# 1️⃣ Create a virtual environment (recommended)
python3 -m venv .venv
source .venv/bin/activate   # on Windows: .venv\Scripts\activate

# 2️⃣ Install dependencies
pip install --upgrade pip
pip install requests python-dotenv tqdm

# 1️⃣ Initialise a new npm project
npm init -y
# (or yarn init -y)

# 2️⃣ Install core libs
npm install axios dotenv   # axios for HTTP, dotenv for env vars
# For TypeScript support
npm install --save-dev typescript @types/node ts-node
npx tsc --init   # creates tsconfig.json (adjust as needed)

#!/usr/bin/env python3
"""
check_patch.py
Verifies that a Check Point Management Server or Gaia device reports the
patched VPN version that mitigates CVE‑2024‑xxxx.

Usage:
    export CP_MGMT_HOST="mgmt.example.com"
    export CP_API_KEY="<your-api-key>"
    python check_patch.py
"""
import os
import sys
import json
import logging
from typing import Tuple

import requests
from dotenv import load_dotenv
from tqdm import tqdm   # optional progress bar for demo purposes

# ----------------------------------------------------------------------
# Configuration (loaded from .env or environment)
# ----------------------------------------------------------------------
load_dotenv()  # reads .env file into os.environ

CP_MGMT_HOST = os.getenv("CP_MGMT_HOST")          # e.g. "mgmt.example.com"
CP_API_KEY   = os.getenv("CP_API_KEY")            # API key generated via mgmt_cli
CP_USER      = os.getenv("CP_USER")               # optional: username/password auth
CP_PASSWORD  = os.getenv("CP_PASSWORD")

# The version string that indicates the patch is present.
# Replace with the exact string from the Check Point sk/article.
PATCHED_VERSION = "R80.40 Jumbo Hotfix Accumulator 123"

# ----------------------------------------------------------------------
# Logging setup
# ----------------------------------------------------------------------
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(name)s - %(message)s",
    datefmt="%Y-%m-%d %H:%M:%S",
)
log = logging.getLogger("checkpoint-patch")

# ----------------------------------------------------------------------
# Helper functions
# ----------------------------------------------------------------------
def build_base_url() -> str:
    """Construct the base URL for the Check Point Management API."""
    # The API always lives under /web_api
    return f"https://{CP_MGMT_HOST}/web_api"

def auth_headers() -> dict:
    """Return HTTP headers for authentication.
    Prefer API‑key; fall back to basic auth if needed.
    """
    if CP_API_KEY:
        return {"Content-Type": "application/json", "X-Chkp-SID": CP_API_KEY}
    if CP_USER and CP_PASSWORD:
        # This example uses token login; you could also use basic auth.
        raise RuntimeError("Username/password flow not shown – use API key for simplicity.")
    raise RuntimeError("No authentication credentials provided.")

def get_version() -> Tuple[bool, str]:
    """
    Call /show-version and return (success, version_string).
    On failure, success=False and version_string contains error info.
    """
    url = f"{build_base_url()}/show-version"
    try:
        resp = requests.get(
            url,
            headers=auth_headers(),
            verify=False,  # Set to True in prod; use proper CA bundle.
            timeout=10,
        )
        resp.raise_for_status()
        data = resp.json()
        version = data.get("version", "").strip()
        log.info(f"Retrieved version: {version!r}")
        return True, version
    except requests.RequestException as exc:
        log.error(f"HTTP request failed: {exc}")
        return False, str(exc)
    except (KeyError, json.JSONDecodeError) as exc:
        log.error(f"Failed to parse response: {exc}")
        return False, str(exc)

def is_patched(version: str) -> bool:
    """
    Simple substring check – adjust as needed for your version scheme.
    """
    return PATCHED_VERSION in version

def main() -> int:
    """Entry point – returns 0 if patched, 1 otherwise."""
    if not CP_MGMT_HOST:
        log.error("Environment variable CP_MGMT_HOST is missing.")
        return 1

    # Show a tiny progress bar just for demo; remove in production.
    for _ in tqdm(range(1), desc="Checking patch status", unit="step"):
        ok, version_or_err = get_version()
        if not ok:
            log.error(f"Unable to retrieve version: {version_or_err}")
            return 1

        patched = is_patched(version_or_err)
        if patched:
            log.info("✅ Patch detected – system is up‑to‑date.")
            return 0
        else:
            log.warning(
                f"⚠️ Patch NOT detected. Current version: {version_or_err!r} "
                f"(expected to contain {PATCHED_VERSION!r})"
            )
            return 1

if __name__ == "__main__":
    sys.exit(main())

export CP_MGMT_HOST="mgmt.corp.example.com"
export CP_API_KEY="abcd1234-ef56-7890-abcd-ef1234567890"
python check_patch.py

/**
 * check-patch.ts
 * Verifies that a Check Point Management Server or Gaia device reports the
 * patched VPN version that mitigates CVE‑2024‑xxxx.
 *
 * Prerequisites:
 *   - Node.js >=18
 *   - .env file with CP_MGMT_HOST and CP_API_KEY (or CP_USER/CP_PASSWORD)
 *
 * Run:
 *   npm install axios dotenv
 *   npx ts-node check-patch.ts
 */

import axios, { AxiosInstance, AxiosResponse } from "axios";
import * as dotenv from "dotenv";
import { log, info, warn, error } from "console"; // simple logging; replace with winston/pino in prod

dotenv.config();

// -------------------------- Configuration --------------------------
const CP_MGMT_HOST: string | undefined = process.env.CP_MGMT_HOST;
const CP_API_KEY: string | undefined = process.env.CP_API_KEY;
const CP_USER: string | undefined = process.env.CP_USER;
const CP_PASSWORD: string | undefined = process.env.CP_PASSWORD;

// Version string that signals the patch is present (update per advisory)
const PATCHED_VERSION = "R80.40 Jumbo Hotfix Accumulator 123";

if (!CP_MGMT_HOST) {
  error("Missing CP_MGMT_HOST environment variable");
  process.exit(1);
}

// -------------------------- HTTP client --------------------------
const baseURL = `https://${CP_MGMT_HOST}/web_api`;

const client: AxiosInstance = axios.create({
  baseURL,
  timeout: 10_000,
  // In production, set `verify` to true and provide proper CA bundle.
  // For self‑signed dev certs:
  httpsAgent: undefined, // let Node decide; you can inject a custom agent if needed.
});

// Attach auth header (API‑key preferred)
if (CP_API_KEY) {
  client.defaults.headers.common["X-Chkp-SID"] = CP_API_KEY;
} else if (CP_USER && CP_PASSWORD) {
  // Example of basic auth – you could also perform a login call first.
  client.defaults.auth = { username: CP_USER, password: CP_PASSWORD };
} else {
  error("No authentication credentials provided (API key or user/pass).");
  process.exit(1);
}

// -------------------------- Helper functions --------------------------
async function getVersion(): Promise<{ success: boolean; versionOrError: string }> {
  try {
    const resp: AxiosResponse = await client.get("/show-version");
    const version: string = resp.data.version?.trim() ?? "";
    info(`Retrieved version: "${version}"`);
    return { success: true, versionOrError: version };
  } catch (err: any) {
    if (axios.isAxiosError(err)) {
      error(`HTTP error: ${err.message}`);
      return { success: false, versionOrError: err.message };
    }
    error(`Unexpected error: ${err}`);
    return { success: false, versionOrError: String(err) };
  }
}

function isPatched(version: string): boolean {
  // Simple substring check – replace with semver logic if needed.
  return version.includes(PATCHED_VERSION);
}

// -------------------------- Main --------------------------
(async () => {
  const { success, versionOrError } = await getVersion();
  if (!success) {
    error(`Failed to obtain version: ${versionOrError}`);
    process.exit(1);
  }

  const patched = isPatched(versionOrError);
  if (patched) {
    info("✅ Patch detected – system is up‑to‑date.");
    process.exit(0);
  } else {
    warn(
      `⚠️ Patch NOT detected. Current version: "${versionOrError}" ` +
        `(expected to contain "${PATCHED_VERSION}")`
    );
    process.exit(1);
  }
})();

export CP_MGMT_HOST="mgmt.corp.example.com"
export CP_API_KEY="abcd1234-ef56-7890-abcd-ef1234567890"
npx ts-node check-patch.ts
# or compile first:
# npx tsc && node dist/check-patch.js

CP_MGMT_HOST=mgmt.corp.example.com
CP_API_KEY=a1b2c3d4-5678-90ab-cdef-1234567890ab
# CP_USER=admin
# CP_PASSWORD=superSecret!

from tenacity import retry, stop_after_attempt, wait_exponential, retry_if_exception_type
import requests

@retry(
    reraise=True,
    stop=stop_after_attempt(3),
    wait=wait_exponential(multiplier=1, min=2, max=10),
    retry=retry_if_exception_type(requests.RequestException),
)
def safe_get(url: str, **kwargs) -> requests.Response:
    return requests.get(url, **kwargs)

import axios from "axios";
import { retry } from "axios-retry";

const api = axios.create({ baseURL, timeout: 8000 });
retry(api, { retries: 3, retryDelay: (retryCount) => Math.pow(2, retryCount) * 1000 });

import requests, socket, sys
host = sys.argv[1] if len(sys.argv) > 1 else "mgmt.example.com"
port = 443
try:
    sock = socket.create_connection((host, port), timeout=5)
    sock.close()
    print(f"TCP {host}:{port} reachable")
except OSError as e:
    print(f"TCP connect failed: {e}")

# Try a GET with insecure TLS to see if we get a response
try:
    r = requests.get(f"https://{host}/web_api/show-version", verify=False, timeout=5)
    print(f"HTTP status: {r.status_code}")
    print(r.text[:200])
except Exception as e:
    print(f"Request error: {e}")