// Copyright 2019 The Grafeas Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package grafeas.v1;

option go_package = "google.golang.org/genproto/googleapis/grafeas/v1;grafeas";
option java_multiple_files = true;
option java_package = "io.grafeas.v1";
option objc_class_prefix = "GRA";
option java_outer_classname = "CVSSProto";

// Common Vulnerability Scoring System version 3.
// For details, see https://www.first.org/cvss/specification-document
message CVSSv3 {
  // The base score is a function of the base metric scores.
  float base_score = 1;

  float exploitability_score = 2;

  float impact_score = 3;

  // Base Metrics
  // Represents the intrinsic characteristics of a vulnerability that are
  // constant over time and across user environments.
  AttackVector attack_vector = 5;
  AttackComplexity attack_complexity = 6;
  PrivilegesRequired privileges_required = 7;
  UserInteraction user_interaction = 8;
  Scope scope = 9;
  Impact confidentiality_impact = 10;
  Impact integrity_impact = 11;
  Impact availability_impact = 12;

  enum AttackVector {
    ATTACK_VECTOR_UNSPECIFIED = 0;
    ATTACK_VECTOR_NETWORK = 1;
    ATTACK_VECTOR_ADJACENT = 2;
    ATTACK_VECTOR_LOCAL = 3;
    ATTACK_VECTOR_PHYSICAL = 4;
  }

  enum AttackComplexity {
    ATTACK_COMPLEXITY_UNSPECIFIED = 0;
    ATTACK_COMPLEXITY_LOW = 1;
    ATTACK_COMPLEXITY_HIGH = 2;
  }

  enum PrivilegesRequired {
    PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
    PRIVILEGES_REQUIRED_NONE = 1;
    PRIVILEGES_REQUIRED_LOW = 2;
    PRIVILEGES_REQUIRED_HIGH = 3;
  }

  enum UserInteraction {
    USER_INTERACTION_UNSPECIFIED = 0;
    USER_INTERACTION_NONE = 1;
    USER_INTERACTION_REQUIRED = 2;
  }

  enum Scope {
    SCOPE_UNSPECIFIED = 0;
    SCOPE_UNCHANGED = 1;
    SCOPE_CHANGED = 2;
  }

  enum Impact {
    IMPACT_UNSPECIFIED = 0;
    IMPACT_HIGH = 1;
    IMPACT_LOW = 2;
    IMPACT_NONE = 3;
  }
}

// Common Vulnerability Scoring System.
// For details, see https://www.first.org/cvss/specification-document
// This is a message we will try to use for storing various versions of CVSS
// rather than making a separate proto for storing a specific version.
message CVSS {
  // The base score is a function of the base metric scores.
  float base_score = 1;

  float exploitability_score = 2;

  float impact_score = 3;

  // Base Metrics
  // Represents the intrinsic characteristics of a vulnerability that are
  // constant over time and across user environments.

  // Attack Vector (AV). Defined in CVSS v2, v3, v4.
  AttackVector attack_vector = 4;
  // Attack Complexity (AC). Defined in CVSS v2, v3, v4.
  AttackComplexity attack_complexity = 5;
  // Authentication (Au). Defined in CVSS v2.
  Authentication authentication = 6;
  // Privileges Required (PR). Defined in CVSS v3, v4.
  PrivilegesRequired privileges_required = 7;
  // User Interaction (UI). Defined in CVSS v3, v4.
  UserInteraction user_interaction = 8;
  // Scope (S). Defined in CVSS v3.
  Scope scope = 9;
  // Confidentiality Impact (C). Defined in CVSS v2, v3.
  Impact confidentiality_impact = 10;
  // Integrity Impact (I). Defined in CVSS v2, v3.
  Impact integrity_impact = 11;
  // Availability Impact (A). Defined in CVSS v2, v3.
  Impact availability_impact = 12;
  // Attack Requirements (AT). Defined in CVSS v4.
  AttackRequirements attack_requirements = 13;
  // Vulnerable System Confidentiality Impact (VC). Defined in CVSS v4.
  Impact vulnerable_system_confidentiality_impact = 14;
  // Vulnerable System Integrity Impact (VI). Defined in CVSS v4.
  Impact vulnerable_system_integrity_impact = 15;
  // Vulnerable System Availability Impact (VA). Defined in CVSS v4.
  Impact vulnerable_system_availability_impact = 16;
  // Subsequent System Confidentiality Impact (SC). Defined in CVSS v4.
  Impact subsequent_system_confidentiality_impact = 17;
  // Subsequent System Integrity Impact (SI). Defined in CVSS v4.
  Impact subsequent_system_integrity_impact = 18;
  // Subsequent System Availability Impact (SA). Defined in CVSS v4.
  Impact subsequent_system_availability_impact = 19;
  // Exploit Maturity (E). Defined in CVSS v4.
  ExploitMaturity exploit_maturity = 20;

  // Attack Vector.
  enum AttackVector {
    // Unspecified.
    ATTACK_VECTOR_UNSPECIFIED = 0;
    // Attack Vector: Network (AV:N). Defined in CVSS v2, v3, v4.
    ATTACK_VECTOR_NETWORK = 1;
    // Attack Vector: Adjacent (AV:A). Defined in CVSS v2, v3, v4.
    ATTACK_VECTOR_ADJACENT = 2;
    //  Attack Vector: Local (AV:L). Defined in CVSS v2, v3, v4.
    ATTACK_VECTOR_LOCAL = 3;
    // Attack Vector: Physical (AV:P). Defined in CVSS v3, v4.
    ATTACK_VECTOR_PHYSICAL = 4;
  }

  // Attack Complexity.
  enum AttackComplexity {
    // Unspecified.
    ATTACK_COMPLEXITY_UNSPECIFIED = 0;
    // Low attack complexity (AC:L). Defined in CVSS v2, v3, v4.
    ATTACK_COMPLEXITY_LOW = 1;
    // High attack complexity (AC:H). Defined in CVSS v2, v3, v4.
    ATTACK_COMPLEXITY_HIGH = 2;
    // Medium attack complexity (AC:M). Defined in CVSS v2.
    ATTACK_COMPLEXITY_MEDIUM = 3;
  }

  // Authentication.
  enum Authentication {
    // Unspecified.
    AUTHENTICATION_UNSPECIFIED = 0;
    // Multiple authentication required (Au:M). Defined in CVSS v2.
    AUTHENTICATION_MULTIPLE = 1;
    // Single authentication required (Au:S). Defined in CVSS v2.
    AUTHENTICATION_SINGLE = 2;
    // No authentication required (Au:N). Defined in CVSS v2.
    AUTHENTICATION_NONE = 3;
  }

  // Privileges Required.
  enum PrivilegesRequired {
    // Unspecified.
    PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
    // No privileges required (PR:N). Defined in CVSS v3, v4.
    PRIVILEGES_REQUIRED_NONE = 1;
    // Low privileges required (PR:L). Defined in CVSS v3, v4.
    PRIVILEGES_REQUIRED_LOW = 2;
    // High privileges required (PR:H). Defined in CVSS v3, v4.
    PRIVILEGES_REQUIRED_HIGH = 3;
  }

  // User Interaction.
  enum UserInteraction {
    // Unspecified.
    USER_INTERACTION_UNSPECIFIED = 0;
    // No user interaction required (UI:N). Defined in CVSS v3, v4.
    USER_INTERACTION_NONE = 1;
    // User interaction required (UI:R). Defined in CVSS v3.
    USER_INTERACTION_REQUIRED = 2;
    // Passive user interaction required (UI:P). Defined in CVSS v4.
    USER_INTERACTION_PASSIVE = 3;
    // Active user interaction required (UI:A). Defined in CVSS v4.
    USER_INTERACTION_ACTIVE = 4;
  }

  // Scope.
  enum Scope {
    // Unspecified.
    SCOPE_UNSPECIFIED = 0;
    // Scope: Unchanged (S:U). Defined in CVSS v3.
    SCOPE_UNCHANGED = 1;
    // Scope: Changed (S:C). Defined in CVSS v3.
    SCOPE_CHANGED = 2;
  }

  // Impact.
  enum Impact {
    // Unspecified.
    IMPACT_UNSPECIFIED = 0;
    // High impact (H). Defined in CVSS v3, v4.
    IMPACT_HIGH = 1;
    // Low impact (L). Defined in CVSS v3, v4.
    IMPACT_LOW = 2;
    // No impact (N). Defined in CVSS v2, v3, v4.
    IMPACT_NONE = 3;
    // Partial impact (P). Defined in CVSS v2.
    IMPACT_PARTIAL = 4;
    // Complete impact (C). Defined in CVSS v2.
    IMPACT_COMPLETE = 5;
  }

  // Attack Requirements.
  enum AttackRequirements {
    // Unspecified.
    ATTACK_REQUIREMENTS_UNSPECIFIED = 0;
    // No attack requirements (AT:N). Defined in CVSS v4.
    ATTACK_REQUIREMENTS_NONE = 1;
    // Attack requirements: Present (AT:P). Defined in CVSS v4.
    ATTACK_REQUIREMENTS_PRESENT = 2;
  }

  // Exploit Maturity (E). Defined in CVSS v4.
  enum ExploitMaturity {
    // Unspecified.
    EXPLOIT_MATURITY_UNSPECIFIED = 0;
    // Exploit maturity: Not defined (E:X). Defined in CVSS v4.
    EXPLOIT_MATURITY_NOT_DEFINED = 1;
    // Exploit maturity: Attacked (E:A). Defined in CVSS v4.
    EXPLOIT_MATURITY_ATTACKED = 2;
    // Exploit maturity: Proof-of-concept (E:P). Defined in CVSS v4.
    EXPLOIT_MATURITY_POC = 3;
    // Exploit maturity: Unreported (E:U). Defined in CVSS v4.
    EXPLOIT_MATURITY_UNREPORTED = 4;
  }
}

// CVSS Version.
enum CVSSVersion {
  // Unspecified.
  CVSS_VERSION_UNSPECIFIED = 0;
  // CVSS v2.
  CVSS_VERSION_2 = 1;
  // CVSS v3.
  CVSS_VERSION_3 = 2;
  // CVSS v4.
  CVSS_VERSION_4 = 3;
}