#!/usr/bin/perl
#
# SmoothWall CGIs
#
# This code is distributed under the terms of the GPL
#
# (c) The SmoothWall Team
#
# Copyright (C) 18-03-2002 Mark Wormgoor <mark@wormgoor.com>
#              - Added links to Snort database and ipinfo.cgi
#
# $Id: ids.dat,v 1.6.2.16 2005/06/14 08:25:30 eoberlander Exp $
#

use strict;

# enable only the following on debugging purpose
#use warnings;
#use CGI::Carp 'fatalsToBrowser';

# Path where the suricata-report-generator binary lives.
my $report_generator_binary = "/usr/bin/suricata-report-generator";

require '/var/ipfire/general-functions.pl';
require "${General::swroot}/ids-functions.pl";
require "${General::swroot}/lang.pl";
require "${General::swroot}/header.pl";

my %color = ();
my %mainsettings = ();
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);

use POSIX();

#workaround to suppress a warning when a variable is used only once
my @dummy = ( ${Header::table1colour}, ${Header::table2colour} );
undef (@dummy);

my %cgiparams=();
my %logsettings=();
my @log=();
my $errormessage = '';

my @shortmonths = ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug',
	'Sep', 'Oct', 'Nov', 'Dec' );
my @longmonths = ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{'march'},
	$Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'}, $Lang::tr{'august'},
	$Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'},
	$Lang::tr{'december'} );

my @now = localtime(time);
my $dow = $now[6];
my $doy = $now[7];
my $tdoy = $now[7];
my $year = $now[5]+1900;

$cgiparams{'DAY'} = $now[3];
$cgiparams{'MONTH'} = $now[4];
$cgiparams{'ACTION'} = '';

&Header::getcgihash(\%cgiparams);
$logsettings{'LOGVIEW_REVERSE'} = 'off';
&General::readhash("${General::swroot}/logging/settings", \%logsettings);
${Header::viewsize} = defined ($logsettings{'LOGVIEW_VIEWSIZE'}) ? $logsettings{'LOGVIEW_VIEWSIZE'} : 150;
$Header::viewsize /= 5;	# each ids is displayed on 5 lines

$now[4] = $cgiparams{'MONTH'}+1;
if($now[4] < 10) {
        $now[4] = "0$now[4]"; }

my $start = -1;
if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'})
{
	my @temp = split(',',$ ENV{'QUERY_STRING'});
 	$start = $temp[0];
 	$cgiparams{'MONTH'} = $temp[1];
 	$cgiparams{'DAY'} = $temp[2];
}

if (!($cgiparams{'MONTH'} =~ /^(0|1|2|3|4|5|6|7|8|9|10|11)$/) ||
        !($cgiparams{'DAY'} =~ /^(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)$/))
{
        $cgiparams{'DAY'} = $now[3];
        $cgiparams{'MONTH'} = $now[4];
}
elsif($cgiparams{'ACTION'} eq '>>')
{
        my @temp_then=();
        my @temp_now = localtime(time);
        $temp_now[4] = $cgiparams{'MONTH'};
        $temp_now[3] = $cgiparams{'DAY'};
        @temp_then = localtime(POSIX::mktime(@temp_now) + 86400);
           ## Retrieve the same time on the next day +
           ## 86400 seconds in a day
        $cgiparams{'MONTH'} = $temp_then[4];
        $cgiparams{'DAY'} = $temp_then[3];
}
elsif($cgiparams{'ACTION'} eq '<<')
{
        my @temp_then=();
        my @temp_now = localtime(time);
        $temp_now[4] = $cgiparams{'MONTH'};
        $temp_now[3] = $cgiparams{'DAY'};
        @temp_then = localtime(POSIX::mktime(@temp_now) - 86400);
           ## Retrieve the same time on the previous day -
           ## 86400 seconds in a day
        $cgiparams{'MONTH'} = $temp_then[4];
        $cgiparams{'DAY'} = $temp_then[3];
}


if (($cgiparams{'DAY'} ne $now[3]) || ($cgiparams{'MONTH'} ne $now[4]))
{
	my @then = ();
	if ( (  $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) ||
			( $cgiparams{'MONTH'} > $now[4] ) ) {
		@then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1901 ));
	} else {
		@then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1900 ));
	}
	$tdoy = $then[7];
	my $lastleap=($year-1)%4;
        if ($tdoy>$doy) {
		if ($lastleap == 0 && $tdoy < 60) {
			$doy=$doy+366;
		} else {
			$doy=$doy+365;
		}
	}
}
my $datediff=0;
my $dowd=0;
my $multifile=0;
if ($tdoy ne $doy) {
	$datediff=int(($doy-$tdoy)/7);
	$dowd=($doy-$tdoy)%7;
        if (($dow-$dowd)<1) {
		$datediff=$datediff+1;
	}
	if (($dow-$dowd)==0) {
		$multifile=1;
	}
}

my $longmonthstr = $longmonths[$cgiparams{'MONTH'}];
my $monthnum = $cgiparams{'MONTH'} + 1;
my $monthstr = $monthnum <= 9 ? "0$monthnum" : "$monthnum";
my $daystr = $cgiparams{'DAY'} <= 9 ? "0$cgiparams{'DAY'}" : "$cgiparams{'DAY'}";

my $lines = 0;
my ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);

&processevent;

if ($multifile) {
	$datediff=$datediff-1;
	&processevent;
}

if ($cgiparams{'ACTION'} eq $Lang::tr{'export'})
{
	print "Content-type: text/plain\n\n";
	print "IPFire IPS log\r\n";
	print "Date: $cgiparams{'DAY'} $longmonths[$cgiparams{'MONTH'}]\r\n";
	print "\r\n";

	if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @log = reverse @log; }

	foreach $_ (@log)
	{
		my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\|/);
		$refs =~ s/,$//;

		# Skip event if no datetime and title are available.
		next unless (($datetime) && ($title));

		print "Date: $datetime\n";
		print "Name: $title\n";
		print "Priority: $priority\n";
		print "Type: $classification\n";
		print "IP Info: ";
		print "$srcip";
		if ($srcport != "n/a") {
			print ":$srcport";
		}
		print " -> ";
		print "$destip";
		if ($destport != "n/a") {
			print ":$destport";
		}
		print "\n";
		print "SID: $sid\n";
		print "Refs: $refs\n\n";
	}

	exit;
}

if ($cgiparams{'ACTION'} eq "$Lang::tr{'download report'}") {
	# Array which contains the report-generator command and it's arguments.
	my @report_cmd = ("$report_generator_binary", "--output=-");

	# Filename for the generated report.
	my $filename = "suricata-report";
	my $file_extension = "pdf";

	# Assign easy to access variables.
	my $day = $cgiparams{'DAY'};
	my $month = $cgiparams{'MONTH'} + 1;
	my $year = $year;

	# Calculate the year value.
	#
	# Check if the given day and/or month is different from today.
	if (($day ne $now[3]) || ($month ne $now[4])) {
		# Check if the given date is in the future.
		if (($month eq $now[4]) && ($day > $now[3]) || ($month > $now[4] )) {
			# Assume we are looking for data from the past year.
			$year = $year-1;
		}
	}

	# Append the date
	push(@report_cmd, "--day=$day", "--month=$month", "--year=$year");

	# Check if there has been any error.
	unless ($errormessage) {
		# Call the suricata-report-generator binary and return it's output.
		my @report = &General::system_output(@report_cmd);

		# Send addition HTTP headers to the client and the generated report.
		print "Content-Type:application/x-download\n";
		print "Content-Disposition:attachment;filename=$filename.$file_extension\n\n";
		print @report;

		# Exit gracefully.
		exit (0);
	}
}

&Header::showhttpheaders();

&Header::openpage($Lang::tr{'ids log viewer'}, 1, '');

&Header::openbigbox('100%', 'left', '', $errormessage);

if ($errormessage) {
	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
	print "<font class='base'>$errormessage&nbsp;</font>\n";
	&Header::closebox();
}

&Header::openbox('100%', 'left', "$Lang::tr{'settings'}:");

print <<END
<form method='post' action="$ENV{'SCRIPT_NAME'}">
<table width='100%'>
<tr>
	<td width='10%' class='base'>$Lang::tr{'month'}:&nbsp;</td>
	<td width='10%'>
	<select name='MONTH'>
END
;
for (my $month = 0; $month < 12; $month++)
{
	print "\t<option ";
	if ($month == $cgiparams{'MONTH'}) {
		print 'selected="selected" '; }
	print "value='$month'>$longmonths[$month]</option>\n";
}
print <<END
	</select>
	</td>
	<td width='10%' class='base' align='right'>&nbsp;$Lang::tr{'day'}:&nbsp;</td>
	<td width='30%'>
	<select name='DAY'>
END
;
for (my $day = 1; $day <= 31; $day++)
{
	print "\t<option ";
	if ($day == $cgiparams{'DAY'}) {
		print 'selected="selected" '; }
	print "value='$day'>$day</option>\n";
}
print <<END
	</select>
	</td>
	<td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day before'}' value='&lt;&lt;' /></td>
        <td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day after'}' value='&gt;&gt;' /></td>
	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'update'}' /></td>
	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'export'}' /></td>
	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'download report'}' /></td>
</tr>
</table>
</form>
END
;

&Header::closebox();

&Header::openbox('100%', 'left', $Lang::tr{'log'});
print "<p><b>$Lang::tr{'ids log hits'} $longmonthstr $daystr: $lines</b></p>";

if ($start == -1) {
        $start = $lines - ${Header::viewsize}; }
if ($start >= $lines - ${Header::viewsize}) { $start = $lines - ${Header::viewsize}; };
if ($start < 0) { $start = 0; }

my $prev = $start - ${Header::viewsize};
my $next = $start + ${Header::viewsize};

if ($prev < 0) { $prev = 0; }
if ($next >= $lines) { $next = -1 }
if ($start == 0) { $prev = -1; }
my @slice = splice(@log, $start, ${Header::viewsize});

if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @slice = reverse @slice; }

if ($lines != 0) {

&oldernewer();

$lines = 0;

print <<END
<table width='100%'>
END
;

foreach $_ (@slice)
{
	if ($lines % 2) {
		print "<tr bgcolor='$color{'color20'}'><td>\n"; }
	else {
		print "<tr bgcolor='$color{'color22'}'><td>\n"; }
	my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\|/);

	# Only show the current event if at least datetime and title are available.
	next unless (($datetime) && ($title));

	print <<END
<table width='100%'>
<tr>
<td width='15%'><b>$Lang::tr{'date'}:</b></td><td width='25%'>$datetime</td>
<td width='10%'><b>$Lang::tr{'name'}:</b></td><td width='50%'>$title</td>
</tr>
<tr><td><b>$Lang::tr{'priority'}:</b></td><td>$priority</td>
<td><b>$Lang::tr{'type'}:</b></td><td>$classification</td>
</tr>
<tr><td><b>$Lang::tr{'ipinfo'}:</b></td>
<td colspan='3'>
END
	;
	if ($srcip ne "n/a") {
		print "<a href='/cgi-bin/ipinfo.cgi?ip=$srcip'>$srcip</a>";
	} else {
		print "$srcip";
	}
	print ":$srcport -&gt; ";
	if ($destip ne "n/a") {
		print "<a href='/cgi-bin/ipinfo.cgi?ip=$destip'>$destip</a>";
	} else {
		print "$destip";
	}
	print ":$destport";
print <<END
</td>
</tr>
<tr><td valign='top'><b>$Lang::tr{'references'}:</b></td><td valign='top'>
END
;
	foreach my $ref (split(/,/,$refs)) {
		if ($ref =~ m/url (.*)/) {
			print "<a href='http://$1'>$1</a><br />";
		} elsif ($ref =~ m/cve (.*)/) {
			print "<a href='http://cve.mitre.org/cgi-bin/cvename.cgi?name=$1'>$1</a><br />";
		} elsif ($ref =~ m/nessus (.*)/) {
			print "<a href='http://cgi.nessus.org/plugins/dump.php3?id=$1'>Nessus $1</a><br />";
		} elsif ($ref =~ m/bugtraq (.*)/) {
			print "<a href='http://www.securityfocus.com/bid/$1'>Bugtraq $1</a><br />";
		} else {
			print "$ref<br />";
		}
	}
	print $Lang::tr{'none found'} unless $refs =~ /,/;
print <<END
<td valign='top'><b>SID:</b></td>
<td valign='top'>
END
	;

	# Check if an valid sid has been found.
	if ($sid ne "n/a") {
		# Try to get the info url for the sid.
		my $info_url = &IDS::get_sid_info_url($sid);

		# Check if an url has been obtained.
		if ($info_url) {
			print "<a href='$info_url' ";
			print "target='_blank'>$sid</a>\n";
		} else {
			# No external link available.
			print $sid;
		}
	} else {
		# No external link for user defined rules
		print $sid;
	}
print <<END
</td>
</tr>
</table><br>
</td></tr>
END
	;
	$lines++;
}

print "</table>";

}

&oldernewer();

&Header::closebox();

&Header::closebigbox();

&Header::closepage();

sub processevent
{
	our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);

	my $filestr='';
	if ($datediff==0) {
		# If there is no datediff, directly assign the suricata fast.log.
		$filestr="/var/log/suricata/fast.log";
	} else {
		# If there is a datediff, assign the datediff to the filestring.
		$filestr="/var/log/suricata/fast.log.$datediff";

		# The files are compressed add the extension to the filestring.
		$filestr="$filestr.gz";

		# If the file does not exist, try to fallback to legacy snort alert file.
		unless (-f $filestr) {
			# Assign snort alert file, the datediff and extension for compressed file.
			$filestr = "/var/log/snort/alert.$datediff";
			$filestr = "$filestr.gz";
		}
	}
	if (!(open (LOG,($filestr =~ /.gz$/ ? "gzip -dc $filestr |" : $filestr)))) {
		$errormessage="$errormessage$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}";
	} else {
		my $line = 0;

		while(<LOG>) {
			$line++;
			if ($_ =~ m/\[\*\*\]/) {
				unless ($line == 1 || $date ne "$monthstr/$daystr") {
					&append;
					$line = 1;
				}
				($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport,$sid) = ("n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a", "n/a");
				@refs = ();
				$_ =~ m/:([0-9]{1,10})\] (.*) \[\*\*\]/;
				$title = &Header::escape($2);
			}
			if ($_ =~ m/Classification: (.*)\] \[Priority: (\d)\]/) {
				$classification = &Header::escape($1);
				$priority = $2;
			}
			if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/) {
				$srcip = $1 . "." . $2 . "." . $3 . "." . $4;
				$destip = $5 . "." . $6 . "." . $7 . "." . $8;
			}
			if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6})/) {
				$srcip = $1 . "." . $2 . "." . $3 . "." . $4;
				$srcport = $5;
				$destip = $6 . "." . $7 . "." . $8 . "." . $9;
				$destport = $10;
			}

			if ($_  =~ m/^([0-9\/]{3,5})(\/\d+)?\-([0-9\:]{5,8})\.([0-9]{1,14})/) {
				($date,$time) = ($1,$3);
			}
			if ($_ =~ m/\[Xref \=\>.*\]/) {
				$_ =~ s/\]\[Xref \=\> /, /g;
				$_ =~ m/\[Xref \=\> (.*)\]/;
				push(@refs, $1);
			}
			if ($_ =~ m/\[1:([0-9]+):[0-9]+\]/) {
				$sid = $1;
			}
		}
		$line++;

		# Check if all data is collected and the date of the event fits the desired date to
		# get displayed.
		if ($line gt 1 && $date eq "$monthstr/$daystr") { &append; }

		close(LOG);
	}
}

sub append
{
	our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);

	$log[$lines] = "$date $time|$title|$priority|$classification|$srcip|$srcport|$destip|$destport|$sid|";
	foreach $_ (@refs) {
		$log[$lines] = "$log[$lines]$_,"; }
	$lines++;
}

sub oldernewer
{
print <<END
<table width='100%'>
<tr>
END
;

print "<td align='center' width='50%'>";
if ($prev != -1) {
        print "<a href='/cgi-bin/logs.cgi/ids.dat?$prev,$cgiparams{'MONTH'},$cgiparams{'DAY'}'>$Lang::tr{'older'}</a>"; }
else {
        print "$Lang::tr{'older'}"; }
print "</td>\n";

print "<td align='center' width='50%'>";
if ($next != -1) {
        print "<a href='/cgi-bin/logs.cgi/ids.dat?$next,$cgiparams{'MONTH'},$cgiparams{'DAY'}'>$Lang::tr{'newer'}</a>"; }
else {
        print "$Lang::tr{'newer'}"; }
print "</td>\n";

print <<END
</tr>
</table>
END
;
}