##########################################################################

# $Id$

##########################################################################

#####################################################

## Copyright (c) 2008 Kirk Bauer

## Covered under the included MIT/X-Consortium License:

##    http://www.opensource.org/licenses/mit-license.php

## All modifications and contributions by other persons to

## this script are assumed to have been donated to the

## Logwatch project and thus assume the above copyright

## and licensing terms.  If you want to make contributions

## under your own copyright or a different license this

## must be explicitly stated in the contribution an the

## Logwatch project reserves the right to not accept such

## contributions.  If you have made significant

## contributions to this script and want to claim

## copyright please contact logwatch-devel@lists.sourceforge.net.

#########################################################

$Debug = $ENV{'LOGWATCH_DEBUG'} || 0;

$Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

if ( $Debug >= 5 ) {

    print STDERR "\n\nDEBUG: Inside Identd Filter \n\n";

    $DebugCounter = 1;

}

# This whole NeedNextLine thing is because there are multiple lines that

# go together for these log entries...

$ThisLine = <STDIN>;

while (defined($ThisLine)) {

    if ( $Debug >= 5 ) {

        print STDERR "DEBUG: Line Number " . $DebugCounter . ":\n";

        print STDERR "DEBUG: " . $ThisLine;

    }

    $NeedNextLine = 1;

    if ( ($IP,$Hostname,$Port) = ($ThisLine =~ m/^from: (\d+\.\d+\.\d+\.\d+) \( ([^ ]*) \) for: \d+, (\d+)$/) ) {

        # this means that somebody accessed identd...

        if ( $Debug >= 5 ) {

            print STDERR "DEBUG: Found -Connection From- Line -- Reading another line\n";

            $DebugCounter++;

        }

        if (defined($NextLine = <STDIN>)) {

            if ( $Debug >= 5 ) {

        	print STDERR "DEBUG: Line Number " . $DebugCounter . ":\n";

        	print STDERR "DEBUG: " . $NextLine;

            }

            if ( ($User) = ($NextLine =~ m/^Successful lookup: \d+ , \d+ : ([^ ]+)\.[^ ]+/) ) {

        	if ( $Debug >= 5 ) {

        	    print STDERR "DEBUG: Found -Successful Lookup- line (" . $User . ")\n";

        	}

        	${Identd{$IP}}[0] = $Hostname;

        	${Identd{$IP}}[1]++;

        	push @{${Identd{$IP}}[2]}, $Port;

        	push @{${Identd{$IP}}[3]}, $User;

            }

            else {

        	if ( $Debug >= 5 ) {

        	    print STDERR "DEBUG: No matches... keeping current line.\n";

        	}

        	$ThisLine = $NextLine;

        	$NeedNextLine = 0;

            }

        }

    }

    elsif ( ($IP,$Hostname) = ($ThisLine =~ m/^from: (\d+\.\d+\.\d+\.\d+) \(([^ ]*)\) EMPTY REQUEST$/) ) {

        if ( $Debug >= 5 ) {

            print STDERR "DEBUG: Found -Empty Request- Line\n";

        }

        $Text = "   " . $Hostname . " (" . $IP . ")";

        push @EmptyRequests,$Text;

    }

    elsif ( ($IP,$Hostname,$Name) = ($ThisLine =~ m/^from: (\d+\.\d+\.\d+\.\d+) \(([^ ]*)\) INVALID REQUEST: (.*)$/) ) {

        if ( $Debug >= 5 ) {

            print STDERR "DEBUG: Found -Invalid Request- Line\n";

        }

        $Text = "   " . $Hostname . " (" . $IP . ") - " . $Name;

        push @InvalidRequests,$Text;

    }

    elsif ( $ThisLine =~ m/^Returned: \d+ , \d+ : NO-USER/ ) {

        # Do nothing...

    }

    elsif ( ($Host) = ( $ThisLine =~ /^Connection from ([^ ]+)/ ) ) {

        chomp($Host);

        if (defined($NextLine = <STDIN>)) {

            if ( $Debug >= 5 ) {

        	print STDERR "DEBUG: Line Number " . $DebugCounter . ":\n";

        	print STDERR "DEBUG: " . $NextLine;

            }

            if ( ($Port,$User) = ($NextLine =~ m/^Successful lookup: \d+ , (\d+) : ([^ ]+)/) ) {

        	if ( $Debug >= 5 ) {

        	    print STDERR "DEBUG: Found -Successful Lookup- line (" . $User . ")\n";

        	}

        	chomp($Port); chomp($User);

        	${Identd{$Host}}[0] = $Host;

        	${Identd{$Host}}[1]++;

        	push @{${Identd{$Host}}[2]}, $Port;

        	push @{${Identd{$Host}}[3]}, $User;

            }

            else {

        	if ( $Debug >= 5 ) {

        	    print STDERR "DEBUG: No matches... keeping current line.\n";

        	}

        	$ThisLine = $NextLine;

        	$NeedNextLine = 0;

            }

        }

    }

    elsif ($ThisLine =~ /^Successful lookup: [1234567890]+ , [1234567890]+ : [^ ]+/ ) {

        # skip empty entry ...

    }

    else {

        # Report any unmatched entries...

        if ( $Debug >= 5 ) {

            print STDERR "DEBUG: Found unmatched line\n";

        }

        chomp($ThisLine);

        $OtherList{$ThisLine}++;

    }

    if ($NeedNextLine == 1) {

        $ThisLine = <STDIN>;

    }

}

if ( (keys %Identd) and ($Detail >= 10) ) {

    print "Identd Lookups:\n";

    foreach $ThisOne (keys %Identd) {

        print "   Host: " . ${Identd{$ThisOne}}[0] . " (" . $ThisOne . ") - " . ${Identd{$ThisOne}}[1] . " Connection(s).\n";

    }

}

if (($#EmptyRequests >= 0) and ($Detail >= 5)) {

    print "\nEmpty requests:\n";

    foreach $ThisOne (@EmptyRequests) {

        print "   " . $ThisOne . "\n";

    }

}

if (($#InvalidRequests >= 0) and ($Detail >= 5)) {

    print "\nInvalid requests:\n";

    foreach $ThisOne (@InvalidRequests) {

        print "   " . $ThisOne . "\n";

    }

}

if (keys %OtherList) {

    print "\n**Unmatched Entries**\n";

    foreach $line (sort {$a cmp $b} keys %OtherList) {

        print "$line: $OtherList{$line} Time(s)\n";

    }

}

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et

# Local Variables:

# mode: perl

# perl-indent-level: 3

# indent-tabs-mode: nil

# End: