#!/usr/bin/perl -w

##########################################################################

# $Id: mod_security2, v 1.0.1 2013/01/11

##########################################################################

#

# Revision 1.0.1   2013/01/11

# fixed problem with uninitialized values #6

#

##########################################################################

# This script is written an maintained by:

#   Torben Hansen <derhansen@gmail.com>

#

# To send comments, suggestions, bugreports, etc, please use:

#   https://github.com/derhansen/logwatch-modsec2

##########################################################################

##########################################################################

# Copyright © 2013 Torben Hansen <derhansen@gmail.com>

#

# Permission is hereby granted, free of charge, to any person obtaining a

# copy of this software and associated documentation files (the

# “Software”), to deal in the Software without restriction, including

# without limitation the rights to use, copy, modify, merge, publish,

# distribute, sublicense, and/or sell copies of the Software, and to

# permit persons to whom the Software is furnished to do so, subject to

# the following conditions:

#

# The above copyright notice and this permission notice shall be included

# in all copies or substantial portions of the Software.

#

# THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS

# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANT-

# ABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO

# EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,

# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR

# THE USE OR OTHER DEALINGS IN THE SOFTWARE.

#

##########################################################################

use Logwatch ':dates';

# Disable warnings about unused variables

no warnings qw(once);

my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;

my $SearchDate = TimeFilter('%d/%b/%Y:%H:%M:%S');

my $within_range = 0;

my %tmpEntry = ();

my $count = 0;

my %messages = ();

my %topips = ();

my %toprules = ();

my $check = 0;

my $option = '';

if ( $Debug >= 5 ) {

    print STDERR "\n\nDEBUG MODE \n\n";

}

# Initialize array

$tmpEntry{$count}{"action"} = "";

$tmpEntry{$count}{"hostname"} = "";

$tmpEntry{$count}{"message"} = "";

$tmpEntry{$count}{"ruleid"} = "";

while (defined($ThisLine = <STDIN>)) {

    chomp($ThisLine);

    # Reset $check if line starts with two dashes

    if ( $ThisLine =~ /-[A-Z]--/ ) {

        $check = 0;

        $option = "";

    }

    if ($check == 1) {

        if ($option eq "audit-log-header") {

            ($timestamp, $transactionID, $sourceIP, $sourcePort, $destIP, $destPort ) = ($ThisLine =~ /\[(.*?)\] (.*?) (.*?) (.*?) (.*?) (.*?)$/ );

            $tmpEntry{$count}{"timestamp"} = $timestamp;

            $tmpEntry{$count}{"sourceIp"} = $sourceIP;

            $tmpEntry{$count}{"sourcePort"} = $sourcePort;

            $tmpEntry{$count}{"destIp"} = $destIP;

            $tmpEntry{$count}{"destPort"} = $destPort;

            if ( $Debug >= 5 ) {

                print STDERR "\n";

                print STDERR "DATE: " . $timestamp . "\n";

                print STDERR "FROM: ". $sourceIP . ":" . $sourcePort . "\n";

                print STDERR "TO: ". $destIP . ":" . $destPort . "\n";

            }

        }

        if ($option eq "request-header") {

            if ( ($method, $requestUri) = ($ThisLine =~ /^(POST|GET) (.*?)$/) ) {

                $tmpEntry{$count}{"method"} = $method;

                $tmpEntry{$count}{"uri"} = $requestUri;

                if ( $Debug >= 5 ) {

                    print STDERR "METHOD: " . $method . "\n";

                    print STDERR "URI: " . $requestUri . "\n";

                }

            }

            elsif ( ($hostname) = ($ThisLine =~ /^Host: (.*?)$/) ) {

                $tmpEntry{$count}{"hostname"} = $hostname;

                if ( $Debug >= 5 ) {

                    print STDERR "HOST: " . $hostname . "\n";

                }

            }

        }

        if ($option eq "audit-log-trailer") {

            if ( $ThisLine =~ /^Message:/ ) {

                if ( ($ruleId) = ($ThisLine =~ /\[id \"(.*?)\"\]/) ) {

                    if ( $Debug >= 5 ) {

                        print STDERR "Rule ID: " . $ruleId. "\n";

                    }

                }

                if ( ($msg) = ($ThisLine =~ /\[msg \"(.*?)\"\]/) ) {

                    if ( $Debug >= 5 ) {

                        print STDERR "Message: " . $msg. "\n";

                    }

                }

                $tmpEntry{$count}{"ruleid"} = $ruleId;

                $tmpEntry{$count}{"message"} = $msg;

            }

            if ( ($action) = ($ThisLine =~ /^Action: (.*?)$/) ) {

                $tmpEntry{$count}{"action"} = $action;

                if ( $Debug >= 5 ) {

                    print STDERR "Action: " . $action. "\n";

                }

            }

            if ( ($engineMode) = ($ThisLine =~ /^Engine-Mode: (.*?)$/) ) {

                $tmpEntry{$count}{"engine"} = $engineMode;

                if ( $Debug >= 5 ) {

                    print STDERR "Engine mode: " . $engineMode. "\n";

                }

            }

        }

    }

    if ( $ThisLine =~ /-A--/ ) {

        $check = 1;

        $option = "audit-log-header";

    }

    elsif ( $ThisLine =~ /-B--/ ) {

        $check = 1;

        $option = "request-header";

    }

    elsif ( $ThisLine =~ /-H--/ ) {

        $check = 1;

        $option = "audit-log-trailer";

    }

    elsif ( $ThisLine =~ /-Z--/ ) {

        $check = 0;

        $option = "";

        # Create new summary entry if date matches searchdate

        if ( $tmpEntry{$count}{"timestamp"} =~ /$SearchDate/ ) {

            if (  $tmpEntry{$count}{"action"} ne "" && $tmpEntry{$count}{"hostname"} ne "" && $tmpEntry{$count}{"message"} ne "" && $tmpEntry{$count}{"ruleid"} ne "" ) {

                $messages{$tmpEntry{$count}{"hostname"}}{"numAttacks"}++;

                $messages{$tmpEntry{$count}{"hostname"}}{"attack"}{$tmpEntry{$count}{"sourceIp"}}{$tmpEntry{$count}{"ruleid"}} =  $tmpEntry{$count}{"message"};

                $messages{$tmpEntry{$count}{"hostname"}}{$tmpEntry{$count}{"sourceIp"}}{$tmpEntry{$count}{"ruleid"}}++;

                $topips{$tmpEntry{$count}{"sourceIp"}}++;

                $toprules{$tmpEntry{$count}{"ruleid"}}++;

            }

        }

        # Increase counter

        $count++;

        # Reset values

        $tmpEntry = ();

        $tmpEntry{$count}{"action"} = "";

        $tmpEntry{$count}{"hostname"} = "";

        $tmpEntry{$count}{"message"} = "";

        $tmpEntry{$count}{"ruleid"} = "";

        if ( $Debug >= 5 ) {

            print STDERR "---------------------------------------\n";

        }

    }

}

# Start summary

if (keys %messages) {

   print "\nATTACKS BLOCKED ON VHOSTS:\n";

   foreach my $vhost ( sort {$a cmp $b} keys %messages ) {

        print "\n" . $vhost . " - " . $messages{$vhost}{"numAttacks"} . " time(s)\n";

        foreach my $fromip (sort {$a cmp $b} keys %{$messages{$vhost}{"attack"}}) {

            foreach my $ruleid (sort {$a cmp $b} keys %{$messages{$vhost}{"attack"}{$fromip}}) {

                print "  [ip: " . sprintf("%-15s", $fromip) . "] ";

                print "[id: " . $ruleid . " ] [msg: " . $messages{$vhost}{"attack"}{$fromip}{$ruleid} . "] ";

                print " - " . $messages{$vhost}{$fromip}{$ruleid} . " time(s)\n";

            }

        }

   }

}

# Top 10 blocked IPs

if (keys %topips) {

   print "\nTOP 10 BLOCKED IPS:\n";

   my $cnt = 0;

   foreach my $ip ( sort {$topips{$b} <=> $topips{$a}} keys %topips ) {

        print "\n  " . sprintf("%2s", ($cnt + 1)) . ". " . $ip . " - " . $topips{$ip} . " time(s)";

        $cnt++;

        if($cnt == 10) { last(); }

   }

   print "\n";

}

exit(0)