##########################################################################
# $Id$
##########################################################################
# $Log: pix,v $
# Revision 1.4  2008/06/30 23:07:51  kirk
# fixed copyright holders for files where I know who they should be
#
# Revision 1.3  2008/03/24 23:31:26  kirk
# added copyright/license notice to each script
#
# Revision 1.2  2007/02/16 03:30:55  bjorn
# Change to Unix text, without CR/LF, by Ivana Varekova.
#
# Revision 1.1  2006/12/20 04:24:07  bjorn
# New script for cisco pix files, written by Bob Hendry.
#
##########################################################################

#######################################################
## Copyright (c) 2008 Bob Hendry
## Covered under the included MIT/X-Consortium License:
##    http://www.opensource.org/licenses/mit-license.php
## All modifications and contributions by other persons to
## this script are assumed to have been donated to the
## Logwatch project and thus assume the above copyright
## and licensing terms.  If you want to make contributions
## under your own copyright or a different license this
## must be explicitly stated in the contribution an the
## Logwatch project reserves the right to not accept such
## contributions.  If you have made significant
## contributions to this script and want to claim
## copyright please contact logwatch-devel@lists.sourceforge.net.
#########################################################

use Logwatch ':all';
##########################################################################
# Apply date for Cisco PIX
##########################################################################

use POSIX qw(strftime);
use Logwatch ':dates';

$SearchDate = TimeFilter('%b %e %H:%M:%S');

$Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
$Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

if ( $Debug >= 5 ) {
    print STDERR "\n\nDEBUG: Inside PIX  Filter \n\n";
    $DebugCounter = 1;
}

my ($month,$day,$time,$host,$process,$conn,$msg);

while (defined($ThisLine = <STDIN>)) {
    if ($ThisLine =~ m/^$SearchDate/o) { # added

    if ( $Debug >= 30 ) {
        print STDERR "DEBUG($DebugCounter): $ThisLine";
        $DebugCounter++;
    }

($month,$day,$time,$host,$process,$conn,$msg)=split(/ +/,$ThisLine,7);

   if ( ($ThisLine =~ /(ISDN-6-.+)/ ) or
         ($ThisLine =~ /Copyright/ ) or
         ($ThisLine =~ /Cisco Internetwork Operating System Software/ ) or
         ($ThisLine =~ /IOS \(tm\)/ ) or
         ($ThisLine =~ /TAC:Home:SW:IOS:Specials/ )
    ) {
      # don't care about this, will code this later
   }

   elsif ( $ThisLine =~ /%PIX-4-106023:/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*PIX-4-106023: Deny //;
      $testline =~ s/\[0x0, 0x0\]//;
      $testline =~ s/"/ /g;
      $testline =~ s/by access-group//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      @testfields = split(' ',$testline);
      $accesslist = @testfields[$#testfields];
      $action = "Deny";
      $protocol = @testfields[0];
      if ($protocol =~ /(tcp|udp)/) {
         $source = @testfields[3];
         $destination = @testfields[7];
         $icmp_type = "";
         $count = 1;
         $source_ip = @testfields[3];
         $source_port = @testfields[4];
         $destination_ip = @testfields[7];
         $destination_port = @dfields[8];
      } elsif ($protocol =~ /icmp/) {
         $source = @testfields[3];
         $destination = @testfields[7];
         $icmp_type = @testfields[8];
         $count = 1;
         $source_ip = @testfields[3];
         $destination_ip = @testfields[7];
      } elsif ($protocol =~ /41/) { #IPv6
         $source = @testfields[3];
         $destination = @testfields[7];
         $icmp_type = "";
         $count = 1;
         $source_ip = @testfields[3];
         $source_port = @testfields[4];
         $destination_ip = @testfields[7];
         $destination_port = @dfields[8];
      } else {
         $count = 0;
      }
      $ACL{$accesslist} += $count;
      $ACTION{$action} += $count;
      $packets += $count;
      if ( ($destination_port == 22) and ($protocol =~ /TCP|tcp/) ) {
         $SSH{$source_ip} += $count;
         $SSH_packets += $count;
      }
      if ( ($destination_port == 23) and ($protocol =~ /TCP|tcp/) ) {
         $TELNET{$source_ip} += $count;
         $TELNET_packets += $count;
      }
   }
   elsif ($ThisLine =~ /%PIX-6-106100:/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-106100://;
      $testline =~ s/ ->//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $accesslist = @testfields[1];
      $action = @testfields[2];
      $protocol = @testfields[3];
      if ($protocol =~ /(TCP|UDP|tcp|udp)/) {
         $count = 1;
         $source_ip = @testfields[5];
         $source_port = @testfields[6];
         $destination_ip = @testfields[8];
         $destination_port = @testfields[9];
      } elsif ($protocol =~ /icmpv6/) {
         # not implemented
      } else {
         $count = 0;
      }
      $ACL{$accesslist} += $count;
      $ACTION{$action} += $count;
      $packets += $count;
      if ( ($destination_port == 22) and ($protocol =~ /TCP|tcp/) ) {
         $SSH{$source_ip} += $count;
         $SSH_packets += $count;
      }
      if ( ($destination_port == 23) and ($protocol =~ /TCP|tcp/) ) {
         $TELNET{$source_ip} += $count;
         $TELNET_packets += $count;
      }
      if ( ($destination_port == 21) and ($protocol =~ /TCP|tcp/) ) {
         $FTP{$source_ip} += $count;
         $FTP_packets += $count;
      }
  }
#Error Message %PIX|ASA-6-302013
   elsif ($ThisLine =~ /%PIX-6-302013: Built/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-302013: Built//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $connection_id = @testfields[3];
      $CONNECTION_ID{$connection_id} = $connection_id;
   }
#Error Message %PIX|ASA-6-302015
   elsif ($ThisLine =~ /%PIX-6-302015: Built/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-302015: Built//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $connection_id = @testfields[3];
      $CONNECTION_ID{$connection_id} = $connection_id;
  }

#Error Message %PIX|ASA-6-302014
   elsif ($ThisLine =~ /%PIX-6-302014: Teardown/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-302014: Teardown//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $protocol = @testfields[0];
      $connection_id = @testfields[2];
      $count = 1;
      $source_ip = @testfields[5];
      $source_port = @testfields[6];
      $destination_ip = @testfields[11];
      $destination_port = @testfields[12];

      if ($connection_id == $CONNECTION_ID{$connection_id}) {
         if ( ($destination_port == 21) and ($protocol =~ /TCP|tcp/) ) {
            $FTP{$source_ip} += $count;
            $FTP_packets += $count;
            }
         if ( ($destination_port == 22) and ($protocol =~ /TCP|tcp/) ) {
            $SSH{$source_ip} += $count;
            $SSH_packets += $count;
            }
         if ( ($destination_port == 23) and ($protocol =~ /TCP|tcp/) ) {
            $TELNET{$source_ip} += $count;
            $TELNET_packets += $count;
            }

         }
   }
#Error Message %PIX|ASA-6-302016
   elsif ($ThisLine =~ /%PIX-6-302016: Teardown/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-302016: Teardown//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $protocol = @testfields[0];
      $connection_id = @testfields[2];
      $count = 1;
      $source_ip = @testfields[5];
      $source_port = @testfields[6];
      $destination_ip = @testfields[11];
      $destination_port = @testfields[12];

      if ($connection_id == $CONNECTION_ID{$connection_id}) {

         if ( ($source_port == 53) and ($protocol =~ /UDP|udp/) ) {
            $DNS{$source_ip} += $count;
            $DNS_packets += $count;
         }
         if ( ($source_port == 123) and ($protocol =~ /UDP|udp/) ) {
            $NTP{$source_ip} += $count;
            $NTP_packets += $count;
         }
         if ( ($source_port == 514) and ($protocol =~ /UDP|udp/) ) {
            $SYSLOG{$source_ip} += $count;
            $SYSLOG_packets += $count;
         }
      }
   }
   elsif ( $ThisLine =~ /%PIX-3-710003:/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-3-710003://;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      @testfields = split(' ',$testline);
      $accesslist = @testfields[4];
      $action = "denied";
      $protocol = @testfields[0];
      if ($protocol =~ /(TCP|UDP|tcp|udp)/) {
         $icmp_type = "";
         $count = 1;
         $source_ip = @testfields[6];
         $source_port = @testfields[7];
         $destination_ip = @testfields[10];
         $destination_port = @testfields[11];
      } elsif ($protocol =~ /icmpv6/) {
         $source_ip = @testfields[3];
         $source_port = 0;
         $destination_ip = @testfields[4];
         $destination_port = 0;
         $icmp_type = @testfields[5];
         $count = @testfields[6];
      } else {
         $count = 0;
      }
      $ACL{$accesslist} += $count;
      $ACTION{$action} += $count;
      $packets += $count;
      if ( ($destination_port == 22) and ($protocol =~ /TCP|tcp/) ) {
         $SSH{$source_ip} += $count;
         $SSH_packets += $count;
      }
   }#Error Message %PIX|ASA-6-302020
   elsif ($ThisLine =~ /%PIX-6-302020: Built ICMP connection for faddr/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-302020: Built ICMP connection for faddr//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $connection_id = @testfields[0];
      $CONNECTION_ID{$connection_id} = $connection_id;
  }

#Error Message %PIX|ASA-6-302021
   elsif ($ThisLine =~ /%PIX-6-302021: Teardown ICMP connection for faddr/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*%PIX-6-302021: Teardown ICMP connection for faddr//;
      $testline =~ s/[:,]/ /g;
      $testline =~ s/\// /g;
      $testline =~ s/[()]/ /g;
      @testfields = split(' ',$testline);
      $connection_id = @testfields[0];
      $count = 1;
      $source_ip = $connection_id;

      if ($connection_id == $CONNECTION_ID{$connection_id}) {
            $ICMP{$source_ip} += $count;
            $ICMP_packets += $count;
      }
   }
   else {
      # Report any unmatched entries...
	  chomp $ThisLine;
	  $OtherList{$ThisLine}++;
   }
 }
}
if (keys %ACL) {
   print "\nAccess Control Lists:\n";
   foreach $ThisOne (sort keys %ACL) {
      print "   " . $ThisOne . " : " . $ACL{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $packets . " Hit(s)\n";
   if ($IPV6_packets >0) {print "   IPv6 Total : " . $IPV6_packets . " Hit(s)\n"}
}

if (keys %ACTION) {
   print "\nActions:\n";
   foreach $ThisOne (sort keys %ACTION) {
      print "   " . $ThisOne . " : " . $ACTION{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $packets . " Hit(s)\n";
   if ($IPV6_packets >0) {print "   IPv6 Total : " . $IPV6_packets . " Hit(s)\n"}
}
if (keys %ICMP) {
   print "\nICMP Requests:\n";
   foreach $ThisOne (sort keys %ICMP) {
      print "   " . $ThisOne . " : " . $ICMP{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $ICMP_packets . " Hit(s)\n";
}

if (keys %SSH) {
   print "\nSSH access:\n";
   foreach $ThisOne (sort keys %SSH) {
      print "   " . $ThisOne . " : " . $SSH{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $SSH_packets . " Hit(s)\n";
}

if (keys %TELNET) {
   print "\nTELNET access:\n";
   foreach $ThisOne (sort keys %TELNET) {
      print "   " . $ThisOne . " : " . $TELNET{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $TELNET_packets . " Hit(s)\n";
}

if (keys %FTP) {
   print "\nFTP access:\n";
   foreach $ThisOne (sort keys %FTP) {
      print "   " . $ThisOne . " : " . $FTP{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $FTP_packets . " Hit(s)\n";
}

if (keys %DNS) {
   print "\nDNS access:\n";
   foreach $ThisOne (sort keys %DNS) {
      print "   " . $ThisOne . " : " . $DNS{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $DNS_packets . " Hit(s)\n";
}
if (keys %NTP) {
   print "\nNTP access:\n";
   foreach $ThisOne (sort keys %NTP) {
      print "   " . $ThisOne . " : " . $NTP{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $NTP_packets . " Hit(s)\n";
}
if (keys %SYSLOG) {
   print "\nSYSLOG access:\n";
   foreach $ThisOne (sort keys %SYSLOG) {
      print "   " . $ThisOne . " : " . $SYSLOG{$ThisOne} . " Hit(s)\n";
   }
   print "   Total : " . $SYSLOG_packets. " Hit(s)\n";
}

#if (keys %OtherList) {
#	print "\n**Unmatched Entries**\n";
#	foreach $line (sort {$OtherList{$b}<=>$OtherList{$a} } keys %OtherList) {
#	print "   $line: $OtherList{$line} Time(s)\n";
#    }
#}

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et
# Local Variables:
# mode: perl
# perl-indent-level: 3
# indent-tabs-mode: nil
# End: