[people/pmueller/ipfire-2.x.git] / html / cgi-bin / logs.cgi / ids.dat

#!/usr/bin/perl
#
# SmoothWall CGIs
#
# This code is distributed under the terms of the GPL
#
# (c) The SmoothWall Team
#
# Copyright (C) 18-03-2002 Mark Wormgoor <mark@wormgoor.com>
#              - Added links to Snort database and ipinfo.cgi
#
# $Id: ids.dat,v 1.6.2.16 2005/06/14 08:25:30 eoberlander Exp $
#

use strict;

# enable only the following on debugging purpose
#use warnings;
#use CGI::Carp 'fatalsToBrowser';

require '/var/ipfire/general-functions.pl';
require "${General::swroot}/lang.pl";
require "${General::swroot}/header.pl";

my %color = ();
my %mainsettings = ();
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);

use POSIX();

#workaround to suppress a warning when a variable is used only once
my @dummy = ( ${Header::table1colour}, ${Header::table2colour} );
undef (@dummy);

my %cgiparams=();
my %logsettings=();
my @log=();
my $errormessage = '';

my @shortmonths = ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug',
	'Sep', 'Oct', 'Nov', 'Dec' );
my @longmonths = ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{'march'},
	$Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'}, $Lang::tr{'august'},
	$Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'},
	$Lang::tr{'december'} );

my @now = localtime(time);
my $dow = $now[6];
my $doy = $now[7];
my $tdoy = $now[7];
my $year = $now[5]+1900;

$cgiparams{'DAY'} = $now[3];
$cgiparams{'MONTH'} = $now[4];
$cgiparams{'ACTION'} = '';

&Header::getcgihash(\%cgiparams);
$logsettings{'LOGVIEW_REVERSE'} = 'off';
&General::readhash("${General::swroot}/logging/settings", \%logsettings);
${Header::viewsize} = defined ($logsettings{'LOGVIEW_VIEWSIZE'}) ? $logsettings{'LOGVIEW_VIEWSIZE'} : 150;
$Header::viewsize /= 5;	# each ids is displayed on 5 lines

$now[4] = $cgiparams{'MONTH'}+1;
if($now[4] < 10) {
        $now[4] = "0$now[4]"; }

my $start = -1;
if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'})
{
	my @temp = split(',',$ ENV{'QUERY_STRING'});
 	$start = $temp[0];
 	$cgiparams{'MONTH'} = $temp[1];
 	$cgiparams{'DAY'} = $temp[2];
}

if (!($cgiparams{'MONTH'} =~ /^(0|1|2|3|4|5|6|7|8|9|10|11)$/) ||
        !($cgiparams{'DAY'} =~ /^(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)$/))
{
        $cgiparams{'DAY'} = $now[3];
        $cgiparams{'MONTH'} = $now[4];
}
elsif($cgiparams{'ACTION'} eq '>>')
{
        my @temp_then=();
        my @temp_now = localtime(time);
        $temp_now[4] = $cgiparams{'MONTH'};
        $temp_now[3] = $cgiparams{'DAY'};
        @temp_then = localtime(POSIX::mktime(@temp_now) + 86400);
           ## Retrieve the same time on the next day +
           ## 86400 seconds in a day
        $cgiparams{'MONTH'} = $temp_then[4];
        $cgiparams{'DAY'} = $temp_then[3];
}
elsif($cgiparams{'ACTION'} eq '<<')
{
        my @temp_then=();
        my @temp_now = localtime(time);
        $temp_now[4] = $cgiparams{'MONTH'};
        $temp_now[3] = $cgiparams{'DAY'};
        @temp_then = localtime(POSIX::mktime(@temp_now) - 86400);
           ## Retrieve the same time on the previous day -
           ## 86400 seconds in a day
        $cgiparams{'MONTH'} = $temp_then[4];
        $cgiparams{'DAY'} = $temp_then[3];
}


if (($cgiparams{'DAY'} ne $now[3]) || ($cgiparams{'MONTH'} ne $now[4]))
{
	my @then = ();
	if ( (  $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) ||
			( $cgiparams{'MONTH'} > $now[4] ) ) {
		@then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1901 ));
	} else {
		@then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1900 ));
	}
	$tdoy = $then[7];
	my $lastleap=($year-1)%4;
        if ($tdoy>$doy) {
		if ($lastleap == 0 && $tdoy < 60) {
			$doy=$doy+366;
		} else {
			$doy=$doy+365;
		}
	}
}
my $datediff=0;
my $dowd=0;
my $multifile=0;
if ($tdoy ne $doy) {
	$datediff=int(($doy-$tdoy)/7);
	$dowd=($doy-$tdoy)%7;
        if (($dow-$dowd)<1) {
		$datediff=$datediff+1;
	}
	if (($dow-$dowd)==0) {
		$multifile=1;
	}
}

my $longmonthstr = $longmonths[$cgiparams{'MONTH'}];
my $monthnum = $cgiparams{'MONTH'} + 1;
my $monthstr = $monthnum <= 9 ? "0$monthnum" : "$monthnum";
my $daystr = $cgiparams{'DAY'} <= 9 ? "0$cgiparams{'DAY'}" : "$cgiparams{'DAY'}";

my $lines = 0;
my ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);

&processevent;

if ($multifile) {
	$datediff=$datediff-1;
	&processevent;
}

if ($cgiparams{'ACTION'} eq $Lang::tr{'export'})
{
	print "Content-type: text/plain\n\n";
	print "IPFire IPS log\r\n";
	print "Date: $cgiparams{'DAY'} $longmonths[$cgiparams{'MONTH'}]\r\n";
	print "\r\n";

	if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @log = reverse @log; }

	foreach $_ (@log)
	{
		my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\|/);
		$refs =~ s/,$//;

		# Skip event if no datetime and title are available.
		next unless (($datetime) && ($title));

		print "Date: $datetime\n";
		print "Name: $title\n";
		print "Priority: $priority\n";
		print "Type: $classification\n";
		print "IP Info: ";
		print "$srcip";
		if ($srcport != "n/a") {
			print ":$srcport";
		}
		print " -> ";
		print "$destip";
		if ($destport != "n/a") {
			print ":$destport";
		}
		print "\n";
		print "SID: $sid\n";
		print "Refs: $refs\n\n";
	}

	exit;
}

&Header::showhttpheaders();

&Header::openpage($Lang::tr{'ids log viewer'}, 1, '');

&Header::openbigbox('100%', 'left', '', $errormessage);

if ($errormessage) {
	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
	print "<font class='base'>$errormessage&nbsp;</font>\n";
	&Header::closebox();
}

&Header::openbox('100%', 'left', "$Lang::tr{'settings'}:");

print <<END
<form method='post' action="$ENV{'SCRIPT_NAME'}">
<table width='100%'>
<tr>
	<td width='10%' class='base'>$Lang::tr{'month'}:&nbsp;</td>
	<td width='10%'>
	<select name='MONTH'>
END
;
for (my $month = 0; $month < 12; $month++)
{
	print "\t<option ";
	if ($month == $cgiparams{'MONTH'}) {
		print 'selected="selected" '; }
	print "value='$month'>$longmonths[$month]</option>\n";
}
print <<END
	</select>
	</td>
	<td width='10%' class='base' align='right'>&nbsp;$Lang::tr{'day'}:&nbsp;</td>
	<td width='40%'>
	<select name='DAY'>
END
;
for (my $day = 1; $day <= 31; $day++)
{
	print "\t<option ";
	if ($day == $cgiparams{'DAY'}) {
		print 'selected="selected" '; }
	print "value='$day'>$day</option>\n";
}
print <<END
	</select>
	</td>
	<td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day before'}' value='&lt;&lt;' /></td>
        <td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day after'}' value='&gt;&gt;' /></td>
	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'update'}' /></td>
	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'export'}' /></td>
</tr>
</table>
</form>
END
;

&Header::closebox();

&Header::openbox('100%', 'left', $Lang::tr{'log'});
print "<p><b>$Lang::tr{'ids log hits'} $longmonthstr $daystr: $lines</b></p>";

if ($start == -1) {
        $start = $lines - ${Header::viewsize}; }
if ($start >= $lines - ${Header::viewsize}) { $start = $lines - ${Header::viewsize}; };
if ($start < 0) { $start = 0; }

my $prev = $start - ${Header::viewsize};
my $next = $start + ${Header::viewsize};

if ($prev < 0) { $prev = 0; }
if ($next >= $lines) { $next = -1 }
if ($start == 0) { $prev = -1; }
my @slice = splice(@log, $start, ${Header::viewsize});

if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @slice = reverse @slice; }

if ($lines != 0) {

&oldernewer();

$lines = 0;

print <<END
<table width='100%'>
END
;

foreach $_ (@slice)
{
	if ($lines % 2) {
		print "<tr bgcolor='$color{'color20'}'><td>\n"; }
	else {
		print "<tr bgcolor='$color{'color22'}'><td>\n"; }
	my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\|/);

	# Only show the current event if at least datetime and title are available.
	next unless (($datetime) && ($title));

	print <<END
<table width='100%'>
<tr>
<td width='15%'><b>$Lang::tr{'date'}:</b></td><td width='25%'>$datetime</td>
<td width='10%'><b>$Lang::tr{'name'}:</b></td><td width='50%'>$title</td>
</tr>
<tr><td><b>$Lang::tr{'priority'}:</b></td><td>$priority</td>
<td><b>$Lang::tr{'type'}:</b></td><td>$classification</td>
</tr>
<tr><td><b>$Lang::tr{'ipinfo'}:</b></td>
<td colspan='3'>
END
	;
	if ($srcip ne "n/a") {
		print "<a href='/cgi-bin/ipinfo.cgi?ip=$srcip'>$srcip</a>";
	} else {
		print "$srcip";
	}
	print ":$srcport -&gt; ";
	if ($destip ne "n/a") {
		print "<a href='/cgi-bin/ipinfo.cgi?ip=$destip'>$destip</a>";
	} else {
		print "$destip";
	}
	print ":$destport";
print <<END
</td>
</tr>
<tr><td valign='top'><b>$Lang::tr{'references'}:</b></td><td valign='top'>
END
;
	foreach my $ref (split(/,/,$refs)) {
		if ($ref =~ m/url (.*)/) {
			print "<a href='http://$1'>$1</a><br />";
		} elsif ($ref =~ m/cve (.*)/) {
			print "<a href='http://cve.mitre.org/cgi-bin/cvename.cgi?name=$1'>$1</a><br />";
		} elsif ($ref =~ m/nessus (.*)/) {
			print "<a href='http://cgi.nessus.org/plugins/dump.php3?id=$1'>Nessus $1</a><br />";
		} elsif ($ref =~ m/bugtraq (.*)/) {
			print "<a href='http://www.securityfocus.com/bid/$1'>Bugtraq $1</a><br />";
		} else {
			print "$ref<br />";
		}
	}
	print $Lang::tr{'none found'} unless $refs =~ /,/;
print <<END
<td valign='top'><b>SID:</b></td>
<td valign='top'>
END
	;
	if ($sid eq "n/a") {
		print $sid;
	} elsif ($sid < 1000000) {
		# Link to sourcefire if the the rule sid is less than 1000000.
		print "<a href='https://www.snort.org/rule_docs/1-$sid' ";
		print "target='_blank'>$sid</a></td>\n";
	} elsif ($sid >= 2000000 and $sid < 3000000) {
		# Link to emergingthreats if the rule sid is between 2000000 and 3000000.
		print "<a href='https://threatintel.proofpoint.com/sid/$sid' ";
		print "target='_blank'>$sid</a></td>\n";
	} else {
		# No external link for user defined rules
		print $sid;
	}
print <<END
</tr>
</table><br>
</td></tr>
END
	;
	$lines++;
}

print "</table>";

}

&oldernewer();

&Header::closebox();

&Header::closebigbox();

&Header::closepage();

sub processevent
{
	our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);

	my $filestr='';
	if ($datediff==0) {
		# If there is no datediff, directly assign the suricata fast.log.
		$filestr="/var/log/suricata/fast.log";
	} else {
		# If there is a datediff, assign the datediff to the filestring.
		$filestr="/var/log/suricata/fast.log.$datediff";

		# The files are compressed add the extension to the filestring.
		$filestr="$filestr.gz";

		# If the file does not exist, try to fallback to legacy snort alert file.
		unless (-f $filestr) {
			# Assign snort alert file, the datediff and extension for compressed file.
			$filestr = "/var/log/snort/alert.$datediff";
			$filestr = "$filestr.gz";
		}
	}
	if (!(open (LOG,($filestr =~ /.gz$/ ? "gzip -dc $filestr |" : $filestr)))) {
		$errormessage="$errormessage$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}";
	} else {
		my $line = 0;

		while(<LOG>) {
			$line++;
			if ($_ =~ m/\[\*\*\]/) {
				unless ($line == 1 || $date ne "$monthstr/$daystr") {
					&append;
					$line = 1;
				}
				($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport,$sid) = ("n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a", "n/a");
				@refs = ();
				$_ =~ m/:([0-9]{1,10})\] (.*) \[\*\*\]/;
				$title = &Header::cleanhtml($2,"y");
			}
			if ($_ =~ m/Classification: (.*)\] \[Priority: (\d)\]/) {
				$classification = &Header::cleanhtml($1,"y");
				$priority = $2;
			}
			if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/) {
				$srcip = $1 . "." . $2 . "." . $3 . "." . $4;
				$destip = $5 . "." . $6 . "." . $7 . "." . $8;
			}
			if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6})/) {
				$srcip = $1 . "." . $2 . "." . $3 . "." . $4;
				$srcport = $5;
				$destip = $6 . "." . $7 . "." . $8 . "." . $9;
				$destport = $10;
			}

			if ($_  =~ m/^([0-9\/]{3,5})(\/\d+)?\-([0-9\:]{5,8})\.([0-9]{1,14})/) {
				($date,$time) = ($1,$3);
			}
			if ($_ =~ m/\[Xref \=\>.*\]/) {
				$_ =~ s/\]\[Xref \=\> /, /g;
				$_ =~ m/\[Xref \=\> (.*)\]/;
				push(@refs, $1);
			}
			if ($_ =~ m/\[1:([0-9]+):[0-9]+\]/) {
				$sid = $1;
			}
		}
		$line++;

		# Check if all data is collected and the date of the event fits the desired date to
		# get displayed.
		if ($line gt 1 && $date eq "$monthstr/$daystr") { &append; }

		close(LOG);
	}
}

sub append
{
	our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);

	$log[$lines] = "$date $time|$title|$priority|$classification|$srcip|$srcport|$destip|$destport|$sid|";
	foreach $_ (@refs) {
		$log[$lines] = "$log[$lines]$_,"; }
	$lines++;
}

sub oldernewer
{
print <<END
<table width='100%'>
<tr>
END
;

print "<td align='center' width='50%'>";
if ($prev != -1) {
        print "<a href='/cgi-bin/logs.cgi/ids.dat?$prev,$cgiparams{'MONTH'},$cgiparams{'DAY'}'>$Lang::tr{'older'}</a>"; }
else {
        print "$Lang::tr{'older'}"; }
print "</td>\n";

print "<td align='center' width='50%'>";
if ($next != -1) {
        print "<a href='/cgi-bin/logs.cgi/ids.dat?$next,$cgiparams{'MONTH'},$cgiparams{'DAY'}'>$Lang::tr{'newer'}</a>"; }
else {
        print "$Lang::tr{'newer'}"; }
print "</td>\n";

print <<END
</tr>
</table>
END
;
}
Commit	Line	Data
cd1a2927 MT	1	#!/usr/bin/perl
	2	#
	3	# SmoothWall CGIs
	4	#
	5	# This code is distributed under the terms of the GPL
	6	#
	7	# (c) The SmoothWall Team
	8	#
	9	# Copyright (C) 18-03-2002 Mark Wormgoor <mark@wormgoor.com>
	10	# - Added links to Snort database and ipinfo.cgi
	11	#
	12	# $Id: ids.dat,v 1.6.2.16 2005/06/14 08:25:30 eoberlander Exp $
	13	#
	14
	15	use strict;
	16
	17	# enable only the following on debugging purpose
	18	#use warnings;
	19	#use CGI::Carp 'fatalsToBrowser';
	20
986e08d9	21	require '/var/ipfire/general-functions.pl';
cd1a2927 MT	22	require "${General::swroot}/lang.pl";
	23	require "${General::swroot}/header.pl";
	24
f2fdd0c1 CS	25	my %color = ();
	26	my %mainsettings = ();
	27	&General::readhash("${General::swroot}/main/settings", \%mainsettings);
8186b372	28	&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
f2fdd0c1	29
cd1a2927 MT	30	use POSIX();
	31
	32	#workaround to suppress a warning when a variable is used only once
	33	my @dummy = ( ${Header::table1colour}, ${Header::table2colour} );
	34	undef (@dummy);
	35
	36	my %cgiparams=();
	37	my %logsettings=();
	38	my @log=();
	39	my $errormessage = '';
	40
	41	my @shortmonths = ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug',
	42	'Sep', 'Oct', 'Nov', 'Dec' );
	43	my @longmonths = ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{'march'},
	44	$Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'}, $Lang::tr{'august'},
	45	$Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'},
	46	$Lang::tr{'december'} );
	47
	48	my @now = localtime(time);
	49	my $dow = $now[6];
	50	my $doy = $now[7];
	51	my $tdoy = $now[7];
	52	my $year = $now[5]+1900;
	53
	54	$cgiparams{'DAY'} = $now[3];
	55	$cgiparams{'MONTH'} = $now[4];
	56	$cgiparams{'ACTION'} = '';
	57
	58	&Header::getcgihash(\%cgiparams);
	59	$logsettings{'LOGVIEW_REVERSE'} = 'off';
	60	&General::readhash("${General::swroot}/logging/settings", \%logsettings);
	61	${Header::viewsize} = defined ($logsettings{'LOGVIEW_VIEWSIZE'}) ? $logsettings{'LOGVIEW_VIEWSIZE'} : 150;
	62	$Header::viewsize /= 5; # each ids is displayed on 5 lines
	63
	64	$now[4] = $cgiparams{'MONTH'}+1;
	65	if($now[4] < 10) {
	66	$now[4] = "0$now[4]"; }
	67
	68	my $start = -1;
	69	if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'})
	70	{
	71	my @temp = split(',',$ ENV{'QUERY_STRING'});
	72	$start = $temp[0];
	73	$cgiparams{'MONTH'} = $temp[1];
66c36198	74	$cgiparams{'DAY'} = $temp[2];
cd1a2927 MT	75	}
	76
	77	if (!($cgiparams{'MONTH'} =~ /^(0\|1\|2\|3\|4\|5\|6\|7\|8\|9\|10\|11)$/) \|\|
	78	!($cgiparams{'DAY'} =~ /^(1\|2\|3\|4\|5\|6\|7\|8\|9\|10\|11\|12\|13\|14\|15\|16\|17\|18\|19\|20\|21\|22\|23\|24\|25\|26\|27\|28\|29\|30\|31)$/))
	79	{
	80	$cgiparams{'DAY'} = $now[3];
	81	$cgiparams{'MONTH'} = $now[4];
	82	}
	83	elsif($cgiparams{'ACTION'} eq '>>')
	84	{
	85	my @temp_then=();
	86	my @temp_now = localtime(time);
	87	$temp_now[4] = $cgiparams{'MONTH'};
	88	$temp_now[3] = $cgiparams{'DAY'};
	89	@temp_then = localtime(POSIX::mktime(@temp_now) + 86400);
	90	## Retrieve the same time on the next day +
	91	## 86400 seconds in a day
	92	$cgiparams{'MONTH'} = $temp_then[4];
	93	$cgiparams{'DAY'} = $temp_then[3];
	94	}
	95	elsif($cgiparams{'ACTION'} eq '<<')
	96	{
	97	my @temp_then=();
	98	my @temp_now = localtime(time);
	99	$temp_now[4] = $cgiparams{'MONTH'};
	100	$temp_now[3] = $cgiparams{'DAY'};
	101	@temp_then = localtime(POSIX::mktime(@temp_now) - 86400);
	102	## Retrieve the same time on the previous day -
	103	## 86400 seconds in a day
	104	$cgiparams{'MONTH'} = $temp_then[4];
	105	$cgiparams{'DAY'} = $temp_then[3];
	106	}
	107
	108
	109	if (($cgiparams{'DAY'} ne $now[3]) \|\| ($cgiparams{'MONTH'} ne $now[4]))
	110	{
	111	my @then = ();
	112	if ( ( $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) \|\|
	113	( $cgiparams{'MONTH'} > $now[4] ) ) {
	114	@then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1901 ));
	115	} else {
	116	@then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1900 ));
	117	}
	118	$tdoy = $then[7];
66c36198	119	my $lastleap=($year-1)%4;
cd1a2927 MT	120	if ($tdoy>$doy) {
	121	if ($lastleap == 0 && $tdoy < 60) {
	122	$doy=$doy+366;
	123	} else {
	124	$doy=$doy+365;
	125	}
	126	}
	127	}
	128	my $datediff=0;
	129	my $dowd=0;
	130	my $multifile=0;
	131	if ($tdoy ne $doy) {
	132	$datediff=int(($doy-$tdoy)/7);
	133	$dowd=($doy-$tdoy)%7;
	134	if (($dow-$dowd)<1) {
	135	$datediff=$datediff+1;
	136	}
	137	if (($dow-$dowd)==0) {
	138	$multifile=1;
	139	}
	140	}
	141
	142	my $longmonthstr = $longmonths[$cgiparams{'MONTH'}];
	143	my $monthnum = $cgiparams{'MONTH'} + 1;
	144	my $monthstr = $monthnum <= 9 ? "0$monthnum" : "$monthnum";
	145	my $daystr = $cgiparams{'DAY'} <= 9 ? "0$cgiparams{'DAY'}" : "$cgiparams{'DAY'}";
	146
	147	my $lines = 0;
	148	my ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);
	149
	150	&processevent;
	151
	152	if ($multifile) {
	153	$datediff=$datediff-1;
	154	&processevent;
	155	}
	156
	157	if ($cgiparams{'ACTION'} eq $Lang::tr{'export'})
	158	{
	159	print "Content-type: text/plain\n\n";
dd8d6f5e	160	print "IPFire IPS log\r\n";
66c36198	161	print "Date: $cgiparams{'DAY'} $longmonths[$cgiparams{'MONTH'}]\r\n";
cd1a2927 MT	162	print "\r\n";
	163
	164	if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @log = reverse @log; }
	165
	166	foreach $_ (@log)
	167	{
	168	my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\\|/);
	169	$refs =~ s/,$//;
6f3b3cd0 SS	170
	171	# Skip event if no datetime and title are available.
	172	next unless (($datetime) && ($title));
	173
cd1a2927 MT	174	print "Date: $datetime\n";
	175	print "Name: $title\n";
	176	print "Priority: $priority\n";
	177	print "Type: $classification\n";
	178	print "IP Info: ";
	179	print "$srcip";
	180	if ($srcport != "n/a") {
	181	print ":$srcport";
	182	}
	183	print " -> ";
	184	print "$destip";
	185	if ($destport != "n/a") {
	186	print ":$destport";
	187	}
	188	print "\n";
	189	print "SID: $sid\n";
	190	print "Refs: $refs\n\n";
	191	}
	192
	193	exit;
	194	}
	195
	196	&Header::showhttpheaders();
	197
	198	&Header::openpage($Lang::tr{'ids log viewer'}, 1, '');
	199
	200	&Header::openbigbox('100%', 'left', '', $errormessage);
	201
	202	if ($errormessage) {
	203	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
	204	print "<font class='base'>$errormessage </font>\n";
	205	&Header::closebox();
	206	}
	207
	208	&Header::openbox('100%', 'left', "$Lang::tr{'settings'}:");
	209
	210	print <<END
	211	<form method='post' action="$ENV{'SCRIPT_NAME'}">
	212	<table width='100%'>
	213	<tr>
	214	<td width='10%' class='base'>$Lang::tr{'month'}: </td>
	215	<td width='10%'>
	216	<select name='MONTH'>
	217	END
	218	;
	219	for (my $month = 0; $month < 12; $month++)
	220	{
	221	print "\t<option ";
	222	if ($month == $cgiparams{'MONTH'}) {
	223	print 'selected="selected" '; }
	224	print "value='$month'>$longmonths[$month]</option>\n";
	225	}
	226	print <<END
	227	</select>
	228	</td>
	229	<td width='10%' class='base' align='right'> $Lang::tr{'day'}: </td>
	230	<td width='40%'>
	231	<select name='DAY'>
	232	END
	233	;
66c36198	234	for (my $day = 1; $day <= 31; $day++)
cd1a2927 MT	235	{
	236	print "\t<option ";
	237	if ($day == $cgiparams{'DAY'}) {
	238	print 'selected="selected" '; }
	239	print "value='$day'>$day</option>\n";
	240	}
	241	print <<END
	242	</select>
	243	</td>
	244	<td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day before'}' value='<<' /></td>
	245	<td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day after'}' value='>>' /></td>
	246	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'update'}' /></td>
	247	<td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'export'}' /></td>
	248	</tr>
	249	</table>
	250	</form>
	251	END
	252	;
	253
	254	&Header::closebox();
	255
	256	&Header::openbox('100%', 'left', $Lang::tr{'log'});
dd8d6f5e	257	print "<p><b>$Lang::tr{'ids log hits'} $longmonthstr $daystr: $lines</b></p>";
cd1a2927 MT	258
	259	if ($start == -1) {
	260	$start = $lines - ${Header::viewsize}; }
	261	if ($start >= $lines - ${Header::viewsize}) { $start = $lines - ${Header::viewsize}; };
	262	if ($start < 0) { $start = 0; }
	263
	264	my $prev = $start - ${Header::viewsize};
	265	my $next = $start + ${Header::viewsize};
	266
	267	if ($prev < 0) { $prev = 0; }
	268	if ($next >= $lines) { $next = -1 }
	269	if ($start == 0) { $prev = -1; }
	270	my @slice = splice(@log, $start, ${Header::viewsize});
	271
	272	if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @slice = reverse @slice; }
	273
	274	if ($lines != 0) {
	275
	276	&oldernewer();
	277
	278	$lines = 0;
	279
	280	print <<END
	281	<table width='100%'>
	282	END
	283	;
	284
	285	foreach $_ (@slice)
	286	{
	287	if ($lines % 2) {
f2fdd0c1	288	print "<tr bgcolor='$color{'color20'}'><td>\n"; }
cd1a2927	289	else {
f2fdd0c1	290	print "<tr bgcolor='$color{'color22'}'><td>\n"; }
cd1a2927	291	my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\\|/);
6f3b3cd0 SS	292
	293	# Only show the current event if at least datetime and title are available.
	294	next unless (($datetime) && ($title));
	295
cd1a2927 MT	296	print <<END
	297	<table width='100%'>
	298	<tr>
	299	<td width='15%'><b>$Lang::tr{'date'}:</b></td><td width='25%'>$datetime</td>
	300	<td width='10%'><b>$Lang::tr{'name'}:</b></td><td width='50%'>$title</td>
	301	</tr>
	302	<tr><td><b>$Lang::tr{'priority'}:</b></td><td>$priority</td>
	303	<td><b>$Lang::tr{'type'}:</b></td><td>$classification</td>
	304	</tr>
	305	<tr><td><b>$Lang::tr{'ipinfo'}:</b></td>
	306	<td colspan='3'>
	307	END
	308	;
	309	if ($srcip ne "n/a") {
	310	print "<a href='/cgi-bin/ipinfo.cgi?ip=$srcip'>$srcip</a>";
	311	} else {
	312	print "$srcip";
	313	}
	314	print ":$srcport -> ";
	315	if ($destip ne "n/a") {
	316	print "<a href='/cgi-bin/ipinfo.cgi?ip=$destip'>$destip</a>";
	317	} else {
	318	print "$destip";
	319	}
	320	print ":$destport";
	321	print <<END
	322	</td>
	323	</tr>
	324	<tr><td valign='top'><b>$Lang::tr{'references'}:</b></td><td valign='top'>
	325	END
	326	;
	327	foreach my $ref (split(/,/,$refs)) {
	328	if ($ref =~ m/url (.*)/) {
	329	print "<a href='http://$1'>$1</a><br />";
	330	} elsif ($ref =~ m/cve (.*)/) {
	331	print "<a href='http://cve.mitre.org/cgi-bin/cvename.cgi?name=$1'>$1</a><br />";
	332	} elsif ($ref =~ m/nessus (.*)/) {
	333	print "<a href='http://cgi.nessus.org/plugins/dump.php3?id=$1'>Nessus $1</a><br />";
	334	} elsif ($ref =~ m/bugtraq (.*)/) {
	335	print "<a href='http://www.securityfocus.com/bid/$1'>Bugtraq $1</a><br />";
	336	} else {
	337	print "$ref<br />";
	338	}
	339	}
	340	print $Lang::tr{'none found'} unless $refs =~ /,/;
	341	print <<END
	342	<td valign='top'><b>SID:</b></td>
	343	<td valign='top'>
	344	END
	345	;
f2f0d61f SS	346	if ($sid eq "n/a") {
	347	print $sid;
	348	} elsif ($sid < 1000000) {
	349	# Link to sourcefire if the the rule sid is less than 1000000.
	350	print "<a href='https://www.snort.org/rule_docs/1-$sid' ";
	351	print "target='_blank'>$sid</a></td>\n";
	352	} elsif ($sid >= 2000000 and $sid < 3000000) {
	353	# Link to emergingthreats if the rule sid is between 2000000 and 3000000.
cdfbef5d	354	print "<a href='https://threatintel.proofpoint.com/sid/$sid' ";
cd1a2927 MT	355	print "target='_blank'>$sid</a></td>\n";
cd1a2927 MT	356	} else {
f2f0d61f	357	# No external link for user defined rules
cd1a2927 MT	358	print $sid;
	359	}
	360	print <<END
	361	</tr>
63d911cd	362	</table><br>
cd1a2927 MT	363	</td></tr>
	364	END
	365	;
	366	$lines++;
	367	}
	368
	369	print "</table>";
	370
	371	}
	372
	373	&oldernewer();
	374
	375	&Header::closebox();
	376
	377	&Header::closebigbox();
	378
	379	&Header::closepage();
	380
	381	sub processevent
	382	{
	383	our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);
	384
	385	my $filestr='';
	386	if ($datediff==0) {
f5ddcad1 SS	387	# If there is no datediff, directly assign the suricata fast.log.
f5ddcad1 SS	388	$filestr="/var/log/suricata/fast.log";
cd1a2927	389	} else {
f5ddcad1 SS	390	# If there is a datediff, assign the datediff to the filestring.
	391	$filestr="/var/log/suricata/fast.log.$datediff";
	392
	393	# The files are compressed add the extension to the filestring.
	394	$filestr="$filestr.gz";
	395
	396	# If the file does not exist, try to fallback to legacy snort alert file.
	397	unless (-f $filestr) {
	398	# Assign snort alert file, the datediff and extension for compressed file.
	399	$filestr = "/var/log/snort/alert.$datediff";
	400	$filestr = "$filestr.gz";
f5ddcad1	401	}
cd1a2927 MT	402	}
	403	if (!(open (LOG,($filestr =~ /.gz$/ ? "gzip -dc $filestr \|" : $filestr)))) {
	404	$errormessage="$errormessage$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}";
	405	} else {
	406	my $line = 0;
	407
	408	while(<LOG>) {
	409	$line++;
2eb0c326	410	if ($_ =~ m/\[\\\]/) {
cd1a2927 MT	411	unless ($line == 1 \|\| $date ne "$monthstr/$daystr") {
	412	&append;
	413	$line = 1;
	414	}
f5ddcad1	415	($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport,$sid) = ("n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a", "n/a");
cd1a2927	416	@refs = ();
d0ee2714	417	$_ =~ m/:([0-9]{1,10})\] (.) \[\\*\]/;
cd1a2927 MT	418	$title = &Header::cleanhtml($2,"y");
	419	}
	420	if ($_ =~ m/Classification: (.*)\] \[Priority: (\d)\]/) {
	421	$classification = &Header::cleanhtml($1,"y");
	422	$priority = $2;
	423	}
	424	if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/) {
	425	$srcip = $1 . "." . $2 . "." . $3 . "." . $4;
	426	$destip = $5 . "." . $6 . "." . $7 . "." . $8;
	427	}
	428	if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6})/) {
	429	$srcip = $1 . "." . $2 . "." . $3 . "." . $4;
	430	$srcport = $5;
	431	$destip = $6 . "." . $7 . "." . $8 . "." . $9;
	432	$destport = $10;
	433	}
	434
19c066b6 MT	435	if ($_ =~ m/^([0-9\/]{3,5})(\/\d+)?\-([0-9\:]{5,8})\.([0-9]{1,14})/) {
19c066b6 MT	436	($date,$time) = ($1,$3);
cd1a2927 MT	437	}
	438	if ($_ =~ m/\[Xref \=\>.*\]/) {
	439	$_ =~ s/\]\[Xref \=\> /, /g;
	440	$_ =~ m/\[Xref \=\> (.*)\]/;
	441	push(@refs, $1);
	442	}
	443	if ($_ =~ m/\[1:([0-9]+):[0-9]+\]/) {
	444	$sid = $1;
	445	}
	446	}
	447	$line++;
7bf5b0f2	448
7bf5b0f2 SS	449	# Check if all data is collected and the date of the event fits the desired date to
7bf5b0f2 SS	450	# get displayed.
d51d3c5b	451	if ($line gt 1 && $date eq "$monthstr/$daystr") { &append; }
7bf5b0f2	452
cd1a2927 MT	453	close(LOG);
	454	}
	455	}
	456
	457	sub append
	458	{
	459	our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs);
	460
	461	$log[$lines] = "$date $time\|$title\|$priority\|$classification\|$srcip\|$srcport\|$destip\|$destport\|$sid\|";
	462	foreach $_ (@refs) {
	463	$log[$lines] = "$log[$lines]$_,"; }
	464	$lines++;
	465	}
	466
	467	sub oldernewer
	468	{
	469	print <<END
	470	<table width='100%'>
	471	<tr>
	472	END
	473	;
	474
	475	print "<td align='center' width='50%'>";
	476	if ($prev != -1) {
	477	print "<a href='/cgi-bin/logs.cgi/ids.dat?$prev,$cgiparams{'MONTH'},$cgiparams{'DAY'}'>$Lang::tr{'older'}</a>"; }
	478	else {
	479	print "$Lang::tr{'older'}"; }
	480	print "</td>\n";
	481
	482	print "<td align='center' width='50%'>";
	483	if ($next != -1) {
	484	print "<a href='/cgi-bin/logs.cgi/ids.dat?$next,$cgiparams{'MONTH'},$cgiparams{'DAY'}'>$Lang::tr{'newer'}</a>"; }
	485	else {
	486	print "$Lang::tr{'newer'}"; }
	487	print "</td>\n";
	488
	489	print <<END
	490	</tr>
	491	</table>
	492	END
	493	;
	494	}