#!/usr/bin/perl
##########################################################################
# $Id$
##########################################################################
# $Log: cisco,v $
# Revision 1.13  2008/06/30 23:07:51  kirk
# fixed copyright holders for files where I know who they should be
#
# Revision 1.12  2008/03/24 23:31:26  kirk
# added copyright/license notice to each script
#
# Revision 1.11  2007/11/27 18:43:05  bjorn
# Processing of additional statements (NTP, ACL), by Hugo van der Kooij.
#
##########################################################################

########################################################
# This was written and is maintained by:
#    Laurent DUFOUR <laurent.dufour@havas.com>,<dufour_l@hotmail.com>
# Heavily modified by:
#    Hugo van der Kooij <hvdkooij@vanderkooij.org>
#    based on the work of
#    Kirk Bauer <kirk@kaybee.org>
#
# Please send all comments, suggestions, bug reports,
#    etc, to laurent.dufour@havas.com and hvdkooij@vanderkooij.org
########################################################

########################################################
## Copyright (c) 2008 Laurent DUFOUR
## Covered under the included MIT/X-Consortium License:
##    http://www.opensource.org/licenses/mit-license.php
## All modifications and contributions by other persons to
## this script are assumed to have been donated to the
## Logwatch project and thus assume the above copyright
## and licensing terms.  If you want to make contributions
## under your own copyright or a different license this
## must be explicitly stated in the contribution an the
## Logwatch project reserves the right to not accept such
## contributions.  If you have made significant
## contributions to this script and want to claim
## copyright please contact logwatch-devel@lists.sourceforge.net.
#########################################################

use Logwatch ':all';

$Debug = ValueOrDefault($ENV{'LOGWATCH_DEBUG'}, 0);
$Detail = ValueOrDefault($ENV{'LOGWATCH_DETAIL_LEVEL'}, 0);
$CatchUnknown = ValueOrDefault($ENV{'catch_unknown'}, 1);

# Avoid "Use of uninitialized value" warning messages.
sub ValueOrDefault {
    my ($value, $default) = @_;
    return ($value ? $value : $default);
}

if ( $Debug >= 5 ) {
    print STDERR "\n\nDEBUG: Inside CISCO Filter \n\n";
    $DebugCounter = 1;
}



my ($month,$day,$time,$host,$process,$conn,$msg);

while (defined($ThisLine = <STDIN>)) {
    if ( $Debug >= 30 ) {
        print STDERR "DEBUG($DebugCounter): $ThisLine";
        $DebugCounter++;
    }

($month,$day,$time,$host,$process,$conn,$msg)=split(/ +/,$ThisLine,7);

   if ( ($ThisLine =~ /(ISDN-6-.+)/ ) or
         ($ThisLine =~ /Copyright/ ) or
         ($ThisLine =~ /Cisco Internetwork Operating System Software/ ) or
         ($ThisLine =~ /IOS \(tm\)/ ) or
         ($ThisLine =~ /Cisco IOS/ ) or
         ($ThisLine =~ /Technical Support/ ) or
         ($ThisLine =~ /self test passed/ ) or
         ($ThisLine =~ /TAC:Home:SW:IOS:Specials/ )
    ) {
      # don't care about this, will code this later
   }
   elsif ( $ThisLine =~ /%SEC-6-IPACCESSLOG(|D|N)P/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*SEC-6-IPACCESSLOG(|D|N)P: list //;
      $testline =~ s/ ->//;
      $testline =~ s/, / /;
      $testline =~ s/ packets//;
      $testline =~ s/ packet//;
      @testfields = split(/ /,$testline);
      $accesslist = @testfields[0];
      $action = @testfields[1];
      $protocol = @testfields[2];
      if ($protocol =~ /(tcp|udp)/) {
         $source = @testfields[3];
         $destination = @testfields[4];
         $icmp_type = "";
         $count = @testfields[5];
         @sfields = split(/\(/, $source);
         $source_ip = @sfields[0];
         $source_port = @sfields[1];
         $source_port =~ s/\)//;
         @dfields = split(/\(/, $destination);
         $destination_ip = @dfields[0];
         $destination_port = @dfields[1];
         $destination_port =~ s/\)//;
      } elsif ($protocol =~ /icmp/) {
         $source_ip = @testfields[3];
         $source_port = 0;
         $destination_ip = @testfields[4];
         $destination_port = 0;
         $icmp_type = @testfields[5];
         $count = @testfields[6];
      } elsif ($protocol =~ /41/) {
         $source_ip = @testfields[3];
         $source_port = 0;
         $destination_ip = @testfields[4];
         $destination_port = 0;
         $icmp_type = "";
         $count = @testfields[5];
      } else {
         $count = 0;
      }

      $ACL{$accesslist} += $count;
      $ACTION{$action} += $count;
      $packets += $count;
      if ( ($destination_port == 22) and ($protocol =~ /tcp/) ) {
         $SSH{$source_ip} += $count;
         $SSH_packets += $count;
      }
   }
   elsif ( $ThisLine =~ /%IPV6-6-ACCESSLOG(|D|N)P/) {
      $testline = $ThisLine;
      chomp $testline;
      $testline =~ s/^.*IPV6-6-ACCESSLOG(|D|N)P: list //;
      $testline =~ s/ ->//;
      $testline =~ s/, / /;
      $testline =~ s/ packets//;
      $testline =~ s/ packet//;
      @testfields = split(/ /,$testline);
      $accesslist = @testfields[0];
      $action = @testfields[1];
      $protocol = @testfields[2];
      if ($protocol =~ /(tcp|udp)/) {
         $source = @testfields[3];
         $destination = @testfields[4];
         $icmp_type = "";
         $count = @testfields[5];
         @sfields = split(/\(/, $source);
         $source_ip = @sfields[0];
         $source_port = @sfields[1];
         $source_port =~ s/\)//;
         @dfields = split(/\(/, $destination);
         $destination_ip = @dfields[0];
         $destination_port = @dfields[1];
         $destination_port =~ s/\)//;
      } elsif ($protocol =~ /icmpv6/) {
         $source_ip = @testfields[3];
         $source_port = 0;
         $destination_ip = @testfields[4];
         $destination_port = 0;
         $icmp_type = @testfields[5];
         $count = @testfields[6];
      } else {
         $count = 0;
      }

      $ACL{$accesslist} += $count;
      $ACTION{$action} += $count;
      $IPV6_packets += $count;
      if ( ($destination_port == 22) and ($protocol =~ /tcp/) ) {
         $SSH{$source_ip} += $count;
         $SSH_packets += $count;
      }
   }
   elsif ( ($protocol,$source,$destination) = ($ThisLine =~ /%FW-6-DROP_PKT: Dropping (\S+) pkt (\S+) => (\S+)/) ) {
      @sfields = split(/:/, $source);
      $source_ip = @sfields[0];
      $source_port = @sfields[1];
      @dfields = split(/:/, $destination);
      $destination_ip = @dfields[0];
      $destination_port = @dfields[1];
      if ($source_port == 25) {
         $dropsmtphost{$destination_ip}++;
         $dropsmtppkts++;
      }
      if ($destination_port == 25) {
         $dropsmtphost{$source_ip}++;
         $dropsmtppkts++;
      }
      if ($source_port == 80) {
         $drophttphost{$source_ip}++;
         $drophttppkts++;
      }
      if ($destination_port == 80) {
         $drophttphost{$destination_ip}++;
         $drophttppkts++;
      }
      $InspectDrop++;
   }
   elsif ( ($ACL,$source,$count) = ($ThisLine =~ /SEC-6-IPACCESSLOGSP: list (.*) denied igmp (.*) -> 224.0.0.1 \(17\), (.*) packet(|s)/) ) {
      $dropigmp{$host}{$ACL}{$source} += $count;
   }
   elsif ($ThisLine =~ /%FW-3-HTTP_JAVA_BLOCK/) {
      $JavaBlock++;
   }
   elsif ( ($username,$vty,$address) = ($ThisLine =~ /%SYS-5-CONFIG_I: Configured from console by (\S+) on (\S+) \((\S+)\)/) ) {
      $Configured{$host}{"Configured from $vty by $username at ".LookupIP($address)}++;
   }
   elsif ( ($username,$vty) = ($ThisLine =~ /%SYS-5-CONFIG_I: Configured from console by (\S+) on (\S+)/) ) {
      $Configured{$host}{"Configured from $vty by $username"}++;
   }
   elsif ( ($username,$vty) = ($ThisLine =~ /%SYS-5-CONFIG_I: Configured from console by (\S+) \((\S+)\)/) ) {
      $Configured{$host}{"Configured from ".LookupIP($vty)." by $usernam                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            