#!/usr/bin/perl



###

# Parse text-based log files of Snort scan reports, and save them

# to a file in Berkley DB format.



###

# Load necessary libraries.

require "init.pl";





###

# Initialize output scan database.

if (-e $SCANDB) {

    die "Output scan database $SCANDB already exists. Exiting.\n";

}

if (! tie(%SCANDB, "DB_File", $SCANDB)) {

    die "Could not initialize output scan database $SCANDB:\n$!\n";

}





###

# Process every line on STDIN or in files passed on command line.

$counter = 0;

$dbdelim = "|";

while (<>) {



    # Display a message every time a new file is being processed.

    if ($VERBOSE) {

	if ($ARGV eq "-") {

	    $infile = "STDIN";

	} else {

	    $infile = $ARGV;

	}

	if (! $PROCESSED_FILES{$infile}) {

	    warn "Processing $infile...\n";

	    $PROCESSED_FILES{$infile} = 1;

	    sleep(1);

	}

    }



    # Skip empty lines, lines with nothing but stars, and title lines.

    # Also skip lines that don't start with a date, but warn about that.

    next if ((/^\s*\**\s*$/) || (/^\s*Snort Scan Report/));

    if (! /^(May|Jun) [\d ]\d /) {

	warn "No leading date: $_";

	next;

    }



    # Separate the line into meaningful fields.

    chop;

    /^(\w\w\w [\d ]\d \d\d:\d\d:\d\d) (.*) \-\> ([^ ]*) (.*)$/;

    $timestamp = $1;

    $src = $2;

    $dst = $3;

    $details = $4;

    $details =~ s/\s+$//;

    if ($timestamp =~ /^\s*$/) {

	warn "Timestamp empty ([**] $name [**] $details)\n";

	next;

    }

    $timestamp =~ s/^May /05\//;

    $timestamp =~ s/^Jun /06\//;

    $timestamp =~ s/\/([\d ]\d) /\/$1\-/;

    $timestamp .= ".000000";

    if ($src =~ /^\s*$/) {

	warn "Source empty ($timestamp)\n";

	next;

    }

    if ($dst =~ /^\s*$/) {

	warn "Destination empty ($timestamp)\n";

	next;

    }

    ($srchost, $srcport) = split(/:/, $src);

    ($dsthost, $dstport) = split(/:/, $dst);

    if (($srchost =~ /^\s*$/) || ($dsthost =~ /^\s*$/)) {	

	# Hosts cannot be empty, but ports are in some alerts.

	warn "Source or destination host corrupted ($timestamp)\n";

	next;

    }



    # Write alert to the database.

    $SCANDB{$counter++} = $timestamp . $dbdelim . $details . $dbdelim .

	                   $srchost . $dbdelim . $srcport . $dbdelim .

                           $dsthost . $dbdelim . $dstport;

}





###

# Clean up and exit.

untie(%SCANDB);