#!/usr/bin/env python3

from systemd import journal
from datetime import datetime, timedelta
import re           # read lines
# Import smtplib for the actual sending function
import smtplib
# Import the email modules we'll need
from email.message import EmailMessage
from tabulate import tabulate
import os
import socket
import logging
import logging.config
import sys
import json

class connection:
    def __init__(self,logger):
        self.logger = logger
        self.records = []
    def __get_list(self):
        liste = []
        for e in self.records:
            self.logger.debug("interface {} source {} destination {} proto {} dport {} uid {} gid {}".format(e['interface'],e['source'],e['destination'],e['proto'],e['dport'],e['uid'],e['gid']))
            try:
                self.logger.debug("--- ask reverse lookup for : {}".format(e['destination']))
                domain, alias, addresslist = socket.gethostbyaddr(e['destination'])
            except socket.herror as he:
                self.logger.debug("--- can't resolv {}".format(e['destination']))
                domain = 'unknown'
            item = [ e['interface'], e['source'], e['destination'], e['proto'], e['dport'], e['uid'], e['gid'] , domain ]
            if not item in liste:
                liste.append(item)
                self.logger.debug(liste)
        return liste
    def report(self):
        headers = { 'Interface':'', 'Source':'', 'Destination':'', 'Protocol':'', 'DestinationPort':'', 'UID':'', 'GID':'' , 'domain':'' }
        header = headers.keys()
        msg = EmailMessage()
        msg.set_content(tabulate(self.__get_list(),headers))
        msg['Subject'] = f'[ssh][attempts] Reporting'
        msg['From'] = "{}@{}".format(os.getlogin(),socket.gethostname())
        msg['To'] = "{}@{}".format(os.getlogin(),'192.168.0.238')
        print(msg)
        #s = smtplib.SMTP('localhost')
        #s.send_message(msg)
        #s.quit()
    def addmessage(self, message:str):
        self.logger.debug("-- scan {}".format(message))
        nftop = r'''^OUTPUT:IN= OUT=(?P<interface>[a-z0-9]+)[ ]SRC=(?P<source>[0-9.]+)[ ]DST=(?P<destination>[0-9.]+)[ ]LEN=([0-9]+)[ ]TOS=([0-9x]+)[ ]PREC=([0-9x]+)[ ]TTL=([0-9]+)[ ]ID=([0-9]+)[ ]DF[ ]PROTO=(?P<proto>[CDTUP]+)[ ]SPT=([0-9]+)[ ]DPT=(?P<dport>[0-9]+)[ ]WINDOW=([0-9]+)[ ]RES=([0-9x]+)[ ]SYN[ ]URGP=([0-9]+)[ ]UID=(?P<uid>[0-9]+)[ ]GID=(?P<gid>[0-9]+)[ ]+$'''
        nftsp = r'''^SSH:[ ]IN=(?P<interface>[a-z0-9]+)[ ]OUT=[ ]MAC=(?P<gid>[0-9a-f:]+)[ ]SRC=(?P<source>[0-9.]+)[ ]DST=(?P<destination>[0-9.]+)[ ]LEN=([0-9]+)[ ]TOS=([0-9x]+)[ ]PREC=([0-9A-Fx]+)[ ]TTL=([0-9]+)[ ]ID=([0-9]+)[ ]DF[ ]PROTO=(?P<proto>[CDTUP]+)[ ]SPT=([0-9]+)[ ]DPT=(?P<dport>[0-9]+)[ ]WINDOW=([0-9]+)[ ]RES=([0-9x]+)[ ](SYN |ACK )(PSH |)URGP=(?P<uid>[0-9]+)[ ]+$'''
        nftom = re.match(re.compile(nftop),message)
        nftsm = re.match(re.compile(nftsp),message)
        if nftom:
            self.logger.debug("$$$ matched: {}".format(nftom))
            self.records.append(nftom.groupdict())
        elif nftsm:
            self.logger.debug("$$$ matched: {}".format(nftsm))
            self.records.append(nftsm.groupdict())

# initiate
logging.basicConfig(filename='/tmp/outlog_reporting.log',level=logging.DEBUG)
logger=logging.getLogger(__name__)
c = connection(logger)

# read from dnscap
try:
    queries = []
    js = json.load(sys.stdin)
    logger.debug("Json : {}".format(js))
    for request in js:
        for k,v in request['_source']['layers']['dns']['Queries'].items():
            query = v['dns.qry.name']
            logger.debug("query: {}".format(query))
            queries.append(query)
    logger.debug("queries: {}".format(queries))
except json.decoder.JSONDecodeError as jde:
    logger.warning("No json found as input")

# read logs from kernel journal
j = journal.Reader()
j.seek_realtime(datetime.now() - timedelta(hours=1))
j.add_match('_TRANSPORT=kernel')
for entry in j:
    logger.debug(entry['MESSAGE'])
    c.addmessage(entry['MESSAGE'])
logger.debug("--- Generating report")
c.report()