local redis = require "redis"

local client = redis.connect("127.0.0.1", 6379)

local response = client:ping()
if response == false then
	return 0
end

client:set("hello", "world")

local var = client:get("hello")
print(var)

json = require "cjson.safe"
md5 = require "md5"
redis = require "redis"

-- 登录接口
login_url = "/login"
-- 登录错误提示
success_code = 0
-- event_name
event_name = "login_audit"
-- event_type
event_type = "lua"
-- logs
name = "login_audit.json"
-- 协议
proto = "TCP"

-- redis_config
host = "127.0.0.1"
port = 6379

-- common_mapping
http_common_mapping = '{"accept":"accept","accept-charset":"accept_charset","accept-encoding":"accept_encoding","accept-language":"accept_language","user-agent":"user_agent"}'
common_mapping_table = json.decode(http_common_mapping)


-- defind functioin
function md5Encode(args)
    m = md5.new()
    m:update(args)
    return md5.tohex(m:finish())
end

function formatStr(args)
    t = {}
    ios = string.match(args, 'canon')
    if ios ~= nil then
        mail = 'email"%s+(.-)%s'
        t['email'] = string.match(args, mail)
    else
        data = string.split(args, '&')
        for n, v in ipairs(data) do
            d = string.split(v, '=')
            t[d[1]] = d[2]
        end
    end
    return t
end

function string.split(s, p)
    rt = {}
    string.gsub(s, '[^'..p..']+', function(w) table.insert(rt, w) end )
    return rt
end

-- default function
function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end

function setup (args)
    filename = SCLogPath() .. "/" .. name
    file = assert(io.open(filename, "a"))
    SCLogInfo("app_login_audit filename: " .. filename)
    http = 0
  
    -- Connect Redis Server
    SCLogInfo("Connect Redis Server...")
    client = redis.connect(host, port)
    response = client:ping()
    if response then
        SCLogInfo("Redis Server connection succeeded.")
    end
end

function log(args)
    -- init tables
    http_table = {}

    -- ti tables
    ti = {
        tags = {}
    }

    -- init score
    score = 50

    -- http_hostname & http_url
    http_hostname = HttpGetRequestHost()
    http_url = HttpGetRequestUriNormalized()
    
    -- http_method
    rl = HttpGetRequestLine()
    if rl then
        http_method = string.match(rl, "%w+")
        if http_method then
            http_table["method"] = http_method
        end
    end
	
	  -- 为了保证 Suricata 的性能不受影响, 严格控制过滤条件
    if http_url == login_url and http_method == "POST" then
        http_table["hostname"] = http_hostname
        http_table["url"] = http_url
        http_table["url_path"] = http_url
        
        -- http_status & http_protocol
        rsl = HttpGetResponseLine()
        if rsl then
            status_code = string.match(rsl, "%s(%d+)%s")
            http_table["status"] = tonumber(status_code)

            http_protocol = string.match(rsl, "(.-)%s")
            http_table["protocol"] = http_protocol
        end

        -- login_results
        a, o, e = HttpGetResponseBody()
        if a then
            for n, v in ipairs(a) do
                body = json.decode(v)
                results_code = tonumber(body["code"])
                if results_code == success_code then
                    http_table["results"] = "success"
                else
                    http_table["results"] = "failed"
                end
            end
            http_table["results_code"] = results_code
        end
        
        --[[
            1. 获取用户登录email 并查询 Redis中是否存在该账号
            2. 根据结果进行相应的打分以及tags标注
        ]]
        -- 
        a, o, e = HttpGetRequestBody()
        if a then
            for n, v in ipairs(a) do
                res = formatStr(v)
                if res["email"] then
                    -- 查询Redis对比黑名单
                    black_ioc = client:get(res["email"])
                    if black_ioc then
                        ti["provider"] = "Canon"
                        ti["producer"] = "NTA"
                        table.insert(ti["tags"], "account in blacklist")
                        score = score + 10
                    end
                end
            end
        end

        -- RequestHeaders
        rh = HttpGetRequestHeaders()
        if rh then
            for k, v in pairs(rh) do
                key = string.lower(k)
                request_var = request_mapping_table[key]
                if request_var then
                    http_table[request_var] = v
                end
            end
        end

        -- ResponseHeaders
        rsh = HttpGetResponseHeaders()
        if rsh then
            for k, v in pairs(rsh) do
                key = string.lower(k)
                response_var = response_mapping_table[key]
                if response_var then
                    http_table[response_var] = v
                end
            end
        end

        -- timestring
        sec, usec = SCPacketTimestamp()
        timestring = os.date("!%Y-%m-%dT%T", sec) .. '.' .. usec .. '+0000'
        
        -- flow_info
        ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()

        -- flow_id
        id = SCFlowId()
        flow_id = string.format("%.0f", id)
        flow_id = tonumber(flow_id)

        -- true_ip
        true_client_ip = HttpGetRequestHeader("True-Client-IP")
        if true_client_ip ~= nil then
            src_ip = true_client_ip
        end

        -- session_id
        tetrad = src_ip .. src_port .. dst_ip .. dst_port
        session_id = md5Encode(tetrad)

        -- table
        raw_data = {
            timestamp = timestring,
            flow_id = flow_id,
            session_id = session_id,
            src_ip = src_ip,
            src_port = src_port,
            proto = proto,
            dest_ip = dst_ip,
            dest_port = dst_port,
            event_name = event_name,
            event_type = event_type,
            app_type = app_type,
            http = http_table,
            ti = ti,
            score = score
        }

        -- json encode
        data = json.encode(raw_data)

        file:write(data .. "\n")
        file:flush()

        http = http + 1
    end

end

function deinit (args)
    SCLogInfo ("app_login_audit transactions logged: " .. http);
    file:close(file)
end

json = require "json"
md5 = require "md5"

-- 登录接口
login_url = "/login"
-- 登录状态码
success_code = 0
-- event_name
event_name = "login_audit"
-- event_type
event_type = "lua"
-- app_type
app_type = "web"
-- logs
name = "web_login_audit.json"

-- common_mapping
http_common_mapping = '{"accept":"accept","accept-charset":"accept_charset","accept-encoding":"accept_encoding","accept-language":"accept_language","accept-datetime":"accept_datetime","authorization":"authorization","cache-control":"cache_control","from":"from","max-forwards":"max_forwards","origin":"origin","pragma":"pragma","proxy-authorization":"proxy_authorization","via":"via","vary":"vary","x-requested-with":"x_requested_with","x-forwarded-proto":"x_forwarded_proto","accept-range":"accept_range","allow":"allow","connection":"connection","content-encoding":"content_encoding","content-language":"content_language","content-location":"content_location","content-md5":"content_md5","content-range":"content_range","date":"date","last-modified":"last_modified","location":"location","proxy-authenticate":"proxy_authenticate","referrer":"refer","retry-after":"retry_after","server":"server","transfer-encoding":"transfer_encoding","upgrade":"upgrade","www-authenticate":"www_authenticate","x-authenticated-user":"x_authenticated_user","user-agent":"user_agent"}'
common_mapping_table = json.decode(http_common_mapping)

-- request_mapping
http_request_mapping = '{"content-length":"request_content_length","content-type":"request_content_type"}'
request_mapping_table = json.decode(http_request_mapping)

-- response_mapping
http_response_mapping = '{"content-length":"response_content_length","content-type":"response_content_type"}'
response_mapping_table = json.decode(http_response_mapping)

-- defind functioin
function md5Encode(args)
    m = md5.new()
    m:update(args)
    return md5.tohex(m:finish())
end

function urlDecode(args)
    s = string.gsub(args, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
    return s
end

-- email=xxx@yyy.com&password=zzz
function formatStr(args)
    t = {}
    data = string.split(args, '&')
    for n, v in ipairs(data) do
        d = string.split(v, '=')
        t[d[1]] = d[2]
    end
    return t
end

function string.split(s, p)
    local rt = {}
    string.gsub(s, '[^'..p..']+', function(w) table.insert(rt, w) end )
    return rt
end

function trim(s)
    return (string.gsub(s, "^%s*(.-)%s*$", "%1"))
end

function formatCookie(args)
    t = {}
    data = string.split(args, ";")
    for n, v in ipairs(data) do
        v = trim(v)
        d = string.split(v, "=")
        t[d[1]] = d[2]
    end
    return t
end

-- default function
function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end


function setup (args)
    filename = SCLogPath() .. "/" .. name
    file = assert(io.open(filename, "a"))
    SCLogInfo("Web Login Log Filename " .. filename)
    http = 0
end


function log(args)

    -- init tables
    http_table = {}

    -- http_hostname
    http_hostname = HttpGetRequestHost()
    http_table["hostname"] = http_hostname

    -- http_url
    http_url = HttpGetRequestUriNormalized()
    if http_url ~= login_url then
        return
    end
    http_table["url"] = login_url

    -- http_url_path
    http_table["url_path"] = http_url

    -- http_method
    rl = HttpGetRequestLine()
    http_method = string.match(rl, "%w+")
    http_table["method"] = http_method

    -- http_status
    rsl = HttpGetResponseLine()
    status_code = string.match(rsl, "%s(%d+)%s")
    http_status = tonumber(status_code)
    http_table["status"] = http_status

    -- http_protocol
    http_protocol = string.match(rsl, "(.-)%s")
    http_table["protocol"] = http_protocol

    -- request_token
    cookie = HttpGetRequestHeader("Cookie")
    if cookie ~= nil then
        session_id = string.match(cookie, "sessionID=(.-);")
        if session_id ~= nil then
            http_table["request_token"] = md5Encode(session_id)
        else
            http_table["request_token"]  = nil
        end
    end

    -- response_token && member_id
    set_cookie = HttpGetResponseHeader("Set-Cookie")
    if set_cookie ~= nil then
        session_id = string.match(set_cookie, "sessionID=(.-);")
        http_table["response_token"]  = md5Encode(session_id)
        member_id = string.match(set_cookie, "memberId=(.-);")
        http_table["member_id"] = tonumber(member_id)
    end
    
    -- login_results
    a, o, e = HttpGetResponseBody()
    for n, v in ipairs(a) do
        body = json.decode(v)
        results_code = tonumber(body["code"])
        if results_code == success_code then
            results = "success"
        else
            results = "failed"
        end
    end
    http_table["results"] = results
    http_table["results_code"] = results_code

    -- email & password
    a, o, e = HttpGetRequestBody()
    for n, v in ipairs(a) do
        res = formatStr(v)
        mail = urlDecode(res['email'])
        pass = md5Encode(res['password'])
    end
    http_table["email"] = mail
    http_table["password"] = pass

    -- RequestHeaders
    rh = HttpGetRequestHeaders()
    for k, v in pairs(rh) do
        key = string.lower(k)

        common_var = common_mapping_table[key]
        if common_var ~= nil then
            http_table[common_var] = v
        end

        request_var = request_mapping_table[key]
        if request_var ~= nil then
            http_table[request_var] = v
        end
    end

    -- ResponseHeaders
    rsh = HttpGetResponseHeaders()
    for k, v in pairs(rsh) do
        key = string.lower(k)

        common_var = common_mapping_table[key]
        if common_var ~= nil then
            http_table[common_var] = v
        end

        response_var = response_mapping_table[key]
        if response_var ~= nil then
            http_table[response_var] = v
        end
    end

    -- timestring = SCPacketTimeString() 2019-09-10T06:08:35.582449+0000
    sec, usec = SCPacketTimestamp()
    timestring = os.date("!%Y-%m-%dT%T", sec) .. "." .. usec .. "+0000"
    
    ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()

    -- flow_id
    id = SCFlowId()
    flow_id = string.format("%.0f", id)

    -- true_ip
    true_client_ip = HttpGetRequestHeader("True-Client-IP")
    if true_client_ip ~= nil then
        src_ip = true_client_ip
    end

    -- table
    raw_data = {
        timestamp = timestring,
        flow_id = flow_id,
        src_ip = src_ip,
        src_port = src_port,
        dest_ip = dst_ip,
        dest_port = dst_port,
        event_name = event_name,
        event_type = event_type,
        app_type = app_type,
        http = http_table,
        proto = "TCP"
    }

    -- json encode
    data = json.encode(raw_data)

    file:write(data .. "\n")
    file:flush()

    http = http + 1
end


function deinit (args)
    SCLogInfo ("HTTP transactions logged: " .. http);
    file:close(file)
end