@@ -12,14 +12,14 @@ discard block |
||
| 12 | 12 | # print "Examine ".$received[0][$i]."\n"; |
| 13 | 13 | if ( preg_match($msa,$received['host'][$i]) ) |
| 14 | 14 | $dateR = $received['date'][$i]; |
| 15 | - foreach ($mxserver as $mx) { |
|
| 16 | - if (!$ip) |
|
| 15 | + foreach ($mxserver as $mx) { |
|
| 16 | + if (!$ip) |
|
| 17 | 17 | if ($mx == $received['host'][$i]) { |
| 18 | 18 | $host = $received['host'][$i]; |
| 19 | 19 | $ip = $received['ip'][$i]; |
| 20 | - } |
|
| 21 | - } |
|
| 22 | - } |
|
| 20 | + } |
|
| 21 | + } |
|
| 22 | + } |
|
| 23 | 23 | } |
| 24 | 24 | if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) |
| 25 | 25 | $dateC['date'] = 'Not found'; |
@@ -39,15 +39,15 @@ discard block |
||
| 39 | 39 | |
| 40 | 40 | |
| 41 | 41 | function summaryBadReport ($uidvet) { |
| 42 | - $nuid = $uidvet['count']; |
|
| 43 | - if ( empty($uidvet) ) return NULL; |
|
| 44 | - $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n"; |
|
| 42 | + $nuid = $uidvet['count']; |
|
| 43 | + if ( empty($uidvet) ) return NULL; |
|
| 44 | + $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n"; |
|
| 45 | 45 | |
| 46 | - /* Remove count index */ |
|
| 47 | - $uids = array_keys($uidvet['uid']); |
|
| 46 | + /* Remove count index */ |
|
| 47 | + $uids = array_keys($uidvet['uid']); |
|
| 48 | 48 | $totlearn = 0; |
| 49 | 49 | |
| 50 | - foreach ( $uids as $uid ) { |
|
| 50 | + foreach ( $uids as $uid ) { |
|
| 51 | 51 | $totlearn += $uidvet['uid']["$uid"]['count'];; |
| 52 | 52 | $return .= sprintf ('<tr><td>%s</td><td>%u</td></tr>',$uid,$uidvet['uid']["$uid"]['count']); |
| 53 | 53 | } |
@@ -60,26 +60,26 @@ discard block |
||
| 60 | 60 | |
| 61 | 61 | function array_msort($array, $cols) |
| 62 | 62 | { |
| 63 | - $colarr = array(); |
|
| 64 | - foreach ($cols as $col => $order) { |
|
| 65 | - $colarr[$col] = array(); |
|
| 66 | - foreach ($array as $k => $row) { $colarr[$col]['_'.$k] = strtolower($row[$col]); } |
|
| 67 | - } |
|
| 68 | - $eval = 'array_multisort('; |
|
| 69 | - foreach ($cols as $col => $order) { |
|
| 70 | - $eval .= '$colarr[\''.$col.'\'],'.$order.','; |
|
| 71 | - } |
|
| 72 | - $eval = substr($eval,0,-1).');'; |
|
| 73 | - eval($eval); |
|
| 74 | - $ret = array(); |
|
| 75 | - foreach ($colarr as $col => $arr) { |
|
| 76 | - foreach ($arr as $k => $v) { |
|
| 77 | - $k = substr($k,1); |
|
| 78 | - if (!isset($ret[$k])) $ret[$k] = $array[$k]; |
|
| 79 | - if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col]; |
|
| 80 | - } |
|
| 81 | - } |
|
| 82 | - return $ret; |
|
| 63 | + $colarr = array(); |
|
| 64 | + foreach ($cols as $col => $order) { |
|
| 65 | + $colarr[$col] = array(); |
|
| 66 | + foreach ($array as $k => $row) { $colarr[$col]['_'.$k] = strtolower($row[$col]); } |
|
| 67 | + } |
|
| 68 | + $eval = 'array_multisort('; |
|
| 69 | + foreach ($cols as $col => $order) { |
|
| 70 | + $eval .= '$colarr[\''.$col.'\'],'.$order.','; |
|
| 71 | + } |
|
| 72 | + $eval = substr($eval,0,-1).');'; |
|
| 73 | + eval($eval); |
|
| 74 | + $ret = array(); |
|
| 75 | + foreach ($colarr as $col => $arr) { |
|
| 76 | + foreach ($arr as $k => $v) { |
|
| 77 | + $k = substr($k,1); |
|
| 78 | + if (!isset($ret[$k])) $ret[$k] = $array[$k]; |
|
| 79 | + if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col]; |
|
| 80 | + } |
|
| 81 | + } |
|
| 82 | + return $ret; |
|
| 83 | 83 | |
| 84 | 84 | } |
| 85 | 85 | |
@@ -94,8 +94,8 @@ discard block |
||
| 94 | 94 | |
| 95 | 95 | foreach ( $ips as $ip ) { |
| 96 | 96 | if ( $ip == 'count' ) continue; |
| 97 | - $nlearn = $ipvet['ip']["$ip"]['count']; |
|
| 98 | - unset($ipvet['ip']["$ip"]['count']); |
|
| 97 | + $nlearn = $ipvet['ip']["$ip"]['count']; |
|
| 98 | + unset($ipvet['ip']["$ip"]['count']); |
|
| 99 | 99 | $nuid = count($ipvet['ip']["$ip"]); |
| 100 | 100 | if ( !$cf['onlyReport'] ) { |
| 101 | 101 | if ( ($nlearn >= $cf['thresholdip']["$category"])&&($nuid >= $cf['thresholduid']["$category"]) ) { |
@@ -122,9 +122,9 @@ discard block |
||
| 122 | 122 | $return .='<tr><td rowspan="'.$nuid.'">'.$ip.'</td>'; |
| 123 | 123 | $return .= sprintf ('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>',$ipvet['ip']["$ip"][0],$nlearn,$nowlist["$listed"]['name']); |
| 124 | 124 | $rowuid=NULL; |
| 125 | - for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 125 | + for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 126 | 126 | array_shift($ipvet['ip']["$ip"]); |
| 127 | - $return .= vsprintf ($rowuid,$ipvet['ip']["$ip"]); |
|
| 127 | + $return .= vsprintf ($rowuid,$ipvet['ip']["$ip"]); |
|
| 128 | 128 | |
| 129 | 129 | } |
| 130 | 130 | $return .= sprintf ('<tr><th title="unique ips">%u</th><th title="unique uids">%u</th><th>%u</th></table>',$ipvet['ip']['count'],$ipvet['uid']['count'],$nips); |
@@ -134,20 +134,20 @@ discard block |
||
| 134 | 134 | /* Not used for listing purpose, but useful to you! */ |
| 135 | 135 | $return .= '<h3>Statistics by UID</h3><table><tr><th>UID</th><th>IP learned</th><th>Learned times</th></tr>'."\n"; |
| 136 | 136 | $uids = array_keys($ipvet['uid']); |
| 137 | - foreach ( $uids as $uid ) { |
|
| 137 | + foreach ( $uids as $uid ) { |
|
| 138 | 138 | if ( $uid == 'count' ) continue; |
| 139 | - $nlearn = $ipvet['uid']["$uid"]['count']; |
|
| 140 | - unset ( $ipvet['uid']["$uid"]['count'] ); |
|
| 139 | + $nlearn = $ipvet['uid']["$uid"]['count']; |
|
| 140 | + unset ( $ipvet['uid']["$uid"]['count'] ); |
|
| 141 | 141 | $nip = count($ipvet['uid']["$uid"]); |
| 142 | 142 | $return .='<tr><td rowspan="'.$nip.'">'.$uid.'</td>'; |
| 143 | 143 | $return .= sprintf ('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>',$ipvet['uid']["$uid"][0],$nlearn); |
| 144 | - $rowuid=NULL; |
|
| 145 | - for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 146 | - array_shift($ipvet['uid']["$uid"]); |
|
| 147 | - $return .= vsprintf ($rowuid,$ipvet['uid']["$uid"]); |
|
| 144 | + $rowuid=NULL; |
|
| 145 | + for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 146 | + array_shift($ipvet['uid']["$uid"]); |
|
| 147 | + $return .= vsprintf ($rowuid,$ipvet['uid']["$uid"]); |
|
| 148 | 148 | |
| 149 | - } |
|
| 150 | - $return .= sprintf ('<tr><th title="unique uids">%u</th><th title="unique ips">%u</th><th>%u</th></table>',$ipvet['uid']['count'],$ipvet['ip']['count'],$nips); |
|
| 149 | + } |
|
| 150 | + $return .= sprintf ('<tr><th title="unique uids">%u</th><th title="unique ips">%u</th><th>%u</th></table>',$ipvet['uid']['count'],$ipvet['ip']['count'],$nips); |
|
| 151 | 151 | |
| 152 | 152 | |
| 153 | 153 | return $return; |
@@ -175,50 +175,50 @@ discard block |
||
| 175 | 175 | */ |
| 176 | 176 | |
| 177 | 177 | // A one shot search |
| 178 | - $searchParams = array( |
|
| 179 | - 'earliest_time' => date("c",strtotime ($date)-120), |
|
| 180 | - 'latest_time' => date("c",strtotime ($date)+60) |
|
| 181 | - ); |
|
| 178 | + $searchParams = array( |
|
| 179 | + 'earliest_time' => date("c",strtotime ($date)-120), |
|
| 180 | + 'latest_time' => date("c",strtotime ($date)+60) |
|
| 181 | + ); |
|
| 182 | 182 | |
| 183 | - // Run a oneshot search that returns the job's results |
|
| 184 | - $resultsStream = $service->oneshotSearch($searchQueryBlocking, $searchParams); |
|
| 185 | - $resultSearch = new Splunk_ResultsReader($resultsStream); |
|
| 183 | + // Run a oneshot search that returns the job's results |
|
| 184 | + $resultsStream = $service->oneshotSearch($searchQueryBlocking, $searchParams); |
|
| 185 | + $resultSearch = new Splunk_ResultsReader($resultsStream); |
|
| 186 | 186 | |
| 187 | 187 | // Use the built-in XML parser to display the job results |
| 188 | 188 | foreach ($resultSearch as $result) |
| 189 | 189 | { |
| 190 | - if ($result instanceof Splunk_ResultsFieldOrder) |
|
| 191 | - { |
|
| 192 | - // More than one field attribute returned by search |
|
| 193 | - // You must redefine the search |
|
| 194 | - if ( count($result->getFieldNames()) > 1 ) return FALSE; |
|
| 195 | - } |
|
| 196 | - else if ($result instanceof Splunk_ResultsMessage) |
|
| 197 | - { |
|
| 198 | - // I don't want messages in my search |
|
| 199 | - return FALSE; |
|
| 200 | - } |
|
| 201 | - else if (is_array($result)) |
|
| 202 | - { |
|
| 203 | - // Process a row |
|
| 204 | - foreach ($result as $key => $valueOrValues) |
|
| 205 | - { |
|
| 206 | - if (is_array($valueOrValues)) |
|
| 207 | - { |
|
| 208 | - return FALSE; |
|
| 209 | - } |
|
| 210 | - else |
|
| 211 | - { |
|
| 212 | - return $valueOrValues; |
|
| 213 | - #print " {$key} => {$value}\r\n"; |
|
| 214 | - } |
|
| 215 | - } |
|
| 216 | - } |
|
| 217 | - else |
|
| 218 | - { |
|
| 219 | - #print "Unknow result type"; |
|
| 220 | - return FALSE; |
|
| 221 | - } |
|
| 190 | + if ($result instanceof Splunk_ResultsFieldOrder) |
|
| 191 | + { |
|
| 192 | + // More than one field attribute returned by search |
|
| 193 | + // You must redefine the search |
|
| 194 | + if ( count($result->getFieldNames()) > 1 ) return FALSE; |
|
| 195 | + } |
|
| 196 | + else if ($result instanceof Splunk_ResultsMessage) |
|
| 197 | + { |
|
| 198 | + // I don't want messages in my search |
|
| 199 | + return FALSE; |
|
| 200 | + } |
|
| 201 | + else if (is_array($result)) |
|
| 202 | + { |
|
| 203 | + // Process a row |
|
| 204 | + foreach ($result as $key => $valueOrValues) |
|
| 205 | + { |
|
| 206 | + if (is_array($valueOrValues)) |
|
| 207 | + { |
|
| 208 | + return FALSE; |
|
| 209 | + } |
|
| 210 | + else |
|
| 211 | + { |
|
| 212 | + return $valueOrValues; |
|
| 213 | + #print " {$key} => {$value}\r\n"; |
|
| 214 | + } |
|
| 215 | + } |
|
| 216 | + } |
|
| 217 | + else |
|
| 218 | + { |
|
| 219 | + #print "Unknow result type"; |
|
| 220 | + return FALSE; |
|
| 221 | + } |
|
| 222 | 222 | } |
| 223 | 223 | } |
| 224 | 224 | |
@@ -227,26 +227,26 @@ discard block |
||
| 227 | 227 | $file = dirname(__FILE__) . '/' . $cf['reportFile']["$type"]; |
| 228 | 228 | $fileb= dirname(__FILE__) . '/' . $cf['badreportFile']["$type"]; |
| 229 | 229 | $m_mail = imap_open('{'.$cf['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['authuser'].'}'.$cf['folder']["$type"], $cf['account'],$cf['authpassword'], OP_READONLY) |
| 230 | - or syslog (LOG_EMERG, $cf['user'].': Error in IMAP connection to <'.$cf['mailhost'].'>: ' . imap_last_error()); |
|
| 230 | + or syslog (LOG_EMERG, $cf['user'].': Error in IMAP connection to <'.$cf['mailhost'].'>: ' . imap_last_error()); |
|
| 231 | 231 | if ( !$m_mail ) exit(254); |
| 232 | 232 | |
| 233 | 233 | |
| 234 | 234 | syslog (LOG_INFO,$cf['user'].': Successfully connected to <'.$cf['mailhost'].">; Reading $type messages of last ".$cf['oldestday'].' days...'); |
| 235 | 235 | //get all messages |
| 236 | 236 | $dateTh = date ( "d-M-Y", strToTime ( '-'.$cf['oldestday'].' days' ) ); |
| 237 | - $dateN = date ( "d-M-Y", strToTime ( "now" ) ); |
|
| 238 | - $m_search=imap_search ($m_mail, "SINCE \"$dateTh\" BEFORE \"$dateN\"" ); |
|
| 237 | + $dateN = date ( "d-M-Y", strToTime ( "now" ) ); |
|
| 238 | + $m_search=imap_search ($m_mail, "SINCE \"$dateTh\" BEFORE \"$dateN\"" ); |
|
| 239 | 239 | |
| 240 | 240 | |
| 241 | 241 | // Order results starting from newest message |
| 242 | 242 | if ( empty($m_search) ) { |
| 243 | 243 | syslog (LOG_INFO,$cf['user'].": No mail found in $type folder. No reports written for $type."); |
| 244 | - if ( $ierr = imap_errors() ) |
|
| 245 | - foreach ( $ierr as $thiserr ) |
|
| 246 | - syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
|
| 247 | - if ( $ierr = imap_alerts() ) |
|
| 248 | - foreach ( $ierr as $thiserr ) |
|
| 249 | - syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 244 | + if ( $ierr = imap_errors() ) |
|
| 245 | + foreach ( $ierr as $thiserr ) |
|
| 246 | + syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
|
| 247 | + if ( $ierr = imap_alerts() ) |
|
| 248 | + foreach ( $ierr as $thiserr ) |
|
| 249 | + syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 250 | 250 | imap_close( $m_mail ); |
| 251 | 251 | if ( file_exists( $file ) ) unlink ($file); |
| 252 | 252 | if ( file_exists( $fileb ) ) unlink ($fileb); |
@@ -279,16 +279,16 @@ discard block |
||
| 279 | 279 | $uidbad['count'] = 0; |
| 280 | 280 | $uidbad['uid'] = array(); |
| 281 | 281 | |
| 282 | - // loop for each message |
|
| 282 | + // loop for each message |
|
| 283 | 283 | foreach ($m_search as $onem) { |
| 284 | 284 | |
| 285 | - //get imap header info for obj thang |
|
| 286 | - //$headers = imap_headerinfo($m_mail, $onem); |
|
| 287 | - //$head = imap_fetchheader($m_mail, $headers->Msgno); |
|
| 285 | + //get imap header info for obj thang |
|
| 286 | + //$headers = imap_headerinfo($m_mail, $onem); |
|
| 287 | + //$head = imap_fetchheader($m_mail, $headers->Msgno); |
|
| 288 | 288 | $head = imap_fetchheader($m_mail, $onem ); |
| 289 | - //$obj = imap_rfc822_parse_headers( $head); |
|
| 289 | + //$obj = imap_rfc822_parse_headers( $head); |
|
| 290 | 290 | |
| 291 | - list ($ip,$host,$dateReceived,$dateClient,$mid) = getIP( $head,$cf['mx'],$cf['msalearn'] ); |
|
| 291 | + list ($ip,$host,$dateReceived,$dateClient,$mid) = getIP( $head,$cf['mx'],$cf['msalearn'] ); |
|
| 292 | 292 | if (empty($mid)) { |
| 293 | 293 | $uid='NA'; |
| 294 | 294 | syslog (LOG_ERR, $cf['user'].": Error retrieving data for empty Message-ID."); |
@@ -303,11 +303,11 @@ discard block |
||
| 303 | 303 | } |
| 304 | 304 | } |
| 305 | 305 | |
| 306 | - /* Update count of each ip */ |
|
| 307 | - if ($host and ($uid!='NA') and ($uid!='unauthenticated') and ($uid!='unknown')) { /* IP is received by MX servers and learned by valid uid */ |
|
| 306 | + /* Update count of each ip */ |
|
| 307 | + if ($host and ($uid!='NA') and ($uid!='unauthenticated') and ($uid!='unknown')) { /* IP is received by MX servers and learned by valid uid */ |
|
| 308 | 308 | $ipuid['count']++; //number of right messages |
| 309 | 309 | |
| 310 | - if (in_array($uid,array_keys($ipuid['uid']))) { |
|
| 310 | + if (in_array($uid,array_keys($ipuid['uid']))) { |
|
| 311 | 311 | $ipuid['uid']["$uid"]['count']++; //number of learn by this uid |
| 312 | 312 | if (!in_array($ip,$ipuid['uid']["$uid"])) |
| 313 | 313 | $ipuid['uid']["$uid"][]=$ip; //ips learned by this uid |
@@ -318,29 +318,29 @@ discard block |
||
| 318 | 318 | $ipuid['uid']['count']++; //number of unique uids |
| 319 | 319 | } |
| 320 | 320 | |
| 321 | - if (in_array($ip,array_keys($ipuid['ip']))) { |
|
| 322 | - $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages |
|
| 321 | + if (in_array($ip,array_keys($ipuid['ip']))) { |
|
| 322 | + $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages |
|
| 323 | 323 | if (!in_array($uid,$ipuid['ip']["$ip"])) |
| 324 | 324 | $ipuid['ip']["$ip"][]=$uid; //uids that learned this ip |
| 325 | 325 | } |
| 326 | - else { |
|
| 327 | - $ipuid['ip']["$ip"]['count'] = 1; |
|
| 326 | + else { |
|
| 327 | + $ipuid['ip']["$ip"]['count'] = 1; |
|
| 328 | 328 | $ipuid['ip']["$ip"][]=$uid; |
| 329 | 329 | $ipuid['ip']['count']++; //number of unique ips |
| 330 | - } |
|
| 330 | + } |
|
| 331 | 331 | |
| 332 | - /* Update HTML report */ |
|
| 333 | - fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) ); |
|
| 332 | + /* Update HTML report */ |
|
| 333 | + fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) ); |
|
| 334 | 334 | } |
| 335 | - else { /* Bad learn */ |
|
| 335 | + else { /* Bad learn */ |
|
| 336 | 336 | |
| 337 | - if (in_array($uid,array_keys($uidbad['uid']))) |
|
| 338 | - $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid |
|
| 339 | - else { |
|
| 340 | - $uidbad['uid']["$uid"]['count'] = 1; |
|
| 337 | + if (in_array($uid,array_keys($uidbad['uid']))) |
|
| 338 | + $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid |
|
| 339 | + else { |
|
| 340 | + $uidbad['uid']["$uid"]['count'] = 1; |
|
| 341 | 341 | $uidbad['uid']["$uid"][]=$uid; |
| 342 | - $uidbad['count']++; //numeber of unique bad uids |
|
| 343 | - } |
|
| 342 | + $uidbad['count']++; //numeber of unique bad uids |
|
| 343 | + } |
|
| 344 | 344 | /* The reason of bad report */ |
| 345 | 345 | if ($host === FALSE) $reason = 'This mail was not received by recognized MX host'; |
| 346 | 346 | if ($dateReceived === FALSE) $reason = 'This mail was not submitted to recognized MSA for learn'; |
@@ -362,17 +362,17 @@ discard block |
||
| 362 | 362 | fwrite($fp, '</table>'); |
| 363 | 363 | fwrite($fp, '<hr><h2>Summary Report</h2><h5>Listing policy: ip must be learned at least '.$cf['thresholdip']["$type"].' times from at least '.$cf['thresholduid']["$type"].' different valid uids.</h5>' ); |
| 364 | 364 | |
| 365 | - /* Make MYSQL connection */ |
|
| 365 | + /* Make MYSQL connection */ |
|
| 366 | 366 | if ( $cf['onlyReport'] ) |
| 367 | 367 | $mysqli = NULL; |
| 368 | 368 | else { |
| 369 | - $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']); |
|
| 370 | - if ($mysqli->connect_error) { |
|
| 371 | - syslog (LOG_EMERG, $cf['user'].': Connect Error (' . $mysqli->connect_errno . ') ' |
|
| 372 | - . $mysqli->connect_error); |
|
| 373 | - exit (254); |
|
| 374 | - } |
|
| 375 | - syslog(LOG_INFO, $cf['user'].': Successfully mysql connected to ' . $mysqli->host_info) ; |
|
| 369 | + $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']); |
|
| 370 | + if ($mysqli->connect_error) { |
|
| 371 | + syslog (LOG_EMERG, $cf['user'].': Connect Error (' . $mysqli->connect_errno . ') ' |
|
| 372 | + . $mysqli->connect_error); |
|
| 373 | + exit (254); |
|
| 374 | + } |
|
| 375 | + syslog(LOG_INFO, $cf['user'].': Successfully mysql connected to ' . $mysqli->host_info) ; |
|
| 376 | 376 | } |
| 377 | 377 | /***********************/ |
| 378 | 378 | |
@@ -392,8 +392,8 @@ discard block |
||
| 392 | 392 | foreach ( $ierr as $thiserr ) |
| 393 | 393 | syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
| 394 | 394 | if ( $ierr = imap_alerts() ) |
| 395 | - foreach ( $ierr as $thiserr ) |
|
| 396 | - syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 395 | + foreach ( $ierr as $thiserr ) |
|
| 396 | + syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 397 | 397 | imap_close($m_mail); |
| 398 | 398 | } |
| 399 | 399 | ?> |
@@ -1,5 +1,5 @@ discard block |
||
| 1 | 1 | <?php |
| 2 | -function getIP($header,$mxserver,$msa) { |
|
| 2 | +function getIP($header, $mxserver, $msa) { |
|
| 3 | 3 | /* Get submission server's IP from header's mail */ |
| 4 | 4 | /* Each line must end with /r/n */ |
| 5 | 5 | /* IP is the first one written by your mxserver */ |
@@ -7,10 +7,10 @@ discard block |
||
| 7 | 7 | $ip = FALSE; |
| 8 | 8 | $host = FALSE; |
| 9 | 9 | $dateR = FALSE; |
| 10 | - if ( preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m',$header,$received) ) { |
|
| 11 | - for ($i = count($received[0])-1;$i>=0;$i--) { |
|
| 10 | + if (preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m', $header, $received)) { |
|
| 11 | + for ($i = count($received[0])-1; $i>=0; $i--) { |
|
| 12 | 12 | # print "Examine ".$received[0][$i]."\n"; |
| 13 | - if ( preg_match($msa,$received['host'][$i]) ) |
|
| 13 | + if (preg_match($msa, $received['host'][$i])) |
|
| 14 | 14 | $dateR = $received['date'][$i]; |
| 15 | 15 | foreach ($mxserver as $mx) { |
| 16 | 16 | if (!$ip) |
@@ -21,38 +21,38 @@ discard block |
||
| 21 | 21 | } |
| 22 | 22 | } |
| 23 | 23 | } |
| 24 | - if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) |
|
| 24 | + if (preg_match('/\r\nDate:\s(?P<date>.*)\r\n/', $header, $dateC) != 1) |
|
| 25 | 25 | $dateC['date'] = 'Not found'; |
| 26 | - if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) |
|
| 26 | + if (preg_match('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/', $header, $mid) != 1) |
|
| 27 | 27 | $mid['mid'] = NULL; |
| 28 | - return array($ip,$host,$dateR,$dateC['date'],$mid['mid']); |
|
| 28 | + return array($ip, $host, $dateR, $dateC['date'], $mid['mid']); |
|
| 29 | 29 | } |
| 30 | 30 | |
| 31 | -function updateReport ($ip,$uid,$ipcount,$uidcount,$hostname,$dateC,$msgid,$dateL) { |
|
| 31 | +function updateReport($ip, $uid, $ipcount, $uidcount, $hostname, $dateC, $msgid, $dateL) { |
|
| 32 | 32 | |
| 33 | - return sprintf ('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td>%u</td><td>%u</td><td>%s</td><td>%s</td></tr>'."\n",$dateL,$dateC,$uid,$ip,$uidcount,$ipcount,$hostname,htmlentities($msgid) ); |
|
| 33 | + return sprintf('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td>%u</td><td>%u</td><td>%s</td><td>%s</td></tr>'."\n", $dateL, $dateC, $uid, $ip, $uidcount, $ipcount, $hostname, htmlentities($msgid)); |
|
| 34 | 34 | } |
| 35 | 35 | |
| 36 | -function updatebadReport ( $uid,$dateC,$msgid,$dateL,$text ) { |
|
| 37 | - return sprintf ('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td nowrap>%s</td></tr>'."\n",$dateL,$dateC,$uid,htmlentities($msgid),$text ); |
|
| 36 | +function updatebadReport($uid, $dateC, $msgid, $dateL, $text) { |
|
| 37 | + return sprintf('<tr><td nowrap>%s</td><td nowrap>%s</td><td>%s</td><td>%s</td><td nowrap>%s</td></tr>'."\n", $dateL, $dateC, $uid, htmlentities($msgid), $text); |
|
| 38 | 38 | } |
| 39 | 39 | |
| 40 | 40 | |
| 41 | -function summaryBadReport ($uidvet) { |
|
| 41 | +function summaryBadReport($uidvet) { |
|
| 42 | 42 | $nuid = $uidvet['count']; |
| 43 | - if ( empty($uidvet) ) return NULL; |
|
| 43 | + if (empty($uidvet)) return NULL; |
|
| 44 | 44 | $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n"; |
| 45 | 45 | |
| 46 | 46 | /* Remove count index */ |
| 47 | 47 | $uids = array_keys($uidvet['uid']); |
| 48 | 48 | $totlearn = 0; |
| 49 | 49 | |
| 50 | - foreach ( $uids as $uid ) { |
|
| 51 | - $totlearn += $uidvet['uid']["$uid"]['count'];; |
|
| 52 | - $return .= sprintf ('<tr><td>%s</td><td>%u</td></tr>',$uid,$uidvet['uid']["$uid"]['count']); |
|
| 50 | + foreach ($uids as $uid) { |
|
| 51 | + $totlearn += $uidvet['uid']["$uid"]['count']; ; |
|
| 52 | + $return .= sprintf('<tr><td>%s</td><td>%u</td></tr>', $uid, $uidvet['uid']["$uid"]['count']); |
|
| 53 | 53 | } |
| 54 | - $return .= sprintf ('<tr><th>%s</th><th>%u</th></tr></table>','TOT',$totlearn); |
|
| 55 | - $return .= sprintf ('<p>%s : %u</p>','Unique UID',$nuid); |
|
| 54 | + $return .= sprintf('<tr><th>%s</th><th>%u</th></tr></table>', 'TOT', $totlearn); |
|
| 55 | + $return .= sprintf('<p>%s : %u</p>', 'Unique UID', $nuid); |
|
| 56 | 56 | |
| 57 | 57 | return $return; |
| 58 | 58 | } |
@@ -69,12 +69,12 @@ discard block |
||
| 69 | 69 | foreach ($cols as $col => $order) { |
| 70 | 70 | $eval .= '$colarr[\''.$col.'\'],'.$order.','; |
| 71 | 71 | } |
| 72 | - $eval = substr($eval,0,-1).');'; |
|
| 72 | + $eval = substr($eval, 0, -1).');'; |
|
| 73 | 73 | eval($eval); |
| 74 | 74 | $ret = array(); |
| 75 | 75 | foreach ($colarr as $col => $arr) { |
| 76 | 76 | foreach ($arr as $k => $v) { |
| 77 | - $k = substr($k,1); |
|
| 77 | + $k = substr($k, 1); |
|
| 78 | 78 | if (!isset($ret[$k])) $ret[$k] = $array[$k]; |
| 79 | 79 | if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col]; |
| 80 | 80 | } |
@@ -84,28 +84,28 @@ discard block |
||
| 84 | 84 | } |
| 85 | 85 | |
| 86 | 86 | |
| 87 | -function summaryReportAndList ($cf,$myconn,$tables,$category,$ipvet) { |
|
| 87 | +function summaryReportAndList($cf, $myconn, $tables, $category, $ipvet) { |
|
| 88 | 88 | $nips = $ipvet['count']; |
| 89 | 89 | |
| 90 | - if ( empty($ipvet) ) return NULL; |
|
| 90 | + if (empty($ipvet)) return NULL; |
|
| 91 | 91 | $return = '<h3>Statistics by IP</h3><table><tr><th>IP</th><th>Learned by</th><th>Learned times</th><th title="This field doesn\'t say if this ip is currently listed, but it says if this IP has listed now!">Listed Now</th></tr>'."\n"; |
| 92 | 92 | |
| 93 | 93 | $ips = array_keys($ipvet['ip']); |
| 94 | 94 | |
| 95 | - foreach ( $ips as $ip ) { |
|
| 96 | - if ( $ip == 'count' ) continue; |
|
| 95 | + foreach ($ips as $ip) { |
|
| 96 | + if ($ip == 'count') continue; |
|
| 97 | 97 | $nlearn = $ipvet['ip']["$ip"]['count']; |
| 98 | 98 | unset($ipvet['ip']["$ip"]['count']); |
| 99 | 99 | $nuid = count($ipvet['ip']["$ip"]); |
| 100 | - if ( !$cf['onlyReport'] ) { |
|
| 101 | - if ( ($nlearn >= $cf['thresholdip']["$category"])&&($nuid >= $cf['thresholduid']["$category"]) ) { |
|
| 100 | + if (!$cf['onlyReport']) { |
|
| 101 | + if (($nlearn>=$cf['thresholdip']["$category"]) && ($nuid>=$cf['thresholduid']["$category"])) { |
|
| 102 | 102 | $reason = "The IP <$ip> has been listed because was marked $nlearn times as $category by $nuid different accounts during last ".$cf['oldestday'].' days.'; |
| 103 | - $listed = searchAndList ($myconn,$cf['user'],$tables,$cf['list']["$category"],$ip,$cf['unit']["$category"],$cf['quantity']["$category"],$reason); |
|
| 103 | + $listed = searchAndList($myconn, $cf['user'], $tables, $cf['list']["$category"], $ip, $cf['unit']["$category"], $cf['quantity']["$category"], $reason); |
|
| 104 | 104 | } |
| 105 | 105 | else $listed = FALSE; |
| 106 | 106 | } |
| 107 | 107 | else $listed = FALSE; |
| 108 | - $nowlist = array( TRUE => array( |
|
| 108 | + $nowlist = array(TRUE => array( |
|
| 109 | 109 | 'style' => 'id=\'ipfound\'', |
| 110 | 110 | 'name' => 'YES', |
| 111 | 111 | ), |
@@ -119,45 +119,45 @@ discard block |
||
| 119 | 119 | ) |
| 120 | 120 | ); |
| 121 | 121 | |
| 122 | - $return .='<tr><td rowspan="'.$nuid.'">'.$ip.'</td>'; |
|
| 123 | - $return .= sprintf ('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>',$ipvet['ip']["$ip"][0],$nlearn,$nowlist["$listed"]['name']); |
|
| 124 | - $rowuid=NULL; |
|
| 125 | - for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 122 | + $return .= '<tr><td rowspan="'.$nuid.'">'.$ip.'</td>'; |
|
| 123 | + $return .= sprintf('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>', $ipvet['ip']["$ip"][0], $nlearn, $nowlist["$listed"]['name']); |
|
| 124 | + $rowuid = NULL; |
|
| 125 | + for ($j = 1; $j<$nuid; $j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 126 | 126 | array_shift($ipvet['ip']["$ip"]); |
| 127 | - $return .= vsprintf ($rowuid,$ipvet['ip']["$ip"]); |
|
| 127 | + $return .= vsprintf($rowuid, $ipvet['ip']["$ip"]); |
|
| 128 | 128 | |
| 129 | 129 | } |
| 130 | - $return .= sprintf ('<tr><th title="unique ips">%u</th><th title="unique uids">%u</th><th>%u</th></table>',$ipvet['ip']['count'],$ipvet['uid']['count'],$nips); |
|
| 130 | + $return .= sprintf('<tr><th title="unique ips">%u</th><th title="unique uids">%u</th><th>%u</th></table>', $ipvet['ip']['count'], $ipvet['uid']['count'], $nips); |
|
| 131 | 131 | |
| 132 | 132 | |
| 133 | 133 | /* Statistics by UID */ |
| 134 | 134 | /* Not used for listing purpose, but useful to you! */ |
| 135 | 135 | $return .= '<h3>Statistics by UID</h3><table><tr><th>UID</th><th>IP learned</th><th>Learned times</th></tr>'."\n"; |
| 136 | 136 | $uids = array_keys($ipvet['uid']); |
| 137 | - foreach ( $uids as $uid ) { |
|
| 138 | - if ( $uid == 'count' ) continue; |
|
| 137 | + foreach ($uids as $uid) { |
|
| 138 | + if ($uid == 'count') continue; |
|
| 139 | 139 | $nlearn = $ipvet['uid']["$uid"]['count']; |
| 140 | - unset ( $ipvet['uid']["$uid"]['count'] ); |
|
| 140 | + unset ($ipvet['uid']["$uid"]['count']); |
|
| 141 | 141 | $nip = count($ipvet['uid']["$uid"]); |
| 142 | - $return .='<tr><td rowspan="'.$nip.'">'.$uid.'</td>'; |
|
| 143 | - $return .= sprintf ('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>',$ipvet['uid']["$uid"][0],$nlearn); |
|
| 144 | - $rowuid=NULL; |
|
| 145 | - for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 142 | + $return .= '<tr><td rowspan="'.$nip.'">'.$uid.'</td>'; |
|
| 143 | + $return .= sprintf('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>', $ipvet['uid']["$uid"][0], $nlearn); |
|
| 144 | + $rowuid = NULL; |
|
| 145 | + for ($j = 1; $j<$nip; $j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 146 | 146 | array_shift($ipvet['uid']["$uid"]); |
| 147 | - $return .= vsprintf ($rowuid,$ipvet['uid']["$uid"]); |
|
| 147 | + $return .= vsprintf($rowuid, $ipvet['uid']["$uid"]); |
|
| 148 | 148 | |
| 149 | 149 | } |
| 150 | - $return .= sprintf ('<tr><th title="unique uids">%u</th><th title="unique ips">%u</th><th>%u</th></table>',$ipvet['uid']['count'],$ipvet['ip']['count'],$nips); |
|
| 150 | + $return .= sprintf('<tr><th title="unique uids">%u</th><th title="unique ips">%u</th><th>%u</th></table>', $ipvet['uid']['count'], $ipvet['ip']['count'], $nips); |
|
| 151 | 151 | |
| 152 | 152 | |
| 153 | 153 | return $return; |
| 154 | 154 | } |
| 155 | 155 | |
| 156 | 156 | |
| 157 | -function splunksearch ($service,$message_id,$date) { |
|
| 157 | +function splunksearch($service, $message_id, $date) { |
|
| 158 | 158 | |
| 159 | 159 | // Run a blocking search |
| 160 | - $searchQueryBlocking = 'search (message_id="'. addslashes( $message_id ) . |
|
| 160 | + $searchQueryBlocking = 'search (message_id="'.addslashes($message_id). |
|
| 161 | 161 | '" OR sasl_username) | transaction message_id queue_id maxspan=3m maxpause=2m | search sasl_username message_id=* | table sasl_username'; |
| 162 | 162 | |
| 163 | 163 | /* Doesn't work on Splunk 6.6 for HTTP exceptions |
@@ -176,8 +176,8 @@ discard block |
||
| 176 | 176 | |
| 177 | 177 | // A one shot search |
| 178 | 178 | $searchParams = array( |
| 179 | - 'earliest_time' => date("c",strtotime ($date)-120), |
|
| 180 | - 'latest_time' => date("c",strtotime ($date)+60) |
|
| 179 | + 'earliest_time' => date("c", strtotime($date)-120), |
|
| 180 | + 'latest_time' => date("c", strtotime($date)+60) |
|
| 181 | 181 | ); |
| 182 | 182 | |
| 183 | 183 | // Run a oneshot search that returns the job's results |
@@ -191,7 +191,7 @@ discard block |
||
| 191 | 191 | { |
| 192 | 192 | // More than one field attribute returned by search |
| 193 | 193 | // You must redefine the search |
| 194 | - if ( count($result->getFieldNames()) > 1 ) return FALSE; |
|
| 194 | + if (count($result->getFieldNames())>1) return FALSE; |
|
| 195 | 195 | } |
| 196 | 196 | else if ($result instanceof Splunk_ResultsMessage) |
| 197 | 197 | { |
@@ -223,51 +223,51 @@ discard block |
||
| 223 | 223 | } |
| 224 | 224 | |
| 225 | 225 | |
| 226 | -function imapReport ($cf,$myconnArray,$splunkconn,$tables,$type) { |
|
| 227 | - $file = dirname(__FILE__) . '/' . $cf['reportFile']["$type"]; |
|
| 228 | - $fileb= dirname(__FILE__) . '/' . $cf['badreportFile']["$type"]; |
|
| 229 | - $m_mail = imap_open('{'.$cf['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['authuser'].'}'.$cf['folder']["$type"], $cf['account'],$cf['authpassword'], OP_READONLY) |
|
| 230 | - or syslog (LOG_EMERG, $cf['user'].': Error in IMAP connection to <'.$cf['mailhost'].'>: ' . imap_last_error()); |
|
| 231 | - if ( !$m_mail ) exit(254); |
|
| 226 | +function imapReport($cf, $myconnArray, $splunkconn, $tables, $type) { |
|
| 227 | + $file = dirname(__FILE__).'/'.$cf['reportFile']["$type"]; |
|
| 228 | + $fileb = dirname(__FILE__).'/'.$cf['badreportFile']["$type"]; |
|
| 229 | + $m_mail = imap_open('{'.$cf['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['authuser'].'}'.$cf['folder']["$type"], $cf['account'], $cf['authpassword'], OP_READONLY) |
|
| 230 | + or syslog(LOG_EMERG, $cf['user'].': Error in IMAP connection to <'.$cf['mailhost'].'>: '.imap_last_error()); |
|
| 231 | + if (!$m_mail) exit(254); |
|
| 232 | 232 | |
| 233 | 233 | |
| 234 | - syslog (LOG_INFO,$cf['user'].': Successfully connected to <'.$cf['mailhost'].">; Reading $type messages of last ".$cf['oldestday'].' days...'); |
|
| 234 | + syslog(LOG_INFO, $cf['user'].': Successfully connected to <'.$cf['mailhost'].">; Reading $type messages of last ".$cf['oldestday'].' days...'); |
|
| 235 | 235 | //get all messages |
| 236 | - $dateTh = date ( "d-M-Y", strToTime ( '-'.$cf['oldestday'].' days' ) ); |
|
| 237 | - $dateN = date ( "d-M-Y", strToTime ( "now" ) ); |
|
| 238 | - $m_search=imap_search ($m_mail, "SINCE \"$dateTh\" BEFORE \"$dateN\"" ); |
|
| 236 | + $dateTh = date("d-M-Y", strToTime('-'.$cf['oldestday'].' days')); |
|
| 237 | + $dateN = date("d-M-Y", strToTime("now")); |
|
| 238 | + $m_search = imap_search($m_mail, "SINCE \"$dateTh\" BEFORE \"$dateN\""); |
|
| 239 | 239 | |
| 240 | 240 | |
| 241 | 241 | // Order results starting from newest message |
| 242 | - if ( empty($m_search) ) { |
|
| 243 | - syslog (LOG_INFO,$cf['user'].": No mail found in $type folder. No reports written for $type."); |
|
| 244 | - if ( $ierr = imap_errors() ) |
|
| 245 | - foreach ( $ierr as $thiserr ) |
|
| 246 | - syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
|
| 247 | - if ( $ierr = imap_alerts() ) |
|
| 248 | - foreach ( $ierr as $thiserr ) |
|
| 249 | - syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 250 | - imap_close( $m_mail ); |
|
| 251 | - if ( file_exists( $file ) ) unlink ($file); |
|
| 252 | - if ( file_exists( $fileb ) ) unlink ($fileb); |
|
| 242 | + if (empty($m_search)) { |
|
| 243 | + syslog(LOG_INFO, $cf['user'].": No mail found in $type folder. No reports written for $type."); |
|
| 244 | + if ($ierr = imap_errors()) |
|
| 245 | + foreach ($ierr as $thiserr) |
|
| 246 | + syslog(LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
|
| 247 | + if ($ierr = imap_alerts()) |
|
| 248 | + foreach ($ierr as $thiserr) |
|
| 249 | + syslog(LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 250 | + imap_close($m_mail); |
|
| 251 | + if (file_exists($file)) unlink($file); |
|
| 252 | + if (file_exists($fileb)) unlink($fileb); |
|
| 253 | 253 | return FALSE; |
| 254 | 254 | } |
| 255 | - $nmes = count ($m_search); |
|
| 256 | - syslog (LOG_INFO,$cf['user'].": Found $nmes mail in $type folder."); |
|
| 255 | + $nmes = count($m_search); |
|
| 256 | + syslog(LOG_INFO, $cf['user'].": Found $nmes mail in $type folder."); |
|
| 257 | 257 | if ($nmes>0) rsort($m_search); |
| 258 | 258 | |
| 259 | 259 | // Create report file |
| 260 | 260 | |
| 261 | 261 | $fp = fopen($file, 'w'); |
| 262 | - $fpb= fopen($fileb, 'w'); |
|
| 263 | - $lastup = "Last Update: " . date ("d F Y H:i", time()); |
|
| 264 | - fwrite( $fp, file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateHeader']) ); |
|
| 265 | - fwrite( $fp,"<h1> Report of IP sending $type</h1><h5>$lastup</h5><h2>Detailed Report</h2>" ); |
|
| 266 | - if ($cf['onlyReport']) fwrite( $fp,'<p>None of the below IP has been listed because listing is not active in configuration.</p>'); |
|
| 267 | - fwrite( $fp,'<table><tr><th title="taken from Received header" nowrap>Date of Learn</th><th title="taken from Date header" nowrap>Date of Write</th><th nowrap>UID</th><th nowrap>IP</th><th title="How many times this uid learns">#UID</th><th title="Number of times this learned IP appears in different mails">#IP</th><th nowrap>Received by</th><th>Message-Id</th></tr>' ); |
|
| 268 | - fwrite( $fpb,file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateHeader']) ); |
|
| 269 | - fwrite( $fpb,"<h1> Report of bad reported $type mails</h1><h5>$lastup</h5><h2>Detailed Report</h2>" ); |
|
| 270 | - fwrite( $fpb,'<table><tr><th title="taken from Received header" nowrap>Date Learn</th><th title="taken from Date header" nowrap>Date Received</th><th nowrap>UID</th><th>Message-Id</th><th title="Why is this a bad report?">Reason</th></tr>' ); |
|
| 262 | + $fpb = fopen($fileb, 'w'); |
|
| 263 | + $lastup = "Last Update: ".date("d F Y H:i", time()); |
|
| 264 | + fwrite($fp, file_get_contents(dirname(__FILE__).'/'.$cf['reportTemplateHeader'])); |
|
| 265 | + fwrite($fp, "<h1> Report of IP sending $type</h1><h5>$lastup</h5><h2>Detailed Report</h2>"); |
|
| 266 | + if ($cf['onlyReport']) fwrite($fp, '<p>None of the below IP has been listed because listing is not active in configuration.</p>'); |
|
| 267 | + fwrite($fp, '<table><tr><th title="taken from Received header" nowrap>Date of Learn</th><th title="taken from Date header" nowrap>Date of Write</th><th nowrap>UID</th><th nowrap>IP</th><th title="How many times this uid learns">#UID</th><th title="Number of times this learned IP appears in different mails">#IP</th><th nowrap>Received by</th><th>Message-Id</th></tr>'); |
|
| 268 | + fwrite($fpb, file_get_contents(dirname(__FILE__).'/'.$cf['reportTemplateHeader'])); |
|
| 269 | + fwrite($fpb, "<h1> Report of bad reported $type mails</h1><h5>$lastup</h5><h2>Detailed Report</h2>"); |
|
| 270 | + fwrite($fpb, '<table><tr><th title="taken from Received header" nowrap>Date Learn</th><th title="taken from Date header" nowrap>Date Received</th><th nowrap>UID</th><th>Message-Id</th><th title="Why is this a bad report?">Reason</th></tr>'); |
|
| 271 | 271 | |
| 272 | 272 | $ipuid = array(); |
| 273 | 273 | $ipuid['count'] = 0; |
@@ -285,69 +285,69 @@ discard block |
||
| 285 | 285 | //get imap header info for obj thang |
| 286 | 286 | //$headers = imap_headerinfo($m_mail, $onem); |
| 287 | 287 | //$head = imap_fetchheader($m_mail, $headers->Msgno); |
| 288 | - $head = imap_fetchheader($m_mail, $onem ); |
|
| 288 | + $head = imap_fetchheader($m_mail, $onem); |
|
| 289 | 289 | //$obj = imap_rfc822_parse_headers( $head); |
| 290 | 290 | |
| 291 | - list ($ip,$host,$dateReceived,$dateClient,$mid) = getIP( $head,$cf['mx'],$cf['msalearn'] ); |
|
| 291 | + list ($ip, $host, $dateReceived, $dateClient, $mid) = getIP($head, $cf['mx'], $cf['msalearn']); |
|
| 292 | 292 | if (empty($mid)) { |
| 293 | - $uid='NA'; |
|
| 294 | - syslog (LOG_ERR, $cf['user'].": Error retrieving data for empty Message-ID."); |
|
| 295 | - } else { |
|
| 293 | + $uid = 'NA'; |
|
| 294 | + syslog(LOG_ERR, $cf['user'].": Error retrieving data for empty Message-ID."); |
|
| 295 | + }else { |
|
| 296 | 296 | if ($dateReceived === FALSE) { |
| 297 | - $uid='unauthenticated'; |
|
| 298 | - syslog (LOG_ERR, $cf['user'].": Error retrieving date for $mid. Maybe this mail was not submitted to Learner MSA"); |
|
| 299 | - } else |
|
| 300 | - if ( !($uid = splunksearch ($splunkconn, trim($mid,'<>'), $dateReceived)) ) { |
|
| 301 | - syslog (LOG_ERR, $cf['user'].": Error retrieving uid from Splunk log for $mid."); |
|
| 302 | - $uid='unknown'; |
|
| 297 | + $uid = 'unauthenticated'; |
|
| 298 | + syslog(LOG_ERR, $cf['user'].": Error retrieving date for $mid. Maybe this mail was not submitted to Learner MSA"); |
|
| 299 | + }else |
|
| 300 | + if (!($uid = splunksearch($splunkconn, trim($mid, '<>'), $dateReceived))) { |
|
| 301 | + syslog(LOG_ERR, $cf['user'].": Error retrieving uid from Splunk log for $mid."); |
|
| 302 | + $uid = 'unknown'; |
|
| 303 | 303 | } |
| 304 | 304 | } |
| 305 | 305 | |
| 306 | 306 | /* Update count of each ip */ |
| 307 | - if ($host and ($uid!='NA') and ($uid!='unauthenticated') and ($uid!='unknown')) { /* IP is received by MX servers and learned by valid uid */ |
|
| 308 | - $ipuid['count']++; //number of right messages |
|
| 307 | + if ($host and ($uid != 'NA') and ($uid != 'unauthenticated') and ($uid != 'unknown')) { /* IP is received by MX servers and learned by valid uid */ |
|
| 308 | + $ipuid['count']++; //number of right messages |
|
| 309 | 309 | |
| 310 | - if (in_array($uid,array_keys($ipuid['uid']))) { |
|
| 311 | - $ipuid['uid']["$uid"]['count']++; //number of learn by this uid |
|
| 312 | - if (!in_array($ip,$ipuid['uid']["$uid"])) |
|
| 313 | - $ipuid['uid']["$uid"][]=$ip; //ips learned by this uid |
|
| 310 | + if (in_array($uid, array_keys($ipuid['uid']))) { |
|
| 311 | + $ipuid['uid']["$uid"]['count']++; //number of learn by this uid |
|
| 312 | + if (!in_array($ip, $ipuid['uid']["$uid"])) |
|
| 313 | + $ipuid['uid']["$uid"][] = $ip; //ips learned by this uid |
|
| 314 | 314 | } |
| 315 | 315 | else { |
| 316 | 316 | $ipuid['uid']["$uid"]['count'] = 1; |
| 317 | - $ipuid['uid']["$uid"][]=$ip; |
|
| 318 | - $ipuid['uid']['count']++; //number of unique uids |
|
| 317 | + $ipuid['uid']["$uid"][] = $ip; |
|
| 318 | + $ipuid['uid']['count']++; //number of unique uids |
|
| 319 | 319 | } |
| 320 | 320 | |
| 321 | - if (in_array($ip,array_keys($ipuid['ip']))) { |
|
| 322 | - $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages |
|
| 323 | - if (!in_array($uid,$ipuid['ip']["$ip"])) |
|
| 324 | - $ipuid['ip']["$ip"][]=$uid; //uids that learned this ip |
|
| 321 | + if (in_array($ip, array_keys($ipuid['ip']))) { |
|
| 322 | + $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages |
|
| 323 | + if (!in_array($uid, $ipuid['ip']["$ip"])) |
|
| 324 | + $ipuid['ip']["$ip"][] = $uid; //uids that learned this ip |
|
| 325 | 325 | } |
| 326 | 326 | else { |
| 327 | 327 | $ipuid['ip']["$ip"]['count'] = 1; |
| 328 | - $ipuid['ip']["$ip"][]=$uid; |
|
| 329 | - $ipuid['ip']['count']++; //number of unique ips |
|
| 328 | + $ipuid['ip']["$ip"][] = $uid; |
|
| 329 | + $ipuid['ip']['count']++; //number of unique ips |
|
| 330 | 330 | } |
| 331 | 331 | |
| 332 | 332 | /* Update HTML report */ |
| 333 | - fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) ); |
|
| 333 | + fwrite($fp, updateReport($ip, $uid, $ipuid['ip']["$ip"]['count'], $ipuid['uid']["$uid"]['count'], $host, $dateClient, $mid, $dateReceived)); |
|
| 334 | 334 | } |
| 335 | 335 | else { /* Bad learn */ |
| 336 | 336 | |
| 337 | - if (in_array($uid,array_keys($uidbad['uid']))) |
|
| 338 | - $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid |
|
| 337 | + if (in_array($uid, array_keys($uidbad['uid']))) |
|
| 338 | + $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid |
|
| 339 | 339 | else { |
| 340 | 340 | $uidbad['uid']["$uid"]['count'] = 1; |
| 341 | - $uidbad['uid']["$uid"][]=$uid; |
|
| 342 | - $uidbad['count']++; //numeber of unique bad uids |
|
| 341 | + $uidbad['uid']["$uid"][] = $uid; |
|
| 342 | + $uidbad['count']++; //numeber of unique bad uids |
|
| 343 | 343 | } |
| 344 | 344 | /* The reason of bad report */ |
| 345 | 345 | if ($host === FALSE) $reason = 'This mail was not received by recognized MX host'; |
| 346 | 346 | if ($dateReceived === FALSE) $reason = 'This mail was not submitted to recognized MSA for learn'; |
| 347 | - if ($uid=='unknown') $reason = 'The uid of this mail was not found in splunk log'; |
|
| 347 | + if ($uid == 'unknown') $reason = 'The uid of this mail was not found in splunk log'; |
|
| 348 | 348 | if (!isset($reason)) $reason = '?'; |
| 349 | 349 | |
| 350 | - fwrite( $fpb,updatebadReport ( $uid,$dateClient,$mid,$dateReceived,$reason ) ); |
|
| 350 | + fwrite($fpb, updatebadReport($uid, $dateClient, $mid, $dateReceived, $reason)); |
|
| 351 | 351 | } |
| 352 | 352 | } |
| 353 | 353 | |
@@ -355,45 +355,45 @@ discard block |
||
| 355 | 355 | //close report file and mailbox |
| 356 | 356 | |
| 357 | 357 | /* Summary Report */ |
| 358 | - $ipuid['ip'] = array_msort( $ipuid['ip'], array('count'=>SORT_DESC) ); |
|
| 359 | - $ipuid['uid'] = array_msort( $ipuid['uid'], array('count'=>SORT_DESC) ); |
|
| 360 | - $uidbad['uid'] = array_msort( $uidbad['uid'], array('count'=>SORT_DESC) ); |
|
| 358 | + $ipuid['ip'] = array_msort($ipuid['ip'], array('count'=>SORT_DESC)); |
|
| 359 | + $ipuid['uid'] = array_msort($ipuid['uid'], array('count'=>SORT_DESC)); |
|
| 360 | + $uidbad['uid'] = array_msort($uidbad['uid'], array('count'=>SORT_DESC)); |
|
| 361 | 361 | |
| 362 | 362 | fwrite($fp, '</table>'); |
| 363 | - fwrite($fp, '<hr><h2>Summary Report</h2><h5>Listing policy: ip must be learned at least '.$cf['thresholdip']["$type"].' times from at least '.$cf['thresholduid']["$type"].' different valid uids.</h5>' ); |
|
| 363 | + fwrite($fp, '<hr><h2>Summary Report</h2><h5>Listing policy: ip must be learned at least '.$cf['thresholdip']["$type"].' times from at least '.$cf['thresholduid']["$type"].' different valid uids.</h5>'); |
|
| 364 | 364 | |
| 365 | 365 | /* Make MYSQL connection */ |
| 366 | - if ( $cf['onlyReport'] ) |
|
| 366 | + if ($cf['onlyReport']) |
|
| 367 | 367 | $mysqli = NULL; |
| 368 | 368 | else { |
| 369 | 369 | $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']); |
| 370 | 370 | if ($mysqli->connect_error) { |
| 371 | - syslog (LOG_EMERG, $cf['user'].': Connect Error (' . $mysqli->connect_errno . ') ' |
|
| 371 | + syslog(LOG_EMERG, $cf['user'].': Connect Error ('.$mysqli->connect_errno.') ' |
|
| 372 | 372 | . $mysqli->connect_error); |
| 373 | 373 | exit (254); |
| 374 | 374 | } |
| 375 | - syslog(LOG_INFO, $cf['user'].': Successfully mysql connected to ' . $mysqli->host_info) ; |
|
| 375 | + syslog(LOG_INFO, $cf['user'].': Successfully mysql connected to '.$mysqli->host_info); |
|
| 376 | 376 | } |
| 377 | 377 | /***********************/ |
| 378 | 378 | |
| 379 | - fwrite($fp, summaryReportAndList ($cf,$mysqli,$tables,$type,$ipuid) ); |
|
| 380 | - if ( !$cf['onlyReport'] ) |
|
| 379 | + fwrite($fp, summaryReportAndList($cf, $mysqli, $tables, $type, $ipuid)); |
|
| 380 | + if (!$cf['onlyReport']) |
|
| 381 | 381 | $mysqli->close(); |
| 382 | - fwrite($fp,file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateFooter'])); |
|
| 382 | + fwrite($fp, file_get_contents(dirname(__FILE__).'/'.$cf['reportTemplateFooter'])); |
|
| 383 | 383 | fclose($fp); |
| 384 | 384 | |
| 385 | 385 | fwrite($fpb, '</table>'); |
| 386 | - fwrite( $fpb,summaryBadReport( $uidbad ) ); |
|
| 387 | - fwrite($fpb,file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateFooter'])); |
|
| 386 | + fwrite($fpb, summaryBadReport($uidbad)); |
|
| 387 | + fwrite($fpb, file_get_contents(dirname(__FILE__).'/'.$cf['reportTemplateFooter'])); |
|
| 388 | 388 | fclose($fpb); |
| 389 | - syslog (LOG_INFO,$cf['user'].': Report files written. Listing job for '.$type.' terminated.'); |
|
| 390 | - |
|
| 391 | - if ( $ierr = imap_errors() ) |
|
| 392 | - foreach ( $ierr as $thiserr ) |
|
| 393 | - syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
|
| 394 | - if ( $ierr = imap_alerts() ) |
|
| 395 | - foreach ( $ierr as $thiserr ) |
|
| 396 | - syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 389 | + syslog(LOG_INFO, $cf['user'].': Report files written. Listing job for '.$type.' terminated.'); |
|
| 390 | + |
|
| 391 | + if ($ierr = imap_errors()) |
|
| 392 | + foreach ($ierr as $thiserr) |
|
| 393 | + syslog(LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
|
| 394 | + if ($ierr = imap_alerts()) |
|
| 395 | + foreach ($ierr as $thiserr) |
|
| 396 | + syslog(LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
|
| 397 | 397 | imap_close($m_mail); |
| 398 | 398 | } |
| 399 | 399 | ?> |
@@ -10,21 +10,25 @@ discard block |
||
| 10 | 10 | if ( preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m',$header,$received) ) { |
| 11 | 11 | for ($i = count($received[0])-1;$i>=0;$i--) { |
| 12 | 12 | # print "Examine ".$received[0][$i]."\n"; |
| 13 | - if ( preg_match($msa,$received['host'][$i]) ) |
|
| 14 | - $dateR = $received['date'][$i]; |
|
| 13 | + if ( preg_match($msa,$received['host'][$i]) ) { |
|
| 14 | + $dateR = $received['date'][$i]; |
|
| 15 | + } |
|
| 15 | 16 | foreach ($mxserver as $mx) { |
| 16 | - if (!$ip) |
|
| 17 | - if ($mx == $received['host'][$i]) { |
|
| 17 | + if (!$ip) { |
|
| 18 | + if ($mx == $received['host'][$i]) { |
|
| 18 | 19 | $host = $received['host'][$i]; |
| 20 | + } |
|
| 19 | 21 | $ip = $received['ip'][$i]; |
| 20 | 22 | } |
| 21 | 23 | } |
| 22 | 24 | } |
| 23 | 25 | } |
| 24 | - if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) |
|
| 25 | - $dateC['date'] = 'Not found'; |
|
| 26 | - if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) |
|
| 27 | - $mid['mid'] = NULL; |
|
| 26 | + if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) { |
|
| 27 | + $dateC['date'] = 'Not found'; |
|
| 28 | + } |
|
| 29 | + if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) { |
|
| 30 | + $mid['mid'] = NULL; |
|
| 31 | + } |
|
| 28 | 32 | return array($ip,$host,$dateR,$dateC['date'],$mid['mid']); |
| 29 | 33 | } |
| 30 | 34 | |
@@ -40,7 +44,9 @@ discard block |
||
| 40 | 44 | |
| 41 | 45 | function summaryBadReport ($uidvet) { |
| 42 | 46 | $nuid = $uidvet['count']; |
| 43 | - if ( empty($uidvet) ) return NULL; |
|
| 47 | + if ( empty($uidvet) ) { |
|
| 48 | + return NULL; |
|
| 49 | + } |
|
| 44 | 50 | $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n"; |
| 45 | 51 | |
| 46 | 52 | /* Remove count index */ |
@@ -75,8 +81,12 @@ discard block |
||
| 75 | 81 | foreach ($colarr as $col => $arr) { |
| 76 | 82 | foreach ($arr as $k => $v) { |
| 77 | 83 | $k = substr($k,1); |
| 78 | - if (!isset($ret[$k])) $ret[$k] = $array[$k]; |
|
| 79 | - if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col]; |
|
| 84 | + if (!isset($ret[$k])) { |
|
| 85 | + $ret[$k] = $array[$k]; |
|
| 86 | + } |
|
| 87 | + if (isset ($array[$k][$col])) { |
|
| 88 | + $ret[$k][$col] = $array[$k][$col]; |
|
| 89 | + } |
|
| 80 | 90 | } |
| 81 | 91 | } |
| 82 | 92 | return $ret; |
@@ -87,13 +97,17 @@ discard block |
||
| 87 | 97 | function summaryReportAndList ($cf,$myconn,$tables,$category,$ipvet) { |
| 88 | 98 | $nips = $ipvet['count']; |
| 89 | 99 | |
| 90 | - if ( empty($ipvet) ) return NULL; |
|
| 100 | + if ( empty($ipvet) ) { |
|
| 101 | + return NULL; |
|
| 102 | + } |
|
| 91 | 103 | $return = '<h3>Statistics by IP</h3><table><tr><th>IP</th><th>Learned by</th><th>Learned times</th><th title="This field doesn\'t say if this ip is currently listed, but it says if this IP has listed now!">Listed Now</th></tr>'."\n"; |
| 92 | 104 | |
| 93 | 105 | $ips = array_keys($ipvet['ip']); |
| 94 | 106 | |
| 95 | 107 | foreach ( $ips as $ip ) { |
| 96 | - if ( $ip == 'count' ) continue; |
|
| 108 | + if ( $ip == 'count' ) { |
|
| 109 | + continue; |
|
| 110 | + } |
|
| 97 | 111 | $nlearn = $ipvet['ip']["$ip"]['count']; |
| 98 | 112 | unset($ipvet['ip']["$ip"]['count']); |
| 99 | 113 | $nuid = count($ipvet['ip']["$ip"]); |
@@ -101,10 +115,12 @@ discard block |
||
| 101 | 115 | if ( ($nlearn >= $cf['thresholdip']["$category"])&&($nuid >= $cf['thresholduid']["$category"]) ) { |
| 102 | 116 | $reason = "The IP <$ip> has been listed because was marked $nlearn times as $category by $nuid different accounts during last ".$cf['oldestday'].' days.'; |
| 103 | 117 | $listed = searchAndList ($myconn,$cf['user'],$tables,$cf['list']["$category"],$ip,$cf['unit']["$category"],$cf['quantity']["$category"],$reason); |
| 118 | + } else { |
|
| 119 | + $listed = FALSE; |
|
| 104 | 120 | } |
| 105 | - else $listed = FALSE; |
|
| 121 | + } else { |
|
| 122 | + $listed = FALSE; |
|
| 106 | 123 | } |
| 107 | - else $listed = FALSE; |
|
| 108 | 124 | $nowlist = array( TRUE => array( |
| 109 | 125 | 'style' => 'id=\'ipfound\'', |
| 110 | 126 | 'name' => 'YES', |
@@ -122,7 +138,9 @@ discard block |
||
| 122 | 138 | $return .='<tr><td rowspan="'.$nuid.'">'.$ip.'</td>'; |
| 123 | 139 | $return .= sprintf ('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>',$ipvet['ip']["$ip"][0],$nlearn,$nowlist["$listed"]['name']); |
| 124 | 140 | $rowuid=NULL; |
| 125 | - for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 141 | + for ($j=1;$j<$nuid;$j++) { |
|
| 142 | + $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 143 | + } |
|
| 126 | 144 | array_shift($ipvet['ip']["$ip"]); |
| 127 | 145 | $return .= vsprintf ($rowuid,$ipvet['ip']["$ip"]); |
| 128 | 146 | |
@@ -135,14 +153,18 @@ discard block |
||
| 135 | 153 | $return .= '<h3>Statistics by UID</h3><table><tr><th>UID</th><th>IP learned</th><th>Learned times</th></tr>'."\n"; |
| 136 | 154 | $uids = array_keys($ipvet['uid']); |
| 137 | 155 | foreach ( $uids as $uid ) { |
| 138 | - if ( $uid == 'count' ) continue; |
|
| 156 | + if ( $uid == 'count' ) { |
|
| 157 | + continue; |
|
| 158 | + } |
|
| 139 | 159 | $nlearn = $ipvet['uid']["$uid"]['count']; |
| 140 | 160 | unset ( $ipvet['uid']["$uid"]['count'] ); |
| 141 | 161 | $nip = count($ipvet['uid']["$uid"]); |
| 142 | 162 | $return .='<tr><td rowspan="'.$nip.'">'.$uid.'</td>'; |
| 143 | 163 | $return .= sprintf ('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>',$ipvet['uid']["$uid"][0],$nlearn); |
| 144 | 164 | $rowuid=NULL; |
| 145 | - for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 165 | + for ($j=1;$j<$nip;$j++) { |
|
| 166 | + $rowuid .= '<tr><td>%s</td></tr>'; |
|
| 167 | + } |
|
| 146 | 168 | array_shift($ipvet['uid']["$uid"]); |
| 147 | 169 | $return .= vsprintf ($rowuid,$ipvet['uid']["$uid"]); |
| 148 | 170 | |
@@ -191,14 +213,14 @@ discard block |
||
| 191 | 213 | { |
| 192 | 214 | // More than one field attribute returned by search |
| 193 | 215 | // You must redefine the search |
| 194 | - if ( count($result->getFieldNames()) > 1 ) return FALSE; |
|
| 195 | - } |
|
| 196 | - else if ($result instanceof Splunk_ResultsMessage) |
|
| 216 | + if ( count($result->getFieldNames()) > 1 ) { |
|
| 217 | + return FALSE; |
|
| 218 | + } |
|
| 219 | + } else if ($result instanceof Splunk_ResultsMessage) |
|
| 197 | 220 | { |
| 198 | 221 | // I don't want messages in my search |
| 199 | 222 | return FALSE; |
| 200 | - } |
|
| 201 | - else if (is_array($result)) |
|
| 223 | + } else if (is_array($result)) |
|
| 202 | 224 | { |
| 203 | 225 | // Process a row |
| 204 | 226 | foreach ($result as $key => $valueOrValues) |
@@ -206,15 +228,13 @@ discard block |
||
| 206 | 228 | if (is_array($valueOrValues)) |
| 207 | 229 | { |
| 208 | 230 | return FALSE; |
| 209 | - } |
|
| 210 | - else |
|
| 231 | + } else |
|
| 211 | 232 | { |
| 212 | 233 | return $valueOrValues; |
| 213 | 234 | #print " {$key} => {$value}\r\n"; |
| 214 | 235 | } |
| 215 | 236 | } |
| 216 | - } |
|
| 217 | - else |
|
| 237 | + } else |
|
| 218 | 238 | { |
| 219 | 239 | #print "Unknow result type"; |
| 220 | 240 | return FALSE; |
@@ -228,7 +248,9 @@ discard block |
||
| 228 | 248 | $fileb= dirname(__FILE__) . '/' . $cf['badreportFile']["$type"]; |
| 229 | 249 | $m_mail = imap_open('{'.$cf['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['authuser'].'}'.$cf['folder']["$type"], $cf['account'],$cf['authpassword'], OP_READONLY) |
| 230 | 250 | or syslog (LOG_EMERG, $cf['user'].': Error in IMAP connection to <'.$cf['mailhost'].'>: ' . imap_last_error()); |
| 231 | - if ( !$m_mail ) exit(254); |
|
| 251 | + if ( !$m_mail ) { |
|
| 252 | + exit(254); |
|
| 253 | + } |
|
| 232 | 254 | |
| 233 | 255 | |
| 234 | 256 | syslog (LOG_INFO,$cf['user'].': Successfully connected to <'.$cf['mailhost'].">; Reading $type messages of last ".$cf['oldestday'].' days...'); |
@@ -241,20 +263,28 @@ discard block |
||
| 241 | 263 | // Order results starting from newest message |
| 242 | 264 | if ( empty($m_search) ) { |
| 243 | 265 | syslog (LOG_INFO,$cf['user'].": No mail found in $type folder. No reports written for $type."); |
| 244 | - if ( $ierr = imap_errors() ) |
|
| 245 | - foreach ( $ierr as $thiserr ) |
|
| 266 | + if ( $ierr = imap_errors() ) { |
|
| 267 | + foreach ( $ierr as $thiserr ) |
|
| 246 | 268 | syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
| 247 | - if ( $ierr = imap_alerts() ) |
|
| 248 | - foreach ( $ierr as $thiserr ) |
|
| 269 | + } |
|
| 270 | + if ( $ierr = imap_alerts() ) { |
|
| 271 | + foreach ( $ierr as $thiserr ) |
|
| 249 | 272 | syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
| 273 | + } |
|
| 250 | 274 | imap_close( $m_mail ); |
| 251 | - if ( file_exists( $file ) ) unlink ($file); |
|
| 252 | - if ( file_exists( $fileb ) ) unlink ($fileb); |
|
| 275 | + if ( file_exists( $file ) ) { |
|
| 276 | + unlink ($file); |
|
| 277 | + } |
|
| 278 | + if ( file_exists( $fileb ) ) { |
|
| 279 | + unlink ($fileb); |
|
| 280 | + } |
|
| 253 | 281 | return FALSE; |
| 254 | 282 | } |
| 255 | 283 | $nmes = count ($m_search); |
| 256 | 284 | syslog (LOG_INFO,$cf['user'].": Found $nmes mail in $type folder."); |
| 257 | - if ($nmes>0) rsort($m_search); |
|
| 285 | + if ($nmes>0) { |
|
| 286 | + rsort($m_search); |
|
| 287 | + } |
|
| 258 | 288 | |
| 259 | 289 | // Create report file |
| 260 | 290 | |
@@ -263,7 +293,9 @@ discard block |
||
| 263 | 293 | $lastup = "Last Update: " . date ("d F Y H:i", time()); |
| 264 | 294 | fwrite( $fp, file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateHeader']) ); |
| 265 | 295 | fwrite( $fp,"<h1> Report of IP sending $type</h1><h5>$lastup</h5><h2>Detailed Report</h2>" ); |
| 266 | - if ($cf['onlyReport']) fwrite( $fp,'<p>None of the below IP has been listed because listing is not active in configuration.</p>'); |
|
| 296 | + if ($cf['onlyReport']) { |
|
| 297 | + fwrite( $fp,'<p>None of the below IP has been listed because listing is not active in configuration.</p>'); |
|
| 298 | + } |
|
| 267 | 299 | fwrite( $fp,'<table><tr><th title="taken from Received header" nowrap>Date of Learn</th><th title="taken from Date header" nowrap>Date of Write</th><th nowrap>UID</th><th nowrap>IP</th><th title="How many times this uid learns">#UID</th><th title="Number of times this learned IP appears in different mails">#IP</th><th nowrap>Received by</th><th>Message-Id</th></tr>' ); |
| 268 | 300 | fwrite( $fpb,file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateHeader']) ); |
| 269 | 301 | fwrite( $fpb,"<h1> Report of bad reported $type mails</h1><h5>$lastup</h5><h2>Detailed Report</h2>" ); |
@@ -309,10 +341,11 @@ discard block |
||
| 309 | 341 | |
| 310 | 342 | if (in_array($uid,array_keys($ipuid['uid']))) { |
| 311 | 343 | $ipuid['uid']["$uid"]['count']++; //number of learn by this uid |
| 312 | - if (!in_array($ip,$ipuid['uid']["$uid"])) |
|
| 313 | - $ipuid['uid']["$uid"][]=$ip; //ips learned by this uid |
|
| 314 | - } |
|
| 315 | - else { |
|
| 344 | + if (!in_array($ip,$ipuid['uid']["$uid"])) { |
|
| 345 | + $ipuid['uid']["$uid"][]=$ip; |
|
| 346 | + } |
|
| 347 | + //ips learned by this uid |
|
| 348 | + } else { |
|
| 316 | 349 | $ipuid['uid']["$uid"]['count'] = 1; |
| 317 | 350 | $ipuid['uid']["$uid"][]=$ip; |
| 318 | 351 | $ipuid['uid']['count']++; //number of unique uids |
@@ -320,10 +353,11 @@ discard block |
||
| 320 | 353 | |
| 321 | 354 | if (in_array($ip,array_keys($ipuid['ip']))) { |
| 322 | 355 | $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages |
| 323 | - if (!in_array($uid,$ipuid['ip']["$ip"])) |
|
| 324 | - $ipuid['ip']["$ip"][]=$uid; //uids that learned this ip |
|
| 325 | - } |
|
| 326 | - else { |
|
| 356 | + if (!in_array($uid,$ipuid['ip']["$ip"])) { |
|
| 357 | + $ipuid['ip']["$ip"][]=$uid; |
|
| 358 | + } |
|
| 359 | + //uids that learned this ip |
|
| 360 | + } else { |
|
| 327 | 361 | $ipuid['ip']["$ip"]['count'] = 1; |
| 328 | 362 | $ipuid['ip']["$ip"][]=$uid; |
| 329 | 363 | $ipuid['ip']['count']++; //number of unique ips |
@@ -331,21 +365,30 @@ discard block |
||
| 331 | 365 | |
| 332 | 366 | /* Update HTML report */ |
| 333 | 367 | fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) ); |
| 334 | - } |
|
| 335 | - else { /* Bad learn */ |
|
| 368 | + } else { /* Bad learn */ |
|
| 336 | 369 | |
| 337 | - if (in_array($uid,array_keys($uidbad['uid']))) |
|
| 338 | - $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid |
|
| 370 | + if (in_array($uid,array_keys($uidbad['uid']))) { |
|
| 371 | + $uidbad['uid']["$uid"]['count']++; |
|
| 372 | + } |
|
| 373 | + //number of bad learn by this uid |
|
| 339 | 374 | else { |
| 340 | 375 | $uidbad['uid']["$uid"]['count'] = 1; |
| 341 | 376 | $uidbad['uid']["$uid"][]=$uid; |
| 342 | 377 | $uidbad['count']++; //numeber of unique bad uids |
| 343 | 378 | } |
| 344 | 379 | /* The reason of bad report */ |
| 345 | - if ($host === FALSE) $reason = 'This mail was not received by recognized MX host'; |
|
| 346 | - if ($dateReceived === FALSE) $reason = 'This mail was not submitted to recognized MSA for learn'; |
|
| 347 | - if ($uid=='unknown') $reason = 'The uid of this mail was not found in splunk log'; |
|
| 348 | - if (!isset($reason)) $reason = '?'; |
|
| 380 | + if ($host === FALSE) { |
|
| 381 | + $reason = 'This mail was not received by recognized MX host'; |
|
| 382 | + } |
|
| 383 | + if ($dateReceived === FALSE) { |
|
| 384 | + $reason = 'This mail was not submitted to recognized MSA for learn'; |
|
| 385 | + } |
|
| 386 | + if ($uid=='unknown') { |
|
| 387 | + $reason = 'The uid of this mail was not found in splunk log'; |
|
| 388 | + } |
|
| 389 | + if (!isset($reason)) { |
|
| 390 | + $reason = '?'; |
|
| 391 | + } |
|
| 349 | 392 | |
| 350 | 393 | fwrite( $fpb,updatebadReport ( $uid,$dateClient,$mid,$dateReceived,$reason ) ); |
| 351 | 394 | } |
@@ -363,9 +406,9 @@ discard block |
||
| 363 | 406 | fwrite($fp, '<hr><h2>Summary Report</h2><h5>Listing policy: ip must be learned at least '.$cf['thresholdip']["$type"].' times from at least '.$cf['thresholduid']["$type"].' different valid uids.</h5>' ); |
| 364 | 407 | |
| 365 | 408 | /* Make MYSQL connection */ |
| 366 | - if ( $cf['onlyReport'] ) |
|
| 367 | - $mysqli = NULL; |
|
| 368 | - else { |
|
| 409 | + if ( $cf['onlyReport'] ) { |
|
| 410 | + $mysqli = NULL; |
|
| 411 | + } else { |
|
| 369 | 412 | $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']); |
| 370 | 413 | if ($mysqli->connect_error) { |
| 371 | 414 | syslog (LOG_EMERG, $cf['user'].': Connect Error (' . $mysqli->connect_errno . ') ' |
@@ -377,8 +420,9 @@ discard block |
||
| 377 | 420 | /***********************/ |
| 378 | 421 | |
| 379 | 422 | fwrite($fp, summaryReportAndList ($cf,$mysqli,$tables,$type,$ipuid) ); |
| 380 | - if ( !$cf['onlyReport'] ) |
|
| 381 | - $mysqli->close(); |
|
| 423 | + if ( !$cf['onlyReport'] ) { |
|
| 424 | + $mysqli->close(); |
|
| 425 | + } |
|
| 382 | 426 | fwrite($fp,file_get_contents(dirname(__FILE__) . '/' . $cf['reportTemplateFooter'])); |
| 383 | 427 | fclose($fp); |
| 384 | 428 | |
@@ -388,12 +432,14 @@ discard block |
||
| 388 | 432 | fclose($fpb); |
| 389 | 433 | syslog (LOG_INFO,$cf['user'].': Report files written. Listing job for '.$type.' terminated.'); |
| 390 | 434 | |
| 391 | - if ( $ierr = imap_errors() ) |
|
| 392 | - foreach ( $ierr as $thiserr ) |
|
| 435 | + if ( $ierr = imap_errors() ) { |
|
| 436 | + foreach ( $ierr as $thiserr ) |
|
| 393 | 437 | syslog (LOG_ERR, $cf['user'].": IMAP Error: $thiserr"); |
| 394 | - if ( $ierr = imap_alerts() ) |
|
| 395 | - foreach ( $ierr as $thiserr ) |
|
| 438 | + } |
|
| 439 | + if ( $ierr = imap_alerts() ) { |
|
| 440 | + foreach ( $ierr as $thiserr ) |
|
| 396 | 441 | syslog (LOG_ALERT, $cf['user'].": IMAP Alert: $thiserr"); |
| 442 | + } |
|
| 397 | 443 | imap_close($m_mail); |
| 398 | 444 | } |
| 399 | 445 | ?> |