@@ -10,21 +10,25 @@ discard block |
||
10 | 10 | if ( preg_match_all('/^Received:\sfrom(?:.|\r\n\s)*?[\[\(]\s*(?P<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\]\)](?:.|\r\n\s)+\s+by(?:\s|\r\n\s+)(?P<host>\S+).*(?:\s|\r\n\s\s)+.*;\s+(?P<date>.*)/m',$header,$received) ) { |
11 | 11 | for ($i = count($received[0])-1;$i>=0;$i--) { |
12 | 12 | # print "Examine ".$received[0][$i]."\n"; |
13 | - if ( preg_match($msa,$received['host'][$i]) ) |
|
14 | - $dateR = $received['date'][$i]; |
|
13 | + if ( preg_match($msa,$received['host'][$i]) ) { |
|
14 | + $dateR = $received['date'][$i]; |
|
15 | + } |
|
15 | 16 | foreach ($mxserver as $mx) { |
16 | - if (!$ip) |
|
17 | - if ($mx == $received['host'][$i]) { |
|
17 | + if (!$ip) { |
|
18 | + if ($mx == $received['host'][$i]) { |
|
18 | 19 | $host = $received['host'][$i]; |
20 | + } |
|
19 | 21 | $ip = $received['ip'][$i]; |
20 | 22 | } |
21 | 23 | } |
22 | 24 | } |
23 | 25 | } |
24 | - if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) |
|
25 | - $dateC['date'] = 'Not found'; |
|
26 | - if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) |
|
27 | - $mid['mid'] = NULL; |
|
26 | + if ( preg_match ('/\r\nDate:\s(?P<date>.*)\r\n/',$header,$dateC) != 1) { |
|
27 | + $dateC['date'] = 'Not found'; |
|
28 | + } |
|
29 | + if ( preg_match ('/\r\nMessage\-I(?:D|d):\s(?P<mid>.*)\r\n/',$header,$mid) != 1) { |
|
30 | + $mid['mid'] = NULL; |
|
31 | + } |
|
28 | 32 | return array($ip,$host,$dateR,$dateC['date'],$mid['mid']); |
29 | 33 | } |
30 | 34 | |
@@ -40,7 +44,9 @@ discard block |
||
40 | 44 | |
41 | 45 | function summaryBadReport ($uidvet) { |
42 | 46 | $nuid = $uidvet['count']; |
43 | - if ( empty($uidvet) ) return NULL; |
|
47 | + if ( empty($uidvet) ) { |
|
48 | + return NULL; |
|
49 | + } |
|
44 | 50 | $return = '<hr><h3>Statistics by UID</h3><table><tr><th>UID</th><th>Learned times</th></tr>'."\n"; |
45 | 51 | |
46 | 52 | /* Remove count index */ |
@@ -75,8 +81,12 @@ discard block |
||
75 | 81 | foreach ($colarr as $col => $arr) { |
76 | 82 | foreach ($arr as $k => $v) { |
77 | 83 | $k = substr($k,1); |
78 | - if (!isset($ret[$k])) $ret[$k] = $array[$k]; |
|
79 | - if (isset ($array[$k][$col])) $ret[$k][$col] = $array[$k][$col]; |
|
84 | + if (!isset($ret[$k])) { |
|
85 | + $ret[$k] = $array[$k]; |
|
86 | + } |
|
87 | + if (isset ($array[$k][$col])) { |
|
88 | + $ret[$k][$col] = $array[$k][$col]; |
|
89 | + } |
|
80 | 90 | } |
81 | 91 | } |
82 | 92 | return $ret; |
@@ -87,14 +97,18 @@ discard block |
||
87 | 97 | function summaryReportAndList ($cf,$myconn,$tables,$category,$vet,$key) { |
88 | 98 | $nk = $vet['count']; |
89 | 99 | |
90 | - if ( empty($vet) ) return NULL; |
|
100 | + if ( empty($vet) ) { |
|
101 | + return NULL; |
|
102 | + } |
|
91 | 103 | |
92 | 104 | $return = sprintf('<h3>Statistics by %s</h3><table><tr><th>%s</th><th>Learned by</th><th>Learned times</th><th title="This field doesn\'t say if this %s is currently listed, but it says if this %s has listed now!">Listed Now</th></tr>'."\n", strtoupper($key),strtoupper($key),$key,$key); |
93 | 105 | |
94 | 106 | $values = array_keys($vet["$key"]); |
95 | 107 | |
96 | 108 | foreach ( $values as $value ) { |
97 | - if ( $value == 'count' ) continue; |
|
109 | + if ( $value == 'count' ) { |
|
110 | + continue; |
|
111 | + } |
|
98 | 112 | $nlearn = $vet["$key"]["$value"]['count']; |
99 | 113 | unset($vet["$key"]["$value"]['count']); |
100 | 114 | $quantity = $cf["listing$key"]['quantity']["$category"]; /* In searchAndList this value is |
@@ -106,10 +120,12 @@ discard block |
||
106 | 120 | 'The %s <%s> has been listed because was marked %u times as %s by %u different accounts during last %u days.', |
107 | 121 | strtoupper($key),$value,$nlearn,$category,$nuid,$cf['imap']['oldestday']); |
108 | 122 | $listed = searchAndList ($myconn,$cf['syslog']['user'],$tables,$cf["listing$key"]['list']["$category"],$value,$cf["listing$key"]['unit']["$category"],$quantity,$reason); |
123 | + } else { |
|
124 | + $listed = FALSE; |
|
109 | 125 | } |
110 | - else $listed = FALSE; |
|
126 | + } else { |
|
127 | + $listed = FALSE; |
|
111 | 128 | } |
112 | - else $listed = FALSE; |
|
113 | 129 | $nowlist = array( TRUE => array( |
114 | 130 | 'style' => 'id=\'ipfound\'', |
115 | 131 | 'name' => 'YES', |
@@ -127,7 +143,9 @@ discard block |
||
127 | 143 | $return .='<tr><td rowspan="'.$nuid.'">'.$value.'</td>'; |
128 | 144 | $return .= sprintf ('<td>%s</td><td rowspan="'.$nuid.'">%u</td><td rowspan="'.$nuid.'" '.$nowlist["$listed"]['style'].'>%s</td></tr>',$vet["$key"]["$value"][0],$nlearn,$nowlist["$listed"]['name']); |
129 | 145 | $rowuid=NULL; |
130 | - for ($j=1;$j<$nuid;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
146 | + for ($j=1;$j<$nuid;$j++) { |
|
147 | + $rowuid .= '<tr><td>%s</td></tr>'; |
|
148 | + } |
|
131 | 149 | array_shift($vet["$key"]["$value"]); |
132 | 150 | $return .= vsprintf ($rowuid,$vet["$key"]["$value"]); |
133 | 151 | |
@@ -140,14 +158,18 @@ discard block |
||
140 | 158 | $return .= sprintf('<h3>Statistics by UID</h3><table><tr><th>UID</th><th>%s learned</th><th>Learned times</th></tr>'."\n",$key); |
141 | 159 | $uids = array_keys($vet['uid']); |
142 | 160 | foreach ( $uids as $uid ) { |
143 | - if ( $uid == 'count' ) continue; |
|
161 | + if ( $uid == 'count' ) { |
|
162 | + continue; |
|
163 | + } |
|
144 | 164 | $nlearn = $vet['uid']["$uid"]['count']; |
145 | 165 | unset ( $vet['uid']["$uid"]['count'] ); |
146 | 166 | $nip = count($vet['uid']["$uid"]); |
147 | 167 | $return .='<tr><td rowspan="'.$nip.'">'.$uid.'</td>'; |
148 | 168 | $return .= sprintf ('<td>%s</td><td rowspan="'.$nip.'">%u</td></tr>',$vet['uid']["$uid"][0],$nlearn); |
149 | 169 | $rowuid=NULL; |
150 | - for ($j=1;$j<$nip;$j++) $rowuid .= '<tr><td>%s</td></tr>'; |
|
170 | + for ($j=1;$j<$nip;$j++) { |
|
171 | + $rowuid .= '<tr><td>%s</td></tr>'; |
|
172 | + } |
|
151 | 173 | array_shift($vet['uid']["$uid"]); |
152 | 174 | $return .= vsprintf ($rowuid,$vet['uid']["$uid"]); |
153 | 175 | |
@@ -197,14 +219,14 @@ discard block |
||
197 | 219 | { |
198 | 220 | // More than one field attribute returned by search |
199 | 221 | // You must redefine the search |
200 | - if ( count($result->getFieldNames()) > 1 ) return FALSE; |
|
201 | - } |
|
202 | - else if ($result instanceof Splunk_ResultsMessage) |
|
222 | + if ( count($result->getFieldNames()) > 1 ) { |
|
223 | + return FALSE; |
|
224 | + } |
|
225 | + } else if ($result instanceof Splunk_ResultsMessage) |
|
203 | 226 | { |
204 | 227 | // I don't want messages in my search |
205 | 228 | return FALSE; |
206 | - } |
|
207 | - else if (is_array($result)) |
|
229 | + } else if (is_array($result)) |
|
208 | 230 | { |
209 | 231 | // Process a row |
210 | 232 | foreach ($result as $key => $valueOrValues) |
@@ -212,15 +234,13 @@ discard block |
||
212 | 234 | if (is_array($valueOrValues)) |
213 | 235 | { |
214 | 236 | return FALSE; |
215 | - } |
|
216 | - else |
|
237 | + } else |
|
217 | 238 | { |
218 | 239 | return $valueOrValues; |
219 | 240 | #print " {$key} => {$value}\r\n"; |
220 | 241 | } |
221 | 242 | } |
222 | - } |
|
223 | - else |
|
243 | + } else |
|
224 | 244 | { |
225 | 245 | #print "Unknow result type"; |
226 | 246 | return FALSE; |
@@ -240,11 +260,9 @@ discard block |
||
240 | 260 | if(isset($part->parts)) { |
241 | 261 | if($part->type == 2) { |
242 | 262 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix.$index.'.', 0, false); |
243 | - } |
|
244 | - elseif($fullPrefix) { |
|
263 | + } elseif($fullPrefix) { |
|
245 | 264 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix.$index.'.'); |
246 | - } |
|
247 | - else { |
|
265 | + } else { |
|
248 | 266 | $flattenedParts = flattenParts($part->parts, $flattenedParts, $prefix); |
249 | 267 | } |
250 | 268 | unset($flattenedParts[$prefix.$index]->parts); |
@@ -281,8 +299,9 @@ discard block |
||
281 | 299 | if ( ($num_found !== FALSE) && ($num_found>0) ) { |
282 | 300 | foreach ($out[0] as $url) { |
283 | 301 | $dom=nsdom(parse_url($url, PHP_URL_HOST)); |
284 | - if (!( empty($dom) || in_array($dom,$exclude) )) |
|
285 | - $ret[] = $dom; |
|
302 | + if (!( empty($dom) || in_array($dom,$exclude) )) { |
|
303 | + $ret[] = $dom; |
|
304 | + } |
|
286 | 305 | } |
287 | 306 | } |
288 | 307 | return array_values(array_unique($ret)); |
@@ -320,12 +339,13 @@ discard block |
||
320 | 339 | } |
321 | 340 | |
322 | 341 | } |
342 | + } else { |
|
343 | + $message = getPart($connection, $messageNumber, 1, $structure->encoding); |
|
323 | 344 | } |
324 | - else |
|
325 | - $message = getPart($connection, $messageNumber, 1, $structure->encoding); |
|
326 | 345 | |
327 | - if ( !empty($message) ) |
|
328 | - return getDomains($message, $exclusionList); |
|
346 | + if ( !empty($message) ) { |
|
347 | + return getDomains($message, $exclusionList); |
|
348 | + } |
|
329 | 349 | return array(); |
330 | 350 | } |
331 | 351 | |
@@ -360,7 +380,9 @@ discard block |
||
360 | 380 | $fileb= dirname(__FILE__) . '/' . $cf['report']['badreportFile']["$type"]; |
361 | 381 | $m_mail = imap_open('{'.$cf['imap']['mailhost'].':143/imap/novalidate-cert/authuser='.$cf['imap']['authuser'].'}'.$cf['imap']['folder']["$type"], $cf['imap']['account'],$cf['imap']['authpassword'], OP_READONLY) |
362 | 382 | or syslog (LOG_EMERG, $cf['syslog']['user'].': Error in IMAP connection to <'.$cf['imap']['mailhost'].'>: ' . imap_last_error()); |
363 | - if ( !$m_mail ) exit(254); |
|
383 | + if ( !$m_mail ) { |
|
384 | + exit(254); |
|
385 | + } |
|
364 | 386 | |
365 | 387 | |
366 | 388 | syslog (LOG_INFO,$cf['syslog']['user'].': Successfully connected to <'.$cf['imap']['mailhost'].">; Reading $type messages of last ".$cf['imap']['oldestday'].' days...'); |
@@ -372,21 +394,31 @@ discard block |
||
372 | 394 | // Order results starting from newest message |
373 | 395 | if ( empty($m_search) ) { |
374 | 396 | syslog (LOG_INFO,$cf['syslog']['user'].": No mail found in $type folder. No reports written for $type."); |
375 | - if ( $ierr = imap_errors() ) |
|
376 | - foreach ( $ierr as $thiserr ) |
|
397 | + if ( $ierr = imap_errors() ) { |
|
398 | + foreach ( $ierr as $thiserr ) |
|
377 | 399 | syslog (LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr"); |
378 | - if ( $ierr = imap_alerts() ) |
|
379 | - foreach ( $ierr as $thiserr ) |
|
400 | + } |
|
401 | + if ( $ierr = imap_alerts() ) { |
|
402 | + foreach ( $ierr as $thiserr ) |
|
380 | 403 | syslog (LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr"); |
404 | + } |
|
381 | 405 | imap_close( $m_mail ); |
382 | - if ( file_exists( $file ) ) unlink ($file); |
|
383 | - if ( file_exists( $filed ) ) unlink ($filed); |
|
384 | - if ( file_exists( $fileb ) ) unlink ($fileb); |
|
406 | + if ( file_exists( $file ) ) { |
|
407 | + unlink ($file); |
|
408 | + } |
|
409 | + if ( file_exists( $filed ) ) { |
|
410 | + unlink ($filed); |
|
411 | + } |
|
412 | + if ( file_exists( $fileb ) ) { |
|
413 | + unlink ($fileb); |
|
414 | + } |
|
385 | 415 | return FALSE; |
386 | 416 | } |
387 | 417 | $nmes = count ($m_search); |
388 | 418 | syslog (LOG_INFO,$cf['syslog']['user'].": Found $nmes mail in $type folder."); |
389 | - if ($nmes>0) rsort($m_search); |
|
419 | + if ($nmes>0) { |
|
420 | + rsort($m_search); |
|
421 | + } |
|
390 | 422 | |
391 | 423 | // Create report file |
392 | 424 | |
@@ -450,10 +482,11 @@ discard block |
||
450 | 482 | |
451 | 483 | if (in_array($uid,array_keys($ipuid['uid']))) { |
452 | 484 | $ipuid['uid']["$uid"]['count']++; //number of learn by this uid |
453 | - if (!in_array($ip,$ipuid['uid']["$uid"])) |
|
454 | - $ipuid['uid']["$uid"][]=$ip; //ips learned by this uid |
|
455 | - } |
|
456 | - else { |
|
485 | + if (!in_array($ip,$ipuid['uid']["$uid"])) { |
|
486 | + $ipuid['uid']["$uid"][]=$ip; |
|
487 | + } |
|
488 | + //ips learned by this uid |
|
489 | + } else { |
|
457 | 490 | $ipuid['uid']["$uid"]['count'] = 1; |
458 | 491 | $ipuid['uid']["$uid"][]=$ip; |
459 | 492 | $ipuid['uid']['count']++; //number of unique uids |
@@ -461,10 +494,11 @@ discard block |
||
461 | 494 | |
462 | 495 | if (in_array($ip,array_keys($ipuid['ip']))) { |
463 | 496 | $ipuid['ip']["$ip"]['count']++; //number of time this ip appears in different messages |
464 | - if (!in_array($uid,$ipuid['ip']["$ip"])) |
|
465 | - $ipuid['ip']["$ip"][]=$uid; //uids that learned this ip |
|
466 | - } |
|
467 | - else { |
|
497 | + if (!in_array($uid,$ipuid['ip']["$ip"])) { |
|
498 | + $ipuid['ip']["$ip"][]=$uid; |
|
499 | + } |
|
500 | + //uids that learned this ip |
|
501 | + } else { |
|
468 | 502 | $ipuid['ip']["$ip"]['count'] = 1; |
469 | 503 | $ipuid['ip']["$ip"][]=$uid; |
470 | 504 | $ipuid['ip']['count']++; //number of unique ips |
@@ -474,10 +508,11 @@ discard block |
||
474 | 508 | $domuid['count']++; |
475 | 509 | if (in_array($uid,array_keys($domuid['uid']))) { |
476 | 510 | $domuid['uid']["$uid"]['count']++; //number of learn by this uid |
477 | - if (!in_array($dom,$domuid['uid']["$uid"])) |
|
478 | - $domuid['uid']["$uid"][]=$dom; //domains learned by this uid |
|
479 | - } |
|
480 | - else { |
|
511 | + if (!in_array($dom,$domuid['uid']["$uid"])) { |
|
512 | + $domuid['uid']["$uid"][]=$dom; |
|
513 | + } |
|
514 | + //domains learned by this uid |
|
515 | + } else { |
|
481 | 516 | $domuid['uid']["$uid"]['count'] = 1; |
482 | 517 | $domuid['uid']["$uid"][]=$dom; |
483 | 518 | $domuid['uid']['count']++; //number of unique uids |
@@ -485,10 +520,11 @@ discard block |
||
485 | 520 | |
486 | 521 | if (in_array($dom,array_keys($domuid['dom']))) { |
487 | 522 | $domuid['dom']["$dom"]['count']++; //number of learn with this domain |
488 | - if (!in_array($uid,$domuid['dom']["$dom"])) |
|
489 | - $domuid['dom']["$dom"][]=$uid; //uids that learned this domain |
|
490 | - } |
|
491 | - else { |
|
523 | + if (!in_array($uid,$domuid['dom']["$dom"])) { |
|
524 | + $domuid['dom']["$dom"][]=$uid; |
|
525 | + } |
|
526 | + //uids that learned this domain |
|
527 | + } else { |
|
492 | 528 | $domuid['dom']["$dom"]['count'] = 1; |
493 | 529 | $domuid['dom']["$dom"][]=$uid; |
494 | 530 | $domuid['dom']['count']++; //number of unique domains |
@@ -505,21 +541,30 @@ discard block |
||
505 | 541 | |
506 | 542 | /* Update HTML report */ |
507 | 543 | fwrite($fp,updateReport ( $ip,$uid,$ipuid['ip']["$ip"]['count'],$ipuid['uid']["$uid"]['count'],$host,$dateClient,$mid,$dateReceived) ); |
508 | - } |
|
509 | - else { /* Bad learn */ |
|
544 | + } else { /* Bad learn */ |
|
510 | 545 | |
511 | - if (in_array($uid,array_keys($uidbad['uid']))) |
|
512 | - $uidbad['uid']["$uid"]['count']++; //number of bad learn by this uid |
|
546 | + if (in_array($uid,array_keys($uidbad['uid']))) { |
|
547 | + $uidbad['uid']["$uid"]['count']++; |
|
548 | + } |
|
549 | + //number of bad learn by this uid |
|
513 | 550 | else { |
514 | 551 | $uidbad['uid']["$uid"]['count'] = 1; |
515 | 552 | $uidbad['uid']["$uid"][]=$uid; |
516 | 553 | $uidbad['count']++; //numeber of unique bad uids |
517 | 554 | } |
518 | 555 | /* The reason of bad report */ |
519 | - if ($host === FALSE) $reason = 'This mail was not received by recognized MX host'; |
|
520 | - if ($dateReceived === FALSE) $reason = 'This mail was not submitted to recognized MSA for learn'; |
|
521 | - if ($uid=='unknown') $reason = 'The uid of this mail was not found in splunk log'; |
|
522 | - if (!isset($reason)) $reason = '?'; |
|
556 | + if ($host === FALSE) { |
|
557 | + $reason = 'This mail was not received by recognized MX host'; |
|
558 | + } |
|
559 | + if ($dateReceived === FALSE) { |
|
560 | + $reason = 'This mail was not submitted to recognized MSA for learn'; |
|
561 | + } |
|
562 | + if ($uid=='unknown') { |
|
563 | + $reason = 'The uid of this mail was not found in splunk log'; |
|
564 | + } |
|
565 | + if (!isset($reason)) { |
|
566 | + $reason = '?'; |
|
567 | + } |
|
523 | 568 | |
524 | 569 | fwrite( $fpb,updatebadReport ( $uid,$dateClient,$mid,$dateReceived,$reason ) ); |
525 | 570 | } |
@@ -541,9 +586,9 @@ discard block |
||
541 | 586 | fwrite($fpd, '<hr><h2>Summary Report</h2><h5>Listing policy: domains must be learned at least '.$cf['listingdom']['threshold']["$type"].' times from at least '.$cf['listingdom']['thresholduid']["$type"].' different valid uids.</h5>' ); |
542 | 587 | |
543 | 588 | /* Make MYSQL connection */ |
544 | - if ( $cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"] ) |
|
545 | - $mysqli = NULL; |
|
546 | - else { |
|
589 | + if ( $cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"] ) { |
|
590 | + $mysqli = NULL; |
|
591 | + } else { |
|
547 | 592 | $mysqli = new mysqli($myconnArray['dbhost'], $myconnArray['userdb'], $myconnArray['pwd'], $myconnArray['db'], $myconnArray['dbport']); |
548 | 593 | if ($mysqli->connect_error) { |
549 | 594 | syslog (LOG_EMERG, $cf['syslog']['user'].': Connect Error (' . $mysqli->connect_errno . ') ' |
@@ -562,8 +607,9 @@ discard block |
||
562 | 607 | fwrite($fpd,file_get_contents(dirname(__FILE__) . '/' . $cf['report']['reportTemplateFooter'])); |
563 | 608 | fclose($fpd); |
564 | 609 | |
565 | - if ( !($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"]) ) |
|
566 | - $mysqli->close(); |
|
610 | + if ( !($cf['listingip']['onlyReport']["$type"] && $cf['listingdom']['onlyReport']["$type"]) ) { |
|
611 | + $mysqli->close(); |
|
612 | + } |
|
567 | 613 | |
568 | 614 | fwrite($fpb, '</table>'); |
569 | 615 | fwrite( $fpb,summaryBadReport( $uidbad ) ); |
@@ -571,12 +617,14 @@ discard block |
||
571 | 617 | fclose($fpb); |
572 | 618 | syslog (LOG_INFO,$cf['syslog']['user'].': Report files written. Listing job for '.$type.' terminated.'); |
573 | 619 | |
574 | - if ( $ierr = imap_errors() ) |
|
575 | - foreach ( $ierr as $thiserr ) |
|
620 | + if ( $ierr = imap_errors() ) { |
|
621 | + foreach ( $ierr as $thiserr ) |
|
576 | 622 | syslog (LOG_ERR, $cf['syslog']['user'].": IMAP Error: $thiserr"); |
577 | - if ( $ierr = imap_alerts() ) |
|
578 | - foreach ( $ierr as $thiserr ) |
|
623 | + } |
|
624 | + if ( $ierr = imap_alerts() ) { |
|
625 | + foreach ( $ierr as $thiserr ) |
|
579 | 626 | syslog (LOG_ALERT, $cf['syslog']['user'].": IMAP Alert: $thiserr"); |
627 | + } |
|
580 | 628 | imap_close($m_mail); |
581 | 629 | } |
582 | 630 | ?> |