#!/bin/bash
#
# gets line from syslogd on input in format '$PRI#$DATE#$HOST#$PROGRAM#$MSG'
# and sends syslogMessage SNMP trap
#

TRAPLINE=$1

## check if the default configuration for snmptrap exists
## it includes src IP address used in the trap
## Without it the src IP will be eth0 by default
if [ ! -f /etc/snmp/snmp.conf ]; then
   /opt/rcon/bin/snmptrapconf.sh >/dev/null 2>&1
fi

## OIDs from our MIB
SYSLOG_MESSAGE_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.10'"
SEVERITY_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.1'"
FACILITY_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.2'"
MSG_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.4'"
DATE_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.5'"
HOST_IDTYPE_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.6'"
HOST_ID_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.7'"
PROGRAM_OID="'.1.3.6.1.4.1.231.7.2.1.11.90.1.8'"

SNMPTRAP="/usr/bin/snmptrap"

## parse command line argument

PRI=`echo $TRAPLINE | cut -d "#" -f 1`
DATE=`echo $TRAPLINE | cut -d "#" -f 2`
HOST=`echo $TRAPLINE | cut -d "#" -f 3`
PROGRAM=`echo $TRAPLINE | cut -d "#" -f 4`
MSG=`echo $TRAPLINE | cut -d "#" -f 5-`


## in the mib the facility and severity is counted from 1, 
## therefore + 1 for each

FACILITY=$(( $PRI / 8 ))
SEVERITY=$(( $PRI - $FACILITY * 8  + 1 ))
FACILITY=$(( $FACILITY + 1 ))

### filter sshd info messages 
### FILTER START
if [ "$PROGRAM" = "sshd" ]; then
   ### only the severity greater than 5
   if [ $SEVERITY -gt 5 ]; then
      ### in case of message is from ILAN we have to filter it
      ILAN_IP=`/bin/getremintIP`
      echo $MSG | grep $ILAN_IP >/dev/null 2>&1
      if [ "$?" = "0" ]; then
         exit 0
      fi
      ### in case of message is from cap logins we have to filter it
      CAP_IP=`/bin/getremintIP -c cap`
      echo $MSG | grep $CAP_IP >/dev/null 2>&1
      if [ "$?" = "0" ]; then
         exit 0
      fi
      ### check if we are in duty hours - if not send trap
      DUTY=`sshr -c assistant /opt/secm/bin/validate_duty.pl`
      if [ "$DUTY" = "IN_DUTY" ]; then
         exit 0
      fi
   fi
fi
### FILTER END

## construct the message for snmptrap - see man snmptrap

TRAP_MESSAGE="\
'' \
$SYSLOG_MESSAGE_OID \
$SEVERITY_OID i $SEVERITY \
$FACILITY_OID i $FACILITY \
$MSG_OID s \"$MSG\" \
$DATE_OID s \"$DATE\" \
$HOST_IDTYPE_OID i 2 \
$HOST_ID_OID s \"$HOST\" \
$PROGRAM_OID s \"$PROGRAM\""

## only for debug - this values can be used to send a trap
## as user 'r' with priv and auth password '11111111'
######
###  CONTEXT_ID="0x80001f8880a6f4600b2af7654e"
###  AUTH_HASH="0x0d6cff701ab4e3e4a4448ee0d3d65f2852889981"
###  PRIV_HASH="0x0d6cff701ab4e3e4a4448ee0d3d65f28"
###  USER_NAME="r"
###  TRAP_DST="10.7.254.70"
###  CMD="$SNMPTRAP -u $USER_NAME -e $CONTEXT_ID -3k $AUTH_HASH -3K $PRIV_HASH $TRAP_DST $TRAP_MESSAGE"
###  echo $CMD
###  /bin/bash -c "$CMD"
###  exit 0
######

MASTER_CONF="/var/lib/net-snmp/snmpd.conf"
TRAP_DES_LIST="/etc/snmp/user-trap.list"

if [ ! -f "$MASTER_CONF" ]; then
   exit 1;
fi

CONTEXT_ID=`grep -m 1 '^usmUser 1 3' $MASTER_CONF | cut -d " " -f 4`
if [ "$CONTEXT_ID" = "" ]; then
   exit 1;
fi

if [ ! -f "$TRAP_DES_LIST" ]; then
   exit 1;
fi

cat "$TRAP_DES_LIST" | while read line; 
do
    USER_NAME=`echo $line |  cut -d " " -f 1`
    TRAP_DST=`echo $line | cut -d " " -f 2`
    GRP_NAME=" 0x"`echo -n $USER_NAME | xxd -ps`"00"
    USER_LINE=`grep -m 1 "$GRP_NAME" $MASTER_CONF`
    if [ "$USER_LINE" = "" ]; then
       continue;
    fi
    AUTH_HASH=`echo $USER_LINE | cut -d " " -f 9`
    PRIV_HASH=`echo $USER_LINE | cut -d " " -f 11`
    if [ -x "$SNMPTRAP" ]; then
       CMD="$SNMPTRAP -u $USER_NAME -e $CONTEXT_ID -3k $AUTH_HASH -3K $PRIV_HASH $TRAP_DST $TRAP_MESSAGE"
       /bin/bash -c "$CMD"
    else
       exit 1
    fi
done

exit 0

