#!/usr/bin/perl -Tw
# $Id: iptables-log-filter,v 1.2 2003/10/07 02:32:59 suter Exp $
# Copyright (C) 2000,2001 Mark Suter <suter@humbug.org.au>
#
# This program takes iptables logs and outputs a sanitized form.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
# [MJS  1 Nov 2001] Initial version.

use strict;
use POSIX qw(strftime);
use Time::Local qw(timelocal);

## Instead of installing a function like Date::Calc::Decode_Month
my %months = ( "Jan" => 0, "Feb" => 1, "Mar" => 2, "Apr" => 3, "May" => 4, "Jun" => 5,
	       "Jul" => 6, "Aug" => 7, "Sep" => 8, "Oct" => 9, "Nov" => 10, "Dec" => 11);

while (<STDIN>) {
    if ( /^(\w{3}) \s{1,2} (\d{1,2}) \s (\d{2}):(\d{2}):(\d{2}) \s \w+ .* IN=\S+ .* 
        SRC=(\S+) \s DST=(\S+) .* PROTO=(\S+) \s SPT=(\S+) \s DPT=(\S+)/x ) {

	my ($mon, $mday, $hour, $min, $sec) = ($months{$1}, $2, $3, $4, $5);
	my ($src, $dst, $proto, $spt, $dpt) = ($6, $7, lc($8), $9, $10);

	my $time = timelocal $sec, $min, $hour, $mday, $mon,
	    (localtime)[5] - ((localtime)[4] < $mon ? 1 : 0);

	printf "%s %s %s:%d -> %s:%d\n", strftime("%Y-%m-%d %H:%M:%S", gmtime $time),
	    $proto, $src, $spt, $dst, $dpt;

    } else {
	print;
    }
}