import subprocess
import os
import time
import smtplib
import pymysql
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart

con = pymysql.connect(host="localhost",user="inaripiadmin79417",password="kali92010linux",database="inari_pi", unix_socket="/run/mysqld/mysqld.sock")
cursor = con.cursor()
select_client_email= ("SELECT email FROM tbl_user WHERE id_user = 2")
cursor.execute(select_client_email)
con.commit()
rows= cursor.fetchall()
for row in rows:
    client_email= row[0]
    con.close()


while True:
    sender_email = "inaripi@outlook.com"
    receiver_email = client_email
    password = *OMITTED*
    
    leasesfile = open("/var/lib/misc/dnsmasq.leases", "r")
    for leases in leasesfile:
        values = leases.split(" ")
        mac= values[1]
        ip= values[2]
        name=values[3]
        mac_val = mac.upper()
        con = pymysql.connect(host="localhost",user="inaripiadmin79417",password="kali92010linux",database="inari_pi", unix_socket="/run/mysqld/mysqld.sock")
        cursor = con.cursor()
        rules_group= ["RECON", "BFA", "DOS"]
        for group in rules_group:
            #check snort logs for traffic alerts
            n_alerts =subprocess.run(" grep -w "+group+" /var/log/snort/alert | cut -d ' ' -f 11 | grep -c "+ ip,  shell=True, text=True, capture_output=True)
            total_alerts= n_alerts.stdout
            if (int(total_alerts))> 0:

                if (group == "RECON" and int(total_alerts) > 5) or (group == "BFA" and int(total_alerts) > 3) or (group == "DOS" and int(total_alerts) > 3) :
                    print(ip +" --> "+group+" attack threats, alerts generated:" + total_alerts)
                    check_if_existing=subprocess.run("sudo iptables -L --line-numbers | grep "+mac_val+" | cut -d ' ' -f 5", shell=True, text=True, capture_output=True)
                    result = (check_if_existing.stdout[0:4])
                    if (result == "ACCE"):
                        print("An accept rule was previosly applied")
                        index_check=subprocess.run("sudo iptables -L --line-numbers | grep "+mac_val+" | cut -d ' ' -f 1", shell=True, text=True, capture_output=True)
                        index = index_check.stdout
                        delete_previous=subprocess.run("sudo iptables -D INPUT "+index, shell=True)
                        print("Old Rule deleted")
                        apply_new_rule=subprocess.run("sudo iptables -A INPUT -i wlan1 -m mac --mac-source "+mac_val+" -j DROP", shell=True)
                        update_status= ("UPDATE tbl_device SET status = 3, details= 'Malicious activity' WHERE mac_address = %s")
                        cursor.execute(update_status, mac_val)
                        con.commit()
                        print("New rule applied")
                    elif (result == "DROP"): 
                        print("Rule already applied")
                    else :
                        print("No previous rules applied, creating one.")
                        iptable_rule=subprocess.run("sudo iptables -A INPUT -i wlan1 -m mac --mac-source "+mac_val+" -j DROP", shell=True)
                        update_status= ("UPDATE tbl_device SET status = 3, details= 'Malicious activity' WHERE mac_address = %s")
                        cursor.execute(update_status, mac_val)
                        con.commit()

                    delete_records=subprocess.run("sudo sed -i '/"+ip+"/d' /var/log/snort/alert", shell=True)
                    snort_restart=subprocess.run("sudo systemctl restart snort.service", shell=True)
                    
                    select_name= ("SELECT device_name FROM tbl_device WHERE mac_address = %s")
                    cursor.execute(select_name, mac_val)
                    con.commit()
                    rows= cursor.fetchall()
                    for row in rows:
                        name= row[0]
                
                    con.close()
                    
                    message = MIMEMultipart("alternative")
                    message["Subject"] = "Malicious Activity Notification"
                    message["From"] = 'inaripi@outlook.com'
                    message["To"] = 'inaripi_client@hotmail.com'


                    html = """\
                    <!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
  <style media="screen">
    body{
      font-family: sans-serif;}
    .footer{
      text-align: center;
      font-size: 10px;
      color: #999999;}

.message{
  padding:10px  20px;
  margin: 10px;
  background-color:#ffffff;}
 a {
  background-color: #ffffff;
  border: solid 1px #3498dc;
  border-radius: 4px;
  box-sizing: border-box;
  color: #3498dc;
  font-size: 14px;
  font-weight: bold;
  padding: 12px 25px;
  text-decoration: none;}
hr{
  background-color: gray;
  border-width: thin}

.page{
  padding: 30px;
  background-color: #f6f6f6;

  </style>
  <title>Notification</title>
</head>
<body>
<div class="page">
<div class="message">
  <p>Dear IPI user,</p><br>
  <p>This email is to inform you that the following device:<b> """ +name+ """</b> has been blocked due to malicious activity.</p><br>
  <p>Please seek IT assistance to verify the device's health</p><br>
  <p>Many thanks,</p>
  <p><strong>The Inari PI Team.<strong></p>
<hr>
    <div class="footer">
    <span>Inari PI @ 2021, all rights reserved.</span>
    </div>
    </div>
</div>
</body>
</html>

        """

                    part2 = MIMEText(html, "html")
                    message.attach(part2)

                    with smtplib.SMTP("smtp-mail.outlook.com", 587) as server:
                        server.starttls()
                        server.login(sender_email, password)
                        server.sendmail(
                        sender_email, receiver_email, message.as_string())

                else:
                    print(ip + " --> no " +group+" threats.")



    print("-------------------Checking-Snort-logs-------------------")

    
    leasesfile.close()
    time.sleep(10)
