import json
import sys
import random
import os

def ccgen(seed=""): # Color code generator
  if(not os.isatty(1)): # Do not output color code at all if output is not a TTY that can accept them
    return ""
  if(seed and seed != "reset" and seed != "RESET"): # If seed is provided, use it to generate a color. Return color reset code otherwise or if seed is the word "reset"
    random.seed(seed)
    return "\x1b[38;2;{r};{g};{b}m".format(r=random.randrange(50, 256), g=random.randrange(50, 256), b=random.randrange(50, 256))
  return "\x1b[0m"

if not 0 <= 1 < len(sys.argv): # TODO: integrate argparse
  print("Provide a path to a Cowrie JSON log file")
  exit()
filepath = sys.argv[1]

verbosity = 0
entries = []
sessions = {}
session_ips = {}
session_timestamps = {}
session_durations = {}
session_ran_command = {}
session_successful_login = {}

with open(filepath, "r") as logfile:
  for line in logfile:
    entry = json.loads(line)
    entries.append(entry)
    session_id = entry['session']

    if(session_id not in sessions):
      sessions.update({session_id: [entry]})
      session_ips.update({session_id: entry['src_ip']})
    else:
      sessions[session_id].append(entry)

    if(entry["eventid"] == "cowrie.session.connect" and session_id not in session_timestamps): # Save the timestamp of the session's initial connection
      session_timestamps.update({session_id: entry['timestamp']})

    if(entry["eventid"] == "cowrie.session.closed" and session_id not in session_durations): # Save the session's duration
      session_durations.update({session_id: entry['duration']})

    if(entry["eventid"] == "cowrie.command.input" and session_id not in session_ran_command): # Save whether any commands were run during the session
      session_ran_command.update({session_id: True})

    if(entry["eventid"] == "cowrie.login.success" and session_id not in session_successful_login): # Save if login was a success
      session_successful_login.update({session_id: True})

    if(entry["eventid"] == "cowrie.login.failed" and session_id not in session_successful_login): # Save if login failed
      session_successful_login.update({session_id: False})

    if(entry["eventid"] == "cowrie.login.success" and session_id in session_successful_login): # Save if login succeeded after failing
      session_successful_login[session_id] = True

filter_ip = ""
if 0 <= 2 < len(sys.argv):
  filter_ip = sys.argv[2]

if(verbosity == 1): # Verbose mode: print timestamp, event type and message (if applicable) for every event. I could probably do better but I'm lazy
  for session_id in sessions:
    ip = session_ips[session]
    if(ip == filter_ip or not filter_ip):        
      print("\n--- Session " + ccgen(session_id) + session_id + ccgen() + " from " + ccgen(ip) + session_ips[session_id] + ccgen() +" ---")
      for entry in sessions[session_id]:
        if(entry['message']):
          eventid = entry['eventid']
          print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
        else:
          print(entry["timestamp"] + " > " + entry['eventid'])

elif(verbosity == 2): # Maximum verbosity: basically just pretty print the now-sorted-by-session logs
  print(json.dumps(sessions, indent=4))

else: # Default verbosity: just the good stuff
  for session_id in sessions:
    ip = session_ips[session_id]
    timestamp = session_timestamps[session_id][:22].replace("T", " ")
    if(session_id not in session_successful_login):
      print(timestamp + " > Ping from " + ccgen(ip) + ip + ccgen() + " lasting " + session_durations[session_id] + "s")
    elif(not session_successful_login[session_id]):
      cred_combos = []
      for entry in sessions[session_id]:
        if(entry["eventid"] == "cowrie.login.failed"):
          cred_combos.append((entry["username"], entry["password"]))
      print(timestamp + " > Failed login attempt from " + ccgen(ip) + ip + ccgen() + " with credentials " + str(cred_combos))
    elif(session_id in session_ran_command):
      print(timestamp + " > Session from " + ccgen(ip) + ip + ccgen() + ":")
      for entry in sessions[session_id]:
        match(entry["eventid"]):
          case "cowrie.login.failed":
            print(" | Failed login attempt: " + entry["username"] + "/" + entry["password"])
          case "cowrie.login.success":
            print(" | Successful login: " + entry["username"] + "/" + entry["password"])
          case "cowrie.command.input":
            print(" | CMD: " + entry["input"])
      print(" \ Disconnected after " + session_durations[session_id] + "s")
    else:
      cred_combos = []
      for entry in sessions[session_id]:
        if(entry["eventid"] == "cowrie.login.failed" or entry["eventid"] == "cowrie.login.success"):
          cred_combos.append((entry["username"], entry["password"]))
      print(timestamp + " > Successful login from " + ccgen(ip) + ip + ccgen() + " with credentials " + str(cred_combos))