import sys

if sys.platform.startswith("linux"):
    from opencanary.modules import CanaryService, FileSystemWatcher
    from opencanary.config import ConfigException

    import os, re, random, shutil, time
    from datetime import datetime

    class SambaLogWatcher(FileSystemWatcher):

        def __init__(self, logFile=None, logger=None):
            self.logger = logger
            FileSystemWatcher.__init__(self, fileName=logFile)

        def handleLines(self, lines=None):
            #samba4 re
            audit_re = re.compile(r'.*smbd_audit: ((?:[^|]*\|){12}[^|]*)$')

            #samba 3 re
            #audit_re = re.compile(r'.*smbd\[[0-9]+\]: (.*)')
            for line in lines:
                    matches = audit_re.match(line)
                    
                    #Skip lines that do not match the correct RegEx pattern
                    if matches is None:
                           continue
                    (user,remoteIP,localIP,remoteName,shareName,
                    localName,smbVer,smbArch,timeStamp,domainName,
                    auditAction,auditStatus,fileName) = matches.group(1).split('|')

                    data = {}
                    data['src_host'] = remoteIP
                    data['src_port'] = '-1'
                    data['dst_host'] = localIP
                    data['dst_port'] = 445
                    data['logtype'] =  self.logger.LOG_SMB_FILE_OPEN
                    data['logdata'] = {'USER':user, 'REMOTENAME': remoteName, 'SHARENAME': shareName,
                                       'LOCALNAME': localName, 'SMBVER': smbVer, 'SMBARCH': smbArch,
                                       'DOMAIN': domainName, 'AUDITACTION': auditAction,
                                       'STATUS':auditStatus, 'FILENAME': fileName}
                    self.logger.log(data)

    class CanarySamba(CanaryService):
        NAME = 'smb'
        def __init__(self,config=None, logger=None):
            CanaryService.__init__(self, config=config, logger=logger)
            self.audit_file = config.getVal('smb.auditfile', default='/var/log/samba-audit.log')
            self.config = config

        def startYourEngines(self, reactor=None):
            #create samba run dir, so testparm doesn't error
            #try:
            #    os.stat('/var/run/samba')
            #except OSError:
            #    os.mkdir('/var/run/samba')

            fs = SambaLogWatcher(logFile=self.audit_file, logger=self.logger)
            fs.start()



@@ -434,16 +434,100 @@
 ogFile)%0A
+                                                                                    
 %0A       
@@ -584,16 +584,72 @@
 amba4 re
+                                                        
 %0A       
@@ -673,24 +673,25 @@
 e.compile(r'
+%5E
 .*smbd_audit
@@ -695,36 +695,14 @@
 dit:
- ((?:%5B%5E%7C%5D*%5C%7C)%7B12%7D%5B%5E%7C%5D*)
+.*
 $')%0A
-%0A
     
@@ -713,81 +713,31 @@
     
-#samba 3 re%0A            #audit_re = re.compile(r'.*smbd%5C%5B%5B0-9%5D+%5C%5D: (.*)')
+                       
 %0A   
@@ -763,16 +763,24 @@
 n lines:
+        
 %0A       
@@ -835,32 +835,54 @@
                 
+                      
 %0A               
@@ -981,16 +981,19 @@
 is None:
+   
 %0A       
@@ -1024,173 +1024,625 @@
 inue
-%0A                    (user,remoteIP,localIP,remoteName,shareName,%0A                    localName,smbVer,smbArch,timeStamp,domainName,%0A                    auditAction,
+      %0A                                      %0A                    data = line.split('smbd_audit:',1)%5B-1%5D.strip().split('%7C')%0A                                           %0A                    user = data%5B0%5D         %0A                    srcHost = data%5B1%5D%0A                    dstHost = data%5B2%5D%0A                    srcHostName = data%5B3%5D%0A                    shareName = data%5B4%5D  %0A                    dstHostName = data%5B5%5D%0A                    smbVersion = data%5B6%5D%0A                    smbArch = data%5B7%5D           %0A                    domainName = data%5B9%5D       %0A                    auditAction = data%5B10%5D  %0A                    
 audi
@@ -1652,218 +1652,777 @@
 atus
-,fileName)
  = 
-matches.group(1).split('%7C')%0A%0A                    data = %7B%7D%0A                    data%5B'src_host'%5D = remoteIP%0A                    data%5B'src_port'%5D = '-1'%0A                    data%5B'dst_host'%5D = localIP
+data%5B11%5D     %0A                    path = data%5B13%5D            %0A                                           %0A                    if user == %22%22:                                   %0A                      user = %22anonymous%22                                                              %0A                                                                                                     %0A                    data = %7B%7D                                                                          %0A                    data%5B'src_host'%5D = srcHost                                                             %0A                    data%5B'src_port'%5D = '-1'                                              %0A                    data%5B'dst_host'%5D = dstHost                                     
 %0A   
@@ -2460,16 +2460,53 @@
 '%5D = 445
+                                     
 %0A       
@@ -2637,14 +2637,15 @@
 E': 
-remote
+srcHost
 Name
@@ -2726,13 +2726,15 @@
 E': 
-local
+dstHost
 Name
@@ -2751,16 +2751,20 @@
 : smbVer
+sion
 , 'SMBAR
@@ -2939,24 +2939,20 @@
 ENAME': 
-fileName
+path
 %7D%0A      
@@ -2987,16 +2987,70 @@
 g(data)%0A
+                                                      
 %0A    cla
@@ -3100,16 +3100,53 @@
  = 'smb'
+                                     
 %0A       
@@ -3194,79 +3194,431 @@
 ne):
-%0A            CanaryService.__init__(self, config=config, logger=logger)
+                                                                                                                                                                                         %0A            CanaryService.__init__(self, config=config, logger=logger)                                                                                                                                                                       
 %0A   
@@ -3743,17 +3743,62 @@
 = config
-%0A
+                                   %0A          
 %0A       
@@ -3918,16 +3918,66 @@
    #try:
+                                                  
 %0A       
@@ -4011,16 +4011,23 @@
 /samba')
+       
 %0A       
@@ -4092,16 +4092,49 @@
 samba')%0A
+                                 
 %0A       
@@ -4227,10 +4227,8 @@
 start()%0A
-%0A%0A

Fix inconsistent SMB Logging