• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

NathanGibbs3 / BASE / 584

pending completion
584

push

travis-ci-com

NathanGibbs3
20230412 Fix CI build breakage.
         Related Issue(s) #158

2 of 2 new or added lines in 1 file covered. (100.0%)

2594 of 16816 relevant lines covered (15.43%)

20.97 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/base_stat_ports.php
1
<?php
2
/*******************************************************************************
3
** Basic Analysis and Security Engine (BASE)
4
** Copyright (C) 2004 BASE Project Team
5
** Copyright (C) 2000 Carnegie Mellon University
6
**
7
** (see the file 'base_main.php' for license details)
8
**
9
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10
**                Sean Muller <samwise_diver@users.sourceforge.net>
11
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12
**
13
** Purpose: Displays statistics on the detected source and
14
**          destination TCP/UDP ports   
15
**
16
** Input GET/POST variables
17
**   - port_type: sets the type of address on which stats will
18
**                be generated
19
**          = 1: source port
20
**          = 2: destination port
21
**   - proto: sets the protocol 
22
**          = 6: TCP
23
**          = 17: UDP
24
**          = -1: either
25
**   - caller: specifies the canned snapshot to run
26
**          = most_frequent: Most frequent Port
27
**   - submit:
28
********************************************************************************
29
** Authors:
30
********************************************************************************
31
** Kevin Johnson <kjohnson@secureideas.net
32
**
33
********************************************************************************
34
*/
35

36
include("base_conf.php");
×
37
include_once("$BASE_path/includes/base_constants.inc.php");
×
38
include("$BASE_path/includes/base_include.inc.php");
×
39
include_once("$BASE_path/base_db_common.php");
×
40
include_once("$BASE_path/base_common.php");
×
41
include_once("$BASE_path/base_qry_common.php");
×
42

43
AuthorizedRole(10000);
×
44
$et = new EventTiming($debug_time_mode);
×
45
$db = NewBASEDBConnection($DBlib_path, $DBtype); // Connect to Alert DB.
×
46
$db->baseDBConnect(
×
47
        $db_connect_method, $alert_dbname, $alert_host, $alert_port, $alert_user,
48
        $alert_password
49
);
50
UpdateAlertCache($db);
×
51
if ( class_exists('UILang') ){ // Issue 11 backport shim.
×
52
        $CPSensor = $UIL->CWA['Sensor'];
×
53
        $CPLast = $UIL->CWA['Last'];
×
54
        $CPFirst = $UIL->CWA['First'];
×
55
}else{
×
56
        $CPSensor = _SENSOR;
×
57
        $CPLast = _LAST;
×
58
        $CPFirst = _FIRST;
×
59
}
60
$port_proto = 'TCP';
×
61
$submit = ImportHTTPVar("submit", VAR_ALPHA | VAR_SPACE, array(_SELECTED, _ALLONSCREEN, _ENTIREQUERY));
×
62
$port_type = ImportHTTPVar("port_type", VAR_DIGIT);
×
63
$proto = ImportHTTPVar("proto", VAR_DIGIT);
×
64
$sort_order=ImportHTTPVar("sort_order", VAR_LETTER | VAR_USCORE);
×
65
$caller = ImportHTTPVar('caller', VAR_LETTER | VAR_USCORE);
×
66
$action = ImportHTTPVar("action", VAR_ALPHA);
×
67
$cs = new CriteriaState("base_stat_ports.php");
×
68
$cs->ReadState();
×
69
if ( $debug_mode > 0 ){ // Dump debugging info on the shared state.
×
70
        PrintCriteriaState();
×
71
}
72
if ( $caller == 'most_frequent' && $sort_order = 'occur_d' ){
×
73
        // Interim Issue #124 Fix
74
        $sort_order = _OCCURRENCES.'_occur_d';
×
75
}
76
if ( $caller == 'last_ports' && $sort_order = 'last_d' ){
×
77
        $sort_order = $CPLast.'_last_d';
×
78
}
79
$qs = new QueryState();
×
80
if ( $caller == 'most_frequent' || $caller == 'last_ports' ){
×
81
        // Issue #124 Fix
82
        $qs->current_sort_order = $sort_order;
×
83
}
84
$qs->AddCannedQuery(
×
85
        'most_frequent', $freq_num_uports, _MOSTFREQPORTS, _OCCURRENCES."_occur_d"
×
86
);
87
$qs->AddCannedQuery(
×
88
        'last_ports', $last_num_uports, _LASTPORTS, $CPLast.'_last_d'
89
);
90
$qs->MoveView($submit); // Increment the view if necessary.
×
91
$page_title = _UNIQ.' ';
×
92
switch ( $proto ){
×
93
        case TCP:
×
94
                $page_title .= "TCP ";
×
95
                break;
×
96
        case UDP:
×
97
                $page_title .= "UDP ";
×
98
                break;
×
99
}
100
switch ( $port_type ){
×
101
        case SOURCE_PORT:
×
102
                $page_title .= _SRCPS;
×
103
                break;
×
104
        case DEST_PORT:
×
105
                $page_title .= _DSTPS;
×
106
                break;
×
107
}
108
if ( $qs->isCannedQuery() ){
×
109
        $page_title.': '.$qs->GetCurrentCannedQueryDesc();
×
110
}
111
$tr = 1; // Page Refresh
×
112
if ($action != '' ){
×
113
        $tr = $refresh_all_pages;
×
114
}
115
PrintBASESubHeader( $page_title, $page_title, $cs->GetBackLink(), $tr );
×
116
$criteria_clauses = ProcessCriteria();
×
117
PrintCriteria('');
×
118

119
  $criteria = $criteria_clauses[0]." ".$criteria_clauses[1];
×
120

121
  $qs->AddValidAction("ag_by_id");
×
122
  $qs->AddValidAction("ag_by_name");
×
123
  $qs->AddValidAction("add_new_ag");
×
124
  $qs->AddValidAction("del_alert");
×
125
  $qs->AddValidAction("email_alert");
×
126
  $qs->AddValidAction("email_alert2");
×
127
  $qs->AddValidAction("csv_alert");
×
128
  $qs->AddValidAction("archive_alert");
×
129
  $qs->AddValidAction("archive_alert2");
×
130
 
131
  $qs->AddValidActionOp(_SELECTED);
×
132
  $qs->AddValidActionOp(_ALLONSCREEN);
×
133
 
134
  $et->Mark("Initialization");
×
135
  
136
  $qs->RunAction($submit, PAGE_STAT_PORTS, $db);
×
137
  $et->Mark("Alert Action");
×
138

139
  switch($proto)
×
140
  {
141
     case TCP:
×
142
       $proto_sql = " ip_proto = ".TCP;
×
143
       break;
×
144
     case UDP:
×
145
       $proto_sql = " ip_proto = ".UDP; 
×
146
       break;
×
147
     default:
×
148
       $proto_sql = " ip_proto IN (".TCP.", ".UDP.")";
×
149
       break;
×
150
  }
151

152
  if ( $criteria_clauses[1] != "" )
×
153
     $proto_sql = $proto_sql." AND ";
×
154
  
155
  switch($port_type)
×
156
  {
157
     case SOURCE_PORT:
×
158
       $port_type_sql = "layer4_sport";
×
159
       break;
×
160
     case DEST_PORT:
×
161
     default:
×
162
       $port_type_sql = "layer4_dport";
×
163
       break;
×
164
  }
165

166
  /* create SQL to get Unique Alerts */
167
  $cnt_sql = "SELECT count(DISTINCT $port_type_sql) ".
×
168
             " FROM acid_event ".$criteria_clauses[0].
×
169
             " WHERE $proto_sql".$criteria_clauses[1];
×
170

171
  /* Run the query to determine the number of rows (No LIMIT)*/
172
  $qs->GetNumResultRows($cnt_sql, $db);
×
173
  $et->Mark("Counting Result size");
×
174

175
// Setup the Query Results Table.
176
// Common SQL Strings
177
$OB = ' ORDER BY';
×
178
$qro = new QueryResultsOutput(
×
179
        "base_stat_ports.php?caller=$caller".
×
180
        "&amp;sort_order=".$sort_order.
181
        "&amp;port_type=$port_type&amp;proto=$proto"
×
182
);
183
$qro->AddTitle('');
×
184
$qro->AddTitle( _PORT,
×
185
        "port_a", " ", "$OB $port_type_sql ASC",
×
186
        "port_d", " ", "$OB $port_type_sql DESC", 'right'
×
187
);
188
$qro->AddTitle( $CPSensor,
×
189
        "sensor_a", " ", "$OB num_sensors ASC",
×
190
        "sensor_d", " ", "$OB num_sensors DESC"
×
191
);
192
$qro->AddTitle( _OCCURRENCES,
×
193
        "occur_a", " ", "$OB num_events ASC",
×
194
        "occur_d", " ", "$OB num_events DESC", 'right'
×
195
);
196
$qro->AddTitle( _UNIALERTS,
×
197
        "alerts_a", " ", "$OB num_sig ASC",
×
198
        "alerts_d", " ", "$OB num_sig DESC", 'right'
×
199
);
200
$qro->AddTitle( _SUASRCADD,
×
201
        "sip_a", " ", "$OB num_sip ASC",
×
202
        "sip_d", " ", "$OB num_sip DESC", 'right'
×
203
);
204
$qro->AddTitle( _SUADSTADD,
×
205
        "dip_a", " ", "$OB num_dip ASC",
×
206
        "dip_d", " ", "$OB num_dip DESC", 'right'
×
207
);
208
$qro->AddTitle( $CPFirst,
×
209
        "first_a", " ", "$OB first_timestamp ASC",
×
210
        "first_d", " ", "$OB first_timestamp DESC"
×
211
);
212
$qro->AddTitle( $CPLast,
×
213
        "last_a", " ", "$OB last_timestamp ASC",
×
214
        "last_d", " ", "$OB last_timestamp DESC"
×
215
);
216

217
// Issue #168
218
$sql = "SELECT DISTINCT $port_type_sql, MIN(ip_proto), ".
×
219
                " COUNT(acid_event.cid) as num_events,".
220
                " COUNT( DISTINCT acid_event.sid) as num_sensors, ".
221
                " COUNT( DISTINCT signature ) as num_sig, ".
222
                " COUNT( DISTINCT ip_src ) as num_sip, ".
223
                " COUNT( DISTINCT ip_dst ) as num_dip, ".
224
                " MIN(timestamp) as first_timestamp, ".
225
                " MAX(timestamp) as last_timestamp ";
226
$sqlPFX = " FROM acid_event ".$criteria_clauses[0].
×
227
        " WHERE ".$proto_sql.$criteria_clauses[1]." GROUP BY ".$port_type_sql." ";
×
228
$sort_sql = $qro->GetSortSQL($qs->GetCurrentSort(), $qs->GetCurrentCannedQuerySort());
×
229
if ( !is_null($sort_sql) ){
×
230
        $sqlPFX = $sort_sql[0].$sqlPFX.$sort_sql[1];
×
231
}
232
$sql .= $sqlPFX;
×
233
// Run the Query again for the actual data (with the LIMIT), if any.
234
$result = $qs->ExecuteOutputQuery($sql, $db);
×
235
$et->Mark("Retrieve Query Data");
×
236
if ( $debug_mode > 0 ){
×
237
        if ( $qs->isCannedQuery() ){
×
238
                $CCF = 'Yes';
×
239
                $qs->PrintCannedQueryList();
×
240
        }else{
×
241
                $CCF = 'No';
×
242
        }
243
        print "Canned Query: $CCF <br/>";
×
244
        $qs->DumpState();
×
245
        print "SQL Executed: $sql <br/>";
×
246
        $TK = array ( 'port_type', 'proto' );
×
247
        $DI = array();
×
248
        $DD = array();
×
249
        foreach ( $TK as $val ){
×
250
                array_push($DD, $val);
×
251
                array_push($DI, $$val);
×
252
        }
253
        NLIO('<hr/>');
×
254
        DDT($DI,$DD,'Port / Protocol Constraints', '', 12);
×
255
}
256
$qs->PrintResultCnt(); // Print current view number and # of rows.
×
257

258
  echo '<FORM METHOD="post" NAME="PacketForm" ACTION="base_stat_ports.php">'."\n";
×
259

260
  $qro->PrintHeader();
×
261

262
  echo "<input type='hidden' name='port_type' value='$port_type'>\n"; 
×
263

264
   $i = 0;
×
265
while ( ($myrow = $result->baseFetchRow()) && ($i < $qs->GetDisplayRowCnt()) ){
×
266
        if ( is_null($myrow[0]) ){
×
267
                continue; // Issue #112 Interim fix.
×
268
        }
269
      $currentPort = $url_port = $myrow[0].' ';
×
270
      if ( $port_proto == TCP )
×
271
      {
272
        $currentPort = $currentPort.'/ tcp ';
×
273
      }
274
      if ( $port_proto == UDP )
×
275
      {
276
        $currentPort = $currentPort.'/ udp ';
×
277
      }
278
      // Go here to change the format of the Port lookup stuff! -- Kevin Johnson
279
      foreach ($external_port_link as $name => $baseurl) {
×
280
            $currentPort = $currentPort.'[<A HREF="'.$baseurl.$myrow[0].'" TARGET="_ACID_PORT_">'.$name.'</A>] ';
×
281
      }
282
      $port_proto = $myrow[1];
×
283
      $num_events = $myrow[2];
×
284
      $num_sensors = $myrow[3];
×
285
      $num_sig = $myrow[4];
×
286
      $num_sip = $myrow[5];
×
287
      $num_dip = $myrow[6];
×
288
      $first_time = $myrow[7];
×
289
      $last_time = $myrow[8];
×
290

291
      if ( $port_proto == TCP )
×
292
      { 
293
        $url_port_type = "tcp";
×
294
        $url_layer4 = "TCP";
×
295
      }
296
      if ( $port_proto == UDP )
×
297
      { 
298
        $url_port_type = "udp";
×
299
        $url_layer4 = "UDP";
×
300
      }
301

302
      $url_param = $url_port_type."_port%5B0%5D%5B0%5D=+".
×
303
                   "&amp;".$url_port_type."_port%5B0%5D%5B1%5D=".$port_type_sql.
304
                   "&amp;".$url_port_type."_port%5B0%5D%5B2%5D=%3D".
305
                   "&amp;".$url_port_type."_port%5B0%5D%5B3%5D=".$url_port.
306
                   "&amp;".$url_port_type."_port%5B0%5D%5B4%5D=+".
307
                   "&amp;".$url_port_type."_port%5B0%5D%5B5%5D=+".
308
                   "&amp;".$url_port_type."_port_cnt=1".
309
                   "&amp;layer4=".$url_layer4.
310
                   "&amp;sort_order=".$sort_order.
311
                   "&amp;num_result_rows=-1&amp;current_view=-1";
312

313
      qroPrintEntryHeader($i);
×
314

315
      /* Generating checkbox value -- nikns */
316
      if ($proto == TCP)
×
317
            $tmp_rowid = TCP ."_";
×
318
      else if ($proto == UDP)
×
319
            $tmp_rowid = UDP ."_";
×
320
      else
×
321
            $tmp_rowid = -1 ."_";
×
322
      
323
      ($port_type == SOURCE_PORT) ? ($tmp_rowid .= SOURCE_PORT) : ($tmp_rowid .= DEST_PORT);
×
324
      $tmp_rowid .= "_" . $myrow[0];
×
325

326
      echo '    <TD><INPUT TYPE="checkbox" NAME="action_chk_lst['.$i.']" VALUE="'.$tmp_rowid.'"></TD>';
×
327
      echo '        <INPUT TYPE="hidden" NAME="action_lst['.$i.']" VALUE="'.$tmp_rowid.'">';
×
328

329
        qroPrintEntry($currentPort,'right');
×
330
      qroPrintEntry('<A HREF="base_stat_sensor.php?'.$url_param.'">'.$num_sensors.'</A>');
×
331
        qroPrintEntry('<A HREF="base_qry_main.php?'.$url_param.'&amp;new=1&amp;submit='._QUERYDBP.
×
332
                    '&amp;sort_order=sig_a">'.$num_events.'</A>','right');
333
        qroPrintEntry('<A HREF="base_stat_alerts.php?'.$url_param.'&amp;sort_order=sig_a">'.
×
334
                    $num_sig.'</A>','right');
335
        qroPrintEntry('<A HREF="base_stat_uaddr.php?'.$url_param.'&amp;addr_type=1'.
×
336
                    '&amp;sort_order=addr_a">'.$num_sip,'right');
337
        qroPrintEntry('<A HREF="base_stat_uaddr.php?'.$url_param.'&amp;addr_type=2'.
×
338
                    '&amp;sort_order=addr_a">'.$num_dip,'right');
339
      qroPrintEntry($first_time);
×
340
      qroPrintEntry($last_time);
×
341
      qroPrintEntryFooter();
×
342
      ++$i;
×
343
}
344
$result->baseFreeRows();
×
345
$qro->PrintFooter();
×
346

347
  $qs->PrintBrowseButtons();
×
348
  $qs->PrintAlertActionButtons();
×
349
  $qs->SaveState();
×
350
  ExportHTTPVar("port_type", $port_type);
×
351
  ExportHTTPVar("proto", $proto);
×
352
        ExportHTTPVar("sort_order", $sort_order);        
×
353

354
  echo "\n</FORM>\n";
×
355
$et->Mark("Get Query Elements");
×
356
PrintBASESubFooter();
×
357
?>
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc