• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

NathanGibbs3 / BASE / 584

pending completion
584

push

travis-ci-com

NathanGibbs3
20230412 Fix CI build breakage.
         Related Issue(s) #158

2 of 2 new or added lines in 1 file covered. (100.0%)

2594 of 16816 relevant lines covered (15.43%)

20.97 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/base_stat_uaddr.php
1
<?php
2
/*******************************************************************************
3
** Basic Analysis and Security Engine (BASE)
4
** Copyright (C) 2004 BASE Project Team
5
** Copyright (C) 2000 Carnegie Mellon University
6
**
7
** (see the file 'base_main.php' for license details)
8
**
9
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10
**                Sean Muller <samwise_diver@users.sourceforge.net>
11
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12
**
13
** Purpose: Displays statistics on the detected source and
14
**          destination IP addresses   
15
**
16
** Input GET/POST variables
17
**   - addr_type: sets the type of address on which stats will
18
**                be generated
19
**          = 1: source address
20
**          = 2: destination address
21
**   - caller: specifies the canned snapshot to run
22
**          = most_frequent: Most frequent IP address
23
**   - submit:
24
**   - limit_start:
25
********************************************************************************
26
** Authors:
27
********************************************************************************
28
** Kevin Johnson <kjohnson@secureideas.net
29
**
30
********************************************************************************
31
*/
32

33
include("base_conf.php");
×
34
include_once("$BASE_path/includes/base_constants.inc.php");
×
35
include("$BASE_path/includes/base_include.inc.php");
×
36
include_once("$BASE_path/base_db_common.php");
×
37
include_once("$BASE_path/base_common.php");
×
38
include_once("$BASE_path/base_qry_common.php");
×
39

40
AuthorizedRole(10000);
×
41
$et = new EventTiming($debug_time_mode);
×
42
$db = NewBASEDBConnection($DBlib_path, $DBtype); // Connect to Alert DB.
×
43
$db->baseDBConnect(
×
44
        $db_connect_method, $alert_dbname, $alert_host, $alert_port, $alert_user,
45
        $alert_password
46
);
47
UpdateAlertCache($db);
×
48
if ( class_exists('UILang') ){ // Issue 11 backport shim.
×
49
        $CPSensor = $UIL->CWA['Sensor'];
×
50
        $CPTotal = $UIL->CWA['Total'];
×
51
}else{
×
52
        $CPSensor = _SENSOR;
×
53
        $CPTotal = _TOTAL;
×
54
}
55
$addr_type = ImportHTTPVar('addr_type', VAR_DIGIT);
×
56
$submit = ImportHTTPVar('submit', VAR_ALPHA | VAR_SPACE, array(_SELECTED, _ALLONSCREEN, _ENTIREQUERY));
×
57
$sort_order = ImportHTTPVar('sort_order', VAR_LETTER | VAR_USCORE);
×
58
$caller = ImportHTTPVar('caller', VAR_LETTER | VAR_USCORE);
×
59
$action = ImportHTTPVar('action', VAR_ALPHA);
×
60
$cs = new CriteriaState("base_stat_uaddr.php", "&amp;addr_type=$addr_type");
×
61
$cs->ReadState();
×
62
if ( $debug_mode > 0 ){ // Dump debugging info on the shared state.
×
63
        PrintCriteriaState();
×
64
}
65
if ( $addr_type == SOURCE_IP ){
×
66
        $page_title = _UNISADD;
×
67
        $results_title = _SUASRCIP;
×
68
        $addr_type_name = "ip_src";
×
69
}else{ // Default to Dst.
×
70
        if ( $addr_type != DEST_IP ){
×
71
                ErrorMessage(_SUAERRCRITADDUNK);
×
72
        }
73
        $page_title = _UNIDADD;
×
74
        $results_title = _SUADSTIP;
×
75
        $addr_type_name = "ip_dst";
×
76
}
77
if ( $caller == 'most_frequent' && $sort_order = 'occur_d' ){
×
78
        // Issue(s) #123 Fix
79
        $sort_order = $CPTotal.'_occur_d';
×
80
}
81
$qs = new QueryState();
×
82
if ( $caller == 'most_frequent' ){ // Issue #123 Fix
×
83
        $qs->current_sort_order = $sort_order;
×
84
}
85
$qs->AddCannedQuery(
×
86
        'most_frequent', $freq_num_uaddr, _MOSTFREQADDRS, $CPTotal.'_occur_d'
87
);
88
$qs->MoveView($submit); // Increment the view if necessary.
×
89
$tr = 1; // Page Refresh
×
90
if ( $qs->isCannedQuery() ){
×
91
        $page_title.': '.$qs->GetCurrentCannedQueryDesc();
×
92
}else{
×
93
        if ($action != '' ){
×
94
                $tr = $refresh_all_pages;
×
95
        }
96
}
97
PrintBASESubHeader( $page_title, $page_title, $cs->GetBackLink(), $tr );
×
98
$criteria_clauses = ProcessCriteria();
×
99
PrintCriteria('');
×
100
  $criteria = $criteria_clauses[0]." ".$criteria_clauses[1];
×
101
  $from = " FROM acid_event ".$criteria_clauses[0];
×
102
  $where = " WHERE ".$criteria_clauses[1];
×
103

104
  $qs->AddValidAction("ag_by_id");
×
105
  $qs->AddValidAction("ag_by_name");
×
106
  $qs->AddValidAction("add_new_ag");
×
107
  $qs->AddValidAction("del_alert");
×
108
  $qs->AddValidAction("email_alert");
×
109
  $qs->AddValidAction("email_alert2");
×
110
  $qs->AddValidAction("csv_alert");
×
111
  $qs->AddValidAction("archive_alert");
×
112
  $qs->AddValidAction("archive_alert2");
×
113
  
114
  $qs->AddValidActionOp(_SELECTED);
×
115
  $qs->AddValidActionOp(_ALLONSCREEN);
×
116
  
117
  $qs->SetActionSQL($from.$where);
×
118
  $et->Mark("Initialization");
×
119
  
120
  $qs->RunAction($submit, PAGE_STAT_UADDR, $db);
×
121
  $et->Mark("Alert Action");
×
122

123
  /* Run the query to determine the number of rows (No LIMIT)*/
124
  $cnt_sql = "SELECT count(DISTINCT $addr_type_name) ". $from. $where;
×
125
  $qs->GetNumResultRows($cnt_sql, $db);
×
126
  $et->Mark("Counting Result size");
×
127

128
// Setup the Query Results Table.
129
// Common SQL Strings
130
$OB = ' ORDER BY';
×
131
$qro = new QueryResultsOutput("base_stat_uaddr.php?caller=".$caller."&amp;addr_type=".$addr_type);
×
132
$qro->AddTitle('');
×
133
$qro->AddTitle( $results_title,
×
134
        "addr_a", " ", "$OB $addr_type_name ASC",
×
135
        "addr_d", " ", "$OB $addr_type_name DESC", 'right'
×
136
);
137
if ( $resolve_IP == 1 ){
×
138
        $qro->AddTitle('FQDN');
×
139
}
140
$qro->AddTitle( $CPSensor);
×
141
$qro->AddTitle( $CPTotal,
×
142
        "occur_a", " ", "$OB num_events ASC",
×
143
        "occur_d", " ", "$OB num_events DESC", 'right'
×
144
);
145
$qro->AddTitle( _SUAUNIALERTS,
×
146
        "sig_a", " ", "$OB num_sig ASC",
×
147
        "sig_d", " ", "$OB num_sig DESC", 'right'
×
148
);
149
if ( $addr_type == DEST_IP ){
×
150
        $qro->AddTitle( _SUASRCADD,
×
151
                "saddr_a", " ", "$OB num_sip ASC",
×
152
                "saddr_d", " ", "$OB num_sip DESC"
×
153
        );
154
}else{
×
155
        $qro->AddTitle( _SUADSTADD,
×
156
                "daddr_a", " ", "$OB num_dip ASC",
×
157
                "daddr_d", " ", "$OB num_dip DESC"
×
158
        );
159
}
160

161
// Issue #168
162
$sql = "SELECT DISTINCT $addr_type_name, ".
×
163
                " COUNT(acid_event.cid) as num_events,".
164
                " COUNT( DISTINCT acid_event.sid) as num_sensors, ".
165
                " COUNT( DISTINCT signature ) as num_sig, ";
166
if ( $addr_type == DEST_IP ){
×
167
        $tmp = 'src';
×
168
        $tmp2 = 's';
×
169
}else{
×
170
        $tmp = 'dst';
×
171
        $tmp2 = 'd';
×
172
}
173
$tmp = "ip_$tmp";
×
174
$tmp2 = "num_$tmp2".'ip ';
×
175
$sql .= " COUNT( DISTINCT $tmp ) as $tmp2 ";
×
176
$sqlPFX = $from.$where." GROUP BY $addr_type_name ";
×
177
$sort_sql = $qro->GetSortSQL($qs->GetCurrentSort(), $qs->GetCurrentCannedQuerySort());
×
178
if ( !is_null($sort_sql) ){
×
179
        $sqlPFX = $sort_sql[0].$sqlPFX.$sort_sql[1];
×
180
}
181
$sql .= $sqlPFX;
×
182
// Run the Query again for the actual data (with the LIMIT), if any.
183
$result = $qs->ExecuteOutputQuery($sql, $db);
×
184
$et->Mark("Retrieve Query Data");
×
185
if ( $debug_mode > 0 ){
×
186
        if ( $qs->isCannedQuery() ){
×
187
                $CCF = 'Yes';
×
188
                $qs->PrintCannedQueryList();
×
189
        }else{
×
190
                $CCF = 'No';
×
191
        }
192
        print "Canned Query: $CCF <br/>";
×
193
        $qs->DumpState();
×
194
        print "SQL Executed: $sql <br/>";
×
195
}
196
$qs->PrintResultCnt(); // Print current view number and # of rows.
×
197

198
  echo '<FORM METHOD="post" NAME="PacketForm" ACTION="base_stat_uaddr.php">';
×
199
  
200
  $qro->PrintHeader();
×
201
  
202
   $i = 0;
×
203
   while ( ($myrow = $result->baseFetchRow()) && ($i < $qs->GetDisplayRowCnt()) )
×
204
   {
205
      $currentIP = baseLong2IP($myrow[0]);
×
206
      $num_events = $myrow[1];
×
207
      $num_sensors = $myrow[2];
×
208
      $num_sig = $myrow[3];
×
209
      $num_ip = $myrow[4];
×
210

211
      if ( $myrow[0] == NULL ) $no_ip = true; else $no_ip = false;
×
212

213
        qroPrintEntryHeader($i);
×
214
        // Generating checkbox value. -- nikns
215
        // Fix for Issue #69 https://github.com/NathanGibbs3/BASE/issues/69
216
        if ( $addr_type == SOURCE_IP ){
×
217
                $src_ip = $myrow[0];
×
218
                $dst_ip = '';
×
219
        }else{
×
220
                $src_ip = '';
×
221
                $dst_ip = $myrow[0];
×
222
        }
223
        $tmp_rowid = $src_ip.'_'.$dst_ip;
×
224
     echo '    <TD><INPUT TYPE="checkbox" NAME="action_chk_lst['.$i.']" VALUE="'.$tmp_rowid.'">';
×
225
     echo '    <INPUT TYPE="hidden" NAME="action_lst['.$i.']" VALUE="'.$tmp_rowid.'"></TD>';
×
226
        // Check for a NULL IP indicating an event (e.g. portscan) which has no IP.
227
        if ( $no_ip ){
×
228
                $tmp = '<A HREF="'.$BASE_urlpath.'/help/base_app_faq.php#1">'._UNKNOWN;
×
229
        }else{
×
230
                $tmp = BuildAddressLink($currentIP, 32).$currentIP;
×
231
        }
232
        $tmp .= '</a>';
×
233
        qroPrintEntry($tmp,'right');
×
234
        if ( $resolve_IP == 1 ){
×
235
                qroPrintEntry(
×
236
                        baseGetHostByAddr($currentIP, $db, $dns_cache_lifetime), 'right'
×
237
                );
238
        }
239
      /* Print # of Occurances */
240
      $tmp_iplookup = 'base_qry_main.php?new=1'.
×
241
                      '&amp;num_result_rows=-1'.
242
                      '&amp;sort_order='.$sort_order.
243
                      '&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=1';
244
      $tmp_iplookup2 = 'base_stat_alerts.php?new=1'.   
×
245
                       '&amp;num_result_rows=-1'.
246
                       '&amp;sort_order='.$sort_order.
247
                       '&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=1';
248
        if ( $addr_type == 1 ){
×
249
         if ( $no_ip )
×
250
            $url_criteria = BuildSrcIPFormVars(NULL_IP);
×
251
         else
×
252
            $url_criteria = BuildSrcIPFormVars($currentIP);
×
253
        }elseif ( $addr_type == 2 ){
×
254
         if ( $no_ip )
×
255
           $url_criteria = BuildDstIpFormVars(NULL_IP);
×
256
         else 
×
257
           $url_criteria = BuildDstIPFormVars($currentIP);
×
258
        }
259
        qroPrintEntry($num_sensors);
×
260
        qroPrintEntry(
×
261
                '<A HREF="'.$tmp_iplookup.$url_criteria.'">'.$num_events.'</A>','right'
262
        );
263
        qroPrintEntry(
×
264
                '<A HREF="'.$tmp_iplookup2.$url_criteria.'">'.$num_sig.'</A>','right'
265
        );
266
        qroPrintEntry($num_ip);
×
267
        qroPrintEntryFooter();
×
268
      ++$i;
×
269
}
270
  $result->baseFreeRows();     
×
271

272
  $qro->PrintFooter();
×
273

274
  $qs->PrintBrowseButtons();
×
275
  $qs->PrintAlertActionButtons();
×
276
  $qs->SaveState();
×
277
  ExportHTTPVar("addr_type", $addr_type);
×
278
ExportHTTPVar("sort_order", $sort_order);
×
279
  echo "\n</FORM>\n";
×
280
$et->Mark("Get Query Elements");
×
281
PrintBASESubFooter();
×
282
?>
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc