NathanGibbs3 / BASE / 590

pending completion

Build # 590

Build Type

push

travis-ci-com

Committed by

NathanGibbs3

Commit Message

20230420 Fix CI build breakage. 2

Run Details

2755 of 16977 relevant lines covered (16.23%)

21.61 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/base_stat_common.php

<?php
/*******************************************************************************
** Basic Analysis and Security Engine (BASE)
** Copyright (C) 2004 BASE Project Team
** Copyright (C) 2000 Carnegie Mellon University
**
** (see the file 'base_main.php' for license details)
**
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
**                Sean Muller <samwise_diver@users.sourceforge.net>
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
**
** Purpose: summary statistics
********************************************************************************
** Authors:
********************************************************************************
** Kevin Johnson <kjohnson@secureideas.net
**
********************************************************************************
*/
defined( '_BASE_INC' ) or die( 'Accessing this file directly is not allowed.' );
include_once("$BASE_path/includes/base_constants.inc.php");

function SensorCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
      $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event");
   else
      $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event $join $where");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function SensorTotal( $db ){
   $result = $db->baseExecute("SELECT COUNT(DISTINCT sensor.sid) FROM sensor");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function EventCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
      $result = $db->baseExecute("SELECT count(*) FROM acid_event");
   else
      $result = $db->baseExecute("SELECT COUNT(acid_event.sid) FROM acid_event $join $where");  

   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
// Returns: The number of unique alert descriptions for the given sensor ID.
function UniqueCntBySensor( $sensorID, $db ){
        // Calculate the Unique Alerts.
  $query = "SELECT COUNT(DISTINCT signature) FROM acid_event WHERE sid = '" . $sensorID . "'";
  $result = $db->baseExecute($query);

  if ( $result ) 
  {
     $row = $result->baseFetchRow();
     $num = $row[0];
     $result->baseFreeRows();
  }
  else
     $num = 0;

        return $num;
}

// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
// Returns: The total number of alerts for the given sensor ID.
function EventCntBySensor( $sensorID, $db ){
   $query = "SELECT count(*) FROM acid_event where sid = '" .$sensorID. "'";

   $result = $db->baseExecute($query);
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function MinDateBySensor( $sensorID, $db ){
   $query = "SELECT min(timestamp) FROM acid_event WHERE sid= '". $sensorID."'";

   $result = $db->baseExecute($query);
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function MaxDateBySensor( $sensorID, $db ){
   $query = "SELECT max(timestamp) FROM acid_event WHERE sid='".$sensorID."'";

   $result = $db->baseExecute($query);
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueDestAddrCntBySensor( $sensorID, $db ){
   $query = "SELECT COUNT(DISTINCT ip_dst) from acid_event WHERE sid='" . $sensorID . "'";

   $result = $db->baseExecute($query);
   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueSrcAddrCntBySensor( $sensorID, $db ){
   $query = "SELECT COUNT(DISTINCT ip_src) from acid_event WHERE sid='" . $sensorID . "'";

   $result = $db->baseExecute($query);
   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function TCPPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=6");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function UDPPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=17");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function ICMPPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=1");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function PortscanPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=255");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueSrcIPCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event $join WHERE $where"); //.
                                //"WHERE acid_event.sid > 0 $where");

   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueDstIPCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join WHERE $where"); //.
                                //"WHERE acid_event.sid > 0 $where");

   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueIPCnt( $db, $join = '', $where = '' ){
   $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src), ".
                              "COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join $where");

   $row = $result->baseFetchRow();
   $num1 = $row[0];
   $num2 = $row[1];
   $result->baseFreeRows();

        return array($num1, $num2);
}

function StartStopTime( &$start_time, &$stop_time, $db ){
   $result = $db->baseExecute("SELECT (SELECT timestamp FROM acid_event ORDER BY timestamp ASC LIMIT 1), ".
                              "(SELECT timestamp FROM acid_event ORDER BY timestamp DESC LIMIT 1)");
   $myrow = $result->baseFetchRow();
   $start_time = $myrow[0];
   $stop_time = $myrow[1];
   $result->baseFreeRows();
}

function UniqueAlertCnt($db, $join = '', $where = '' ){
   $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.signature) FROM acid_event $join ".
                                 "$where");    

   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniquePortCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "")
     $result = $db->baseExecute("SELECT COUNT(DISTINCT layer4_sport),  ".
                                "COUNT(DISTINCT layer4_dport) FROM acid_event");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                                "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join ".
                                "$where");

   $row = $result->baseFetchRow();
   $result->baseFreeRows();

        return array($row[0], $row[1]);
}

function UniqueTCPPortCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "")
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
                              "WHERE ip_proto='".TCP."'");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".
                              " $where AND ip_proto='".TCP."'");

   $row = $result->baseFetchRow();
   $result->baseFreeRows();

        return array($row[0], $row[1]);
}

function UniqueUDPPortCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "")
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
                              "WHERE ip_proto='".UDP."'");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".
                              " $where AND ip_proto='".UDP."'");

   $row = $result->baseFetchRow();
   $result->baseFreeRows();

        return array($row[0], $row[1]);
}

function UniqueLinkCnt( $db, $join = '', $where = '' ){
   if (!stristr($where, "WHERE") && $where != "")
        $where = " WHERE $where ";

   if ( $db->DB_type == "mysql" )
   {
     if ( $join == "" && $where == "")
       $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event");
     else
       $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event $join $where");

     $row = $result->baseFetchRow();
     $result->baseFreeRows();
   }
   else
   {
     if ( $join == "" && $where == "")
       $result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event");
     else
       $result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event $join $where");
   
     $row[0] = $result->baseRecordCount();
     $result->baseFreeRows();     
   }

        return $row[0];
}

function PrintGeneralStats(
        $db, $compact, $show_stats, $join = '', $where = '',
        $show_total_events = false
){
        GLOBAL $et;
        if ( $show_stats == 1 ){
     $sensor_cnt = SensorCnt($db, $join, $where);
     $sensor_total = SensorTotal($db);
     $unique_alert_cnt = UniqueAlertCnt($db, $join, $where);
     $event_cnt = EventCnt($db, $join, $where);
     $unique_ip_cnt = UniqueIPCnt($db, $join, $where);
     $unique_links_cnt = UniqueLinkCnt($db, $join, $where);
     $unique_port_cnt = UniquePortCnt($db, $join, $where);
     $unique_tcp_port_cnt = UniqueTCPPortCnt($db, $join, $where);
     $unique_udp_port_cnt = UniqueUDPPortCnt($db, $join, $where);
        }
        if ( $db->baseGetDBversion() >= 103 ){
                // mstone 20050309 this is an expensive calculation.
                // Only do it if we're going to use it.
      if ($show_stats == 1) {
              $result = $db->baseExecute("SELECT count(DISTINCT(sig_class_id)) FROM acid_event");
              $myrow = $result->baseFetchRow();
              $class_cnt = $myrow[0];
              $result->baseFreeRows();
      }

      $class_cnt_info[0] = " <strong>"._SCCATEGORIES." </strong>";
      $class_cnt_info[1] = "<a href=\"base_stat_class.php?sort_order=class_a\">";
      $class_cnt_info[2] = "</a>";
        }

   $sensor_cnt_info[0] = "<strong>"._SCSENSORTOTAL."</strong>\n";
   $sensor_cnt_info[1] = "<a href=\"base_stat_sensor.php\">";
   $sensor_cnt_info[2] = "</a> / ";

   $unique_alert_cnt_info[0] = "<strong>"._UNIALERTS.":</strong>\n";
   $unique_alert_cnt_info[1] = "<a href=\"base_stat_alerts.php\">"; 
   $unique_alert_cnt_info[2] = "</a>";

   $event_cnt_info[0] = "<strong>"._SCTOTALNUMALERTS."</strong>\n";
   $event_cnt_info[1] = '<a href="base_qry_main.php?&amp;num_result_rows=-1'.
                        '&amp;submit='._QUERYDBP.'&amp;current_view=-1">';
   $event_cnt_info[2] = "</a>";

   $unique_src_ip_cnt_info[0] = _SCSRCIP;
   $unique_src_ip_cnt_info[1] = " ".BuildUniqueAddressLink(1);
   $unique_src_ip_cnt_info[2] = "</a>";
   $unique_dst_ip_cnt_info[0] = _SCDSTIP;
   $unique_dst_ip_cnt_info[1] = " ".BuildUniqueAddressLink(2);
   $unique_dst_ip_cnt_info[2] = "</a>";

   $unique_links_info[0] = _SCUNILINKS;
   $unique_links_info[1] = " <a href=\"base_stat_iplink.php\">";
   $unique_links_info[2] = "</a>";

   $unique_src_port_cnt_info[0] = _SCSRCPORTS; 
   $unique_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&amp;proto=-1\">";
   $unique_src_port_cnt_info[2] = "</a>";
   $unique_dst_port_cnt_info[0] = _SCDSTPORTS; 
   $unique_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&amp;proto=-1\">";
   $unique_dst_port_cnt_info[2] = "</a>";

   $unique_tcp_src_port_cnt_info[0] = "TCP (";
   $unique_tcp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&amp;proto=".TCP."\">";
   $unique_tcp_src_port_cnt_info[2] = "</a>)";
   $unique_tcp_dst_port_cnt_info[0] = "TCP (";
   $unique_tcp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&amp;proto=".TCP."\">";
   $unique_tcp_dst_port_cnt_info[2] = "</a>)";

   $unique_udp_src_port_cnt_info[0] = "UDP (";
   $unique_udp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&amp;proto=".UDP."\">";
   $unique_udp_src_port_cnt_info[2] = "</a>)";
   $unique_udp_dst_port_cnt_info[0] = "UDP (";
   $unique_udp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&amp;proto=".UDP."\">";
   $unique_udp_dst_port_cnt_info[2] = "</a>)";

// Begin page output.
        if ( $show_stats == 1 ){
   echo $sensor_cnt_info[0].
        $sensor_cnt_info[1].
        $sensor_cnt.
        $sensor_cnt_info[2].
        $sensor_total;
                NLIO('<br/>');
   echo $unique_alert_cnt_info[0].
        $unique_alert_cnt_info[1].
        $unique_alert_cnt.
        $unique_alert_cnt_info[2];
                NLIO('<br/>');
                if ( $db->baseGetDBversion() >= 103 ){
                        print $class_cnt_info[0] . $class_cnt_info[1] . $class_cnt
                        . $class_cnt_info[2];
                        NLIO('<br/>');
                }

   echo $event_cnt_info[0].
        $event_cnt_info[1].
        $event_cnt.
        $event_cnt_info[2];
                NLIO("<ul class='stats'>",2);
                NLIO('<li>');
                print $unique_src_ip_cnt_info[0] . $unique_src_ip_cnt_info[1]
                        . $unique_ip_cnt[0] . $unique_src_ip_cnt_info[2];
                PrintLINext();
                print $unique_dst_ip_cnt_info[0] . $unique_dst_ip_cnt_info[1]
                        . $unique_ip_cnt[1] . $unique_dst_ip_cnt_info[2];
                PrintLINext();
                print $unique_links_info[0] . $unique_links_info[1]
                        . $unique_links_cnt . $unique_links_info[2];
                if ( $compact == 0 ){
                        NLIO('</li></ul>');
                        NLIO("<ul class='stats'><li>");
                }else{
                        PrintLINext();
                }
                print $unique_src_port_cnt_info[0] . $unique_src_port_cnt_info[1]
                        . $unique_port_cnt[0] . $unique_src_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO("<ul class='stats'><li>");
                }else{
                        PrintLINext();
     echo "&nbsp;&nbsp;--&nbsp;&nbsp;";
                }
   echo $unique_tcp_src_port_cnt_info[0].
        $unique_tcp_src_port_cnt_info[1]. 
        $unique_tcp_port_cnt[0].
        $unique_tcp_src_port_cnt_info[2].
        "&nbsp;&nbsp;".
        $unique_udp_src_port_cnt_info[0].
        $unique_udp_src_port_cnt_info[1]. 
        $unique_udp_port_cnt[0].
        $unique_udp_src_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO('</li></ul>',4);
                }
                PrintLINext();
                print $unique_dst_port_cnt_info[0] . $unique_dst_port_cnt_info[1]
                        . $unique_port_cnt[1] . $unique_dst_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO("<ul class='stats'><li>");
                }else{
                        PrintLINext();
     echo "&nbsp;&nbsp;--&nbsp;&nbsp;";
                }
   echo $unique_tcp_dst_port_cnt_info[0].
        $unique_tcp_dst_port_cnt_info[1]. 
        $unique_tcp_port_cnt[1].
        $unique_tcp_dst_port_cnt_info[2].
        "&nbsp;&nbsp;".
        $unique_udp_dst_port_cnt_info[0].
        $unique_udp_dst_port_cnt_info[1]. 
        $unique_udp_port_cnt[1].
        $unique_udp_dst_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO('</li></ul>',4);
                }
                NLIO('</li></ul>');
        }else{
                if ( $show_total_events ){
                        $event_cnt = EventCnt($db, $join, $where);
                        NLIO("<ul class='stats'><li>");
                        print $event_cnt_info[0] . $event_cnt_info[1] . $event_cnt
                                . $event_cnt_info[2];
                        NLIO('</li></ul>');
                }
                NLIO("<ul class='stats'><li>");
      echo $sensor_cnt_info[1]._SCSENSORS.'</a>';
                PrintLINext();
                print $unique_alert_cnt_info[1] . _UNIALERTS
                        . $unique_alert_cnt_info[2];
                PrintLINext();
                if ( $db->baseGetDBversion() >= 103 ){
                        print '&nbsp;&nbsp;&nbsp;( ' . $class_cnt_info[1]
                                . _SCCLASS.'</a> )';
                }
                PrintLINext();
                print _SCUNIADDRESS
                . $unique_src_ip_cnt_info[1] . _SCSOURCE . ' | '
                . $unique_src_ip_cnt_info[2] . $unique_dst_ip_cnt_info[1] . _SCDEST
                . $unique_dst_ip_cnt_info[2];
                PrintLINext();
                print $unique_links_info[1] . $unique_links_info[0]
                . $unique_links_info[2];
                PrintLINext();
                print $unique_src_port_cnt_info[1] . _SCSOURCE . " "
                . $unique_src_port_cnt_info[2] . _SCPORT . ": "
                . $unique_tcp_src_port_cnt_info[1]." TCP</a> | "
                . $unique_udp_src_port_cnt_info[1]." UDP</a>";
                PrintLINext();
                print $unique_dst_port_cnt_info[1] . _SCDEST . " "
                . $unique_dst_port_cnt_info[2] . _SCPORT . ": "
                . $unique_tcp_dst_port_cnt_info[1] . " TCP</a> | "
                . $unique_udp_dst_port_cnt_info[1] . " UDP</a>";
                NLIO('</li></ul>');
        }
        if ( isset($et) && is_object($et) ){
                $et->Mark("Output Stats");
        }
}
?>

1	<?php
2	/*******************************************************************************
3	** Basic Analysis and Security Engine (BASE)
4	** Copyright (C) 2004 BASE Project Team
5	** Copyright (C) 2000 Carnegie Mellon University
6	**
7	** (see the file 'base_main.php' for license details)
8	**
9	** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10	** Sean Muller <samwise_diver@users.sourceforge.net>
11	** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12	**
13	** Purpose: summary statistics
14	********************************************************************************
15	** Authors:
16	********************************************************************************
17	** Kevin Johnson <kjohnson@secureideas.net
18	**
19	********************************************************************************
20	*/
21	defined( '_BASE_INC' ) or die( 'Accessing this file directly is not allowed.' );
22	include_once("$BASE_path/includes/base_constants.inc.php");
23
24	function SensorCnt( $db, $join = '', $where = '' ){
25	if ( $join == "" && $where == "" )	×
26	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event");	×
27	else
28	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event $join $where");	×
29	$myrow = $result->baseFetchRow();	×
30	$num = $myrow[0];	×
31	$result->baseFreeRows();	×
32
33	return $num;	×
34	}
35
36	function SensorTotal( $db ){
37	$result = $db->baseExecute("SELECT COUNT(DISTINCT sensor.sid) FROM sensor");	×
38	$myrow = $result->baseFetchRow();	×
39	$num = $myrow[0];	×
40	$result->baseFreeRows();	×
41
42	return $num;	×
43	}
44
45	function EventCnt( $db, $join = '', $where = '' ){
46	if ( $join == "" && $where == "" )	×
47	$result = $db->baseExecute("SELECT count(*) FROM acid_event");	×
48	else
49	$result = $db->baseExecute("SELECT COUNT(acid_event.sid) FROM acid_event $join $where");	×
50
51	$myrow = $result->baseFetchRow();	×
52	$num = $myrow[0];	×
53	$result->baseFreeRows();	×
54
55	return $num;	×
56	}
57
58	// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
59	// Returns: The number of unique alert descriptions for the given sensor ID.
60	function UniqueCntBySensor( $sensorID, $db ){
61	// Calculate the Unique Alerts.
62	$query = "SELECT COUNT(DISTINCT signature) FROM acid_event WHERE sid = '" . $sensorID . "'";	×
63	$result = $db->baseExecute($query);	×
64
65	if ( $result )
66	{
67	$row = $result->baseFetchRow();	×
68	$num = $row[0];	×
69	$result->baseFreeRows();	×
70	}
71	else
72	$num = 0;	×
73
74	return $num;	×
75	}
76
77	// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
78	// Returns: The total number of alerts for the given sensor ID.
79	function EventCntBySensor( $sensorID, $db ){
80	$query = "SELECT count(*) FROM acid_event where sid = '" .$sensorID. "'";	×
81
82	$result = $db->baseExecute($query);	×
83	$myrow = $result->baseFetchRow();	×
84	$num = $myrow[0];	×
85	$result->baseFreeRows();	×
86
87	return $num;	×
88	}
89
90	function MinDateBySensor( $sensorID, $db ){
91	$query = "SELECT min(timestamp) FROM acid_event WHERE sid= '". $sensorID."'";	×
92
93	$result = $db->baseExecute($query);	×
94	$myrow = $result->baseFetchRow();	×
95	$num = $myrow[0];	×
96	$result->baseFreeRows();	×
97
98	return $num;	×
99	}
100
101	function MaxDateBySensor( $sensorID, $db ){
102	$query = "SELECT max(timestamp) FROM acid_event WHERE sid='".$sensorID."'";	×
103
104	$result = $db->baseExecute($query);	×
105	$myrow = $result->baseFetchRow();	×
106	$num = $myrow[0];	×
107	$result->baseFreeRows();	×
108
109	return $num;	×
110	}
111
112	function UniqueDestAddrCntBySensor( $sensorID, $db ){
113	$query = "SELECT COUNT(DISTINCT ip_dst) from acid_event WHERE sid='" . $sensorID . "'";	×
114
115	$result = $db->baseExecute($query);	×
116	$row = $result->baseFetchRow();	×
117	$num = $row[0];	×
118	$result->baseFreeRows();	×
119
120	return $num;	×
121	}
122
123	function UniqueSrcAddrCntBySensor( $sensorID, $db ){
124	$query = "SELECT COUNT(DISTINCT ip_src) from acid_event WHERE sid='" . $sensorID . "'";	×
125
126	$result = $db->baseExecute($query);	×
127	$row = $result->baseFetchRow();	×
128	$num = $row[0];	×
129	$result->baseFreeRows();	×
130
131	return $num;	×
132	}
133
134	function TCPPktCnt( $db ){
135	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=6");	×
136	$myrow = $result->baseFetchRow();	×
137	$num = $myrow[0];	×
138	$result->baseFreeRows();	×
139
140	return $num;	×
141	}
142
143	function UDPPktCnt( $db ){
144	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=17");	×
145	$myrow = $result->baseFetchRow();	×
146	$num = $myrow[0];	×
147	$result->baseFreeRows();	×
148
149	return $num;	×
150	}
151
152	function ICMPPktCnt( $db ){
153	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=1");	×
154	$myrow = $result->baseFetchRow();	×
155	$num = $myrow[0];	×
156	$result->baseFreeRows();	×
157
158	return $num;	×
159	}
160
161	function PortscanPktCnt( $db ){
162	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=255");	×
163	$myrow = $result->baseFetchRow();	×
164	$num = $myrow[0];	×
165	$result->baseFreeRows();	×
166
167	return $num;	×
168	}
169
170	function UniqueSrcIPCnt( $db, $join = '', $where = '' ){
171	if ( $join == "" && $where == "" )	×
172	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event");	×
173	else
174	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event $join WHERE $where"); //.	×
175	//"WHERE acid_event.sid > 0 $where");
176
177	$row = $result->baseFetchRow();	×
178	$num = $row[0];	×
179	$result->baseFreeRows();	×
180
181	return $num;	×
182	}
183
184	function UniqueDstIPCnt( $db, $join = '', $where = '' ){
185	if ( $join == "" && $where == "" )	×
186	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event");	×
187	else
188	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join WHERE $where"); //.	×
189	//"WHERE acid_event.sid > 0 $where");
190
191	$row = $result->baseFetchRow();	×
192	$num = $row[0];	×
193	$result->baseFreeRows();	×
194
195	return $num;	×
196	}
197
198	function UniqueIPCnt( $db, $join = '', $where = '' ){
199	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src), ".	×
200	"COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join $where");	×
201
202	$row = $result->baseFetchRow();	×
203	$num1 = $row[0];	×
204	$num2 = $row[1];	×
205	$result->baseFreeRows();	×
206
207	return array($num1, $num2);	×
208	}
209
210	function StartStopTime( &$start_time, &$stop_time, $db ){
211	$result = $db->baseExecute("SELECT (SELECT timestamp FROM acid_event ORDER BY timestamp ASC LIMIT 1), ".	×
212	"(SELECT timestamp FROM acid_event ORDER BY timestamp DESC LIMIT 1)");
213	$myrow = $result->baseFetchRow();	×
214	$start_time = $myrow[0];	×
215	$stop_time = $myrow[1];	×
216	$result->baseFreeRows();	×
217	}
218
219	function UniqueAlertCnt($db, $join = '', $where = '' ){
220	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.signature) FROM acid_event $join ".	×
221	"$where");	×
222
223	$row = $result->baseFetchRow();	×
224	$num = $row[0];	×
225	$result->baseFreeRows();	×
226
227	return $num;	×
228	}
229
230	function UniquePortCnt( $db, $join = '', $where = '' ){
231	if ( $join == "" && $where == "")	×
232	$result = $db->baseExecute("SELECT COUNT(DISTINCT layer4_sport), ".	×
233	"COUNT(DISTINCT layer4_dport) FROM acid_event");
234	else
235	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
236	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join ".	×
237	"$where");	×
238
239	$row = $result->baseFetchRow();	×
240	$result->baseFreeRows();	×
241
242	return array($row[0], $row[1]);	×
243	}
244
245	function UniqueTCPPortCnt( $db, $join = '', $where = '' ){
246	if ( $join == "" && $where == "")	×
247	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
248	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
249	"WHERE ip_proto='".TCP."'");
250	else
251	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
252	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".	×
253	" $where AND ip_proto='".TCP."'");	×
254
255	$row = $result->baseFetchRow();	×
256	$result->baseFreeRows();	×
257
258	return array($row[0], $row[1]);	×
259	}
260
261	function UniqueUDPPortCnt( $db, $join = '', $where = '' ){
262	if ( $join == "" && $where == "")	×
263	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
264	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
265	"WHERE ip_proto='".UDP."'");
266	else
267	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
268	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".	×
269	" $where AND ip_proto='".UDP."'");	×
270
271	$row = $result->baseFetchRow();	×
272	$result->baseFreeRows();	×
273
274	return array($row[0], $row[1]);	×
275	}
276
277	function UniqueLinkCnt( $db, $join = '', $where = '' ){
278	if (!stristr($where, "WHERE") && $where != "")	×
279	$where = " WHERE $where ";	×
280
281	if ( $db->DB_type == "mysql" )	×
282	{
283	if ( $join == "" && $where == "")	×
284	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event");	×
285	else
286	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event $join $where");	×
287
288	$row = $result->baseFetchRow();	×
289	$result->baseFreeRows();	×
290	}
291	else
292	{
293	if ( $join == "" && $where == "")	×
294	$result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event");	×
295	else
296	$result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event $join $where");	×
297
298	$row[0] = $result->baseRecordCount();	×
299	$result->baseFreeRows();	×
300	}
301
302	return $row[0];	×
303	}
304
305	function PrintGeneralStats(
306	$db, $compact, $show_stats, $join = '', $where = '',
307	$show_total_events = false
308	){
309	GLOBAL $et;
310	if ( $show_stats == 1 ){	×
311	$sensor_cnt = SensorCnt($db, $join, $where);	×
312	$sensor_total = SensorTotal($db);	×
313	$unique_alert_cnt = UniqueAlertCnt($db, $join, $where);	×
314	$event_cnt = EventCnt($db, $join, $where);	×
315	$unique_ip_cnt = UniqueIPCnt($db, $join, $where);	×
316	$unique_links_cnt = UniqueLinkCnt($db, $join, $where);	×
317	$unique_port_cnt = UniquePortCnt($db, $join, $where);	×
318	$unique_tcp_port_cnt = UniqueTCPPortCnt($db, $join, $where);	×
319	$unique_udp_port_cnt = UniqueUDPPortCnt($db, $join, $where);	×
320	}
321	if ( $db->baseGetDBversion() >= 103 ){	×
322	// mstone 20050309 this is an expensive calculation.
323	// Only do it if we're going to use it.
324	if ($show_stats == 1) {	×
325	$result = $db->baseExecute("SELECT count(DISTINCT(sig_class_id)) FROM acid_event");	×
326	$myrow = $result->baseFetchRow();	×
327	$class_cnt = $myrow[0];	×
328	$result->baseFreeRows();	×
329	}
330
331	$class_cnt_info[0] = " <strong>"._SCCATEGORIES." </strong>";	×
332	$class_cnt_info[1] = "<a href=\"base_stat_class.php?sort_order=class_a\">";	×
333	$class_cnt_info[2] = "</a>";	×
334	}
335
336	$sensor_cnt_info[0] = "<strong>"._SCSENSORTOTAL."</strong>\n";	×
337	$sensor_cnt_info[1] = "<a href=\"base_stat_sensor.php\">";	×
338	$sensor_cnt_info[2] = "</a> / ";	×
339
340	$unique_alert_cnt_info[0] = "<strong>"._UNIALERTS.":</strong>\n";	×
341	$unique_alert_cnt_info[1] = "<a href=\"base_stat_alerts.php\">";	×
342	$unique_alert_cnt_info[2] = "</a>";	×
343
344	$event_cnt_info[0] = "<strong>"._SCTOTALNUMALERTS."</strong>\n";	×
345	$event_cnt_info[1] = '<a href="base_qry_main.php?&num_result_rows=-1'.	×
346	'&submit='._QUERYDBP.'&current_view=-1">';
347	$event_cnt_info[2] = "</a>";	×
348
349	$unique_src_ip_cnt_info[0] = _SCSRCIP;	×
350	$unique_src_ip_cnt_info[1] = " ".BuildUniqueAddressLink(1);	×
351	$unique_src_ip_cnt_info[2] = "</a>";	×
352	$unique_dst_ip_cnt_info[0] = _SCDSTIP;	×
353	$unique_dst_ip_cnt_info[1] = " ".BuildUniqueAddressLink(2);	×
354	$unique_dst_ip_cnt_info[2] = "</a>";	×
355
356	$unique_links_info[0] = _SCUNILINKS;	×
357	$unique_links_info[1] = " <a href=\"base_stat_iplink.php\">";	×
358	$unique_links_info[2] = "</a>";	×
359
360	$unique_src_port_cnt_info[0] = _SCSRCPORTS;	×
361	$unique_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&proto=-1\">";	×
362	$unique_src_port_cnt_info[2] = "</a>";	×
363	$unique_dst_port_cnt_info[0] = _SCDSTPORTS;	×
364	$unique_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&proto=-1\">";	×
365	$unique_dst_port_cnt_info[2] = "</a>";	×
366
367	$unique_tcp_src_port_cnt_info[0] = "TCP (";	×
368	$unique_tcp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&proto=".TCP."\">";	×
369	$unique_tcp_src_port_cnt_info[2] = "</a>)";	×
370	$unique_tcp_dst_port_cnt_info[0] = "TCP (";	×
371	$unique_tcp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&proto=".TCP."\">";	×
372	$unique_tcp_dst_port_cnt_info[2] = "</a>)";	×
373
374	$unique_udp_src_port_cnt_info[0] = "UDP (";	×
375	$unique_udp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&proto=".UDP."\">";	×
376	$unique_udp_src_port_cnt_info[2] = "</a>)";	×
377	$unique_udp_dst_port_cnt_info[0] = "UDP (";	×
378	$unique_udp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&proto=".UDP."\">";	×
379	$unique_udp_dst_port_cnt_info[2] = "</a>)";	×
380
381	// Begin page output.
382	if ( $show_stats == 1 ){	×
383	echo $sensor_cnt_info[0].	×
384	$sensor_cnt_info[1].	×
385	$sensor_cnt.
386	$sensor_cnt_info[2].	×
387	$sensor_total;
388	NLIO('<br/>');	×
389	echo $unique_alert_cnt_info[0].	×
390	$unique_alert_cnt_info[1].	×
391	$unique_alert_cnt.
392	$unique_alert_cnt_info[2];	×
393	NLIO('<br/>');	×
394	if ( $db->baseGetDBversion() >= 103 ){	×
395	print $class_cnt_info[0] . $class_cnt_info[1] . $class_cnt	×
396	. $class_cnt_info[2];	×
397	NLIO('<br/>');	×
398	}
399
400	echo $event_cnt_info[0].	×
401	$event_cnt_info[1].	×
402	$event_cnt.
403	$event_cnt_info[2];	×
404	NLIO("<ul class='stats'>",2);	×
405	NLIO('<li>');	×
406	print $unique_src_ip_cnt_info[0] . $unique_src_ip_cnt_info[1]	×
407	. $unique_ip_cnt[0] . $unique_src_ip_cnt_info[2];	×
408	PrintLINext();	×
409	print $unique_dst_ip_cnt_info[0] . $unique_dst_ip_cnt_info[1]	×
410	. $unique_ip_cnt[1] . $unique_dst_ip_cnt_info[2];	×
411	PrintLINext();	×
412	print $unique_links_info[0] . $unique_links_info[1]	×
413	. $unique_links_cnt . $unique_links_info[2];	×
414	if ( $compact == 0 ){	×
415	NLIO('</li></ul>');	×
416	NLIO("<ul class='stats'><li>");	×
417	}else{
418	PrintLINext();	×
419	}
420	print $unique_src_port_cnt_info[0] . $unique_src_port_cnt_info[1]	×
421	. $unique_port_cnt[0] . $unique_src_port_cnt_info[2];	×
422	if ( $compact == 0 ){	×
423	NLIO("<ul class='stats'><li>");	×
424	}else{
425	PrintLINext();	×
426	echo "  --  ";	×
427	}
428	echo $unique_tcp_src_port_cnt_info[0].	×
429	$unique_tcp_src_port_cnt_info[1].	×
430	$unique_tcp_port_cnt[0].	×
431	$unique_tcp_src_port_cnt_info[2].	×
432	"  ".
433	$unique_udp_src_port_cnt_info[0].	×
434	$unique_udp_src_port_cnt_info[1].	×
435	$unique_udp_port_cnt[0].	×
436	$unique_udp_src_port_cnt_info[2];	×
437	if ( $compact == 0 ){	×
438	NLIO('</li></ul>',4);	×
439	}
440	PrintLINext();	×
441	print $unique_dst_port_cnt_info[0] . $unique_dst_port_cnt_info[1]	×
442	. $unique_port_cnt[1] . $unique_dst_port_cnt_info[2];	×
443	if ( $compact == 0 ){	×
444	NLIO("<ul class='stats'><li>");	×
445	}else{
446	PrintLINext();	×
447	echo "  --  ";	×
448	}
449	echo $unique_tcp_dst_port_cnt_info[0].	×
450	$unique_tcp_dst_port_cnt_info[1].	×
451	$unique_tcp_port_cnt[1].	×
452	$unique_tcp_dst_port_cnt_info[2].	×
453	"  ".
454	$unique_udp_dst_port_cnt_info[0].	×
455	$unique_udp_dst_port_cnt_info[1].	×
456	$unique_udp_port_cnt[1].	×
457	$unique_udp_dst_port_cnt_info[2];	×
458	if ( $compact == 0 ){	×
459	NLIO('</li></ul>',4);	×
460	}
461	NLIO('</li></ul>');	×
462	}else{
463	if ( $show_total_events ){	×
464	$event_cnt = EventCnt($db, $join, $where);	×
465	NLIO("<ul class='stats'><li>");	×
466	print $event_cnt_info[0] . $event_cnt_info[1] . $event_cnt	×
467	. $event_cnt_info[2];	×
468	NLIO('</li></ul>');	×
469	}
470	NLIO("<ul class='stats'><li>");	×
471	echo $sensor_cnt_info[1]._SCSENSORS.'</a>';	×
472	PrintLINext();	×
473	print $unique_alert_cnt_info[1] . _UNIALERTS	×
474	. $unique_alert_cnt_info[2];	×
475	PrintLINext();	×
476	if ( $db->baseGetDBversion() >= 103 ){	×
477	print '   ( ' . $class_cnt_info[1]	×
478	. _SCCLASS.'</a> )';
479	}
480	PrintLINext();	×
481	print _SCUNIADDRESS
482	. $unique_src_ip_cnt_info[1] . _SCSOURCE . ' \| '	×
483	. $unique_src_ip_cnt_info[2] . $unique_dst_ip_cnt_info[1] . _SCDEST	×
484	. $unique_dst_ip_cnt_info[2];	×
485	PrintLINext();	×
486	print $unique_links_info[1] . $unique_links_info[0]	×
487	. $unique_links_info[2];	×
488	PrintLINext();	×
489	print $unique_src_port_cnt_info[1] . _SCSOURCE . " "	×
490	. $unique_src_port_cnt_info[2] . _SCPORT . ": "	×
491	. $unique_tcp_src_port_cnt_info[1]." TCP</a> \| "	×
492	. $unique_udp_src_port_cnt_info[1]." UDP</a>";	×
493	PrintLINext();	×
494	print $unique_dst_port_cnt_info[1] . _SCDEST . " "	×
495	. $unique_dst_port_cnt_info[2] . _SCPORT . ": "	×
496	. $unique_tcp_dst_port_cnt_info[1] . " TCP</a> \| "	×
497	. $unique_udp_dst_port_cnt_info[1] . " UDP</a>";	×
498	NLIO('</li></ul>');	×
499	}
500	if ( isset($et) && is_object($et) ){	×
501	$et->Mark("Output Stats");	×
502	}
503	}
504	?>

NathanGibbs3 / BASE / 590

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous