• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

NathanGibbs3 / BASE / 627

pending completion
627

push

travis-ci-com

NathanGibbs3
Merge branch 'documentation' into devel

1766 of 6437 relevant lines covered (27.44%)

105.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/base_stat_uaddr.php
1
<?php
2
/*******************************************************************************
3
** Basic Analysis and Security Engine (BASE)
4
** Copyright (C) 2004 BASE Project Team
5
** Copyright (C) 2000 Carnegie Mellon University
6
**
7
** (see the file 'base_main.php' for license details)
8
**
9
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10
**                Sean Muller <samwise_diver@users.sourceforge.net>
11
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12
**
13
** Purpose: Displays statistics on the detected source and
14
**          destination IP addresses   
15
**
16
** Input GET/POST variables
17
**   - addr_type: sets the type of address on which stats will
18
**                be generated
19
**          = 1: source address
20
**          = 2: destination address
21
**   - caller: specifies the canned snapshot to run
22
**          = most_frequent: Most frequent IP address
23
**   - submit:
24
**   - limit_start:
25
********************************************************************************
26
** Authors:
27
********************************************************************************
28
** Kevin Johnson <kjohnson@secureideas.net
29
**
30
********************************************************************************
31
*/
32

33
$sc = DIRECTORY_SEPARATOR;
×
34
require_once("includes$sc" . 'base_krnl.php');
×
35
include_once("$BASE_path/includes/base_include.inc.php");
×
36
include_once("$BASE_path/base_db_common.php");
×
37
include_once("$BASE_path/base_qry_common.php");
×
38

39
AuthorizedRole(10000);
×
40
$db = NewBASEDBConnection($DBlib_path, $DBtype); // Connect to Alert DB.
×
41
$db->baseDBConnect(
×
42
        $db_connect_method, $alert_dbname, $alert_host, $alert_port, $alert_user,
43
        $alert_password
44
);
45
UpdateAlertCache($db);
×
46
if ( class_exists('UILang') ){ // Issue 11 backport shim.
×
47
        $CPSensor = $UIL->CWA['Sensor'];
×
48
        $CPTotal = $UIL->CWA['Total'];
×
49
}else{
×
50
        $CPSensor = _SENSOR;
×
51
        $CPTotal = _TOTAL;
×
52
}
53
$addr_type = ImportHTTPVar('addr_type', VAR_DIGIT);
×
54
$submit = ImportHTTPVar('submit', VAR_ALPHA | VAR_SPACE, array(_SELECTED, _ALLONSCREEN, _ENTIREQUERY));
×
55
$sort_order = ImportHTTPVar('sort_order', VAR_LETTER | VAR_USCORE);
×
56
$caller = ImportHTTPVar('caller', VAR_LETTER | VAR_USCORE);
×
57
$action = ImportHTTPVar('action', VAR_ALPHA);
×
58
$cs = new CriteriaState("base_stat_uaddr.php", "&amp;addr_type=$addr_type");
×
59
$cs->ReadState();
×
60
if ( $addr_type == SOURCE_IP ){
×
61
        $page_title = _UNISADD;
×
62
        $results_title = _SUASRCIP;
×
63
        $addr_type_name = "ip_src";
×
64
}else{ // Default to Dst.
×
65
        if ( $addr_type != DEST_IP ){
×
66
                ErrorMessage(_SUAERRCRITADDUNK);
×
67
        }
68
        $page_title = _UNIDADD;
×
69
        $results_title = _SUADSTIP;
×
70
        $addr_type_name = "ip_dst";
×
71
}
72
if ( $caller == 'most_frequent' && $sort_order = 'occur_d' ){
×
73
        // Issue(s) #123 Fix
74
        $sort_order = $CPTotal.'_occur_d';
×
75
}
76
$qs = new QueryState();
×
77
if ( $caller == 'most_frequent' ){ // Issue #123 Fix
×
78
        $qs->current_sort_order = $sort_order;
×
79
}
80
$qs->AddCannedQuery(
×
81
        'most_frequent', $freq_num_uaddr, _MOSTFREQADDRS, $CPTotal.'_occur_d'
82
);
83
$qs->MoveView($submit); // Increment the view if necessary.
×
84
$tr = 1; // Page Refresh
×
85
if ( $qs->isCannedQuery() ){
×
86
        $page_title.': '.$qs->GetCurrentCannedQueryDesc();
×
87
}else{
×
88
        if ($action != '' ){
×
89
                $tr = $refresh_all_pages;
×
90
        }
91
}
92
PrintBASESubHeader( $page_title, $page_title, $cs->GetBackLink(), $tr );
×
93
if( $debug_mode > 0 ){ // Dump debugging info on the shared state.
×
94
        PrintCriteriaState();
×
95
}
96
$criteria_clauses = ProcessCriteria();
×
97
PrintCriteria('');
×
98
  $criteria = $criteria_clauses[0]." ".$criteria_clauses[1];
×
99
  $from = " FROM acid_event ".$criteria_clauses[0];
×
100
  $where = " WHERE ".$criteria_clauses[1];
×
101

102
  $qs->AddValidAction("ag_by_id");
×
103
  $qs->AddValidAction("ag_by_name");
×
104
  $qs->AddValidAction("add_new_ag");
×
105
  $qs->AddValidAction("del_alert");
×
106
  $qs->AddValidAction("email_alert");
×
107
  $qs->AddValidAction("email_alert2");
×
108
  $qs->AddValidAction("csv_alert");
×
109
  $qs->AddValidAction("archive_alert");
×
110
  $qs->AddValidAction("archive_alert2");
×
111
  
112
  $qs->AddValidActionOp(_SELECTED);
×
113
  $qs->AddValidActionOp(_ALLONSCREEN);
×
114
  
115
  $qs->SetActionSQL($from.$where);
×
116
  $et->Mark("Initialization");
×
117
  
118
  $qs->RunAction($submit, PAGE_STAT_UADDR, $db);
×
119
  $et->Mark("Alert Action");
×
120

121
  /* Run the query to determine the number of rows (No LIMIT)*/
122
  $cnt_sql = "SELECT count(DISTINCT $addr_type_name) ". $from. $where;
×
123
  $qs->GetNumResultRows($cnt_sql, $db);
×
124
  $et->Mark("Counting Result size");
×
125

126
// Setup the Query Results Table.
127
// Common SQL Strings
128
$OB = ' ORDER BY';
×
129
$qro = new QueryResultsOutput("base_stat_uaddr.php?caller=".$caller."&amp;addr_type=".$addr_type);
×
130
$qro->AddTitle('');
×
131
$qro->AddTitle( $results_title,
×
132
        "addr_a", " ", "$OB $addr_type_name ASC",
×
133
        "addr_d", " ", "$OB $addr_type_name DESC", 'right'
×
134
);
135
if ( $resolve_IP == 1 ){
×
136
        $qro->AddTitle('FQDN');
×
137
}
138
$qro->AddTitle( $CPSensor);
×
139
$qro->AddTitle( $CPTotal,
×
140
        "occur_a", " ", "$OB num_events ASC",
×
141
        "occur_d", " ", "$OB num_events DESC", 'right'
×
142
);
143
$qro->AddTitle( _SUAUNIALERTS,
×
144
        "sig_a", " ", "$OB num_sig ASC",
×
145
        "sig_d", " ", "$OB num_sig DESC", 'right'
×
146
);
147
if ( $addr_type == DEST_IP ){
×
148
        $qro->AddTitle( _SUASRCADD,
×
149
                "saddr_a", " ", "$OB num_sip ASC",
×
150
                "saddr_d", " ", "$OB num_sip DESC"
×
151
        );
152
}else{
×
153
        $qro->AddTitle( _SUADSTADD,
×
154
                "daddr_a", " ", "$OB num_dip ASC",
×
155
                "daddr_d", " ", "$OB num_dip DESC"
×
156
        );
157
}
158

159
// Issue #168
160
$sql = "SELECT DISTINCT $addr_type_name, ".
×
161
                " COUNT(acid_event.cid) as num_events,".
162
                " COUNT( DISTINCT acid_event.sid) as num_sensors, ".
163
                " COUNT( DISTINCT signature ) as num_sig, ";
164
if ( $addr_type == DEST_IP ){
×
165
        $tmp = 'src';
×
166
        $tmp2 = 's';
×
167
}else{
×
168
        $tmp = 'dst';
×
169
        $tmp2 = 'd';
×
170
}
171
$tmp = "ip_$tmp";
×
172
$tmp2 = "num_$tmp2".'ip ';
×
173
$sql .= " COUNT( DISTINCT $tmp ) as $tmp2 ";
×
174
$sqlPFX = $from.$where." GROUP BY $addr_type_name ";
×
175
$sort_sql = $qro->GetSortSQL($qs->GetCurrentSort(), $qs->GetCurrentCannedQuerySort());
×
176
if ( !is_null($sort_sql) ){
×
177
        $sqlPFX = $sort_sql[0].$sqlPFX.$sort_sql[1];
×
178
}
179
$sql .= $sqlPFX;
×
180
// Run the Query again for the actual data (with the LIMIT), if any.
181
$result = $qs->ExecuteOutputQuery($sql, $db);
×
182
$et->Mark("Retrieve Query Data");
×
183
if ( $debug_mode > 0 ){
×
184
        if ( $qs->isCannedQuery() ){
×
185
                $CCF = 'Yes';
×
186
                $qs->PrintCannedQueryList();
×
187
        }else{
×
188
                $CCF = 'No';
×
189
        }
190
        print "Canned Query: $CCF <br/>";
×
191
        $qs->DumpState();
×
192
        print "SQL Executed: $sql <br/>";
×
193
}
194
$qs->PrintResultCnt(); // Print current view number and # of rows.
×
195

196
  echo '<FORM METHOD="post" NAME="PacketForm" ACTION="base_stat_uaddr.php">';
×
197
  
198
  $qro->PrintHeader();
×
199
  
200
   $i = 0;
×
201
   while ( ($myrow = $result->baseFetchRow()) && ($i < $qs->GetDisplayRowCnt()) )
×
202
   {
203
      $currentIP = baseLong2IP($myrow[0]);
×
204
      $num_events = $myrow[1];
×
205
      $num_sensors = $myrow[2];
×
206
      $num_sig = $myrow[3];
×
207
      $num_ip = $myrow[4];
×
208

209
      if ( $myrow[0] == NULL ) $no_ip = true; else $no_ip = false;
×
210

211
        qroPrintEntryHeader($i);
×
212
        // Generating checkbox value. -- nikns
213
        // Fix for Issue #69 https://github.com/NathanGibbs3/BASE/issues/69
214
        if ( $addr_type == SOURCE_IP ){
×
215
                $src_ip = $myrow[0];
×
216
                $dst_ip = '';
×
217
        }else{
×
218
                $src_ip = '';
×
219
                $dst_ip = $myrow[0];
×
220
        }
221
        $tmp_rowid = $src_ip.'_'.$dst_ip;
×
222
        $tmp = "_lst[$i]";
×
223
        qroPrintCheckBox($tmp, $tmp_rowid);
×
224
        $tmp = '';
×
225
        // Check for a NULL IP indicating an event (e.g. portscan) which has no IP.
226
        if ( $no_ip ){
×
227
                $tmp = '<A HREF="'.$BASE_urlpath.'/help/base_app_faq.php#1">'._UNKNOWN;
×
228
        }else{
×
229
                $tmp = BuildAddressLink($currentIP, 32).$currentIP;
×
230
        }
231
        $tmp .= '</a>';
×
232
        qroPrintEntry($tmp,'right');
×
233
        if ( $resolve_IP == 1 ){
×
234
                qroPrintEntry(
×
235
                        baseGetHostByAddr($currentIP, $db, $dns_cache_lifetime), 'right'
×
236
                );
237
        }
238
      /* Print # of Occurances */
239
      $tmp_iplookup = 'base_qry_main.php?new=1'.
×
240
                      '&amp;num_result_rows=-1'.
241
                      '&amp;sort_order='.$sort_order.
242
                      '&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=1';
243
      $tmp_iplookup2 = 'base_stat_alerts.php?new=1'.   
×
244
                       '&amp;num_result_rows=-1'.
245
                       '&amp;sort_order='.$sort_order.
246
                       '&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=1';
247
        if ( $addr_type == 1 ){
×
248
         if ( $no_ip )
×
249
            $url_criteria = BuildSrcIPFormVars(NULL_IP);
×
250
         else
×
251
            $url_criteria = BuildSrcIPFormVars($currentIP);
×
252
        }elseif ( $addr_type == 2 ){
×
253
         if ( $no_ip )
×
254
           $url_criteria = BuildDstIpFormVars(NULL_IP);
×
255
         else 
×
256
           $url_criteria = BuildDstIPFormVars($currentIP);
×
257
        }
258
        qroPrintEntry($num_sensors);
×
259
        qroPrintEntry(
×
260
                '<A HREF="'.$tmp_iplookup.$url_criteria.'">'.$num_events.'</A>','right'
261
        );
262
        qroPrintEntry(
×
263
                '<A HREF="'.$tmp_iplookup2.$url_criteria.'">'.$num_sig.'</A>','right'
264
        );
265
        qroPrintEntry($num_ip);
×
266
        qroPrintEntryFooter();
×
267
      ++$i;
×
268
}
269
$result->baseFreeRows();
×
270

271
$qro->PrintFooter();
×
272
$qs->PrintBrowseButtons();
×
273
$qs->PrintAlertActionButtons();
×
274
$qs->SaveState();
×
275
ExportHTTPVar("addr_type", $addr_type);
×
276
ExportHTTPVar("sort_order", $sort_order);
×
277
NLIO('</form>',2);
×
278
$et->Mark("Get Query Elements");
×
279
PrintBASESubFooter();
×
280
?>
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc