<?php
/*
** Copyright (C) 2004 Kevin Johnson
** Copyright (C) 2000 Carnegie Mellon University
**
** Author: Kevin Johnson <kjohnson@secureideas.net>
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License as published by
** the Free Software Foundation; either version 2 of the License, or
** (at your option) any later version.
**
** This program is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
** GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
** along with this program; if not, write to the Free Software
** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/

/*  
 * Basic Analysis and Security Engine (BASE) by Kevin Johnson
 * based upon Analysis Console for Incident Databases (ACID) by Roman Danyliw
 *
 * See http://sourceforge.net/projects/secureideas for the most up to date 
 * information and documentation about this application.
 *
 * Purpose:
 *
 *   BASE is an PHP-based analysis engine to search and process 
 *   a database of security incidents generated by the NIDS Snort.
 *
 * Configuration:
 *
 *   See the 'docs/README' file, and 'base_conf.php'
 *
 */

  $start = time();

   include("base_conf.php");
   include_once("$BASE_path/includes/base_auth.inc.php");
   include_once("$BASE_path/includes/base_db.inc.php");
   include_once("$BASE_path/includes/base_output_html.inc.php");
   include_once("$BASE_path/base_common.php");
   include_once("$BASE_path/base_db_common.php");
   include_once("$BASE_path/includes/base_cache.inc.php");
   include_once("$BASE_path/includes/base_state_criteria.inc.php");
   include_once("$BASE_path/includes/base_log_error.inc.php");
   include_once("$BASE_path/includes/base_log_timing.inc.php");

  RegisterGlobalState();
  //InitGlobalState();

  /* Initialize the history */
  $HTTP_SESSION_VARS = NULL;
  InitArray($HTTP_SESSION_VARS['back_list'], 1, 3, "");
  $HTTP_SESSION_VARS['back_list_cnt'] = 0;

  PushHistory();
  
   // Check role out and redirect if needed -- Kevin
  $roleneeded = 10000;
  $BUser = new BaseUser();
  if (($BUser->hasRole($roleneeded) == 0) && ($Use_Auth_System == 1))
  {
    header("Location: ". $BASE_urlpath . "/index.php");
  }
  
?>

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<!-- <?php echo(_TITLE . $BASE_VERSION); ?> -->
<HTML>

<HEAD>
   <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1" />
  <META HTTP-EQUIV="pragma" CONTENT="no-cache">
  <?php
    PrintFreshPage($refresh_stat_page, $stat_page_refresh_time);
  ?>
  <TITLE><?php echo(_TITLE . $BASE_VERSION); ?></TITLE>

  <LINK rel="stylesheet" type="text/css" HREF="styles/base_style.css">

</HEAD>

<BODY>

   <div class="mainheadertitle">&nbsp;<?php echo(_TITLE); ?></div>
<?php

  if ( $debug_mode == 1 )
     PrintPageHeader();

  /* Check that PHP was built correctly */
  $tmp_str = verify_php_build($DBtype);
  if ( $tmp_str != "")
  {
     echo $tmp_str;
     die();
  }

  /* Connect to the Alert database */
  $db = NewBASEDBConnection($DBlib_path, $DBtype);
  $db->baseDBConnect($db_connect_method,
                     $alert_dbname, $alert_host, $alert_port, $alert_user, $alert_password);

  /* Check that the DB schema is recent */
  $tmp_str = verify_db($db, $alert_dbname, $alert_host);
  if ( $tmp_str != "")
  {
     echo $tmp_str;
     die();
  }
?>
<table width="100%" border=0 cellpadding=0 cellspacing=0><tr><td align="left" rowspan=2>
      <?php
         // Various things for the snapshot functiuonality on the first page.... Kevin
         $tmp_month = date("m");
         $tmp_day = date("d");
         $tmp_year = date("Y");
         $today = '&time%5B0%5D%5B0%5D=+&time%5B0%5D%5B1%5D=%3D'.
                  '&time%5B0%5D%5B2%5D='.$tmp_month.
                  '&time%5B0%5D%5B3%5D='.$tmp_day.
                  '&time%5B0%5D%5B4%5D='.$tmp_year.
                  '&time%5B0%5D%5B5%5D=&time%5B0%5D%5B6%5D=&time%5B0%5D%5B7%5D='.
                  '&time%5B0%5D%5B8%5D=+&time%5B0%5D%5B9%5D=+';
      
         $yesterday_year = date("Y", time()-86400);
         $yesterday_month = date("m", time()-86400);
         $yesterday_day = date ("d", time()-86400);
         $yesterday_hour = date ("H", time()-86400);
         $yesterday =  '&time%5B0%5D%5B0%5D=+&time%5B0%5D%5B1%5D=%3E%3D'.
                       '&time%5B0%5D%5B2%5D='.$yesterday_month.
                       '&time%5B0%5D%5B3%5D='.$yesterday_day.
                       '&time%5B0%5D%5B4%5D='.$yesterday_year.
                       '&time%5B0%5D%5B5%5D='.$yesterday_hour.
                       '&time%5B0%5D%5B6%5D=&time%5B0%5D%5B7%5D='.
                       '&time%5B0%5D%5B8%5D=+&time%5B0%5D%5B9%5D=+';
      
         $last72_year = date("Y", time()-86400*3);
         $last72_month = date("m", time()-86400*3);
         $last72_day = date ("d", time()-86400*3);
         $last72_hour = date ("H", time()-86400*3);
         $last72 = '&time%5B0%5D%5B0%5D=+&time%5B0%5D%5B1%5D=%3E%3D'.
                   '&time%5B0%5D%5B2%5D='.$last72_month.
                   '&time%5B0%5D%5B3%5D='.$last72_day.
                   '&time%5B0%5D%5B4%5D='.$last72_year.
                   '&time%5B0%5D%5B5%5D='.$last72_hour.
                   '&time%5B0%5D%5B6%5D=&time%5B0%5D%5B7%5D='.
                   '&time%5B0%5D%5B8%5D=+&time%5B0%5D%5B9%5D=+';
      
         $tmp_24hour = 'base_qry_main.php?new=1'.$yesterday.'&submit=Query+DB&num_result_rows=-1&time_cnt=1';
         $tmp_24hour_unique = 'base_stat_alerts.php?time_cnt=1'.$yesterday;
         $tmp_24hour_sip = 'base_stat_uaddr.php?addr_type=1&sort_order=occur_d&time_cnt=1'.$yesterday;
         $tmp_24hour_dip = 'base_stat_uaddr.php?addr_type=2&sort_order=occur_d&time_cnt=1'.$yesterday;
      
         $tmp_72hour = 'base_qry_main.php?new=1'.$last72.'&submit=Query+DB&num_result_rows=-1&time_cnt=1';
         $tmp_72hour_unique = 'base_stat_alerts.php?time_cnt=1'.$last72;
         $tmp_72hour_sip = 'base_stat_uaddr.php?addr_type=1&sort_order=occur_d&time_cnt=1'.$last72;
         $tmp_72hour_dip = 'base_stat_uaddr.php?addr_type=2&sort_order=occur_d&time_cnt=1'.$last72;
      
         $tmp_today = 'base_qry_main.php?new=1'.$today.'&submit=Query+DB&num_result_rows=-1&time_cnt=1';
         $tmp_today_unique = 'base_stat_alerts.php?time_cnt=1'.$today;
         $tmp_sip = 'base_stat_uaddr.php?addr_type=1&sort_order=occur_d&time_cnt=1'.$today;
         $tmp_dip = 'base_stat_uaddr.php?addr_type=2&sort_order=occur_d&time_cnt=1'.$today;
      
        echo '
        <TABLE WIDTH="100%" BORDER=0>
        <TR>
        <TD VALIGN=TOP>
        <LI>' . _MOSTRECENT . $last_num_alerts . _ALERTS .'
            <A HREF="base_qry_main.php?new=1&caller=last_any&num_result_rows=-1&submit=Last%20Any">' . _ANYPROTO . '</A>,  
            <A HREF="base_qry_main.php?new=1&layer4=TCP&caller=last_tcp&num_result_rows=-1&submit=Last%20TCP">TCP</A>,
            <A HREF="base_qry_main.php?new=1&layer4=UDP&caller=last_udp&num_result_rows=-1&submit=Last%20UDP">UDP</A>,
            <A HREF="base_qry_main.php?new=1&layer4=ICMP&caller=last_icmp&num_result_rows=-1&submit=Last%20ICMP">ICMP</A>
      
        <LI>'. _TALERTS .'<A HREF="'.$tmp_today_unique.'">'. _UNI .'</A>, 
                      <A HREF="'.$tmp_today.'">'. _LISTING .'</A>;
                      IP <A HREF="'.$tmp_sip.'">src</A> / <A HREF="'.$tmp_dip.'">dst</A>
        <LI>'. _L24ALERTS .'<A HREF="'.$tmp_24hour_unique.'">'. _UNI .'</A>,
                      <A HREF="'.$tmp_24hour.'">'. _LISTING .'</A>;
                      IP <A HREF="'.$tmp_24hour_sip.'">src</A> / <A HREF="'.$tmp_24hour_dip.'">dst</A>
      
        <LI>'. _L72ALERTS .'<A HREF="'.$tmp_72hour_unique.'">'._UNI.'</A>,
                      <A HREF="'.$tmp_72hour.'">'. _LISTING .'</A>;
                      IP <A HREF="'.$tmp_72hour_sip.'">src</A> / <A HREF="'.$tmp_72hour_dip.'">dst</A>';
      ?>
        <LI><A HREF="base_stat_alerts.php?caller=last_alerts&sort_order=last_d"><?php echo(_MOSTRECENT . $last_num_ualerts . _UNIALERTS); ?></A>
        <LI><?php echo _LSOURCEPORTS;?>
            <A HREF="base_stat_ports.php?caller=last_ports&port_type=1&proto=-1&sort_order=last_d">
            <?php echo _ANYPROTO; ?>
            </A>,
            <A HREF="base_stat_ports.php?caller=last_ports&port_type=1&proto=6&sort_order=last_d">
            TCP
            </A>,
            <A HREF="base_stat_ports.php?caller=last_ports&port_type=1&proto=17&sort_order=last_d">
            UDP
            </A>
      
        <LI><?php echo _LDESTPORTS; ?>
            <A HREF="base_stat_ports.php?caller=last_ports&port_type=2&proto=-1&sort_order=last_d">
            <?php echo _ANYPROTO; ?>
            </A>,
            <A HREF="base_stat_ports.php?caller=last_ports&port_type=2&proto=6&sort_order=last_d">
            TCP
            </A>,
            <A HREF="base_stat_ports.php?caller=last_ports&port_type=2&proto=17&sort_order=last_d">
            UDP
            </A>
        <LI><A HREF="base_stat_alerts.php?caller=most_frequent&sort_order=occur_d"><?php echo(_MOSTFREQUENT . $freq_num_alerts . " " ._UNIALERTS); ?></A>
        <LI><?php echo _FREGSOURCEP; ?>
            <A HREF="base_stat_ports.php?caller=most_frequent&port_type=1&proto=-1&sort_order=occur_d">
            <?php echo _ANYPROTO; ?>
            </A>,
            <A HREF="base_stat_ports.php?caller=most_frequent&port_type=1&proto=6&sort_order=occur_d">
            TCP
            </A>,
            <A HREF="base_stat_ports.php?caller=most_frequent&port_type=1&proto=17&sort_order=occur_d">
            UDP
            </A>
      
        <LI><?php echo _FREGDESTP; ?>
            <A HREF="base_stat_ports.php?caller=most_frequent&port_type=2&proto=-1&sort_order=occur_d">
            <?php echo _ANYPROTO; ?>
            </A>,
            <A HREF="base_stat_ports.php?caller=most_frequent&port_type=2&proto=6&sort_order=occur_d">
            TCP
            </A>,
            <A HREF="base_stat_ports.php?caller=most_frequent&port_type=2&proto=17&sort_order=occur_d">
            UDP
            </A>
        <LI><?php echo(_MOSTFREQUENT . $freq_num_uaddr . " " ._ADDRESS.":"); ?>
            <A HREF="base_stat_uaddr.php?caller=most_frequent&addr_type=1&sort_order=occur_d"><?php echo _SOURCE; ?></A>, 
            <A HREF="base_stat_uaddr.php?caller=most_frequent&addr_type=2&sort_order=occur_d"><?php echo _DEST; ?></A>
        </TD>
        <TD></TD>
        </TR>
        </TABLE>


      </td><td align="right" valign="top"><div class="systemstats">
      <?php
        if ( $event_cache_auto_update == 1 )  UpdateAlertCache($db);
      
        printf("<B>"._QUERIED." </B><FONT> : %s<BR>",date("D F d, Y H:i:s",time()));
        printf("<B>"._DATABASE."</B> %s &nbsp;&nbsp;&nbsp;(<B>"._SCHEMAV."</B> %d) \n<BR>\n", 
               ($alert_dbname.'@'.$alert_host. ($alert_port != "" ? ':'.$alert_port : "") ),
               $db->baseGetDBversion() );
        StartStopTime($start_time, $end_time, $db);
        if ( $start_time != "" )
           printf("<B>"._TIMEWIN."</B> [%s] - [%s]\n<P>\n", $start_time, $end_time);
        else
           printf("<B>"._TIMEWIN."</B> <I>"._NOALERTS."</I>\n");
      ?>
</div></td></tr>
<tr><td align="center" valign="top">
<B><A HREF="base_qry_main.php?new=1"><?php echo _SEARCH; ?></A></B><br>
<B><A HREF="base_graph_main.php"><?php echo _GALERTD; ?></A></B><br>
<A HREF="base_stat_time.php"><?php echo _GALERTDT; ?></A> </td></tr></table>
<hr>
<?php
  echo '<TABLE BORDER=0 WIDTH="100%">
        <TR>
           <TD WIDTH="30%" VALIGN=TOP>';

  PrintGeneralStats($db, 0, $main_page_detail, "", "", true);

  echo '   </TD>
           <TD WIDTH="70%" VALIGN=TOP>
             <B>Traffic Profile by Protocol</B>';
             PrintProtocolProfileGraphs($db);

  echo '   </TD>
        </TR>
        </TABLE>';
?>

<P>
</UL>
<hr>
     <?php
      include("$BASE_path/base_footer.php");
      
      $stop = time();
      if ( $debug_time_mode > 0 )
        echo "<div class='systemdebug'>[Loaded in ".($stop-$start)." seconds]</div>";
      ?>
</BODY>

</HTML>





