Skip to content

Commit 119d8c6

Browse files
NathanGibbs3NathanGibbs3
committed
20230702 Closes #217 Closes #218 Closes #222 Closes #223
Closes #224 Closes #225 Closes #226 Code Cleanup. File(s): base_ag_main.php : base_local_rules.php : includes/base_krnl.php : includes/base_net.inc.php : includes/base_state_citems.inc.php : includes/base_state_query.inc.php Code Cleanup. File(s): base_common.php Code Cleanup. Issue(s): #222 Function(s): Removed: BuildIPFormVars(), BuildSrcIPFormVars(), & BuildDstIPFormVars(). Function(s): BuildIPFormVar( ip, addr_type, criteria_instance ) Returns HTTP Query String fragment containing IP Address search criteria; or empty string on invalid IP. Note: Curently the NULL_IP constant is also treated as valid foe backward compatibility reasons. This "feature" will be removed in the future, when code depending on NULL_IP being in the HTTP Query String is removed. File(s): base_db_common.php : includes/base_db.inc.php Code Cleanup. Issue(s): #226 File(s): base_maintenance.php : composer.json : includes/base_auth.inc.php : includes/base_capabilities.php Code Cleanup. Issue(s): #225 File(s): base_stat_ipaddr.php Issue(s): #217 Code Cleanup. File(s): base_stat_uaddr.php Issue(s): #223 Code Cleanup. File(s): includes/base_log_error.inc.php Issue(s): #226 Function(s): returnBuildError( Desc, Opt, dll ) Added dll paramater to provide more meaningful error reports for Windows installations. File(s): includes/base_rtl.php Code Cleanup. Bumped RTL Version to 0.0.12 Issue(s): #224 #225 Function(s): BCMi() Returns true if BCMath is installed, false otherwise. : GMPi() Returns true if GMP is installed, false otherwise. : IPv6i() Returns true if RTL can handle IPv6 on this installation. Sets New Constant BASE_RTL_IPv6 accordingly. File(s): includes/base_state_criteria.inc.php Issue(s): #218 Unit Test(s): Covers BuildIPFormVar(), the following in the CriteriaState Class, ReadState().
1 parent 9bfe278 commit 119d8c6

26 files changed

+944
-405
lines changed

‎base_ag_main.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@
102102
$qs->AddValidAction("email_alert");
103103
$qs->AddValidAction("email_alert2");
104104
$qs->AddValidAction("clear_alert");
105-
105+
106106
$qs->AddValidActionOp(_SELECTED);
107107
$qs->AddValidActionOp(_ALLONSCREEN);
108108
$qs->AddValidActionOp(_ENTIREQUERY);

‎base_common.php

Lines changed: 41 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -113,28 +113,45 @@ function PrintProtocolProfileGraphs( $db ){
113113
PrintFramedBoxFooter(0,2);
114114
}
115115

116-
function BuildIPFormVars( $ipaddr ){
117-
return '' .
118-
'&ip_addr%5B0%5D%5B0%5D=+&ip_addr%5B0%5D%5B1%5D=ip_src&ip_addr%5B0%5D%5B2%5D=%3D'.
119-
'&ip_addr%5B0%5D%5B3%5D='.$ipaddr.
120-
'&ip_addr%5B0%5D%5B8%5D=+&ip_addr%5B0%5D%5B9%5D=OR'.
121-
'&ip_addr%5B1%5D%5B0%5D=+&ip_addr%5B1%5D%5B1%5D=ip_dst&ip_addr%5B1%5D%5B2%5D=%3D'.
122-
'&ip_addr%5B1%5D%5B3%5D='.$ipaddr.
123-
'&ip_addr%5B1%5D%5B8%5D=+&ip_addr%5B1%5D%5B9%5D=+';
124-
}
125-
126-
function BuildSrcIPFormVars( $ipaddr ){
127-
return '' .
128-
'&ip_addr%5B0%5D%5B0%5D=+&ip_addr%5B0%5D%5B1%5D=ip_src&ip_addr%5B0%5D%5B2%5D=%3D'.
129-
'&ip_addr%5B0%5D%5B3%5D='.$ipaddr.
130-
'&ip_addr%5B0%5D%5B8%5D=+&ip_addr%5B0%5D%5B9%5D=+';
131-
}
132-
133-
function BuildDstIPFormVars( $ipaddr ){
134-
return '' .
135-
'&ip_addr%5B0%5D%5B0%5D=+&ip_addr%5B0%5D%5B1%5D=ip_dst&ip_addr%5B0%5D%5B2%5D=%3D'.
136-
'&ip_addr%5B0%5D%5B3%5D='.$ipaddr.
137-
'&ip_addr%5B0%5D%5B8%5D=+&ip_addr%5B0%5D%5B9%5D=+';
116+
function BuildIPFormVar( $ip = '', $type = 2, $idx = 0 ){
117+
// Returns HTTP Query String fragment containing IP Address search
118+
// criteria; or empty string on invalid IP.
119+
//
120+
// Note: Curently the NULL_IP constant is also returned as valid foe
121+
// backward compatibility reasons. This "feature" will be removed in the
122+
// future, once we untagle the code that depends on NULL_IP being present
123+
// in the passed param.
124+
$Ret = ''; // Default Return
125+
if( is_ip($ip) || $ip == NULL_IP ){ // NULL_IP = Backwards Compat Hack.
126+
$type = intval($type); // Type Lock this.
127+
$idx = intval($idx); // Type Lock this.
128+
if( $type < 1 || $type > 3 ){ // Input Validation.
129+
$type = 2;
130+
}
131+
if( $idx < 0 || $idx > 1 ){ // Input Validation.
132+
$idx = 0;
133+
}
134+
// Lock to PHP 8.1+ settings.
135+
$Flag = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401;
136+
$FPFX = htmlentities('&' . urlencode("ip_addr[$idx]["), $Flag);
137+
$FSFX = urlencode(']') . '=';
138+
$Pfx = $FPFX . "0$FSFX" . urlencode(' ') . $FPFX . "1$FSFX";
139+
$Mfx = $FPFX . "2$FSFX" . urlencode('=') . $FPFX . "3$FSFX";
140+
$Sfx = $FPFX . "8$FSFX" . urlencode(' ') . $FPFX . "9$FSFX";
141+
if( $type == 1 ){ // Src
142+
$tmp = 'ip_src';
143+
}elseif( $type == 2 ){ // Dst
144+
$tmp = 'ip_dst';
145+
}else{ // Both
146+
$tmp = BuildIPFormVar($ip, 1);
147+
$Ret = substr($tmp, 0, -1) . 'OR' . BuildIPFormVar($ip, 2, 1);
148+
$tmp = '';
149+
}
150+
if( LoadedString($tmp)){
151+
$Ret = "$Pfx$tmp$Mfx" . urlencode($ip) . $Sfx . urlencode(' ');
152+
}
153+
}
154+
return $Ret;
138155
}
139156

140157
function BuildUniqueAddressLink( $addr_type, $raw = '' ){
@@ -150,10 +167,9 @@ function BuildAddressLink( $ipaddr, $netmask ){
150167
. '&amp;netmask=' . $netmask . '">';
151168
}
152169

153-
// Add blank row to given criteria element.
154170
function AddCriteriaFormRow(
155171
&$submit, $submit_value, &$cnt, &$criteria_array, $max
156-
){
172+
){ // Add blank row to given criteria element.
157173
$submit = $submit_value;
158174
++$cnt;
159175
InitArray($criteria_array[$cnt-1], $max, 0, '');
@@ -1059,9 +1075,7 @@ function ChkLib ( $path = '', $LibLoc = '', $LibFile = '' ){
10591075
}else{
10601076
$Msg .= 'not ';
10611077
}
1062-
if( $tmp == 0 ){
1063-
$Msg .= 'file';
1064-
}elseif( $tmp == -1 ){
1078+
if( $tmp == -1 ){
10651079
$Msg .= 'found';
10661080
}elseif( $tmp == -2 ){
10671081
$Msg .= 'readable';

‎base_db_common.php

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -69,32 +69,45 @@ function verify_php_build( $DBtype ){
6969
// On PHP 5.5+, use mysqli ADODB driver & gracefully deprecate the
7070
// mysql, mysqlt & maxsql drivers.
7171
if( $PHPVer[0] > 5 || ( $PHPVer[0] == 5 && $PHPVer[1] > 4) ){
72-
if( !(function_exists('mysqli_connect')) ){
72+
if( !extension_loaded('mysqli') ){
7373
$Ret = returnBuildError('MySQLi', '--with-mysqli');
74-
$Ret .= NLI('Unable to read ALERT DB.<br/>'); // TD This.
7574
}
7675
}else{
7776
if( !(function_exists("mysql_connect")) ){
7877
return _ERRPHPMYSQLSUP;
7978
}
8079
}
81-
}elseif( $DBtype == "postgres" ){
80+
}elseif( $DBtype == 'postgres' ){
8281
if( !(function_exists("pg_connect")) ){
8382
return _ERRPHPPOSTGRESSUP;
8483
}
85-
}elseif( $DBtype == "mssql" ){
86-
if( !(function_exists("mssql_connect")) ){
87-
return _ERRPHPMSSQLSUP;
84+
// @codeCoverageIgnoreStart
85+
}elseif( $DBtype == 'mssql' ){
86+
// On PHP 5.3+, use mssqlnative ADODB driver & gracefully deprecate
87+
// the mssql driver.
88+
if( $PHPVer[0] > 5 || ( $PHPVer[0] == 5 && $PHPVer[1] > 2) ){
89+
if( !extension_loaded('sqlsrv') ){
90+
$Ret = returnBuildError(
91+
'MS SQL Server', '--enable-sqlsrv', 'php_sqlsrv.dll'
92+
);
93+
}
94+
}else{
95+
if( !(function_exists("mssql_connect")) ){
96+
return _ERRPHPMSSQLSUP;
97+
}
8898
}
8999
}elseif( $DBtype == "oci8" ){
90100
if( !(function_exists("ocilogon")) ){
91101
return _ERRPHPORACLESUP;
92102
}
93-
// Additional DB Support would tie in here.
94-
}else{
103+
// @codeCoverageIgnoreEnd
104+
}else{ // Additional DB Support would tie in here.
95105
return '<b>' . _ERRSQLDBTYPE . '</b>: ' . _ERRSQLDBTYPEINFO1
96106
. "'$DBtype'." . _ERRSQLDBTYPEINFO2;
97107
}
108+
if( LoadedString($Ret) ){
109+
$Ret .= NLI('Unable to read ALERT DB.<br/>'); // TD This.
110+
}
98111
return $Ret;
99112
}
100113

‎base_local_rules.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ function search_dir($dir, $sid){
156156
############# main() ##############
157157
AuthorizedRole(10000);
158158
PrintBASESubHeader('Local Rule Lookup');
159-
$tmp = ChkAccess($dir, 'd') > 0
159+
$tmp = ChkAccess($dir, 'd');
160160
if ( $tmp > 1 ){
161161
echo "<H1>sid: $OSid</H1>\n";
162162
if( $debug_mode > 0 ){

‎base_maintenance.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@
153153
);
154154
}
155155
if( $AdminAuth ){ // Issue #146 Fix
156-
$PF_lst = array('Mail', 'GD', 'GMP');
156+
$PF_lst = array('Mail', 'GD', 'GMP', 'BCMath');
157157
foreach( $PF_lst as $val ){
158158
$PF_St[$val] = $BCR->GetCap("PHP_$val");
159159
}

‎base_stat_ipaddr.php

Lines changed: 59 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -229,9 +229,8 @@ function PrintPortscanEvents($db, $ip)
229229
</TABLE>';
230230
}
231231

232-
function PrintEventsByIP($db, $ip)
233-
{
234-
GLOBAL $debug_mode;
232+
function PrintEventsByIP( $db, $ip ){
233+
GLOBAL $debug_mode;
235234

236235
if (!isset($ip))
237236
{
@@ -287,16 +286,16 @@ function PrintEventsByIP($db, $ip)
287286
{
288287
SQLTraceLog(__FILE__ . ":" . __LINE__ . ":" . __FUNCTION__ . ": After BuildSigByID()");
289288
}
290-
$tmp_iplookup = 'base_qry_main.php?new=1'.
291-
'&amp;sig%5B0%5D=%3D&amp;sig%5B1%5D='.(rawurlencode(GetSignatureName($unique_events[$i], $db))).
292-
'&amp;num_result_rows=-1'.
293-
'&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=2'.
294-
BuildIPFormVars($ip);
295-
296-
$tmp_sensor_lookup = 'base_stat_sensor.php?'.
297-
'sig%5B0%5D=%3D&amp;sig%5B1%5D='.
298-
(rawurlencode($unique_events[$i])).
299-
'&amp;ip_addr_cnt=2'.BuildIPFormVars($ip);
289+
$tmp_iplookup = 'base_qry_main.php?new=1'
290+
. '&amp;sig%5B0%5D=%3D&amp;sig%5B1%5D='
291+
. rawurlencode(GetSignatureName($unique_events[$i], $db))
292+
. '&amp;num_result_rows=-1&amp;submit='
293+
. _QUERYDBP . '&amp;current_view=-1&amp;ip_addr_cnt=2'
294+
. BuildIPFormVar($ip, 3);
295+
$tmp_sensor_lookup = 'base_stat_sensor.php?'
296+
. 'sig%5B0%5D=%3D&amp;sig%5B1%5D='
297+
. rawurlencode($unique_events[$i])
298+
. '&amp;ip_addr_cnt=2' . BuildIPFormVar($ip, 3);
300299

301300
echo " <TD align='center'> <A HREF=\"$tmp_iplookup\">$total</A> ";
302301
echo " <TD align='center'> <A HREF=\"$tmp_sensor_lookup\">$num_sensors</A> ";
@@ -305,33 +304,29 @@ function PrintEventsByIP($db, $ip)
305304
echo '</TR>';
306305
}
307306

308-
echo "</TABLE>\n";
307+
PrintFramedBoxFooter(0,2);
309308
}
310309

310+
$Sep = ' | '; // Separator.
311311
if ( sizeof($sig) != 0 && strstr($sig[1], "spp_portscan") )
312312
$sig[1] = "";
313313

314-
/* Build new link for criteria-based sensor page
315-
* -- ALS <[email protected]>
316-
*/
317-
$tmp_sensor_lookup = 'base_stat_sensor.php?ip_addr_cnt=2'.
318-
BuildIPFormVars($ip);
314+
// Build new link for criteria-based sensor page - ALS <[email protected]>
315+
$tmp_sensor_lookup = 'base_stat_sensor.php?ip_addr_cnt=2'
316+
. BuildIPFormVar($ip, 3);
319317

318+
$tmp_srcdst_iplookup = 'base_qry_main.php?new=2&amp;num_result_rows=-1'
319+
. '&amp;submit=' . _QUERYDBP . '&amp;current_view=-1&amp;ip_addr_cnt=2'
320+
. BuildIPFormVar($ip, 3);
320321

321-
$tmp_srcdst_iplookup = 'base_qry_main.php?new=2'.
322-
'&amp;num_result_rows=-1'.
323-
'&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=2'.
324-
BuildIPFormVars($ip);
322+
$tmp_src_iplookup = 'base_qry_main.php?new=2&amp;num_result_rows=-1'
323+
. '&amp;submit=' . _QUERYDBP . '&amp;current_view=-1&amp;ip_addr_cnt=1'
324+
. BuildIPFormVar($ip, 1);
325325

326-
$tmp_src_iplookup = 'base_qry_main.php?new=2'.
327-
'&amp;num_result_rows=-1'.
328-
'&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=1'.
329-
BuildSrcIPFormVars($ip);
326+
$tmp_dst_iplookup = 'base_qry_main.php?new=2&amp;num_result_rows=-1'
327+
. '&amp;submit=' . _QUERYDBP . '&amp;current_view=-1&amp;ip_addr_cnt=1'
328+
. BuildIPFormVar($ip, 2);
330329

331-
$tmp_dst_iplookup = 'base_qry_main.php?new=2'.
332-
'&amp;num_result_rows=-1'.
333-
'&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=1'.
334-
BuildDstIPFormVars($ip);
335330
echo '<CENTER>';
336331
printf ("<FONT>"._PSALLALERTSAS.":</FONT>",$ip,$netmask);
337332
echo '
@@ -351,25 +346,39 @@ function PrintEventsByIP($db, $ip)
351346
<A HREF="http://www.db.ripe.net/whois?query='.$ip.'" target="_NEW">RIPE</A> |
352347
<A HREF="http://wq.apnic.net/apnic-bin/whois.pl?do_search=Search&amp;searchtext='.$ip.'" target="_NEW">APNIC</A> |
353348
<A HREF="http://lacnic.net/cgi-bin/lacnic/whois?lg=EN&amp;query='.$ip.'" target="_NEW">LACNIC</A><BR></FONT>';
354-
// Have no idea why this code is here.
355-
// Commenting it out as it was ccontributing to Issue #5
356-
// $octet=preg_split("/\./", $ip);
357-
// $classc=sprintf("%03s.%03s.%03s",$octet[0],$octet[1],$octet[2]);
358-
print '<FONT>'._PSEXTERNAL.': ';
359-
if (isset($external_dns_link)){
360-
print '<A HREF="'.$external_dns_link.$ip.'" target="_NEW">DNS</A>';
361-
}
362-
if (isset($external_whois_link)){
363-
print ' | <A HREF="'.$external_whois_link.$ip.'" target="_NEW">whois</A>';
364-
}
365-
if (isset($external_all_link)){
366-
print ' | <A HREF="'.$external_all_link.$ip.'" target="_NEW">Extended whois</A>';
367-
}
368-
print ' | <A HREF="http://www.dshield.org/ipinfo.php?ip='.$ip.'&amp;Submit=Submit" target="_NEW">DShield.org IP Info</A> | '.
369-
'<A HREF="http://www.trustedsource.org/query.php?q='.$ip.'" target="_NEW">TrustedSource.org IP Info</A> | '.
370-
'<A HREF="http://isc.sans.org/ipinfo.html?ip='.$ip.'" target="_NEW">ISC Source/Subnet Report</A><BR> </FONT>';
349+
// Have no idea why this code is here.
350+
// Commenting it out as it was ccontributing to Issue #5
351+
// $octet=preg_split("/\./", $ip);
352+
// $classc=sprintf("%03s.%03s.%03s",$octet[0],$octet[1],$octet[2]);
353+
print _PSEXTERNAL . ': ';
354+
if( isset($external_dns_link) ){
355+
NLIO(
356+
"<a href='" . $external_dns_link . $ip
357+
. "' target='_NEW'>DNS</a>$Sep", 2
358+
);
359+
}
360+
if( isset($external_whois_link) ){
361+
NLIO(
362+
"<a href='" . $external_whois_link . $ip
363+
. "' target='_NEW'>whois</a>$Sep", 2
364+
);
365+
}
366+
if( isset($external_all_link) ){
367+
NLIO(
368+
"<a href='" . $external_all_link . $ip
369+
. "' target='_NEW'>Extended whois</a>$Sep", 2
370+
);
371+
}
372+
NLIO(
373+
"<a href='" . 'https://www.dshield.org/ipinfo.html?ip=' . $ip
374+
. "' target='_NEW'>DShield.org IP Info</a>$Sep", 2
375+
);
376+
NLIO(
377+
"<a href='" . 'https://isc.sans.edu/ipinfo.html?ip=' . $ip
378+
. "' target='_NEW'>ISC Source/Subnet Report</a>", 2
379+
);
380+
NLIO('<br/>');
371381

372-
373382
echo '</CENTER>';
374383
echo '<HR>';
375384

@@ -472,6 +481,6 @@ function PrintEventsByIP($db, $ip)
472481
PrintPortscanEvents($db, $ip);
473482
echo ' </CENTER>';
474483
}
475-
NLIO('</form>',2);
484+
NLIO('</form>', 2);
476485
PrintBASESubFooter();
477486
?>

0 commit comments

Comments
 (0)