From 763c983ea06d13207a219328564c70d795541c5b Mon Sep 17 00:00:00 2001 From: doug Date: Fri, 25 May 2018 08:16:26 -0400 Subject: [PATCH] 1.8.0 - update for 16.04 --- .inc/callback.php | 4 + .inc/functions.php | 4 +- .inc/ip2c.php | 117 +- {auth/sso/squert/.js => .js}/squertMain.js | 0 .scripts/securityonion-squert.cnf | 1 + auth/native/squert/.js/squertMain.js | 3275 -------- auth/native/squert/login.php | 158 - debian/changelog | 72 + debian/control | 2 +- debian/install | 2 +- debian/patches/disable-mysql-strict-mode | 35 + debian/patches/fix-auth | 6915 +++++++++++++++++ debian/patches/fix-for-loop | 36 + .../frontend-expects-all-values-to-be-strings | 36 + ...te-over-all-arrays-when-converting-strings | 38 + .../patches/move-files-from-elastic-package | 3465 +++++++++ ...ove-unnecessary-code-from-ip2c.php\033:wq" | 161 + debian/patches/series | 10 + debian/patches/update-mysql-calls-and-config | 52 + .../update-mysql-function-calls-in-ip2c.php | 113 + debian/patches/version-1.7.1 | 47 + debian/postinst | 21 +- auth/sso/squert/login.php => login.php | 2 +- 23 files changed, 11023 insertions(+), 3543 deletions(-) rename {auth/sso/squert/.js => .js}/squertMain.js (100%) delete mode 100644 auth/native/squert/.js/squertMain.js delete mode 100644 auth/native/squert/login.php create mode 100644 debian/patches/disable-mysql-strict-mode create mode 100644 debian/patches/fix-auth create mode 100644 debian/patches/fix-for-loop create mode 100644 debian/patches/frontend-expects-all-values-to-be-strings create mode 100644 debian/patches/iterate-over-all-arrays-when-converting-strings create mode 100644 debian/patches/move-files-from-elastic-package create mode 100644 "debian/patches/remove-unnecessary-code-from-ip2c.php\033:wq" create mode 100644 debian/patches/update-mysql-calls-and-config create mode 100644 debian/patches/update-mysql-function-calls-in-ip2c.php create mode 100644 debian/patches/version-1.7.1 rename auth/sso/squert/login.php => login.php (98%) diff --git a/.inc/callback.php b/.inc/callback.php index 80c151d..0053c85 100644 --- a/.inc/callback.php +++ b/.inc/callback.php @@ -442,6 +442,10 @@ function level2() { $query->execute($merged_params); // fetch the data and encode to json $rows = $query->fetchAll(PDO::FETCH_ASSOC); + // the frontend expects all values to be strings + for ($i=0;$i=start_ip AND $ip <= end_ip LIMIT 1"); - $result = mysql_fetch_array($ipLookup); + $result = mysqli_fetch_array($ipLookup); if ($result) { $registry = $result[0]; @@ -63,7 +60,7 @@ function lookup($list) { $date = $result[4]; $status = $result[5]; - mysql_query("REPLACE INTO mappings (registry,cc,c_long,type,ip,date,status) + mysqli_query($db,"REPLACE INTO mappings (registry,cc,c_long,type,ip,date,status) VALUES (\"$registry\",\"$cc\",\"$c_long\",\"$type\",\"$ip\",\"$date\",\"$status\")"); echo "-- Mapped $dot ($ip) to $cc ($c_long)\n"; } @@ -71,52 +68,39 @@ function lookup($list) { } } - // DB Connect - $db = mysql_connect($dbHost,$dbUser,$dbPass) or die(mysql_error()); - mysql_select_db($dbName,$db) or die(mysql_error()); - // Start timing $st = microtime(true); - $sipList = mysql_query("SELECT DISTINCT(e.src_ip) FROM event AS e LEFT JOIN mappings AS m ON e.src_ip=m.ip + + // DB Connect + global $db; + $sipList = mysqli_query($db,"SELECT DISTINCT(e.src_ip) FROM event AS e LEFT JOIN mappings AS m ON e.src_ip=m.ip WHERE (m.ip IS NULL OR m.cc = '01')"); - $dipList = mysql_query("SELECT DISTINCT(e.dst_ip) FROM event AS e LEFT JOIN mappings AS m ON e.dst_ip=m.ip + $dipList = mysqli_query($db,"SELECT DISTINCT(e.dst_ip) FROM event AS e LEFT JOIN mappings AS m ON e.dst_ip=m.ip WHERE (m.ip IS NULL OR m.cc = '01')"); $sipCount = $dipCount = 0; if ($sipList) { - $sipCount = mysql_num_rows($sipList); + $sipCount = mysqli_num_rows($sipList); if ($sipCount > 0) { lookup($sipList); } } if ($dipList) { - $dipCount = mysql_num_rows($dipList); + $dipCount = mysqli_num_rows($dipList); if ($dipCount > 0) { lookup($dipList); } } - $allRecs = mysql_query("SELECT COUNT(*) FROM mappings"); - $allCount = mysql_fetch_row($allRecs); + $allRecs = mysqli_query($db,"SELECT COUNT(*) FROM mappings"); + $allCount = mysqli_fetch_row($allRecs); // Stop Timing $et = microtime(true); $time = $et - $st; $rt = sprintf("%01.3f",$time); - if ($isCLI == 'NO') { - - $html = "\r - \r - \r - \r - \r - \r
 -> Query Time: $rt seconds
 -> Source Count: $sipCount
 -> Destination Count: $dipCount
 -> Total Mapped: $allCount[0]
"; - - return $html; - } - - if ($isCLI == 'YES' && $string == 0) { + if ($string == 0) { echo "\n-> Query Time: $rt seconds \r-> Source Count: $sipCount \r-> Destination Count: $dipCount @@ -125,30 +109,6 @@ function lookup($list) { } -/* - -Commenting out the following function per -https://github.com/int13h/squert/issues/76 - -function TheHTML($string) { - - echo "\r - \r - \r - \r - \r - \r - \r
- \r
- \r - \r

- \r - \r
- \r - \r"; -} -*/ - if (isset($argc)) { if ($argc == 1 || $argc > 2 || $argv[1] > 1 || !is_numeric($argv[1])) { @@ -159,21 +119,8 @@ function TheHTML($string) { \r1 - Update. This is intended to be called via Cron\n\n"; exit; } else { - IP2C($argv[1],'YES'); - } - -} else { - - $html = ''; - - if(!isset($_REQUEST['qText'])) { $string = $_REQUEST['qp']; } else { $string = $_REQUEST['qText']; } - - if (@$_REQUEST['csync']) { - $string = $_REQUEST['qText']; - $html = IP2C($string,'NO'); + IP2C($argv[1]); } - TheHTML($string); - echo $html; } ?> diff --git a/auth/sso/squert/.js/squertMain.js b/.js/squertMain.js similarity index 100% rename from auth/sso/squert/.js/squertMain.js rename to .js/squertMain.js diff --git a/.scripts/securityonion-squert.cnf b/.scripts/securityonion-squert.cnf index fe81ad9..1db2bd4 100644 --- a/.scripts/securityonion-squert.cnf +++ b/.scripts/securityonion-squert.cnf @@ -1,5 +1,6 @@ [mysqld] group_concat_max_len = 100000 +sql_mode=NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION [mysqltcl] local-infile=1 diff --git a/auth/native/squert/.js/squertMain.js b/auth/native/squert/.js/squertMain.js deleted file mode 100644 index 913fc54..0000000 --- a/auth/native/squert/.js/squertMain.js +++ /dev/null @@ -1,3275 +0,0 @@ -/* Copyright (C) 2012 Paul Halliday */ - -$(document).ready(function(){ - - $(document).on('click', '[class*="bpr"]', function() { - // We disallow filtering if any events have already been selected - // or if we stray from the event tab - if ($('.d_row_active')[0]) return; - if ($(".chk_event:checked").length > 0) return; - if ($(".tab_active").attr('id') != 't_sum') return; - - var prClass = $(this).attr('class').split('b')[1]; - var prOld = $(this).data('pr'); - - function flipIt(pattern) { - $(pattern).closest('tr').hide(); - $(pattern).closest('tr').attr('class','hidden'); - if ($('#gr').text() == 'on') $(pattern).closest('tr').find('.chk_event').prop("disabled",true); - } - if ($('.b' + prClass).attr('class') == 'bprA') { - $('.b' + prClass).attr('class', 'bpr' + prOld); - $('.hidden').attr('class','d_row'); - $('.d_row').show(); - if ($('#gr').text() == 'on') { - $('.chk_event').prop("disabled",false); - $('.chk_all').prop("checked",false); - $('.chk_event').css("background-color", "#fafafa"); - } - } else { - // See if we are already filtered - if ($('.bprA')[0]) { - $('.hidden').attr('class','d_row'); - $('.d_row').show(); - if ($('#gr').text() == 'on') { - $('.chk_event').prop("disabled",false); - $('.chk_all').prop("checked",false); - $('.chk_event').css("background-color", "#fafafa"); - } - var prPrev = $('.bprA').data('pr'); - $('.bprA').attr('class', 'bpr' + prPrev); - } - $('.b' + prClass).attr('class','bprA'); - switch (prClass) { - case "pr1": ptrn = ".pr2,.pr3,.pr4"; break; - case "pr2": ptrn = ".pr1,.pr3,.pr4"; break; - case "pr3": ptrn = ".pr1,.pr2,.pr4"; break; - case "pr4": ptrn = ".pr1,.pr2,.pr3"; break; - } - flipIt(ptrn); - } - }); - - // - // Load main content - // - - // Keep track of context - thisUser = $('#t_usr').data('c_usr'); - thisTZ = $('#user_tz').val(); - rtbit = 0; - eventList("0-aaa-00"); - $("#loader").show(); - lastclasscount = 0; - - $(document).on("click", "#dt_savetz", function(event) { - if ($('.dt_error').data('err') == 0) { - var newOffset = $('#ts_offset').val(); - profileUpdate("tz", s2h(newOffset)); - $('#user_tz').val(newOffset); - } - }); - - // Depending on context a 'No result' may be confusing - // so we turn off active queue and show everything - $(document).on('click', '#retry', function() { - $('#rt').attr('class','tvalue_off'); - $('#rt').text('off'); - rtbit = 0; - $('.b_update').click(); - }); - - // Get event statuses - var eTotal = 0, qTotal = 0; - function statusPoll(caller) { - // See if we are filtering by sensor - var theSensors = s2h('empty'); - if ($('.chk_sen:checked').length > 0) { - var active_sensors = "AND event.sid IN("; - var iter = $('.chk_sen:checked').length; - $('.chk_sen:checked').each(function() { - active_sensors += "'" + $(this).val() + "',"; - }); - active_sensors = active_sensors.replace(/,+$/,''); - active_sensors += ")"; - theSensors = s2h(active_sensors); - } - - var urArgs = "type=" + 6 + "&ts=" + theWhen + "&sensors=" + theSensors; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb(data)}); - }); - - function cb(data){ - // Check to make sure we still have a valid session. If we don't - // let the user know and return them to the login page. - if (data[0] == "<") { - $("span.class_msg").text("Your session has expired!"); - $("span.class_msg").css("background-color", "#cc0000"); - $("span.class_msg").css("color", "#fff"); - $("span.class_msg").show(); - var sessionDead = confirm("Your session has expired. Press \"OK\" to return to the login page. If you aren't finished with what you were looking at click 'Cancel'. Note: you won't be able to perform any actions."); - if (sessionDead) { - $("#logout").click(); - } - } - eval("ec=" + data); - - var esum = 0; - - for (var i=0; i 0) { - var p = parseFloat(ecount/esum*100).toFixed(1); - var w = parseInt(p*2); - } - if (eclass == 0) { - qTotal = ecount; - } - $("#c-" + eclass).text(ecount); - $("#c-" + eclass).append("(" + p + "%)"); - } - - var lastcount = $("#cat_sum").val(); - var newcount = esum; - $("#cat_sum").val(esum); - eTotal = esum; - $("#event_sum").val(eTotal); - - if (caller == 0) { // Fresh load - lastcount = newcount; - } - - // Last RT value - var lastQ = Number($("#qtotal").html()); - if (lastcount < newcount) { - $("#etotal").html(eTotal); - } - - if (lastQ < qTotal) { - if (caller != 0) { - if ($(".icon_notifier").css('display') == 'none') $(".icon_notifier").fadeToggle(); - } - $("#etotal").html(eTotal); - $("#qtotal").html(qTotal); - } - - $("#title").html("squert (" + qTotal + ") - " + thisUser); - - } - - } - - // - // Event monitor (how often we poll for new events) - // - - var emTimeout = 30000; - window.setInterval(function(){ - if ($('#search').val().length == 0) { - statusPoll(1); - } - }, emTimeout); - - $(document).on("click", '[class*="cl_"]', function(event) { - var nc = $(this).attr('class').split("_"); - var ct = $(this).parents('table').data('comment'); - $(".cat_msg_txt").val(ct); - $('#b_class-' + nc[1]).click(); - }); - - // Tabs - var tab_cached = $("#sel_tab").val(); - - switch (tab_cached) { - case "t_sum": - $('.content-right').show(); - break; - case "t_ovr": - $('.content-right').hide(); - $('.content-left').hide(); - if ($('#ovestat').text().length == 0) loadSummary(); - break; - case "t_view": - $('.content-right').hide(); - $('.content-left').hide(); - loadViews(); - default: - $('.content-right').hide(); - $('.content-left').hide(); - break; - } - - $('#' + tab_cached).attr('class','tab_active'); - $("#" + tab_cached + "_content").attr('class','content_active'); - - $(".tab,.tab_active").click(function(event) { - var active = $(".tab_active").attr('id'); - var content = $(".content_active").attr('id'); - if ($(".fl_val_on")[0]) { - $('.b_update').click(); - } - - if ( this.id != active ) { - $("#" + active).removeClass('tab_active'); - $("#" + active).addClass('tab'); - $(this).attr('class','tab_active'); - $("#" + content).attr('class','content'); - $("#" + this.id + "_content").attr('class','content_active'); - activeTab = $(".tab_active").attr('id'); - $('.pin').hide(); - - switch (activeTab) { - case "t_sum": - $('.content-right').show(); - if (Number($('.botog').data('val')) == 1) $('.content-left').show(); - $('.t_pbar').css('opacity',1); - $('.db_links').hide(); - $('.pin').show(); - break; - case "t_ovr": - $('.content-right').hide(); - $('.content-left').hide(); - if ($('#ovestat').text().length == 0) loadSummary(); - $('.t_pbar').css('opacity',.1); - $('.db_links').hide(); - break; - case "t_view": - $('.content-right').hide(); - $('.content-left').hide(); - $('.t_pbar').css('opacity',.1); - loadViews(); - break; - default: - $('.content-right').hide(); - $('.content-left').hide(); - $('.t_pbar').css('opacity',.1); - $('.db_links').hide(); - break; - } - - $('#sel_tab').val(activeTab); - var ctab = $('#sel_tab').val(); - var urArgs = "type=" + 5 + "&tab=" + ctab; - $.get(".inc/callback.php?" + urArgs); - } - }); - - // Sub tab groups - $(".tsg").click(function(event) { - var nc = Number($(this).attr('class').split(/\s/).length); - var ct = $(this).data('tab'); - $('.tsg_active').attr('class','tsg'); - $(this).attr('class','tsg tsg_active'); - }); - - // Toggle and update views - function newView(req) { - // No racing please - var bail = $("#loader").css('display'); - if (bail != 'none') return; - // Remove any stale views - $("#tl0,#tl1,#tl3a,#tl3b").remove(); - var f = "0-aaa-00"; - var s = "2a-aaa-00"; - var cv = $("#gr").text(); - - switch (cv) { - case "on": - eventList(f); - $("#loader").show(); - break; - case "off": - eventList(s); - $("#loader").show(); - break; - } - } - - // Group and ungroup - $(document).on("click", "#gr", function(event) { - var bail = $("#loader").css('display'); - if (bail != 'none') return; - var cv = $('#gr').text(); - switch (cv) { - case 'on': - $('#gr').attr('class','tvalue_off'); - $('#gr').text('off'); - break; - case 'off': - $('#gr').attr('class','tvalue_on'); - $('#gr').text('on'); - $("#event_sort").val("DESC"); - break; - } - }); - - // RT check/uncheck - $(document).on("click", "#rt", function(event) { - var bail = $("#loader").css('display'); - if (bail != 'none') return; - var cv = $('#rt').text(); - switch (cv) { - case 'on': - $('#rt').attr('class','tvalue_off'); - $('#rt').text('off'); - rtbit = 0; - break; - case 'off': - $('#rt').attr('class','tvalue_on'); - $('#rt').text('on'); - rtbit = 1; - break; - } - }); - - // Toggle side/lower bars - $(document).on("click", ".botog", function(event) { - if ($('.tab_active').attr('id') != 't_sum') return; - var n = Number($('.botog').data("val")); - switch (n) { - case 1: - $('.botog').data("val","0"); - $('.content-right').css("width","100%"); - $('.botog').attr('src','.css/layout0.png'); - break; - case 0: - $('.botog').data("val","1"); - $('.content-right').css("width","82%"); - $('.botog').attr('src','.css/layout1.png'); - break; - } - $('.bottom').animate({height: 'toggle'}); - $('.content-left').animate({width: 'toggle'}); - }); - - // Section show and hide - $(".st").click(function() { - var thisSec = $(this).data("sec"); - var thisSecID = "#sec_" + thisSec; - var thisSecVis = $(thisSecID).css("display"); - var lastSection = "h"; - switch (thisSecVis) { - case "none": - $(this).attr("src", ".css/uarr.png"); - $(thisSecID).slideDown(); - break; - default: - $(this).attr("src", ".css/darr.png"); - $(thisSecID).slideUp(); - break; - } - }); - - // If search is in focus, update on enter - $('#search').keypress(function(e) { - if (!e) e=window.event; - key = e.keyCode ? e.keyCode : e.which; - if (key == 13) { - // Close comment box if it is open - if ($('#cat_box').css('display') != 'none') { - $('#ico01').click(); - } - $('.b_update').click(); - } - }); - - // Sort ASC/DESC - $(document).on("click", ".event_time", function(event) { - var csv = $(".event_time").text(); - switch (csv) { - case "show oldest first": - $("#event_sort").val("ASC"); - break; - case "show newest first": - $("#event_sort").val("DESC"); - break; - } - newView("u"); - }); - - // Update page - $(document).on("click", ".b_update", function(event) { - $(".icon_notifier").fadeToggle(); - $(".tag").remove(); - $(".tag_empty").show(); - // Remove any supplementary results - if ($("#extresult")[0]) $("#extresult").remove(); - // Where are we? - var curTab = $('.tab_active').attr('id'); - switch (curTab) { - case 't_ovr': - loadSummary(); - break; - case 't_view': - mkView(); - break; - default: - $(".b_update_note").hide(); - newView("u"); - break; - } - }); - - // Clear search and refresh - $('#clear_search').click(function() { - if ($('#search').val() != '') { - $('#search').val(''); - $("#search").focus(); - if ($(".fl_val_on")[0]) { - $('.b_update').click(); - } - } - }); - - // Logout - $("#logout").click(function(event) { - $.get("index.php?id=0", function(){location.reload()}); - }); - - // Toggle filters - $(document).on('click', '.fl_val_on', function(event) { - var wF = $(this).data("ft"); - switch (wF) { - case "tl": - - break; - case "ob": - $('#clear_search').click(); - break; - case "sn": - $(".chk_sen").each(function() { - $(this).prop("checked",false); - }); - $('.b_update').click(); - break; - } - }); - - function clearTags() { - //$(".tag").remove(); - //$(".tag_empty").show(); - $(".tag").removeClass('tag_active'); - } - - // - // Rows - // - - function closeRow() { - $("#active_eview").remove(); - $("#" + this.id).attr('class','d_row'); - $(".d_row").css('opacity','1'); - ltCol = $(".d_row_active").find('td.lt').html(); - $(".d_row_active").find('td.lt').css('background', ltCol); - $(".d_row_active").attr('class','d_row'); - // Update class_count - $("#class_count").text(lastclasscount); - // Get rid of any crashed loaders - $("#loader").hide(); - // Reset checkbox - $(".chk_all").prop("checked",false); - // Clear Tags - clearTags(); - } - function closeSubRow() { - $("#eview_sub1").remove(); - $("#" + this.id).attr('class','d_row_sub'); - $(".d_row_sub").css('opacity','1'); - $(".d_row_sub_active").attr('class','d_row_sub'); - // Update class_count - $("#class_count").text(lastclasscount); - curclasscount = lastclasscount; - $("#loader").hide(); - // Reset and show checkbox - $(".chk_all").prop("checked",false); - $("#ca0").show(); - // Remove any open externals - if ($("#extresult")[0]) $("#extresult").remove(); - // Clear Tags - clearTags(); - } - function closeSubRow1() { - $("#eview_sub2").remove(); - $("#" + this.id).attr('class','d_row_sub1'); - if (!$("#eview_sub3")[0]) { - $(".d_row_sub1").css('opacity','1'); - $(".d_row_sub_active1").attr('class','d_row_sub1'); - } - $("#loader").hide(); - // Reset checkbox - $(".chk_all").prop("checked",false); - // Remove any open externals - if ($("#extresult")[0]) $("#extresult").remove(); - // Clear Tags - clearTags(); - } - function closeSubRow2() { - $("#eview_sub3").remove(); - $("#" + this.id).attr('class','d_row_sub1'); - if (!$("#eview_sub2")[0]) { - $(".d_row_sub1").css('opacity','1'); - $(".d_row_sub1_active").attr('class','d_row_sub1'); - } - $("#loader").hide(); - // Clear Tags - clearTags(); - } - - // - // Level 1 - // - - $(document).on("click", ".row_active", function(event) { - var curID = $(this).parent('tr').attr('id'); - // What type of row are we? - rowType = curID.substr(0,3); - - // Make sure no other instances are open - if (!$(".d_row_active")[0] && rowType == 'sid') { - $("#loader").show(); - // This leaves us with sid-gid - var rowValue = curID.replace("sid-",""); - var sigID = rowValue.split("-")[0]; - - $(".d_row_active").attr('class', 'd_row'); - $("#active_eview").attr('class','d_row'); - - // This is now the active row - $("#" + curID).attr('class','d_row_active'); - $("html, body").animate({ scrollTop: $('.d_row_active').offset().top - 140 }, 20); - // History - var itemToAdd = $("#" + curID).find('[class*="row_filter"]').text(); - hItemAdd(itemToAdd); - // Set the class count (counted again after load) - curclasscount = $('.d_row_active').data('event_count'); - var cols = $('th.sort').length; - var tbl = ''; - tbl += ""; - tbl += "
"; - tbl += "
"; - tbl += "
"; - tbl += "
↓
"; - tbl += "
"; - tbl += "
"; - tbl += "
"; - tbl += "
"; - tbl += ""; - tbl += "CATEGORIZE"; - tbl += curclasscount + "EVENT(S)  "; - tbl += "    "; - tbl += "CREATE FILTER: "; - tbl += "src  "; - tbl += "dst  "; - tbl += "both"; - tbl += "
"; - $("#" + curID).after(tbl); - - // Lookup signature - sigLookup(rowValue); - - // Fetch results - eventList("1-" + rowValue); - - $("#eview").show(); - $(".d_row").fadeTo('0','0.2'); - } else { - closeRow(); - } - }); - - // - // Level 2 - // - - $(document).on("click", ".sub_active", function() { - if (!$(".d_row_sub_active")[0]) { - var callerID = $(this).parent('tr').attr('id'); - - // Reset checkbox - $(".chk_all").prop("checked",false); - - // RT or ALL? - switch (rtbit) { - case 1: adqp = s2h("AND event.status = 0"); break; - case 0: adqp = s2h("empty"); break; - } - // We are now the active row - $("#" + callerID).attr('class','d_row_sub_active'); - - // Populate search times - var bt = $("#" + callerID).find('[class*="timestamp"]').html(); - var est = mkStamp(bt,"-",3600000,thisTZ); - var eet = mkStamp(bt,"+",3600000,thisTZ); - - $('#el_start').val(est); - $('#el_end').val(eet); - - // Clear search terms - $("#srchterms").html(''); - $(".srch_txt").val(''); - - // History and search - $("#" + callerID).find('[class*="sub_filter"]').each(function() { - if ($(this).data('type') == 'cc') { - var itemToAdd = $(this).data('value'); - } else { - var itemToAdd = $(this).text(); - // Add search terms - $("#srchterms").append("" + itemToAdd + "  "); - } - hItemAdd(itemToAdd); - }); - - $("#loader").show(); - eventList("2-" + callerID + "-" + adqp); - } else { - closeSubRow(); - } - }); - - // - // Level 3 (a or b) request payload - // - - $(document).on("click", ".sub1_active", function() { - // Close transcript if it is open - if ($(".eview_sub3")[0]) closeSubRow2(); - if (!$(".d_row_sub_active1")[0]) { - var callerID = $(this).parent('tr').attr('id'); - $("#" + callerID).attr('class','d_row_sub_active1'); - - // Populate search times - var bt = $("#" + callerID).find('[class*="timestamp"]').html(); - var est = mkStamp(bt,"-",1800000,thisTZ); - var eet = mkStamp(bt,"+",1800000,thisTZ); - - $('#el_start').val(est); - $('#el_end').val(eet); - - // Clear search terms - $("#srchterms").html(''); - $(".srch_txt").val(''); - - // History - $("#" + callerID).find('[class*="sub_filter"]').each(function() { - if ($(this).data('type') == 'cc') { - var itemToAdd = $(this).data('value'); - } else { - var itemToAdd = $(this).text(); - } - if ($(this).data('type') == 'ip') { - // Add search terms - $("#srchterms").append("" + itemToAdd + "  "); - } - hItemAdd(itemToAdd); - }); - $("#loader").show(); - eventList("3-" + callerID); - } else { - closeSubRow1() - } - }); - - // - // Level 3 (a or b) request transcript - // - - $(document).on("click", ".sub2_active", function(event) { - // Close payload if it is open - if ($(".eview_sub2")[0]) closeSubRow1(); - var bail = $("#loader").css('display'); - if (bail != 'none') return; - if (!$(".eview_sub3")[0]) { - $("#loader").show(); - composite = $(this).data('tx').split("-"); - rowLoke = composite[0]; - $("#" + rowLoke).attr('class','d_row_sub1_active'); - nCols = $("#" + rowLoke).find('td').length; - cid = composite[1]; - txdata = composite[2]; - - // See if a transcript is available - var urArgs = "type=" + 7 + "&txdata=" + txdata; - $(function(){ - $.post(".inc/callback.php?" + urArgs, function(data){cb5(data)}); - }); - - function cb5(data){ - eval("txRaw=" + data); - txCMD = txRaw.cmd; - txResult = txRaw.tx; - txDebug = txRaw.dbg; - if (txResult == "DEBUG:") txResult += " No data was returned."; - if (!txResult) { - txResult = "Transcript request failed!

"; - txResult += "The command was:
" + txCMD + "

"; - txResult += "The response was:" + txDebug.replace(/DEBUG:/g,"
"); - } - - var row = '',tbl = ''; - row += ""; - row += ""; - row += "
"; - row += txResult; - row += "
"; - - tbl += ""; - tbl += row; - tbl += ""; - $("#" + rowLoke).after(tbl); - - // Turn off fade effect for large results - var rC = $(".d_row_sub1").length; - if ( rC <= 399 ) { - $(".d_row_sub1").fadeTo('fast','0.2'); - } - - $("#loader").hide(); - } - } else { - closeSubRow2(); - } - }); - - // Toggle RT depending on entry point - $(document).on("click", ".b_ec_hot", function() { - rtbit = 1; - }); - $(document).on("click", ".b_ec_total", function() { - rtbit = 0; - }); - - // Filter constructor - function mkFilter() { - if ($('#search').val().length > 0) { - - var srchVal = $('#search').val(); - var fParts = ""; - - // If no term is supplied default to a string, IP or wildcard IP search - chkVal: - if (srchVal.indexOf(" ") == -1 && srchVal[0] != "!") { - var re = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; - if (re.exec(srchVal)) { - srchVal = "ip " + srchVal; - break chkVal; - } - - var re = /^(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)/; - if (re.exec(srchVal)) { - srchVal = "wip " + srchVal; - break chkVal; - } - - srchVal = "sig " + srchVal; - } - - fParts = srchVal.replace(/^!/,"").split(" "); - if (fParts[0] == 'cmt') { - var theFilter = s2h($('#search').val()); - rtbit = 0; - } else { - // Now see if the requested filter exists - if ($("#tr_" + fParts[0]).length > 0) { - tmpFilter = $("#tr_" + fParts[0]).data('filter'); - // Now see if we need to modify the query - if (fParts[1]) { - // This is the base filter - preFilter = h2s(tmpFilter); - // This is the user supplied text. - var re = new RegExp("^" + fParts[0] + "\\s{1}|[';\\\`]","g"); - theQuestion = fParts.join(' ').replace(re, ""); - // We will accept multiple questions if they are comma delimited - questionParts = theQuestion.split(","); - if (questionParts.length > 1) { - var f = '('; - for (var i = 0; i < questionParts.length; i++) { - f += preFilter.replace(/\$/g, questionParts[i]); - if (i != (questionParts.length - 1)) { - f += " OR "; - } - } - f += ')'; - theFilter = s2h(f); - } else { - var newFilter = preFilter.replace(/\$/g, questionParts[0]); - theFilter = s2h(newFilter); - } - } else { - theFilter = tmpFilter; - } - } else { // The filter does not exist - theFilter = s2h('empty'); - } - } - } else { // No filter supplied - theFilter = s2h('empty'); - } - return theFilter; - } - - // - // This creates the views for each level - // - - function eventList (type) { - theWhen = getTimestamp(); - statusPoll(0); - var parts = type.split("-"); - var filterMsg = ''; - var rt = 0; - var theSensors = s2h('empty'); - var theFilter = mkFilter(); - - // See if we are just RT events - if ($('#rt').text() == 'on' || rtbit == 1) { - rt = 1; - rtbit = 1; - } - // How are we sorting? - var sortval = $("#event_sort").val(), sorttxt; - switch (sortval) { - case "DESC": sorttxt = "show oldest first"; break; - case "ASC": sorttxt = "show newest first"; break; - } - - // See if we are filtering by sensor - if ($('.chk_sen:checked').length > 0) { - var active_sensors = "AND event.sid IN("; - var iter = $('.chk_sen:checked').length; - $('.chk_sen:checked').each(function() { - active_sensors += "'" + $(this).val() + "',"; - }); - active_sensors = active_sensors.replace(/,+$/,''); - active_sensors += ")"; - theSensors = s2h(active_sensors); - } - - // Check for any filters - if (h2s(theFilter) != 'empty') { - $('.fl_val').text('YES'); - } else { - $('.fl_val').text('NO'); - } - - switch (parts[0]) { - - // Level 0 view - Grouped by Signature - case "0": - $('.value').text('-'); - - // Times Chart - var urChrtArgs = "type=22&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors; - $(function(){ - $.get(".inc/callback.php?" + urChrtArgs, function(data){cb22(data)}); - }); - - function cb22(data){ - eval("chartData=" + data); - var r = chartData.r; - if (r > 0) { - mkLine(".times",chartData.rows,chartData.m); - } - } - - var urArgs = "type=" + parts[0] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb1(data)}); - }); - function cb1(data){ - eval("d0=" + data); - var tbl = ''; - var head = ''; - var row = ''; - var cols = 11; - - if (rt == 0) cols = 12; - head += ""; - head += ""; - head += "QUEUE"; - if (rt == 0) head += "ALL"; - head += ""; - head += "SC"; - head += "DC"; - if (rt == 0) head += "CLASS"; - head += "ACTIVITY"; - head += "LAST EVENT"; - head += "SIGNATURE"; - head += "ID"; - head += "PROTO"; - head += "% TOTAL"; - head += ""; - - var sumEC = 0, sumSC = 0, sumDC = 0, sumSI = "-", spr1 = 0, spr2 = 0, spr3 = 0, spr4 = 0; - - if (d0.length > 0) { - // Sums for boxes - for (var i=0; i"; - row += "No result. If this is unexpected try this"; - } - - if (rt == 1) { - sumSC = "-"; - sumDC = "-"; - sumEC = eTotal; - } - - var sumRT = 0; - - // Tag Array - var tags = new Array(); - - for (var i=0; i 0 ) { - rtClass = "b_ec_hot"; - sumRT += parseInt(unClass); - } else { - rtClass = "b_ec_cold"; - } - - // Sum priorities - var prC = Number(d0[i].f1); - switch (d0[i].f13) { - case "1": spr1 += prC; break; - case "2": spr2 += prC; break; - case "3": spr3 += prC; break; - default: spr4 += prC; break; - } - - rid = "r" + i + "-" + parts[1]; - var cells = mkGrid(d0[i].f12); - if (rt == 0) var catCells = catGrid(d0[i].f11,0,0); - row += ""; - row += "
" + unClass + "
"; - if (rt == 0) row += "
" + d0[i].f1 + "
"; - row += "
" + d0[i].f13 + "
"; - row += "" +d0[i].f6+ ""; - row += "" +d0[i].f7+ ""; - if (rt == 0) row += "" + catCells + ""; - - timeParts = d0[i].f5.split(" "); - timeStamp = timeParts[1]; - - if ( sumEC > 0) { - rowPer = Number(d0[i].f1/sumEC*100).toFixed(3); - } else { - rowPer = "0.000"; - } - - row += "" + cells + ""; - row += "" + timeStamp + ""; - row += ""; - //row += "
" + d0[i].f2 + "
"; - row += d0[i].f2 + ""; - row += "" + d0[i].f3 + ""; - row += "" + d0[i].f8 + ""; - - - row += "" + rowPer + "%"; - row += ""; - } - - // Populate event summary - $('#qtotal').text(sumRT); - $('#etotal').text(sumEC); - $('#esignature').text(sumSI); - - // Populate tags - for (var i=0; i < tags.length; i++) { - addTag(tags[i]); - } - - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - - $('#' + parts[1] + '-' + parts[2]).append(tbl); - - if (d0.length > 0) { - var prVals = [spr1,spr2,spr3,spr4]; - var pryBar = mkPribar(prVals); - } else { - var pryBar = mkPribar([0]); - } - $('#tl1').fadeIn('slow'); - $("#tl1").tablesorter(); - $("#loader").hide(); - } - break; - - // Level 1 view - Grouped by signature, source, destination - - case "1": - var urArgs = "type=" + parts[0] + "&object=" + parts[1] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb2(data)}); - }); - - function cb2(data){ - eval("theData=" + data); - tbl = ''; - head = ''; - row = ''; - head += "QUEUE"; - if (rt == 0) head += "TOTAL"; - if (rt == 0) head += "CLASS"; - head += "ACTIVITY"; - head += "LAST EVENT"; - head += "SOURCE"; - head += "AGE"; - head += "COUNTRY"; - head += "DESTINATION"; - head += "AGE"; - head += "COUNTRY"; - head += ""; - var curclasscount = 0, tlCount = 0, rtCount = 0; - var timeValues = "", scid = ""; - - // Tag array - var tags = new Array(); - - for (var i=0; i 0 ) { - rtClass = "b_ec_hot"; - isActive = "sub_active"; - } else { - rtClass = "b_ec_cold"; - isActive = "sub"; - } - - // Aggregate time values - timeValues += theData[i].c_ts + ","; - var cells = mkGrid(theData[i].f12); - if (rt == 0) var catCells = catGrid(theData[i].c_status,0,0); - - // Event sums - tlCount += parseInt(count,10); - rtCount += parseInt(unclass,10); - - rid = "r" + i + "-" + parts[1] + "-" + src_ip + "-" + dst_ip; - row += ""; - row += "
" + unclass + "
"; - if (rt == 0) row += "
" + count + "
"; - if (rt == 0) row += "" + catCells + ""; - row += "" + cells + ""; - row += "" + max_time + ""; - row += "
" + src_ip + ""; - row += "" + src_age_n + ""; - row += ""; - row += cs[1] + src_clong + " (." + src_cc.toLowerCase() + ")" + ""; - row += "
" + dst_ip + ""; - row += "" + dst_age_n + ""; - row += ""; - row += cd[1] + dst_clong + " (." + dst_cc.toLowerCase() + ")" + ""; - row += ""; - } - - // Populate tags - for (var i=0; i < tags.length; i++) { - addTag(tags[i]); - } - - // Add scid's to checkbox - $("#ca0").data("scid", scid.replace(/,$/, "")); - - // If queue is empty provide event sums in case the user - // intends to reclass anything - if (rtbit == 1) { - curclasscount = rtCount; - } else { - curclasscount = tlCount; - } - - // update class_count - $("#class_count").html(curclasscount); - lastclasscount = $("#class_count").html(); - - // While in grouped events (RT) we remove rows as - // they are classed and subtract the values from "Total Events" - // This keeps etotal up to date so the math doesn't get silly - var oldrt = Number($(".d_row_active").find(".b_ec_hot").text()); - var oldec = Number($("#etotal").text()); - if (oldrt < rtCount) { - newrtcount = parseInt((rtCount - oldrt) + oldec); - $("#etotal").text(newrtcount); - } - - // Update parent counts - $(".d_row_active").find(".b_ec_hot").text(rtCount); - if (rt == 0) $(".d_row_active").find(".b_ec_total").text(tlCount); - - tbl += "
"; - tbl += head; - tbl += row; - tbl += "
"; - $("#eview").after(tbl); - $("#tl2").tablesorter({ - headers: { - 4: {sorter:'ipv4'}, - 6: {sorter:'ipv4'} - } - }); - $("#loader").hide(); - } - break; - - // Level 2 view - No grouping, individual events - - case "2": - var rowLoke = parts[1]; - var filter = $('#' + parts[1]).data('filter'); - var urArgs = "type=" + parts[0] + "&object=" + filter + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen + "&adqp=" + parts[2] + "&rt=" + rt + "&sv=" + sortval; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb3(data)}); - }); - - function cb3(data){ - eval("d2=" + data); - tbl = ''; - head = ''; - row = ''; - head += ""; - head += ""; - head += "ST"; - head += "TIMESTAMP"; - head += "EVENT ID"; - head += "SOURCE"; - head += "PORT"; - head += "DESTINATION"; - head += "PORT"; - head += "SIGNATURE"; - head += ""; - - // Update class_count - $("#class_count").html(0); - var tlCount=0, rtCount=0; - - // Tag array - var tags= new Array(); - - for (var i=0; i"; - tclass = "c" + eclass; - cv = classifications.class[tclass][0].short; - - // Populate tags array - if (src_tag != "-") { - var src_tags = src_tag.split(","); - $.each(src_tags, function(n,tag) { - var t = tags.indexOf(tag); - if (t < 0) tags.push(tag); - }); - } - - if (dst_tag != "-") { - var dst_tags = dst_tag.split(","); - $.each(dst_tags, function(n,tag) { - var t = tags.indexOf(tag); - if (t < 0) tags.push(tag); - }); - } - - // Timestamp - var compts = d2[i].f2.split(",") || "--"; - var timestamp = compts[0]; - var utctimestamp = compts[1]; - - // Event sums - tlCount += parseInt(1,10); - if (cv == "RT") { - rtCount += parseInt(1,10); - } - - // Transcript link - // original Squert native pivot: - //txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); - //txBit = "" + sid + "." + cid + "
"; - //if (src_port != "-" && dst_port != "-") { - // txBit = "" + sid + "." + cid + ""; - //} - // new pivot to CapMe: - txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); - txBit = "" + sid + "." + cid + ""; - if (src_port != "-" && dst_port != "-") { - var startDate = new Date(utctimestamp); - var start_tz_offset = (startDate.getTimezoneOffset()); - var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; - var endDate = new Date(utctimestamp); - var end_tz_offset = (endDate.getTimezoneOffset()); - var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; - txBit = " " + sid + "." + cid + ""; - } - - row += ""; - row += "
"; - row += cv + "
"; - row += "" + timestamp + ""; - row += txBit; - row += "" + src_ip + ""; - row += "" + src_port + ""; - row += "" + dst_ip + ""; - row += "" + dst_port + ""; - row += "" + signature + ""; - row += ""; - } - - // Update parent counts - $(".d_row_sub_active").find(".b_ec_hot").text(rtCount); - if ($(".d_row_sub_active").find(".b_ec_total").text() < tlCount) { - $(".d_row_sub_active").find(".b_ec_total").text(tlCount); - } - - var cols = $('th.sort').length; - - // Populate tags - clearTags(); - for (var i=0; i < tags.length; i++) { - addTag(tags[i]); - } - - tbl += ""; - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - $("#" + rowLoke).after(tbl); - $(".d_row_sub").fadeTo('0','0.2'); - $("#loader").hide(); - $("#tl3").tablesorter({ - headers: { - 0:{sorter:false}, - 4:{sorter:'ipv4'}, - 6:{sorter:'ipv4'} - }, - cancelSelection:false - }); - $("#ca0").hide(); - } - break; - - // Level 2a view - No grouping, individual events - - case "2a": - $('.value').text('-'); - var urArgs = "type=2a&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb3a(data)}); - }); - - function cb3a(data){ - eval("d2a=" + data); - var tbl = ''; - var head = ''; - var row = ''; - var disabled = ''; - if (d2a.length == 0) { - disabled = "disabled"; - row += ""; - row += "No result. If this is unexpected try this"; - } - - head += ""; - head += ""; - head += ""; - head += "ST"; - head += ""; - head += "TIMESTAMP"; - head += "ID"; - head += "SOURCE"; - head += "PORT"; - head += "AGE"; - head += "CC"; - head += "DESTINATION"; - head += "PORT"; - head += "AGE"; - head += "CC"; - head += "SIGNATURE"; - head += ""; - - // Aggregate time values - var timeValues = ""; - for (var ts=0; ts" + sid + "." + cid + ""; - //if (src_port != "-" && dst_port != "-") { - // txBit = "" + sid + "." + cid + ""; - //} - // new pivot to CapMe: - txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); - txBit = "" + sid + "." + cid + ""; - if (src_port != "-" && dst_port != "-") { - var startDate = new Date(utctimestamp); - var start_tz_offset = (startDate.getTimezoneOffset()); - var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; - var endDate = new Date(utctimestamp); - var end_tz_offset = (endDate.getTimezoneOffset()); - var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; - txBit = " " + sid + "." + cid + ""; - } - - row += ""; - row += ""; - row += "
"; - row += cv + "
"; - row += "
" + d2a[i].f16 + "
"; - row += "" + timestamp + ""; - row += txBit; - row += "
" + src_ip + ""; - row += "" + src_port + ""; - row += "" + src_age_n + ""; - row += "" + cs[1] + ""; - row += "
" + dst_ip + ""; - row += "" + dst_port + ""; - row += "" + dst_age_n + "" - row += "" + cd[1] + ""; - row += "" + signature + ""; - } - - var sumED = 0, sumEC = 0, cmsg = ""; - - if (d2a.length > 0) { - sumED = i; - sumEC = d2a.length; - } - - if (d2a.length >= maxI) { - sumRE = sumEC - maxI; - cmsg = " / " + sumRE + " not shown"; - } - - $("#qtotal").html(rsumRT); - - // Populate tags - clearTags(); - for (var i=0; i < tags.length; i++) { - addTag(tags[i]); - } - - // Draw - tbl += ""; - tbl += "
"; - tbl += "
"; - tbl += "
"; - tbl += "categorize " + 0 + ""; - tbl += " of " + sumED + " event(s)" + cmsg; - tbl += "
"; - tbl += "
" + sorttxt + "
"; - tbl += "
"; - tbl += "
"; - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - $('#' + parts[1] + '-' + parts[2]).after(tbl); - - if (d2a.length > 0) { - var prVals = [spr1,spr2,spr3,spr4]; - var pryBar = mkPribar(prVals); - } else { - var pryBar = mkPribar([0]); - } - $("#tl3a,#tl3b").fadeIn('slow'); - $("#tl3b").tablesorter({ - headers: { - 0:{sorter:false}, - 1:{sorter:false}, - 5:{sorter:'ipv4'}, - 8:{sorter:'ipv4'} - }, - cancelSelection:false - }); - $("#loader").hide(); - } - break; - - // Level 3 view - Packet Data - - case "3": - var rowLoke = parts[1]; - var nCols = $('#' + parts[1]).data('cols'); - var filter = $('#' + parts[1]).data('filter'); - var urArgs = "type=" + parts[0] + "&object=" + filter + "&ts=" + theWhen; - var sg = $('#' + parts[1]).data('sg'); - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb4(data)}); - }); - - function cb4(data){ - eval("theData=" + data); - - var tbl = '', head = '', row = ''; - - // If IP version is 0 we can jump right to the payload (likely bro, http or ossec agent) - if (theData[0].ip_ver != 0) { - - var PDATA = 0; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - head += ""; - - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += "
IPVERIHLTOSLENGTHIDFLAGSOFFSETTTLCHECKSUMPROTO
" + theData[0].ip_ver + "" + theData[0].ip_hlen + "" + theData[0].ip_tos + "" + theData[0].ip_len + "" + theData[0].ip_id + "" + theData[0].ip_flags + "" + theData[0].ip_off + "" + theData[0].ip_ttl + "" + theData[0].ip_csum + "" + theData[0].ip_proto + "
"; - - switch (theData[0].ip_proto) { - case "1": - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += "
ICMPTYPECODECHECKSUMIDSEQ#
" + theData[1].icmp_type + "" + theData[1].icmp_code + "" + theData[1].icmp_csum + "" + theData[1].icmp_id + "" + theData[1].icmp_seq + "
"; - break; - - case "6": - // TCP flags - var tmpFlags = theData[1].tcp_flags || 'z'; - switch (tmpFlags) { - case 'z': var tcpFlags = '--------'; break; - default: - var binFlags = Number(theData[1].tcp_flags).toString(2); - var binPad = 8 - binFlags.length; - var tcpFlags = "00000000".substring(0,binPad) + binFlags; - break; - } - var tcp_seq = theData[1].tcp_seq || '-'; - var tcp_ack = theData[1].tcp_ack || '-'; - var tcp_off = theData[1].tcp_off || '-'; - var tcp_res = theData[1].tcp_res || '-'; - var tcp_win = theData[1].tcp_win || '-'; - var tcp_urp = theData[1].tcp_urp || '-'; - var tcp_csum = theData[1].tcp_csum || '-'; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += "
TCPR1R0URGACKPSHRSTSYNFINSEQ#ACK#OFFSETRESWINURPCHECKSUM
" + tcpFlags[0] + "" + tcpFlags[1] + "" + tcpFlags[2] + "" + tcpFlags[3] + "" + tcpFlags[4] + "" + tcpFlags[5] + "" + tcpFlags[6] + "" + tcpFlags[7] + "" + tcp_seq + "" + tcp_ack + "" + tcp_off + "" + tcp_res + "" + tcp_win + "" + tcp_urp + "" + tcp_csum + "
"; - break; - - case "17": - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += "
UDPLENGTHCHECKSUM
" + theData[1].udp_len + "" + theData[1].udp_csum + "
"; - break; - } - - var p_hex = '', p_ascii = '', p_ascii_l = ''; - - // Data - if (!theData[2]) { - p_hex = "No Data Sent."; - p_ascii = "No Data Sent."; - } else { - p_pl = theData[2].data_payload; - p_length = theData[2].data_payload.length; - var b0 = 0; - - for(var i=0; i < p_length; i+=2) { - b0++; - t_hex = p_pl.substr(i,2); - t_int = parseInt(t_hex,16); - - if ((t_int < 32) || (t_int > 126)) { - p_hex += t_hex + " "; - p_ascii += "."; - p_ascii_l += "."; - } else if (t_int == 60) { - p_hex += t_hex + " "; - p_ascii += "<"; - p_ascii_l += "<"; - } else if (t_int == 62) { - p_hex += t_hex + " "; - p_ascii += ">"; - p_ascii_l += ">"; - } else { - p_hex += t_hex + " "; - p_ascii += String.fromCharCode(parseInt(t_hex, 16)); - p_ascii_l += String.fromCharCode(parseInt(t_hex, 16)); - } - - if ((b0 == 16) && (i < p_length)) { - p_hex += "
"; - p_ascii += "
"; - b0 = 0; - } - } - } - - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += ""; - row += "
DATAHEXASCII
" + p_hex + "" + p_ascii + "
ASCII" + p_ascii_l + "
"; - - } else { - - head += ""; - var p_ascii = "No Data Sent."; - // This needs to be more robust. - if (theData[2]) { - var tmp = h2s(theData[2].data_payload).split("\n"); - p_ascii = ''; - for (var i in tmp) { - p_ascii += "
" + tmp[i] + "
"; - } - - } - row += ""; - row += ""; - row += "
" + p_ascii + "
"; - } - - tbl += ""; - - // If we are not grouped we show the signature text - if ( sg != 0 ) { - tbl += "
"; - tbl += "
"; - tbl += "
↓
"; - tbl += "
"; - tbl += "
"; - tbl += "
"; - sigLookup(sg); - } - - // Comments and tags are done here - var tags = new Array(); - var eventTag = 'None.'; - var eventComment = theData[0].comment || 'None.'; - var src_tag = theData[0].srctag || '-'; - var dst_tag = theData[0].dsttag || '-'; - - // Populate tags array - if (src_tag != "-") { - var src_tags = src_tag.split(","); - $.each(src_tags, function(n,tag) { - var t = tags.indexOf(tag + ",s"); - if (t < 0) tags.push(tag + ",s"); - }); - } - - if (dst_tag != "-") { - var dst_tags = dst_tag.split(","); - $.each(dst_tags, function(n,tag) { - var t = tags.indexOf(tag + ",d"); - if (t < 0) tags.push(tag + ",d"); - }); - } - - if (tags.length > 0) eventTag = ''; - - tbl += "
COMMENTS
"; - tbl += "
" + eventComment + "
"; - tbl += "
TAGS
"; - tbl += "
" + eventTag + "
"; - if (PDATA != 0) { - tbl += "
DETAILS
"; - } else { - tbl += "
PAYLOAD
"; - } - tbl += head; - tbl += row; - tbl += ""; - $("#" + rowLoke).after(tbl); - $("#loader").hide(); - - // Turn off fade effect for large results - var rC = $(".d_row_sub1").length; - if ( rC <= 499 ) { - $(".d_row_sub1").fadeTo('fast','0.2'); - } - - // Populate tags - clearTags(); - for (var i=0; i < tags.length; i++) { - addTag(tags[i]); - } - - } - break; - } - // If event queue is off we need to reset this after load if b_ec_hot was - // the entry point - if ($('#rt').text() == 'off') rtbit = 0; - } - - // - // Object click handlers - // - - $(document).on("click", ".select,.ex_val,.sub_filter,.row_filter,.tof,.value_link,.nr_f", function(e) { - // Check if we are coming from a legit object - var prefix = $(this).data('type'); - if (prefix == "none") return; - - // Check if we are coming from a sane selection - var selLen = window.getSelection().toString().length; - if (selLen > 4) { - if (selLen < 255) { // Might need to change these based on how people use this - prefix = "zz"; - var suffix = window.getSelection().toString(); - var re = /\s/g; - var NOK = re.exec(suffix); - if (NOK) return; - } else { - return; - } - } else { - var suffix = $(this).text(); - } - - var mX = e.pageX; - var mY = e.pageY; - - var colour = $(this).data('col') || "FFFFFF"; - var tfocus = "#search"; - switch (prefix) { - case 'ip': - hItemAdd(suffix); - var sord = $(this).data('sord'); - mkPickBox(prefix,suffix,sord,colour,mX,mY); - break; - case 'spt': - case 'dpt': - hItemAdd(suffix); - mkPickBox(prefix,suffix,0,colour,mX,mY); - break; - case 'cc': - case 'scc': - case 'dcc': - var cc = $(this).data('value'); - hItemAdd(cc); - mkPickBox(prefix,cc,suffix,colour,mX,mY); - break; - case 'cmt': - suffix = $(this).data('comment'); - $("#rt").text("off"); - $("#rt").attr('class','tvalue_off'); - $('#search').val(prefix + " " + suffix); - hItemAdd(suffix); - if ($('#cat_box').css('display') != 'none') { - $('#ico01').click(); - } - $('.b_update').click(); - break; - case 'cmt_c': - $('.cat_msg_txt').val(suffix); - hItemAdd(suffix); - tfocus = ".cat_msg_txt"; - break; - case 'fil': - var fil = $(this).data('value'); - $('#search').val(fil); - hItemAdd(fil); - if ($('#fltr_box').css('display') != 'none') { - $('#ico04').click(); - } - $('.b_update').click(); - break; - case 'sid': - var value = $(this).data('value'); - hItemAdd(suffix); - mkPickBox(prefix,value,suffix,colour,mX,mY); - break; - case 'st': - var suffix = $(this).attr('id').split('-')[1]; - $('#search').val(prefix + " " + suffix); - // RT must be off to return anything - $('#rt').attr('class','tvalue_off'); - $('#rt').text('off'); - rtbit = 0; - $('.b_update').click(); - break; - case 'el': - var suffix = $(this).data('value'); - mkPickBox(prefix,suffix,0,colour,mX,mY); - break; - case 'zz': - hItemAdd(suffix); - mkPickBox(prefix,suffix,0,colour,mX,mY); - break; - } - }); - - // - // Picker Box - // - - function mkPickBox(prefix,suffix,rsuffix,colour,mX,mY) { - var doexternals = "yes"; - var objhex = s2h(suffix); - var tbl = '', row = ''; - // Local stuff first - switch (prefix[prefix.length - 1]) { - case "c": - row += ":: SRC or DST"; - row += ":: SRC"; - row += ":: DST"; - row += ":: SEARCH"; - break; - case "p": - row += ":: SRC or DST"; - row += ":: SRC"; - row += ":: DST"; - row += ":: ADD / REMOVE TAG"; - if ($('.sigtxt')[0]) { - row += ":: HISTORY"; - } - row += ":: SEARCH"; - row += ":: COLOUR  "; - row += ""; - row += "apply"; - row += "apply all"; - row += ""; - break; - case "t": - row += ":: SRC"; - row += ":: DST"; - row += ":: SEARCH"; - break; - case "d": - row += ":: SIGNATURE"; - if ($('.sigtxt')[0]) { - row += ":: HISTORY"; - } - row += ":: SEARCH"; - break; - case "l": - row += ":: COLOUR  "; - row += ""; - row += "update"; - doexternals = "no"; - break; - case "z": - row += ":: SEARCH"; - break; - } - - // If applicable populate externals - if (doexternals == "yes") { - $('.f_row').each(function() { - var ct = $(this).data('type'); - if (ct == 'url') { - var alias = $(this).data('alias'); - var name = $(this).data('name'); - var url = $(this).data('filter'); - row += ""; - row += "" + name + ""; - row += ""; - } - }); - } - - tbl += ""; - tbl += row; - tbl += "
"; - - var boxlabel = suffix; - - // Use more descriptive names where possible - var re = /(sid|cc|scc|dcc)/; - var OK = re.exec(prefix); - if (OK) { - var boxlabel = rsuffix; - } - - if (boxlabel.length > 24) { - boxlabel = boxlabel.substring(0,24); - boxlabel += ".."; - } - - $('#pickbox_label').text(boxlabel).css('font-weight','normal').data('sord', rsuffix); - - if ($('#tlpick')[0]) $('#tlpick').remove(); - $(".pickbox_tbl").append(tbl); - $('.pickbox').fadeIn('fast'); - - // Colour Picker - $("#menucol").spectrum({ - showInput: true, - className: "full-spectrum", - showInitial: true, - showPalette: true, - showSelectionPalette: true, - maxPaletteSize: 6, - preferredFormat: "hex", - localStorageKey: "spectrum.demo", - move: function (color) {}, - show: function () {}, - beforeShow: function () {}, - hide: function () {}, - change: function() {}, - palette: [ - ['rgb(217,217,217)','rgb(189,189,189)','rgb(150,150,150)','rgb(99,99,99)','rgb(37,37,37)'], - ['rgb(199,233,192)','rgb(161,217,155)','rgb(116,196,118)','rgb(49,163,84)','rgb(0,109,44)'], - ['rgb(218,218,235)','rgb(188,189,220)','rgb(158,154,200)','rgb(117,107,177)','rgb(84,39,143)'], - ['rgb(198,219,239)','rgb(158,202,225)','rgb(107,174,214)','rgb(49,130,189)','rgb(8,81,156)'], - ['rgb(254,217,118)','rgb(254,178,76)','rgb(253,141,60)','rgb(240,59,32)','rgb(189,0,38)'] - ] - }); - } - - // Pickbox click events - $(document).on('click', '.p_row', function() { - if ($('.tagbox').css('display') != 'none') $('.tagcancel').click(); - var ctype = $(this).data('type'); - var alias = $(this).data('alias'); - var args = $('#tlpick').data('val'); - switch(ctype) { - case "l": - $('.pickbox').fadeOut('fast'); - $('#search').val(alias + " " + args); - $('.b_update').click(); - break; - case "r": - $('.pickbox').fadeOut('fast'); - var url = h2s($(this).data('url')).replace("${var}", args); - window.open(url); - break; - case "t": - $('.tagbox').fadeIn('fast'); - $('.taginput').focus(); - break; - case "s": - $('.pickbox').fadeOut('fast', function() {; - $('#ico05').click(); - }); - $('.srch_txt').val(args); - break; - case "h": - doHistory(args); - $('.pickbox').fadeOut('fast'); - break; - default: return; - } - }); - - // - // Tags - // - - // Truncate - function truncTag(tag,len) { - if (tag.length > len) tag = tag.substring(0,len) + ".."; - return tag; - } - - // Filter results or add as new - $(document).on('click', '.tag', function() { - var tag = $(this).data('val'); - if($('.taginput').is(":visible")) { - $('.taginput').val(tag); - $('.taginput').focus(); - } else { - $('#search').val('tag ' + tag); - $('.b_update').click(); - } - }); - - // Remove individual tags on "(X)" click via payload area - $(document).on('mouseenter', '.tag_d, .tag_s', function() { - var tag = $(this).data('val'); - if ($(".tag_x")[0]) return; - var dw = $(this).width() - 5 + "px"; - $(this).append("
X
"); - $(".tag_x").css("margin-left", dw); - $(".tag_x").fadeIn("slow"); - - }); - - $(document).on('mouseleave', '.tag_d, .tag_s', function() { - $('.tag_x').remove(); - }); - - $(document).on('click', '.tag_x', function() { - var tag = $(this).parent().data("val"); - var obj = $(this).parent().data("obj"); - $(this).parent().remove(); - var len = $("#tag_area").text().length; - if (len == 0) $("#tag_area").append("None."); - //doTag(s2h(obj),tag,'rm'); - }); - - // Fire tag add on enter - $('.taginput').keypress(function(e) { - if (!e) e=window.event; - key = e.keyCode ? e.keyCode : e.which; - if (key == 13) $('.tagok').click(); - }); - - // Close tag entry - $(document).on('click', '.tagcancel', function() { - $('.taginput').val(''); - $('.tagbox').fadeOut('fast'); - }); - - // Add a tag - $(document).on('click', '.tagok', function() { - var tag = $('.taginput').val(); - var obj = $('#pickbox_label').text(); - var re = /^[?a-zA-Z0-9][\s{1}\w-\.]*$/; - var OK = re.exec(tag); - if (OK) doTag(s2h(obj),tag,'add'); - }); - - // Remove a tag - $(document).on('click', '.tagrm', function() { - var tag = truncTag($('.taginput').val(),20); - var obj = $('#pickbox_label').text(); - doTag(s2h(obj),tag,'rm'); - $(".tag" + ":contains('" + tag + "')").remove(); - $('.tagcancel').click(); - }); - - // Display or Toggle tags - function addTag(tag) { - // If we entered from payload we have some additional info - if ($('#eview_sub2')[0]) { - var longTag = tag.split(",")[0]; - var theClass = tag.split(",")[1]; - var t_tag = truncTag(longTag,20); - } else { - var t_tag = truncTag(tag,20); - } - - // Hide empty - $('.tag_empty').hide(); - - // Check if tag exists - var tag_exists = 0; - $('.tag').each(function() { - if ($(this).text() == t_tag) { - $(this).addClass('tag_active'); - tag_exists = 1; - } - }); - - // Add tag to left pane - if (tag_exists == 0) { - var newTag = "
" + t_tag + "
"; - $('#tg_box').prepend(newTag); - } - - // If we have the payload open, add here as well - if ($('#eview_sub2')[0]) { - if($('#pickbox_label').is(":visible")) { - theClass = $('#pickbox_label').data('sord')[0]; - } - // Remove placeholder - if ($('#tag_none')[0]) $('#tag_none').remove(); - var newTag = "
" + t_tag + "
"; - $('#tag_area').prepend(newTag); - } - - } - - function doTag(obj,tag,op) { - var urArgs = "type=19&obtype=tag&object=" + obj + "&value=" + tag + "&op=" + op; - $(function(){ - $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); - }); - - function cb22(data){ - eval("theData=" + data); - if (theData.msg != '') { - alert(theData.msg); - } else { - if (op != 'rm') addTag(tag); - $('.tagcancel').click(); - } - } - } - - // Colours - $(document).on('click', '.csave', function() { - var obtype = $(this).data('obtype'); - var object = $(this).data('object'); - var colour = $('#menucol').val().replace(/#/,"").toUpperCase(); - var op = "add"; - var re = /^([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/; - var OK = re.exec(colour); - if (!OK) return; - // Single or multiple? - if (obtype == "src" || obtype == "dst") { - var vr = new Array(); - $("." + obtype).each(function() { - var v = $(this).text(); - var re = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; - var OK = re.exec(v); - if (OK) { - var t = vr.indexOf(v); - if (t < 0) vr.push(v); - } - }); - object = vr.toString(); - } - - var urArgs = "type=19&obtype=" + obtype + "_c&object=" + object + "&value=" + colour + "&op=" + op; - $(function(){ - $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); - }); - - function cb22(data){ - eval("theData=" + data); - if (theData.msg != '') { - alert(theData.msg); - } else { // We should be good.. - var curObject = $('#pickbox_label').text(); - if (obtype == "el") { - var html = "
" + colour; - $('#el_' + curObject).html(html); - $('#el_' + curObject).data('col', colour); - } else { - $(".sub_filter:contains(" + curObject + ")").each(function() { - $(this).find('.object').css('background-color', '#' + colour).parent().data('col', colour); - }); - } - $('.pickbox').fadeOut('fast'); - } - } - }); - - $(document).on('click', '.pickbox_close', function() { - $('.tagcancel').click(); - $('.pickbox').fadeOut('fast'); - }); - - // - // Object History - // - - function hItemAdd(item) { - var itemTitle = item; - // Truncate - if (item.length > 33) { - itemTitle = item.substring(0,33) + ".."; - } - // Remove empty message - $('.history_empty').hide(); - - // If the item doesn't exist, add it. Otherwise, we start counting. - if ($(".h_item:contains('" + itemTitle + "')").length > 0) { - var oc = $(".h_item:contains('" + itemTitle + "')").data('n'); - var nc = Number(oc) + 1; - var bg = '#c9c9c9'; - var fn = 'normal'; - if (nc <= 3) { - bg = '#000'; - } else if (nc > 3) { - bg = '#cc0000'; - fn = 'bold'; - } - - $(".h_item:contains('" + itemTitle + "')").css('color', bg); - $(".h_item:contains('" + itemTitle + "')").css('font-weight', fn); - $(".h_item:contains('" + itemTitle + "')").data('n',nc); - $(".h_item:contains('" + itemTitle + "')").text(itemTitle + "(" + nc + ")"); - } else { - var toAdd = " " + itemTitle + ""; - $('#h_box').prepend(toAdd); - } - } - - if (!$('.h_item')[0]) { - $('.history_empty').show(); - } - - // Alt mappings for icons - - $.alt('1', function() { - $("#ico01").click(); - }); - $.alt('2', function() { - $("#ico02").click(); - }); - $.alt('3', function() { - $("#ico03").click(); - }); - $.alt('4', function() { - $("#ico05").click(); - }); - $.alt('5', function() { - $("#ico04").click(); - }); - - // - // Event classification - // - - // Use function keys to trigger status buttons - $(document).keydown(function(event){ - - function stopOthers() { - event.originalEvent.keyCode = 0; - event.preventDefault(); - event.stopPropagation(); - } - - switch (event.keyCode) { - case 112: stopOthers(); $('#b_class-11').click(); break; - case 113: stopOthers(); $('#b_class-12').click(); break; - case 114: stopOthers(); $('#b_class-13').click(); break; - case 115: stopOthers(); $('#b_class-14').click(); break; - case 116: stopOthers(); $('#b_class-15').click(); break; - case 117: stopOthers(); $('#b_class-16').click(); break; - case 118: stopOthers(); $('#b_class-17').click(); break; - case 119: stopOthers(); $('#b_class-1').click(); break; - case 120: stopOthers(); $('#b_class-2').click(); break; - } - }); - - // Comment window status buttons - $(document).on("click", "#cw_buttons", function(event) { - var newclass = $(event.target).data('n'); - if (newclass == 0) { - $('#b_class-' + newclass).click(); - } else { - $('#b_class-' + newclass).click(); - } - }); - - // Highlight colour for selected events - var hlcol = "#FFFFE0"; - var hlhov = "#FDFDD6"; - - // Individual selects - var clickOne = 0, clck1 = 0, clck2 = 0; - $(document).on("click", ".chk_event", function(event) { - $("#tl3b").trigger('update'); - var clickTwo = this.id.split("_"); - if (Number(clickOne[1]) > Number(clickTwo[1])) { - clck1 = clickTwo[1]; - clck2 = clickOne[1]; - } else { - clck1 = clickOne[1]; - clck2 = clickTwo[1]; - } - - if (event.shiftKey) { - if (clck1 != clck2) { - $("#s" + clck1).nextUntil("#s" + clck2).find(".chk_event").prop("checked", true); - $("#s" + clck1).nextUntil("#s" + clck2).css("background-color", hlcol); - $("#s" + clck1).nextUntil("#s" + clck2).hover( - function(){$(this).css("background-color", hlhov)}, - function(){$(this).css("background-color", hlcol)}); - clickOne = 0, clck1 = 0, clck2 = 0; - } - } - - // Update class_count - $("#class_count").html($(".chk_event:checked").length); - if ($("#ca1:checked").length > 0) { - $("#ca1").prop("checked",false); - } - clickOne = this.id.split("_"); - - if ($(this).prop("checked") == true) { - $("#s" + clickTwo[1]).css("background-color", hlcol); - $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", hlhov)}, - function(){$(this).css("background-color", hlcol)}); - } else { - $("#s" + clickTwo[1]).css("background-color", "transparent"); - $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", "#f4f4f4")}, - function(){$(this).css("background-color", "transparent")}); - } - }); - - // Select all (2) - $(document).on("click", "#ca1", function(event) { - var chkLen = $("#ca1:checked").length; - switch(chkLen) { - case 0: - $(".chk_event").prop("checked",false); - $("#ca0").prop("checked",false); - $(".d_row_sub1").css("background-color", "transparent"); - $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, - function(){$(this).css("background-color", "transparent")}); - break; - default: - $(".chk_event").each(function() { - if ($(this).prop("disabled") == false) { - $(this).prop("checked",true); - } - }); - $(".d_row_sub1").css("background-color", hlcol); - $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, - function(){$(this).css("background-color", hlcol)}); - $("#ca0").prop("checked",true); - break; - } - - if ($(".eview_sub1")[0]) { - // Update class_count - $("#class_count").html($(".chk_event:checked").length); - } - - }); - - // Select all (2a) - clean this up, the above is almost identical - $(document).on("click", "#ca2", function(event) { - var chkLen = $("#ca2:checked").length; - switch(chkLen) { - case 0: - $(".chk_event").prop("checked",false); - $("#ca2").prop("checked",false); - $(".d_row_sub1").css("background-color", "transparent"); - $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, - function(){$(this).css("background-color", "transparent")}); - break; - default: - $(".chk_event").each(function() { - if ($(this).prop("disabled") == false) { - $(this).prop("checked",true); - } - }); - $(".d_row_sub1").css("background-color", hlcol); - $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, - function(){$(this).css("background-color", hlcol)}); - $("#ca2").prop("checked",true); - break; - } - // Update class_count - $("#class_count").html($(".chk_event:checked").length); - }); - - // Class button click - $(document).on("click", "[id*=\"b_class-\"]", function() { - // We only fire if something is selected - var chkLen = parseInt($(".chk_event:checked").length + $(".chk_all:checked").length); - var intclass = $(this).attr('id').split("-"); - if (chkLen > 0 && intclass[1] != 0) { - eClass(this,intclass[1]); - } - }); - - function eClass(caller,intclass) { - // The sid.cid values - var scid= "", scidlist = "", ecls = 0; - if ($(".eview_sub1")[0] || $("#ca2")[0]) { - $(".chk_event:checked").each(function() { - if ($(this).data('eclass') == 0) { - ecls++; - } - scid += $(this).val() + ","; - }); - scidlist = scid.replace(/,$/, ""); - } else { - ecls = $(".d_row_active").find(".b_ec_hot").text(); - scidlist = $("#ca0").data("scid"); - } - - // Was there a message? - var msg = "none"; - if ($(".cat_msg_txt").val().length != 0) { - msg = $(".cat_msg_txt").val(); - } - - if ($('#cat_box').css('display') != 'none') { - $('#ico01').click(); - } - - // We are now ready to class - var catdata = intclass + "|||" + msg + "|||" + scidlist; - var urArgs = "type=" + 9; - $(function(){ - $.post(".inc/callback.php?" + urArgs, { catdata: catdata } ,function(data){cb9(data)}); - }); - - function cb9(data){ - eval("catRaw=" + data); - catDbg = catRaw.dbg; - if (catDbg == "0") { - - var curtotalrtcount = Number(ecls); - // Working on grouped events - if ($("#gr").text() == "on") { - curclasscount = Number($("#class_count").text()); - var curtotalparentcount = $(".d_row_active").find(".b_ec_hot").text(); - // Do we have queued events? - if (curtotalparentcount > 0) { - - // Are we working on queued events? - if (curtotalrtcount > 0) { - curclasscount = curtotalrtcount; - } else { - curclasscount = 0; - } - // Adjust the parent count - newparentcount = parseInt(curtotalparentcount - curclasscount,10); - $(".d_row_active").find(".b_ec_hot").text(newparentcount); - - if (newparentcount == 0) { - $(".d_row_active").find(".b_ec_hot").parent().attr('class','row'); - $(".d_row_active").find(".b_ec_hot").attr('class','b_ec_cold'); - } - - // If we are working within the child, adjust accordingly - if ($(".eview_sub1")[0]) { - // How many are in the child - curtotalchildcount = $(".d_row_sub_active").find(".b_ec_hot").text(); - - // Adjust the child count - newchildcount = parseInt(curtotalchildcount - curclasscount,10); - $(".d_row_sub_active").find(".b_ec_hot").text(newchildcount); - if (newchildcount == 0) { - $("#ca1").prop("disabled",true); - $(".d_row_sub_active").find(".b_ec_hot").parent().attr('class','sub'); - $(".d_row_sub_active").find(".b_ec_hot").attr('class','b_ec_cold'); - } - // Otherwise we were called from the parent - } else { - $(".d_row_sub").find(".b_ec_hot").parent().attr('class','sub'); - $(".d_row_sub").find(".b_ec_hot").text(0); - $(".d_row_sub").find(".b_ec_hot").attr('class','b_ec_cold'); - $("#ca0").prop("disabled",true); - } - lastclasscount = newparentcount; - } - - // Lastly, update class_count - if (rtbit == 1 || curtotalrtcount > 0 || $("#eview_sub")[0]) { - $("#class_count").html(0); - } else { - $("#class_count").html($(".d_row_active").find(".b_ec_total").text()); - } - - // Working on ungrouped events - } else { - $("#class_count").html(lastclasscount); - } - - // What the new classification is - selClass = $(caller).data("cn"); - newClass = "a_" + selClass; - - // Change visible class and disable if RT - // If we are RT ungrouped, we just remove - if ($('#rt').text() == 'on' && $("#ca2")[0]) { - $(".chk_event:checked").each(function() { - var pid = $(this).attr("id").split("_"); - var nid = parseInt(Number(pid[1]) + 1); - // Remove any open payload or TX panes - if ($("[id^=eview_]")[0]) { - $("[id^=eview_]").remove(); - $(".d_row_sub1").css('opacity','1'); - } - // Remove the row - $("#s" + pid[1]).fadeOut('fast', function() { - $("#s" + pid[1]).remove(); - }); - }); - - // Update table (for sorter) - $("#tl3b").trigger('update'); - } else { - // If we are RT and all events are classed we just remove - if ($('#rt').text() == 'on' && $(".d_row_active").find(".b_ec_hot").text() == 0) { - $("#active_eview").remove(); - $(".d_row_active").fadeOut('slow', function (event) { - $(".d_row_active").remove(); - var newsigtotal = "-"; - var sigtotal = $("#esignature").text(); - if (sigtotal > 0) { - newsigtotal = parseInt(sigtotal - 1); - } - $("#esignature").text(newsigtotal); - }); - $(".d_row").css('opacity','1'); - } else { - $(".chk_event:checked").each(function() { - var n = this.id.split("_"); - $("#class_box_" + n[1]).attr('class', newClass); - $("#class_box_" + n[1]).text(selClass); - if (curtotalparentcount > 0) { - $(this).prop("disabled",true); - } - }); - } - $(".d_row_sub1").css("background-color", "#fafafa"); - $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, - function(){$(this).css("background-color", "#fafafa")}); - } - - // Uncheck everything - $(".chk_event").prop("checked", false); - $(".chk_all").prop("checked", false); - // Remove these scids from the L1 scidlist - if ($("#ca0")[0] && rtbit == 1) { - var cur_scidlist = scidlist.split(','); - var active_scidlist = $("#ca0").data("scid"); - for (var i = 0; i < cur_scidlist.length; i++) { - active_scidlist = active_scidlist.replace(cur_scidlist[i],''); - } - active_scidlist = active_scidlist.replace(/,{2,}/g,','); - active_scidlist = active_scidlist.replace(/(^,|,$)/g,''); - $("#ca0").data("scid", active_scidlist); - } - catMsg(scidlist.split(',').length, curtotalrtcount); - } else { - catMsg(0); - } - } - } - - function catMsg(count, rtcount) { - switch (count) { - default: - var ess = ''; - if ( count > 1 ) ess = 's'; - - var numrows = Number($('.d_row').length + $('.d_row_sub1').length); - var newboxtotal = 0, newcatcount = 0; - newboxtotal = parseInt($("#qtotal").text() - rtcount); - $("#qtotal").text(newboxtotal); - - // If we are just rt update Total boxes as we go - if ($("#ca2")[0]) { // We are ungrouped - newcatcount = parseInt($("#cat_count").text() - count); - if (newcatcount == 0) { - newView("u"); - } else { - $("#cat_count").text(newcatcount); - } - } - - if (numrows == 0) { - newView("u"); - } - - var msg = count + " event" + ess + " categorized"; - clearTags(); - break; - } - - $("span.class_msg").text(msg); - $("span.class_msg").fadeIn('slow', function() { - setTimeout(function(){ - $(".class_msg").fadeOut('slow'); - }, 3000); - }); - } - - // Load summary tab - function loadSummary() { - var limit = 10; - if ($('#wm0')[0]) { - doMap("redraw"); - } else { - doMap("draw"); - } - mkSummary("signature",limit); - mkSummary("srcip",limit); - mkSummary("dstip",limit); - mkSummary("srcpt",limit); - mkSummary("dstpt",limit); - mkSummary("srccc",limit); - mkSummary("dstcc",limit); - } - - // Toggle summary section - $(document).on("click", ".hidepane", function(e) { - $('#topsignature').toggle(); - }); - - // Summary tab - function mkSummary(box,limit) { - var theWhen = getTimestamp(); - var theSensors = s2h('empty'); - var theFilter = mkFilter(); - // See if we are filtering by sensor - if ($('.chk_sen:checked').length > 0) { - var active_sensors = "AND event.sid IN("; - var iter = $('.chk_sen:checked').length; - $('.chk_sen:checked').each(function() { - active_sensors += "'" + $(this).val() + "',"; - }); - active_sensors = active_sensors.replace(/,+$/,''); - active_sensors += ")"; - theSensors = s2h(active_sensors); - } - - var ldr = "
"; - $('#ov_' + box + '_sl').prepend(ldr); - $('#top' + box).fadeTo('fast', 0.2); - switch (box) { - case "srcip": - var cbArgs = "srcip"; - var qargs = "ip-src"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); - }); - break; - case "dstip": - var cbArgs = "dstip"; - var qargs = "ip-dst"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); - }); - break; - case "srcpt": - var cbArgs = "srcpt"; - var qargs = "pt-src"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); - }); - break; - case "dstpt": - var cbArgs = "dstpt"; - var qargs = "pt-dst"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); - }); - break; - case "signature": - var qargs = "sig-sig"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb16(data)}); - }); - break; - case "srccc": - var cbArgs = "srccc"; - var qargs = "cc-src"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); - }); - break; - case "dstcc": - var cbArgs = "dstcc"; - var qargs = "cc-dst"; - var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); - }); - break; - } - - // IP and Country - function cb15(data,cbArgs){ - var ch = "SRC"; - var wip = "d"; - if (cbArgs[0] == "s") ch = "DST", wip = "s"; - eval("raw=" + data); - var tbl = '', head = '', row = ''; - head += ""; - head += "COUNT"; - head += "%TOTAL"; - head += "#SIG"; - head += "#" + ch + ""; - if (cbArgs[3] == "c") { - head += "COUNTRY"; - head += "#IP"; - } else { - head += "IP"; - head += "COUNTRY"; - } - head += ""; - - var eventsum = raw[raw.length - 1].n || 0; - var records = raw[raw.length - 1].r || 0; - if (records == 0) { - row = "No result."; - $("#ov_" + cbArgs + "_sl").text(""); - } - for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); - row += ""; - row += "" + cnt + ""; - row += "" + per + "%"; - row += "" + sigs + ""; - row += "" + ip2 + ""; - - if (cbArgs[3] == "c") { - row += ""; - row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; - row += "" + ip + ""; - } else { - row += "
" + ip + ""; - row += ""; - row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; - } - row += ""; - row += "
"; - } - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); - $("#ov_" + cbArgs + "_sl").after(tbl); - $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); - mkSlider("ov_" + cbArgs + "_sl", i, records); - } - - // Ports - function cb17(data,cbArgs){ - eval("raw=" + data); - var tbl = '', head = '', row = ''; - head += ""; - head += "COUNT"; - head += "%TOTAL"; - head += "#SIG"; - head += "#SRC" - head += "#DST"; - head += "PORT"; - head += ""; - - var eventsum = raw[raw.length - 1].n || 0; - var records = raw[raw.length - 1].r || 0; - if (records == 0) { - row = "No result."; - $("#ov_" + cbArgs + "_sl").text(""); - } - for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); - row += ""; - row += "" + cnt + ""; - row += "" + per + "%"; - row += "" + sigs + ""; - row += "" + src + ""; - row += "" + dst + ""; - row += "" + port + ""; - row += ""; - row += "
"; - } - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); - $("#ov_" + cbArgs + "_sl").after(tbl); - $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); - mkSlider("ov_" + cbArgs + "_sl", i, records); - } - // Signature - function cb16(data){ - eval("raw=" + data); - var tbl = '', head = '', row = ''; - head += ""; - head += "COUNT"; - head += "%TOTAL"; - head += "#SRC"; - head += "#DST"; - head += "SIGNATURE"; - head += "ID"; - head += ""; - - var eventsum = raw[raw.length - 1].n || 0; - var records = raw[raw.length - 1].r || 0; - if (records == 0) { - row = "No result."; - $("#ov_signature_sl").text(""); - $("#ovestat").html("(No events)"); - } else { - $("#ovestat").html("(" + eventsum + " events)"); - } - for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); - row += ""; - row += "" + cnt + ""; - row += "" + per + "%"; - row += "" + src + ""; - row += "" + dst + ""; - row += "" + sig + ""; - row += "" + sid + ""; - row += ""; - row += "
"; - } - - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - if ($('#topsignature')[0]) $('#topsignature').remove(); - $("#ov_signature_sl").after(tbl); - $("#ov_signature_msg").html("viewing " + i + " of " + records + " results"); - mkSlider("ov_signature_sl", i, records); - } - } - - $(".ovsl").mouseup(function() { - var section = $(this).attr('id'); - var base = section.split("_")[1]; - var limit = Number($("#" + section + "_lbl").text()); - if (limit > 0) mkSummary(base, limit); - }); - - // - // Views tab - // - - function loadViews() { - $('.db_links').show(); - if (!$("#db_view_cont")[0]) mkView(); - } - - // Link handlers - $(document).on('click', '.db_link', function() { - $('.db_link').each(function() { - if ($(this).data('state') == '1') { - $(this).removeClass('db_link_active'); - $(this).data('state', '0'); - } - }); - $(this).data('state', '1'); - mkView(); - }); - - $(document).on('click', '.db_type', function() { - $('.db_type').each(function() { - if ($(this).data('state') == '1') { - $(this).removeClass('db_type_active'); - $(this).data('state', '0'); - } - }); - $(this).data('state', '1'); - mkView(); - }); - - $(document).on('click','.db_save', function() { - - }); - - // Create the view - function mkView() { - $('#db_view_cont,#hp_info').remove(); - if (!$("#db_view_ldr")[0]) { - var view = 'ip'; - $('.db_link').each(function() { - if ($(this).data('state') == '1') { - $(this).addClass('db_link_active'); - view = $(this).data('val'); - } - }); - - var type = 'sk'; - $('.db_type').each(function() { - if ($(this).data('state') == '1') { - $(this).addClass('db_type_active'); - type = $(this).data('type'); - } - }); - - var theWhen = getTimestamp(); - var theSensors = s2h('empty'); - var theFilter = mkFilter(); - // See if we are filtering by sensor - if ($('.chk_sen:checked').length > 0) { - var active_sensors = "AND event.sid IN("; - var iter = $('.chk_sen:checked').length; - $('.chk_sen:checked').each(function() { - active_sensors += "'" + $(this).val() + "',"; - }); - active_sensors = active_sensors.replace(/,+$/,''); - active_sensors += ")"; - theSensors = s2h(active_sensors); - } - - var ldr = "
"; - $('.db_view').after(ldr); - var qargs = view + "-" + type; - var urArgs = "type=16&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,type)}); - }); - - function cb17(data,type) { - eval("viewData=" + data); - var records = viewData.records; - if ($('#db_view_cont')[0]) $('#db_view_cont').remove(); - if (records > 0) { - $('.db_view').after("
"); - switch (type) { - case 'sk': - var w = $(window).width(); - var h = viewData.links.length * 12; - if (h < 100) h = 100; - mkSankey("db_view_cont",viewData,w,h); - break; - } - } else { - $('.db_view').after("
The query returned no results.
"); - } - $('#db_view_ldr').remove(); - } - } - } - - // Make a map - function doMap() { - theWhen = getTimestamp(); - var theFilter = mkFilter(); - var working = "Working
"; - - $('#wm0').html(working); - - var urArgs = "type=" + 10 + "&filter=" + theFilter + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb10(data)}); - }); - - function cb10(data){ - eval("mapRaw=" + data); - try { - var mapDetail = $.parseJSON("{" + mapRaw.all + "}"); - var srcc = mapRaw.srcc; - var srce = mapRaw.srce; - var dstc = mapRaw.dstc; - var dste = mapRaw.dste; - var allc = mapRaw.allc; - var alle = mapRaw.alle; - } - catch(e) { - var mapDetail = "{\"\"}"; - } - - // What is our current event total? - var esum = $('#event_sum').val(); - var w = $(window).width() - 72; - var h = w / 2.7 ; - $("#ov_map").html("
"); - $('#wm0').vectorMap({ - map: 'world_mill_en', - color: '#f4f3f0', - backgroundColor: '#CFE1FC', - zoomOnScroll: false, - onRegionClick: function(event, code){ - hItemAdd(code); - $('#search').val("cc" + " " + code); - $('#search').focus(); - }, - series: { - regions: [{ - values: mapDetail, - scale: ['#ffffff', '#000000'], - normalizeFunction: 'polynomial' - }] - }, - onRegionLabelShow: function(e, el, code){ - if (mapDetail[code]) { - var eper = parseFloat(mapDetail[code]/esum*100).toFixed(3); - el.html(el.html() + ' (' + mapDetail[code] + ' Events ' + eper + '% of Total)'); - } else { - el.html(el.html()); - } - } - }); - - var stats = "("; - stats += allc + " distinct countries)"; - $("#ovmapstat").html(stats); - } - } - - // Redraw map - $(document).on("click", "#map_src, #map_dst", function() { - doMap($(this).attr('id').split("_")[1]); - }); - - // - // History - // - - function doHistory(object) { - $('#loader').show(); - var urArgs = "type=" + 21 + "&object=" + s2h("aa" + object) + "&ts=" + theWhen; - $(function(){ - $.get(".inc/callback.php?" + urArgs, function(data){cb21(data)}); - }); - - function cb21(data){ - eval("chartData=" + data); - var r1 = chartData.r1; - var r2 = chartData.r2; - var sum = 0; - if (r1 > 0) { - mkHeatMap(".ev_hm",chartData.start,chartData.rows1,object); - $('#obhist_sig').remove(); - if (r2 > 0) { - - for (var i=0; i < r2; i++) { - sum += Number(chartData.rows2[i].value); - } - - var tbl = '', head = '', row = ''; - head += ""; - head += "COUNT"; - head += "%TOTAL"; - head += "SIGNATURE"; - head += ""; - row += ""; - - for (var i=0; i < r2; i++) { - - var cnt = chartData.rows2[i].value || "-"; - var sig = chartData.rows2[i].label || "-"; - var sid = chartData.rows2[i].sid || "-"; - var per = 0; - if (sum > 0) var per = parseFloat(cnt/sum*100).toFixed(2); - var tsg = truncTag(sig,60); - - row += ""; - row += "" + cnt + ""; - row += "" + per + "%"; - row += "" + tsg + ""; - row += "" - row += "
"; - } - - row += ""; - tbl += ""; - tbl += head; - tbl += row; - tbl += "
"; - if ($('#obhist_sig')[0]) $('#obhist_sig').remove(); - $(".ev_py").append(tbl); - } - } else { - return; - } - if ($(".eview_charts")[0]) $('.eview_charts').slideDown('slow'); - $("#loader").hide(); - } - } -// The End. -}); diff --git a/auth/native/squert/login.php b/auth/native/squert/login.php deleted file mode 100644 index 89aedee..0000000 --- a/auth/native/squert/login.php +++ /dev/null @@ -1,158 +0,0 @@ - -// -// This program is free software: you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation, either version 3 of the License, or -// (at your option) any later version. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License -// along with this program. If not, see . -// -// - -include_once '.inc/config.php'; - -$username = $password = $err = ''; -$focus = 'username'; -session_set_cookie_params(0, NULL, NULL, NULL, TRUE); - -function cleanUp($string) { - if (get_magic_quotes_gpc()) { - $string = stripslashes($string); - } - $string = mysql_real_escape_string($string); - return $string; -} - -if ($_SERVER['REQUEST_METHOD'] == 'POST'){ - $username = $_REQUEST['username']; - $password = $_REQUEST['password']; - // sso - //$username = $_SERVER['PHP_AUTH_USER']; - //$password = $_SERVER['PHP_AUTH_PW']; - - $ua = $_SERVER['HTTP_USER_AGENT']; - $rqt = $_SERVER['REQUEST_TIME']; - $rqaddr = $_SERVER['REMOTE_ADDR']; - $max = mt_getrandmax(); - $rqt .= mt_rand(0,$max); - $rqaddr .= mt_rand(0,$max); - $ua .= mt_rand(0,$max); - $cmpid = $rqt . $rqaddr . $ua; - $id = md5($cmpid); - // PDO prepared statements - try { - // first connect to database with the PDO object. - $dbpdo = new PDO("mysql:host=$dbHost;dbname=$dbName;charset=latin1", "$dbUser", "$dbPass", [ - PDO::ATTR_EMULATE_PREPARES => false, - PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => false, - PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION - ]); - } catch(PDOException $e){ - // if connection fails, log PDO error. - error_log("Error connecting to mysql: ". $e->getMessage()); - } - - if (isset($dbpdo)) { - // prepare statement - $statement = "SELECT * FROM user_info WHERE username = :user"; - $query = $dbpdo->prepare("$statement"); - // build parameters for prepared statement - $params = [":user" => "$username"]; - // execute the prepared statement and pass it params - $query->execute($params); - // fetch the data - while ($row = $query->fetch(PDO::FETCH_NUM)) { - $userName = $row[1]; - $lastLogin = $row[2]; - $userHash = $row[3]; - $userEmail = $row[4]; - $userType = $row[5]; - $userTime = $row[6]; - $tzoffset = $row[7]; - } - - // if $username was found in database, then check password - if ( isset($userName) && $username == $userName) { - // The first 2 chars are the salt - $theSalt = substr($userHash, 0,2); - - // The remainder is the hash - $theHash = substr($userHash, 2); - - // Now we hash the users input - $testHash = sha1($password . $theSalt); - - // Does it match? If yes, start the session. - if ($testHash === $theHash) { - session_start(); - - // Protect against session fixation attack - if (!isset($_SESSION['initiated'])) { - session_regenerate_id(); - $_SESSION['initiated'] = true; - } - - $_SESSION['sLogin'] = 1; - $_SESSION['sUser'] = $userName; - $_SESSION['sPass'] = $password; - $_SESSION['sEmail'] = $userEmail; - $_SESSION['sType'] = $userType; - $_SESSION['sTime'] = $userTime; - $_SESSION['tzoffset'] = $tzoffset; - $_SESSION['sTab'] = 't_sum'; - $_SESSION['id'] = $id; - - header ("Location: index.php?id=$id"); - } else { - $err = 'The user name or password is incorrect.'; - $focus = 'username'; - } - } else { - $err = 'The user name or password is incorrect.'; - $focus = 'username'; - } - } else { - $err = 'Connection Failed'; - } -} -?> - - - -Please login to continue - - - - - -
- - - - - - -
-squert - Please login to continue
-Username
-
-Password
-
-

-
Version 1.7.1©2016 Paul Halliday
-
- - - - diff --git a/debian/changelog b/debian/changelog index 0ae0561..bbb827a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,75 @@ +securityonion-squert (20161212-1ubuntu1securityonion39) xenial; urgency=medium + + * remove unnecessary code from ip2c.php + + -- Doug Burks Sat, 05 May 2018 06:28:57 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion38) xenial; urgency=medium + + * update mysql function calls in ip2c.php + + -- Doug Burks Fri, 04 May 2018 17:04:11 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion37) xenial; urgency=medium + + * fix for loop + + -- Doug Burks Thu, 03 May 2018 11:01:09 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion36) xenial; urgency=medium + + * iterate over all arrays when converting strings + + -- Doug Burks Thu, 03 May 2018 10:05:19 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion35) xenial; urgency=medium + + * frontend expects all values to be strings + + -- Doug Burks Thu, 03 May 2018 09:34:58 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion34) xenial; urgency=medium + + * disable mysql strict mode + + -- Doug Burks Wed, 02 May 2018 16:46:37 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion33) xenial; urgency=medium + + * fix auth + + -- Doug Burks Wed, 02 May 2018 14:56:49 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion32) xenial; urgency=medium + + * move files from elastic package + + -- Doug Burks Wed, 02 May 2018 13:42:37 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion31) xenial; urgency=medium + + * force disable autoindex + + -- Doug Burks Wed, 02 May 2018 09:14:41 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion30) xenial; urgency=medium + + * update mysql calls and config + + -- Doug Burks Tue, 01 May 2018 18:04:07 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion29) xenial; urgency=medium + + * change php5 to php + + -- Doug Burks Fri, 27 Apr 2018 15:39:16 -0400 + +securityonion-squert (20161212-1ubuntu1securityonion28) trusty; urgency=medium + + * version 1.7.1 + + -- Doug Burks Fri, 09 Feb 2018 06:14:16 -0500 + securityonion-squert (20161212-1ubuntu1securityonion27) trusty; urgency=medium * add row for Bro agent diff --git a/debian/control b/debian/control index a59ed3f..be27171 100644 --- a/debian/control +++ b/debian/control @@ -10,6 +10,6 @@ Homepage: http://www.squertproject.org/ Package: securityonion-squert Architecture: all -Depends: ${misc:Depends}, apache2, patch, php5, libapache2-mod-php5, php5-mysql, php5-cli, php5-gd, mysqltcl, mysql-server, mysql-client, graphviz, libtext-csv-perl, tclcurl +Depends: ${misc:Depends}, apache2, patch, php, libapache2-mod-php, php-mysql, php-cli, php-gd, mysqltcl, mysql-server, mysql-client, graphviz, libtext-csv-perl, tclcurl Description: squert Squert is a web interface for the Sguil database. diff --git a/debian/install b/debian/install index 7a17818..19c9401 100644 --- a/debian/install +++ b/debian/install @@ -1,8 +1,8 @@ -auth opt/squert/ .css var/www/so/squert/ .flags var/www/so/squert/ .inc var/www/so/squert/ index.php var/www/so/squert/ +login.php var/www/so/squert/ .js var/www/so/squert/ .scripts var/www/so/squert/ .scripts/securityonion-squert.cnf etc/mysql/conf.d/ diff --git a/debian/patches/disable-mysql-strict-mode b/debian/patches/disable-mysql-strict-mode new file mode 100644 index 0000000..7bd4458 --- /dev/null +++ b/debian/patches/disable-mysql-strict-mode @@ -0,0 +1,35 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion34) xenial; urgency=medium + . + * disable mysql strict mode +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.scripts/securityonion-squert.cnf ++++ securityonion-squert-20161212/.scripts/securityonion-squert.cnf +@@ -1,6 +1,6 @@ + [mysqld] + group_concat_max_len = 100000 +-sql_mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION ++sql_mode=NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION + + [mysqltcl] + local-infile=1 diff --git a/debian/patches/fix-auth b/debian/patches/fix-auth new file mode 100644 index 0000000..5bd6dde --- /dev/null +++ b/debian/patches/fix-auth @@ -0,0 +1,6915 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion33) xenial; urgency=medium + . + * fix auth +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/auth/native/squert/.js/squertMain.js ++++ /dev/null +@@ -1,3275 +0,0 @@ +-/* Copyright (C) 2012 Paul Halliday */ +- +-$(document).ready(function(){ +- +- $(document).on('click', '[class*="bpr"]', function() { +- // We disallow filtering if any events have already been selected +- // or if we stray from the event tab +- if ($('.d_row_active')[0]) return; +- if ($(".chk_event:checked").length > 0) return; +- if ($(".tab_active").attr('id') != 't_sum') return; +- +- var prClass = $(this).attr('class').split('b')[1]; +- var prOld = $(this).data('pr'); +- +- function flipIt(pattern) { +- $(pattern).closest('tr').hide(); +- $(pattern).closest('tr').attr('class','hidden'); +- if ($('#gr').text() == 'on') $(pattern).closest('tr').find('.chk_event').prop("disabled",true); +- } +- if ($('.b' + prClass).attr('class') == 'bprA') { +- $('.b' + prClass).attr('class', 'bpr' + prOld); +- $('.hidden').attr('class','d_row'); +- $('.d_row').show(); +- if ($('#gr').text() == 'on') { +- $('.chk_event').prop("disabled",false); +- $('.chk_all').prop("checked",false); +- $('.chk_event').css("background-color", "#fafafa"); +- } +- } else { +- // See if we are already filtered +- if ($('.bprA')[0]) { +- $('.hidden').attr('class','d_row'); +- $('.d_row').show(); +- if ($('#gr').text() == 'on') { +- $('.chk_event').prop("disabled",false); +- $('.chk_all').prop("checked",false); +- $('.chk_event').css("background-color", "#fafafa"); +- } +- var prPrev = $('.bprA').data('pr'); +- $('.bprA').attr('class', 'bpr' + prPrev); +- } +- $('.b' + prClass).attr('class','bprA'); +- switch (prClass) { +- case "pr1": ptrn = ".pr2,.pr3,.pr4"; break; +- case "pr2": ptrn = ".pr1,.pr3,.pr4"; break; +- case "pr3": ptrn = ".pr1,.pr2,.pr4"; break; +- case "pr4": ptrn = ".pr1,.pr2,.pr3"; break; +- } +- flipIt(ptrn); +- } +- }); +- +- // +- // Load main content +- // +- +- // Keep track of context +- thisUser = $('#t_usr').data('c_usr'); +- thisTZ = $('#user_tz').val(); +- rtbit = 0; +- eventList("0-aaa-00"); +- $("#loader").show(); +- lastclasscount = 0; +- +- $(document).on("click", "#dt_savetz", function(event) { +- if ($('.dt_error').data('err') == 0) { +- var newOffset = $('#ts_offset').val(); +- profileUpdate("tz", s2h(newOffset)); +- $('#user_tz').val(newOffset); +- } +- }); +- +- // Depending on context a 'No result' may be confusing +- // so we turn off active queue and show everything +- $(document).on('click', '#retry', function() { +- $('#rt').attr('class','tvalue_off'); +- $('#rt').text('off'); +- rtbit = 0; +- $('.b_update').click(); +- }); +- +- // Get event statuses +- var eTotal = 0, qTotal = 0; +- function statusPoll(caller) { +- // See if we are filtering by sensor +- var theSensors = s2h('empty'); +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- var urArgs = "type=" + 6 + "&ts=" + theWhen + "&sensors=" + theSensors; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb(data)}); +- }); +- +- function cb(data){ +- // Check to make sure we still have a valid session. If we don't +- // let the user know and return them to the login page. +- if (data[0] == "<") { +- $("span.class_msg").text("Your session has expired!"); +- $("span.class_msg").css("background-color", "#cc0000"); +- $("span.class_msg").css("color", "#fff"); +- $("span.class_msg").show(); +- var sessionDead = confirm("Your session has expired. Press \"OK\" to return to the login page. If you aren't finished with what you were looking at click 'Cancel'. Note: you won't be able to perform any actions."); +- if (sessionDead) { +- $("#logout").click(); +- } +- } +- eval("ec=" + data); +- +- var esum = 0; +- +- for (var i=0; i 0) { +- var p = parseFloat(ecount/esum*100).toFixed(1); +- var w = parseInt(p*2); +- } +- if (eclass == 0) { +- qTotal = ecount; +- } +- $("#c-" + eclass).text(ecount); +- $("#c-" + eclass).append("(" + p + "%)"); +- } +- +- var lastcount = $("#cat_sum").val(); +- var newcount = esum; +- $("#cat_sum").val(esum); +- eTotal = esum; +- $("#event_sum").val(eTotal); +- +- if (caller == 0) { // Fresh load +- lastcount = newcount; +- } +- +- // Last RT value +- var lastQ = Number($("#qtotal").html()); +- if (lastcount < newcount) { +- $("#etotal").html(eTotal); +- } +- +- if (lastQ < qTotal) { +- if (caller != 0) { +- if ($(".icon_notifier").css('display') == 'none') $(".icon_notifier").fadeToggle(); +- } +- $("#etotal").html(eTotal); +- $("#qtotal").html(qTotal); +- } +- +- $("#title").html("squert (" + qTotal + ") - " + thisUser); +- +- } +- +- } +- +- // +- // Event monitor (how often we poll for new events) +- // +- +- var emTimeout = 30000; +- window.setInterval(function(){ +- if ($('#search').val().length == 0) { +- statusPoll(1); +- } +- }, emTimeout); +- +- $(document).on("click", '[class*="cl_"]', function(event) { +- var nc = $(this).attr('class').split("_"); +- var ct = $(this).parents('table').data('comment'); +- $(".cat_msg_txt").val(ct); +- $('#b_class-' + nc[1]).click(); +- }); +- +- // Tabs +- var tab_cached = $("#sel_tab").val(); +- +- switch (tab_cached) { +- case "t_sum": +- $('.content-right').show(); +- break; +- case "t_ovr": +- $('.content-right').hide(); +- $('.content-left').hide(); +- if ($('#ovestat').text().length == 0) loadSummary(); +- break; +- case "t_view": +- $('.content-right').hide(); +- $('.content-left').hide(); +- loadViews(); +- default: +- $('.content-right').hide(); +- $('.content-left').hide(); +- break; +- } +- +- $('#' + tab_cached).attr('class','tab_active'); +- $("#" + tab_cached + "_content").attr('class','content_active'); +- +- $(".tab,.tab_active").click(function(event) { +- var active = $(".tab_active").attr('id'); +- var content = $(".content_active").attr('id'); +- if ($(".fl_val_on")[0]) { +- $('.b_update').click(); +- } +- +- if ( this.id != active ) { +- $("#" + active).removeClass('tab_active'); +- $("#" + active).addClass('tab'); +- $(this).attr('class','tab_active'); +- $("#" + content).attr('class','content'); +- $("#" + this.id + "_content").attr('class','content_active'); +- activeTab = $(".tab_active").attr('id'); +- $('.pin').hide(); +- +- switch (activeTab) { +- case "t_sum": +- $('.content-right').show(); +- if (Number($('.botog').data('val')) == 1) $('.content-left').show(); +- $('.t_pbar').css('opacity',1); +- $('.db_links').hide(); +- $('.pin').show(); +- break; +- case "t_ovr": +- $('.content-right').hide(); +- $('.content-left').hide(); +- if ($('#ovestat').text().length == 0) loadSummary(); +- $('.t_pbar').css('opacity',.1); +- $('.db_links').hide(); +- break; +- case "t_view": +- $('.content-right').hide(); +- $('.content-left').hide(); +- $('.t_pbar').css('opacity',.1); +- loadViews(); +- break; +- default: +- $('.content-right').hide(); +- $('.content-left').hide(); +- $('.t_pbar').css('opacity',.1); +- $('.db_links').hide(); +- break; +- } +- +- $('#sel_tab').val(activeTab); +- var ctab = $('#sel_tab').val(); +- var urArgs = "type=" + 5 + "&tab=" + ctab; +- $.get(".inc/callback.php?" + urArgs); +- } +- }); +- +- // Sub tab groups +- $(".tsg").click(function(event) { +- var nc = Number($(this).attr('class').split(/\s/).length); +- var ct = $(this).data('tab'); +- $('.tsg_active').attr('class','tsg'); +- $(this).attr('class','tsg tsg_active'); +- }); +- +- // Toggle and update views +- function newView(req) { +- // No racing please +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- // Remove any stale views +- $("#tl0,#tl1,#tl3a,#tl3b").remove(); +- var f = "0-aaa-00"; +- var s = "2a-aaa-00"; +- var cv = $("#gr").text(); +- +- switch (cv) { +- case "on": +- eventList(f); +- $("#loader").show(); +- break; +- case "off": +- eventList(s); +- $("#loader").show(); +- break; +- } +- } +- +- // Group and ungroup +- $(document).on("click", "#gr", function(event) { +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- var cv = $('#gr').text(); +- switch (cv) { +- case 'on': +- $('#gr').attr('class','tvalue_off'); +- $('#gr').text('off'); +- break; +- case 'off': +- $('#gr').attr('class','tvalue_on'); +- $('#gr').text('on'); +- $("#event_sort").val("DESC"); +- break; +- } +- }); +- +- // RT check/uncheck +- $(document).on("click", "#rt", function(event) { +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- var cv = $('#rt').text(); +- switch (cv) { +- case 'on': +- $('#rt').attr('class','tvalue_off'); +- $('#rt').text('off'); +- rtbit = 0; +- break; +- case 'off': +- $('#rt').attr('class','tvalue_on'); +- $('#rt').text('on'); +- rtbit = 1; +- break; +- } +- }); +- +- // Toggle side/lower bars +- $(document).on("click", ".botog", function(event) { +- if ($('.tab_active').attr('id') != 't_sum') return; +- var n = Number($('.botog').data("val")); +- switch (n) { +- case 1: +- $('.botog').data("val","0"); +- $('.content-right').css("width","100%"); +- $('.botog').attr('src','.css/layout0.png'); +- break; +- case 0: +- $('.botog').data("val","1"); +- $('.content-right').css("width","82%"); +- $('.botog').attr('src','.css/layout1.png'); +- break; +- } +- $('.bottom').animate({height: 'toggle'}); +- $('.content-left').animate({width: 'toggle'}); +- }); +- +- // Section show and hide +- $(".st").click(function() { +- var thisSec = $(this).data("sec"); +- var thisSecID = "#sec_" + thisSec; +- var thisSecVis = $(thisSecID).css("display"); +- var lastSection = "h"; +- switch (thisSecVis) { +- case "none": +- $(this).attr("src", ".css/uarr.png"); +- $(thisSecID).slideDown(); +- break; +- default: +- $(this).attr("src", ".css/darr.png"); +- $(thisSecID).slideUp(); +- break; +- } +- }); +- +- // If search is in focus, update on enter +- $('#search').keypress(function(e) { +- if (!e) e=window.event; +- key = e.keyCode ? e.keyCode : e.which; +- if (key == 13) { +- // Close comment box if it is open +- if ($('#cat_box').css('display') != 'none') { +- $('#ico01').click(); +- } +- $('.b_update').click(); +- } +- }); +- +- // Sort ASC/DESC +- $(document).on("click", ".event_time", function(event) { +- var csv = $(".event_time").text(); +- switch (csv) { +- case "show oldest first": +- $("#event_sort").val("ASC"); +- break; +- case "show newest first": +- $("#event_sort").val("DESC"); +- break; +- } +- newView("u"); +- }); +- +- // Update page +- $(document).on("click", ".b_update", function(event) { +- $(".icon_notifier").fadeToggle(); +- $(".tag").remove(); +- $(".tag_empty").show(); +- // Remove any supplementary results +- if ($("#extresult")[0]) $("#extresult").remove(); +- // Where are we? +- var curTab = $('.tab_active').attr('id'); +- switch (curTab) { +- case 't_ovr': +- loadSummary(); +- break; +- case 't_view': +- mkView(); +- break; +- default: +- $(".b_update_note").hide(); +- newView("u"); +- break; +- } +- }); +- +- // Clear search and refresh +- $('#clear_search').click(function() { +- if ($('#search').val() != '') { +- $('#search').val(''); +- $("#search").focus(); +- if ($(".fl_val_on")[0]) { +- $('.b_update').click(); +- } +- } +- }); +- +- // Logout +- $("#logout").click(function(event) { +- $.get("index.php?id=0", function(){location.reload()}); +- }); +- +- // Toggle filters +- $(document).on('click', '.fl_val_on', function(event) { +- var wF = $(this).data("ft"); +- switch (wF) { +- case "tl": +- +- break; +- case "ob": +- $('#clear_search').click(); +- break; +- case "sn": +- $(".chk_sen").each(function() { +- $(this).prop("checked",false); +- }); +- $('.b_update').click(); +- break; +- } +- }); +- +- function clearTags() { +- //$(".tag").remove(); +- //$(".tag_empty").show(); +- $(".tag").removeClass('tag_active'); +- } +- +- // +- // Rows +- // +- +- function closeRow() { +- $("#active_eview").remove(); +- $("#" + this.id).attr('class','d_row'); +- $(".d_row").css('opacity','1'); +- ltCol = $(".d_row_active").find('td.lt').html(); +- $(".d_row_active").find('td.lt').css('background', ltCol); +- $(".d_row_active").attr('class','d_row'); +- // Update class_count +- $("#class_count").text(lastclasscount); +- // Get rid of any crashed loaders +- $("#loader").hide(); +- // Reset checkbox +- $(".chk_all").prop("checked",false); +- // Clear Tags +- clearTags(); +- } +- function closeSubRow() { +- $("#eview_sub1").remove(); +- $("#" + this.id).attr('class','d_row_sub'); +- $(".d_row_sub").css('opacity','1'); +- $(".d_row_sub_active").attr('class','d_row_sub'); +- // Update class_count +- $("#class_count").text(lastclasscount); +- curclasscount = lastclasscount; +- $("#loader").hide(); +- // Reset and show checkbox +- $(".chk_all").prop("checked",false); +- $("#ca0").show(); +- // Remove any open externals +- if ($("#extresult")[0]) $("#extresult").remove(); +- // Clear Tags +- clearTags(); +- } +- function closeSubRow1() { +- $("#eview_sub2").remove(); +- $("#" + this.id).attr('class','d_row_sub1'); +- if (!$("#eview_sub3")[0]) { +- $(".d_row_sub1").css('opacity','1'); +- $(".d_row_sub_active1").attr('class','d_row_sub1'); +- } +- $("#loader").hide(); +- // Reset checkbox +- $(".chk_all").prop("checked",false); +- // Remove any open externals +- if ($("#extresult")[0]) $("#extresult").remove(); +- // Clear Tags +- clearTags(); +- } +- function closeSubRow2() { +- $("#eview_sub3").remove(); +- $("#" + this.id).attr('class','d_row_sub1'); +- if (!$("#eview_sub2")[0]) { +- $(".d_row_sub1").css('opacity','1'); +- $(".d_row_sub1_active").attr('class','d_row_sub1'); +- } +- $("#loader").hide(); +- // Clear Tags +- clearTags(); +- } +- +- // +- // Level 1 +- // +- +- $(document).on("click", ".row_active", function(event) { +- var curID = $(this).parent('tr').attr('id'); +- // What type of row are we? +- rowType = curID.substr(0,3); +- +- // Make sure no other instances are open +- if (!$(".d_row_active")[0] && rowType == 'sid') { +- $("#loader").show(); +- // This leaves us with sid-gid +- var rowValue = curID.replace("sid-",""); +- var sigID = rowValue.split("-")[0]; +- +- $(".d_row_active").attr('class', 'd_row'); +- $("#active_eview").attr('class','d_row'); +- +- // This is now the active row +- $("#" + curID).attr('class','d_row_active'); +- $("html, body").animate({ scrollTop: $('.d_row_active').offset().top - 140 }, 20); +- // History +- var itemToAdd = $("#" + curID).find('[class*="row_filter"]').text(); +- hItemAdd(itemToAdd); +- // Set the class count (counted again after load) +- curclasscount = $('.d_row_active').data('event_count'); +- var cols = $('th.sort').length; +- var tbl = ''; +- tbl += ""; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
↓
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += ""; +- tbl += "CATEGORIZE"; +- tbl += curclasscount + "EVENT(S)  "; +- tbl += "    "; +- tbl += "CREATE FILTER: "; +- tbl += "src  "; +- tbl += "dst  "; +- tbl += "both"; +- tbl += "
"; +- $("#" + curID).after(tbl); +- +- // Lookup signature +- sigLookup(rowValue); +- +- // Fetch results +- eventList("1-" + rowValue); +- +- $("#eview").show(); +- $(".d_row").fadeTo('0','0.2'); +- } else { +- closeRow(); +- } +- }); +- +- // +- // Level 2 +- // +- +- $(document).on("click", ".sub_active", function() { +- if (!$(".d_row_sub_active")[0]) { +- var callerID = $(this).parent('tr').attr('id'); +- +- // Reset checkbox +- $(".chk_all").prop("checked",false); +- +- // RT or ALL? +- switch (rtbit) { +- case 1: adqp = s2h("AND event.status = 0"); break; +- case 0: adqp = s2h("empty"); break; +- } +- // We are now the active row +- $("#" + callerID).attr('class','d_row_sub_active'); +- +- // Populate search times +- var bt = $("#" + callerID).find('[class*="timestamp"]').html(); +- var est = mkStamp(bt,"-",3600000,thisTZ); +- var eet = mkStamp(bt,"+",3600000,thisTZ); +- +- $('#el_start').val(est); +- $('#el_end').val(eet); +- +- // Clear search terms +- $("#srchterms").html(''); +- $(".srch_txt").val(''); +- +- // History and search +- $("#" + callerID).find('[class*="sub_filter"]').each(function() { +- if ($(this).data('type') == 'cc') { +- var itemToAdd = $(this).data('value'); +- } else { +- var itemToAdd = $(this).text(); +- // Add search terms +- $("#srchterms").append("" + itemToAdd + "  "); +- } +- hItemAdd(itemToAdd); +- }); +- +- $("#loader").show(); +- eventList("2-" + callerID + "-" + adqp); +- } else { +- closeSubRow(); +- } +- }); +- +- // +- // Level 3 (a or b) request payload +- // +- +- $(document).on("click", ".sub1_active", function() { +- // Close transcript if it is open +- if ($(".eview_sub3")[0]) closeSubRow2(); +- if (!$(".d_row_sub_active1")[0]) { +- var callerID = $(this).parent('tr').attr('id'); +- $("#" + callerID).attr('class','d_row_sub_active1'); +- +- // Populate search times +- var bt = $("#" + callerID).find('[class*="timestamp"]').html(); +- var est = mkStamp(bt,"-",1800000,thisTZ); +- var eet = mkStamp(bt,"+",1800000,thisTZ); +- +- $('#el_start').val(est); +- $('#el_end').val(eet); +- +- // Clear search terms +- $("#srchterms").html(''); +- $(".srch_txt").val(''); +- +- // History +- $("#" + callerID).find('[class*="sub_filter"]').each(function() { +- if ($(this).data('type') == 'cc') { +- var itemToAdd = $(this).data('value'); +- } else { +- var itemToAdd = $(this).text(); +- } +- if ($(this).data('type') == 'ip') { +- // Add search terms +- $("#srchterms").append("" + itemToAdd + "  "); +- } +- hItemAdd(itemToAdd); +- }); +- $("#loader").show(); +- eventList("3-" + callerID); +- } else { +- closeSubRow1() +- } +- }); +- +- // +- // Level 3 (a or b) request transcript +- // +- +- $(document).on("click", ".sub2_active", function(event) { +- // Close payload if it is open +- if ($(".eview_sub2")[0]) closeSubRow1(); +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- if (!$(".eview_sub3")[0]) { +- $("#loader").show(); +- composite = $(this).data('tx').split("-"); +- rowLoke = composite[0]; +- $("#" + rowLoke).attr('class','d_row_sub1_active'); +- nCols = $("#" + rowLoke).find('td').length; +- cid = composite[1]; +- txdata = composite[2]; +- +- // See if a transcript is available +- var urArgs = "type=" + 7 + "&txdata=" + txdata; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, function(data){cb5(data)}); +- }); +- +- function cb5(data){ +- eval("txRaw=" + data); +- txCMD = txRaw.cmd; +- txResult = txRaw.tx; +- txDebug = txRaw.dbg; +- if (txResult == "DEBUG:") txResult += " No data was returned."; +- if (!txResult) { +- txResult = "Transcript request failed!

"; +- txResult += "The command was:
" + txCMD + "

"; +- txResult += "The response was:" + txDebug.replace(/DEBUG:/g,"
"); +- } +- +- var row = '',tbl = ''; +- row += ""; +- row += ""; +- row += "
"; +- row += txResult; +- row += "
"; +- +- tbl += ""; +- tbl += row; +- tbl += ""; +- $("#" + rowLoke).after(tbl); +- +- // Turn off fade effect for large results +- var rC = $(".d_row_sub1").length; +- if ( rC <= 399 ) { +- $(".d_row_sub1").fadeTo('fast','0.2'); +- } +- +- $("#loader").hide(); +- } +- } else { +- closeSubRow2(); +- } +- }); +- +- // Toggle RT depending on entry point +- $(document).on("click", ".b_ec_hot", function() { +- rtbit = 1; +- }); +- $(document).on("click", ".b_ec_total", function() { +- rtbit = 0; +- }); +- +- // Filter constructor +- function mkFilter() { +- if ($('#search').val().length > 0) { +- +- var srchVal = $('#search').val(); +- var fParts = ""; +- +- // If no term is supplied default to a string, IP or wildcard IP search +- chkVal: +- if (srchVal.indexOf(" ") == -1 && srchVal[0] != "!") { +- var re = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; +- if (re.exec(srchVal)) { +- srchVal = "ip " + srchVal; +- break chkVal; +- } +- +- var re = /^(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)/; +- if (re.exec(srchVal)) { +- srchVal = "wip " + srchVal; +- break chkVal; +- } +- +- srchVal = "sig " + srchVal; +- } +- +- fParts = srchVal.replace(/^!/,"").split(" "); +- if (fParts[0] == 'cmt') { +- var theFilter = s2h($('#search').val()); +- rtbit = 0; +- } else { +- // Now see if the requested filter exists +- if ($("#tr_" + fParts[0]).length > 0) { +- tmpFilter = $("#tr_" + fParts[0]).data('filter'); +- // Now see if we need to modify the query +- if (fParts[1]) { +- // This is the base filter +- preFilter = h2s(tmpFilter); +- // This is the user supplied text. +- var re = new RegExp("^" + fParts[0] + "\\s{1}|[';\\\`]","g"); +- theQuestion = fParts.join(' ').replace(re, ""); +- // We will accept multiple questions if they are comma delimited +- questionParts = theQuestion.split(","); +- if (questionParts.length > 1) { +- var f = '('; +- for (var i = 0; i < questionParts.length; i++) { +- f += preFilter.replace(/\$/g, questionParts[i]); +- if (i != (questionParts.length - 1)) { +- f += " OR "; +- } +- } +- f += ')'; +- theFilter = s2h(f); +- } else { +- var newFilter = preFilter.replace(/\$/g, questionParts[0]); +- theFilter = s2h(newFilter); +- } +- } else { +- theFilter = tmpFilter; +- } +- } else { // The filter does not exist +- theFilter = s2h('empty'); +- } +- } +- } else { // No filter supplied +- theFilter = s2h('empty'); +- } +- return theFilter; +- } +- +- // +- // This creates the views for each level +- // +- +- function eventList (type) { +- theWhen = getTimestamp(); +- statusPoll(0); +- var parts = type.split("-"); +- var filterMsg = ''; +- var rt = 0; +- var theSensors = s2h('empty'); +- var theFilter = mkFilter(); +- +- // See if we are just RT events +- if ($('#rt').text() == 'on' || rtbit == 1) { +- rt = 1; +- rtbit = 1; +- } +- // How are we sorting? +- var sortval = $("#event_sort").val(), sorttxt; +- switch (sortval) { +- case "DESC": sorttxt = "show oldest first"; break; +- case "ASC": sorttxt = "show newest first"; break; +- } +- +- // See if we are filtering by sensor +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- // Check for any filters +- if (h2s(theFilter) != 'empty') { +- $('.fl_val').text('YES'); +- } else { +- $('.fl_val').text('NO'); +- } +- +- switch (parts[0]) { +- +- // Level 0 view - Grouped by Signature +- case "0": +- $('.value').text('-'); +- +- // Times Chart +- var urChrtArgs = "type=22&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors; +- $(function(){ +- $.get(".inc/callback.php?" + urChrtArgs, function(data){cb22(data)}); +- }); +- +- function cb22(data){ +- eval("chartData=" + data); +- var r = chartData.r; +- if (r > 0) { +- mkLine(".times",chartData.rows,chartData.m); +- } +- } +- +- var urArgs = "type=" + parts[0] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb1(data)}); +- }); +- function cb1(data){ +- eval("d0=" + data); +- var tbl = ''; +- var head = ''; +- var row = ''; +- var cols = 11; +- +- if (rt == 0) cols = 12; +- head += ""; +- head += ""; +- head += "QUEUE"; +- if (rt == 0) head += "ALL"; +- head += ""; +- head += "SC"; +- head += "DC"; +- if (rt == 0) head += "CLASS"; +- head += "ACTIVITY"; +- head += "LAST EVENT"; +- head += "SIGNATURE"; +- head += "ID"; +- head += "PROTO"; +- head += "% TOTAL"; +- head += ""; +- +- var sumEC = 0, sumSC = 0, sumDC = 0, sumSI = "-", spr1 = 0, spr2 = 0, spr3 = 0, spr4 = 0; +- +- if (d0.length > 0) { +- // Sums for boxes +- for (var i=0; i"; +- row += "No result. If this is unexpected try this"; +- } +- +- if (rt == 1) { +- sumSC = "-"; +- sumDC = "-"; +- sumEC = eTotal; +- } +- +- var sumRT = 0; +- +- // Tag Array +- var tags = new Array(); +- +- for (var i=0; i 0 ) { +- rtClass = "b_ec_hot"; +- sumRT += parseInt(unClass); +- } else { +- rtClass = "b_ec_cold"; +- } +- +- // Sum priorities +- var prC = Number(d0[i].f1); +- switch (d0[i].f13) { +- case "1": spr1 += prC; break; +- case "2": spr2 += prC; break; +- case "3": spr3 += prC; break; +- default: spr4 += prC; break; +- } +- +- rid = "r" + i + "-" + parts[1]; +- var cells = mkGrid(d0[i].f12); +- if (rt == 0) var catCells = catGrid(d0[i].f11,0,0); +- row += ""; +- row += "
" + unClass + "
"; +- if (rt == 0) row += "
" + d0[i].f1 + "
"; +- row += "
" + d0[i].f13 + "
"; +- row += "" +d0[i].f6+ ""; +- row += "" +d0[i].f7+ ""; +- if (rt == 0) row += "" + catCells + ""; +- +- timeParts = d0[i].f5.split(" "); +- timeStamp = timeParts[1]; +- +- if ( sumEC > 0) { +- rowPer = Number(d0[i].f1/sumEC*100).toFixed(3); +- } else { +- rowPer = "0.000"; +- } +- +- row += "" + cells + ""; +- row += "" + timeStamp + ""; +- row += ""; +- //row += "
" + d0[i].f2 + "
"; +- row += d0[i].f2 + ""; +- row += "" + d0[i].f3 + ""; +- row += "" + d0[i].f8 + ""; +- +- +- row += "" + rowPer + "%"; +- row += ""; +- } +- +- // Populate event summary +- $('#qtotal').text(sumRT); +- $('#etotal').text(sumEC); +- $('#esignature').text(sumSI); +- +- // Populate tags +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- +- $('#' + parts[1] + '-' + parts[2]).append(tbl); +- +- if (d0.length > 0) { +- var prVals = [spr1,spr2,spr3,spr4]; +- var pryBar = mkPribar(prVals); +- } else { +- var pryBar = mkPribar([0]); +- } +- $('#tl1').fadeIn('slow'); +- $("#tl1").tablesorter(); +- $("#loader").hide(); +- } +- break; +- +- // Level 1 view - Grouped by signature, source, destination +- +- case "1": +- var urArgs = "type=" + parts[0] + "&object=" + parts[1] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb2(data)}); +- }); +- +- function cb2(data){ +- eval("theData=" + data); +- tbl = ''; +- head = ''; +- row = ''; +- head += "QUEUE"; +- if (rt == 0) head += "TOTAL"; +- if (rt == 0) head += "CLASS"; +- head += "ACTIVITY"; +- head += "LAST EVENT"; +- head += "SOURCE"; +- head += "AGE"; +- head += "COUNTRY"; +- head += "DESTINATION"; +- head += "AGE"; +- head += "COUNTRY"; +- head += ""; +- var curclasscount = 0, tlCount = 0, rtCount = 0; +- var timeValues = "", scid = ""; +- +- // Tag array +- var tags = new Array(); +- +- for (var i=0; i 0 ) { +- rtClass = "b_ec_hot"; +- isActive = "sub_active"; +- } else { +- rtClass = "b_ec_cold"; +- isActive = "sub"; +- } +- +- // Aggregate time values +- timeValues += theData[i].c_ts + ","; +- var cells = mkGrid(theData[i].f12); +- if (rt == 0) var catCells = catGrid(theData[i].c_status,0,0); +- +- // Event sums +- tlCount += parseInt(count,10); +- rtCount += parseInt(unclass,10); +- +- rid = "r" + i + "-" + parts[1] + "-" + src_ip + "-" + dst_ip; +- row += ""; +- row += "
" + unclass + "
"; +- if (rt == 0) row += "
" + count + "
"; +- if (rt == 0) row += "" + catCells + ""; +- row += "" + cells + ""; +- row += "" + max_time + ""; +- row += "
" + src_ip + ""; +- row += "" + src_age_n + ""; +- row += ""; +- row += cs[1] + src_clong + " (." + src_cc.toLowerCase() + ")" + ""; +- row += "
" + dst_ip + ""; +- row += "" + dst_age_n + ""; +- row += ""; +- row += cd[1] + dst_clong + " (." + dst_cc.toLowerCase() + ")" + ""; +- row += ""; +- } +- +- // Populate tags +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- // Add scid's to checkbox +- $("#ca0").data("scid", scid.replace(/,$/, "")); +- +- // If queue is empty provide event sums in case the user +- // intends to reclass anything +- if (rtbit == 1) { +- curclasscount = rtCount; +- } else { +- curclasscount = tlCount; +- } +- +- // update class_count +- $("#class_count").html(curclasscount); +- lastclasscount = $("#class_count").html(); +- +- // While in grouped events (RT) we remove rows as +- // they are classed and subtract the values from "Total Events" +- // This keeps etotal up to date so the math doesn't get silly +- var oldrt = Number($(".d_row_active").find(".b_ec_hot").text()); +- var oldec = Number($("#etotal").text()); +- if (oldrt < rtCount) { +- newrtcount = parseInt((rtCount - oldrt) + oldec); +- $("#etotal").text(newrtcount); +- } +- +- // Update parent counts +- $(".d_row_active").find(".b_ec_hot").text(rtCount); +- if (rt == 0) $(".d_row_active").find(".b_ec_total").text(tlCount); +- +- tbl += "
"; +- tbl += head; +- tbl += row; +- tbl += "
"; +- $("#eview").after(tbl); +- $("#tl2").tablesorter({ +- headers: { +- 4: {sorter:'ipv4'}, +- 6: {sorter:'ipv4'} +- } +- }); +- $("#loader").hide(); +- } +- break; +- +- // Level 2 view - No grouping, individual events +- +- case "2": +- var rowLoke = parts[1]; +- var filter = $('#' + parts[1]).data('filter'); +- var urArgs = "type=" + parts[0] + "&object=" + filter + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen + "&adqp=" + parts[2] + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb3(data)}); +- }); +- +- function cb3(data){ +- eval("d2=" + data); +- tbl = ''; +- head = ''; +- row = ''; +- head += ""; +- head += ""; +- head += "ST"; +- head += "TIMESTAMP"; +- head += "EVENT ID"; +- head += "SOURCE"; +- head += "PORT"; +- head += "DESTINATION"; +- head += "PORT"; +- head += "SIGNATURE"; +- head += ""; +- +- // Update class_count +- $("#class_count").html(0); +- var tlCount=0, rtCount=0; +- +- // Tag array +- var tags= new Array(); +- +- for (var i=0; i"; +- tclass = "c" + eclass; +- cv = classifications.class[tclass][0].short; +- +- // Populate tags array +- if (src_tag != "-") { +- var src_tags = src_tag.split(","); +- $.each(src_tags, function(n,tag) { +- var t = tags.indexOf(tag); +- if (t < 0) tags.push(tag); +- }); +- } +- +- if (dst_tag != "-") { +- var dst_tags = dst_tag.split(","); +- $.each(dst_tags, function(n,tag) { +- var t = tags.indexOf(tag); +- if (t < 0) tags.push(tag); +- }); +- } +- +- // Timestamp +- var compts = d2[i].f2.split(",") || "--"; +- var timestamp = compts[0]; +- var utctimestamp = compts[1]; +- +- // Event sums +- tlCount += parseInt(1,10); +- if (cv == "RT") { +- rtCount += parseInt(1,10); +- } +- +- // Transcript link +- // original Squert native pivot: +- //txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); +- //txBit = "" + sid + "." + cid + "
"; +- //if (src_port != "-" && dst_port != "-") { +- // txBit = "" + sid + "." + cid + ""; +- //} +- // new pivot to CapMe: +- txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); +- txBit = "" + sid + "." + cid + ""; +- if (src_port != "-" && dst_port != "-") { +- var startDate = new Date(utctimestamp); +- var start_tz_offset = (startDate.getTimezoneOffset()); +- var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; +- var endDate = new Date(utctimestamp); +- var end_tz_offset = (endDate.getTimezoneOffset()); +- var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; +- txBit = " " + sid + "." + cid + ""; +- } +- +- row += ""; +- row += "
"; +- row += cv + "
"; +- row += "" + timestamp + ""; +- row += txBit; +- row += "" + src_ip + ""; +- row += "" + src_port + ""; +- row += "" + dst_ip + ""; +- row += "" + dst_port + ""; +- row += "" + signature + ""; +- row += ""; +- } +- +- // Update parent counts +- $(".d_row_sub_active").find(".b_ec_hot").text(rtCount); +- if ($(".d_row_sub_active").find(".b_ec_total").text() < tlCount) { +- $(".d_row_sub_active").find(".b_ec_total").text(tlCount); +- } +- +- var cols = $('th.sort').length; +- +- // Populate tags +- clearTags(); +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- tbl += ""; +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- $("#" + rowLoke).after(tbl); +- $(".d_row_sub").fadeTo('0','0.2'); +- $("#loader").hide(); +- $("#tl3").tablesorter({ +- headers: { +- 0:{sorter:false}, +- 4:{sorter:'ipv4'}, +- 6:{sorter:'ipv4'} +- }, +- cancelSelection:false +- }); +- $("#ca0").hide(); +- } +- break; +- +- // Level 2a view - No grouping, individual events +- +- case "2a": +- $('.value').text('-'); +- var urArgs = "type=2a&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb3a(data)}); +- }); +- +- function cb3a(data){ +- eval("d2a=" + data); +- var tbl = ''; +- var head = ''; +- var row = ''; +- var disabled = ''; +- if (d2a.length == 0) { +- disabled = "disabled"; +- row += ""; +- row += "No result. If this is unexpected try this"; +- } +- +- head += ""; +- head += ""; +- head += ""; +- head += "ST"; +- head += ""; +- head += "TIMESTAMP"; +- head += "ID"; +- head += "SOURCE"; +- head += "PORT"; +- head += "AGE"; +- head += "CC"; +- head += "DESTINATION"; +- head += "PORT"; +- head += "AGE"; +- head += "CC"; +- head += "SIGNATURE"; +- head += ""; +- +- // Aggregate time values +- var timeValues = ""; +- for (var ts=0; ts" + sid + "." + cid + ""; +- //if (src_port != "-" && dst_port != "-") { +- // txBit = "" + sid + "." + cid + ""; +- //} +- // new pivot to CapMe: +- txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); +- txBit = "" + sid + "." + cid + ""; +- if (src_port != "-" && dst_port != "-") { +- var startDate = new Date(utctimestamp); +- var start_tz_offset = (startDate.getTimezoneOffset()); +- var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; +- var endDate = new Date(utctimestamp); +- var end_tz_offset = (endDate.getTimezoneOffset()); +- var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; +- txBit = " " + sid + "." + cid + ""; +- } +- +- row += ""; +- row += ""; +- row += "
"; +- row += cv + "
"; +- row += "
" + d2a[i].f16 + "
"; +- row += "" + timestamp + ""; +- row += txBit; +- row += "
" + src_ip + ""; +- row += "" + src_port + ""; +- row += "" + src_age_n + ""; +- row += "" + cs[1] + ""; +- row += "
" + dst_ip + ""; +- row += "" + dst_port + ""; +- row += "" + dst_age_n + "" +- row += "" + cd[1] + ""; +- row += "" + signature + ""; +- } +- +- var sumED = 0, sumEC = 0, cmsg = ""; +- +- if (d2a.length > 0) { +- sumED = i; +- sumEC = d2a.length; +- } +- +- if (d2a.length >= maxI) { +- sumRE = sumEC - maxI; +- cmsg = " / " + sumRE + " not shown"; +- } +- +- $("#qtotal").html(rsumRT); +- +- // Populate tags +- clearTags(); +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- // Draw +- tbl += ""; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "categorize " + 0 + ""; +- tbl += " of " + sumED + " event(s)" + cmsg; +- tbl += "
"; +- tbl += "
" + sorttxt + "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- $('#' + parts[1] + '-' + parts[2]).after(tbl); +- +- if (d2a.length > 0) { +- var prVals = [spr1,spr2,spr3,spr4]; +- var pryBar = mkPribar(prVals); +- } else { +- var pryBar = mkPribar([0]); +- } +- $("#tl3a,#tl3b").fadeIn('slow'); +- $("#tl3b").tablesorter({ +- headers: { +- 0:{sorter:false}, +- 1:{sorter:false}, +- 5:{sorter:'ipv4'}, +- 8:{sorter:'ipv4'} +- }, +- cancelSelection:false +- }); +- $("#loader").hide(); +- } +- break; +- +- // Level 3 view - Packet Data +- +- case "3": +- var rowLoke = parts[1]; +- var nCols = $('#' + parts[1]).data('cols'); +- var filter = $('#' + parts[1]).data('filter'); +- var urArgs = "type=" + parts[0] + "&object=" + filter + "&ts=" + theWhen; +- var sg = $('#' + parts[1]).data('sg'); +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb4(data)}); +- }); +- +- function cb4(data){ +- eval("theData=" + data); +- +- var tbl = '', head = '', row = ''; +- +- // If IP version is 0 we can jump right to the payload (likely bro, http or ossec agent) +- if (theData[0].ip_ver != 0) { +- +- var PDATA = 0; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
IPVERIHLTOSLENGTHIDFLAGSOFFSETTTLCHECKSUMPROTO
" + theData[0].ip_ver + "" + theData[0].ip_hlen + "" + theData[0].ip_tos + "" + theData[0].ip_len + "" + theData[0].ip_id + "" + theData[0].ip_flags + "" + theData[0].ip_off + "" + theData[0].ip_ttl + "" + theData[0].ip_csum + "" + theData[0].ip_proto + "
"; +- +- switch (theData[0].ip_proto) { +- case "1": +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
ICMPTYPECODECHECKSUMIDSEQ#
" + theData[1].icmp_type + "" + theData[1].icmp_code + "" + theData[1].icmp_csum + "" + theData[1].icmp_id + "" + theData[1].icmp_seq + "
"; +- break; +- +- case "6": +- // TCP flags +- var tmpFlags = theData[1].tcp_flags || 'z'; +- switch (tmpFlags) { +- case 'z': var tcpFlags = '--------'; break; +- default: +- var binFlags = Number(theData[1].tcp_flags).toString(2); +- var binPad = 8 - binFlags.length; +- var tcpFlags = "00000000".substring(0,binPad) + binFlags; +- break; +- } +- var tcp_seq = theData[1].tcp_seq || '-'; +- var tcp_ack = theData[1].tcp_ack || '-'; +- var tcp_off = theData[1].tcp_off || '-'; +- var tcp_res = theData[1].tcp_res || '-'; +- var tcp_win = theData[1].tcp_win || '-'; +- var tcp_urp = theData[1].tcp_urp || '-'; +- var tcp_csum = theData[1].tcp_csum || '-'; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
TCPR1R0URGACKPSHRSTSYNFINSEQ#ACK#OFFSETRESWINURPCHECKSUM
" + tcpFlags[0] + "" + tcpFlags[1] + "" + tcpFlags[2] + "" + tcpFlags[3] + "" + tcpFlags[4] + "" + tcpFlags[5] + "" + tcpFlags[6] + "" + tcpFlags[7] + "" + tcp_seq + "" + tcp_ack + "" + tcp_off + "" + tcp_res + "" + tcp_win + "" + tcp_urp + "" + tcp_csum + "
"; +- break; +- +- case "17": +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
UDPLENGTHCHECKSUM
" + theData[1].udp_len + "" + theData[1].udp_csum + "
"; +- break; +- } +- +- var p_hex = '', p_ascii = '', p_ascii_l = ''; +- +- // Data +- if (!theData[2]) { +- p_hex = "No Data Sent."; +- p_ascii = "No Data Sent."; +- } else { +- p_pl = theData[2].data_payload; +- p_length = theData[2].data_payload.length; +- var b0 = 0; +- +- for(var i=0; i < p_length; i+=2) { +- b0++; +- t_hex = p_pl.substr(i,2); +- t_int = parseInt(t_hex,16); +- +- if ((t_int < 32) || (t_int > 126)) { +- p_hex += t_hex + " "; +- p_ascii += "."; +- p_ascii_l += "."; +- } else if (t_int == 60) { +- p_hex += t_hex + " "; +- p_ascii += "<"; +- p_ascii_l += "<"; +- } else if (t_int == 62) { +- p_hex += t_hex + " "; +- p_ascii += ">"; +- p_ascii_l += ">"; +- } else { +- p_hex += t_hex + " "; +- p_ascii += String.fromCharCode(parseInt(t_hex, 16)); +- p_ascii_l += String.fromCharCode(parseInt(t_hex, 16)); +- } +- +- if ((b0 == 16) && (i < p_length)) { +- p_hex += "
"; +- p_ascii += "
"; +- b0 = 0; +- } +- } +- } +- +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
DATAHEXASCII
" + p_hex + "" + p_ascii + "
ASCII" + p_ascii_l + "
"; +- +- } else { +- +- head += ""; +- var p_ascii = "No Data Sent."; +- // This needs to be more robust. +- if (theData[2]) { +- var tmp = h2s(theData[2].data_payload).split("\n"); +- p_ascii = ''; +- for (var i in tmp) { +- p_ascii += "
" + tmp[i] + "
"; +- } +- +- } +- row += ""; +- row += ""; +- row += "
" + p_ascii + "
"; +- } +- +- tbl += ""; +- +- // If we are not grouped we show the signature text +- if ( sg != 0 ) { +- tbl += "
"; +- tbl += "
"; +- tbl += "
↓
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- sigLookup(sg); +- } +- +- // Comments and tags are done here +- var tags = new Array(); +- var eventTag = 'None.'; +- var eventComment = theData[0].comment || 'None.'; +- var src_tag = theData[0].srctag || '-'; +- var dst_tag = theData[0].dsttag || '-'; +- +- // Populate tags array +- if (src_tag != "-") { +- var src_tags = src_tag.split(","); +- $.each(src_tags, function(n,tag) { +- var t = tags.indexOf(tag + ",s"); +- if (t < 0) tags.push(tag + ",s"); +- }); +- } +- +- if (dst_tag != "-") { +- var dst_tags = dst_tag.split(","); +- $.each(dst_tags, function(n,tag) { +- var t = tags.indexOf(tag + ",d"); +- if (t < 0) tags.push(tag + ",d"); +- }); +- } +- +- if (tags.length > 0) eventTag = ''; +- +- tbl += "
COMMENTS
"; +- tbl += "
" + eventComment + "
"; +- tbl += "
TAGS
"; +- tbl += "
" + eventTag + "
"; +- if (PDATA != 0) { +- tbl += "
DETAILS
"; +- } else { +- tbl += "
PAYLOAD
"; +- } +- tbl += head; +- tbl += row; +- tbl += ""; +- $("#" + rowLoke).after(tbl); +- $("#loader").hide(); +- +- // Turn off fade effect for large results +- var rC = $(".d_row_sub1").length; +- if ( rC <= 499 ) { +- $(".d_row_sub1").fadeTo('fast','0.2'); +- } +- +- // Populate tags +- clearTags(); +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- } +- break; +- } +- // If event queue is off we need to reset this after load if b_ec_hot was +- // the entry point +- if ($('#rt').text() == 'off') rtbit = 0; +- } +- +- // +- // Object click handlers +- // +- +- $(document).on("click", ".select,.ex_val,.sub_filter,.row_filter,.tof,.value_link,.nr_f", function(e) { +- // Check if we are coming from a legit object +- var prefix = $(this).data('type'); +- if (prefix == "none") return; +- +- // Check if we are coming from a sane selection +- var selLen = window.getSelection().toString().length; +- if (selLen > 4) { +- if (selLen < 255) { // Might need to change these based on how people use this +- prefix = "zz"; +- var suffix = window.getSelection().toString(); +- var re = /\s/g; +- var NOK = re.exec(suffix); +- if (NOK) return; +- } else { +- return; +- } +- } else { +- var suffix = $(this).text(); +- } +- +- var mX = e.pageX; +- var mY = e.pageY; +- +- var colour = $(this).data('col') || "FFFFFF"; +- var tfocus = "#search"; +- switch (prefix) { +- case 'ip': +- hItemAdd(suffix); +- var sord = $(this).data('sord'); +- mkPickBox(prefix,suffix,sord,colour,mX,mY); +- break; +- case 'spt': +- case 'dpt': +- hItemAdd(suffix); +- mkPickBox(prefix,suffix,0,colour,mX,mY); +- break; +- case 'cc': +- case 'scc': +- case 'dcc': +- var cc = $(this).data('value'); +- hItemAdd(cc); +- mkPickBox(prefix,cc,suffix,colour,mX,mY); +- break; +- case 'cmt': +- suffix = $(this).data('comment'); +- $("#rt").text("off"); +- $("#rt").attr('class','tvalue_off'); +- $('#search').val(prefix + " " + suffix); +- hItemAdd(suffix); +- if ($('#cat_box').css('display') != 'none') { +- $('#ico01').click(); +- } +- $('.b_update').click(); +- break; +- case 'cmt_c': +- $('.cat_msg_txt').val(suffix); +- hItemAdd(suffix); +- tfocus = ".cat_msg_txt"; +- break; +- case 'fil': +- var fil = $(this).data('value'); +- $('#search').val(fil); +- hItemAdd(fil); +- if ($('#fltr_box').css('display') != 'none') { +- $('#ico04').click(); +- } +- $('.b_update').click(); +- break; +- case 'sid': +- var value = $(this).data('value'); +- hItemAdd(suffix); +- mkPickBox(prefix,value,suffix,colour,mX,mY); +- break; +- case 'st': +- var suffix = $(this).attr('id').split('-')[1]; +- $('#search').val(prefix + " " + suffix); +- // RT must be off to return anything +- $('#rt').attr('class','tvalue_off'); +- $('#rt').text('off'); +- rtbit = 0; +- $('.b_update').click(); +- break; +- case 'el': +- var suffix = $(this).data('value'); +- mkPickBox(prefix,suffix,0,colour,mX,mY); +- break; +- case 'zz': +- hItemAdd(suffix); +- mkPickBox(prefix,suffix,0,colour,mX,mY); +- break; +- } +- }); +- +- // +- // Picker Box +- // +- +- function mkPickBox(prefix,suffix,rsuffix,colour,mX,mY) { +- var doexternals = "yes"; +- var objhex = s2h(suffix); +- var tbl = '', row = ''; +- // Local stuff first +- switch (prefix[prefix.length - 1]) { +- case "c": +- row += ":: SRC or DST"; +- row += ":: SRC"; +- row += ":: DST"; +- row += ":: SEARCH"; +- break; +- case "p": +- row += ":: SRC or DST"; +- row += ":: SRC"; +- row += ":: DST"; +- row += ":: ADD / REMOVE TAG"; +- if ($('.sigtxt')[0]) { +- row += ":: HISTORY"; +- } +- row += ":: SEARCH"; +- row += ":: COLOUR  "; +- row += ""; +- row += "apply"; +- row += "apply all"; +- row += ""; +- break; +- case "t": +- row += ":: SRC"; +- row += ":: DST"; +- row += ":: SEARCH"; +- break; +- case "d": +- row += ":: SIGNATURE"; +- if ($('.sigtxt')[0]) { +- row += ":: HISTORY"; +- } +- row += ":: SEARCH"; +- break; +- case "l": +- row += ":: COLOUR  "; +- row += ""; +- row += "update"; +- doexternals = "no"; +- break; +- case "z": +- row += ":: SEARCH"; +- break; +- } +- +- // If applicable populate externals +- if (doexternals == "yes") { +- $('.f_row').each(function() { +- var ct = $(this).data('type'); +- if (ct == 'url') { +- var alias = $(this).data('alias'); +- var name = $(this).data('name'); +- var url = $(this).data('filter'); +- row += ""; +- row += "" + name + ""; +- row += ""; +- } +- }); +- } +- +- tbl += ""; +- tbl += row; +- tbl += "
"; +- +- var boxlabel = suffix; +- +- // Use more descriptive names where possible +- var re = /(sid|cc|scc|dcc)/; +- var OK = re.exec(prefix); +- if (OK) { +- var boxlabel = rsuffix; +- } +- +- if (boxlabel.length > 24) { +- boxlabel = boxlabel.substring(0,24); +- boxlabel += ".."; +- } +- +- $('#pickbox_label').text(boxlabel).css('font-weight','normal').data('sord', rsuffix); +- +- if ($('#tlpick')[0]) $('#tlpick').remove(); +- $(".pickbox_tbl").append(tbl); +- $('.pickbox').fadeIn('fast'); +- +- // Colour Picker +- $("#menucol").spectrum({ +- showInput: true, +- className: "full-spectrum", +- showInitial: true, +- showPalette: true, +- showSelectionPalette: true, +- maxPaletteSize: 6, +- preferredFormat: "hex", +- localStorageKey: "spectrum.demo", +- move: function (color) {}, +- show: function () {}, +- beforeShow: function () {}, +- hide: function () {}, +- change: function() {}, +- palette: [ +- ['rgb(217,217,217)','rgb(189,189,189)','rgb(150,150,150)','rgb(99,99,99)','rgb(37,37,37)'], +- ['rgb(199,233,192)','rgb(161,217,155)','rgb(116,196,118)','rgb(49,163,84)','rgb(0,109,44)'], +- ['rgb(218,218,235)','rgb(188,189,220)','rgb(158,154,200)','rgb(117,107,177)','rgb(84,39,143)'], +- ['rgb(198,219,239)','rgb(158,202,225)','rgb(107,174,214)','rgb(49,130,189)','rgb(8,81,156)'], +- ['rgb(254,217,118)','rgb(254,178,76)','rgb(253,141,60)','rgb(240,59,32)','rgb(189,0,38)'] +- ] +- }); +- } +- +- // Pickbox click events +- $(document).on('click', '.p_row', function() { +- if ($('.tagbox').css('display') != 'none') $('.tagcancel').click(); +- var ctype = $(this).data('type'); +- var alias = $(this).data('alias'); +- var args = $('#tlpick').data('val'); +- switch(ctype) { +- case "l": +- $('.pickbox').fadeOut('fast'); +- $('#search').val(alias + " " + args); +- $('.b_update').click(); +- break; +- case "r": +- $('.pickbox').fadeOut('fast'); +- var url = h2s($(this).data('url')).replace("${var}", args); +- window.open(url); +- break; +- case "t": +- $('.tagbox').fadeIn('fast'); +- $('.taginput').focus(); +- break; +- case "s": +- $('.pickbox').fadeOut('fast', function() {; +- $('#ico05').click(); +- }); +- $('.srch_txt').val(args); +- break; +- case "h": +- doHistory(args); +- $('.pickbox').fadeOut('fast'); +- break; +- default: return; +- } +- }); +- +- // +- // Tags +- // +- +- // Truncate +- function truncTag(tag,len) { +- if (tag.length > len) tag = tag.substring(0,len) + ".."; +- return tag; +- } +- +- // Filter results or add as new +- $(document).on('click', '.tag', function() { +- var tag = $(this).data('val'); +- if($('.taginput').is(":visible")) { +- $('.taginput').val(tag); +- $('.taginput').focus(); +- } else { +- $('#search').val('tag ' + tag); +- $('.b_update').click(); +- } +- }); +- +- // Remove individual tags on "(X)" click via payload area +- $(document).on('mouseenter', '.tag_d, .tag_s', function() { +- var tag = $(this).data('val'); +- if ($(".tag_x")[0]) return; +- var dw = $(this).width() - 5 + "px"; +- $(this).append("
X
"); +- $(".tag_x").css("margin-left", dw); +- $(".tag_x").fadeIn("slow"); +- +- }); +- +- $(document).on('mouseleave', '.tag_d, .tag_s', function() { +- $('.tag_x').remove(); +- }); +- +- $(document).on('click', '.tag_x', function() { +- var tag = $(this).parent().data("val"); +- var obj = $(this).parent().data("obj"); +- $(this).parent().remove(); +- var len = $("#tag_area").text().length; +- if (len == 0) $("#tag_area").append("None."); +- //doTag(s2h(obj),tag,'rm'); +- }); +- +- // Fire tag add on enter +- $('.taginput').keypress(function(e) { +- if (!e) e=window.event; +- key = e.keyCode ? e.keyCode : e.which; +- if (key == 13) $('.tagok').click(); +- }); +- +- // Close tag entry +- $(document).on('click', '.tagcancel', function() { +- $('.taginput').val(''); +- $('.tagbox').fadeOut('fast'); +- }); +- +- // Add a tag +- $(document).on('click', '.tagok', function() { +- var tag = $('.taginput').val(); +- var obj = $('#pickbox_label').text(); +- var re = /^[?a-zA-Z0-9][\s{1}\w-\.]*$/; +- var OK = re.exec(tag); +- if (OK) doTag(s2h(obj),tag,'add'); +- }); +- +- // Remove a tag +- $(document).on('click', '.tagrm', function() { +- var tag = truncTag($('.taginput').val(),20); +- var obj = $('#pickbox_label').text(); +- doTag(s2h(obj),tag,'rm'); +- $(".tag" + ":contains('" + tag + "')").remove(); +- $('.tagcancel').click(); +- }); +- +- // Display or Toggle tags +- function addTag(tag) { +- // If we entered from payload we have some additional info +- if ($('#eview_sub2')[0]) { +- var longTag = tag.split(",")[0]; +- var theClass = tag.split(",")[1]; +- var t_tag = truncTag(longTag,20); +- } else { +- var t_tag = truncTag(tag,20); +- } +- +- // Hide empty +- $('.tag_empty').hide(); +- +- // Check if tag exists +- var tag_exists = 0; +- $('.tag').each(function() { +- if ($(this).text() == t_tag) { +- $(this).addClass('tag_active'); +- tag_exists = 1; +- } +- }); +- +- // Add tag to left pane +- if (tag_exists == 0) { +- var newTag = "
" + t_tag + "
"; +- $('#tg_box').prepend(newTag); +- } +- +- // If we have the payload open, add here as well +- if ($('#eview_sub2')[0]) { +- if($('#pickbox_label').is(":visible")) { +- theClass = $('#pickbox_label').data('sord')[0]; +- } +- // Remove placeholder +- if ($('#tag_none')[0]) $('#tag_none').remove(); +- var newTag = "
" + t_tag + "
"; +- $('#tag_area').prepend(newTag); +- } +- +- } +- +- function doTag(obj,tag,op) { +- var urArgs = "type=19&obtype=tag&object=" + obj + "&value=" + tag + "&op=" + op; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); +- }); +- +- function cb22(data){ +- eval("theData=" + data); +- if (theData.msg != '') { +- alert(theData.msg); +- } else { +- if (op != 'rm') addTag(tag); +- $('.tagcancel').click(); +- } +- } +- } +- +- // Colours +- $(document).on('click', '.csave', function() { +- var obtype = $(this).data('obtype'); +- var object = $(this).data('object'); +- var colour = $('#menucol').val().replace(/#/,"").toUpperCase(); +- var op = "add"; +- var re = /^([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/; +- var OK = re.exec(colour); +- if (!OK) return; +- // Single or multiple? +- if (obtype == "src" || obtype == "dst") { +- var vr = new Array(); +- $("." + obtype).each(function() { +- var v = $(this).text(); +- var re = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; +- var OK = re.exec(v); +- if (OK) { +- var t = vr.indexOf(v); +- if (t < 0) vr.push(v); +- } +- }); +- object = vr.toString(); +- } +- +- var urArgs = "type=19&obtype=" + obtype + "_c&object=" + object + "&value=" + colour + "&op=" + op; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); +- }); +- +- function cb22(data){ +- eval("theData=" + data); +- if (theData.msg != '') { +- alert(theData.msg); +- } else { // We should be good.. +- var curObject = $('#pickbox_label').text(); +- if (obtype == "el") { +- var html = "
" + colour; +- $('#el_' + curObject).html(html); +- $('#el_' + curObject).data('col', colour); +- } else { +- $(".sub_filter:contains(" + curObject + ")").each(function() { +- $(this).find('.object').css('background-color', '#' + colour).parent().data('col', colour); +- }); +- } +- $('.pickbox').fadeOut('fast'); +- } +- } +- }); +- +- $(document).on('click', '.pickbox_close', function() { +- $('.tagcancel').click(); +- $('.pickbox').fadeOut('fast'); +- }); +- +- // +- // Object History +- // +- +- function hItemAdd(item) { +- var itemTitle = item; +- // Truncate +- if (item.length > 33) { +- itemTitle = item.substring(0,33) + ".."; +- } +- // Remove empty message +- $('.history_empty').hide(); +- +- // If the item doesn't exist, add it. Otherwise, we start counting. +- if ($(".h_item:contains('" + itemTitle + "')").length > 0) { +- var oc = $(".h_item:contains('" + itemTitle + "')").data('n'); +- var nc = Number(oc) + 1; +- var bg = '#c9c9c9'; +- var fn = 'normal'; +- if (nc <= 3) { +- bg = '#000'; +- } else if (nc > 3) { +- bg = '#cc0000'; +- fn = 'bold'; +- } +- +- $(".h_item:contains('" + itemTitle + "')").css('color', bg); +- $(".h_item:contains('" + itemTitle + "')").css('font-weight', fn); +- $(".h_item:contains('" + itemTitle + "')").data('n',nc); +- $(".h_item:contains('" + itemTitle + "')").text(itemTitle + "(" + nc + ")"); +- } else { +- var toAdd = " " + itemTitle + ""; +- $('#h_box').prepend(toAdd); +- } +- } +- +- if (!$('.h_item')[0]) { +- $('.history_empty').show(); +- } +- +- // Alt mappings for icons +- +- $.alt('1', function() { +- $("#ico01").click(); +- }); +- $.alt('2', function() { +- $("#ico02").click(); +- }); +- $.alt('3', function() { +- $("#ico03").click(); +- }); +- $.alt('4', function() { +- $("#ico05").click(); +- }); +- $.alt('5', function() { +- $("#ico04").click(); +- }); +- +- // +- // Event classification +- // +- +- // Use function keys to trigger status buttons +- $(document).keydown(function(event){ +- +- function stopOthers() { +- event.originalEvent.keyCode = 0; +- event.preventDefault(); +- event.stopPropagation(); +- } +- +- switch (event.keyCode) { +- case 112: stopOthers(); $('#b_class-11').click(); break; +- case 113: stopOthers(); $('#b_class-12').click(); break; +- case 114: stopOthers(); $('#b_class-13').click(); break; +- case 115: stopOthers(); $('#b_class-14').click(); break; +- case 116: stopOthers(); $('#b_class-15').click(); break; +- case 117: stopOthers(); $('#b_class-16').click(); break; +- case 118: stopOthers(); $('#b_class-17').click(); break; +- case 119: stopOthers(); $('#b_class-1').click(); break; +- case 120: stopOthers(); $('#b_class-2').click(); break; +- } +- }); +- +- // Comment window status buttons +- $(document).on("click", "#cw_buttons", function(event) { +- var newclass = $(event.target).data('n'); +- if (newclass == 0) { +- $('#b_class-' + newclass).click(); +- } else { +- $('#b_class-' + newclass).click(); +- } +- }); +- +- // Highlight colour for selected events +- var hlcol = "#FFFFE0"; +- var hlhov = "#FDFDD6"; +- +- // Individual selects +- var clickOne = 0, clck1 = 0, clck2 = 0; +- $(document).on("click", ".chk_event", function(event) { +- $("#tl3b").trigger('update'); +- var clickTwo = this.id.split("_"); +- if (Number(clickOne[1]) > Number(clickTwo[1])) { +- clck1 = clickTwo[1]; +- clck2 = clickOne[1]; +- } else { +- clck1 = clickOne[1]; +- clck2 = clickTwo[1]; +- } +- +- if (event.shiftKey) { +- if (clck1 != clck2) { +- $("#s" + clck1).nextUntil("#s" + clck2).find(".chk_event").prop("checked", true); +- $("#s" + clck1).nextUntil("#s" + clck2).css("background-color", hlcol); +- $("#s" + clck1).nextUntil("#s" + clck2).hover( +- function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- clickOne = 0, clck1 = 0, clck2 = 0; +- } +- } +- +- // Update class_count +- $("#class_count").html($(".chk_event:checked").length); +- if ($("#ca1:checked").length > 0) { +- $("#ca1").prop("checked",false); +- } +- clickOne = this.id.split("_"); +- +- if ($(this).prop("checked") == true) { +- $("#s" + clickTwo[1]).css("background-color", hlcol); +- $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- } else { +- $("#s" + clickTwo[1]).css("background-color", "transparent"); +- $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "transparent")}); +- } +- }); +- +- // Select all (2) +- $(document).on("click", "#ca1", function(event) { +- var chkLen = $("#ca1:checked").length; +- switch(chkLen) { +- case 0: +- $(".chk_event").prop("checked",false); +- $("#ca0").prop("checked",false); +- $(".d_row_sub1").css("background-color", "transparent"); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "transparent")}); +- break; +- default: +- $(".chk_event").each(function() { +- if ($(this).prop("disabled") == false) { +- $(this).prop("checked",true); +- } +- }); +- $(".d_row_sub1").css("background-color", hlcol); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- $("#ca0").prop("checked",true); +- break; +- } +- +- if ($(".eview_sub1")[0]) { +- // Update class_count +- $("#class_count").html($(".chk_event:checked").length); +- } +- +- }); +- +- // Select all (2a) - clean this up, the above is almost identical +- $(document).on("click", "#ca2", function(event) { +- var chkLen = $("#ca2:checked").length; +- switch(chkLen) { +- case 0: +- $(".chk_event").prop("checked",false); +- $("#ca2").prop("checked",false); +- $(".d_row_sub1").css("background-color", "transparent"); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "transparent")}); +- break; +- default: +- $(".chk_event").each(function() { +- if ($(this).prop("disabled") == false) { +- $(this).prop("checked",true); +- } +- }); +- $(".d_row_sub1").css("background-color", hlcol); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- $("#ca2").prop("checked",true); +- break; +- } +- // Update class_count +- $("#class_count").html($(".chk_event:checked").length); +- }); +- +- // Class button click +- $(document).on("click", "[id*=\"b_class-\"]", function() { +- // We only fire if something is selected +- var chkLen = parseInt($(".chk_event:checked").length + $(".chk_all:checked").length); +- var intclass = $(this).attr('id').split("-"); +- if (chkLen > 0 && intclass[1] != 0) { +- eClass(this,intclass[1]); +- } +- }); +- +- function eClass(caller,intclass) { +- // The sid.cid values +- var scid= "", scidlist = "", ecls = 0; +- if ($(".eview_sub1")[0] || $("#ca2")[0]) { +- $(".chk_event:checked").each(function() { +- if ($(this).data('eclass') == 0) { +- ecls++; +- } +- scid += $(this).val() + ","; +- }); +- scidlist = scid.replace(/,$/, ""); +- } else { +- ecls = $(".d_row_active").find(".b_ec_hot").text(); +- scidlist = $("#ca0").data("scid"); +- } +- +- // Was there a message? +- var msg = "none"; +- if ($(".cat_msg_txt").val().length != 0) { +- msg = $(".cat_msg_txt").val(); +- } +- +- if ($('#cat_box').css('display') != 'none') { +- $('#ico01').click(); +- } +- +- // We are now ready to class +- var catdata = intclass + "|||" + msg + "|||" + scidlist; +- var urArgs = "type=" + 9; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, { catdata: catdata } ,function(data){cb9(data)}); +- }); +- +- function cb9(data){ +- eval("catRaw=" + data); +- catDbg = catRaw.dbg; +- if (catDbg == "0") { +- +- var curtotalrtcount = Number(ecls); +- // Working on grouped events +- if ($("#gr").text() == "on") { +- curclasscount = Number($("#class_count").text()); +- var curtotalparentcount = $(".d_row_active").find(".b_ec_hot").text(); +- // Do we have queued events? +- if (curtotalparentcount > 0) { +- +- // Are we working on queued events? +- if (curtotalrtcount > 0) { +- curclasscount = curtotalrtcount; +- } else { +- curclasscount = 0; +- } +- // Adjust the parent count +- newparentcount = parseInt(curtotalparentcount - curclasscount,10); +- $(".d_row_active").find(".b_ec_hot").text(newparentcount); +- +- if (newparentcount == 0) { +- $(".d_row_active").find(".b_ec_hot").parent().attr('class','row'); +- $(".d_row_active").find(".b_ec_hot").attr('class','b_ec_cold'); +- } +- +- // If we are working within the child, adjust accordingly +- if ($(".eview_sub1")[0]) { +- // How many are in the child +- curtotalchildcount = $(".d_row_sub_active").find(".b_ec_hot").text(); +- +- // Adjust the child count +- newchildcount = parseInt(curtotalchildcount - curclasscount,10); +- $(".d_row_sub_active").find(".b_ec_hot").text(newchildcount); +- if (newchildcount == 0) { +- $("#ca1").prop("disabled",true); +- $(".d_row_sub_active").find(".b_ec_hot").parent().attr('class','sub'); +- $(".d_row_sub_active").find(".b_ec_hot").attr('class','b_ec_cold'); +- } +- // Otherwise we were called from the parent +- } else { +- $(".d_row_sub").find(".b_ec_hot").parent().attr('class','sub'); +- $(".d_row_sub").find(".b_ec_hot").text(0); +- $(".d_row_sub").find(".b_ec_hot").attr('class','b_ec_cold'); +- $("#ca0").prop("disabled",true); +- } +- lastclasscount = newparentcount; +- } +- +- // Lastly, update class_count +- if (rtbit == 1 || curtotalrtcount > 0 || $("#eview_sub")[0]) { +- $("#class_count").html(0); +- } else { +- $("#class_count").html($(".d_row_active").find(".b_ec_total").text()); +- } +- +- // Working on ungrouped events +- } else { +- $("#class_count").html(lastclasscount); +- } +- +- // What the new classification is +- selClass = $(caller).data("cn"); +- newClass = "a_" + selClass; +- +- // Change visible class and disable if RT +- // If we are RT ungrouped, we just remove +- if ($('#rt').text() == 'on' && $("#ca2")[0]) { +- $(".chk_event:checked").each(function() { +- var pid = $(this).attr("id").split("_"); +- var nid = parseInt(Number(pid[1]) + 1); +- // Remove any open payload or TX panes +- if ($("[id^=eview_]")[0]) { +- $("[id^=eview_]").remove(); +- $(".d_row_sub1").css('opacity','1'); +- } +- // Remove the row +- $("#s" + pid[1]).fadeOut('fast', function() { +- $("#s" + pid[1]).remove(); +- }); +- }); +- +- // Update table (for sorter) +- $("#tl3b").trigger('update'); +- } else { +- // If we are RT and all events are classed we just remove +- if ($('#rt').text() == 'on' && $(".d_row_active").find(".b_ec_hot").text() == 0) { +- $("#active_eview").remove(); +- $(".d_row_active").fadeOut('slow', function (event) { +- $(".d_row_active").remove(); +- var newsigtotal = "-"; +- var sigtotal = $("#esignature").text(); +- if (sigtotal > 0) { +- newsigtotal = parseInt(sigtotal - 1); +- } +- $("#esignature").text(newsigtotal); +- }); +- $(".d_row").css('opacity','1'); +- } else { +- $(".chk_event:checked").each(function() { +- var n = this.id.split("_"); +- $("#class_box_" + n[1]).attr('class', newClass); +- $("#class_box_" + n[1]).text(selClass); +- if (curtotalparentcount > 0) { +- $(this).prop("disabled",true); +- } +- }); +- } +- $(".d_row_sub1").css("background-color", "#fafafa"); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "#fafafa")}); +- } +- +- // Uncheck everything +- $(".chk_event").prop("checked", false); +- $(".chk_all").prop("checked", false); +- // Remove these scids from the L1 scidlist +- if ($("#ca0")[0] && rtbit == 1) { +- var cur_scidlist = scidlist.split(','); +- var active_scidlist = $("#ca0").data("scid"); +- for (var i = 0; i < cur_scidlist.length; i++) { +- active_scidlist = active_scidlist.replace(cur_scidlist[i],''); +- } +- active_scidlist = active_scidlist.replace(/,{2,}/g,','); +- active_scidlist = active_scidlist.replace(/(^,|,$)/g,''); +- $("#ca0").data("scid", active_scidlist); +- } +- catMsg(scidlist.split(',').length, curtotalrtcount); +- } else { +- catMsg(0); +- } +- } +- } +- +- function catMsg(count, rtcount) { +- switch (count) { +- default: +- var ess = ''; +- if ( count > 1 ) ess = 's'; +- +- var numrows = Number($('.d_row').length + $('.d_row_sub1').length); +- var newboxtotal = 0, newcatcount = 0; +- newboxtotal = parseInt($("#qtotal").text() - rtcount); +- $("#qtotal").text(newboxtotal); +- +- // If we are just rt update Total boxes as we go +- if ($("#ca2")[0]) { // We are ungrouped +- newcatcount = parseInt($("#cat_count").text() - count); +- if (newcatcount == 0) { +- newView("u"); +- } else { +- $("#cat_count").text(newcatcount); +- } +- } +- +- if (numrows == 0) { +- newView("u"); +- } +- +- var msg = count + " event" + ess + " categorized"; +- clearTags(); +- break; +- } +- +- $("span.class_msg").text(msg); +- $("span.class_msg").fadeIn('slow', function() { +- setTimeout(function(){ +- $(".class_msg").fadeOut('slow'); +- }, 3000); +- }); +- } +- +- // Load summary tab +- function loadSummary() { +- var limit = 10; +- if ($('#wm0')[0]) { +- doMap("redraw"); +- } else { +- doMap("draw"); +- } +- mkSummary("signature",limit); +- mkSummary("srcip",limit); +- mkSummary("dstip",limit); +- mkSummary("srcpt",limit); +- mkSummary("dstpt",limit); +- mkSummary("srccc",limit); +- mkSummary("dstcc",limit); +- } +- +- // Toggle summary section +- $(document).on("click", ".hidepane", function(e) { +- $('#topsignature').toggle(); +- }); +- +- // Summary tab +- function mkSummary(box,limit) { +- var theWhen = getTimestamp(); +- var theSensors = s2h('empty'); +- var theFilter = mkFilter(); +- // See if we are filtering by sensor +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- var ldr = "
"; +- $('#ov_' + box + '_sl').prepend(ldr); +- $('#top' + box).fadeTo('fast', 0.2); +- switch (box) { +- case "srcip": +- var cbArgs = "srcip"; +- var qargs = "ip-src"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- case "dstip": +- var cbArgs = "dstip"; +- var qargs = "ip-dst"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- case "srcpt": +- var cbArgs = "srcpt"; +- var qargs = "pt-src"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); +- }); +- break; +- case "dstpt": +- var cbArgs = "dstpt"; +- var qargs = "pt-dst"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); +- }); +- break; +- case "signature": +- var qargs = "sig-sig"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb16(data)}); +- }); +- break; +- case "srccc": +- var cbArgs = "srccc"; +- var qargs = "cc-src"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- case "dstcc": +- var cbArgs = "dstcc"; +- var qargs = "cc-dst"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- } +- +- // IP and Country +- function cb15(data,cbArgs){ +- var ch = "SRC"; +- var wip = "d"; +- if (cbArgs[0] == "s") ch = "DST", wip = "s"; +- eval("raw=" + data); +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "#SIG"; +- head += "#" + ch + ""; +- if (cbArgs[3] == "c") { +- head += "COUNTRY"; +- head += "#IP"; +- } else { +- head += "IP"; +- head += "COUNTRY"; +- } +- head += ""; +- +- var eventsum = raw[raw.length - 1].n || 0; +- var records = raw[raw.length - 1].r || 0; +- if (records == 0) { +- row = "No result."; +- $("#ov_" + cbArgs + "_sl").text(""); +- } +- for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + sigs + ""; +- row += "" + ip2 + ""; +- +- if (cbArgs[3] == "c") { +- row += ""; +- row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; +- row += "" + ip + ""; +- } else { +- row += "
" + ip + ""; +- row += ""; +- row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; +- } +- row += ""; +- row += "
"; +- } +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); +- $("#ov_" + cbArgs + "_sl").after(tbl); +- $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); +- mkSlider("ov_" + cbArgs + "_sl", i, records); +- } +- +- // Ports +- function cb17(data,cbArgs){ +- eval("raw=" + data); +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "#SIG"; +- head += "#SRC" +- head += "#DST"; +- head += "PORT"; +- head += ""; +- +- var eventsum = raw[raw.length - 1].n || 0; +- var records = raw[raw.length - 1].r || 0; +- if (records == 0) { +- row = "No result."; +- $("#ov_" + cbArgs + "_sl").text(""); +- } +- for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + sigs + ""; +- row += "" + src + ""; +- row += "" + dst + ""; +- row += "" + port + ""; +- row += ""; +- row += "
"; +- } +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); +- $("#ov_" + cbArgs + "_sl").after(tbl); +- $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); +- mkSlider("ov_" + cbArgs + "_sl", i, records); +- } +- // Signature +- function cb16(data){ +- eval("raw=" + data); +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "#SRC"; +- head += "#DST"; +- head += "SIGNATURE"; +- head += "ID"; +- head += ""; +- +- var eventsum = raw[raw.length - 1].n || 0; +- var records = raw[raw.length - 1].r || 0; +- if (records == 0) { +- row = "No result."; +- $("#ov_signature_sl").text(""); +- $("#ovestat").html("(No events)"); +- } else { +- $("#ovestat").html("(" + eventsum + " events)"); +- } +- for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + src + ""; +- row += "" + dst + ""; +- row += "" + sig + ""; +- row += "" + sid + ""; +- row += ""; +- row += "
"; +- } +- +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($('#topsignature')[0]) $('#topsignature').remove(); +- $("#ov_signature_sl").after(tbl); +- $("#ov_signature_msg").html("viewing " + i + " of " + records + " results"); +- mkSlider("ov_signature_sl", i, records); +- } +- } +- +- $(".ovsl").mouseup(function() { +- var section = $(this).attr('id'); +- var base = section.split("_")[1]; +- var limit = Number($("#" + section + "_lbl").text()); +- if (limit > 0) mkSummary(base, limit); +- }); +- +- // +- // Views tab +- // +- +- function loadViews() { +- $('.db_links').show(); +- if (!$("#db_view_cont")[0]) mkView(); +- } +- +- // Link handlers +- $(document).on('click', '.db_link', function() { +- $('.db_link').each(function() { +- if ($(this).data('state') == '1') { +- $(this).removeClass('db_link_active'); +- $(this).data('state', '0'); +- } +- }); +- $(this).data('state', '1'); +- mkView(); +- }); +- +- $(document).on('click', '.db_type', function() { +- $('.db_type').each(function() { +- if ($(this).data('state') == '1') { +- $(this).removeClass('db_type_active'); +- $(this).data('state', '0'); +- } +- }); +- $(this).data('state', '1'); +- mkView(); +- }); +- +- $(document).on('click','.db_save', function() { +- +- }); +- +- // Create the view +- function mkView() { +- $('#db_view_cont,#hp_info').remove(); +- if (!$("#db_view_ldr")[0]) { +- var view = 'ip'; +- $('.db_link').each(function() { +- if ($(this).data('state') == '1') { +- $(this).addClass('db_link_active'); +- view = $(this).data('val'); +- } +- }); +- +- var type = 'sk'; +- $('.db_type').each(function() { +- if ($(this).data('state') == '1') { +- $(this).addClass('db_type_active'); +- type = $(this).data('type'); +- } +- }); +- +- var theWhen = getTimestamp(); +- var theSensors = s2h('empty'); +- var theFilter = mkFilter(); +- // See if we are filtering by sensor +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- var ldr = "
"; +- $('.db_view').after(ldr); +- var qargs = view + "-" + type; +- var urArgs = "type=16&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,type)}); +- }); +- +- function cb17(data,type) { +- eval("viewData=" + data); +- var records = viewData.records; +- if ($('#db_view_cont')[0]) $('#db_view_cont').remove(); +- if (records > 0) { +- $('.db_view').after("
"); +- switch (type) { +- case 'sk': +- var w = $(window).width(); +- var h = viewData.links.length * 12; +- if (h < 100) h = 100; +- mkSankey("db_view_cont",viewData,w,h); +- break; +- } +- } else { +- $('.db_view').after("
The query returned no results.
"); +- } +- $('#db_view_ldr').remove(); +- } +- } +- } +- +- // Make a map +- function doMap() { +- theWhen = getTimestamp(); +- var theFilter = mkFilter(); +- var working = "Working
"; +- +- $('#wm0').html(working); +- +- var urArgs = "type=" + 10 + "&filter=" + theFilter + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb10(data)}); +- }); +- +- function cb10(data){ +- eval("mapRaw=" + data); +- try { +- var mapDetail = $.parseJSON("{" + mapRaw.all + "}"); +- var srcc = mapRaw.srcc; +- var srce = mapRaw.srce; +- var dstc = mapRaw.dstc; +- var dste = mapRaw.dste; +- var allc = mapRaw.allc; +- var alle = mapRaw.alle; +- } +- catch(e) { +- var mapDetail = "{\"\"}"; +- } +- +- // What is our current event total? +- var esum = $('#event_sum').val(); +- var w = $(window).width() - 72; +- var h = w / 2.7 ; +- $("#ov_map").html("
"); +- $('#wm0').vectorMap({ +- map: 'world_mill_en', +- color: '#f4f3f0', +- backgroundColor: '#CFE1FC', +- zoomOnScroll: false, +- onRegionClick: function(event, code){ +- hItemAdd(code); +- $('#search').val("cc" + " " + code); +- $('#search').focus(); +- }, +- series: { +- regions: [{ +- values: mapDetail, +- scale: ['#ffffff', '#000000'], +- normalizeFunction: 'polynomial' +- }] +- }, +- onRegionLabelShow: function(e, el, code){ +- if (mapDetail[code]) { +- var eper = parseFloat(mapDetail[code]/esum*100).toFixed(3); +- el.html(el.html() + ' (' + mapDetail[code] + ' Events ' + eper + '% of Total)'); +- } else { +- el.html(el.html()); +- } +- } +- }); +- +- var stats = "("; +- stats += allc + " distinct countries)"; +- $("#ovmapstat").html(stats); +- } +- } +- +- // Redraw map +- $(document).on("click", "#map_src, #map_dst", function() { +- doMap($(this).attr('id').split("_")[1]); +- }); +- +- // +- // History +- // +- +- function doHistory(object) { +- $('#loader').show(); +- var urArgs = "type=" + 21 + "&object=" + s2h("aa" + object) + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb21(data)}); +- }); +- +- function cb21(data){ +- eval("chartData=" + data); +- var r1 = chartData.r1; +- var r2 = chartData.r2; +- var sum = 0; +- if (r1 > 0) { +- mkHeatMap(".ev_hm",chartData.start,chartData.rows1,object); +- $('#obhist_sig').remove(); +- if (r2 > 0) { +- +- for (var i=0; i < r2; i++) { +- sum += Number(chartData.rows2[i].value); +- } +- +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "SIGNATURE"; +- head += ""; +- row += ""; +- +- for (var i=0; i < r2; i++) { +- +- var cnt = chartData.rows2[i].value || "-"; +- var sig = chartData.rows2[i].label || "-"; +- var sid = chartData.rows2[i].sid || "-"; +- var per = 0; +- if (sum > 0) var per = parseFloat(cnt/sum*100).toFixed(2); +- var tsg = truncTag(sig,60); +- +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + tsg + ""; +- row += "" +- row += "
"; +- } +- +- row += ""; +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($('#obhist_sig')[0]) $('#obhist_sig').remove(); +- $(".ev_py").append(tbl); +- } +- } else { +- return; +- } +- if ($(".eview_charts")[0]) $('.eview_charts').slideDown('slow'); +- $("#loader").hide(); +- } +- } +-// The End. +-}); +--- securityonion-squert-20161212.orig/auth/native/squert/login.php ++++ /dev/null +@@ -1,158 +0,0 @@ +- +-// +-// This program is free software: you can redistribute it and/or modify +-// it under the terms of the GNU General Public License as published by +-// the Free Software Foundation, either version 3 of the License, or +-// (at your option) any later version. +-// +-// This program is distributed in the hope that it will be useful, +-// but WITHOUT ANY WARRANTY; without even the implied warranty of +-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-// GNU General Public License for more details. +-// +-// You should have received a copy of the GNU General Public License +-// along with this program. If not, see . +-// +-// +- +-include_once '.inc/config.php'; +- +-$username = $password = $err = ''; +-$focus = 'username'; +-session_set_cookie_params(0, NULL, NULL, NULL, TRUE); +- +-function cleanUp($string) { +- if (get_magic_quotes_gpc()) { +- $string = stripslashes($string); +- } +- $string = mysql_real_escape_string($string); +- return $string; +-} +- +-if ($_SERVER['REQUEST_METHOD'] == 'POST'){ +- $username = $_REQUEST['username']; +- $password = $_REQUEST['password']; +- // sso +- //$username = $_SERVER['PHP_AUTH_USER']; +- //$password = $_SERVER['PHP_AUTH_PW']; +- +- $ua = $_SERVER['HTTP_USER_AGENT']; +- $rqt = $_SERVER['REQUEST_TIME']; +- $rqaddr = $_SERVER['REMOTE_ADDR']; +- $max = mt_getrandmax(); +- $rqt .= mt_rand(0,$max); +- $rqaddr .= mt_rand(0,$max); +- $ua .= mt_rand(0,$max); +- $cmpid = $rqt . $rqaddr . $ua; +- $id = md5($cmpid); +- // PDO prepared statements +- try { +- // first connect to database with the PDO object. +- $dbpdo = new PDO("mysql:host=$dbHost;dbname=$dbName;charset=latin1", "$dbUser", "$dbPass", [ +- PDO::ATTR_EMULATE_PREPARES => false, +- PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => false, +- PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION +- ]); +- } catch(PDOException $e){ +- // if connection fails, log PDO error. +- error_log("Error connecting to mysql: ". $e->getMessage()); +- } +- +- if (isset($dbpdo)) { +- // prepare statement +- $statement = "SELECT * FROM user_info WHERE username = :user"; +- $query = $dbpdo->prepare("$statement"); +- // build parameters for prepared statement +- $params = [":user" => "$username"]; +- // execute the prepared statement and pass it params +- $query->execute($params); +- // fetch the data +- while ($row = $query->fetch(PDO::FETCH_NUM)) { +- $userName = $row[1]; +- $lastLogin = $row[2]; +- $userHash = $row[3]; +- $userEmail = $row[4]; +- $userType = $row[5]; +- $userTime = $row[6]; +- $tzoffset = $row[7]; +- } +- +- // if $username was found in database, then check password +- if ( isset($userName) && $username == $userName) { +- // The first 2 chars are the salt +- $theSalt = substr($userHash, 0,2); +- +- // The remainder is the hash +- $theHash = substr($userHash, 2); +- +- // Now we hash the users input +- $testHash = sha1($password . $theSalt); +- +- // Does it match? If yes, start the session. +- if ($testHash === $theHash) { +- session_start(); +- +- // Protect against session fixation attack +- if (!isset($_SESSION['initiated'])) { +- session_regenerate_id(); +- $_SESSION['initiated'] = true; +- } +- +- $_SESSION['sLogin'] = 1; +- $_SESSION['sUser'] = $userName; +- $_SESSION['sPass'] = $password; +- $_SESSION['sEmail'] = $userEmail; +- $_SESSION['sType'] = $userType; +- $_SESSION['sTime'] = $userTime; +- $_SESSION['tzoffset'] = $tzoffset; +- $_SESSION['sTab'] = 't_sum'; +- $_SESSION['id'] = $id; +- +- header ("Location: index.php?id=$id"); +- } else { +- $err = 'The user name or password is incorrect.'; +- $focus = 'username'; +- } +- } else { +- $err = 'The user name or password is incorrect.'; +- $focus = 'username'; +- } +- } else { +- $err = 'Connection Failed'; +- } +-} +-?> +- +- +- +-Please login to continue +- +- +- +- +-
+-
+- +- +- +- +- +- +-
+-squert - Please login to continue
+-Username
+-
+-Password
+-
+-

+-
Version 1.7.1©2016 Paul Halliday
+-
+-
+- +- +- +--- securityonion-squert-20161212.orig/auth/sso/squert/.js/squertMain.js ++++ /dev/null +@@ -1,3276 +0,0 @@ +-/* Copyright (C) 2012 Paul Halliday */ +- +-$(document).ready(function(){ +- +- $(document).on('click', '[class*="bpr"]', function() { +- // We disallow filtering if any events have already been selected +- // or if we stray from the event tab +- if ($('.d_row_active')[0]) return; +- if ($(".chk_event:checked").length > 0) return; +- if ($(".tab_active").attr('id') != 't_sum') return; +- +- var prClass = $(this).attr('class').split('b')[1]; +- var prOld = $(this).data('pr'); +- +- function flipIt(pattern) { +- $(pattern).closest('tr').hide(); +- $(pattern).closest('tr').attr('class','hidden'); +- if ($('#gr').text() == 'on') $(pattern).closest('tr').find('.chk_event').prop("disabled",true); +- } +- if ($('.b' + prClass).attr('class') == 'bprA') { +- $('.b' + prClass).attr('class', 'bpr' + prOld); +- $('.hidden').attr('class','d_row'); +- $('.d_row').show(); +- if ($('#gr').text() == 'on') { +- $('.chk_event').prop("disabled",false); +- $('.chk_all').prop("checked",false); +- $('.chk_event').css("background-color", "#fafafa"); +- } +- } else { +- // See if we are already filtered +- if ($('.bprA')[0]) { +- $('.hidden').attr('class','d_row'); +- $('.d_row').show(); +- if ($('#gr').text() == 'on') { +- $('.chk_event').prop("disabled",false); +- $('.chk_all').prop("checked",false); +- $('.chk_event').css("background-color", "#fafafa"); +- } +- var prPrev = $('.bprA').data('pr'); +- $('.bprA').attr('class', 'bpr' + prPrev); +- } +- $('.b' + prClass).attr('class','bprA'); +- switch (prClass) { +- case "pr1": ptrn = ".pr2,.pr3,.pr4"; break; +- case "pr2": ptrn = ".pr1,.pr3,.pr4"; break; +- case "pr3": ptrn = ".pr1,.pr2,.pr4"; break; +- case "pr4": ptrn = ".pr1,.pr2,.pr3"; break; +- } +- flipIt(ptrn); +- } +- }); +- +- // +- // Load main content +- // +- +- // Keep track of context +- thisUser = $('#t_usr').data('c_usr'); +- thisTZ = $('#user_tz').val(); +- rtbit = 0; +- eventList("0-aaa-00"); +- $("#loader").show(); +- lastclasscount = 0; +- +- $(document).on("click", "#dt_savetz", function(event) { +- if ($('.dt_error').data('err') == 0) { +- var newOffset = $('#ts_offset').val(); +- profileUpdate("tz", s2h(newOffset)); +- $('#user_tz').val(newOffset); +- } +- }); +- +- // Depending on context a 'No result' may be confusing +- // so we turn off active queue and show everything +- $(document).on('click', '#retry', function() { +- $('#rt').attr('class','tvalue_off'); +- $('#rt').text('off'); +- rtbit = 0; +- $('.b_update').click(); +- }); +- +- // Get event statuses +- var eTotal = 0, qTotal = 0; +- function statusPoll(caller) { +- // See if we are filtering by sensor +- var theSensors = s2h('empty'); +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- var urArgs = "type=" + 6 + "&ts=" + theWhen + "&sensors=" + theSensors; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb(data)}); +- }); +- +- function cb(data){ +- // Check to make sure we still have a valid session. If we don't +- // let the user know and return them to the login page. +- if (data[0] == "<") { +- $("span.class_msg").text("Your session has expired!"); +- $("span.class_msg").css("background-color", "#cc0000"); +- $("span.class_msg").css("color", "#fff"); +- $("span.class_msg").show(); +- var sessionDead = confirm("Your session has expired. Press \"OK\" to return to the login page. If you aren't finished with what you were looking at click 'Cancel'. Note: you won't be able to perform any actions."); +- if (sessionDead) { +- $("#logout").click(); +- } +- } +- eval("ec=" + data); +- +- var esum = 0; +- +- for (var i=0; i 0) { +- var p = parseFloat(ecount/esum*100).toFixed(1); +- var w = parseInt(p*2); +- } +- if (eclass == 0) { +- qTotal = ecount; +- } +- $("#c-" + eclass).text(ecount); +- $("#c-" + eclass).append("(" + p + "%)"); +- } +- +- var lastcount = $("#cat_sum").val(); +- var newcount = esum; +- $("#cat_sum").val(esum); +- eTotal = esum; +- $("#event_sum").val(eTotal); +- +- if (caller == 0) { // Fresh load +- lastcount = newcount; +- } +- +- // Last RT value +- var lastQ = Number($("#qtotal").html()); +- if (lastcount < newcount) { +- $("#etotal").html(eTotal); +- } +- +- if (lastQ < qTotal) { +- if (caller != 0) { +- if ($(".icon_notifier").css('display') == 'none') $(".icon_notifier").fadeToggle(); +- } +- $("#etotal").html(eTotal); +- $("#qtotal").html(qTotal); +- } +- +- $("#title").html("squert (" + qTotal + ") - " + thisUser); +- +- } +- +- } +- +- // +- // Event monitor (how often we poll for new events) +- // +- +- var emTimeout = 30000; +- window.setInterval(function(){ +- if ($('#search').val().length == 0) { +- statusPoll(1); +- } +- }, emTimeout); +- +- $(document).on("click", '[class*="cl_"]', function(event) { +- var nc = $(this).attr('class').split("_"); +- var ct = $(this).parents('table').data('comment'); +- $(".cat_msg_txt").val(ct); +- $('#b_class-' + nc[1]).click(); +- }); +- +- // Tabs +- var tab_cached = $("#sel_tab").val(); +- +- switch (tab_cached) { +- case "t_sum": +- $('.content-right').show(); +- break; +- case "t_ovr": +- $('.content-right').hide(); +- $('.content-left').hide(); +- if ($('#ovestat').text().length == 0) loadSummary(); +- break; +- case "t_view": +- $('.content-right').hide(); +- $('.content-left').hide(); +- loadViews(); +- default: +- $('.content-right').hide(); +- $('.content-left').hide(); +- break; +- } +- +- $('#' + tab_cached).attr('class','tab_active'); +- $("#" + tab_cached + "_content").attr('class','content_active'); +- +- $(".tab,.tab_active").click(function(event) { +- var active = $(".tab_active").attr('id'); +- var content = $(".content_active").attr('id'); +- if ($(".fl_val_on")[0]) { +- $('.b_update').click(); +- } +- +- if ( this.id != active ) { +- $("#" + active).removeClass('tab_active'); +- $("#" + active).addClass('tab'); +- $(this).attr('class','tab_active'); +- $("#" + content).attr('class','content'); +- $("#" + this.id + "_content").attr('class','content_active'); +- activeTab = $(".tab_active").attr('id'); +- $('.pin').hide(); +- +- switch (activeTab) { +- case "t_sum": +- $('.content-right').show(); +- if (Number($('.botog').data('val')) == 1) $('.content-left').show(); +- $('.t_pbar').css('opacity',1); +- $('.db_links').hide(); +- $('.pin').show(); +- break; +- case "t_ovr": +- $('.content-right').hide(); +- $('.content-left').hide(); +- if ($('#ovestat').text().length == 0) loadSummary(); +- $('.t_pbar').css('opacity',.1); +- $('.db_links').hide(); +- break; +- case "t_view": +- $('.content-right').hide(); +- $('.content-left').hide(); +- $('.t_pbar').css('opacity',.1); +- loadViews(); +- break; +- default: +- $('.content-right').hide(); +- $('.content-left').hide(); +- $('.t_pbar').css('opacity',.1); +- $('.db_links').hide(); +- break; +- } +- +- $('#sel_tab').val(activeTab); +- var ctab = $('#sel_tab').val(); +- var urArgs = "type=" + 5 + "&tab=" + ctab; +- $.get(".inc/callback.php?" + urArgs); +- } +- }); +- +- // Sub tab groups +- $(".tsg").click(function(event) { +- var nc = Number($(this).attr('class').split(/\s/).length); +- var ct = $(this).data('tab'); +- $('.tsg_active').attr('class','tsg'); +- $(this).attr('class','tsg tsg_active'); +- }); +- +- // Toggle and update views +- function newView(req) { +- // No racing please +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- // Remove any stale views +- $("#tl0,#tl1,#tl3a,#tl3b").remove(); +- var f = "0-aaa-00"; +- var s = "2a-aaa-00"; +- var cv = $("#gr").text(); +- +- switch (cv) { +- case "on": +- eventList(f); +- $("#loader").show(); +- break; +- case "off": +- eventList(s); +- $("#loader").show(); +- break; +- } +- } +- +- // Group and ungroup +- $(document).on("click", "#gr", function(event) { +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- var cv = $('#gr').text(); +- switch (cv) { +- case 'on': +- $('#gr').attr('class','tvalue_off'); +- $('#gr').text('off'); +- break; +- case 'off': +- $('#gr').attr('class','tvalue_on'); +- $('#gr').text('on'); +- $("#event_sort").val("DESC"); +- break; +- } +- }); +- +- // RT check/uncheck +- $(document).on("click", "#rt", function(event) { +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- var cv = $('#rt').text(); +- switch (cv) { +- case 'on': +- $('#rt').attr('class','tvalue_off'); +- $('#rt').text('off'); +- rtbit = 0; +- break; +- case 'off': +- $('#rt').attr('class','tvalue_on'); +- $('#rt').text('on'); +- rtbit = 1; +- break; +- } +- }); +- +- // Toggle side/lower bars +- $(document).on("click", ".botog", function(event) { +- if ($('.tab_active').attr('id') != 't_sum') return; +- var n = Number($('.botog').data("val")); +- switch (n) { +- case 1: +- $('.botog').data("val","0"); +- $('.content-right').css("width","100%"); +- $('.botog').attr('src','.css/layout0.png'); +- break; +- case 0: +- $('.botog').data("val","1"); +- $('.content-right').css("width","82%"); +- $('.botog').attr('src','.css/layout1.png'); +- break; +- } +- $('.bottom').animate({height: 'toggle'}); +- $('.content-left').animate({width: 'toggle'}); +- }); +- +- // Section show and hide +- $(".st").click(function() { +- var thisSec = $(this).data("sec"); +- var thisSecID = "#sec_" + thisSec; +- var thisSecVis = $(thisSecID).css("display"); +- var lastSection = "h"; +- switch (thisSecVis) { +- case "none": +- $(this).attr("src", ".css/uarr.png"); +- $(thisSecID).slideDown(); +- break; +- default: +- $(this).attr("src", ".css/darr.png"); +- $(thisSecID).slideUp(); +- break; +- } +- }); +- +- // If search is in focus, update on enter +- $('#search').keypress(function(e) { +- if (!e) e=window.event; +- key = e.keyCode ? e.keyCode : e.which; +- if (key == 13) { +- // Close comment box if it is open +- if ($('#cat_box').css('display') != 'none') { +- $('#ico01').click(); +- } +- $('.b_update').click(); +- } +- }); +- +- // Sort ASC/DESC +- $(document).on("click", ".event_time", function(event) { +- var csv = $(".event_time").text(); +- switch (csv) { +- case "show oldest first": +- $("#event_sort").val("ASC"); +- break; +- case "show newest first": +- $("#event_sort").val("DESC"); +- break; +- } +- newView("u"); +- }); +- +- // Update page +- $(document).on("click", ".b_update", function(event) { +- $(".icon_notifier").fadeToggle(); +- $(".tag").remove(); +- $(".tag_empty").show(); +- // Remove any supplementary results +- if ($("#extresult")[0]) $("#extresult").remove(); +- // Where are we? +- var curTab = $('.tab_active').attr('id'); +- switch (curTab) { +- case 't_ovr': +- loadSummary(); +- break; +- case 't_view': +- mkView(); +- break; +- default: +- $(".b_update_note").hide(); +- newView("u"); +- break; +- } +- }); +- +- // Clear search and refresh +- $('#clear_search').click(function() { +- if ($('#search').val() != '') { +- $('#search').val(''); +- $("#search").focus(); +- if ($(".fl_val_on")[0]) { +- $('.b_update').click(); +- } +- } +- }); +- +- // Logout +- $("#logout").click(function(event) { +- //$.get("/logout.html", function(){location.reload()}); +- location.replace("/logout.html"); +- }); +- +- // Toggle filters +- $(document).on('click', '.fl_val_on', function(event) { +- var wF = $(this).data("ft"); +- switch (wF) { +- case "tl": +- +- break; +- case "ob": +- $('#clear_search').click(); +- break; +- case "sn": +- $(".chk_sen").each(function() { +- $(this).prop("checked",false); +- }); +- $('.b_update').click(); +- break; +- } +- }); +- +- function clearTags() { +- //$(".tag").remove(); +- //$(".tag_empty").show(); +- $(".tag").removeClass('tag_active'); +- } +- +- // +- // Rows +- // +- +- function closeRow() { +- $("#active_eview").remove(); +- $("#" + this.id).attr('class','d_row'); +- $(".d_row").css('opacity','1'); +- ltCol = $(".d_row_active").find('td.lt').html(); +- $(".d_row_active").find('td.lt').css('background', ltCol); +- $(".d_row_active").attr('class','d_row'); +- // Update class_count +- $("#class_count").text(lastclasscount); +- // Get rid of any crashed loaders +- $("#loader").hide(); +- // Reset checkbox +- $(".chk_all").prop("checked",false); +- // Clear Tags +- clearTags(); +- } +- function closeSubRow() { +- $("#eview_sub1").remove(); +- $("#" + this.id).attr('class','d_row_sub'); +- $(".d_row_sub").css('opacity','1'); +- $(".d_row_sub_active").attr('class','d_row_sub'); +- // Update class_count +- $("#class_count").text(lastclasscount); +- curclasscount = lastclasscount; +- $("#loader").hide(); +- // Reset and show checkbox +- $(".chk_all").prop("checked",false); +- $("#ca0").show(); +- // Remove any open externals +- if ($("#extresult")[0]) $("#extresult").remove(); +- // Clear Tags +- clearTags(); +- } +- function closeSubRow1() { +- $("#eview_sub2").remove(); +- $("#" + this.id).attr('class','d_row_sub1'); +- if (!$("#eview_sub3")[0]) { +- $(".d_row_sub1").css('opacity','1'); +- $(".d_row_sub_active1").attr('class','d_row_sub1'); +- } +- $("#loader").hide(); +- // Reset checkbox +- $(".chk_all").prop("checked",false); +- // Remove any open externals +- if ($("#extresult")[0]) $("#extresult").remove(); +- // Clear Tags +- clearTags(); +- } +- function closeSubRow2() { +- $("#eview_sub3").remove(); +- $("#" + this.id).attr('class','d_row_sub1'); +- if (!$("#eview_sub2")[0]) { +- $(".d_row_sub1").css('opacity','1'); +- $(".d_row_sub1_active").attr('class','d_row_sub1'); +- } +- $("#loader").hide(); +- // Clear Tags +- clearTags(); +- } +- +- // +- // Level 1 +- // +- +- $(document).on("click", ".row_active", function(event) { +- var curID = $(this).parent('tr').attr('id'); +- // What type of row are we? +- rowType = curID.substr(0,3); +- +- // Make sure no other instances are open +- if (!$(".d_row_active")[0] && rowType == 'sid') { +- $("#loader").show(); +- // This leaves us with sid-gid +- var rowValue = curID.replace("sid-",""); +- var sigID = rowValue.split("-")[0]; +- +- $(".d_row_active").attr('class', 'd_row'); +- $("#active_eview").attr('class','d_row'); +- +- // This is now the active row +- $("#" + curID).attr('class','d_row_active'); +- $("html, body").animate({ scrollTop: $('.d_row_active').offset().top - 140 }, 20); +- // History +- var itemToAdd = $("#" + curID).find('[class*="row_filter"]').text(); +- hItemAdd(itemToAdd); +- // Set the class count (counted again after load) +- curclasscount = $('.d_row_active').data('event_count'); +- var cols = $('th.sort').length; +- var tbl = ''; +- tbl += ""; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
↓
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += ""; +- tbl += "CATEGORIZE"; +- tbl += curclasscount + "EVENT(S)  "; +- tbl += "    "; +- tbl += "CREATE FILTER: "; +- tbl += "src  "; +- tbl += "dst  "; +- tbl += "both"; +- tbl += "
"; +- $("#" + curID).after(tbl); +- +- // Lookup signature +- sigLookup(rowValue); +- +- // Fetch results +- eventList("1-" + rowValue); +- +- $("#eview").show(); +- $(".d_row").fadeTo('0','0.2'); +- } else { +- closeRow(); +- } +- }); +- +- // +- // Level 2 +- // +- +- $(document).on("click", ".sub_active", function() { +- if (!$(".d_row_sub_active")[0]) { +- var callerID = $(this).parent('tr').attr('id'); +- +- // Reset checkbox +- $(".chk_all").prop("checked",false); +- +- // RT or ALL? +- switch (rtbit) { +- case 1: adqp = s2h("AND event.status = 0"); break; +- case 0: adqp = s2h("empty"); break; +- } +- // We are now the active row +- $("#" + callerID).attr('class','d_row_sub_active'); +- +- // Populate search times +- var bt = $("#" + callerID).find('[class*="timestamp"]').html(); +- var est = mkStamp(bt,"-",3600000,thisTZ); +- var eet = mkStamp(bt,"+",3600000,thisTZ); +- +- $('#el_start').val(est); +- $('#el_end').val(eet); +- +- // Clear search terms +- $("#srchterms").html(''); +- $(".srch_txt").val(''); +- +- // History and search +- $("#" + callerID).find('[class*="sub_filter"]').each(function() { +- if ($(this).data('type') == 'cc') { +- var itemToAdd = $(this).data('value'); +- } else { +- var itemToAdd = $(this).text(); +- // Add search terms +- $("#srchterms").append("" + itemToAdd + "  "); +- } +- hItemAdd(itemToAdd); +- }); +- +- $("#loader").show(); +- eventList("2-" + callerID + "-" + adqp); +- } else { +- closeSubRow(); +- } +- }); +- +- // +- // Level 3 (a or b) request payload +- // +- +- $(document).on("click", ".sub1_active", function() { +- // Close transcript if it is open +- if ($(".eview_sub3")[0]) closeSubRow2(); +- if (!$(".d_row_sub_active1")[0]) { +- var callerID = $(this).parent('tr').attr('id'); +- $("#" + callerID).attr('class','d_row_sub_active1'); +- +- // Populate search times +- var bt = $("#" + callerID).find('[class*="timestamp"]').html(); +- var est = mkStamp(bt,"-",1800000,thisTZ); +- var eet = mkStamp(bt,"+",1800000,thisTZ); +- +- $('#el_start').val(est); +- $('#el_end').val(eet); +- +- // Clear search terms +- $("#srchterms").html(''); +- $(".srch_txt").val(''); +- +- // History +- $("#" + callerID).find('[class*="sub_filter"]').each(function() { +- if ($(this).data('type') == 'cc') { +- var itemToAdd = $(this).data('value'); +- } else { +- var itemToAdd = $(this).text(); +- } +- if ($(this).data('type') == 'ip') { +- // Add search terms +- $("#srchterms").append("" + itemToAdd + "  "); +- } +- hItemAdd(itemToAdd); +- }); +- $("#loader").show(); +- eventList("3-" + callerID); +- } else { +- closeSubRow1() +- } +- }); +- +- // +- // Level 3 (a or b) request transcript +- // +- +- $(document).on("click", ".sub2_active", function(event) { +- // Close payload if it is open +- if ($(".eview_sub2")[0]) closeSubRow1(); +- var bail = $("#loader").css('display'); +- if (bail != 'none') return; +- if (!$(".eview_sub3")[0]) { +- $("#loader").show(); +- composite = $(this).data('tx').split("-"); +- rowLoke = composite[0]; +- $("#" + rowLoke).attr('class','d_row_sub1_active'); +- nCols = $("#" + rowLoke).find('td').length; +- cid = composite[1]; +- txdata = composite[2]; +- +- // See if a transcript is available +- var urArgs = "type=" + 7 + "&txdata=" + txdata; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, function(data){cb5(data)}); +- }); +- +- function cb5(data){ +- eval("txRaw=" + data); +- txCMD = txRaw.cmd; +- txResult = txRaw.tx; +- txDebug = txRaw.dbg; +- if (txResult == "DEBUG:") txResult += " No data was returned."; +- if (!txResult) { +- txResult = "Transcript request failed!

"; +- txResult += "The command was:
" + txCMD + "

"; +- txResult += "The response was:" + txDebug.replace(/DEBUG:/g,"
"); +- } +- +- var row = '',tbl = ''; +- row += ""; +- row += ""; +- row += "
"; +- row += txResult; +- row += "
"; +- +- tbl += ""; +- tbl += row; +- tbl += ""; +- $("#" + rowLoke).after(tbl); +- +- // Turn off fade effect for large results +- var rC = $(".d_row_sub1").length; +- if ( rC <= 399 ) { +- $(".d_row_sub1").fadeTo('fast','0.2'); +- } +- +- $("#loader").hide(); +- } +- } else { +- closeSubRow2(); +- } +- }); +- +- // Toggle RT depending on entry point +- $(document).on("click", ".b_ec_hot", function() { +- rtbit = 1; +- }); +- $(document).on("click", ".b_ec_total", function() { +- rtbit = 0; +- }); +- +- // Filter constructor +- function mkFilter() { +- if ($('#search').val().length > 0) { +- +- var srchVal = $('#search').val(); +- var fParts = ""; +- +- // If no term is supplied default to a string, IP or wildcard IP search +- chkVal: +- if (srchVal.indexOf(" ") == -1 && srchVal[0] != "!") { +- var re = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; +- if (re.exec(srchVal)) { +- srchVal = "ip " + srchVal; +- break chkVal; +- } +- +- var re = /^(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)/; +- if (re.exec(srchVal)) { +- srchVal = "wip " + srchVal; +- break chkVal; +- } +- +- srchVal = "sig " + srchVal; +- } +- +- fParts = srchVal.replace(/^!/,"").split(" "); +- if (fParts[0] == 'cmt') { +- var theFilter = s2h($('#search').val()); +- rtbit = 0; +- } else { +- // Now see if the requested filter exists +- if ($("#tr_" + fParts[0]).length > 0) { +- tmpFilter = $("#tr_" + fParts[0]).data('filter'); +- // Now see if we need to modify the query +- if (fParts[1]) { +- // This is the base filter +- preFilter = h2s(tmpFilter); +- // This is the user supplied text. +- var re = new RegExp("^" + fParts[0] + "\\s{1}|[';\\\`]","g"); +- theQuestion = fParts.join(' ').replace(re, ""); +- // We will accept multiple questions if they are comma delimited +- questionParts = theQuestion.split(","); +- if (questionParts.length > 1) { +- var f = '('; +- for (var i = 0; i < questionParts.length; i++) { +- f += preFilter.replace(/\$/g, questionParts[i]); +- if (i != (questionParts.length - 1)) { +- f += " OR "; +- } +- } +- f += ')'; +- theFilter = s2h(f); +- } else { +- var newFilter = preFilter.replace(/\$/g, questionParts[0]); +- theFilter = s2h(newFilter); +- } +- } else { +- theFilter = tmpFilter; +- } +- } else { // The filter does not exist +- theFilter = s2h('empty'); +- } +- } +- } else { // No filter supplied +- theFilter = s2h('empty'); +- } +- return theFilter; +- } +- +- // +- // This creates the views for each level +- // +- +- function eventList (type) { +- theWhen = getTimestamp(); +- statusPoll(0); +- var parts = type.split("-"); +- var filterMsg = ''; +- var rt = 0; +- var theSensors = s2h('empty'); +- var theFilter = mkFilter(); +- +- // See if we are just RT events +- if ($('#rt').text() == 'on' || rtbit == 1) { +- rt = 1; +- rtbit = 1; +- } +- // How are we sorting? +- var sortval = $("#event_sort").val(), sorttxt; +- switch (sortval) { +- case "DESC": sorttxt = "show oldest first"; break; +- case "ASC": sorttxt = "show newest first"; break; +- } +- +- // See if we are filtering by sensor +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- // Check for any filters +- if (h2s(theFilter) != 'empty') { +- $('.fl_val').text('YES'); +- } else { +- $('.fl_val').text('NO'); +- } +- +- switch (parts[0]) { +- +- // Level 0 view - Grouped by Signature +- case "0": +- $('.value').text('-'); +- +- // Times Chart +- var urChrtArgs = "type=22&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors; +- $(function(){ +- $.get(".inc/callback.php?" + urChrtArgs, function(data){cb22(data)}); +- }); +- +- function cb22(data){ +- eval("chartData=" + data); +- var r = chartData.r; +- if (r > 0) { +- mkLine(".times",chartData.rows,chartData.m); +- } +- } +- +- var urArgs = "type=" + parts[0] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb1(data)}); +- }); +- function cb1(data){ +- eval("d0=" + data); +- var tbl = ''; +- var head = ''; +- var row = ''; +- var cols = 11; +- +- if (rt == 0) cols = 12; +- head += ""; +- head += ""; +- head += "QUEUE"; +- if (rt == 0) head += "ALL"; +- head += ""; +- head += "SC"; +- head += "DC"; +- if (rt == 0) head += "CLASS"; +- head += "ACTIVITY"; +- head += "LAST EVENT"; +- head += "SIGNATURE"; +- head += "ID"; +- head += "PROTO"; +- head += "% TOTAL"; +- head += ""; +- +- var sumEC = 0, sumSC = 0, sumDC = 0, sumSI = "-", spr1 = 0, spr2 = 0, spr3 = 0, spr4 = 0; +- +- if (d0.length > 0) { +- // Sums for boxes +- for (var i=0; i"; +- row += "No result. If this is unexpected try this"; +- } +- +- if (rt == 1) { +- sumSC = "-"; +- sumDC = "-"; +- sumEC = eTotal; +- } +- +- var sumRT = 0; +- +- // Tag Array +- var tags = new Array(); +- +- for (var i=0; i 0 ) { +- rtClass = "b_ec_hot"; +- sumRT += parseInt(unClass); +- } else { +- rtClass = "b_ec_cold"; +- } +- +- // Sum priorities +- var prC = Number(d0[i].f1); +- switch (d0[i].f13) { +- case "1": spr1 += prC; break; +- case "2": spr2 += prC; break; +- case "3": spr3 += prC; break; +- default: spr4 += prC; break; +- } +- +- rid = "r" + i + "-" + parts[1]; +- var cells = mkGrid(d0[i].f12); +- if (rt == 0) var catCells = catGrid(d0[i].f11,0,0); +- row += ""; +- row += "
" + unClass + "
"; +- if (rt == 0) row += "
" + d0[i].f1 + "
"; +- row += "
" + d0[i].f13 + "
"; +- row += "" +d0[i].f6+ ""; +- row += "" +d0[i].f7+ ""; +- if (rt == 0) row += "" + catCells + ""; +- +- timeParts = d0[i].f5.split(" "); +- timeStamp = timeParts[1]; +- +- if ( sumEC > 0) { +- rowPer = Number(d0[i].f1/sumEC*100).toFixed(3); +- } else { +- rowPer = "0.000"; +- } +- +- row += "" + cells + ""; +- row += "" + timeStamp + ""; +- row += ""; +- //row += "
" + d0[i].f2 + "
"; +- row += d0[i].f2 + ""; +- row += "" + d0[i].f3 + ""; +- row += "" + d0[i].f8 + ""; +- +- +- row += "" + rowPer + "%"; +- row += ""; +- } +- +- // Populate event summary +- $('#qtotal').text(sumRT); +- $('#etotal').text(sumEC); +- $('#esignature').text(sumSI); +- +- // Populate tags +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- +- $('#' + parts[1] + '-' + parts[2]).append(tbl); +- +- if (d0.length > 0) { +- var prVals = [spr1,spr2,spr3,spr4]; +- var pryBar = mkPribar(prVals); +- } else { +- var pryBar = mkPribar([0]); +- } +- $('#tl1').fadeIn('slow'); +- $("#tl1").tablesorter(); +- $("#loader").hide(); +- } +- break; +- +- // Level 1 view - Grouped by signature, source, destination +- +- case "1": +- var urArgs = "type=" + parts[0] + "&object=" + parts[1] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb2(data)}); +- }); +- +- function cb2(data){ +- eval("theData=" + data); +- tbl = ''; +- head = ''; +- row = ''; +- head += "QUEUE"; +- if (rt == 0) head += "TOTAL"; +- if (rt == 0) head += "CLASS"; +- head += "ACTIVITY"; +- head += "LAST EVENT"; +- head += "SOURCE"; +- head += "AGE"; +- head += "COUNTRY"; +- head += "DESTINATION"; +- head += "AGE"; +- head += "COUNTRY"; +- head += ""; +- var curclasscount = 0, tlCount = 0, rtCount = 0; +- var timeValues = "", scid = ""; +- +- // Tag array +- var tags = new Array(); +- +- for (var i=0; i 0 ) { +- rtClass = "b_ec_hot"; +- isActive = "sub_active"; +- } else { +- rtClass = "b_ec_cold"; +- isActive = "sub"; +- } +- +- // Aggregate time values +- timeValues += theData[i].c_ts + ","; +- var cells = mkGrid(theData[i].f12); +- if (rt == 0) var catCells = catGrid(theData[i].c_status,0,0); +- +- // Event sums +- tlCount += parseInt(count,10); +- rtCount += parseInt(unclass,10); +- +- rid = "r" + i + "-" + parts[1] + "-" + src_ip + "-" + dst_ip; +- row += ""; +- row += "
" + unclass + "
"; +- if (rt == 0) row += "
" + count + "
"; +- if (rt == 0) row += "" + catCells + ""; +- row += "" + cells + ""; +- row += "" + max_time + ""; +- row += "
" + src_ip + ""; +- row += "" + src_age_n + ""; +- row += ""; +- row += cs[1] + src_clong + " (." + src_cc.toLowerCase() + ")" + ""; +- row += "
" + dst_ip + ""; +- row += "" + dst_age_n + ""; +- row += ""; +- row += cd[1] + dst_clong + " (." + dst_cc.toLowerCase() + ")" + ""; +- row += ""; +- } +- +- // Populate tags +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- // Add scid's to checkbox +- $("#ca0").data("scid", scid.replace(/,$/, "")); +- +- // If queue is empty provide event sums in case the user +- // intends to reclass anything +- if (rtbit == 1) { +- curclasscount = rtCount; +- } else { +- curclasscount = tlCount; +- } +- +- // update class_count +- $("#class_count").html(curclasscount); +- lastclasscount = $("#class_count").html(); +- +- // While in grouped events (RT) we remove rows as +- // they are classed and subtract the values from "Total Events" +- // This keeps etotal up to date so the math doesn't get silly +- var oldrt = Number($(".d_row_active").find(".b_ec_hot").text()); +- var oldec = Number($("#etotal").text()); +- if (oldrt < rtCount) { +- newrtcount = parseInt((rtCount - oldrt) + oldec); +- $("#etotal").text(newrtcount); +- } +- +- // Update parent counts +- $(".d_row_active").find(".b_ec_hot").text(rtCount); +- if (rt == 0) $(".d_row_active").find(".b_ec_total").text(tlCount); +- +- tbl += "
"; +- tbl += head; +- tbl += row; +- tbl += "
"; +- $("#eview").after(tbl); +- $("#tl2").tablesorter({ +- headers: { +- 4: {sorter:'ipv4'}, +- 6: {sorter:'ipv4'} +- } +- }); +- $("#loader").hide(); +- } +- break; +- +- // Level 2 view - No grouping, individual events +- +- case "2": +- var rowLoke = parts[1]; +- var filter = $('#' + parts[1]).data('filter'); +- var urArgs = "type=" + parts[0] + "&object=" + filter + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen + "&adqp=" + parts[2] + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb3(data)}); +- }); +- +- function cb3(data){ +- eval("d2=" + data); +- tbl = ''; +- head = ''; +- row = ''; +- head += ""; +- head += ""; +- head += "ST"; +- head += "TIMESTAMP"; +- head += "EVENT ID"; +- head += "SOURCE"; +- head += "PORT"; +- head += "DESTINATION"; +- head += "PORT"; +- head += "SIGNATURE"; +- head += ""; +- +- // Update class_count +- $("#class_count").html(0); +- var tlCount=0, rtCount=0; +- +- // Tag array +- var tags= new Array(); +- +- for (var i=0; i"; +- tclass = "c" + eclass; +- cv = classifications.class[tclass][0].short; +- +- // Populate tags array +- if (src_tag != "-") { +- var src_tags = src_tag.split(","); +- $.each(src_tags, function(n,tag) { +- var t = tags.indexOf(tag); +- if (t < 0) tags.push(tag); +- }); +- } +- +- if (dst_tag != "-") { +- var dst_tags = dst_tag.split(","); +- $.each(dst_tags, function(n,tag) { +- var t = tags.indexOf(tag); +- if (t < 0) tags.push(tag); +- }); +- } +- +- // Timestamp +- var compts = d2[i].f2.split(",") || "--"; +- var timestamp = compts[0]; +- var utctimestamp = compts[1]; +- +- // Event sums +- tlCount += parseInt(1,10); +- if (cv == "RT") { +- rtCount += parseInt(1,10); +- } +- +- // Transcript link +- // original Squert native pivot: +- //txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); +- //txBit = "" + sid + "." + cid + "
"; +- //if (src_port != "-" && dst_port != "-") { +- // txBit = "" + sid + "." + cid + ""; +- //} +- // new pivot to CapMe: +- txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); +- txBit = "" + sid + "." + cid + ""; +- if (src_port != "-" && dst_port != "-") { +- var startDate = new Date(utctimestamp); +- var start_tz_offset = (startDate.getTimezoneOffset()); +- var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; +- var endDate = new Date(utctimestamp); +- var end_tz_offset = (endDate.getTimezoneOffset()); +- var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; +- txBit = " " + sid + "." + cid + ""; +- } +- +- row += ""; +- row += "
"; +- row += cv + "
"; +- row += "" + timestamp + ""; +- row += txBit; +- row += "" + src_ip + ""; +- row += "" + src_port + ""; +- row += "" + dst_ip + ""; +- row += "" + dst_port + ""; +- row += "" + signature + ""; +- row += ""; +- } +- +- // Update parent counts +- $(".d_row_sub_active").find(".b_ec_hot").text(rtCount); +- if ($(".d_row_sub_active").find(".b_ec_total").text() < tlCount) { +- $(".d_row_sub_active").find(".b_ec_total").text(tlCount); +- } +- +- var cols = $('th.sort').length; +- +- // Populate tags +- clearTags(); +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- tbl += ""; +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- $("#" + rowLoke).after(tbl); +- $(".d_row_sub").fadeTo('0','0.2'); +- $("#loader").hide(); +- $("#tl3").tablesorter({ +- headers: { +- 0:{sorter:false}, +- 4:{sorter:'ipv4'}, +- 6:{sorter:'ipv4'} +- }, +- cancelSelection:false +- }); +- $("#ca0").hide(); +- } +- break; +- +- // Level 2a view - No grouping, individual events +- +- case "2a": +- $('.value').text('-'); +- var urArgs = "type=2a&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb3a(data)}); +- }); +- +- function cb3a(data){ +- eval("d2a=" + data); +- var tbl = ''; +- var head = ''; +- var row = ''; +- var disabled = ''; +- if (d2a.length == 0) { +- disabled = "disabled"; +- row += ""; +- row += "No result. If this is unexpected try this"; +- } +- +- head += ""; +- head += ""; +- head += ""; +- head += "ST"; +- head += ""; +- head += "TIMESTAMP"; +- head += "ID"; +- head += "SOURCE"; +- head += "PORT"; +- head += "AGE"; +- head += "CC"; +- head += "DESTINATION"; +- head += "PORT"; +- head += "AGE"; +- head += "CC"; +- head += "SIGNATURE"; +- head += ""; +- +- // Aggregate time values +- var timeValues = ""; +- for (var ts=0; ts" + sid + "." + cid + ""; +- //if (src_port != "-" && dst_port != "-") { +- // txBit = "" + sid + "." + cid + ""; +- //} +- // new pivot to CapMe: +- txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); +- txBit = "" + sid + "." + cid + ""; +- if (src_port != "-" && dst_port != "-") { +- var startDate = new Date(utctimestamp); +- var start_tz_offset = (startDate.getTimezoneOffset()); +- var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; +- var endDate = new Date(utctimestamp); +- var end_tz_offset = (endDate.getTimezoneOffset()); +- var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; +- txBit = " " + sid + "." + cid + ""; +- } +- +- row += ""; +- row += ""; +- row += "
"; +- row += cv + "
"; +- row += "
" + d2a[i].f16 + "
"; +- row += "" + timestamp + ""; +- row += txBit; +- row += "
" + src_ip + ""; +- row += "" + src_port + ""; +- row += "" + src_age_n + ""; +- row += "" + cs[1] + ""; +- row += "
" + dst_ip + ""; +- row += "" + dst_port + ""; +- row += "" + dst_age_n + "" +- row += "" + cd[1] + ""; +- row += "" + signature + ""; +- } +- +- var sumED = 0, sumEC = 0, cmsg = ""; +- +- if (d2a.length > 0) { +- sumED = i; +- sumEC = d2a.length; +- } +- +- if (d2a.length >= maxI) { +- sumRE = sumEC - maxI; +- cmsg = " / " + sumRE + " not shown"; +- } +- +- $("#qtotal").html(rsumRT); +- +- // Populate tags +- clearTags(); +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- // Draw +- tbl += ""; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "categorize " + 0 + ""; +- tbl += " of " + sumED + " event(s)" + cmsg; +- tbl += "
"; +- tbl += "
" + sorttxt + "
"; +- tbl += "
"; +- tbl += "
"; +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- $('#' + parts[1] + '-' + parts[2]).after(tbl); +- +- if (d2a.length > 0) { +- var prVals = [spr1,spr2,spr3,spr4]; +- var pryBar = mkPribar(prVals); +- } else { +- var pryBar = mkPribar([0]); +- } +- $("#tl3a,#tl3b").fadeIn('slow'); +- $("#tl3b").tablesorter({ +- headers: { +- 0:{sorter:false}, +- 1:{sorter:false}, +- 5:{sorter:'ipv4'}, +- 8:{sorter:'ipv4'} +- }, +- cancelSelection:false +- }); +- $("#loader").hide(); +- } +- break; +- +- // Level 3 view - Packet Data +- +- case "3": +- var rowLoke = parts[1]; +- var nCols = $('#' + parts[1]).data('cols'); +- var filter = $('#' + parts[1]).data('filter'); +- var urArgs = "type=" + parts[0] + "&object=" + filter + "&ts=" + theWhen; +- var sg = $('#' + parts[1]).data('sg'); +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb4(data)}); +- }); +- +- function cb4(data){ +- eval("theData=" + data); +- +- var tbl = '', head = '', row = ''; +- +- // If IP version is 0 we can jump right to the payload (likely bro, http or ossec agent) +- if (theData[0].ip_ver != 0) { +- +- var PDATA = 0; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- head += ""; +- +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
IPVERIHLTOSLENGTHIDFLAGSOFFSETTTLCHECKSUMPROTO
" + theData[0].ip_ver + "" + theData[0].ip_hlen + "" + theData[0].ip_tos + "" + theData[0].ip_len + "" + theData[0].ip_id + "" + theData[0].ip_flags + "" + theData[0].ip_off + "" + theData[0].ip_ttl + "" + theData[0].ip_csum + "" + theData[0].ip_proto + "
"; +- +- switch (theData[0].ip_proto) { +- case "1": +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
ICMPTYPECODECHECKSUMIDSEQ#
" + theData[1].icmp_type + "" + theData[1].icmp_code + "" + theData[1].icmp_csum + "" + theData[1].icmp_id + "" + theData[1].icmp_seq + "
"; +- break; +- +- case "6": +- // TCP flags +- var tmpFlags = theData[1].tcp_flags || 'z'; +- switch (tmpFlags) { +- case 'z': var tcpFlags = '--------'; break; +- default: +- var binFlags = Number(theData[1].tcp_flags).toString(2); +- var binPad = 8 - binFlags.length; +- var tcpFlags = "00000000".substring(0,binPad) + binFlags; +- break; +- } +- var tcp_seq = theData[1].tcp_seq || '-'; +- var tcp_ack = theData[1].tcp_ack || '-'; +- var tcp_off = theData[1].tcp_off || '-'; +- var tcp_res = theData[1].tcp_res || '-'; +- var tcp_win = theData[1].tcp_win || '-'; +- var tcp_urp = theData[1].tcp_urp || '-'; +- var tcp_csum = theData[1].tcp_csum || '-'; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
TCPR1R0URGACKPSHRSTSYNFINSEQ#ACK#OFFSETRESWINURPCHECKSUM
" + tcpFlags[0] + "" + tcpFlags[1] + "" + tcpFlags[2] + "" + tcpFlags[3] + "" + tcpFlags[4] + "" + tcpFlags[5] + "" + tcpFlags[6] + "" + tcpFlags[7] + "" + tcp_seq + "" + tcp_ack + "" + tcp_off + "" + tcp_res + "" + tcp_win + "" + tcp_urp + "" + tcp_csum + "
"; +- break; +- +- case "17": +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
UDPLENGTHCHECKSUM
" + theData[1].udp_len + "" + theData[1].udp_csum + "
"; +- break; +- } +- +- var p_hex = '', p_ascii = '', p_ascii_l = ''; +- +- // Data +- if (!theData[2]) { +- p_hex = "No Data Sent."; +- p_ascii = "No Data Sent."; +- } else { +- p_pl = theData[2].data_payload; +- p_length = theData[2].data_payload.length; +- var b0 = 0; +- +- for(var i=0; i < p_length; i+=2) { +- b0++; +- t_hex = p_pl.substr(i,2); +- t_int = parseInt(t_hex,16); +- +- if ((t_int < 32) || (t_int > 126)) { +- p_hex += t_hex + " "; +- p_ascii += "."; +- p_ascii_l += "."; +- } else if (t_int == 60) { +- p_hex += t_hex + " "; +- p_ascii += "<"; +- p_ascii_l += "<"; +- } else if (t_int == 62) { +- p_hex += t_hex + " "; +- p_ascii += ">"; +- p_ascii_l += ">"; +- } else { +- p_hex += t_hex + " "; +- p_ascii += String.fromCharCode(parseInt(t_hex, 16)); +- p_ascii_l += String.fromCharCode(parseInt(t_hex, 16)); +- } +- +- if ((b0 == 16) && (i < p_length)) { +- p_hex += "
"; +- p_ascii += "
"; +- b0 = 0; +- } +- } +- } +- +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += ""; +- row += "
DATAHEXASCII
" + p_hex + "" + p_ascii + "
ASCII" + p_ascii_l + "
"; +- +- } else { +- +- head += ""; +- var p_ascii = "No Data Sent."; +- // This needs to be more robust. +- if (theData[2]) { +- var tmp = h2s(theData[2].data_payload).split("\n"); +- p_ascii = ''; +- for (var i in tmp) { +- p_ascii += "
" + tmp[i] + "
"; +- } +- +- } +- row += ""; +- row += ""; +- row += "
" + p_ascii + "
"; +- } +- +- tbl += ""; +- +- // If we are not grouped we show the signature text +- if ( sg != 0 ) { +- tbl += "
"; +- tbl += "
"; +- tbl += "
↓
"; +- tbl += "
"; +- tbl += "
"; +- tbl += "
"; +- sigLookup(sg); +- } +- +- // Comments and tags are done here +- var tags = new Array(); +- var eventTag = 'None.'; +- var eventComment = theData[0].comment || 'None.'; +- var src_tag = theData[0].srctag || '-'; +- var dst_tag = theData[0].dsttag || '-'; +- +- // Populate tags array +- if (src_tag != "-") { +- var src_tags = src_tag.split(","); +- $.each(src_tags, function(n,tag) { +- var t = tags.indexOf(tag + ",s"); +- if (t < 0) tags.push(tag + ",s"); +- }); +- } +- +- if (dst_tag != "-") { +- var dst_tags = dst_tag.split(","); +- $.each(dst_tags, function(n,tag) { +- var t = tags.indexOf(tag + ",d"); +- if (t < 0) tags.push(tag + ",d"); +- }); +- } +- +- if (tags.length > 0) eventTag = ''; +- +- tbl += "
COMMENTS
"; +- tbl += "
" + eventComment + "
"; +- tbl += "
TAGS
"; +- tbl += "
" + eventTag + "
"; +- if (PDATA != 0) { +- tbl += "
DETAILS
"; +- } else { +- tbl += "
PAYLOAD
"; +- } +- tbl += head; +- tbl += row; +- tbl += ""; +- $("#" + rowLoke).after(tbl); +- $("#loader").hide(); +- +- // Turn off fade effect for large results +- var rC = $(".d_row_sub1").length; +- if ( rC <= 499 ) { +- $(".d_row_sub1").fadeTo('fast','0.2'); +- } +- +- // Populate tags +- clearTags(); +- for (var i=0; i < tags.length; i++) { +- addTag(tags[i]); +- } +- +- } +- break; +- } +- // If event queue is off we need to reset this after load if b_ec_hot was +- // the entry point +- if ($('#rt').text() == 'off') rtbit = 0; +- } +- +- // +- // Object click handlers +- // +- +- $(document).on("click", ".select,.ex_val,.sub_filter,.row_filter,.tof,.value_link,.nr_f", function(e) { +- // Check if we are coming from a legit object +- var prefix = $(this).data('type'); +- if (prefix == "none") return; +- +- // Check if we are coming from a sane selection +- var selLen = window.getSelection().toString().length; +- if (selLen > 4) { +- if (selLen < 255) { // Might need to change these based on how people use this +- prefix = "zz"; +- var suffix = window.getSelection().toString(); +- var re = /\s/g; +- var NOK = re.exec(suffix); +- if (NOK) return; +- } else { +- return; +- } +- } else { +- var suffix = $(this).text(); +- } +- +- var mX = e.pageX; +- var mY = e.pageY; +- +- var colour = $(this).data('col') || "FFFFFF"; +- var tfocus = "#search"; +- switch (prefix) { +- case 'ip': +- hItemAdd(suffix); +- var sord = $(this).data('sord'); +- mkPickBox(prefix,suffix,sord,colour,mX,mY); +- break; +- case 'spt': +- case 'dpt': +- hItemAdd(suffix); +- mkPickBox(prefix,suffix,0,colour,mX,mY); +- break; +- case 'cc': +- case 'scc': +- case 'dcc': +- var cc = $(this).data('value'); +- hItemAdd(cc); +- mkPickBox(prefix,cc,suffix,colour,mX,mY); +- break; +- case 'cmt': +- suffix = $(this).data('comment'); +- $("#rt").text("off"); +- $("#rt").attr('class','tvalue_off'); +- $('#search').val(prefix + " " + suffix); +- hItemAdd(suffix); +- if ($('#cat_box').css('display') != 'none') { +- $('#ico01').click(); +- } +- $('.b_update').click(); +- break; +- case 'cmt_c': +- $('.cat_msg_txt').val(suffix); +- hItemAdd(suffix); +- tfocus = ".cat_msg_txt"; +- break; +- case 'fil': +- var fil = $(this).data('value'); +- $('#search').val(fil); +- hItemAdd(fil); +- if ($('#fltr_box').css('display') != 'none') { +- $('#ico04').click(); +- } +- $('.b_update').click(); +- break; +- case 'sid': +- var value = $(this).data('value'); +- hItemAdd(suffix); +- mkPickBox(prefix,value,suffix,colour,mX,mY); +- break; +- case 'st': +- var suffix = $(this).attr('id').split('-')[1]; +- $('#search').val(prefix + " " + suffix); +- // RT must be off to return anything +- $('#rt').attr('class','tvalue_off'); +- $('#rt').text('off'); +- rtbit = 0; +- $('.b_update').click(); +- break; +- case 'el': +- var suffix = $(this).data('value'); +- mkPickBox(prefix,suffix,0,colour,mX,mY); +- break; +- case 'zz': +- hItemAdd(suffix); +- mkPickBox(prefix,suffix,0,colour,mX,mY); +- break; +- } +- }); +- +- // +- // Picker Box +- // +- +- function mkPickBox(prefix,suffix,rsuffix,colour,mX,mY) { +- var doexternals = "yes"; +- var objhex = s2h(suffix); +- var tbl = '', row = ''; +- // Local stuff first +- switch (prefix[prefix.length - 1]) { +- case "c": +- row += ":: SRC or DST"; +- row += ":: SRC"; +- row += ":: DST"; +- row += ":: SEARCH"; +- break; +- case "p": +- row += ":: SRC or DST"; +- row += ":: SRC"; +- row += ":: DST"; +- row += ":: ADD / REMOVE TAG"; +- if ($('.sigtxt')[0]) { +- row += ":: HISTORY"; +- } +- row += ":: SEARCH"; +- row += ":: COLOUR  "; +- row += ""; +- row += "apply"; +- row += "apply all"; +- row += ""; +- break; +- case "t": +- row += ":: SRC"; +- row += ":: DST"; +- row += ":: SEARCH"; +- break; +- case "d": +- row += ":: SIGNATURE"; +- if ($('.sigtxt')[0]) { +- row += ":: HISTORY"; +- } +- row += ":: SEARCH"; +- break; +- case "l": +- row += ":: COLOUR  "; +- row += ""; +- row += "update"; +- doexternals = "no"; +- break; +- case "z": +- row += ":: SEARCH"; +- break; +- } +- +- // If applicable populate externals +- if (doexternals == "yes") { +- $('.f_row').each(function() { +- var ct = $(this).data('type'); +- if (ct == 'url') { +- var alias = $(this).data('alias'); +- var name = $(this).data('name'); +- var url = $(this).data('filter'); +- row += ""; +- row += "" + name + ""; +- row += ""; +- } +- }); +- } +- +- tbl += ""; +- tbl += row; +- tbl += "
"; +- +- var boxlabel = suffix; +- +- // Use more descriptive names where possible +- var re = /(sid|cc|scc|dcc)/; +- var OK = re.exec(prefix); +- if (OK) { +- var boxlabel = rsuffix; +- } +- +- if (boxlabel.length > 24) { +- boxlabel = boxlabel.substring(0,24); +- boxlabel += ".."; +- } +- +- $('#pickbox_label').text(boxlabel).css('font-weight','normal').data('sord', rsuffix); +- +- if ($('#tlpick')[0]) $('#tlpick').remove(); +- $(".pickbox_tbl").append(tbl); +- $('.pickbox').fadeIn('fast'); +- +- // Colour Picker +- $("#menucol").spectrum({ +- showInput: true, +- className: "full-spectrum", +- showInitial: true, +- showPalette: true, +- showSelectionPalette: true, +- maxPaletteSize: 6, +- preferredFormat: "hex", +- localStorageKey: "spectrum.demo", +- move: function (color) {}, +- show: function () {}, +- beforeShow: function () {}, +- hide: function () {}, +- change: function() {}, +- palette: [ +- ['rgb(217,217,217)','rgb(189,189,189)','rgb(150,150,150)','rgb(99,99,99)','rgb(37,37,37)'], +- ['rgb(199,233,192)','rgb(161,217,155)','rgb(116,196,118)','rgb(49,163,84)','rgb(0,109,44)'], +- ['rgb(218,218,235)','rgb(188,189,220)','rgb(158,154,200)','rgb(117,107,177)','rgb(84,39,143)'], +- ['rgb(198,219,239)','rgb(158,202,225)','rgb(107,174,214)','rgb(49,130,189)','rgb(8,81,156)'], +- ['rgb(254,217,118)','rgb(254,178,76)','rgb(253,141,60)','rgb(240,59,32)','rgb(189,0,38)'] +- ] +- }); +- } +- +- // Pickbox click events +- $(document).on('click', '.p_row', function() { +- if ($('.tagbox').css('display') != 'none') $('.tagcancel').click(); +- var ctype = $(this).data('type'); +- var alias = $(this).data('alias'); +- var args = $('#tlpick').data('val'); +- switch(ctype) { +- case "l": +- $('.pickbox').fadeOut('fast'); +- $('#search').val(alias + " " + args); +- $('.b_update').click(); +- break; +- case "r": +- $('.pickbox').fadeOut('fast'); +- var url = h2s($(this).data('url')).replace("${var}", args); +- window.open(url); +- break; +- case "t": +- $('.tagbox').fadeIn('fast'); +- $('.taginput').focus(); +- break; +- case "s": +- $('.pickbox').fadeOut('fast', function() {; +- $('#ico05').click(); +- }); +- $('.srch_txt').val(args); +- break; +- case "h": +- doHistory(args); +- $('.pickbox').fadeOut('fast'); +- break; +- default: return; +- } +- }); +- +- // +- // Tags +- // +- +- // Truncate +- function truncTag(tag,len) { +- if (tag.length > len) tag = tag.substring(0,len) + ".."; +- return tag; +- } +- +- // Filter results or add as new +- $(document).on('click', '.tag', function() { +- var tag = $(this).data('val'); +- if($('.taginput').is(":visible")) { +- $('.taginput').val(tag); +- $('.taginput').focus(); +- } else { +- $('#search').val('tag ' + tag); +- $('.b_update').click(); +- } +- }); +- +- // Remove individual tags on "(X)" click via payload area +- $(document).on('mouseenter', '.tag_d, .tag_s', function() { +- var tag = $(this).data('val'); +- if ($(".tag_x")[0]) return; +- var dw = $(this).width() - 5 + "px"; +- $(this).append("
X
"); +- $(".tag_x").css("margin-left", dw); +- $(".tag_x").fadeIn("slow"); +- +- }); +- +- $(document).on('mouseleave', '.tag_d, .tag_s', function() { +- $('.tag_x').remove(); +- }); +- +- $(document).on('click', '.tag_x', function() { +- var tag = $(this).parent().data("val"); +- var obj = $(this).parent().data("obj"); +- $(this).parent().remove(); +- var len = $("#tag_area").text().length; +- if (len == 0) $("#tag_area").append("None."); +- //doTag(s2h(obj),tag,'rm'); +- }); +- +- // Fire tag add on enter +- $('.taginput').keypress(function(e) { +- if (!e) e=window.event; +- key = e.keyCode ? e.keyCode : e.which; +- if (key == 13) $('.tagok').click(); +- }); +- +- // Close tag entry +- $(document).on('click', '.tagcancel', function() { +- $('.taginput').val(''); +- $('.tagbox').fadeOut('fast'); +- }); +- +- // Add a tag +- $(document).on('click', '.tagok', function() { +- var tag = $('.taginput').val(); +- var obj = $('#pickbox_label').text(); +- var re = /^[?a-zA-Z0-9][\s{1}\w-\.]*$/; +- var OK = re.exec(tag); +- if (OK) doTag(s2h(obj),tag,'add'); +- }); +- +- // Remove a tag +- $(document).on('click', '.tagrm', function() { +- var tag = truncTag($('.taginput').val(),20); +- var obj = $('#pickbox_label').text(); +- doTag(s2h(obj),tag,'rm'); +- $(".tag" + ":contains('" + tag + "')").remove(); +- $('.tagcancel').click(); +- }); +- +- // Display or Toggle tags +- function addTag(tag) { +- // If we entered from payload we have some additional info +- if ($('#eview_sub2')[0]) { +- var longTag = tag.split(",")[0]; +- var theClass = tag.split(",")[1]; +- var t_tag = truncTag(longTag,20); +- } else { +- var t_tag = truncTag(tag,20); +- } +- +- // Hide empty +- $('.tag_empty').hide(); +- +- // Check if tag exists +- var tag_exists = 0; +- $('.tag').each(function() { +- if ($(this).text() == t_tag) { +- $(this).addClass('tag_active'); +- tag_exists = 1; +- } +- }); +- +- // Add tag to left pane +- if (tag_exists == 0) { +- var newTag = "
" + t_tag + "
"; +- $('#tg_box').prepend(newTag); +- } +- +- // If we have the payload open, add here as well +- if ($('#eview_sub2')[0]) { +- if($('#pickbox_label').is(":visible")) { +- theClass = $('#pickbox_label').data('sord')[0]; +- } +- // Remove placeholder +- if ($('#tag_none')[0]) $('#tag_none').remove(); +- var newTag = "
" + t_tag + "
"; +- $('#tag_area').prepend(newTag); +- } +- +- } +- +- function doTag(obj,tag,op) { +- var urArgs = "type=19&obtype=tag&object=" + obj + "&value=" + tag + "&op=" + op; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); +- }); +- +- function cb22(data){ +- eval("theData=" + data); +- if (theData.msg != '') { +- alert(theData.msg); +- } else { +- if (op != 'rm') addTag(tag); +- $('.tagcancel').click(); +- } +- } +- } +- +- // Colours +- $(document).on('click', '.csave', function() { +- var obtype = $(this).data('obtype'); +- var object = $(this).data('object'); +- var colour = $('#menucol').val().replace(/#/,"").toUpperCase(); +- var op = "add"; +- var re = /^([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/; +- var OK = re.exec(colour); +- if (!OK) return; +- // Single or multiple? +- if (obtype == "src" || obtype == "dst") { +- var vr = new Array(); +- $("." + obtype).each(function() { +- var v = $(this).text(); +- var re = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; +- var OK = re.exec(v); +- if (OK) { +- var t = vr.indexOf(v); +- if (t < 0) vr.push(v); +- } +- }); +- object = vr.toString(); +- } +- +- var urArgs = "type=19&obtype=" + obtype + "_c&object=" + object + "&value=" + colour + "&op=" + op; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); +- }); +- +- function cb22(data){ +- eval("theData=" + data); +- if (theData.msg != '') { +- alert(theData.msg); +- } else { // We should be good.. +- var curObject = $('#pickbox_label').text(); +- if (obtype == "el") { +- var html = "
" + colour; +- $('#el_' + curObject).html(html); +- $('#el_' + curObject).data('col', colour); +- } else { +- $(".sub_filter:contains(" + curObject + ")").each(function() { +- $(this).find('.object').css('background-color', '#' + colour).parent().data('col', colour); +- }); +- } +- $('.pickbox').fadeOut('fast'); +- } +- } +- }); +- +- $(document).on('click', '.pickbox_close', function() { +- $('.tagcancel').click(); +- $('.pickbox').fadeOut('fast'); +- }); +- +- // +- // Object History +- // +- +- function hItemAdd(item) { +- var itemTitle = item; +- // Truncate +- if (item.length > 33) { +- itemTitle = item.substring(0,33) + ".."; +- } +- // Remove empty message +- $('.history_empty').hide(); +- +- // If the item doesn't exist, add it. Otherwise, we start counting. +- if ($(".h_item:contains('" + itemTitle + "')").length > 0) { +- var oc = $(".h_item:contains('" + itemTitle + "')").data('n'); +- var nc = Number(oc) + 1; +- var bg = '#c9c9c9'; +- var fn = 'normal'; +- if (nc <= 3) { +- bg = '#000'; +- } else if (nc > 3) { +- bg = '#cc0000'; +- fn = 'bold'; +- } +- +- $(".h_item:contains('" + itemTitle + "')").css('color', bg); +- $(".h_item:contains('" + itemTitle + "')").css('font-weight', fn); +- $(".h_item:contains('" + itemTitle + "')").data('n',nc); +- $(".h_item:contains('" + itemTitle + "')").text(itemTitle + "(" + nc + ")"); +- } else { +- var toAdd = " " + itemTitle + ""; +- $('#h_box').prepend(toAdd); +- } +- } +- +- if (!$('.h_item')[0]) { +- $('.history_empty').show(); +- } +- +- // Alt mappings for icons +- +- $.alt('1', function() { +- $("#ico01").click(); +- }); +- $.alt('2', function() { +- $("#ico02").click(); +- }); +- $.alt('3', function() { +- $("#ico03").click(); +- }); +- $.alt('4', function() { +- $("#ico05").click(); +- }); +- $.alt('5', function() { +- $("#ico04").click(); +- }); +- +- // +- // Event classification +- // +- +- // Use function keys to trigger status buttons +- $(document).keydown(function(event){ +- +- function stopOthers() { +- event.originalEvent.keyCode = 0; +- event.preventDefault(); +- event.stopPropagation(); +- } +- +- switch (event.keyCode) { +- case 112: stopOthers(); $('#b_class-11').click(); break; +- case 113: stopOthers(); $('#b_class-12').click(); break; +- case 114: stopOthers(); $('#b_class-13').click(); break; +- case 115: stopOthers(); $('#b_class-14').click(); break; +- case 116: stopOthers(); $('#b_class-15').click(); break; +- case 117: stopOthers(); $('#b_class-16').click(); break; +- case 118: stopOthers(); $('#b_class-17').click(); break; +- case 119: stopOthers(); $('#b_class-1').click(); break; +- case 120: stopOthers(); $('#b_class-2').click(); break; +- } +- }); +- +- // Comment window status buttons +- $(document).on("click", "#cw_buttons", function(event) { +- var newclass = $(event.target).data('n'); +- if (newclass == 0) { +- $('#b_class-' + newclass).click(); +- } else { +- $('#b_class-' + newclass).click(); +- } +- }); +- +- // Highlight colour for selected events +- var hlcol = "#FFFFE0"; +- var hlhov = "#FDFDD6"; +- +- // Individual selects +- var clickOne = 0, clck1 = 0, clck2 = 0; +- $(document).on("click", ".chk_event", function(event) { +- $("#tl3b").trigger('update'); +- var clickTwo = this.id.split("_"); +- if (Number(clickOne[1]) > Number(clickTwo[1])) { +- clck1 = clickTwo[1]; +- clck2 = clickOne[1]; +- } else { +- clck1 = clickOne[1]; +- clck2 = clickTwo[1]; +- } +- +- if (event.shiftKey) { +- if (clck1 != clck2) { +- $("#s" + clck1).nextUntil("#s" + clck2).find(".chk_event").prop("checked", true); +- $("#s" + clck1).nextUntil("#s" + clck2).css("background-color", hlcol); +- $("#s" + clck1).nextUntil("#s" + clck2).hover( +- function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- clickOne = 0, clck1 = 0, clck2 = 0; +- } +- } +- +- // Update class_count +- $("#class_count").html($(".chk_event:checked").length); +- if ($("#ca1:checked").length > 0) { +- $("#ca1").prop("checked",false); +- } +- clickOne = this.id.split("_"); +- +- if ($(this).prop("checked") == true) { +- $("#s" + clickTwo[1]).css("background-color", hlcol); +- $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- } else { +- $("#s" + clickTwo[1]).css("background-color", "transparent"); +- $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "transparent")}); +- } +- }); +- +- // Select all (2) +- $(document).on("click", "#ca1", function(event) { +- var chkLen = $("#ca1:checked").length; +- switch(chkLen) { +- case 0: +- $(".chk_event").prop("checked",false); +- $("#ca0").prop("checked",false); +- $(".d_row_sub1").css("background-color", "transparent"); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "transparent")}); +- break; +- default: +- $(".chk_event").each(function() { +- if ($(this).prop("disabled") == false) { +- $(this).prop("checked",true); +- } +- }); +- $(".d_row_sub1").css("background-color", hlcol); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- $("#ca0").prop("checked",true); +- break; +- } +- +- if ($(".eview_sub1")[0]) { +- // Update class_count +- $("#class_count").html($(".chk_event:checked").length); +- } +- +- }); +- +- // Select all (2a) - clean this up, the above is almost identical +- $(document).on("click", "#ca2", function(event) { +- var chkLen = $("#ca2:checked").length; +- switch(chkLen) { +- case 0: +- $(".chk_event").prop("checked",false); +- $("#ca2").prop("checked",false); +- $(".d_row_sub1").css("background-color", "transparent"); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "transparent")}); +- break; +- default: +- $(".chk_event").each(function() { +- if ($(this).prop("disabled") == false) { +- $(this).prop("checked",true); +- } +- }); +- $(".d_row_sub1").css("background-color", hlcol); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, +- function(){$(this).css("background-color", hlcol)}); +- $("#ca2").prop("checked",true); +- break; +- } +- // Update class_count +- $("#class_count").html($(".chk_event:checked").length); +- }); +- +- // Class button click +- $(document).on("click", "[id*=\"b_class-\"]", function() { +- // We only fire if something is selected +- var chkLen = parseInt($(".chk_event:checked").length + $(".chk_all:checked").length); +- var intclass = $(this).attr('id').split("-"); +- if (chkLen > 0 && intclass[1] != 0) { +- eClass(this,intclass[1]); +- } +- }); +- +- function eClass(caller,intclass) { +- // The sid.cid values +- var scid= "", scidlist = "", ecls = 0; +- if ($(".eview_sub1")[0] || $("#ca2")[0]) { +- $(".chk_event:checked").each(function() { +- if ($(this).data('eclass') == 0) { +- ecls++; +- } +- scid += $(this).val() + ","; +- }); +- scidlist = scid.replace(/,$/, ""); +- } else { +- ecls = $(".d_row_active").find(".b_ec_hot").text(); +- scidlist = $("#ca0").data("scid"); +- } +- +- // Was there a message? +- var msg = "none"; +- if ($(".cat_msg_txt").val().length != 0) { +- msg = $(".cat_msg_txt").val(); +- } +- +- if ($('#cat_box').css('display') != 'none') { +- $('#ico01').click(); +- } +- +- // We are now ready to class +- var catdata = intclass + "|||" + msg + "|||" + scidlist; +- var urArgs = "type=" + 9; +- $(function(){ +- $.post(".inc/callback.php?" + urArgs, { catdata: catdata } ,function(data){cb9(data)}); +- }); +- +- function cb9(data){ +- eval("catRaw=" + data); +- catDbg = catRaw.dbg; +- if (catDbg == "0") { +- +- var curtotalrtcount = Number(ecls); +- // Working on grouped events +- if ($("#gr").text() == "on") { +- curclasscount = Number($("#class_count").text()); +- var curtotalparentcount = $(".d_row_active").find(".b_ec_hot").text(); +- // Do we have queued events? +- if (curtotalparentcount > 0) { +- +- // Are we working on queued events? +- if (curtotalrtcount > 0) { +- curclasscount = curtotalrtcount; +- } else { +- curclasscount = 0; +- } +- // Adjust the parent count +- newparentcount = parseInt(curtotalparentcount - curclasscount,10); +- $(".d_row_active").find(".b_ec_hot").text(newparentcount); +- +- if (newparentcount == 0) { +- $(".d_row_active").find(".b_ec_hot").parent().attr('class','row'); +- $(".d_row_active").find(".b_ec_hot").attr('class','b_ec_cold'); +- } +- +- // If we are working within the child, adjust accordingly +- if ($(".eview_sub1")[0]) { +- // How many are in the child +- curtotalchildcount = $(".d_row_sub_active").find(".b_ec_hot").text(); +- +- // Adjust the child count +- newchildcount = parseInt(curtotalchildcount - curclasscount,10); +- $(".d_row_sub_active").find(".b_ec_hot").text(newchildcount); +- if (newchildcount == 0) { +- $("#ca1").prop("disabled",true); +- $(".d_row_sub_active").find(".b_ec_hot").parent().attr('class','sub'); +- $(".d_row_sub_active").find(".b_ec_hot").attr('class','b_ec_cold'); +- } +- // Otherwise we were called from the parent +- } else { +- $(".d_row_sub").find(".b_ec_hot").parent().attr('class','sub'); +- $(".d_row_sub").find(".b_ec_hot").text(0); +- $(".d_row_sub").find(".b_ec_hot").attr('class','b_ec_cold'); +- $("#ca0").prop("disabled",true); +- } +- lastclasscount = newparentcount; +- } +- +- // Lastly, update class_count +- if (rtbit == 1 || curtotalrtcount > 0 || $("#eview_sub")[0]) { +- $("#class_count").html(0); +- } else { +- $("#class_count").html($(".d_row_active").find(".b_ec_total").text()); +- } +- +- // Working on ungrouped events +- } else { +- $("#class_count").html(lastclasscount); +- } +- +- // What the new classification is +- selClass = $(caller).data("cn"); +- newClass = "a_" + selClass; +- +- // Change visible class and disable if RT +- // If we are RT ungrouped, we just remove +- if ($('#rt').text() == 'on' && $("#ca2")[0]) { +- $(".chk_event:checked").each(function() { +- var pid = $(this).attr("id").split("_"); +- var nid = parseInt(Number(pid[1]) + 1); +- // Remove any open payload or TX panes +- if ($("[id^=eview_]")[0]) { +- $("[id^=eview_]").remove(); +- $(".d_row_sub1").css('opacity','1'); +- } +- // Remove the row +- $("#s" + pid[1]).fadeOut('fast', function() { +- $("#s" + pid[1]).remove(); +- }); +- }); +- +- // Update table (for sorter) +- $("#tl3b").trigger('update'); +- } else { +- // If we are RT and all events are classed we just remove +- if ($('#rt').text() == 'on' && $(".d_row_active").find(".b_ec_hot").text() == 0) { +- $("#active_eview").remove(); +- $(".d_row_active").fadeOut('slow', function (event) { +- $(".d_row_active").remove(); +- var newsigtotal = "-"; +- var sigtotal = $("#esignature").text(); +- if (sigtotal > 0) { +- newsigtotal = parseInt(sigtotal - 1); +- } +- $("#esignature").text(newsigtotal); +- }); +- $(".d_row").css('opacity','1'); +- } else { +- $(".chk_event:checked").each(function() { +- var n = this.id.split("_"); +- $("#class_box_" + n[1]).attr('class', newClass); +- $("#class_box_" + n[1]).text(selClass); +- if (curtotalparentcount > 0) { +- $(this).prop("disabled",true); +- } +- }); +- } +- $(".d_row_sub1").css("background-color", "#fafafa"); +- $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, +- function(){$(this).css("background-color", "#fafafa")}); +- } +- +- // Uncheck everything +- $(".chk_event").prop("checked", false); +- $(".chk_all").prop("checked", false); +- // Remove these scids from the L1 scidlist +- if ($("#ca0")[0] && rtbit == 1) { +- var cur_scidlist = scidlist.split(','); +- var active_scidlist = $("#ca0").data("scid"); +- for (var i = 0; i < cur_scidlist.length; i++) { +- active_scidlist = active_scidlist.replace(cur_scidlist[i],''); +- } +- active_scidlist = active_scidlist.replace(/,{2,}/g,','); +- active_scidlist = active_scidlist.replace(/(^,|,$)/g,''); +- $("#ca0").data("scid", active_scidlist); +- } +- catMsg(scidlist.split(',').length, curtotalrtcount); +- } else { +- catMsg(0); +- } +- } +- } +- +- function catMsg(count, rtcount) { +- switch (count) { +- default: +- var ess = ''; +- if ( count > 1 ) ess = 's'; +- +- var numrows = Number($('.d_row').length + $('.d_row_sub1').length); +- var newboxtotal = 0, newcatcount = 0; +- newboxtotal = parseInt($("#qtotal").text() - rtcount); +- $("#qtotal").text(newboxtotal); +- +- // If we are just rt update Total boxes as we go +- if ($("#ca2")[0]) { // We are ungrouped +- newcatcount = parseInt($("#cat_count").text() - count); +- if (newcatcount == 0) { +- newView("u"); +- } else { +- $("#cat_count").text(newcatcount); +- } +- } +- +- if (numrows == 0) { +- newView("u"); +- } +- +- var msg = count + " event" + ess + " categorized"; +- clearTags(); +- break; +- } +- +- $("span.class_msg").text(msg); +- $("span.class_msg").fadeIn('slow', function() { +- setTimeout(function(){ +- $(".class_msg").fadeOut('slow'); +- }, 3000); +- }); +- } +- +- // Load summary tab +- function loadSummary() { +- var limit = 10; +- if ($('#wm0')[0]) { +- doMap("redraw"); +- } else { +- doMap("draw"); +- } +- mkSummary("signature",limit); +- mkSummary("srcip",limit); +- mkSummary("dstip",limit); +- mkSummary("srcpt",limit); +- mkSummary("dstpt",limit); +- mkSummary("srccc",limit); +- mkSummary("dstcc",limit); +- } +- +- // Toggle summary section +- $(document).on("click", ".hidepane", function(e) { +- $('#topsignature').toggle(); +- }); +- +- // Summary tab +- function mkSummary(box,limit) { +- var theWhen = getTimestamp(); +- var theSensors = s2h('empty'); +- var theFilter = mkFilter(); +- // See if we are filtering by sensor +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- var ldr = "
"; +- $('#ov_' + box + '_sl').prepend(ldr); +- $('#top' + box).fadeTo('fast', 0.2); +- switch (box) { +- case "srcip": +- var cbArgs = "srcip"; +- var qargs = "ip-src"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- case "dstip": +- var cbArgs = "dstip"; +- var qargs = "ip-dst"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- case "srcpt": +- var cbArgs = "srcpt"; +- var qargs = "pt-src"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); +- }); +- break; +- case "dstpt": +- var cbArgs = "dstpt"; +- var qargs = "pt-dst"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); +- }); +- break; +- case "signature": +- var qargs = "sig-sig"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb16(data)}); +- }); +- break; +- case "srccc": +- var cbArgs = "srccc"; +- var qargs = "cc-src"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- case "dstcc": +- var cbArgs = "dstcc"; +- var qargs = "cc-dst"; +- var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); +- }); +- break; +- } +- +- // IP and Country +- function cb15(data,cbArgs){ +- var ch = "SRC"; +- var wip = "d"; +- if (cbArgs[0] == "s") ch = "DST", wip = "s"; +- eval("raw=" + data); +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "#SIG"; +- head += "#" + ch + ""; +- if (cbArgs[3] == "c") { +- head += "COUNTRY"; +- head += "#IP"; +- } else { +- head += "IP"; +- head += "COUNTRY"; +- } +- head += ""; +- +- var eventsum = raw[raw.length - 1].n || 0; +- var records = raw[raw.length - 1].r || 0; +- if (records == 0) { +- row = "No result."; +- $("#ov_" + cbArgs + "_sl").text(""); +- } +- for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + sigs + ""; +- row += "" + ip2 + ""; +- +- if (cbArgs[3] == "c") { +- row += ""; +- row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; +- row += "" + ip + ""; +- } else { +- row += "
" + ip + ""; +- row += ""; +- row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; +- } +- row += ""; +- row += "
"; +- } +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); +- $("#ov_" + cbArgs + "_sl").after(tbl); +- $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); +- mkSlider("ov_" + cbArgs + "_sl", i, records); +- } +- +- // Ports +- function cb17(data,cbArgs){ +- eval("raw=" + data); +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "#SIG"; +- head += "#SRC" +- head += "#DST"; +- head += "PORT"; +- head += ""; +- +- var eventsum = raw[raw.length - 1].n || 0; +- var records = raw[raw.length - 1].r || 0; +- if (records == 0) { +- row = "No result."; +- $("#ov_" + cbArgs + "_sl").text(""); +- } +- for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + sigs + ""; +- row += "" + src + ""; +- row += "" + dst + ""; +- row += "" + port + ""; +- row += ""; +- row += "
"; +- } +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); +- $("#ov_" + cbArgs + "_sl").after(tbl); +- $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); +- mkSlider("ov_" + cbArgs + "_sl", i, records); +- } +- // Signature +- function cb16(data){ +- eval("raw=" + data); +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "#SRC"; +- head += "#DST"; +- head += "SIGNATURE"; +- head += "ID"; +- head += ""; +- +- var eventsum = raw[raw.length - 1].n || 0; +- var records = raw[raw.length - 1].r || 0; +- if (records == 0) { +- row = "No result."; +- $("#ov_signature_sl").text(""); +- $("#ovestat").html("(No events)"); +- } else { +- $("#ovestat").html("(" + eventsum + " events)"); +- } +- for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + src + ""; +- row += "" + dst + ""; +- row += "" + sig + ""; +- row += "" + sid + ""; +- row += ""; +- row += "
"; +- } +- +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($('#topsignature')[0]) $('#topsignature').remove(); +- $("#ov_signature_sl").after(tbl); +- $("#ov_signature_msg").html("viewing " + i + " of " + records + " results"); +- mkSlider("ov_signature_sl", i, records); +- } +- } +- +- $(".ovsl").mouseup(function() { +- var section = $(this).attr('id'); +- var base = section.split("_")[1]; +- var limit = Number($("#" + section + "_lbl").text()); +- if (limit > 0) mkSummary(base, limit); +- }); +- +- // +- // Views tab +- // +- +- function loadViews() { +- $('.db_links').show(); +- if (!$("#db_view_cont")[0]) mkView(); +- } +- +- // Link handlers +- $(document).on('click', '.db_link', function() { +- $('.db_link').each(function() { +- if ($(this).data('state') == '1') { +- $(this).removeClass('db_link_active'); +- $(this).data('state', '0'); +- } +- }); +- $(this).data('state', '1'); +- mkView(); +- }); +- +- $(document).on('click', '.db_type', function() { +- $('.db_type').each(function() { +- if ($(this).data('state') == '1') { +- $(this).removeClass('db_type_active'); +- $(this).data('state', '0'); +- } +- }); +- $(this).data('state', '1'); +- mkView(); +- }); +- +- $(document).on('click','.db_save', function() { +- +- }); +- +- // Create the view +- function mkView() { +- $('#db_view_cont,#hp_info').remove(); +- if (!$("#db_view_ldr")[0]) { +- var view = 'ip'; +- $('.db_link').each(function() { +- if ($(this).data('state') == '1') { +- $(this).addClass('db_link_active'); +- view = $(this).data('val'); +- } +- }); +- +- var type = 'sk'; +- $('.db_type').each(function() { +- if ($(this).data('state') == '1') { +- $(this).addClass('db_type_active'); +- type = $(this).data('type'); +- } +- }); +- +- var theWhen = getTimestamp(); +- var theSensors = s2h('empty'); +- var theFilter = mkFilter(); +- // See if we are filtering by sensor +- if ($('.chk_sen:checked').length > 0) { +- var active_sensors = "AND event.sid IN("; +- var iter = $('.chk_sen:checked').length; +- $('.chk_sen:checked').each(function() { +- active_sensors += "'" + $(this).val() + "',"; +- }); +- active_sensors = active_sensors.replace(/,+$/,''); +- active_sensors += ")"; +- theSensors = s2h(active_sensors); +- } +- +- var ldr = "
"; +- $('.db_view').after(ldr); +- var qargs = view + "-" + type; +- var urArgs = "type=16&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,type)}); +- }); +- +- function cb17(data,type) { +- eval("viewData=" + data); +- var records = viewData.records; +- if ($('#db_view_cont')[0]) $('#db_view_cont').remove(); +- if (records > 0) { +- $('.db_view').after("
"); +- switch (type) { +- case 'sk': +- var w = $(window).width(); +- var h = viewData.links.length * 12; +- if (h < 100) h = 100; +- mkSankey("db_view_cont",viewData,w,h); +- break; +- } +- } else { +- $('.db_view').after("
The query returned no results.
"); +- } +- $('#db_view_ldr').remove(); +- } +- } +- } +- +- // Make a map +- function doMap() { +- theWhen = getTimestamp(); +- var theFilter = mkFilter(); +- var working = "Working
"; +- +- $('#wm0').html(working); +- +- var urArgs = "type=" + 10 + "&filter=" + theFilter + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb10(data)}); +- }); +- +- function cb10(data){ +- eval("mapRaw=" + data); +- try { +- var mapDetail = $.parseJSON("{" + mapRaw.all + "}"); +- var srcc = mapRaw.srcc; +- var srce = mapRaw.srce; +- var dstc = mapRaw.dstc; +- var dste = mapRaw.dste; +- var allc = mapRaw.allc; +- var alle = mapRaw.alle; +- } +- catch(e) { +- var mapDetail = "{\"\"}"; +- } +- +- // What is our current event total? +- var esum = $('#event_sum').val(); +- var w = $(window).width() - 72; +- var h = w / 2.7 ; +- $("#ov_map").html("
"); +- $('#wm0').vectorMap({ +- map: 'world_mill_en', +- color: '#f4f3f0', +- backgroundColor: '#CFE1FC', +- zoomOnScroll: false, +- onRegionClick: function(event, code){ +- hItemAdd(code); +- $('#search').val("cc" + " " + code); +- $('#search').focus(); +- }, +- series: { +- regions: [{ +- values: mapDetail, +- scale: ['#ffffff', '#000000'], +- normalizeFunction: 'polynomial' +- }] +- }, +- onRegionLabelShow: function(e, el, code){ +- if (mapDetail[code]) { +- var eper = parseFloat(mapDetail[code]/esum*100).toFixed(3); +- el.html(el.html() + ' (' + mapDetail[code] + ' Events ' + eper + '% of Total)'); +- } else { +- el.html(el.html()); +- } +- } +- }); +- +- var stats = "("; +- stats += allc + " distinct countries)"; +- $("#ovmapstat").html(stats); +- } +- } +- +- // Redraw map +- $(document).on("click", "#map_src, #map_dst", function() { +- doMap($(this).attr('id').split("_")[1]); +- }); +- +- // +- // History +- // +- +- function doHistory(object) { +- $('#loader').show(); +- var urArgs = "type=" + 21 + "&object=" + s2h("aa" + object) + "&ts=" + theWhen; +- $(function(){ +- $.get(".inc/callback.php?" + urArgs, function(data){cb21(data)}); +- }); +- +- function cb21(data){ +- eval("chartData=" + data); +- var r1 = chartData.r1; +- var r2 = chartData.r2; +- var sum = 0; +- if (r1 > 0) { +- mkHeatMap(".ev_hm",chartData.start,chartData.rows1,object); +- $('#obhist_sig').remove(); +- if (r2 > 0) { +- +- for (var i=0; i < r2; i++) { +- sum += Number(chartData.rows2[i].value); +- } +- +- var tbl = '', head = '', row = ''; +- head += ""; +- head += "COUNT"; +- head += "%TOTAL"; +- head += "SIGNATURE"; +- head += ""; +- row += ""; +- +- for (var i=0; i < r2; i++) { +- +- var cnt = chartData.rows2[i].value || "-"; +- var sig = chartData.rows2[i].label || "-"; +- var sid = chartData.rows2[i].sid || "-"; +- var per = 0; +- if (sum > 0) var per = parseFloat(cnt/sum*100).toFixed(2); +- var tsg = truncTag(sig,60); +- +- row += ""; +- row += "" + cnt + ""; +- row += "" + per + "%"; +- row += "" + tsg + ""; +- row += "" +- row += "
"; +- } +- +- row += ""; +- tbl += ""; +- tbl += head; +- tbl += row; +- tbl += "
"; +- if ($('#obhist_sig')[0]) $('#obhist_sig').remove(); +- $(".ev_py").append(tbl); +- } +- } else { +- return; +- } +- if ($(".eview_charts")[0]) $('.eview_charts').slideDown('slow'); +- $("#loader").hide(); +- } +- } +-// The End. +-}); +--- securityonion-squert-20161212.orig/auth/sso/squert/login.php ++++ /dev/null +@@ -1,158 +0,0 @@ +- +-// +-// This program is free software: you can redistribute it and/or modify +-// it under the terms of the GNU General Public License as published by +-// the Free Software Foundation, either version 3 of the License, or +-// (at your option) any later version. +-// +-// This program is distributed in the hope that it will be useful, +-// but WITHOUT ANY WARRANTY; without even the implied warranty of +-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-// GNU General Public License for more details. +-// +-// You should have received a copy of the GNU General Public License +-// along with this program. If not, see . +-// +-// +- +-include_once '.inc/config.php'; +- +-$username = $password = $err = ''; +-$focus = 'username'; +-session_set_cookie_params(0, NULL, NULL, NULL, TRUE); +- +-function cleanUp($string) { +- if (get_magic_quotes_gpc()) { +- $string = stripslashes($string); +- } +- $string = mysql_real_escape_string($string); +- return $string; +-} +- +-//if ($_SERVER['REQUEST_METHOD'] == 'POST'){ +- //$username = $_REQUEST['username']; +- //$password = $_REQUEST['password']; +- // sso +- $username = $_SERVER['PHP_AUTH_USER']; +- $password = $_SERVER['PHP_AUTH_PW']; +- +- $ua = $_SERVER['HTTP_USER_AGENT']; +- $rqt = $_SERVER['REQUEST_TIME']; +- $rqaddr = $_SERVER['REMOTE_ADDR']; +- $max = mt_getrandmax(); +- $rqt .= mt_rand(0,$max); +- $rqaddr .= mt_rand(0,$max); +- $ua .= mt_rand(0,$max); +- $cmpid = $rqt . $rqaddr . $ua; +- $id = md5($cmpid); +- // PDO prepared statements +- try { +- // first connect to database with the PDO object. +- $dbpdo = new PDO("mysql:host=$dbHost;dbname=$dbName;charset=latin1", "$dbUser", "$dbPass", [ +- PDO::ATTR_EMULATE_PREPARES => false, +- PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => false, +- PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION +- ]); +- } catch(PDOException $e){ +- // if connection fails, log PDO error. +- error_log("Error connecting to mysql: ". $e->getMessage()); +- } +- +- if (isset($dbpdo)) { +- // prepare statement +- $statement = "SELECT * FROM user_info WHERE username = :user"; +- $query = $dbpdo->prepare("$statement"); +- // build parameters for prepared statement +- $params = [":user" => "$username"]; +- // execute the prepared statement and pass it params +- $query->execute($params); +- // fetch the data +- while ($row = $query->fetch(PDO::FETCH_NUM)) { +- $userName = $row[1]; +- $lastLogin = $row[2]; +- $userHash = $row[3]; +- $userEmail = $row[4]; +- $userType = $row[5]; +- $userTime = $row[6]; +- $tzoffset = $row[7]; +- } +- +- // if $username was found in database, then check password +- if ( isset($userName) && $username == $userName) { +- // The first 2 chars are the salt +- $theSalt = substr($userHash, 0,2); +- +- // The remainder is the hash +- $theHash = substr($userHash, 2); +- +- // Now we hash the users input +- $testHash = sha1($password . $theSalt); +- +- // Does it match? If yes, start the session. +- if ($testHash === $theHash) { +- session_start(); +- +- // Protect against session fixation attack +- if (!isset($_SESSION['initiated'])) { +- session_regenerate_id(); +- $_SESSION['initiated'] = true; +- } +- +- $_SESSION['sLogin'] = 1; +- $_SESSION['sUser'] = $userName; +- $_SESSION['sPass'] = $password; +- $_SESSION['sEmail'] = $userEmail; +- $_SESSION['sType'] = $userType; +- $_SESSION['sTime'] = $userTime; +- $_SESSION['tzoffset'] = $tzoffset; +- $_SESSION['sTab'] = 't_sum'; +- $_SESSION['id'] = $id; +- +- header ("Location: index.php?id=$id"); +- } else { +- $err = 'The user name or password is incorrect.'; +- $focus = 'username'; +- } +- } else { +- $err = 'The user name or password is incorrect.'; +- $focus = 'username'; +- } +- } else { +- $err = 'Connection Failed'; +- } +-//} +-?> +- +- +- +-Please login to continue +- +- +- +- +-
+-
+- +- +- +- +- +- +-
+-squert - Please login to continue
+-Username
+-
+-Password
+-
+-

+-
Version 1.7.1©2016 Paul Halliday
+-
+-
+- +- +- +--- securityonion-squert-20161212.orig/login.php ++++ securityonion-squert-20161212/login.php +@@ -150,7 +150,7 @@ Password
+

+ + +-
Version 1.7.0©2016 Paul Halliday
++
Version 1.7.1©2016 Paul Halliday
+ + + diff --git a/debian/patches/fix-for-loop b/debian/patches/fix-for-loop new file mode 100644 index 0000000..d49a09b --- /dev/null +++ b/debian/patches/fix-for-loop @@ -0,0 +1,36 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion37) xenial; urgency=medium + . + * fix for loop +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.inc/callback.php ++++ securityonion-squert-20161212/.inc/callback.php +@@ -444,7 +444,7 @@ function level2() { + $rows = $query->fetchAll(PDO::FETCH_ASSOC); + // the frontend expects all values to be strings + for ($i=0;$i + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion35) xenial; urgency=medium + . + * frontend expects all values to be strings +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.inc/callback.php ++++ securityonion-squert-20161212/.inc/callback.php +@@ -442,6 +442,8 @@ function level2() { + $query->execute($merged_params); + // fetch the data and encode to json + $rows = $query->fetchAll(PDO::FETCH_ASSOC); ++ // the frontend expects all values to be strings ++ $rows[0] = array_map('strval', $rows[0]); + $theJSON = json_encode($rows); + echo $theJSON; + diff --git a/debian/patches/iterate-over-all-arrays-when-converting-strings b/debian/patches/iterate-over-all-arrays-when-converting-strings new file mode 100644 index 0000000..0411e40 --- /dev/null +++ b/debian/patches/iterate-over-all-arrays-when-converting-strings @@ -0,0 +1,38 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion36) xenial; urgency=medium + . + * iterate over all arrays when converting strings +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.inc/callback.php ++++ securityonion-squert-20161212/.inc/callback.php +@@ -443,7 +443,9 @@ function level2() { + // fetch the data and encode to json + $rows = $query->fetchAll(PDO::FETCH_ASSOC); + // the frontend expects all values to be strings +- $rows[0] = array_map('strval', $rows[0]); ++ for ($i=0;$i + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion32) xenial; urgency=medium + . + * move files from elastic package +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- /dev/null ++++ securityonion-squert-20161212/.js/squertMain.js +@@ -0,0 +1,3276 @@ ++/* Copyright (C) 2012 Paul Halliday */ ++ ++$(document).ready(function(){ ++ ++ $(document).on('click', '[class*="bpr"]', function() { ++ // We disallow filtering if any events have already been selected ++ // or if we stray from the event tab ++ if ($('.d_row_active')[0]) return; ++ if ($(".chk_event:checked").length > 0) return; ++ if ($(".tab_active").attr('id') != 't_sum') return; ++ ++ var prClass = $(this).attr('class').split('b')[1]; ++ var prOld = $(this).data('pr'); ++ ++ function flipIt(pattern) { ++ $(pattern).closest('tr').hide(); ++ $(pattern).closest('tr').attr('class','hidden'); ++ if ($('#gr').text() == 'on') $(pattern).closest('tr').find('.chk_event').prop("disabled",true); ++ } ++ if ($('.b' + prClass).attr('class') == 'bprA') { ++ $('.b' + prClass).attr('class', 'bpr' + prOld); ++ $('.hidden').attr('class','d_row'); ++ $('.d_row').show(); ++ if ($('#gr').text() == 'on') { ++ $('.chk_event').prop("disabled",false); ++ $('.chk_all').prop("checked",false); ++ $('.chk_event').css("background-color", "#fafafa"); ++ } ++ } else { ++ // See if we are already filtered ++ if ($('.bprA')[0]) { ++ $('.hidden').attr('class','d_row'); ++ $('.d_row').show(); ++ if ($('#gr').text() == 'on') { ++ $('.chk_event').prop("disabled",false); ++ $('.chk_all').prop("checked",false); ++ $('.chk_event').css("background-color", "#fafafa"); ++ } ++ var prPrev = $('.bprA').data('pr'); ++ $('.bprA').attr('class', 'bpr' + prPrev); ++ } ++ $('.b' + prClass).attr('class','bprA'); ++ switch (prClass) { ++ case "pr1": ptrn = ".pr2,.pr3,.pr4"; break; ++ case "pr2": ptrn = ".pr1,.pr3,.pr4"; break; ++ case "pr3": ptrn = ".pr1,.pr2,.pr4"; break; ++ case "pr4": ptrn = ".pr1,.pr2,.pr3"; break; ++ } ++ flipIt(ptrn); ++ } ++ }); ++ ++ // ++ // Load main content ++ // ++ ++ // Keep track of context ++ thisUser = $('#t_usr').data('c_usr'); ++ thisTZ = $('#user_tz').val(); ++ rtbit = 0; ++ eventList("0-aaa-00"); ++ $("#loader").show(); ++ lastclasscount = 0; ++ ++ $(document).on("click", "#dt_savetz", function(event) { ++ if ($('.dt_error').data('err') == 0) { ++ var newOffset = $('#ts_offset').val(); ++ profileUpdate("tz", s2h(newOffset)); ++ $('#user_tz').val(newOffset); ++ } ++ }); ++ ++ // Depending on context a 'No result' may be confusing ++ // so we turn off active queue and show everything ++ $(document).on('click', '#retry', function() { ++ $('#rt').attr('class','tvalue_off'); ++ $('#rt').text('off'); ++ rtbit = 0; ++ $('.b_update').click(); ++ }); ++ ++ // Get event statuses ++ var eTotal = 0, qTotal = 0; ++ function statusPoll(caller) { ++ // See if we are filtering by sensor ++ var theSensors = s2h('empty'); ++ if ($('.chk_sen:checked').length > 0) { ++ var active_sensors = "AND event.sid IN("; ++ var iter = $('.chk_sen:checked').length; ++ $('.chk_sen:checked').each(function() { ++ active_sensors += "'" + $(this).val() + "',"; ++ }); ++ active_sensors = active_sensors.replace(/,+$/,''); ++ active_sensors += ")"; ++ theSensors = s2h(active_sensors); ++ } ++ ++ var urArgs = "type=" + 6 + "&ts=" + theWhen + "&sensors=" + theSensors; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb(data)}); ++ }); ++ ++ function cb(data){ ++ // Check to make sure we still have a valid session. If we don't ++ // let the user know and return them to the login page. ++ if (data[0] == "<") { ++ $("span.class_msg").text("Your session has expired!"); ++ $("span.class_msg").css("background-color", "#cc0000"); ++ $("span.class_msg").css("color", "#fff"); ++ $("span.class_msg").show(); ++ var sessionDead = confirm("Your session has expired. Press \"OK\" to return to the login page. If you aren't finished with what you were looking at click 'Cancel'. Note: you won't be able to perform any actions."); ++ if (sessionDead) { ++ $("#logout").click(); ++ } ++ } ++ eval("ec=" + data); ++ ++ var esum = 0; ++ ++ for (var i=0; i 0) { ++ var p = parseFloat(ecount/esum*100).toFixed(1); ++ var w = parseInt(p*2); ++ } ++ if (eclass == 0) { ++ qTotal = ecount; ++ } ++ $("#c-" + eclass).text(ecount); ++ $("#c-" + eclass).append("(" + p + "%)"); ++ } ++ ++ var lastcount = $("#cat_sum").val(); ++ var newcount = esum; ++ $("#cat_sum").val(esum); ++ eTotal = esum; ++ $("#event_sum").val(eTotal); ++ ++ if (caller == 0) { // Fresh load ++ lastcount = newcount; ++ } ++ ++ // Last RT value ++ var lastQ = Number($("#qtotal").html()); ++ if (lastcount < newcount) { ++ $("#etotal").html(eTotal); ++ } ++ ++ if (lastQ < qTotal) { ++ if (caller != 0) { ++ if ($(".icon_notifier").css('display') == 'none') $(".icon_notifier").fadeToggle(); ++ } ++ $("#etotal").html(eTotal); ++ $("#qtotal").html(qTotal); ++ } ++ ++ $("#title").html("squert (" + qTotal + ") - " + thisUser); ++ ++ } ++ ++ } ++ ++ // ++ // Event monitor (how often we poll for new events) ++ // ++ ++ var emTimeout = 30000; ++ window.setInterval(function(){ ++ if ($('#search').val().length == 0) { ++ statusPoll(1); ++ } ++ }, emTimeout); ++ ++ $(document).on("click", '[class*="cl_"]', function(event) { ++ var nc = $(this).attr('class').split("_"); ++ var ct = $(this).parents('table').data('comment'); ++ $(".cat_msg_txt").val(ct); ++ $('#b_class-' + nc[1]).click(); ++ }); ++ ++ // Tabs ++ var tab_cached = $("#sel_tab").val(); ++ ++ switch (tab_cached) { ++ case "t_sum": ++ $('.content-right').show(); ++ break; ++ case "t_ovr": ++ $('.content-right').hide(); ++ $('.content-left').hide(); ++ if ($('#ovestat').text().length == 0) loadSummary(); ++ break; ++ case "t_view": ++ $('.content-right').hide(); ++ $('.content-left').hide(); ++ loadViews(); ++ default: ++ $('.content-right').hide(); ++ $('.content-left').hide(); ++ break; ++ } ++ ++ $('#' + tab_cached).attr('class','tab_active'); ++ $("#" + tab_cached + "_content").attr('class','content_active'); ++ ++ $(".tab,.tab_active").click(function(event) { ++ var active = $(".tab_active").attr('id'); ++ var content = $(".content_active").attr('id'); ++ if ($(".fl_val_on")[0]) { ++ $('.b_update').click(); ++ } ++ ++ if ( this.id != active ) { ++ $("#" + active).removeClass('tab_active'); ++ $("#" + active).addClass('tab'); ++ $(this).attr('class','tab_active'); ++ $("#" + content).attr('class','content'); ++ $("#" + this.id + "_content").attr('class','content_active'); ++ activeTab = $(".tab_active").attr('id'); ++ $('.pin').hide(); ++ ++ switch (activeTab) { ++ case "t_sum": ++ $('.content-right').show(); ++ if (Number($('.botog').data('val')) == 1) $('.content-left').show(); ++ $('.t_pbar').css('opacity',1); ++ $('.db_links').hide(); ++ $('.pin').show(); ++ break; ++ case "t_ovr": ++ $('.content-right').hide(); ++ $('.content-left').hide(); ++ if ($('#ovestat').text().length == 0) loadSummary(); ++ $('.t_pbar').css('opacity',.1); ++ $('.db_links').hide(); ++ break; ++ case "t_view": ++ $('.content-right').hide(); ++ $('.content-left').hide(); ++ $('.t_pbar').css('opacity',.1); ++ loadViews(); ++ break; ++ default: ++ $('.content-right').hide(); ++ $('.content-left').hide(); ++ $('.t_pbar').css('opacity',.1); ++ $('.db_links').hide(); ++ break; ++ } ++ ++ $('#sel_tab').val(activeTab); ++ var ctab = $('#sel_tab').val(); ++ var urArgs = "type=" + 5 + "&tab=" + ctab; ++ $.get(".inc/callback.php?" + urArgs); ++ } ++ }); ++ ++ // Sub tab groups ++ $(".tsg").click(function(event) { ++ var nc = Number($(this).attr('class').split(/\s/).length); ++ var ct = $(this).data('tab'); ++ $('.tsg_active').attr('class','tsg'); ++ $(this).attr('class','tsg tsg_active'); ++ }); ++ ++ // Toggle and update views ++ function newView(req) { ++ // No racing please ++ var bail = $("#loader").css('display'); ++ if (bail != 'none') return; ++ // Remove any stale views ++ $("#tl0,#tl1,#tl3a,#tl3b").remove(); ++ var f = "0-aaa-00"; ++ var s = "2a-aaa-00"; ++ var cv = $("#gr").text(); ++ ++ switch (cv) { ++ case "on": ++ eventList(f); ++ $("#loader").show(); ++ break; ++ case "off": ++ eventList(s); ++ $("#loader").show(); ++ break; ++ } ++ } ++ ++ // Group and ungroup ++ $(document).on("click", "#gr", function(event) { ++ var bail = $("#loader").css('display'); ++ if (bail != 'none') return; ++ var cv = $('#gr').text(); ++ switch (cv) { ++ case 'on': ++ $('#gr').attr('class','tvalue_off'); ++ $('#gr').text('off'); ++ break; ++ case 'off': ++ $('#gr').attr('class','tvalue_on'); ++ $('#gr').text('on'); ++ $("#event_sort").val("DESC"); ++ break; ++ } ++ }); ++ ++ // RT check/uncheck ++ $(document).on("click", "#rt", function(event) { ++ var bail = $("#loader").css('display'); ++ if (bail != 'none') return; ++ var cv = $('#rt').text(); ++ switch (cv) { ++ case 'on': ++ $('#rt').attr('class','tvalue_off'); ++ $('#rt').text('off'); ++ rtbit = 0; ++ break; ++ case 'off': ++ $('#rt').attr('class','tvalue_on'); ++ $('#rt').text('on'); ++ rtbit = 1; ++ break; ++ } ++ }); ++ ++ // Toggle side/lower bars ++ $(document).on("click", ".botog", function(event) { ++ if ($('.tab_active').attr('id') != 't_sum') return; ++ var n = Number($('.botog').data("val")); ++ switch (n) { ++ case 1: ++ $('.botog').data("val","0"); ++ $('.content-right').css("width","100%"); ++ $('.botog').attr('src','.css/layout0.png'); ++ break; ++ case 0: ++ $('.botog').data("val","1"); ++ $('.content-right').css("width","82%"); ++ $('.botog').attr('src','.css/layout1.png'); ++ break; ++ } ++ $('.bottom').animate({height: 'toggle'}); ++ $('.content-left').animate({width: 'toggle'}); ++ }); ++ ++ // Section show and hide ++ $(".st").click(function() { ++ var thisSec = $(this).data("sec"); ++ var thisSecID = "#sec_" + thisSec; ++ var thisSecVis = $(thisSecID).css("display"); ++ var lastSection = "h"; ++ switch (thisSecVis) { ++ case "none": ++ $(this).attr("src", ".css/uarr.png"); ++ $(thisSecID).slideDown(); ++ break; ++ default: ++ $(this).attr("src", ".css/darr.png"); ++ $(thisSecID).slideUp(); ++ break; ++ } ++ }); ++ ++ // If search is in focus, update on enter ++ $('#search').keypress(function(e) { ++ if (!e) e=window.event; ++ key = e.keyCode ? e.keyCode : e.which; ++ if (key == 13) { ++ // Close comment box if it is open ++ if ($('#cat_box').css('display') != 'none') { ++ $('#ico01').click(); ++ } ++ $('.b_update').click(); ++ } ++ }); ++ ++ // Sort ASC/DESC ++ $(document).on("click", ".event_time", function(event) { ++ var csv = $(".event_time").text(); ++ switch (csv) { ++ case "show oldest first": ++ $("#event_sort").val("ASC"); ++ break; ++ case "show newest first": ++ $("#event_sort").val("DESC"); ++ break; ++ } ++ newView("u"); ++ }); ++ ++ // Update page ++ $(document).on("click", ".b_update", function(event) { ++ $(".icon_notifier").fadeToggle(); ++ $(".tag").remove(); ++ $(".tag_empty").show(); ++ // Remove any supplementary results ++ if ($("#extresult")[0]) $("#extresult").remove(); ++ // Where are we? ++ var curTab = $('.tab_active').attr('id'); ++ switch (curTab) { ++ case 't_ovr': ++ loadSummary(); ++ break; ++ case 't_view': ++ mkView(); ++ break; ++ default: ++ $(".b_update_note").hide(); ++ newView("u"); ++ break; ++ } ++ }); ++ ++ // Clear search and refresh ++ $('#clear_search').click(function() { ++ if ($('#search').val() != '') { ++ $('#search').val(''); ++ $("#search").focus(); ++ if ($(".fl_val_on")[0]) { ++ $('.b_update').click(); ++ } ++ } ++ }); ++ ++ // Logout ++ $("#logout").click(function(event) { ++ //$.get("/logout.html", function(){location.reload()}); ++ location.replace("/logout.html"); ++ }); ++ ++ // Toggle filters ++ $(document).on('click', '.fl_val_on', function(event) { ++ var wF = $(this).data("ft"); ++ switch (wF) { ++ case "tl": ++ ++ break; ++ case "ob": ++ $('#clear_search').click(); ++ break; ++ case "sn": ++ $(".chk_sen").each(function() { ++ $(this).prop("checked",false); ++ }); ++ $('.b_update').click(); ++ break; ++ } ++ }); ++ ++ function clearTags() { ++ //$(".tag").remove(); ++ //$(".tag_empty").show(); ++ $(".tag").removeClass('tag_active'); ++ } ++ ++ // ++ // Rows ++ // ++ ++ function closeRow() { ++ $("#active_eview").remove(); ++ $("#" + this.id).attr('class','d_row'); ++ $(".d_row").css('opacity','1'); ++ ltCol = $(".d_row_active").find('td.lt').html(); ++ $(".d_row_active").find('td.lt').css('background', ltCol); ++ $(".d_row_active").attr('class','d_row'); ++ // Update class_count ++ $("#class_count").text(lastclasscount); ++ // Get rid of any crashed loaders ++ $("#loader").hide(); ++ // Reset checkbox ++ $(".chk_all").prop("checked",false); ++ // Clear Tags ++ clearTags(); ++ } ++ function closeSubRow() { ++ $("#eview_sub1").remove(); ++ $("#" + this.id).attr('class','d_row_sub'); ++ $(".d_row_sub").css('opacity','1'); ++ $(".d_row_sub_active").attr('class','d_row_sub'); ++ // Update class_count ++ $("#class_count").text(lastclasscount); ++ curclasscount = lastclasscount; ++ $("#loader").hide(); ++ // Reset and show checkbox ++ $(".chk_all").prop("checked",false); ++ $("#ca0").show(); ++ // Remove any open externals ++ if ($("#extresult")[0]) $("#extresult").remove(); ++ // Clear Tags ++ clearTags(); ++ } ++ function closeSubRow1() { ++ $("#eview_sub2").remove(); ++ $("#" + this.id).attr('class','d_row_sub1'); ++ if (!$("#eview_sub3")[0]) { ++ $(".d_row_sub1").css('opacity','1'); ++ $(".d_row_sub_active1").attr('class','d_row_sub1'); ++ } ++ $("#loader").hide(); ++ // Reset checkbox ++ $(".chk_all").prop("checked",false); ++ // Remove any open externals ++ if ($("#extresult")[0]) $("#extresult").remove(); ++ // Clear Tags ++ clearTags(); ++ } ++ function closeSubRow2() { ++ $("#eview_sub3").remove(); ++ $("#" + this.id).attr('class','d_row_sub1'); ++ if (!$("#eview_sub2")[0]) { ++ $(".d_row_sub1").css('opacity','1'); ++ $(".d_row_sub1_active").attr('class','d_row_sub1'); ++ } ++ $("#loader").hide(); ++ // Clear Tags ++ clearTags(); ++ } ++ ++ // ++ // Level 1 ++ // ++ ++ $(document).on("click", ".row_active", function(event) { ++ var curID = $(this).parent('tr').attr('id'); ++ // What type of row are we? ++ rowType = curID.substr(0,3); ++ ++ // Make sure no other instances are open ++ if (!$(".d_row_active")[0] && rowType == 'sid') { ++ $("#loader").show(); ++ // This leaves us with sid-gid ++ var rowValue = curID.replace("sid-",""); ++ var sigID = rowValue.split("-")[0]; ++ ++ $(".d_row_active").attr('class', 'd_row'); ++ $("#active_eview").attr('class','d_row'); ++ ++ // This is now the active row ++ $("#" + curID).attr('class','d_row_active'); ++ $("html, body").animate({ scrollTop: $('.d_row_active').offset().top - 140 }, 20); ++ // History ++ var itemToAdd = $("#" + curID).find('[class*="row_filter"]').text(); ++ hItemAdd(itemToAdd); ++ // Set the class count (counted again after load) ++ curclasscount = $('.d_row_active').data('event_count'); ++ var cols = $('th.sort').length; ++ var tbl = ''; ++ tbl += ""; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
↓
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += ""; ++ tbl += "CATEGORIZE"; ++ tbl += curclasscount + "EVENT(S)  "; ++ tbl += "    "; ++ tbl += "CREATE FILTER: "; ++ tbl += "src  "; ++ tbl += "dst  "; ++ tbl += "both"; ++ tbl += "
"; ++ $("#" + curID).after(tbl); ++ ++ // Lookup signature ++ sigLookup(rowValue); ++ ++ // Fetch results ++ eventList("1-" + rowValue); ++ ++ $("#eview").show(); ++ $(".d_row").fadeTo('0','0.2'); ++ } else { ++ closeRow(); ++ } ++ }); ++ ++ // ++ // Level 2 ++ // ++ ++ $(document).on("click", ".sub_active", function() { ++ if (!$(".d_row_sub_active")[0]) { ++ var callerID = $(this).parent('tr').attr('id'); ++ ++ // Reset checkbox ++ $(".chk_all").prop("checked",false); ++ ++ // RT or ALL? ++ switch (rtbit) { ++ case 1: adqp = s2h("AND event.status = 0"); break; ++ case 0: adqp = s2h("empty"); break; ++ } ++ // We are now the active row ++ $("#" + callerID).attr('class','d_row_sub_active'); ++ ++ // Populate search times ++ var bt = $("#" + callerID).find('[class*="timestamp"]').html(); ++ var est = mkStamp(bt,"-",3600000,thisTZ); ++ var eet = mkStamp(bt,"+",3600000,thisTZ); ++ ++ $('#el_start').val(est); ++ $('#el_end').val(eet); ++ ++ // Clear search terms ++ $("#srchterms").html(''); ++ $(".srch_txt").val(''); ++ ++ // History and search ++ $("#" + callerID).find('[class*="sub_filter"]').each(function() { ++ if ($(this).data('type') == 'cc') { ++ var itemToAdd = $(this).data('value'); ++ } else { ++ var itemToAdd = $(this).text(); ++ // Add search terms ++ $("#srchterms").append("" + itemToAdd + "  "); ++ } ++ hItemAdd(itemToAdd); ++ }); ++ ++ $("#loader").show(); ++ eventList("2-" + callerID + "-" + adqp); ++ } else { ++ closeSubRow(); ++ } ++ }); ++ ++ // ++ // Level 3 (a or b) request payload ++ // ++ ++ $(document).on("click", ".sub1_active", function() { ++ // Close transcript if it is open ++ if ($(".eview_sub3")[0]) closeSubRow2(); ++ if (!$(".d_row_sub_active1")[0]) { ++ var callerID = $(this).parent('tr').attr('id'); ++ $("#" + callerID).attr('class','d_row_sub_active1'); ++ ++ // Populate search times ++ var bt = $("#" + callerID).find('[class*="timestamp"]').html(); ++ var est = mkStamp(bt,"-",1800000,thisTZ); ++ var eet = mkStamp(bt,"+",1800000,thisTZ); ++ ++ $('#el_start').val(est); ++ $('#el_end').val(eet); ++ ++ // Clear search terms ++ $("#srchterms").html(''); ++ $(".srch_txt").val(''); ++ ++ // History ++ $("#" + callerID).find('[class*="sub_filter"]').each(function() { ++ if ($(this).data('type') == 'cc') { ++ var itemToAdd = $(this).data('value'); ++ } else { ++ var itemToAdd = $(this).text(); ++ } ++ if ($(this).data('type') == 'ip') { ++ // Add search terms ++ $("#srchterms").append("" + itemToAdd + "  "); ++ } ++ hItemAdd(itemToAdd); ++ }); ++ $("#loader").show(); ++ eventList("3-" + callerID); ++ } else { ++ closeSubRow1() ++ } ++ }); ++ ++ // ++ // Level 3 (a or b) request transcript ++ // ++ ++ $(document).on("click", ".sub2_active", function(event) { ++ // Close payload if it is open ++ if ($(".eview_sub2")[0]) closeSubRow1(); ++ var bail = $("#loader").css('display'); ++ if (bail != 'none') return; ++ if (!$(".eview_sub3")[0]) { ++ $("#loader").show(); ++ composite = $(this).data('tx').split("-"); ++ rowLoke = composite[0]; ++ $("#" + rowLoke).attr('class','d_row_sub1_active'); ++ nCols = $("#" + rowLoke).find('td').length; ++ cid = composite[1]; ++ txdata = composite[2]; ++ ++ // See if a transcript is available ++ var urArgs = "type=" + 7 + "&txdata=" + txdata; ++ $(function(){ ++ $.post(".inc/callback.php?" + urArgs, function(data){cb5(data)}); ++ }); ++ ++ function cb5(data){ ++ eval("txRaw=" + data); ++ txCMD = txRaw.cmd; ++ txResult = txRaw.tx; ++ txDebug = txRaw.dbg; ++ if (txResult == "DEBUG:") txResult += " No data was returned."; ++ if (!txResult) { ++ txResult = "Transcript request failed!

"; ++ txResult += "The command was:
" + txCMD + "

"; ++ txResult += "The response was:" + txDebug.replace(/DEBUG:/g,"
"); ++ } ++ ++ var row = '',tbl = ''; ++ row += ""; ++ row += ""; ++ row += "
"; ++ row += txResult; ++ row += "
"; ++ ++ tbl += ""; ++ tbl += row; ++ tbl += ""; ++ $("#" + rowLoke).after(tbl); ++ ++ // Turn off fade effect for large results ++ var rC = $(".d_row_sub1").length; ++ if ( rC <= 399 ) { ++ $(".d_row_sub1").fadeTo('fast','0.2'); ++ } ++ ++ $("#loader").hide(); ++ } ++ } else { ++ closeSubRow2(); ++ } ++ }); ++ ++ // Toggle RT depending on entry point ++ $(document).on("click", ".b_ec_hot", function() { ++ rtbit = 1; ++ }); ++ $(document).on("click", ".b_ec_total", function() { ++ rtbit = 0; ++ }); ++ ++ // Filter constructor ++ function mkFilter() { ++ if ($('#search').val().length > 0) { ++ ++ var srchVal = $('#search').val(); ++ var fParts = ""; ++ ++ // If no term is supplied default to a string, IP or wildcard IP search ++ chkVal: ++ if (srchVal.indexOf(" ") == -1 && srchVal[0] != "!") { ++ var re = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; ++ if (re.exec(srchVal)) { ++ srchVal = "ip " + srchVal; ++ break chkVal; ++ } ++ ++ var re = /^(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)\.(\d{1,3}|%)/; ++ if (re.exec(srchVal)) { ++ srchVal = "wip " + srchVal; ++ break chkVal; ++ } ++ ++ srchVal = "sig " + srchVal; ++ } ++ ++ fParts = srchVal.replace(/^!/,"").split(" "); ++ if (fParts[0] == 'cmt') { ++ var theFilter = s2h($('#search').val()); ++ rtbit = 0; ++ } else { ++ // Now see if the requested filter exists ++ if ($("#tr_" + fParts[0]).length > 0) { ++ tmpFilter = $("#tr_" + fParts[0]).data('filter'); ++ // Now see if we need to modify the query ++ if (fParts[1]) { ++ // This is the base filter ++ preFilter = h2s(tmpFilter); ++ // This is the user supplied text. ++ var re = new RegExp("^" + fParts[0] + "\\s{1}|[';\\\`]","g"); ++ theQuestion = fParts.join(' ').replace(re, ""); ++ // We will accept multiple questions if they are comma delimited ++ questionParts = theQuestion.split(","); ++ if (questionParts.length > 1) { ++ var f = '('; ++ for (var i = 0; i < questionParts.length; i++) { ++ f += preFilter.replace(/\$/g, questionParts[i]); ++ if (i != (questionParts.length - 1)) { ++ f += " OR "; ++ } ++ } ++ f += ')'; ++ theFilter = s2h(f); ++ } else { ++ var newFilter = preFilter.replace(/\$/g, questionParts[0]); ++ theFilter = s2h(newFilter); ++ } ++ } else { ++ theFilter = tmpFilter; ++ } ++ } else { // The filter does not exist ++ theFilter = s2h('empty'); ++ } ++ } ++ } else { // No filter supplied ++ theFilter = s2h('empty'); ++ } ++ return theFilter; ++ } ++ ++ // ++ // This creates the views for each level ++ // ++ ++ function eventList (type) { ++ theWhen = getTimestamp(); ++ statusPoll(0); ++ var parts = type.split("-"); ++ var filterMsg = ''; ++ var rt = 0; ++ var theSensors = s2h('empty'); ++ var theFilter = mkFilter(); ++ ++ // See if we are just RT events ++ if ($('#rt').text() == 'on' || rtbit == 1) { ++ rt = 1; ++ rtbit = 1; ++ } ++ // How are we sorting? ++ var sortval = $("#event_sort").val(), sorttxt; ++ switch (sortval) { ++ case "DESC": sorttxt = "show oldest first"; break; ++ case "ASC": sorttxt = "show newest first"; break; ++ } ++ ++ // See if we are filtering by sensor ++ if ($('.chk_sen:checked').length > 0) { ++ var active_sensors = "AND event.sid IN("; ++ var iter = $('.chk_sen:checked').length; ++ $('.chk_sen:checked').each(function() { ++ active_sensors += "'" + $(this).val() + "',"; ++ }); ++ active_sensors = active_sensors.replace(/,+$/,''); ++ active_sensors += ")"; ++ theSensors = s2h(active_sensors); ++ } ++ ++ // Check for any filters ++ if (h2s(theFilter) != 'empty') { ++ $('.fl_val').text('YES'); ++ } else { ++ $('.fl_val').text('NO'); ++ } ++ ++ switch (parts[0]) { ++ ++ // Level 0 view - Grouped by Signature ++ case "0": ++ $('.value').text('-'); ++ ++ // Times Chart ++ var urChrtArgs = "type=22&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors; ++ $(function(){ ++ $.get(".inc/callback.php?" + urChrtArgs, function(data){cb22(data)}); ++ }); ++ ++ function cb22(data){ ++ eval("chartData=" + data); ++ var r = chartData.r; ++ if (r > 0) { ++ mkLine(".times",chartData.rows,chartData.m); ++ } ++ } ++ ++ var urArgs = "type=" + parts[0] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb1(data)}); ++ }); ++ function cb1(data){ ++ eval("d0=" + data); ++ var tbl = ''; ++ var head = ''; ++ var row = ''; ++ var cols = 11; ++ ++ if (rt == 0) cols = 12; ++ head += ""; ++ head += ""; ++ head += "QUEUE"; ++ if (rt == 0) head += "ALL"; ++ head += ""; ++ head += "SC"; ++ head += "DC"; ++ if (rt == 0) head += "CLASS"; ++ head += "ACTIVITY"; ++ head += "LAST EVENT"; ++ head += "SIGNATURE"; ++ head += "ID"; ++ head += "PROTO"; ++ head += "% TOTAL"; ++ head += ""; ++ ++ var sumEC = 0, sumSC = 0, sumDC = 0, sumSI = "-", spr1 = 0, spr2 = 0, spr3 = 0, spr4 = 0; ++ ++ if (d0.length > 0) { ++ // Sums for boxes ++ for (var i=0; i"; ++ row += "No result. If this is unexpected try this"; ++ } ++ ++ if (rt == 1) { ++ sumSC = "-"; ++ sumDC = "-"; ++ sumEC = eTotal; ++ } ++ ++ var sumRT = 0; ++ ++ // Tag Array ++ var tags = new Array(); ++ ++ for (var i=0; i 0 ) { ++ rtClass = "b_ec_hot"; ++ sumRT += parseInt(unClass); ++ } else { ++ rtClass = "b_ec_cold"; ++ } ++ ++ // Sum priorities ++ var prC = Number(d0[i].f1); ++ switch (d0[i].f13) { ++ case "1": spr1 += prC; break; ++ case "2": spr2 += prC; break; ++ case "3": spr3 += prC; break; ++ default: spr4 += prC; break; ++ } ++ ++ rid = "r" + i + "-" + parts[1]; ++ var cells = mkGrid(d0[i].f12); ++ if (rt == 0) var catCells = catGrid(d0[i].f11,0,0); ++ row += ""; ++ row += "
" + unClass + "
"; ++ if (rt == 0) row += "
" + d0[i].f1 + "
"; ++ row += "
" + d0[i].f13 + "
"; ++ row += "" +d0[i].f6+ ""; ++ row += "" +d0[i].f7+ ""; ++ if (rt == 0) row += "" + catCells + ""; ++ ++ timeParts = d0[i].f5.split(" "); ++ timeStamp = timeParts[1]; ++ ++ if ( sumEC > 0) { ++ rowPer = Number(d0[i].f1/sumEC*100).toFixed(3); ++ } else { ++ rowPer = "0.000"; ++ } ++ ++ row += "" + cells + ""; ++ row += "" + timeStamp + ""; ++ row += ""; ++ //row += "
" + d0[i].f2 + "
"; ++ row += d0[i].f2 + ""; ++ row += "" + d0[i].f3 + ""; ++ row += "" + d0[i].f8 + ""; ++ ++ ++ row += "" + rowPer + "%"; ++ row += ""; ++ } ++ ++ // Populate event summary ++ $('#qtotal').text(sumRT); ++ $('#etotal').text(sumEC); ++ $('#esignature').text(sumSI); ++ ++ // Populate tags ++ for (var i=0; i < tags.length; i++) { ++ addTag(tags[i]); ++ } ++ ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ ++ $('#' + parts[1] + '-' + parts[2]).append(tbl); ++ ++ if (d0.length > 0) { ++ var prVals = [spr1,spr2,spr3,spr4]; ++ var pryBar = mkPribar(prVals); ++ } else { ++ var pryBar = mkPribar([0]); ++ } ++ $('#tl1').fadeIn('slow'); ++ $("#tl1").tablesorter(); ++ $("#loader").hide(); ++ } ++ break; ++ ++ // Level 1 view - Grouped by signature, source, destination ++ ++ case "1": ++ var urArgs = "type=" + parts[0] + "&object=" + parts[1] + "&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb2(data)}); ++ }); ++ ++ function cb2(data){ ++ eval("theData=" + data); ++ tbl = ''; ++ head = ''; ++ row = ''; ++ head += "QUEUE"; ++ if (rt == 0) head += "TOTAL"; ++ if (rt == 0) head += "CLASS"; ++ head += "ACTIVITY"; ++ head += "LAST EVENT"; ++ head += "SOURCE"; ++ head += "AGE"; ++ head += "COUNTRY"; ++ head += "DESTINATION"; ++ head += "AGE"; ++ head += "COUNTRY"; ++ head += ""; ++ var curclasscount = 0, tlCount = 0, rtCount = 0; ++ var timeValues = "", scid = ""; ++ ++ // Tag array ++ var tags = new Array(); ++ ++ for (var i=0; i 0 ) { ++ rtClass = "b_ec_hot"; ++ isActive = "sub_active"; ++ } else { ++ rtClass = "b_ec_cold"; ++ isActive = "sub"; ++ } ++ ++ // Aggregate time values ++ timeValues += theData[i].c_ts + ","; ++ var cells = mkGrid(theData[i].f12); ++ if (rt == 0) var catCells = catGrid(theData[i].c_status,0,0); ++ ++ // Event sums ++ tlCount += parseInt(count,10); ++ rtCount += parseInt(unclass,10); ++ ++ rid = "r" + i + "-" + parts[1] + "-" + src_ip + "-" + dst_ip; ++ row += ""; ++ row += "
" + unclass + "
"; ++ if (rt == 0) row += "
" + count + "
"; ++ if (rt == 0) row += "" + catCells + ""; ++ row += "" + cells + ""; ++ row += "" + max_time + ""; ++ row += "
" + src_ip + ""; ++ row += "" + src_age_n + ""; ++ row += ""; ++ row += cs[1] + src_clong + " (." + src_cc.toLowerCase() + ")" + ""; ++ row += "
" + dst_ip + ""; ++ row += "" + dst_age_n + ""; ++ row += ""; ++ row += cd[1] + dst_clong + " (." + dst_cc.toLowerCase() + ")" + ""; ++ row += ""; ++ } ++ ++ // Populate tags ++ for (var i=0; i < tags.length; i++) { ++ addTag(tags[i]); ++ } ++ ++ // Add scid's to checkbox ++ $("#ca0").data("scid", scid.replace(/,$/, "")); ++ ++ // If queue is empty provide event sums in case the user ++ // intends to reclass anything ++ if (rtbit == 1) { ++ curclasscount = rtCount; ++ } else { ++ curclasscount = tlCount; ++ } ++ ++ // update class_count ++ $("#class_count").html(curclasscount); ++ lastclasscount = $("#class_count").html(); ++ ++ // While in grouped events (RT) we remove rows as ++ // they are classed and subtract the values from "Total Events" ++ // This keeps etotal up to date so the math doesn't get silly ++ var oldrt = Number($(".d_row_active").find(".b_ec_hot").text()); ++ var oldec = Number($("#etotal").text()); ++ if (oldrt < rtCount) { ++ newrtcount = parseInt((rtCount - oldrt) + oldec); ++ $("#etotal").text(newrtcount); ++ } ++ ++ // Update parent counts ++ $(".d_row_active").find(".b_ec_hot").text(rtCount); ++ if (rt == 0) $(".d_row_active").find(".b_ec_total").text(tlCount); ++ ++ tbl += "
"; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ $("#eview").after(tbl); ++ $("#tl2").tablesorter({ ++ headers: { ++ 4: {sorter:'ipv4'}, ++ 6: {sorter:'ipv4'} ++ } ++ }); ++ $("#loader").hide(); ++ } ++ break; ++ ++ // Level 2 view - No grouping, individual events ++ ++ case "2": ++ var rowLoke = parts[1]; ++ var filter = $('#' + parts[1]).data('filter'); ++ var urArgs = "type=" + parts[0] + "&object=" + filter + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen + "&adqp=" + parts[2] + "&rt=" + rt + "&sv=" + sortval; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb3(data)}); ++ }); ++ ++ function cb3(data){ ++ eval("d2=" + data); ++ tbl = ''; ++ head = ''; ++ row = ''; ++ head += ""; ++ head += ""; ++ head += "ST"; ++ head += "TIMESTAMP"; ++ head += "EVENT ID"; ++ head += "SOURCE"; ++ head += "PORT"; ++ head += "DESTINATION"; ++ head += "PORT"; ++ head += "SIGNATURE"; ++ head += ""; ++ ++ // Update class_count ++ $("#class_count").html(0); ++ var tlCount=0, rtCount=0; ++ ++ // Tag array ++ var tags= new Array(); ++ ++ for (var i=0; i"; ++ tclass = "c" + eclass; ++ cv = classifications.class[tclass][0].short; ++ ++ // Populate tags array ++ if (src_tag != "-") { ++ var src_tags = src_tag.split(","); ++ $.each(src_tags, function(n,tag) { ++ var t = tags.indexOf(tag); ++ if (t < 0) tags.push(tag); ++ }); ++ } ++ ++ if (dst_tag != "-") { ++ var dst_tags = dst_tag.split(","); ++ $.each(dst_tags, function(n,tag) { ++ var t = tags.indexOf(tag); ++ if (t < 0) tags.push(tag); ++ }); ++ } ++ ++ // Timestamp ++ var compts = d2[i].f2.split(",") || "--"; ++ var timestamp = compts[0]; ++ var utctimestamp = compts[1]; ++ ++ // Event sums ++ tlCount += parseInt(1,10); ++ if (cv == "RT") { ++ rtCount += parseInt(1,10); ++ } ++ ++ // Transcript link ++ // original Squert native pivot: ++ //txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); ++ //txBit = "" + sid + "." + cid + "
"; ++ //if (src_port != "-" && dst_port != "-") { ++ // txBit = "" + sid + "." + cid + ""; ++ //} ++ // new pivot to CapMe: ++ txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); ++ txBit = "" + sid + "." + cid + ""; ++ if (src_port != "-" && dst_port != "-") { ++ var startDate = new Date(utctimestamp); ++ var start_tz_offset = (startDate.getTimezoneOffset()); ++ var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; ++ var endDate = new Date(utctimestamp); ++ var end_tz_offset = (endDate.getTimezoneOffset()); ++ var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; ++ txBit = " " + sid + "." + cid + ""; ++ } ++ ++ row += ""; ++ row += "
"; ++ row += cv + "
"; ++ row += "" + timestamp + ""; ++ row += txBit; ++ row += "" + src_ip + ""; ++ row += "" + src_port + ""; ++ row += "" + dst_ip + ""; ++ row += "" + dst_port + ""; ++ row += "" + signature + ""; ++ row += ""; ++ } ++ ++ // Update parent counts ++ $(".d_row_sub_active").find(".b_ec_hot").text(rtCount); ++ if ($(".d_row_sub_active").find(".b_ec_total").text() < tlCount) { ++ $(".d_row_sub_active").find(".b_ec_total").text(tlCount); ++ } ++ ++ var cols = $('th.sort').length; ++ ++ // Populate tags ++ clearTags(); ++ for (var i=0; i < tags.length; i++) { ++ addTag(tags[i]); ++ } ++ ++ tbl += ""; ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ $("#" + rowLoke).after(tbl); ++ $(".d_row_sub").fadeTo('0','0.2'); ++ $("#loader").hide(); ++ $("#tl3").tablesorter({ ++ headers: { ++ 0:{sorter:false}, ++ 4:{sorter:'ipv4'}, ++ 6:{sorter:'ipv4'} ++ }, ++ cancelSelection:false ++ }); ++ $("#ca0").hide(); ++ } ++ break; ++ ++ // Level 2a view - No grouping, individual events ++ ++ case "2a": ++ $('.value').text('-'); ++ var urArgs = "type=2a&ts=" + theWhen + "&filter=" + theFilter + "&sensors=" + theSensors + "&rt=" + rt + "&sv=" + sortval; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb3a(data)}); ++ }); ++ ++ function cb3a(data){ ++ eval("d2a=" + data); ++ var tbl = ''; ++ var head = ''; ++ var row = ''; ++ var disabled = ''; ++ if (d2a.length == 0) { ++ disabled = "disabled"; ++ row += ""; ++ row += "No result. If this is unexpected try this"; ++ } ++ ++ head += ""; ++ head += ""; ++ head += ""; ++ head += "ST"; ++ head += ""; ++ head += "TIMESTAMP"; ++ head += "ID"; ++ head += "SOURCE"; ++ head += "PORT"; ++ head += "AGE"; ++ head += "CC"; ++ head += "DESTINATION"; ++ head += "PORT"; ++ head += "AGE"; ++ head += "CC"; ++ head += "SIGNATURE"; ++ head += ""; ++ ++ // Aggregate time values ++ var timeValues = ""; ++ for (var ts=0; ts" + sid + "." + cid + ""; ++ //if (src_port != "-" && dst_port != "-") { ++ // txBit = "" + sid + "." + cid + ""; ++ //} ++ // new pivot to CapMe: ++ txdata = "s" + i + "-" + cid + "-" + s2h(sid + "|" + utctimestamp + "|" + src_ip + "|" + src_port + "|" + dst_ip + "|" + dst_port); ++ txBit = "" + sid + "." + cid + ""; ++ if (src_port != "-" && dst_port != "-") { ++ var startDate = new Date(utctimestamp); ++ var start_tz_offset = (startDate.getTimezoneOffset()); ++ var stime = startDate.setTime( startDate.getTime()/1000-(start_tz_offset*60) ) - 3600; ++ var endDate = new Date(utctimestamp); ++ var end_tz_offset = (endDate.getTimezoneOffset()); ++ var etime = endDate.setTime( endDate.getTime()/1000-(end_tz_offset*60) ) + 3600; ++ txBit = " " + sid + "." + cid + ""; ++ } ++ ++ row += ""; ++ row += ""; ++ row += "
"; ++ row += cv + "
"; ++ row += "
" + d2a[i].f16 + "
"; ++ row += "" + timestamp + ""; ++ row += txBit; ++ row += "
" + src_ip + ""; ++ row += "" + src_port + ""; ++ row += "" + src_age_n + ""; ++ row += "" + cs[1] + ""; ++ row += "
" + dst_ip + ""; ++ row += "" + dst_port + ""; ++ row += "" + dst_age_n + "" ++ row += "" + cd[1] + ""; ++ row += "" + signature + ""; ++ } ++ ++ var sumED = 0, sumEC = 0, cmsg = ""; ++ ++ if (d2a.length > 0) { ++ sumED = i; ++ sumEC = d2a.length; ++ } ++ ++ if (d2a.length >= maxI) { ++ sumRE = sumEC - maxI; ++ cmsg = " / " + sumRE + " not shown"; ++ } ++ ++ $("#qtotal").html(rsumRT); ++ ++ // Populate tags ++ clearTags(); ++ for (var i=0; i < tags.length; i++) { ++ addTag(tags[i]); ++ } ++ ++ // Draw ++ tbl += ""; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "categorize " + 0 + ""; ++ tbl += " of " + sumED + " event(s)" + cmsg; ++ tbl += "
"; ++ tbl += "
" + sorttxt + "
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ $('#' + parts[1] + '-' + parts[2]).after(tbl); ++ ++ if (d2a.length > 0) { ++ var prVals = [spr1,spr2,spr3,spr4]; ++ var pryBar = mkPribar(prVals); ++ } else { ++ var pryBar = mkPribar([0]); ++ } ++ $("#tl3a,#tl3b").fadeIn('slow'); ++ $("#tl3b").tablesorter({ ++ headers: { ++ 0:{sorter:false}, ++ 1:{sorter:false}, ++ 5:{sorter:'ipv4'}, ++ 8:{sorter:'ipv4'} ++ }, ++ cancelSelection:false ++ }); ++ $("#loader").hide(); ++ } ++ break; ++ ++ // Level 3 view - Packet Data ++ ++ case "3": ++ var rowLoke = parts[1]; ++ var nCols = $('#' + parts[1]).data('cols'); ++ var filter = $('#' + parts[1]).data('filter'); ++ var urArgs = "type=" + parts[0] + "&object=" + filter + "&ts=" + theWhen; ++ var sg = $('#' + parts[1]).data('sg'); ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb4(data)}); ++ }); ++ ++ function cb4(data){ ++ eval("theData=" + data); ++ ++ var tbl = '', head = '', row = ''; ++ ++ // If IP version is 0 we can jump right to the payload (likely bro, http or ossec agent) ++ if (theData[0].ip_ver != 0) { ++ ++ var PDATA = 0; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ head += ""; ++ ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += "
IPVERIHLTOSLENGTHIDFLAGSOFFSETTTLCHECKSUMPROTO
" + theData[0].ip_ver + "" + theData[0].ip_hlen + "" + theData[0].ip_tos + "" + theData[0].ip_len + "" + theData[0].ip_id + "" + theData[0].ip_flags + "" + theData[0].ip_off + "" + theData[0].ip_ttl + "" + theData[0].ip_csum + "" + theData[0].ip_proto + "
"; ++ ++ switch (theData[0].ip_proto) { ++ case "1": ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += "
ICMPTYPECODECHECKSUMIDSEQ#
" + theData[1].icmp_type + "" + theData[1].icmp_code + "" + theData[1].icmp_csum + "" + theData[1].icmp_id + "" + theData[1].icmp_seq + "
"; ++ break; ++ ++ case "6": ++ // TCP flags ++ var tmpFlags = theData[1].tcp_flags || 'z'; ++ switch (tmpFlags) { ++ case 'z': var tcpFlags = '--------'; break; ++ default: ++ var binFlags = Number(theData[1].tcp_flags).toString(2); ++ var binPad = 8 - binFlags.length; ++ var tcpFlags = "00000000".substring(0,binPad) + binFlags; ++ break; ++ } ++ var tcp_seq = theData[1].tcp_seq || '-'; ++ var tcp_ack = theData[1].tcp_ack || '-'; ++ var tcp_off = theData[1].tcp_off || '-'; ++ var tcp_res = theData[1].tcp_res || '-'; ++ var tcp_win = theData[1].tcp_win || '-'; ++ var tcp_urp = theData[1].tcp_urp || '-'; ++ var tcp_csum = theData[1].tcp_csum || '-'; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += "
TCPR1R0URGACKPSHRSTSYNFINSEQ#ACK#OFFSETRESWINURPCHECKSUM
" + tcpFlags[0] + "" + tcpFlags[1] + "" + tcpFlags[2] + "" + tcpFlags[3] + "" + tcpFlags[4] + "" + tcpFlags[5] + "" + tcpFlags[6] + "" + tcpFlags[7] + "" + tcp_seq + "" + tcp_ack + "" + tcp_off + "" + tcp_res + "" + tcp_win + "" + tcp_urp + "" + tcp_csum + "
"; ++ break; ++ ++ case "17": ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += "
UDPLENGTHCHECKSUM
" + theData[1].udp_len + "" + theData[1].udp_csum + "
"; ++ break; ++ } ++ ++ var p_hex = '', p_ascii = '', p_ascii_l = ''; ++ ++ // Data ++ if (!theData[2]) { ++ p_hex = "No Data Sent."; ++ p_ascii = "No Data Sent."; ++ } else { ++ p_pl = theData[2].data_payload; ++ p_length = theData[2].data_payload.length; ++ var b0 = 0; ++ ++ for(var i=0; i < p_length; i+=2) { ++ b0++; ++ t_hex = p_pl.substr(i,2); ++ t_int = parseInt(t_hex,16); ++ ++ if ((t_int < 32) || (t_int > 126)) { ++ p_hex += t_hex + " "; ++ p_ascii += "."; ++ p_ascii_l += "."; ++ } else if (t_int == 60) { ++ p_hex += t_hex + " "; ++ p_ascii += "<"; ++ p_ascii_l += "<"; ++ } else if (t_int == 62) { ++ p_hex += t_hex + " "; ++ p_ascii += ">"; ++ p_ascii_l += ">"; ++ } else { ++ p_hex += t_hex + " "; ++ p_ascii += String.fromCharCode(parseInt(t_hex, 16)); ++ p_ascii_l += String.fromCharCode(parseInt(t_hex, 16)); ++ } ++ ++ if ((b0 == 16) && (i < p_length)) { ++ p_hex += "
"; ++ p_ascii += "
"; ++ b0 = 0; ++ } ++ } ++ } ++ ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += ""; ++ row += "
DATAHEXASCII
" + p_hex + "" + p_ascii + "
ASCII" + p_ascii_l + "
"; ++ ++ } else { ++ ++ head += ""; ++ var p_ascii = "No Data Sent."; ++ // This needs to be more robust. ++ if (theData[2]) { ++ var tmp = h2s(theData[2].data_payload).split("\n"); ++ p_ascii = ''; ++ for (var i in tmp) { ++ p_ascii += "
" + tmp[i] + "
"; ++ } ++ ++ } ++ row += ""; ++ row += ""; ++ row += "
" + p_ascii + "
"; ++ } ++ ++ tbl += ""; ++ ++ // If we are not grouped we show the signature text ++ if ( sg != 0 ) { ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
↓
"; ++ tbl += "
"; ++ tbl += "
"; ++ tbl += "
"; ++ sigLookup(sg); ++ } ++ ++ // Comments and tags are done here ++ var tags = new Array(); ++ var eventTag = 'None.'; ++ var eventComment = theData[0].comment || 'None.'; ++ var src_tag = theData[0].srctag || '-'; ++ var dst_tag = theData[0].dsttag || '-'; ++ ++ // Populate tags array ++ if (src_tag != "-") { ++ var src_tags = src_tag.split(","); ++ $.each(src_tags, function(n,tag) { ++ var t = tags.indexOf(tag + ",s"); ++ if (t < 0) tags.push(tag + ",s"); ++ }); ++ } ++ ++ if (dst_tag != "-") { ++ var dst_tags = dst_tag.split(","); ++ $.each(dst_tags, function(n,tag) { ++ var t = tags.indexOf(tag + ",d"); ++ if (t < 0) tags.push(tag + ",d"); ++ }); ++ } ++ ++ if (tags.length > 0) eventTag = ''; ++ ++ tbl += "
COMMENTS
"; ++ tbl += "
" + eventComment + "
"; ++ tbl += "
TAGS
"; ++ tbl += "
" + eventTag + "
"; ++ if (PDATA != 0) { ++ tbl += "
DETAILS
"; ++ } else { ++ tbl += "
PAYLOAD
"; ++ } ++ tbl += head; ++ tbl += row; ++ tbl += ""; ++ $("#" + rowLoke).after(tbl); ++ $("#loader").hide(); ++ ++ // Turn off fade effect for large results ++ var rC = $(".d_row_sub1").length; ++ if ( rC <= 499 ) { ++ $(".d_row_sub1").fadeTo('fast','0.2'); ++ } ++ ++ // Populate tags ++ clearTags(); ++ for (var i=0; i < tags.length; i++) { ++ addTag(tags[i]); ++ } ++ ++ } ++ break; ++ } ++ // If event queue is off we need to reset this after load if b_ec_hot was ++ // the entry point ++ if ($('#rt').text() == 'off') rtbit = 0; ++ } ++ ++ // ++ // Object click handlers ++ // ++ ++ $(document).on("click", ".select,.ex_val,.sub_filter,.row_filter,.tof,.value_link,.nr_f", function(e) { ++ // Check if we are coming from a legit object ++ var prefix = $(this).data('type'); ++ if (prefix == "none") return; ++ ++ // Check if we are coming from a sane selection ++ var selLen = window.getSelection().toString().length; ++ if (selLen > 4) { ++ if (selLen < 255) { // Might need to change these based on how people use this ++ prefix = "zz"; ++ var suffix = window.getSelection().toString(); ++ var re = /\s/g; ++ var NOK = re.exec(suffix); ++ if (NOK) return; ++ } else { ++ return; ++ } ++ } else { ++ var suffix = $(this).text(); ++ } ++ ++ var mX = e.pageX; ++ var mY = e.pageY; ++ ++ var colour = $(this).data('col') || "FFFFFF"; ++ var tfocus = "#search"; ++ switch (prefix) { ++ case 'ip': ++ hItemAdd(suffix); ++ var sord = $(this).data('sord'); ++ mkPickBox(prefix,suffix,sord,colour,mX,mY); ++ break; ++ case 'spt': ++ case 'dpt': ++ hItemAdd(suffix); ++ mkPickBox(prefix,suffix,0,colour,mX,mY); ++ break; ++ case 'cc': ++ case 'scc': ++ case 'dcc': ++ var cc = $(this).data('value'); ++ hItemAdd(cc); ++ mkPickBox(prefix,cc,suffix,colour,mX,mY); ++ break; ++ case 'cmt': ++ suffix = $(this).data('comment'); ++ $("#rt").text("off"); ++ $("#rt").attr('class','tvalue_off'); ++ $('#search').val(prefix + " " + suffix); ++ hItemAdd(suffix); ++ if ($('#cat_box').css('display') != 'none') { ++ $('#ico01').click(); ++ } ++ $('.b_update').click(); ++ break; ++ case 'cmt_c': ++ $('.cat_msg_txt').val(suffix); ++ hItemAdd(suffix); ++ tfocus = ".cat_msg_txt"; ++ break; ++ case 'fil': ++ var fil = $(this).data('value'); ++ $('#search').val(fil); ++ hItemAdd(fil); ++ if ($('#fltr_box').css('display') != 'none') { ++ $('#ico04').click(); ++ } ++ $('.b_update').click(); ++ break; ++ case 'sid': ++ var value = $(this).data('value'); ++ hItemAdd(suffix); ++ mkPickBox(prefix,value,suffix,colour,mX,mY); ++ break; ++ case 'st': ++ var suffix = $(this).attr('id').split('-')[1]; ++ $('#search').val(prefix + " " + suffix); ++ // RT must be off to return anything ++ $('#rt').attr('class','tvalue_off'); ++ $('#rt').text('off'); ++ rtbit = 0; ++ $('.b_update').click(); ++ break; ++ case 'el': ++ var suffix = $(this).data('value'); ++ mkPickBox(prefix,suffix,0,colour,mX,mY); ++ break; ++ case 'zz': ++ hItemAdd(suffix); ++ mkPickBox(prefix,suffix,0,colour,mX,mY); ++ break; ++ } ++ }); ++ ++ // ++ // Picker Box ++ // ++ ++ function mkPickBox(prefix,suffix,rsuffix,colour,mX,mY) { ++ var doexternals = "yes"; ++ var objhex = s2h(suffix); ++ var tbl = '', row = ''; ++ // Local stuff first ++ switch (prefix[prefix.length - 1]) { ++ case "c": ++ row += ":: SRC or DST"; ++ row += ":: SRC"; ++ row += ":: DST"; ++ row += ":: SEARCH"; ++ break; ++ case "p": ++ row += ":: SRC or DST"; ++ row += ":: SRC"; ++ row += ":: DST"; ++ row += ":: ADD / REMOVE TAG"; ++ if ($('.sigtxt')[0]) { ++ row += ":: HISTORY"; ++ } ++ row += ":: SEARCH"; ++ row += ":: COLOUR  "; ++ row += ""; ++ row += "apply"; ++ row += "apply all"; ++ row += ""; ++ break; ++ case "t": ++ row += ":: SRC"; ++ row += ":: DST"; ++ row += ":: SEARCH"; ++ break; ++ case "d": ++ row += ":: SIGNATURE"; ++ if ($('.sigtxt')[0]) { ++ row += ":: HISTORY"; ++ } ++ row += ":: SEARCH"; ++ break; ++ case "l": ++ row += ":: COLOUR  "; ++ row += ""; ++ row += "update"; ++ doexternals = "no"; ++ break; ++ case "z": ++ row += ":: SEARCH"; ++ break; ++ } ++ ++ // If applicable populate externals ++ if (doexternals == "yes") { ++ $('.f_row').each(function() { ++ var ct = $(this).data('type'); ++ if (ct == 'url') { ++ var alias = $(this).data('alias'); ++ var name = $(this).data('name'); ++ var url = $(this).data('filter'); ++ row += ""; ++ row += "" + name + ""; ++ row += ""; ++ } ++ }); ++ } ++ ++ tbl += ""; ++ tbl += row; ++ tbl += "
"; ++ ++ var boxlabel = suffix; ++ ++ // Use more descriptive names where possible ++ var re = /(sid|cc|scc|dcc)/; ++ var OK = re.exec(prefix); ++ if (OK) { ++ var boxlabel = rsuffix; ++ } ++ ++ if (boxlabel.length > 24) { ++ boxlabel = boxlabel.substring(0,24); ++ boxlabel += ".."; ++ } ++ ++ $('#pickbox_label').text(boxlabel).css('font-weight','normal').data('sord', rsuffix); ++ ++ if ($('#tlpick')[0]) $('#tlpick').remove(); ++ $(".pickbox_tbl").append(tbl); ++ $('.pickbox').fadeIn('fast'); ++ ++ // Colour Picker ++ $("#menucol").spectrum({ ++ showInput: true, ++ className: "full-spectrum", ++ showInitial: true, ++ showPalette: true, ++ showSelectionPalette: true, ++ maxPaletteSize: 6, ++ preferredFormat: "hex", ++ localStorageKey: "spectrum.demo", ++ move: function (color) {}, ++ show: function () {}, ++ beforeShow: function () {}, ++ hide: function () {}, ++ change: function() {}, ++ palette: [ ++ ['rgb(217,217,217)','rgb(189,189,189)','rgb(150,150,150)','rgb(99,99,99)','rgb(37,37,37)'], ++ ['rgb(199,233,192)','rgb(161,217,155)','rgb(116,196,118)','rgb(49,163,84)','rgb(0,109,44)'], ++ ['rgb(218,218,235)','rgb(188,189,220)','rgb(158,154,200)','rgb(117,107,177)','rgb(84,39,143)'], ++ ['rgb(198,219,239)','rgb(158,202,225)','rgb(107,174,214)','rgb(49,130,189)','rgb(8,81,156)'], ++ ['rgb(254,217,118)','rgb(254,178,76)','rgb(253,141,60)','rgb(240,59,32)','rgb(189,0,38)'] ++ ] ++ }); ++ } ++ ++ // Pickbox click events ++ $(document).on('click', '.p_row', function() { ++ if ($('.tagbox').css('display') != 'none') $('.tagcancel').click(); ++ var ctype = $(this).data('type'); ++ var alias = $(this).data('alias'); ++ var args = $('#tlpick').data('val'); ++ switch(ctype) { ++ case "l": ++ $('.pickbox').fadeOut('fast'); ++ $('#search').val(alias + " " + args); ++ $('.b_update').click(); ++ break; ++ case "r": ++ $('.pickbox').fadeOut('fast'); ++ var url = h2s($(this).data('url')).replace("${var}", args); ++ window.open(url); ++ break; ++ case "t": ++ $('.tagbox').fadeIn('fast'); ++ $('.taginput').focus(); ++ break; ++ case "s": ++ $('.pickbox').fadeOut('fast', function() {; ++ $('#ico05').click(); ++ }); ++ $('.srch_txt').val(args); ++ break; ++ case "h": ++ doHistory(args); ++ $('.pickbox').fadeOut('fast'); ++ break; ++ default: return; ++ } ++ }); ++ ++ // ++ // Tags ++ // ++ ++ // Truncate ++ function truncTag(tag,len) { ++ if (tag.length > len) tag = tag.substring(0,len) + ".."; ++ return tag; ++ } ++ ++ // Filter results or add as new ++ $(document).on('click', '.tag', function() { ++ var tag = $(this).data('val'); ++ if($('.taginput').is(":visible")) { ++ $('.taginput').val(tag); ++ $('.taginput').focus(); ++ } else { ++ $('#search').val('tag ' + tag); ++ $('.b_update').click(); ++ } ++ }); ++ ++ // Remove individual tags on "(X)" click via payload area ++ $(document).on('mouseenter', '.tag_d, .tag_s', function() { ++ var tag = $(this).data('val'); ++ if ($(".tag_x")[0]) return; ++ var dw = $(this).width() - 5 + "px"; ++ $(this).append("
X
"); ++ $(".tag_x").css("margin-left", dw); ++ $(".tag_x").fadeIn("slow"); ++ ++ }); ++ ++ $(document).on('mouseleave', '.tag_d, .tag_s', function() { ++ $('.tag_x').remove(); ++ }); ++ ++ $(document).on('click', '.tag_x', function() { ++ var tag = $(this).parent().data("val"); ++ var obj = $(this).parent().data("obj"); ++ $(this).parent().remove(); ++ var len = $("#tag_area").text().length; ++ if (len == 0) $("#tag_area").append("None."); ++ //doTag(s2h(obj),tag,'rm'); ++ }); ++ ++ // Fire tag add on enter ++ $('.taginput').keypress(function(e) { ++ if (!e) e=window.event; ++ key = e.keyCode ? e.keyCode : e.which; ++ if (key == 13) $('.tagok').click(); ++ }); ++ ++ // Close tag entry ++ $(document).on('click', '.tagcancel', function() { ++ $('.taginput').val(''); ++ $('.tagbox').fadeOut('fast'); ++ }); ++ ++ // Add a tag ++ $(document).on('click', '.tagok', function() { ++ var tag = $('.taginput').val(); ++ var obj = $('#pickbox_label').text(); ++ var re = /^[?a-zA-Z0-9][\s{1}\w-\.]*$/; ++ var OK = re.exec(tag); ++ if (OK) doTag(s2h(obj),tag,'add'); ++ }); ++ ++ // Remove a tag ++ $(document).on('click', '.tagrm', function() { ++ var tag = truncTag($('.taginput').val(),20); ++ var obj = $('#pickbox_label').text(); ++ doTag(s2h(obj),tag,'rm'); ++ $(".tag" + ":contains('" + tag + "')").remove(); ++ $('.tagcancel').click(); ++ }); ++ ++ // Display or Toggle tags ++ function addTag(tag) { ++ // If we entered from payload we have some additional info ++ if ($('#eview_sub2')[0]) { ++ var longTag = tag.split(",")[0]; ++ var theClass = tag.split(",")[1]; ++ var t_tag = truncTag(longTag,20); ++ } else { ++ var t_tag = truncTag(tag,20); ++ } ++ ++ // Hide empty ++ $('.tag_empty').hide(); ++ ++ // Check if tag exists ++ var tag_exists = 0; ++ $('.tag').each(function() { ++ if ($(this).text() == t_tag) { ++ $(this).addClass('tag_active'); ++ tag_exists = 1; ++ } ++ }); ++ ++ // Add tag to left pane ++ if (tag_exists == 0) { ++ var newTag = "
" + t_tag + "
"; ++ $('#tg_box').prepend(newTag); ++ } ++ ++ // If we have the payload open, add here as well ++ if ($('#eview_sub2')[0]) { ++ if($('#pickbox_label').is(":visible")) { ++ theClass = $('#pickbox_label').data('sord')[0]; ++ } ++ // Remove placeholder ++ if ($('#tag_none')[0]) $('#tag_none').remove(); ++ var newTag = "
" + t_tag + "
"; ++ $('#tag_area').prepend(newTag); ++ } ++ ++ } ++ ++ function doTag(obj,tag,op) { ++ var urArgs = "type=19&obtype=tag&object=" + obj + "&value=" + tag + "&op=" + op; ++ $(function(){ ++ $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); ++ }); ++ ++ function cb22(data){ ++ eval("theData=" + data); ++ if (theData.msg != '') { ++ alert(theData.msg); ++ } else { ++ if (op != 'rm') addTag(tag); ++ $('.tagcancel').click(); ++ } ++ } ++ } ++ ++ // Colours ++ $(document).on('click', '.csave', function() { ++ var obtype = $(this).data('obtype'); ++ var object = $(this).data('object'); ++ var colour = $('#menucol').val().replace(/#/,"").toUpperCase(); ++ var op = "add"; ++ var re = /^([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/; ++ var OK = re.exec(colour); ++ if (!OK) return; ++ // Single or multiple? ++ if (obtype == "src" || obtype == "dst") { ++ var vr = new Array(); ++ $("." + obtype).each(function() { ++ var v = $(this).text(); ++ var re = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/; ++ var OK = re.exec(v); ++ if (OK) { ++ var t = vr.indexOf(v); ++ if (t < 0) vr.push(v); ++ } ++ }); ++ object = vr.toString(); ++ } ++ ++ var urArgs = "type=19&obtype=" + obtype + "_c&object=" + object + "&value=" + colour + "&op=" + op; ++ $(function(){ ++ $.post(".inc/callback.php?" + urArgs, function(data){cb22(data)}); ++ }); ++ ++ function cb22(data){ ++ eval("theData=" + data); ++ if (theData.msg != '') { ++ alert(theData.msg); ++ } else { // We should be good.. ++ var curObject = $('#pickbox_label').text(); ++ if (obtype == "el") { ++ var html = "
" + colour; ++ $('#el_' + curObject).html(html); ++ $('#el_' + curObject).data('col', colour); ++ } else { ++ $(".sub_filter:contains(" + curObject + ")").each(function() { ++ $(this).find('.object').css('background-color', '#' + colour).parent().data('col', colour); ++ }); ++ } ++ $('.pickbox').fadeOut('fast'); ++ } ++ } ++ }); ++ ++ $(document).on('click', '.pickbox_close', function() { ++ $('.tagcancel').click(); ++ $('.pickbox').fadeOut('fast'); ++ }); ++ ++ // ++ // Object History ++ // ++ ++ function hItemAdd(item) { ++ var itemTitle = item; ++ // Truncate ++ if (item.length > 33) { ++ itemTitle = item.substring(0,33) + ".."; ++ } ++ // Remove empty message ++ $('.history_empty').hide(); ++ ++ // If the item doesn't exist, add it. Otherwise, we start counting. ++ if ($(".h_item:contains('" + itemTitle + "')").length > 0) { ++ var oc = $(".h_item:contains('" + itemTitle + "')").data('n'); ++ var nc = Number(oc) + 1; ++ var bg = '#c9c9c9'; ++ var fn = 'normal'; ++ if (nc <= 3) { ++ bg = '#000'; ++ } else if (nc > 3) { ++ bg = '#cc0000'; ++ fn = 'bold'; ++ } ++ ++ $(".h_item:contains('" + itemTitle + "')").css('color', bg); ++ $(".h_item:contains('" + itemTitle + "')").css('font-weight', fn); ++ $(".h_item:contains('" + itemTitle + "')").data('n',nc); ++ $(".h_item:contains('" + itemTitle + "')").text(itemTitle + "(" + nc + ")"); ++ } else { ++ var toAdd = " " + itemTitle + ""; ++ $('#h_box').prepend(toAdd); ++ } ++ } ++ ++ if (!$('.h_item')[0]) { ++ $('.history_empty').show(); ++ } ++ ++ // Alt mappings for icons ++ ++ $.alt('1', function() { ++ $("#ico01").click(); ++ }); ++ $.alt('2', function() { ++ $("#ico02").click(); ++ }); ++ $.alt('3', function() { ++ $("#ico03").click(); ++ }); ++ $.alt('4', function() { ++ $("#ico05").click(); ++ }); ++ $.alt('5', function() { ++ $("#ico04").click(); ++ }); ++ ++ // ++ // Event classification ++ // ++ ++ // Use function keys to trigger status buttons ++ $(document).keydown(function(event){ ++ ++ function stopOthers() { ++ event.originalEvent.keyCode = 0; ++ event.preventDefault(); ++ event.stopPropagation(); ++ } ++ ++ switch (event.keyCode) { ++ case 112: stopOthers(); $('#b_class-11').click(); break; ++ case 113: stopOthers(); $('#b_class-12').click(); break; ++ case 114: stopOthers(); $('#b_class-13').click(); break; ++ case 115: stopOthers(); $('#b_class-14').click(); break; ++ case 116: stopOthers(); $('#b_class-15').click(); break; ++ case 117: stopOthers(); $('#b_class-16').click(); break; ++ case 118: stopOthers(); $('#b_class-17').click(); break; ++ case 119: stopOthers(); $('#b_class-1').click(); break; ++ case 120: stopOthers(); $('#b_class-2').click(); break; ++ } ++ }); ++ ++ // Comment window status buttons ++ $(document).on("click", "#cw_buttons", function(event) { ++ var newclass = $(event.target).data('n'); ++ if (newclass == 0) { ++ $('#b_class-' + newclass).click(); ++ } else { ++ $('#b_class-' + newclass).click(); ++ } ++ }); ++ ++ // Highlight colour for selected events ++ var hlcol = "#FFFFE0"; ++ var hlhov = "#FDFDD6"; ++ ++ // Individual selects ++ var clickOne = 0, clck1 = 0, clck2 = 0; ++ $(document).on("click", ".chk_event", function(event) { ++ $("#tl3b").trigger('update'); ++ var clickTwo = this.id.split("_"); ++ if (Number(clickOne[1]) > Number(clickTwo[1])) { ++ clck1 = clickTwo[1]; ++ clck2 = clickOne[1]; ++ } else { ++ clck1 = clickOne[1]; ++ clck2 = clickTwo[1]; ++ } ++ ++ if (event.shiftKey) { ++ if (clck1 != clck2) { ++ $("#s" + clck1).nextUntil("#s" + clck2).find(".chk_event").prop("checked", true); ++ $("#s" + clck1).nextUntil("#s" + clck2).css("background-color", hlcol); ++ $("#s" + clck1).nextUntil("#s" + clck2).hover( ++ function(){$(this).css("background-color", hlhov)}, ++ function(){$(this).css("background-color", hlcol)}); ++ clickOne = 0, clck1 = 0, clck2 = 0; ++ } ++ } ++ ++ // Update class_count ++ $("#class_count").html($(".chk_event:checked").length); ++ if ($("#ca1:checked").length > 0) { ++ $("#ca1").prop("checked",false); ++ } ++ clickOne = this.id.split("_"); ++ ++ if ($(this).prop("checked") == true) { ++ $("#s" + clickTwo[1]).css("background-color", hlcol); ++ $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", hlhov)}, ++ function(){$(this).css("background-color", hlcol)}); ++ } else { ++ $("#s" + clickTwo[1]).css("background-color", "transparent"); ++ $("#s" + clickTwo[1]).hover(function(){$(this).css("background-color", "#f4f4f4")}, ++ function(){$(this).css("background-color", "transparent")}); ++ } ++ }); ++ ++ // Select all (2) ++ $(document).on("click", "#ca1", function(event) { ++ var chkLen = $("#ca1:checked").length; ++ switch(chkLen) { ++ case 0: ++ $(".chk_event").prop("checked",false); ++ $("#ca0").prop("checked",false); ++ $(".d_row_sub1").css("background-color", "transparent"); ++ $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, ++ function(){$(this).css("background-color", "transparent")}); ++ break; ++ default: ++ $(".chk_event").each(function() { ++ if ($(this).prop("disabled") == false) { ++ $(this).prop("checked",true); ++ } ++ }); ++ $(".d_row_sub1").css("background-color", hlcol); ++ $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, ++ function(){$(this).css("background-color", hlcol)}); ++ $("#ca0").prop("checked",true); ++ break; ++ } ++ ++ if ($(".eview_sub1")[0]) { ++ // Update class_count ++ $("#class_count").html($(".chk_event:checked").length); ++ } ++ ++ }); ++ ++ // Select all (2a) - clean this up, the above is almost identical ++ $(document).on("click", "#ca2", function(event) { ++ var chkLen = $("#ca2:checked").length; ++ switch(chkLen) { ++ case 0: ++ $(".chk_event").prop("checked",false); ++ $("#ca2").prop("checked",false); ++ $(".d_row_sub1").css("background-color", "transparent"); ++ $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, ++ function(){$(this).css("background-color", "transparent")}); ++ break; ++ default: ++ $(".chk_event").each(function() { ++ if ($(this).prop("disabled") == false) { ++ $(this).prop("checked",true); ++ } ++ }); ++ $(".d_row_sub1").css("background-color", hlcol); ++ $(".d_row_sub1").hover(function(){$(this).css("background-color", hlhov)}, ++ function(){$(this).css("background-color", hlcol)}); ++ $("#ca2").prop("checked",true); ++ break; ++ } ++ // Update class_count ++ $("#class_count").html($(".chk_event:checked").length); ++ }); ++ ++ // Class button click ++ $(document).on("click", "[id*=\"b_class-\"]", function() { ++ // We only fire if something is selected ++ var chkLen = parseInt($(".chk_event:checked").length + $(".chk_all:checked").length); ++ var intclass = $(this).attr('id').split("-"); ++ if (chkLen > 0 && intclass[1] != 0) { ++ eClass(this,intclass[1]); ++ } ++ }); ++ ++ function eClass(caller,intclass) { ++ // The sid.cid values ++ var scid= "", scidlist = "", ecls = 0; ++ if ($(".eview_sub1")[0] || $("#ca2")[0]) { ++ $(".chk_event:checked").each(function() { ++ if ($(this).data('eclass') == 0) { ++ ecls++; ++ } ++ scid += $(this).val() + ","; ++ }); ++ scidlist = scid.replace(/,$/, ""); ++ } else { ++ ecls = $(".d_row_active").find(".b_ec_hot").text(); ++ scidlist = $("#ca0").data("scid"); ++ } ++ ++ // Was there a message? ++ var msg = "none"; ++ if ($(".cat_msg_txt").val().length != 0) { ++ msg = $(".cat_msg_txt").val(); ++ } ++ ++ if ($('#cat_box').css('display') != 'none') { ++ $('#ico01').click(); ++ } ++ ++ // We are now ready to class ++ var catdata = intclass + "|||" + msg + "|||" + scidlist; ++ var urArgs = "type=" + 9; ++ $(function(){ ++ $.post(".inc/callback.php?" + urArgs, { catdata: catdata } ,function(data){cb9(data)}); ++ }); ++ ++ function cb9(data){ ++ eval("catRaw=" + data); ++ catDbg = catRaw.dbg; ++ if (catDbg == "0") { ++ ++ var curtotalrtcount = Number(ecls); ++ // Working on grouped events ++ if ($("#gr").text() == "on") { ++ curclasscount = Number($("#class_count").text()); ++ var curtotalparentcount = $(".d_row_active").find(".b_ec_hot").text(); ++ // Do we have queued events? ++ if (curtotalparentcount > 0) { ++ ++ // Are we working on queued events? ++ if (curtotalrtcount > 0) { ++ curclasscount = curtotalrtcount; ++ } else { ++ curclasscount = 0; ++ } ++ // Adjust the parent count ++ newparentcount = parseInt(curtotalparentcount - curclasscount,10); ++ $(".d_row_active").find(".b_ec_hot").text(newparentcount); ++ ++ if (newparentcount == 0) { ++ $(".d_row_active").find(".b_ec_hot").parent().attr('class','row'); ++ $(".d_row_active").find(".b_ec_hot").attr('class','b_ec_cold'); ++ } ++ ++ // If we are working within the child, adjust accordingly ++ if ($(".eview_sub1")[0]) { ++ // How many are in the child ++ curtotalchildcount = $(".d_row_sub_active").find(".b_ec_hot").text(); ++ ++ // Adjust the child count ++ newchildcount = parseInt(curtotalchildcount - curclasscount,10); ++ $(".d_row_sub_active").find(".b_ec_hot").text(newchildcount); ++ if (newchildcount == 0) { ++ $("#ca1").prop("disabled",true); ++ $(".d_row_sub_active").find(".b_ec_hot").parent().attr('class','sub'); ++ $(".d_row_sub_active").find(".b_ec_hot").attr('class','b_ec_cold'); ++ } ++ // Otherwise we were called from the parent ++ } else { ++ $(".d_row_sub").find(".b_ec_hot").parent().attr('class','sub'); ++ $(".d_row_sub").find(".b_ec_hot").text(0); ++ $(".d_row_sub").find(".b_ec_hot").attr('class','b_ec_cold'); ++ $("#ca0").prop("disabled",true); ++ } ++ lastclasscount = newparentcount; ++ } ++ ++ // Lastly, update class_count ++ if (rtbit == 1 || curtotalrtcount > 0 || $("#eview_sub")[0]) { ++ $("#class_count").html(0); ++ } else { ++ $("#class_count").html($(".d_row_active").find(".b_ec_total").text()); ++ } ++ ++ // Working on ungrouped events ++ } else { ++ $("#class_count").html(lastclasscount); ++ } ++ ++ // What the new classification is ++ selClass = $(caller).data("cn"); ++ newClass = "a_" + selClass; ++ ++ // Change visible class and disable if RT ++ // If we are RT ungrouped, we just remove ++ if ($('#rt').text() == 'on' && $("#ca2")[0]) { ++ $(".chk_event:checked").each(function() { ++ var pid = $(this).attr("id").split("_"); ++ var nid = parseInt(Number(pid[1]) + 1); ++ // Remove any open payload or TX panes ++ if ($("[id^=eview_]")[0]) { ++ $("[id^=eview_]").remove(); ++ $(".d_row_sub1").css('opacity','1'); ++ } ++ // Remove the row ++ $("#s" + pid[1]).fadeOut('fast', function() { ++ $("#s" + pid[1]).remove(); ++ }); ++ }); ++ ++ // Update table (for sorter) ++ $("#tl3b").trigger('update'); ++ } else { ++ // If we are RT and all events are classed we just remove ++ if ($('#rt').text() == 'on' && $(".d_row_active").find(".b_ec_hot").text() == 0) { ++ $("#active_eview").remove(); ++ $(".d_row_active").fadeOut('slow', function (event) { ++ $(".d_row_active").remove(); ++ var newsigtotal = "-"; ++ var sigtotal = $("#esignature").text(); ++ if (sigtotal > 0) { ++ newsigtotal = parseInt(sigtotal - 1); ++ } ++ $("#esignature").text(newsigtotal); ++ }); ++ $(".d_row").css('opacity','1'); ++ } else { ++ $(".chk_event:checked").each(function() { ++ var n = this.id.split("_"); ++ $("#class_box_" + n[1]).attr('class', newClass); ++ $("#class_box_" + n[1]).text(selClass); ++ if (curtotalparentcount > 0) { ++ $(this).prop("disabled",true); ++ } ++ }); ++ } ++ $(".d_row_sub1").css("background-color", "#fafafa"); ++ $(".d_row_sub1").hover(function(){$(this).css("background-color", "#f4f4f4")}, ++ function(){$(this).css("background-color", "#fafafa")}); ++ } ++ ++ // Uncheck everything ++ $(".chk_event").prop("checked", false); ++ $(".chk_all").prop("checked", false); ++ // Remove these scids from the L1 scidlist ++ if ($("#ca0")[0] && rtbit == 1) { ++ var cur_scidlist = scidlist.split(','); ++ var active_scidlist = $("#ca0").data("scid"); ++ for (var i = 0; i < cur_scidlist.length; i++) { ++ active_scidlist = active_scidlist.replace(cur_scidlist[i],''); ++ } ++ active_scidlist = active_scidlist.replace(/,{2,}/g,','); ++ active_scidlist = active_scidlist.replace(/(^,|,$)/g,''); ++ $("#ca0").data("scid", active_scidlist); ++ } ++ catMsg(scidlist.split(',').length, curtotalrtcount); ++ } else { ++ catMsg(0); ++ } ++ } ++ } ++ ++ function catMsg(count, rtcount) { ++ switch (count) { ++ default: ++ var ess = ''; ++ if ( count > 1 ) ess = 's'; ++ ++ var numrows = Number($('.d_row').length + $('.d_row_sub1').length); ++ var newboxtotal = 0, newcatcount = 0; ++ newboxtotal = parseInt($("#qtotal").text() - rtcount); ++ $("#qtotal").text(newboxtotal); ++ ++ // If we are just rt update Total boxes as we go ++ if ($("#ca2")[0]) { // We are ungrouped ++ newcatcount = parseInt($("#cat_count").text() - count); ++ if (newcatcount == 0) { ++ newView("u"); ++ } else { ++ $("#cat_count").text(newcatcount); ++ } ++ } ++ ++ if (numrows == 0) { ++ newView("u"); ++ } ++ ++ var msg = count + " event" + ess + " categorized"; ++ clearTags(); ++ break; ++ } ++ ++ $("span.class_msg").text(msg); ++ $("span.class_msg").fadeIn('slow', function() { ++ setTimeout(function(){ ++ $(".class_msg").fadeOut('slow'); ++ }, 3000); ++ }); ++ } ++ ++ // Load summary tab ++ function loadSummary() { ++ var limit = 10; ++ if ($('#wm0')[0]) { ++ doMap("redraw"); ++ } else { ++ doMap("draw"); ++ } ++ mkSummary("signature",limit); ++ mkSummary("srcip",limit); ++ mkSummary("dstip",limit); ++ mkSummary("srcpt",limit); ++ mkSummary("dstpt",limit); ++ mkSummary("srccc",limit); ++ mkSummary("dstcc",limit); ++ } ++ ++ // Toggle summary section ++ $(document).on("click", ".hidepane", function(e) { ++ $('#topsignature').toggle(); ++ }); ++ ++ // Summary tab ++ function mkSummary(box,limit) { ++ var theWhen = getTimestamp(); ++ var theSensors = s2h('empty'); ++ var theFilter = mkFilter(); ++ // See if we are filtering by sensor ++ if ($('.chk_sen:checked').length > 0) { ++ var active_sensors = "AND event.sid IN("; ++ var iter = $('.chk_sen:checked').length; ++ $('.chk_sen:checked').each(function() { ++ active_sensors += "'" + $(this).val() + "',"; ++ }); ++ active_sensors = active_sensors.replace(/,+$/,''); ++ active_sensors += ")"; ++ theSensors = s2h(active_sensors); ++ } ++ ++ var ldr = "
"; ++ $('#ov_' + box + '_sl').prepend(ldr); ++ $('#top' + box).fadeTo('fast', 0.2); ++ switch (box) { ++ case "srcip": ++ var cbArgs = "srcip"; ++ var qargs = "ip-src"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); ++ }); ++ break; ++ case "dstip": ++ var cbArgs = "dstip"; ++ var qargs = "ip-dst"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); ++ }); ++ break; ++ case "srcpt": ++ var cbArgs = "srcpt"; ++ var qargs = "pt-src"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); ++ }); ++ break; ++ case "dstpt": ++ var cbArgs = "dstpt"; ++ var qargs = "pt-dst"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,cbArgs)}); ++ }); ++ break; ++ case "signature": ++ var qargs = "sig-sig"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb16(data)}); ++ }); ++ break; ++ case "srccc": ++ var cbArgs = "srccc"; ++ var qargs = "cc-src"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); ++ }); ++ break; ++ case "dstcc": ++ var cbArgs = "dstcc"; ++ var qargs = "cc-dst"; ++ var urArgs = "type=15&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&limit=" + limit + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb15(data,cbArgs)}); ++ }); ++ break; ++ } ++ ++ // IP and Country ++ function cb15(data,cbArgs){ ++ var ch = "SRC"; ++ var wip = "d"; ++ if (cbArgs[0] == "s") ch = "DST", wip = "s"; ++ eval("raw=" + data); ++ var tbl = '', head = '', row = ''; ++ head += ""; ++ head += "COUNT"; ++ head += "%TOTAL"; ++ head += "#SIG"; ++ head += "#" + ch + ""; ++ if (cbArgs[3] == "c") { ++ head += "COUNTRY"; ++ head += "#IP"; ++ } else { ++ head += "IP"; ++ head += "COUNTRY"; ++ } ++ head += ""; ++ ++ var eventsum = raw[raw.length - 1].n || 0; ++ var records = raw[raw.length - 1].r || 0; ++ if (records == 0) { ++ row = "No result."; ++ $("#ov_" + cbArgs + "_sl").text(""); ++ } ++ for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); ++ row += ""; ++ row += "" + cnt + ""; ++ row += "" + per + "%"; ++ row += "" + sigs + ""; ++ row += "" + ip2 + ""; ++ ++ if (cbArgs[3] == "c") { ++ row += ""; ++ row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; ++ row += "" + ip + ""; ++ } else { ++ row += "
" + ip + ""; ++ row += ""; ++ row += cs[1] + clong + " (." + cc.toLowerCase() + ")" + ""; ++ } ++ row += ""; ++ row += "
"; ++ } ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); ++ $("#ov_" + cbArgs + "_sl").after(tbl); ++ $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); ++ mkSlider("ov_" + cbArgs + "_sl", i, records); ++ } ++ ++ // Ports ++ function cb17(data,cbArgs){ ++ eval("raw=" + data); ++ var tbl = '', head = '', row = ''; ++ head += ""; ++ head += "COUNT"; ++ head += "%TOTAL"; ++ head += "#SIG"; ++ head += "#SRC" ++ head += "#DST"; ++ head += "PORT"; ++ head += ""; ++ ++ var eventsum = raw[raw.length - 1].n || 0; ++ var records = raw[raw.length - 1].r || 0; ++ if (records == 0) { ++ row = "No result."; ++ $("#ov_" + cbArgs + "_sl").text(""); ++ } ++ for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); ++ row += ""; ++ row += "" + cnt + ""; ++ row += "" + per + "%"; ++ row += "" + sigs + ""; ++ row += "" + src + ""; ++ row += "" + dst + ""; ++ row += "" + port + ""; ++ row += ""; ++ row += "
"; ++ } ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ if ($("#top" + cbArgs)[0]) $("#top" + cbArgs).remove(); ++ $("#ov_" + cbArgs + "_sl").after(tbl); ++ $("#ov_" + cbArgs + "_msg").html("viewing " + i + " of " + records + " results"); ++ mkSlider("ov_" + cbArgs + "_sl", i, records); ++ } ++ // Signature ++ function cb16(data){ ++ eval("raw=" + data); ++ var tbl = '', head = '', row = ''; ++ head += ""; ++ head += "COUNT"; ++ head += "%TOTAL"; ++ head += "#SRC"; ++ head += "#DST"; ++ head += "SIGNATURE"; ++ head += "ID"; ++ head += ""; ++ ++ var eventsum = raw[raw.length - 1].n || 0; ++ var records = raw[raw.length - 1].r || 0; ++ if (records == 0) { ++ row = "No result."; ++ $("#ov_signature_sl").text(""); ++ $("#ovestat").html("(No events)"); ++ } else { ++ $("#ovestat").html("(" + eventsum + " events)"); ++ } ++ for (var i=0; i 0) per = parseFloat(cnt/eventsum*100).toFixed(2); ++ row += ""; ++ row += "" + cnt + ""; ++ row += "" + per + "%"; ++ row += "" + src + ""; ++ row += "" + dst + ""; ++ row += "" + sig + ""; ++ row += "" + sid + ""; ++ row += ""; ++ row += "
"; ++ } ++ ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ if ($('#topsignature')[0]) $('#topsignature').remove(); ++ $("#ov_signature_sl").after(tbl); ++ $("#ov_signature_msg").html("viewing " + i + " of " + records + " results"); ++ mkSlider("ov_signature_sl", i, records); ++ } ++ } ++ ++ $(".ovsl").mouseup(function() { ++ var section = $(this).attr('id'); ++ var base = section.split("_")[1]; ++ var limit = Number($("#" + section + "_lbl").text()); ++ if (limit > 0) mkSummary(base, limit); ++ }); ++ ++ // ++ // Views tab ++ // ++ ++ function loadViews() { ++ $('.db_links').show(); ++ if (!$("#db_view_cont")[0]) mkView(); ++ } ++ ++ // Link handlers ++ $(document).on('click', '.db_link', function() { ++ $('.db_link').each(function() { ++ if ($(this).data('state') == '1') { ++ $(this).removeClass('db_link_active'); ++ $(this).data('state', '0'); ++ } ++ }); ++ $(this).data('state', '1'); ++ mkView(); ++ }); ++ ++ $(document).on('click', '.db_type', function() { ++ $('.db_type').each(function() { ++ if ($(this).data('state') == '1') { ++ $(this).removeClass('db_type_active'); ++ $(this).data('state', '0'); ++ } ++ }); ++ $(this).data('state', '1'); ++ mkView(); ++ }); ++ ++ $(document).on('click','.db_save', function() { ++ ++ }); ++ ++ // Create the view ++ function mkView() { ++ $('#db_view_cont,#hp_info').remove(); ++ if (!$("#db_view_ldr")[0]) { ++ var view = 'ip'; ++ $('.db_link').each(function() { ++ if ($(this).data('state') == '1') { ++ $(this).addClass('db_link_active'); ++ view = $(this).data('val'); ++ } ++ }); ++ ++ var type = 'sk'; ++ $('.db_type').each(function() { ++ if ($(this).data('state') == '1') { ++ $(this).addClass('db_type_active'); ++ type = $(this).data('type'); ++ } ++ }); ++ ++ var theWhen = getTimestamp(); ++ var theSensors = s2h('empty'); ++ var theFilter = mkFilter(); ++ // See if we are filtering by sensor ++ if ($('.chk_sen:checked').length > 0) { ++ var active_sensors = "AND event.sid IN("; ++ var iter = $('.chk_sen:checked').length; ++ $('.chk_sen:checked').each(function() { ++ active_sensors += "'" + $(this).val() + "',"; ++ }); ++ active_sensors = active_sensors.replace(/,+$/,''); ++ active_sensors += ")"; ++ theSensors = s2h(active_sensors); ++ } ++ ++ var ldr = "
"; ++ $('.db_view').after(ldr); ++ var qargs = view + "-" + type; ++ var urArgs = "type=16&qargs=" + qargs + "&filter=" + theFilter + "&sensors=" + theSensors + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb17(data,type)}); ++ }); ++ ++ function cb17(data,type) { ++ eval("viewData=" + data); ++ var records = viewData.records; ++ if ($('#db_view_cont')[0]) $('#db_view_cont').remove(); ++ if (records > 0) { ++ $('.db_view').after("
"); ++ switch (type) { ++ case 'sk': ++ var w = $(window).width(); ++ var h = viewData.links.length * 12; ++ if (h < 100) h = 100; ++ mkSankey("db_view_cont",viewData,w,h); ++ break; ++ } ++ } else { ++ $('.db_view').after("
The query returned no results.
"); ++ } ++ $('#db_view_ldr').remove(); ++ } ++ } ++ } ++ ++ // Make a map ++ function doMap() { ++ theWhen = getTimestamp(); ++ var theFilter = mkFilter(); ++ var working = "Working
"; ++ ++ $('#wm0').html(working); ++ ++ var urArgs = "type=" + 10 + "&filter=" + theFilter + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb10(data)}); ++ }); ++ ++ function cb10(data){ ++ eval("mapRaw=" + data); ++ try { ++ var mapDetail = $.parseJSON("{" + mapRaw.all + "}"); ++ var srcc = mapRaw.srcc; ++ var srce = mapRaw.srce; ++ var dstc = mapRaw.dstc; ++ var dste = mapRaw.dste; ++ var allc = mapRaw.allc; ++ var alle = mapRaw.alle; ++ } ++ catch(e) { ++ var mapDetail = "{\"\"}"; ++ } ++ ++ // What is our current event total? ++ var esum = $('#event_sum').val(); ++ var w = $(window).width() - 72; ++ var h = w / 2.7 ; ++ $("#ov_map").html("
"); ++ $('#wm0').vectorMap({ ++ map: 'world_mill_en', ++ color: '#f4f3f0', ++ backgroundColor: '#CFE1FC', ++ zoomOnScroll: false, ++ onRegionClick: function(event, code){ ++ hItemAdd(code); ++ $('#search').val("cc" + " " + code); ++ $('#search').focus(); ++ }, ++ series: { ++ regions: [{ ++ values: mapDetail, ++ scale: ['#ffffff', '#000000'], ++ normalizeFunction: 'polynomial' ++ }] ++ }, ++ onRegionLabelShow: function(e, el, code){ ++ if (mapDetail[code]) { ++ var eper = parseFloat(mapDetail[code]/esum*100).toFixed(3); ++ el.html(el.html() + ' (' + mapDetail[code] + ' Events ' + eper + '% of Total)'); ++ } else { ++ el.html(el.html()); ++ } ++ } ++ }); ++ ++ var stats = "("; ++ stats += allc + " distinct countries)"; ++ $("#ovmapstat").html(stats); ++ } ++ } ++ ++ // Redraw map ++ $(document).on("click", "#map_src, #map_dst", function() { ++ doMap($(this).attr('id').split("_")[1]); ++ }); ++ ++ // ++ // History ++ // ++ ++ function doHistory(object) { ++ $('#loader').show(); ++ var urArgs = "type=" + 21 + "&object=" + s2h("aa" + object) + "&ts=" + theWhen; ++ $(function(){ ++ $.get(".inc/callback.php?" + urArgs, function(data){cb21(data)}); ++ }); ++ ++ function cb21(data){ ++ eval("chartData=" + data); ++ var r1 = chartData.r1; ++ var r2 = chartData.r2; ++ var sum = 0; ++ if (r1 > 0) { ++ mkHeatMap(".ev_hm",chartData.start,chartData.rows1,object); ++ $('#obhist_sig').remove(); ++ if (r2 > 0) { ++ ++ for (var i=0; i < r2; i++) { ++ sum += Number(chartData.rows2[i].value); ++ } ++ ++ var tbl = '', head = '', row = ''; ++ head += ""; ++ head += "COUNT"; ++ head += "%TOTAL"; ++ head += "SIGNATURE"; ++ head += ""; ++ row += ""; ++ ++ for (var i=0; i < r2; i++) { ++ ++ var cnt = chartData.rows2[i].value || "-"; ++ var sig = chartData.rows2[i].label || "-"; ++ var sid = chartData.rows2[i].sid || "-"; ++ var per = 0; ++ if (sum > 0) var per = parseFloat(cnt/sum*100).toFixed(2); ++ var tsg = truncTag(sig,60); ++ ++ row += ""; ++ row += "" + cnt + ""; ++ row += "" + per + "%"; ++ row += "" + tsg + ""; ++ row += "" ++ row += "
"; ++ } ++ ++ row += ""; ++ tbl += ""; ++ tbl += head; ++ tbl += row; ++ tbl += "
"; ++ if ($('#obhist_sig')[0]) $('#obhist_sig').remove(); ++ $(".ev_py").append(tbl); ++ } ++ } else { ++ return; ++ } ++ if ($(".eview_charts")[0]) $('.eview_charts').slideDown('slow'); ++ $("#loader").hide(); ++ } ++ } ++// The End. ++}); +--- /dev/null ++++ securityonion-squert-20161212/login.php +@@ -0,0 +1,158 @@ ++ ++// ++// This program is free software: you can redistribute it and/or modify ++// it under the terms of the GNU General Public License as published by ++// the Free Software Foundation, either version 3 of the License, or ++// (at your option) any later version. ++// ++// This program is distributed in the hope that it will be useful, ++// but WITHOUT ANY WARRANTY; without even the implied warranty of ++// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++// GNU General Public License for more details. ++// ++// You should have received a copy of the GNU General Public License ++// along with this program. If not, see . ++// ++// ++ ++include_once '.inc/config.php'; ++ ++$username = $password = $err = ''; ++$focus = 'username'; ++session_set_cookie_params(0, NULL, NULL, NULL, TRUE); ++ ++function cleanUp($string) { ++ if (get_magic_quotes_gpc()) { ++ $string = stripslashes($string); ++ } ++ $string = mysql_real_escape_string($string); ++ return $string; ++} ++ ++//if ($_SERVER['REQUEST_METHOD'] == 'POST'){ ++ //$username = $_REQUEST['username']; ++ //$password = $_REQUEST['password']; ++ // sso ++ $username = $_SERVER['PHP_AUTH_USER']; ++ $password = $_SERVER['PHP_AUTH_PW']; ++ ++ $ua = $_SERVER['HTTP_USER_AGENT']; ++ $rqt = $_SERVER['REQUEST_TIME']; ++ $rqaddr = $_SERVER['REMOTE_ADDR']; ++ $max = mt_getrandmax(); ++ $rqt .= mt_rand(0,$max); ++ $rqaddr .= mt_rand(0,$max); ++ $ua .= mt_rand(0,$max); ++ $cmpid = $rqt . $rqaddr . $ua; ++ $id = md5($cmpid); ++ // PDO prepared statements ++ try { ++ // first connect to database with the PDO object. ++ $dbpdo = new PDO("mysql:host=$dbHost;dbname=$dbName;charset=latin1", "$dbUser", "$dbPass", [ ++ PDO::ATTR_EMULATE_PREPARES => false, ++ PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => false, ++ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ++ ]); ++ } catch(PDOException $e){ ++ // if connection fails, log PDO error. ++ error_log("Error connecting to mysql: ". $e->getMessage()); ++ } ++ ++ if (isset($dbpdo)) { ++ // prepare statement ++ $statement = "SELECT * FROM user_info WHERE username = :user"; ++ $query = $dbpdo->prepare("$statement"); ++ // build parameters for prepared statement ++ $params = [":user" => "$username"]; ++ // execute the prepared statement and pass it params ++ $query->execute($params); ++ // fetch the data ++ while ($row = $query->fetch(PDO::FETCH_NUM)) { ++ $userName = $row[1]; ++ $lastLogin = $row[2]; ++ $userHash = $row[3]; ++ $userEmail = $row[4]; ++ $userType = $row[5]; ++ $userTime = $row[6]; ++ $tzoffset = $row[7]; ++ } ++ ++ // if $username was found in database, then check password ++ if ( isset($userName) && $username == $userName) { ++ // The first 2 chars are the salt ++ $theSalt = substr($userHash, 0,2); ++ ++ // The remainder is the hash ++ $theHash = substr($userHash, 2); ++ ++ // Now we hash the users input ++ $testHash = sha1($password . $theSalt); ++ ++ // Does it match? If yes, start the session. ++ if ($testHash === $theHash) { ++ session_start(); ++ ++ // Protect against session fixation attack ++ if (!isset($_SESSION['initiated'])) { ++ session_regenerate_id(); ++ $_SESSION['initiated'] = true; ++ } ++ ++ $_SESSION['sLogin'] = 1; ++ $_SESSION['sUser'] = $userName; ++ $_SESSION['sPass'] = $password; ++ $_SESSION['sEmail'] = $userEmail; ++ $_SESSION['sType'] = $userType; ++ $_SESSION['sTime'] = $userTime; ++ $_SESSION['tzoffset'] = $tzoffset; ++ $_SESSION['sTab'] = 't_sum'; ++ $_SESSION['id'] = $id; ++ ++ header ("Location: index.php?id=$id"); ++ } else { ++ $err = 'The user name or password is incorrect.'; ++ $focus = 'username'; ++ } ++ } else { ++ $err = 'The user name or password is incorrect.'; ++ $focus = 'username'; ++ } ++ } else { ++ $err = 'Connection Failed'; ++ } ++//} ++?> ++ ++ ++ ++Please login to continue ++ ++ ++ ++ ++
++
++ ++ ++ ++ ++ ++ ++
++squert - Please login to continue
++Username
++
++Password
++
++

++
Version 1.7.0©2016 Paul Halliday
++
++
++ ++ ++ diff --git "a/debian/patches/remove-unnecessary-code-from-ip2c.php\033:wq" "b/debian/patches/remove-unnecessary-code-from-ip2c.php\033:wq" new file mode 100644 index 0000000..b2efc9e --- /dev/null +++ "b/debian/patches/remove-unnecessary-code-from-ip2c.php\033:wq" @@ -0,0 +1,161 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion39) xenial; urgency=medium + . + * remove unnecessary code from ip2c.php +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.inc/ip2c.php ++++ securityonion-squert-20161212/.inc/ip2c.php +@@ -25,29 +25,22 @@ include_once "functions.php"; + $db = mysqli_connect($dbHost,$dbUser,$dbPass) or die(mysqli_error($db)); + mysqli_select_db($db,$dbName) or die(mysqli_error($db)); + +-function IP2C($string,$isCLI) { ++function IP2C($string) { + +- if ($isCLI == 'NO') { +- // Running from a browser +- $when = 'WHERE ' . hextostr($string) . ' AND '; +- } else { +- // Running from the command line +- if ($string == 0) { +- $when = "WHERE "; +- } +- +- if ($string == 1) { +- $startDate = gmdate("Y-m-d"); +- $startTime = "00:00:00"; +- $endDate = gmdate("Y-m-d",strtotime($startDate . "+1 day")); +- $endTime = "00:00:00"; +- $when = "WHERE e.timestamp BETWEEN '$startDate $startTime' AND '$endDate $endTime' AND"; +- } +- +- echo "Performing base queries (this can take a while)..\n\n"; ++ if ($string == 0) { ++ $when = "WHERE "; ++ } + ++ if ($string == 1) { ++ $startDate = gmdate("Y-m-d"); ++ $startTime = "00:00:00"; ++ $endDate = gmdate("Y-m-d",strtotime($startDate . "+1 day")); ++ $endTime = "00:00:00"; ++ $when = "WHERE e.timestamp BETWEEN '$startDate $startTime' AND '$endDate $endTime' AND"; + } + ++ echo "Performing base queries (this can take a while)..\n\n"; ++ + function lookup($list) { + + global $db; +@@ -75,13 +68,11 @@ function IP2C($string,$isCLI) { + } + } + +- // DB Connect +- global $dbHost, $dbUser, $dbPass, $dbName; +- $db = mysqli_connect($dbHost,$dbUser,$dbPass) or die(mysqli_error($db)); +- mysqli_select_db($db,$dbName) or die(mysqli_error($db)); +- + // Start timing + $st = microtime(true); ++ ++ // DB Connect ++ global $db; + $sipList = mysqli_query($db,"SELECT DISTINCT(e.src_ip) FROM event AS e LEFT JOIN mappings AS m ON e.src_ip=m.ip + WHERE (m.ip IS NULL OR m.cc = '01')"); + $dipList = mysqli_query($db,"SELECT DISTINCT(e.dst_ip) FROM event AS e LEFT JOIN mappings AS m ON e.dst_ip=m.ip +@@ -109,19 +100,7 @@ function IP2C($string,$isCLI) { + $time = $et - $st; + $rt = sprintf("%01.3f",$time); + +- if ($isCLI == 'NO') { +- +- $html = "\r +- \r +- \r +- \r +- \r +- \r
 -> Query Time: $rt seconds
 -> Source Count: $sipCount
 -> Destination Count: $dipCount
 -> Total Mapped: $allCount[0]
"; +- +- return $html; +- } +- +- if ($isCLI == 'YES' && $string == 0) { ++ if ($string == 0) { + echo "\n-> Query Time: $rt seconds + \r-> Source Count: $sipCount + \r-> Destination Count: $dipCount +@@ -130,30 +109,6 @@ function IP2C($string,$isCLI) { + + } + +-/* +- +-Commenting out the following function per +-https://github.com/int13h/squert/issues/76 +- +-function TheHTML($string) { +- +- echo "\r +- \r +- \r +- \r +- \r +- \r +- \r
+- \r
+- \r +- \r

+- \r +- \r
+- \r +- \r"; +-} +-*/ +- + if (isset($argc)) { + + if ($argc == 1 || $argc > 2 || $argv[1] > 1 || !is_numeric($argv[1])) { +@@ -164,21 +119,8 @@ if (isset($argc)) { + \r1 - Update. This is intended to be called via Cron\n\n"; + exit; + } else { +- IP2C($argv[1],'YES'); +- } +- +-} else { +- +- $html = ''; +- +- if(!isset($_REQUEST['qText'])) { $string = $_REQUEST['qp']; } else { $string = $_REQUEST['qText']; } +- +- if (@$_REQUEST['csync']) { +- $string = $_REQUEST['qText']; +- $html = IP2C($string,'NO'); ++ IP2C($argv[1]); + } + +- TheHTML($string); +- echo $html; + } + ?> diff --git a/debian/patches/series b/debian/patches/series index c4d3939..49ac6eb 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -24,3 +24,13 @@ improve-callback.php-and-grant-permission-to-autocat-table allow-pivot-to-elsa-or-elastic migrate-login.php-to-prepared-statements add-row-for-Bro-agent +version-1.7.1 +update-mysql-calls-and-config +move-files-from-elastic-package +fix-auth +disable-mysql-strict-mode +frontend-expects-all-values-to-be-strings +iterate-over-all-arrays-when-converting-strings +fix-for-loop +update-mysql-function-calls-in-ip2c.php +remove-unnecessary-code-from-ip2c.php:wq diff --git a/debian/patches/update-mysql-calls-and-config b/debian/patches/update-mysql-calls-and-config new file mode 100644 index 0000000..87f8a4a --- /dev/null +++ b/debian/patches/update-mysql-calls-and-config @@ -0,0 +1,52 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion30) xenial; urgency=medium + . + * update mysql calls and config +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.inc/functions.php ++++ securityonion-squert-20161212/.inc/functions.php +@@ -56,13 +56,13 @@ function retSD($x) { + function dbC() { + if (file_exists('.inc/config.php')) { + global $dbHost,$dbName,$dbUser,$dbPass; +- $link = mysql_connect($dbHost,$dbUser,$dbPass); ++ $link = mysqli_connect($dbHost,$dbUser,$dbPass); + + if (!$link) { + die('Connection failed: ' . mysql_error()); + } + +- $db = mysql_select_db($dbName,$link); ++ $db = mysqli_select_db($link,$dbName); + + if (!$db) { + die('Database selection failed: ' . mysql_error()); +--- securityonion-squert-20161212.orig/.scripts/securityonion-squert.cnf ++++ securityonion-squert-20161212/.scripts/securityonion-squert.cnf +@@ -1,5 +1,6 @@ + [mysqld] + group_concat_max_len = 100000 ++sql_mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION + + [mysqltcl] + local-infile=1 diff --git a/debian/patches/update-mysql-function-calls-in-ip2c.php b/debian/patches/update-mysql-function-calls-in-ip2c.php new file mode 100644 index 0000000..f3730b7 --- /dev/null +++ b/debian/patches/update-mysql-function-calls-in-ip2c.php @@ -0,0 +1,113 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion38) xenial; urgency=medium + . + * update mysql function calls in ip2c.php +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/.inc/ip2c.php ++++ securityonion-squert-20161212/.inc/ip2c.php +@@ -19,10 +19,13 @@ + // + // + +-function IP2C($string,$isCLI) { ++include_once "config.php"; ++include_once "functions.php"; ++ ++$db = mysqli_connect($dbHost,$dbUser,$dbPass) or die(mysqli_error($db)); ++mysqli_select_db($db,$dbName) or die(mysqli_error($db)); + +- include_once "config.php"; +- include_once "functions.php"; ++function IP2C($string,$isCLI) { + + if ($isCLI == 'NO') { + // Running from a browser +@@ -47,13 +50,14 @@ function IP2C($string,$isCLI) { + + function lookup($list) { + +- while ($row = mysql_fetch_row($list)) { ++ global $db; ++ while ($row = mysqli_fetch_row($list)) { + $ip = $row[0]; + $dot = long2ip((float)$ip); +- $ipLookup = mysql_query("SELECT registry, cc, c_long, type, date, status FROM ip2c WHERE ++ $ipLookup = mysqli_query($db,"SELECT registry, cc, c_long, type, date, status FROM ip2c WHERE + $ip >=start_ip AND $ip <= end_ip LIMIT 1"); + +- $result = mysql_fetch_array($ipLookup); ++ $result = mysqli_fetch_array($ipLookup); + + if ($result) { + $registry = $result[0]; +@@ -63,7 +67,7 @@ function IP2C($string,$isCLI) { + $date = $result[4]; + $status = $result[5]; + +- mysql_query("REPLACE INTO mappings (registry,cc,c_long,type,ip,date,status) ++ mysqli_query($db,"REPLACE INTO mappings (registry,cc,c_long,type,ip,date,status) + VALUES (\"$registry\",\"$cc\",\"$c_long\",\"$type\",\"$ip\",\"$date\",\"$status\")"); + echo "-- Mapped $dot ($ip) to $cc ($c_long)\n"; + } +@@ -72,32 +76,33 @@ function IP2C($string,$isCLI) { + } + + // DB Connect +- $db = mysql_connect($dbHost,$dbUser,$dbPass) or die(mysql_error()); +- mysql_select_db($dbName,$db) or die(mysql_error()); ++ global $dbHost, $dbUser, $dbPass, $dbName; ++ $db = mysqli_connect($dbHost,$dbUser,$dbPass) or die(mysqli_error($db)); ++ mysqli_select_db($db,$dbName) or die(mysqli_error($db)); + + // Start timing + $st = microtime(true); +- $sipList = mysql_query("SELECT DISTINCT(e.src_ip) FROM event AS e LEFT JOIN mappings AS m ON e.src_ip=m.ip ++ $sipList = mysqli_query($db,"SELECT DISTINCT(e.src_ip) FROM event AS e LEFT JOIN mappings AS m ON e.src_ip=m.ip + WHERE (m.ip IS NULL OR m.cc = '01')"); +- $dipList = mysql_query("SELECT DISTINCT(e.dst_ip) FROM event AS e LEFT JOIN mappings AS m ON e.dst_ip=m.ip ++ $dipList = mysqli_query($db,"SELECT DISTINCT(e.dst_ip) FROM event AS e LEFT JOIN mappings AS m ON e.dst_ip=m.ip + WHERE (m.ip IS NULL OR m.cc = '01')"); + $sipCount = $dipCount = 0; + if ($sipList) { +- $sipCount = mysql_num_rows($sipList); ++ $sipCount = mysqli_num_rows($sipList); + if ($sipCount > 0) { + lookup($sipList); + } + } + + if ($dipList) { +- $dipCount = mysql_num_rows($dipList); ++ $dipCount = mysqli_num_rows($dipList); + if ($dipCount > 0) { + lookup($dipList); + } + } + +- $allRecs = mysql_query("SELECT COUNT(*) FROM mappings"); +- $allCount = mysql_fetch_row($allRecs); ++ $allRecs = mysqli_query($db,"SELECT COUNT(*) FROM mappings"); ++ $allCount = mysqli_fetch_row($allRecs); + + // Stop Timing + $et = microtime(true); diff --git a/debian/patches/version-1.7.1 b/debian/patches/version-1.7.1 new file mode 100644 index 0000000..9cb997a --- /dev/null +++ b/debian/patches/version-1.7.1 @@ -0,0 +1,47 @@ +Description: + TODO: Put a short summary on the line above and replace this paragraph + with a longer explanation of this change. Complete the meta-information + with other relevant fields (see below for details). To make it easier, the + information below has been extracted from the changelog. Adjust it or drop + it. + . + securityonion-squert (20161212-1ubuntu1securityonion28) trusty; urgency=medium + . + * version 1.7.1 +Author: Doug Burks + +--- +The information above should follow the Patch Tagging Guidelines, please +checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here +are templates for supplementary fields that you might want to add: + +Origin: , +Bug: +Bug-Debian: http://bugs.debian.org/ +Bug-Ubuntu: https://launchpad.net/bugs/ +Forwarded: +Reviewed-By: +Last-Update: + +--- securityonion-squert-20161212.orig/auth/native/squert/login.php ++++ securityonion-squert-20161212/auth/native/squert/login.php +@@ -150,7 +150,7 @@ Password
+

+ + +-
Version 1.7.0©2016 Paul Halliday
++
Version 1.7.1©2016 Paul Halliday
+ + + +--- securityonion-squert-20161212.orig/auth/sso/squert/login.php ++++ securityonion-squert-20161212/auth/sso/squert/login.php +@@ -150,7 +150,7 @@ Password
+

+ + +-
Version 1.7.0©2016 Paul Halliday
++
Version 1.7.1©2016 Paul Halliday
+ + + diff --git a/debian/postinst b/debian/postinst index c3d28d0..47dd814 100644 --- a/debian/postinst +++ b/debian/postinst @@ -6,7 +6,7 @@ case "$1" in configure) a2enmod ssl || echo "Error enabling Apache ssl module." - a2dismod autoindex || echo "Error disabling Apache autoindex module." + a2dismod autoindex -f || echo "Error disabling Apache autoindex module." a2dissite 000-default || echo "Error disabling Apache HTTP listener." a2ensite securityonion || echo "Error enabling Apache securityonion site." @@ -19,25 +19,6 @@ case "$1" in fi fi - # Squert has its own native authentication, but we're moving to SSO for the Elastic integration. - # If Apache is configured for SSO, then configure Squert for SSO. - # Otherwise, configure Squert for native authentication. - AUTH="native" - SO="/var/www/so/" - SQUERT="${SO}/squert" - CONF="/etc/apache2/sites-enabled/securityonion.conf" - if ! [ -f ${CONF} ]; then - echo "${CONF} does not exist. Configuring for Squert authentication." - else - if grep -q "" ${CONF} ; then - echo "${CONF} is configured for SSO authentication. Updating SSO auth files." - AUTH="sso" - else - echo "${CONF} is configured for Squert authentication. Updating Squert auth files." - fi - fi - cp -av /opt/squert/auth/${AUTH}/squert ${SO} || echo "Error copying from /opt/squert/auth/${AUTH}/squert to ${SO}." - apache2ctl restart || echo "Error restarting Apache." if ! grep "/var/www/so/squert/.scripts/Ip2c/results.txt" /etc/apparmor.d/local/usr.sbin.mysqld >/dev/null; then diff --git a/auth/sso/squert/login.php b/login.php similarity index 98% rename from auth/sso/squert/login.php rename to login.php index 5e3d620..a579456 100644 --- a/auth/sso/squert/login.php +++ b/login.php @@ -150,7 +150,7 @@ function cleanUp($string) {

-
Version 1.7.1©2016 Paul Halliday
+
Version 1.8.0©2016 Paul Halliday