<?php
/*  
 * Analysis Console for Incident Databases (ACID)
 *
 * Author: Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
 * Author: Steve Halligan <geek2@geeksquad.com>
 * Copyright (C) 2000 Carnegie Mellon University
 * (see the file 'acid_main.php' for license details)
 *
 * Purpose:   Based on acid_pkt_main.php.  All raw html has been removed and output collected in output buffer.  Buffer then dumped to mail function.
 * SRH-NOTE:  Changes to database structure, or to acid_pkt_main.php may need to be mirrored here.
 *
 */


ob_start();
 


echo '
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<!-- Analysis Console for Incident Databases (ACID) $ACID_VERSION -->
<HTML>
  <HEAD>
      <META name="Author" content="Roman Danyliw">
       <TITLE>ACID: Query Results</TITLE>
  </HEAD>

  <BODY>

	<TABLE WIDTH="100%" BORDER=0 CELLSPACING=0 CELLPADDING=5>
	  <TR>
	    <TD class="mainheader">';

readfile("acid_hdr1.html");
echo '  
</TD>
<TD class="mainheadertitle">Query Results</TD>
</TR>
</TABLE>
<P><P>';


/* Connect to the Alert database */
  $db=acid_mysql_connect($alert_host, $alert_port, $alert_user, $alert_password, $alert_dbname);
  mysql_select_db($alert_dbname, $db);

  $t = rawurldecode($save_criteria);
  $save_criteria = $t;





/* Clean any SQL we passed */
InputSafeSQL($save_sql);

/* Dump some debugging information on the shared state */
if ( $debug_mode == 1 )
{
   echo '<HR>COMING INTO PAGE:<HR>';
   echo 'submit = "'.$submit.'"';
   echo '<TABLE BORDER=1>';
   echo '<TR><TD>time_cnt<TD>ip_addr_cnt<TD>ip_field_cnt<TD>ip_opt_cnt<TD>tcp_port_cnt
             <TD>tcp_field_cnt<TD>tcp_opt_cnt<TD>udp_port_cnt<TD>udp_field_cnt
             <TD>icmp_field_cnt<TD>data_cnt</TR>';
   echo '<TR><TD>'.$time_cnt.'<TD>'.$ip_addr_cnt.'<TD>'.$ip_field_cnt.'<TD>'.$ip_opt_cnt.
            '<TD>'.$tcp_port_cnt.'<TD>'.$tcp_field_cnt.'<TD>'.$tcp_opt_cnt.
            '<TD>'.$udp_port_cnt.'<TD>'.$udp_field_cnt.'<TD>'.$icmp_field_cnt.
            '<TD>'.$data_cnt.'</TABLE>';
   printf("layer4 = %s<BR>\nsave_sql = %s<BR>", $layer4, $save_sql);
   printf("current_view = %s<BR>num_result_rows = %s\n", $current_view, $num_result_rows);
   printf("save_criteria = %s<BR>", $save_criteria);
   printf("caller = %s<BR>", $caller);
   printf("action= %s<BR>\nag_add_key= %s<BR><HR>\n", $action, $ag_add_key);
}

/* Run the SQL Query and get results */
if ( $caller == "" || $caller == "last_any" || $caller == "last_tcp" || $caller == "last_udp" || $caller == "last_icmp" || $caller == "stat_alerts")
	include("acid_email_sqlcalls.php");

/* Packet Lookup based on sid/cid */
if ( strstr($submit, "#") != "" || strstr($caller, "#") != "")
{
   echo '<INPUT TYPE=hidden NAME="action_chk_lst[0]" VALUE="'.$submit.'">';   
   /* $caller = $submit; */
   EmailPacketLookup( $caller , $db, $save_sql, $mod_snort_config);
}





/* Stores the necessary variables for shared state between calls */
echo '<INPUT TYPE="hidden" NAME="time_cnt" VALUE="'.$time_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="layer4" VALUE="'.$layer4.'">';
echo '<INPUT TYPE="hidden" NAME="ip_addr_cnt" VALUE="'.$ip_addr_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="ip_field_cnt" VALUE="'.$ip_field_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="ip_opt_cnt" VALUE="'.$ip_opt_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="tcp_port_cnt" VALUE="'.$tcp_port_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="tcp_field_cnt" VALUE="'.$tcp_field_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="tcp_opt_cnt" VALUE="'.$tcp_opt_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="udp_port_cnt" VALUE="'.$udp_port_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="udp_field_cnt" VALUE="'.$udp_field_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="icmp_field_cnt" VALUE="'.$icmp_field_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="data_cnt" VALUE="'.$data_cnt.'">';
echo '<INPUT TYPE="hidden" NAME="save_sql" VALUE="'.$save_sql.'">';
echo '<INPUT TYPE="hidden" NAME="num_result_rows" VALUE="'.$num_result_rows.'">';
echo '<INPUT TYPE="hidden" NAME="current_view" VALUE="'.$current_view.'">';
echo '<INPUT TYPE="hidden" NAME="save_criteria" VALUE="'.(rawurlencode($save_criteria)).'">';
echo '<INPUT TYPE="hidden" NAME="have_meta" VALUE="'.$have_meta.'">';
echo '<INPUT TYPE="hidden" NAME="have_ip" VALUE="'.$have_ip.'">';
echo '<INPUT TYPE="hidden" NAME="have_tcp" VALUE="'.$have_tcp.'">';
echo '<INPUT TYPE="hidden" NAME="have_udp" VALUE="'.$have_udp.'">';
echo '<INPUT TYPE="hidden" NAME="have_icmp" VALUE="'.$have_icmp.'">';
echo '<INPUT TYPE="hidden" NAME="have_data" VALUE="'.$have_data.'">';
echo '<INPUT TYPE="hidden" NAME="caller" VALUE="'.$caller.'">';
  mysql_close($db);

echo '
</FORM>

<P>
<TABLE WIDTH="100%" BORDER=0 CELLSPACING=0 CELLPADDING=5>
<TR>
  <TD class="mainheader">';
 
readfile("acid_footer.html");

echo '
	  </TD>
</TR>
</TABLE>

</BODY>

</HTML>';
$message_body = ob_get_contents ();
ob_end_clean();
$message_mime = "MIME-Version: 1.0\nContent-Type: text/html; charset=us-ascii\n";
$message_subject = "Incident Report";
$message_recip = $ag_add_key;
if ($message_recip != "")
 	mail($message_recip, $message_subject, $message_body, $message_mime);
else
	ErrorMessage ("Please type the recipient's E-Mail Address in the box provided");
$submit = "Query DB";


