 <?php
/*  
 * Analysis Console for Incident Databases (ACID)
 *
 * Author: Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
 * Author: Steve Halligan <geek2@geeksquad.com>
 * Copyright (C) 2000 Carnegie Mellon University
 * (see the file 'acid_main.php' for license details)
 *
 * Purpose:   Based on acid_pkt_sqlcalls.php without links and raw html.  Output is collected in output buffer and dumped to mail function.
 * SRH-NOTE:  Changes made to database structure, or to acid_pkt_sqlcalls.php may need to be mirrored here.  
 *
 */  

  /* Apply the sort criteria */
  //if ( $caller == "last_tcp" || $caller == "last_udp" || 
  //     $caller == "last_icmp" || $caller == "last_any" )
  //      $sql = $sql." ORDER BY timestamp DESC ";
  //else
  //{
  //   if ( $sort_order == "time_a" )
  //      $sql = $sql." ORDER BY timestamp ASC ";  
  //   else if ( $sort_order == "time_d" )
  //      $sql = $sql." ORDER BY timestamp DESC ";
  //   else if ( $sort_order == "sig" )
  //      $sql = $sql." ORDER BY signature ";
  //}
  /* Export the SQL into the shared state variable */
  //if ( $save_sql == "" )
  //   $save_sql = $sql;
  //else
  //   $sql = $save_sql; 

  /* Run the query to determine the number of rows (No LIMIT)*/
  if ( $num_result_rows == -1 )
  {
     $current_view = 0;
     $result = mysql_query($sql, $db);

     if ( mysql_errno($db) > 0 )
     {
        ErrorMessage("<B>Query execution error:</B> ".mysql_error($db));
        die();
     }
     if ( $result  )
     {
        $num_result_rows = mysql_num_rows($result);
        mysql_free_result($result);
     }
     else
        $num_result_rows = 0;
   }

  /* Run the Query again for the actual data (with the LIMIT) */

  /* When display a Snapshot of alerts limit the number displayed */
  if ( $caller == "last_tcp" || $caller == "last_udp" || 
       $caller == "last_icmp" || $caller == "last_any" )
     $limit_tmp = " LIMIT 0, ".$last_num_alerts;
  else if ($submit == "Entire Query")
  	$limit_tmp = " LIMIT 0, ".$num_result_rows;
  else
     $limit_tmp = " LIMIT ".($current_view * $show_rows).",".$show_rows;

  if ( $save_sql != "" )
       $sql = $save_sql;
 $result = mysql_query($sql.$limit_tmp, $db);
  
  /* Generate and print the criteria in human readable form */
  PrintCriteria($caller);
  
 $action_count = count($action_chk_lst);
 if ( $debug_mode == 1 )
     printf("<P>%s<HR>\n", $sql.$limit_tmp);

  /* Print the current view number and # of rows */
  if ( ($submit !="Selected" &&$num_result_rows != 0) || ($submit == "Selected" && $action_count != 0 ))
  {  
     $num_rows = mysql_num_rows($result);
     if ( $submit == "Selected")	
        printf ("<HR><FONT><CENTER> Displaying <B> selected %d</B> rows</CENTER></FONT><BR>\n",$action_count);
     elseif (  $caller == "last_tcp" || $caller == "last_udp" || 
           $caller == "last_icmp" || $caller == "last_any" ) 
        printf("<HR><FONT><CENTER> Displaying <B>last %d</B> rows of %d</CENTER></FONT><BR>\n", 
               $last_num_alerts, $num_result_rows);
     else
        printf("<HR><CENTER>Displaying rows %d-%d of %d </CENTER><BR>\n", ($current_view * $show_rows)+1, 
         (($current_view * $show_rows) + $show_rows-1) < $num_result_rows ? 
           (($current_view * $show_rows) + $show_rows) : $num_result_rows, 
         $num_result_rows);
  }
  else
     printf("<P><HR><B>No Packets were found matching the specified criteria.  0 Rows returned.</B><P><P>\n");


  /* Print the search results */
  if ( $num_rows > 0 )
  {
    echo '<TABLE BORDER=1 CELLSPACING=0 PADDING=0 WIDTH="100%">';
    echo '<TR>
              <TD CLASS="pl_fieldhdr">ID</TD>
              <TD CLASS="pl_fieldhdr">Signature</TD>
              <TD CLASS="pl_fieldhdr">TimeStamp</TD>
              <TD CLASS="pl_fieldhdr">Source Address</TD>
              <TD CLASS="pl_fieldhdr">Destination Address</TD>
              <TD CLASS="pl_fieldhdr">Layer 4 Proto</TD>';
   
    for ( $i = 0; $i < $num_rows; $i++ )
    {
      $myrow = mysql_fetch_row($result);
      
      if ( $submit == "Entire Query" || $submit == "ALL on Screen"  || ($submit == "Selected" && $action_chk_lst[$i] !=""))
      {		echo '<TR BGCOLOR="'.((($i % 2) == 0) ? "DDDDDD" : "FFFFFF").'">';
		
      		$tmp_rowid = "#".(($current_view * $show_rows)+$i)."-(".$myrow[0]."-".$myrow[1].")";

      		echo '     <TD ALIGN=CENTER>'.$tmp_rowid.'</TD>
      		              <TD ALIGN=CENTER>'.BuildSigLookup($myrow[2]).'</TD>
      		    	    <TD ALIGN=CENTER>'.$myrow[3].'</TD>
      		   	    <TD ALIGN=CENTER>'.$myrow[4].".".$myrow[5].".".$myrow[6].".".$myrow[7].'</TD>
      			    <TD ALIGN=CENTER>'.$myrow[8].".".$myrow[9].".".$myrow[10].".".$myrow[11].'</TD>
      			   <TD ALIGN=CENTER>'.IPProto2str($myrow[12]).'</TD>';
      }
    }
    mysql_free_result($result);
  }
  echo "</TABLE>";

 ?>
