#!/usr/bin/perl # # SmoothWall CGIs # # This code is distributed under the terms of the GPL # # (c) The SmoothWall Team # # Copyright (C) 18-03-2002 Mark Wormgoor # - Added links to Snort database and ipinfo.cgi # # $Id: ids.dat,v 1.6.2.16 2005/06/14 08:25:30 eoberlander Exp $ # use strict; # enable only the following on debugging purpose #use warnings; #use CGI::Carp 'fatalsToBrowser'; require 'CONFIG_ROOT/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; use POSIX(); #workaround to suppress a warning when a variable is used only once my @dummy = ( ${Header::table1colour}, ${Header::table2colour} ); undef (@dummy); my %cgiparams=(); my %logsettings=(); my @log=(); my $errormessage = ''; my @shortmonths = ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec' ); my @longmonths = ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{'march'}, $Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'}, $Lang::tr{'august'}, $Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'}, $Lang::tr{'december'} ); my @now = localtime(time); my $dow = $now[6]; my $doy = $now[7]; my $tdoy = $now[7]; my $year = $now[5]+1900; $cgiparams{'DAY'} = $now[3]; $cgiparams{'MONTH'} = $now[4]; $cgiparams{'ACTION'} = ''; &Header::getcgihash(\%cgiparams); $logsettings{'LOGVIEW_REVERSE'} = 'off'; &General::readhash("${General::swroot}/logging/settings", \%logsettings); ${Header::viewsize} = defined ($logsettings{'LOGVIEW_VIEWSIZE'}) ? $logsettings{'LOGVIEW_VIEWSIZE'} : 150; $Header::viewsize /= 5; # each ids is displayed on 5 lines $now[4] = $cgiparams{'MONTH'}+1; if($now[4] < 10) { $now[4] = "0$now[4]"; } my $start = -1; if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'}) { my @temp = split(',',$ ENV{'QUERY_STRING'}); $start = $temp[0]; $cgiparams{'MONTH'} = $temp[1]; $cgiparams{'DAY'} = $temp[2]; } if (!($cgiparams{'MONTH'} =~ /^(0|1|2|3|4|5|6|7|8|9|10|11)$/) || !($cgiparams{'DAY'} =~ /^(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)$/)) { $cgiparams{'DAY'} = $now[3]; $cgiparams{'MONTH'} = $now[4]; } elsif($cgiparams{'ACTION'} eq '>>') { my @temp_then=(); my @temp_now = localtime(time); $temp_now[4] = $cgiparams{'MONTH'}; $temp_now[3] = $cgiparams{'DAY'}; @temp_then = localtime(POSIX::mktime(@temp_now) + 86400); ## Retrieve the same time on the next day + ## 86400 seconds in a day $cgiparams{'MONTH'} = $temp_then[4]; $cgiparams{'DAY'} = $temp_then[3]; } elsif($cgiparams{'ACTION'} eq '<<') { my @temp_then=(); my @temp_now = localtime(time); $temp_now[4] = $cgiparams{'MONTH'}; $temp_now[3] = $cgiparams{'DAY'}; @temp_then = localtime(POSIX::mktime(@temp_now) - 86400); ## Retrieve the same time on the previous day - ## 86400 seconds in a day $cgiparams{'MONTH'} = $temp_then[4]; $cgiparams{'DAY'} = $temp_then[3]; } if (($cgiparams{'DAY'} ne $now[3]) || ($cgiparams{'MONTH'} ne $now[4])) { my @then = (); if ( ( $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) || ( $cgiparams{'MONTH'} > $now[4] ) ) { @then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1901 )); } else { @then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1900 )); } $tdoy = $then[7]; my $lastleap=($year-1)%4; if ($tdoy>$doy) { if ($lastleap == 0 && $tdoy < 60) { $doy=$doy+366; } else { $doy=$doy+365; } } } my $datediff=0; my $dowd=0; my $multifile=0; if ($tdoy ne $doy) { $datediff=int(($doy-$tdoy)/7); $dowd=($doy-$tdoy)%7; if (($dow-$dowd)<1) { $datediff=$datediff+1; } if (($dow-$dowd)==0) { $multifile=1; } } my $longmonthstr = $longmonths[$cgiparams{'MONTH'}]; my $monthnum = $cgiparams{'MONTH'} + 1; my $monthstr = $monthnum <= 9 ? "0$monthnum" : "$monthnum"; my $daystr = $cgiparams{'DAY'} <= 9 ? "0$cgiparams{'DAY'}" : "$cgiparams{'DAY'}"; my $lines = 0; my ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs); &processevent; if ($multifile) { $datediff=$datediff-1; &processevent; } if ($cgiparams{'ACTION'} eq $Lang::tr{'export'}) { print "Content-type: text/plain\n\n"; print "IPFire IDS snort log\r\n"; print "Date: $cgiparams{'DAY'} $longmonths[$cgiparams{'MONTH'}]\r\n"; print "\r\n"; if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @log = reverse @log; } foreach $_ (@log) { my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\|/); $refs =~ s/,$//; print "Date: $datetime\n"; print "Name: $title\n"; print "Priority: $priority\n"; print "Type: $classification\n"; print "IP Info: "; print "$srcip"; if ($srcport != "n/a") { print ":$srcport"; } print " -> "; print "$destip"; if ($destport != "n/a") { print ":$destport"; } print "\n"; print "SID: $sid\n"; print "Refs: $refs\n\n"; } exit; } &Header::showhttpheaders(); &Header::openpage($Lang::tr{'ids log viewer'}, 1, ''); &Header::openbigbox('100%', 'left', '', $errormessage); if ($errormessage) { &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); print "$errormessage \n"; &Header::closebox(); } &Header::openbox('100%', 'left', "$Lang::tr{'settings'}:"); print <
$Lang::tr{'month'}:   $Lang::tr{'day'}: 
END ; &Header::closebox(); &Header::openbox('100%', 'left', $Lang::tr{'log'}); print "

$Lang::tr{'snort hits'} $longmonthstr $daystr: $lines

"; if ($start == -1) { $start = $lines - ${Header::viewsize}; } if ($start >= $lines - ${Header::viewsize}) { $start = $lines - ${Header::viewsize}; }; if ($start < 0) { $start = 0; } my $prev = $start - ${Header::viewsize}; my $next = $start + ${Header::viewsize}; if ($prev < 0) { $prev = 0; } if ($next >= $lines) { $next = -1 } if ($start == 0) { $prev = -1; } my @slice = splice(@log, $start, ${Header::viewsize}); if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @slice = reverse @slice; } if ($lines != 0) { &oldernewer(); $lines = 0; print < END ; foreach $_ (@slice) { if ($lines % 2) { print "\n"; } else { print "\n"; } my ($datetime,$title,$priority,$classification,$srcip,$srcport,$destip,$destport,$sid,$refs) = split(/\|/); print < $Lang::tr{'date'}:$datetime $Lang::tr{'name'}:$title $Lang::tr{'priority'}:$priority $Lang::tr{'type'}:$classification $Lang::tr{'ipinfo'}: END ; if ($srcip ne "n/a") { print "$srcip"; } else { print "$srcip"; } print ":$srcport -> "; if ($destip ne "n/a") { print "$destip"; } else { print "$destip"; } print ":$destport"; print < $Lang::tr{'references'}: END ; foreach my $ref (split(/,/,$refs)) { if ($ref =~ m/url (.*)/) { print "$1
"; } elsif ($ref =~ m/cve (.*)/) { print "$1
"; } elsif ($ref =~ m/nessus (.*)/) { print "Nessus $1
"; } elsif ($ref =~ m/bugtraq (.*)/) { print "Bugtraq $1
"; } else { print "$ref
"; } } print $Lang::tr{'none found'} unless $refs =~ /,/; print <SID: END ; if ($sid ne "n/a") { print "$sid\n"; } else { print $sid; } print < END ; $lines++; } print ""; } &oldernewer(); &Header::closebox(); &Header::closebigbox(); &Header::closepage(); sub processevent { our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs); my $filestr=''; if ($datediff==0) { $filestr="/var/log/snort/alert"; } else { $filestr="/var/log/snort/alert.$datediff"; $filestr = "$filestr.gz" if -f "$filestr.gz"; } if (!(open (LOG,($filestr =~ /.gz$/ ? "gzip -dc $filestr |" : $filestr)))) { $errormessage="$errormessage$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}"; } else { my $line = 0; while() { $line++; if ($_ =~ m/\[\*\*\]/) { unless ($line == 1 || $date ne "$monthstr/$daystr") { &append; $line = 1; } ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid) = ("n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a","n/a", "n/a"); @refs = (); $_ =~ m/:([0-9]{1,4})\] (.*) \[\*\*\]/; $title = &Header::cleanhtml($2,"y"); } if ($_ =~ m/Classification: (.*)\] \[Priority: (\d)\]/) { $classification = &Header::cleanhtml($1,"y"); $priority = $2; } if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/) { $srcip = $1 . "." . $2 . "." . $3 . "." . $4; $destip = $5 . "." . $6 . "." . $7 . "." . $8; } if ($_ =~ m/([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6}) \-\> ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\:([0-9]{1,6})/) { $srcip = $1 . "." . $2 . "." . $3 . "." . $4; $srcport = $5; $destip = $6 . "." . $7 . "." . $8 . "." . $9; $destport = $10; } if ($_ =~ m/^([0-9\/]{3,5})\-([0-9\:]{5,8})\.([0-9]{1,14})/) { ($date,$time) = ($1,$2); } if ($_ =~ m/\[Xref \=\>.*\]/) { $_ =~ s/\]\[Xref \=\> /, /g; $_ =~ m/\[Xref \=\> (.*)\]/; push(@refs, $1); } if ($_ =~ m/\[1:([0-9]+):[0-9]+\]/) { $sid = $1; } } $line++; unless ($line == 1 || $date ne "$monthstr/$daystr") { &append; } close(LOG); } } sub append { our ($title,$classification,$priority,$date,$time,$srcip,$srcport,$destip,$destport, $sid, @refs); $log[$lines] = "$date $time|$title|$priority|$classification|$srcip|$srcport|$destip|$destport|$sid|"; foreach $_ (@refs) { $log[$lines] = "$log[$lines]$_,"; } $lines++; } sub oldernewer { print < END ; print ""; if ($prev != -1) { print "$Lang::tr{'older'}"; } else { print "$Lang::tr{'older'}"; } print "\n"; print ""; if ($next != -1) { print "$Lang::tr{'newer'}"; } else { print "$Lang::tr{'newer'}"; } print "\n"; print < END ; }