<?php
/*
$Id: packet.php 579 2014-05-17 21:23:44Z bhockney $
(C) 2003-2014 by Bob Hockney <zeus@ix.netcom.com>

packet detail web output

This code is distributed under the terms of GNU GPL
*/
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" 
		"http://www.w3.org/TR/REC-html40/loose.dtd">
<html>
<head>
  <title><?php print "{$config["title"]}"; ?></title>
  <LINK REL=StyleSheet HREF="style.css" TYPE="text/css" MEDIA=screen>
</head>

<body bgcolor=#FFFFFF>
	<?php if ($config["debug"]) include "include/debug.php"; ?>
	<div align="center"><h1><?php print "{$config["title"]}"; ?></h1></div>
<?php
	$link = db("open", "$database");

	$rownum = 0;

	if ($source == "syslog") {
		$FWLOG["c_oob_in"]=0;
		$FWLOG["c_oob_out"]=0;
		$FWLOG["c_id"]=0;
		$FWLOG["c_raw_mac"]=0;
		$FWLOG["c_local_time"]=0;
		$FWLOG["c_local_hostname"]=0;
		$FWLOG["c_oob_prefix"]=0;
		$FWLOG["c_oob_mark"]=0;
		$FWLOG["c_oob_family"]=0;
		$FWLOG["c_ip_protocol"]=0;
		$FWLOG["c_ip_saddr"]=0;
		$FWLOG["c_ip_daddr"]=0;
		$FWLOG["c_ip_tos"]=0;
		$FWLOG["c_ip_ttl"]=0;
		$FWLOG["c_ip_totlen"]=0;
		$FWLOG["c_ip_ihl"]=0;
		$FWLOG["c_ip_id"]=0;
		$FWLOG["c_ip_fragoff"]=0;
		$FWLOG["c_ip6_flowlabel"]=0;
		$FWLOG["c_ip6_payloadlen"]=0;
		$FWLOG["c_sport"]=0;
		$FWLOG["c_src_service"]=0;
		$FWLOG["c_dport"]=0;
		$FWLOG["c_dst_service"]=0;
		$FWLOG["c_tcp_seq"]=0;
		$FWLOG["c_tcp_ackseq"]=0;
		$FWLOG["c_tcp_window"]=0;
		$FWLOG["c_tcp_options"]=0;
		$FWLOG["c_tcp_urgp"]=0;
		$FWLOG["c_udp_len"]=0;
		$FWLOG["c_icmptype"]=0;
		$FWLOG["c_icmpcode"]=0;
		$FWLOG["c_icmpechoid"]=0;
		$FWLOG["c_icmpechoseq"]=0;
		$FWLOG["c_icmp_gateway"]=0;
		$FWLOG["c_icmp_fragmtu"]=0;
		$FWLOG["c_oob_protocol"]=0;
		$FWLOG["c_mac_saddr_str"]=0;
		$FWLOG["c_mac_daddr_str"]=0;
		$FWLOG["c_pwsniff_user"]=0;
		$FWLOG["c_pwsniff_pass"]=0;
		$FWLOG["c_ahesp_spi"]=0;
		$FWLOG["c_tcp_options"]=0;

		require "syslog.php";

		$fields = array();

		if ($config["debug"] >= 2) print "<pre>".htmlspecialchars("$query", ENT_QUOTES)."</pre>";
		if (isset($FWLOG["be_verbose"]) and isset($config["allow_be_verbose"])) {
			print "<pre>";
			print "Exit code: $retval\n";
			print htmlspecialchars("$prog_params", ENT_QUOTES)."\n";
			while($line = db("nextrow", $result, "$source")) {
				print htmlspecialchars("$line", ENT_QUOTES)."\n";
			}
			print "</pre>\n";
		} else while($line = db("nextrow", $result, "$source")) {}

		if ($source == "syslog")
			$db_data = $source;
		else
			$db_data = $link;
		$colnum = 0;
		while ($name = db("nextfield", $result, $db_data)) {
			$fields[] = "$name";
		}
		$rownum = $rownum + 1;
	} else { // $source = "sql"
		$query = "SELECT * FROM {$FWLOG['w_sname']} t WHERE t.{$config["data_id"]}={$FWLOG["w_id"]}";
		if (isset($FWLOG["be_verbose"]) and isset($config["allow_be_verbose"])) {
			print "<pre>";
			print htmlspecialchars("$query", ENT_QUOTES)."\n";
			print "</pre>\n\n";
		}
		if (isset($FWLOG["upd_hosts"]) or (isset($FWLOG["action"])
				and strtolower("{$FWLOG["action"]}") == "update hosts")) {
			$sql_update = "yes";
			if (isset($FWLOG["action"]) and strtolower("{$FWLOG["action"]}") == "update hosts") {
				$FWLOG["c_src_host"] = "yes";
				$FWLOG["c_dst_host"] = "yes";
			}
			$where = "t.{$config["data_id"]}={$FWLOG["w_id"]}\n";
			db("statement", "CREATE TEMPORARY TABLE $tmp_output AS\n$query", $link);
			include "include/update_cache.php";
		}
		$result = db("statement", "$query", $link);
		$rownum = 0;
	}

	$line = db("nextrow", $result, "$source");

	foreach ($line as $key => $value) {
		if (is_numeric($value) and isset($config["format.$key"]))
			$line["$key"] = sprintf($config["format.$key"], $value);
	}

?>

<table align="center">
<tr>
<td colspan="2" align="center">
	<h1>
		<?php
			if ($source == "syslog") {
				print "Details for log file ".htmlspecialchars("{$FWLOG['syslog_file']}", ENT_QUOTES).
					", line ".htmlspecialchars("{$FWLOG['w_id']}", ENT_QUOTES);
			} else {
				print "Details for packet ".htmlspecialchars("{$line["{$config["data_id"]}"]}", ENT_QUOTES);
			}
		?>
	</h1>
	<table border=1>
	<caption><strong><font size="+2">Local Info</font></strong></caption>
		<?php if (isset($line["local_hostname"]) and $line["local_hostname"]) { ?>
		<tr class=t_sheader>
			<td><?php print "{$longnames["local_hostname"]}"; ?></td>
			<td><?php print "".htmlspecialchars("{$line["local_hostname"]}", ENT_QUOTES); ?></td>
		</tr>
		<?php } if (isset($line["local_time"]) and $line["local_time"]) { ?>
		<tr>
			<td><?php print "{$longnames["local_time"]}"; ?></td>
			<td><?php print date("{$config["dformat"]}", $line["local_time"]); ?></td>
		</tr>
		<?php } if (isset($line["oob_time_sec"]) and $line["oob_time_sec"]) { ?>
		<tr>
			<td><?php print "{$longnames["oob_time_sec"]}"; ?></td>
			<td><?php print date("{$config["dformat"]}", $line["oob_time_sec"]); ?></td>
		</tr>
		<?php } ?>
<?php
	$localdata = array();
	if (!($source == "syslog"))
		$localdata[] = "oob_time_usec";
	$localdata[] = "oob_hook";
	$localdata[] = "oob_in";
	$localdata[] = "oob_out";
	$localdata[] = "oob_prefix";
	$localdata[] = "oob_family";
	$localdata[] = "oob_mark";
	$localdata[] = "raw_type";
	$localdata[] = "oob_protocol";
	$localdata[] = "mac_saddr_str";
	$localdata[] = "mac_daddr_str";
	$localdata[] = "raw_mac";

	foreach ($localdata as $l) {
		if ("$l" == "raw_mac")
			$m = $config["mac_str"];
		else
			$m = $l;
		if (isset($line["$m"]) and $line["$m"]) { ?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
			<td><?php print "".htmlspecialchars("{$line["$m"]}", ENT_QUOTES); ?></td>
		</tr>
<?php	}
	} ?>
	</table>
</td>
</tr>

<tr>
<td valign="top">
	<br>
	<table border=1>
	<caption><strong><font size="+2">IP headers</font></strong></caption>
		<tr>
			<td>
			<?php print "{$longnames["ip_saddr"]}"; ?></td>
			<td>
			<?php
				if ($config["iptype"] == "int") {
					if (isset ($line["ip_saddr{$config["addr_type"]}"])) $addr = long2ip($line["ip_saddr{$config["addr_type"]}"]);
					if ($config["wfwl_iptype"] <> "int") {
						$line["ip_saddr{$config["addr_type"]}"] = long2ip("{$line["ip_saddr{$config["addr_type"]}"]}");
					}
				} elseif ($config["iptype"] == "bin") {
					if (isset ($line["ip_saddr{$config["addr_type"]}"]))
						if (bin2hex(substr($line["ip_saddr{$config["addr_type"]}"],0,12)) == "00000000000000000000ffff")
							$addr = $php_inet_ntop(substr($line["ip_saddr{$config["addr_type"]}"],12));
						else
							$addr = $php_inet_ntop($line["ip_saddr{$config["addr_type"]}"]);
				} else {
					if (isset ($line["ip_saddr{$config["addr_type"]}"])) $addr = "{$line["ip_saddr{$config["addr_type"]}"]}";
					if ($config["wfwl_iptype"] == "int") {
						$line["ip_saddr{$config["addr_type"]}"] = ip2long("{$line["ip_saddr{$config["addr_type"]}"]}");
						if ($line["ip_saddr{$config["addr_type"]}"] < 0) $line["ip_saddr{$config["addr_type"]}"] += pow(2,32);
					}
				}
				print "$addr";
			?>
			</td>
		</tr>
<?php
	if (isset($line["src_host"]) and "{$line["src_host"]}" <> "-") {
		$host = "{$line["src_host"]}";
	} else {
		if ($config["have_hostnames"]) {
			if ($config["wfwl_iptype"] == "int")
				$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_aton('$addr');", $link);
			elseif ($config["wfwl_iptype"] == "bin")
				$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_pton(".AF_INET6.", '$addr');", $link);
			else
				$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr='{$line["ip_saddr{$config["addr_type"]}"]}'::inet;", $link);
			$rownum = 0;
			$l = db("nextrow", $res);
			$host = $l["hostname"];
			if ($host == "") $host = "-";
		} else {
			$host = "-";
		}
	}
 ?>
		<tr>
			<td colspan="2" align="center"><?php print "$host"; ?></td>
		</tr>
		<tr>
			<td><?php print "{$longnames["ip_daddr"]}"; ?></td>
			<td>
			<?php
				if ($config["iptype"] == "int") {
					if (isset ($line["ip_daddr{$config["addr_type"]}"])) $addr = long2ip($line["ip_daddr{$config["addr_type"]}"]);
					if ($config["wfwl_iptype"] <> "int") {
						$line["ip_daddr{$config["addr_type"]}"] = long2ip("{$line["ip_daddr{$config["addr_type"]}"]}");
					}
				} elseif ($config["iptype"] == "bin") {
					if (isset ($line["ip_daddr{$config["addr_type"]}"]))
						if (bin2hex(substr($line["ip_daddr{$config["addr_type"]}"],0,12)) == "00000000000000000000ffff")
							$addr = $php_inet_ntop(substr($line["ip_daddr{$config["addr_type"]}"],12));
						else
							$addr = $php_inet_ntop($line["ip_daddr{$config["addr_type"]}"]);
				} else {
					if (isset ($line["ip_daddr{$config["addr_type"]}"])) $addr = "{$line["ip_daddr{$config["addr_type"]}"]}";
					if ($config["wfwl_iptype"] == "int") {
						$line["ip_daddr{$config["addr_type"]}"] = ip2long("{$line["ip_daddr{$config["addr_type"]}"]}");
						if ($line["ip_daddr{$config["addr_type"]}"] < 0) $line["ip_daddr{$config["addr_type"]}"] += pow(2,32);
					}
				}
				print "$addr";
			?>
			</td>
		</tr>
<?php
	if (isset ($line["dst_host"]) and "{$line["dst_host"]}" <> "-") {
		$host = "{$line["dst_host"]}";
	} else {
		if ($config["have_hostnames"]) {
			if ($config["wfwl_iptype"] == "int")
				$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_aton('$addr');", $link);
			elseif ($config["wfwl_iptype"] == "bin")
				$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_pton(".AF_INET6.", '$addr');", $link);
			else
				$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr='{$line["ip_daddr{$config["addr_type"]}"]}'::inet;", $link);
			$rownum = 0;
			$l = db("nextrow", $res);
			$host = $l["hostname"];
			if ($host == "") $host = "-";
		} else {
			$host = "-";
		}
	}
 ?>
		<tr>
			<td colspan="2" align="center"><?php print "$host"; ?></td>
		</tr>
<?php

	$ipdata = array(
		"ip_protocol",
		"ip_tos",
		"ip_ttl",
		"ip_totlen",
		"ip_ihl",
		"ip6_payloadlen",
		"ip6_priority",
		"ip6_hoplimit",
		"ip6_flowlabel",
		"ip_id",
		"ip_fragoff",
		"ip6_fragid",
		"ip6_fragoff",
		"ip_csum"
	);

	if (!($source == "syslog")){
		$proto_out["pnum"] = $line["ip_protocol"];
		$proto_out["pname"] = getprotobynumber($line["ip_protocol"]);
	} else {
	 	$proto_out["pnum"] = getprotobyname($line["ip_protocol"]);
		$proto_out["pname"] = $line["ip_protocol"];
		if ($proto_out["pnum"] < 0 or !$proto_out["pnum"]) {
			$proto_out["pnum"] = $proto_out["pname"];
		}
	}

	foreach ($ipdata as $l) {
		if (isset($line["$l"]) and $line["$l"]) {
		switch ("$l") {
			case "ip_fragoff":
				$flags = " ";
				$offset = $line["$l"] & ~0x4000; // IP_DF
				$offset = $offset & ~0x2000; // IP_MF
				if (($line["$l"] & 0x4000) <> 0 ) $flags = $flags . "DF ";
				if (($line["$l"] & 0x2000) <> 0 ) $flags = $flags . "MF ";
?>
			<tr>
				<td><?php print "Fragment Flags"; ?></td>
				<td><?php print "$flags";?></td>
			</tr>
			<tr>
				<td><?php print "Fragment offset"; ?></td>
				<td><?php print "$offset";?></td>
			</tr>
			<?php 	break;
			case "ip_protocol": ?>
			<tr>
				<td><?php print "{$longnames["$l"]}"; ?></td>
				<td><?php print "{$proto_out["pnum"]}";
					if ($proto_out["pname"] and $proto_out["pnum"] <> $proto_out["pname"]) print " --&gt; {$proto_out["pname"]}" ?></td>
			</tr>
			<?php	break;
			default: ?>
			<tr>
				<td><?php if (isset($line["$l"])) print "{$longnames["$l"]}"; ?></td>
				<td><?php print "{$line["$l"]}" ?></td>
			</tr>
<?php
			break;
		}
		}
	}
?>
	</table>
</td>
<td valign="top">
<?php
	switch ($proto_out["pnum"]) {
		case 17:
	$udpdata = array(
		"udp_sport",
		"udp_dport",
		"udp_len",
	);
?>
	<br>
	<table border=1>
	<caption><strong><font size="+2">Protocol UDP</font></strong></caption>
<?php
	foreach ($udpdata as $l) {
		unset ($servicename);
		if ($l == "udp_dport" or $l == "udp_sport") {
		if ($source == "syslog") {
			$l = substr($l, 4);
			if ("$l" == "sport") $servicename = "{$line["src_service"]}";
			if ("$l" == "dport") $servicename = "{$line["dst_service"]}";
		}
		if (!isset($servicename) or "$servicename" == "-"){
			$servicename = getservbyport($line["$l"], "udp");
		}
?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
			<td><?php print "{$line["$l"]}" ?></td>
			<td><?php print "&nbsp; $servicename"; ?></td>
		</tr>
<?php
		} else {
			if (isset($line["$l"]) and $line["$l"]) {
?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
			<td><?php print "{$line["$l"]}" ?></td>
			<td>&nbsp;</td>
		</tr>
<?php	}
		}
	}
?>
	</table>

<?php
			break;
		case  6:
	$tcpdata = array(
		"tcp_sport",
		"tcp_dport",
		"tcp_seq",
		"tcp_ackseq",
		"tcp_window",
	);
?>
	<br>
	<table border=1>
	<caption><strong><font size="+2">Protocol TCP</font></strong></caption>
<?php
	foreach ($tcpdata as $l) {
		unset ($servicename);
		if ($l == "tcp_dport" or $l == "tcp_sport") {
		if ($source == "syslog") {
			$l = substr($l, 4);
			if ("$l" == "sport") $servicename = "{$line["src_service"]}";
			if ("$l" == "dport") $servicename = "{$line["dst_service"]}";
		}
		if (!isset($servicename) or "$servicename" == "-"){
			$servicename = getservbyport($line["$l"], "tcp");
		}
?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
			<td><?php print "{$line["$l"]}" ?></td>
			<td><?php print "&nbsp; $servicename"; ?></td>
		</tr>
<?php
		} else {
			if (isset($line["$l"]) and $line["$l"]) {
?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
			<td><?php print "{$line["$l"]}" ?></td>
			<td>&nbsp;</td>
		</tr>
<?php
		}
		}
	}
?>
	</table>
	<table border=1>
		<tr class=t_sheader>
			<td>SYN</td>
			<td>ACK</td>
			<td>FIN</td>
			<td>RST</td>
			<td>PSH</td>
			<td>URG</td>
			<td>URGP</td>
		</tr>

<?php
		if ($source == "syslog") {
			$flags = $line["tcp_options"];
			if (preg_match("/s...../", $flags ) or $flags == "SYN" ) { $line["tcp_syn"] = 1; } else { $line["tcp_syn"] = 0; } 
			if (preg_match("/.a..../", $flags )) { $line["tcp_ack"] = 1; } else { $line["tcp_ack"] = 0; }
			if (preg_match("/..f.../", $flags )) { $line["tcp_fin"] = 1; } else { $line["tcp_fin"] = 0; }
			if (preg_match("/...r../", $flags )) { $line["tcp_rst"] = 1; } else { $line["tcp_rst"] = 0; }
			if (preg_match("/....p./", $flags )) { $line["tcp_psh"] = 1; } else { $line["tcp_psh"] = 0; }
			if (preg_match("/.....u/", $flags )) { $line["tcp_urg"] = 1; } else { $line["tcp_urg"] = 0; }
		}
?>
		<tr class=t_datas>

			<td><?php if ("{$line["tcp_syn"]}" == 't' or $line["tcp_syn"] == 1)
					print 1; else print 0; ?></td>
			<td><?php if ("{$line["tcp_ack"]}" == 't' or $line["tcp_ack"] == 1)
					print 1; else print 0; ?></td>
			<td><?php if ("{$line["tcp_fin"]}" == 't' or $line["tcp_fin"] == 1)
					print 1; else print 0; ?></td>
			<td><?php if ("{$line["tcp_rst"]}" == 't' or $line["tcp_rst"] == 1)
					print 1; else print 0; ?></td>
			<td><?php if ("{$line["tcp_psh"]}" == 't' or $line["tcp_psh"] == 1)
					print 1; else print 0; ?></td>
			<td><?php if ("{$line["tcp_urg"]}" == 't' or $line["tcp_urg"] == 1)
					print 1; else print 0; ?></td>
			<td><?php if (isset ($line["tcp_urgp"])) print "{$line["tcp_urgp"]}" ?></td>
		</tr>
	</table>
<?php			break;
		case  1:
	if ("$source" == "syslog")
		$icmpdata = array(
			"icmptype",
			"icmpcode",
			"icmpechoid",
			"icmpechoseq",
			"icmp_gateway",
			"icmp_fragmtu",
		);
	else
		$icmpdata = array(
			"icmp_type",
			"icmp_code",
			"icmp_echoid",
			"icmp_echoseq",
			"icmp_gateway",
			"icmp_fragmtu",
			"icmpv6_type",
			"icmpv6_code",
			"icmpv6_echoid",
			"icmpv6_echoseq",
		);
?>
	<br>
	<table border=1>
	<caption><strong><font size="+2">Protocol&nbsp;ICMP</font></strong></caption>
<?php
	foreach ($icmpdata as $l) {
		if (preg_match("/icmp_?(type|code)/", "$l") or (isset($line["$l"]) and is_numeric($line["$l"]))) {
?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
<?php		if ("$l" == "icmp_gateway" and "{$line["$l"]}" and $config["iptype_g"] == "int") { ?>
			<td><?php print long2ip($line["$l"]);?></td>
<?php		} else { ?>
			<td><?php print "{$line["$l"]}" ?></td>
<?php		} ?>
		</tr>
<?php
		}
	}
?>
	</table>
<?php
			break;
		case  58:
	if ("$source" == "syslog")
		$icmpdata = array(
			"icmptype",
			"icmpcode",
			"icmpechoid",
			"icmpechoseq",
		);
	else
		$icmpdata = array(
			"icmpv6_type",
			"icmpv6_code",
			"icmpv6_echoid",
			"icmpv6_echoseq",
		);
?>
	<br>
	<table border=1>
	<caption><strong><font size="+2">Protocol&nbsp;ICMPv6</font></strong></caption>
<?php
	foreach ($icmpdata as $l) {
		if (preg_match("/icmp(v6)?_?(type|code)/", "$l") or (isset($line["$l"]) and is_numeric($line["$l"]))) {
?>
		<tr>
			<td><?php print "{$longnames["$l"]}"; ?></td>
			<td><?php print "{$line["$l"]}" ?></td>
		</tr>
<?php
		}
	}
?>
	</table>
<?php
			break;
		default:
			if ($proto_out["pname"]) {
				$p = $proto_out["pname"];
			} else {
				$p = $proto_out["pnum"];
			}
?>
	<br>
	<table border=1>
	<caption><strong><font size="+2">Protocol&nbsp;<?php print "$p" ?></font></strong></caption>
		<tr>
			<td><?php print "No header information available for protocol $p" ?></td>
		</tr>
	</table>
<?php
			break;
	}
?>
</td>
</tr>
<tr>
<td colspan=2>
	<form action="<?php print "$self"; ?>" method="post">
		<input type="submit" name="action" value="Resolve Hosts">
		<input type="hidden" name="w_id" value="<?php print "{$FWLOG["w_id"]}"; ?>">
<?php
		if (is_array($FWLOG))
			foreach ($FWLOG as $k => $v) {
				if ("$k" == "action" or "$k" == "w_id" or "$k" == "data_tables") continue;
				print "\t\t<input type=\"hidden\" name=\"".htmlspecialchars("$k", ENT_QUOTES).
					"\" value=\"".htmlspecialchars("$v", ENT_QUOTES)."\">\n";
			}
?>
	</form>
</td>
</tr>
</table>

<?php
	db("close", $link);
?>

</body>
</html>

<!-- vim:set ts=4: -->
