PHP Asset_host::get_extended_name方法代码示例

     $ctx_src = $src_host->get_ctx();
 }
 // Src icon and bold
 $src_output = Asset_host::get_extended_name($conn, $geoloc, $s_src_ip, $ctx_src, $event_info["src_host"], $event_info["src_net"]);
 $homelan_src = $src_output['is_internal'];
 $src_img = $src_output['html_icon'];
 // Dst
 if ($no_resolv || !$dst_host) {
     $s_dst_name = $s_dst_ip;
     $ctx_dst = $ctx;
 } elseif ($dst_host) {
     $s_dst_name = $dst_host->get_name();
     $ctx_dst = $dst_host->get_ctx();
 }
 // Dst icon and bold
 $dst_output = Asset_host::get_extended_name($conn, $geoloc, $s_dst_ip, $ctx_dst, $event_info["dst_host"], $event_info["dst_net"]);
 $homelan_dst = $dst_output['is_internal'];
 $dst_img = $dst_output['html_icon'];
 // Clean icon hover tiptip
 $s_src_link = Menu::get_menu_url("../forensics/base_stat_ipaddr.php?clear_allcriteria=1&ip={$s_src_ip}", 'analysis', 'security_events', 'security_events');
 $s_dst_link = Menu::get_menu_url("../forensics/base_stat_ipaddr.php?clear_allcriteria=1&ip={$s_dst_ip}", 'analysis', 'security_events', 'security_events');
 $s_src_port = $s_src_port != 0 ? ":" . Port::port2service($conn, $s_src_port) : "";
 $s_dst_port = $s_dst_port != 0 ? ":" . Port::port2service($conn, $s_dst_port) : "";
 // Reputation info
 $rep_src_icon = Reputation::getrepimg($event_info["rep_prio_src"], $event_info["rep_rel_src"], $event_info["rep_act_src"], $s_src_ip);
 //$rep_src_bgcolor  = Reputation::getrepbgcolor($event_info["rep_prio_src"]);
 $rep_dst_icon = Reputation::getrepimg($event_info["rep_prio_dst"], $event_info["rep_rel_dst"], $event_info["rep_act_dst"], $s_dst_ip);
 //$rep_dst_bgcolor  = Reputation::getrepbgcolor($event_info["rep_prio_dst"]);
 $c_src_homelan = $homelan_src ? 'bold alarm_netlookup' : '';
 $source_link = $src_img . " <a href='{$s_src_link}' class='{$c_src_homelan}' data-title='{$s_src_ip}-{$ctx_src}' title='{$s_src_ip}'>" . $s_src_name . $s_src_port . "</a> {$rep_src_icon}";
 $source_balloon = "<div id='" . $s_src_ip . ";" . $s_src_name . ";" . $event_info["src_host"] . "' ctx='{$ctx}' id2='" . $s_src_ip . ";" . $s_dst_ip . "' class='HostReportMenu'>";

             <td style="width:80mm;" valign="top">
                 <table style="width:80mm; padding-top: 10px; padding-bottom: 10px;">
                     <tr>
                         <th>' . gettext("Host") . '</th>
                         <th class="center">' . gettext("Occurrences") . '</th>
                     </tr>');
 $c = 0;
 $shared_file = $dDB["_shared"]->dbfile();
 $dDB["_shared"]->put("SS_AttackedHost" . $runorder, $list);
 $font_size = getFontSizeSIEM($list);
 foreach ($list as $l) {
     $ip = $l[0];
     $occurrences = number_format($l[1], 0, ",", ".");
     $host_id = $l[2];
     $ctx = $l[3] != '' ? $l[3] : Session::get_default_ctx();
     $host_output = Asset_host::get_extended_name($security_report->ossim_conn, $geoloc, $ip, $ctx, $host_id);
     $os_pixmap = $host_id != "" ? Asset_host_properties::get_os_by_host($security_report->ossim_conn, $host_id) : "";
     $hostname = $host_id != "" ? $host_output['name'] : $ip;
     $icon = $host_output['html_icon'];
     $link = "{$acid_link}/" . $acid_prefix . "_stat_alerts.php?&" . "num_result_rows=-1&" . "submit=Query+DB&" . "current_view=-1&" . "ip_addr[0][1]={$target}&" . "ip_addr[0][2]==&" . "ip_addr[0][3]={$ip}&" . "ip_addr_cnt=1&" . "sort_order=time_d";
     $bc = $c++ % 2 != 0 ? "class='par'" : "";
     $htmlPdfReport->set('
                             <tr ' . $bc . '>
                                 <td style="width:55mm;font-size:' . $font_size . 'px">' . $icon . ' ' . Util::wordwrap($hostname, 21, " ", true) . ' ' . $os_pixmap . '</td>
                                 <td style="width:22mm;text-align:center;font-size:' . $font_size . 'px">' . $occurrences . '</td>
                             </tr>');
 }
 $htmlPdfReport->set('
                 </table>
             </td>
         <td valign="top" style="padding-top:15px; width:98mm;">');

//.........这里部分代码省略.........
                }
                # capture errors
                if (preg_match("/ error /i", $line, $found)) {
                    if (preg_match("/stat\\(\\) error/i", $line)) {
                        $errors[] = _('The netflow information you are trying to access either has not been processed yet or does not exist. Please check your date filters.');
                        Av_exception::write_log(Av_exception::USER_ERROR, $line);
                    } else {
                        $errors[] = $line;
                    }
                }
                # print results
                $line = preg_replace("/\\(\\s(\\d)/", "(\\1", $line);
                // Patch for ( 0.3)
                $line = preg_replace("/(\\d)\\s*([KMGT])/", "\\1\\2", $line);
                // Patch for 1.2 M(99.6)
                $line = preg_replace("/(\\d+)(TCP|UDP|ICMP|IGMP)\\s/", "\\1 \\2 ", $line);
                // Patch for 9.003TCP
                $start = $end = $proto = "";
                $ips = $ports = array();
                if (preg_match($regex, preg_replace('/\\s*/', ' ', $line), $found)) {
                    echo "<tr class='tr_flow_data'>\n";
                    foreach ($found as $ki => $field) {
                        if ($ki > 0) {
                            $wrap = $ki == 1 ? "nowrap" : "";
                            $field = Util::htmlentities(preg_replace("/(\\:\\d+)\\.0\$/", "\\1", $field));
                            if (preg_match("/(\\d+\\.\\d+\\.\\d+\\.\\d+)(.*)/", $field, $fnd)) {
                                # match ip (resolve and geolocalize)
                                $ip = $fnd[1];
                                $port = $fnd[2];
                                list($name, $ctx, $host_id) = GetDataFromSingleIp($ip, $hosts);
                                if ($name == "" && $sensors[$ip] != "") {
                                    $name = $sensors[$ip];
                                }
                                $output = Asset_host::get_extended_name($conn, $geoloc, $ip, $ctx, $host_id, '');
                                $homelan = $output['is_internal'] || $name != "" && $name != $ip;
                                $icon = $output['html_icon'];
                                # reputation info
                                if (!is_array($_SESSION["_repinfo_ips"][$ip])) {
                                    $_SESSION["_repinfo_ips"][$ip] = $rep->get_data_by_ip($ip);
                                }
                                $rep_icon = Reputation::getrepimg($_SESSION["_repinfo_ips"][$ip][0], $_SESSION["_repinfo_ips"][$ip][1], $_SESSION["_repinfo_ips"][$ip][2], $ip);
                                $rep_bgcolor = Reputation::getrepbgcolor($_SESSION["_repinfo_ips"][$ip][0]);
                                $style_aux = $homelan ? 'style="font-weight:bold"' : '';
                                $bold_aux1 = $homelan ? '<b>' : '';
                                $bold_aux2 = $homelan ? '<b>' : '';
                                $field = '<div id="' . $ip . ';' . Util::htmlentities($name) . ';' . $host_id . '" id2="' . $ip . ';' . $ip . '" ctx="' . $ctx . '" class="HostReportMenu">' . $icon . ' <a ' . $style_aux . ' href="javascript:;">' . Util::htmlentities($name) . '</a>' . $bold_aux1 . $port . $bold_aux2 . ' ' . $rep_icon . '</div>';
                                $wrap = "nowrap style='{$rep_bgcolor}'";
                                $ips[] = $ip;
                                if ($geotools) {
                                    if ($ki == 4) {
                                        $geoips['ip_src'][$ip]++;
                                    } elseif ($ki == 5) {
                                        $geoips['ip_dst'][$ip]++;
                                    }
                                }
                                $ports[] = str_replace(":", "", $port);
                            }
                            if (preg_match("/(\\d+-\\d+-\\d+ \\d+:\\d+:\\d+)(.*)/", $field, $fnd)) {
                                # match date
                                $start = $end = $fnd[1];
                                $time = strtotime($fnd[1]);
                                $field = Util::htmlentities(gmdate("Y-m-d H:i:s", $time + 3600 * $tz) . "." . $fnd[2]);
                            }
                            if (preg_match("/(TCP|UDP|ICMP|RAW)/", $field, $fnd)) {
                                # match date
                                $proto = strtolower($fnd[1]);

 } elseif ($risk > 4) {
     $rst = "style=\"padding:2px 5px 2px 5px;background-color:orange;color:black\"";
 } elseif ($risk > 2) {
     $rst = "style=\"padding:2px 5px 2px 5px;background-color:green;color:white\"";
 } else {
     $rst = "style=\"padding:2px 5px 2px 5px;color:black\"";
 }
 echo "edata[{$i}][3] = '<span {$rst}>" . $risk . "</span>';\n";
 echo "var pid = '" . $rs->fields["plugin_id"] . "';\n";
 echo "edata[{$i}][4]  = pid;\n";
 echo "edata[{$i}][5]  = '" . $rs->fields["plugin_sid"] . "';\n";
 echo "edata[{$i}][6]  = devices['ip_" . $rs->fields["device_id"] . "'];\n";
 // Assets
 $src_output = Asset_host::get_extended_name($conn, $geoloc, inet_ntop($rs->fields["ip_src"]), $rs->fields["ctx"], $rs->fields["src_host"], $rs->fields["src_net"]);
 $src_field = $src_output['is_internal'] ? $src_output['html_icon'] . ' <b>' . $src_output['name'] . '</b>' : $src_output['html_icon'] . ' ' . $src_output['name'];
 $dst_output = Asset_host::get_extended_name($conn, $geoloc, inet_ntop($rs->fields["ip_dst"]), $rs->fields["ctx"], $rs->fields["dst_host"], $rs->fields["dst_net"]);
 $dst_field = $dst_output['is_internal'] ? $dst_output['html_icon'] . ' <b>' . $dst_output['name'] . '</b>' : $dst_output['html_icon'] . ' ' . $dst_output['name'];
 echo "edata[{$i}][7]  = \"" . $src_field . "\";\n";
 echo "edata[{$i}][8]  = '" . $rs->fields["src_port"] . "';\n";
 echo "edata[{$i}][9]  = \"" . $dst_field . "\";\n";
 echo "edata[{$i}][10] = '" . $rs->fields["dst_port"] . "';\n";
 // more detail
 echo "edata[{$i}][11] = '" . $rs->fields["priority"] . "';\n";
 echo "edata[{$i}][12] = '" . $rs->fields["reliability"] . "';\n";
 echo "edata[{$i}][13] = '" . $rs->fields["interface"] . "';\n";
 echo "edata[{$i}][14] = '" . $rs->fields["protocol"] . "';\n";
 echo "edata[{$i}][15] = '" . $rs->fields["asset_src"] . "';\n";
 echo "edata[{$i}][16] = '" . $rs->fields["asset_dst"] . "';\n";
 echo "edata[{$i}][17] = '" . $rs->fields["alarm"] . "';\n";
 echo "edata[{$i}][18] = '" . $rs->fields["event_id"] . "';\n";
 if (GET('idm') == 1) {

    $aux[] = '<a href="#" data-url="' . Menu::get_menu_url(AV_MAIN_PATH . '/av_asset/common/views/detail.php?asset_id=' . $nid, 'environment', 'assets', 'networks') . '">' . Util::htmlentities($nname) . '</a>';
}
if (empty($aux)) {
    $aux[] = $empty;
}
$dst_nets = implode(', ', $aux) . (count($aux) >= $limitc ? ' [...]' : '');
$dst_groups = GetAssetGroups($db, $myrow2['dst_host'], $current_dip, $ctx, $limitc);
$aux = array();
foreach ($dst_groups as $nid => $nname) {
    $aux[] = '<a href="#" data-url="' . Menu::get_menu_url(AV_MAIN_PATH . '/av_asset/common/views/detail.php?asset_id=' . $nid, 'environment', 'assets', 'asset_groups') . '">' . Util::htmlentities($nname) . '</a>';
}
if (empty($aux)) {
    $aux[] = $empty;
}
$dst_groups = implode(', ', $aux) . (count($aux) >= $limitc ? ' [...]' : '');
$dst_output = Asset_host::get_extended_name($_conn, $geoloc, $current_dip, $ctx, $myrow2["dst_host"], $myrow2["dst_net"]);
$dip_aux = $dst_output['name'];
$dst_img = $dst_output['html_icon'];
$dst_loc = preg_match("/data-title\\s*=\\s*'([^\\d]+)'/", $dst_img, $matches) ? $dst_img . ' <a target="_blank" href="' . $gmaps_url . '">' . $matches[1] . '</a>' : '';
$ip_dst_data = (preg_match("/data-title\\s*=\\s*'\\d+/", $dst_img) ? $dst_img . ' ' : ' ') . ($myrow2['dst_host'] != '' ? '<A HREF="#" data-url="' . Menu::get_menu_url(AV_MAIN_PATH . '/av_asset/common/views/detail.php?asset_id=' . $myrow2['dst_host'], 'environment', 'assets', 'assets') . '">' : '<A HREF="#" data-url="' . AV_MAIN_PATH . '/forensics/base_stat_ipaddr.php?ip=' . $current_dip . '&amp;netmask=32">') . $dip_aux . ($current_dip == $dip_aux ? '' : ' [' . $current_dip . ']');
$reptooltip_dst = getreptooltip($idm_data["rep_prio_dst"], $idm_data["rep_rel_dst"], $idm_data["rep_act_dst"], $current_dip);
// Destination Map
$dst_latitude = $dst_longitude = 0;
if (valid_hex32($myrow2['dst_host'])) {
    if ($dst_obj = Asset_host::get_object($_conn, $myrow2['dst_host'])) {
        $coordinates = $dst_obj->get_location();
        if (floatval($coordinates['lat']) != 0) {
            $dst_latitude = floatval($coordinates['lat']);
        }
        if (floatval($coordinates['lon']) != 0) {
            $dst_longitude = floatval($coordinates['lon']);

preg_match_all("/(\\d+)\\s(\\w+)/", strip_tags(trim($alarm_life)), $found);
$alarm_life_number = $found[1][0];
$alarm_life_unit = $found[2][0];
$show_total = false;
$removable = $alarm->get_removable();
$backlog_id = $alarm->get_backlog_id();
$event_id = $alarm->get_event_id();
/* Buttons */
$alarm_detail_url = empty($stats) ? "load_alarm_detail('{$event_id}', 'event')" : "load_alarm_detail('{$backlog_id}', 'alarm')";
$alarm_close_url = "tray_close('{$backlog_id}');";
$alarm_open_url = "open_alarm('{$backlog_id}');";
$alarm_delete_url = "tray_delete('{$backlog_id}');";
/* Source Home */
$_home_src = Asset_host::get_extended_name($conn, $geoloc, $alarm->get_src_ip(), $ctx, $event["_SRC_HOST"], $event["_SRC_NET"]);
/* Destination Home */
$_home_dst = Asset_host::get_extended_name($conn, $geoloc, $alarm->get_dst_ip(), $ctx, $event["_DST_HOST"], $event["_DST_NET"]);
/* Detail */
$alarm_name = Util::translate_alarm($conn, $alarm->get_sid_name(), $alarm, 'array');
if ($alarm_name["id"] != '') {
    $alarm_image = file_exists("/usr/share/ossim/www/alarm/style/img/" . $alarm_name["id"] . ".png") ? "<img src='style/img/" . $alarm_name["id"] . ".png' border='0' title='" . $alarm_name["kingdom"] . "'>" : "";
    $alarm_title = $alarm_name["kingdom"] . ": <span style='font-size:15px'>" . $alarm_name["category"] . "</span>";
} else {
    $alarm_image = "";
    $alarm_title = $alarm_name['name'];
}
$promiscous_title = _(is_promiscous(count($stats['src']['ip']), count($stats['dst']['ip']), $_home_src['is_internal'], $_home_dst['is_internal']));
?>

<script language="javascript">

    // Remove tag

function ip_max_occurrences($target, $date_from, $date_to)
{
    global $NUM_HOSTS;
    global $security_report;
    global $report_type;
    global $geoloc;
    /* ossim framework conf */
    $conf = $GLOBALS['CONF'];
    $report_graph_type = $conf->get_conf('report_graph_type');
    if (!strcmp($target, "ip_src")) {
        if ($report_type == "alarm") {
            $target = "src_ip";
        }
        $title = _("Attacker hosts");
    } elseif (!strcmp($target, "ip_dst")) {
        if ($report_type == "alarm") {
            $target = "dst_ip";
        }
        $title = _("Attacked hosts");
    }
    $list = $security_report->AttackHost($target, $NUM_HOSTS, $report_type, $date_from, $date_to);
    if (!is_array($list) || empty($list)) {
        return 0;
    }
    ?>
    <table class='t_alarms'>
        <thead>
            <tr><td colspan='2' class="headerpr"><?php 
    echo _("Top");
    echo " {$NUM_HOSTS} {$title}";
    ?>
</td></tr>
        </thead>
        
        <tbody>
            <tr>
                <td class='td_container'>
                    <table class="table_data">
                        <thead>                     
                            <tr>
                                <th> <?php 
    echo _("Host");
    ?>
 </th>
                                <th> <?php 
    echo _("Occurrences");
    ?>
 </th>
                            </tr>
                        </thead>
                        
                        <tbody>
                        <?php 
    foreach ($list as $l) {
        $ip = $l[0];
        $occurrences = number_format($l[1], 0, ",", ".");
        $id = $l[2];
        $ctx = $l[3];
        $host_output = Asset_host::get_extended_name($security_report->ossim_conn, $geoloc, $ip, $ctx, $id);
        $hostname = $host_output['name'];
        $icon = $host_output['html_icon'];
        $os = valid_hex32($id) ? Asset_host_properties::get_os_by_host($security_report->ossim_conn, $id) : "";
        $os_pixmap = preg_match("/unknown/", $os) ? '' : $os;
        $bold = $host_output['is_internal'];
        ?>
                            <tr>
                                <td class='td_data <?php 
        if ($bold) {
            echo 'bold';
        }
        ?>
'>                                
                                    <?php 
        echo $icon . ' ' . $hostname . ' ' . $os_pixmap;
        ?>
                                </td>
                                <td class='td_data'><?php 
        echo $occurrences;
        ?>
</td>
                            </tr>
                            <?php 
    }
    ?>
                        </tbody>
                    </table>
                </td>
                
                <td class='td_container'>
                    <?php 
    if ($report_graph_type == "applets") {
        jgraph_attack_graph($target, $NUM_HOSTS);
    } else {
        ?>
                        <img src="graphs/attack_graph.php?target=<?php 
        echo $target;
        ?>
&hosts=<?php 
        echo $NUM_HOSTS;
        ?>
//.........这里部分代码省略.........

$event_info = Alarm::get_event($conn, $alarm->get_event_id());
//alarm source and detination
$src = $stats['src'];
$dst = $stats['dst'];
$alarm_name = Util::translate_alarm($conn, $alarm->get_sid_name(), $alarm, 'array');
if (!empty($alarm_name['subcategory'])) {
    $alarm_tr = Util::translate_alarm($conn, $alarm_name['subcategory'], $alarm, 'array');
    $alarm_name['subcategory'] = $alarm_tr['name'];
}
$event_number = $stats['events'];
$alarm_time = get_alarm_life($alarm->get_since(), $alarm->get_last());
$alarm_life = get_alarm_life($alarm->get_last(), gmdate("Y-m-d H:i:s"), 'ago');
/* Source */
$_home_src = Asset_host::get_extended_name($conn, $gl, $alarm->get_src_ip(), $ctx, $event_info["src_host"], $event_info["src_net"]);
/* Destination */
$_home_dst = Asset_host::get_extended_name($conn, $gl, $alarm->get_dst_ip(), $ctx, $event_info["dst_host"], $event_info["dst_net"]);
//Alarm Attack Pattern
$attack_pattern = _(is_promiscous(count($src['ip']), count($dst['ip']), $_home_src['is_internal'], $_home_dst['is_internal']));
//Getting the tags
$_tags = Tag::get_tags_by_component($conn, $backlog_id);
$tag_list = array();
foreach ($_tags as $tag_id => $tag) {
    $tag_list[$tag_id] = array('id' => $tag_id, 'name' => $tag->get_name(), 'class' => $tag->get_class());
}
//Alarm Status
if ($alarm->get_removable() === 0) {
    $status = 'correlating';
} else {
    $status = $alarm->get_status();
}
//Alarm JSON Info

        $location = _('Unknown');
        $flag = '';
    }
}
// HOME IP
$vulns = -1;
$_ctx = $ctx;
$homelan = '';
$hostname = '';
$_net_id = preg_match('/src/', $prefix) ? $event_info['src_net'] : $event_info['dst_net'];
$host_obj = Asset_host::get_object($conn, $uuid, TRUE);
if (is_object($host_obj)) {
    $hostname = $host_obj->get_name();
    $_ctx = $host_obj->get_ctx();
}
$host_output = Asset_host::get_extended_name($conn, $geoloc, $ip, $_ctx, $uuid, $_net_id);
$homelan = $host_output['is_internal'] ? 'bold' : '';
if ($homelan) {
    $location = '<strong>' . _('UNKNOWN') . '</strong>';
    $vulns = Vulnerabilities::get_latest_vulns($conn, $ip);
}
$net = array_shift(Asset_host::get_closest_net($conn, $ip, $_ctx));
if (is_array($net) && !empty($net)) {
    $location = '';
    if ($net['icon'] != '') {
        $location = "<img src='data:image/png;base64," . base64_encode($net['icon']) . "' border='0'> ";
    }
    $location .= '<strong>' . strtoupper($net['name']) . '</strong> (' . $net['ips'] . ')';
}
// OTX / Vulns
$subfix = str_replace('_t', '_', $prefix);