File Source for port

#!/usr/bin/php
<?php
/**
* /opt/nac/bin/portscan
*
* Long description for file:
* Learn open ports from equipments allowed
* Currently it has 3 modes of operation:
* Normal: Without parameters
* Will get ips from devices allowed in the network and will scan them
* Scannow: With the parameter "scannow"
* Will get ips which have the scannow value set to 1 no matter if
* they are allowed in the network or not
* Manual:
* Every parameter passed through the command line will be taken
* as an ip to be scanned. No to be used in combination with the
* "scannow" parameter
*
* Important: You have to define first networks to scan in the
* nac_netsallowed table
*
* PHP version 5
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as published
* by the Free Software Foundation.
*
* @package FreeNAC
* @author Héctor Ortiz (FreeNAC Core Team)
* @copyright 2006 FreeNAC
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License Version 2
* @version SVN: $Id$
* @link http://www.freenac.net
*
*/
require_once "funcs.inc.php";
$output=TRUE;
$logger->setDebugLevel(0);
$logger->setLogToStdOut(false);
#Compatibility with old vars
if (!$conf->scan_directory && $conf->nmap_scan_directory)
$scan_directory=$conf->nmap_scan_directory;
else
$scan_directory=$conf->scan_directory;
if (!$conf->what_units_time && $conf->nmap_what_units_time)
$what_units_time=$conf->nmap_what_units_time;
else
$what_units_time=$conf->what_units_time;
if (!$conf->time_threshold && $conf->nmap_time_threshold)
$time_threshold=$conf->nmap_time_threshold;
else
$time_threshold=$conf->time_threshold;
if (!$conf->which_nmap && $conf->nmap_path)
$which_nmap=$conf->nmap_path;
else
$which_nmap=$conf->which_nmap;
check_requirements();
//If we get up to this point, life is good
$queries['number']=0;
$queries['messages']=0;
$flagscannow=0;
for ($i=0;$i<$argc;$i++)
{
if ($argv[$i]=="--scannow")
$flagscannow++;
else if ($argv[$i]=="--verbose")
$logger->setDebugLevel(1);
}
if ($flagscannow)
$output=FALSE;
message("Doing port_scan to sytems... Please wait...\n");
$logger->debug("port_scan started");
$file_timestamp=date('Y-m-d H:i:s');
$file_timestamp=str_replace(' ','-',$file_timestamp);
$scan_results=$scan_directory."/scan-$file_timestamp.xml"; //Scan file
$logger->debug("Scan file: $scan_results"); //Parameters from port_scan.inc
$logger->debug("Nmap flags: ".$conf->nmap_flags);
if (($what_units_time<0)||($what_units_time>6)||($what_units_time==2))
$string=$time_threshold." hours";
else if ($what_units_time==0)
$string=$time_threshold." seconds";
else if ($what_units_time==1)
$string=$time_threshold." minutes";
else if ($what_units_time==3)
$string=$time_threshold." days";
else if ($what_units_time==4)
$string=$time_threshold." weeks";
else if ($what_units_time==5)
$string=$time_threshold." months";
else if ($what_units_time==6)
$string=$time_threshold." years";
$logger->debug("Last_seen threshold: $string");
if ($argc==1) //Running mode
$logger->debug("Running mode: Normal");
else if ($flagscannow)
$logger->debug("Running mode: Scannow");
else $logger->debug("Running mode: Manual");
$list=scan($scan_results,$conf->nmap_flags); //Scan network with those flags
if ( ! is_array($list) || (count($list) == 0) )
check_and_abort("No info retrieved from the scan", 0);
$var=parse_scanfile($scan_results,$list); //Parse the xml file
if ($var['equipments']>0)
do_inventory($var); //Check against database
else
$var['equipments']=0;
syscall("rm $scan_results");
message("port_scan finished normally. ".$var['equipments']." hosts scanned\n");
$logger->debug("port_scan finished normally. ".$var['equipments']." hosts scanned\n");
if ($flagscannow)
log2db('info',"port_scan finished normally. ".$var['equipments']." hosts scanned");
function check_requirements() //Checks for required functions and tables structure
{
global $conf,$what_units_time, $scan_directory, $time_threshold, $which_nmap;
$functions=get_defined_functions();
$functions=$functions['user']; //A little bit of paranoia :)
if (!in_array('logit',$functions))
check_and_abort("Function logit not defined in funcs.inc\n",0);
if (!in_array('db_connect',$functions))
check_and_abort("Function db_connect not defined in funcs.inc\n",0);
if (!in_array('syscall',$functions))
check_and_abort("Function syscall not defined in funcs.inc\n",0);
if (!in_array('normalise_mac',$functions))
check_and_abort("Function normalise_mac not defined in funcs.inc\n",0);
if (!in_array('log2db',$functions))
check_and_abort("Function log2db not defined in funcs.inc\n",0);
if (!$which_nmap)
check_and_abort("Var \$which_nmap not defined in port_scan.inc\n",0);
if (!$scan_directory)
check_and_abort("Var \$scan_directory not defined in port_scan.inc\n",0);
if (!$scan_directory)
check_and_abort("Required directory $scan_directory doesn't exist\n",0);
if (!$time_threshold)
check_and_abort("Var \$time_threshold not defined in port_scan.inc\n",0);
if (!$what_units_time)
check_and_abort("Var \$what_units_time not defined in port_scan.inc\n",0);
$query="describe systems;";
$res=execute_query($query);
check_and_abort("Please make sure you have properly installed FreeNAC\n",$res);
$query="describe nac_hostscanned;";
$res=execute_query($query);
check_and_abort("Please make sure you have properly followed the doc file README.port_scan\n",$res);
$query="describe nac_openports;";
$res=execute_query($query);
check_and_abort("Please make sure you have properly followed the doc file README.port_scan\n",$res);
$query="describe subnets;";
$res=execute_query($query);
check_and_abort("Please make sure you have properly followed the doc file README.port_scan\n",$res);
$query="describe services;";
$res=execute_query($query);
check_and_abort("Please make sure you have properly followed the doc file README.port_scan\n",$res);
$query="describe protocols;";
$res=execute_query($query);
check_and_abort("Please make sure you have properly followed the doc file README.port_scan\n",$res);
$tmp=syscall($which_nmap." --version | grep -i nmap");
$nmap_string = NULL;
$nmap_version = NULL;
if ( $tmp )
{
$tmp=explode(" ",$tmp);
$nmap_string=$tmp[0];
$nmap_version=$tmp[2];
}
if (isset($nmap_string)&&(strcasecmp($nmap_string,"nmap")!=0))
check_and_abort("Nmap seems not to be installed in your system\n",0);
#if (isset($nmap_version)&&($nmap_version<4.11))
if (isset($nmap_version)&&($nmap_version<4.10))
check_and_abort("You need a newer version of nmap\n",0);
if (!$conf->nmap_flags)
check_and_abort("Var \$nmap_flags not defined in port_scan.inc\n",0);
}
function message($string)
{
global $output,$logger,$output_to_syslog;
if (($output===TRUE)&&(!$logger->getDebugLevel()))
{
if ($output_to_syslog===TRUE)
{
$logger->logit($string);
//log2db('info',$string);
}
else
{
$logger->setLogToStdOut();
$logger->logit($string);
$logger->setLogToStdOut(false);
}
}
}
function validate($string)
{
rtrim($string,' ');
if (get_magic_quotes_gpc()) {
$value=stripslashes($string);
}
if (!is_numeric($string)) {
$string= mysql_real_escape_string($string);
}
return $string;
}
function do_something($query) //Let's do something with our structure
{
global $logger;
if ( isset($query['number']) )
$queries=$query['number']; //How many queries we have?
else
$queries = 0;
if ( isset($query['messages']) )
$messages=$query['messages']; //How many messages?
else
$messages = 0;
for ($i=0;$i<$queries;$i++)
{
if ( isset($query['query'][$i]) )
execute_query($query['query'][$i]); //Execute the queries
}
for ($i=0;$i<$messages;$i++)
if ( isset($query['message'][$i]) )
$logger->debug($query['message'][$i]); //And display the messages
}
function update_queries($mesg,$what)
{
global $queries; //Here we hold messages and queries
if ($what=='q')
{
if ( ! isset($queries['query'][$queries['number']]) )
$queries['query'][$queries['number']]=$mesg; //This is a query
if ( ! isset($queries['number']) )
$queries['number'] = 0;
$queries['number']++; //Count queries
}
else if ($what=='m')
{
if ( ! isset($queries['message'][$queries['messages']]) )
$queries['message'][$queries['messages']]=$mesg; //This is a message
if ( ! isset($queries['messages']) )
$queries['messages'] = 0;
$queries['messages']++; //Count messages
}
}
function do_inventory($data_from_xml)
{
global $queries;
for ($i=0;$i<$data_from_xml['equipments'];$i++) //How many hosts scanned
{
if ( isset($data_from_xml[$i]['ip']) )
$ip=$data_from_xml[$i]['ip']; //Get ip of one host
else
$ip = 0;
if ( isset($data_from_xml[$i]['sid']) )
$id=$data_from_xml[$i]['sid'];
else
$id = 0;
$query=sprintf("select * from nac_hostscanned where sid='%s';",mysql_real_escape_string($id));
$res=execute_query($query);
if ($res)
{
if (mysql_num_rows($res) ==0)
add_entry($data_from_xml[$i]);//Host not found in database
else
check_existent($data_from_xml[$i]); //Host in database, let's see if something has changed
}
}
do_something($queries); //Do something with the structure
}
function check_existent($data) //This function will check info concerning one host scanned against its info in the database
{
global $logger, $queries;
$timestamp=date('Y-m-d H:i:s');
if ((!isset($data))||(!is_array($data)))
check_and_abort("There was a problem parsing the XML file. Make sure you have the right version of PHP and libXML in your system",0);
if ( isset($data['ip']) )
$ip=$data['ip'];
else
$ip = 0;
if ( isset($data['ports']) )
$ports=$data['ports']; //Number of open ports this time
else
$ports = 0;
if ( isset($data['hostname']) )
$hostname=strtolower($data['hostname']);
else
$hostname = '';
if ( isset($data['os']) )
$os=$data['os']; //OS system this time
else
$os = '';
if ( isset($data['sid']) )
$id=$data['sid'];
else
$id = 0;
$query=sprintf("select * from nac_hostscanned where sid='%s';",mysql_real_escape_string($id));
$res=execute_query($query);
if ($res)
{
$result=mysql_fetch_array($res, MYSQL_ASSOC);
$db_ports=mysql_num_rows($res);
$db_ip=$result['ip']; //Same IP from last time?
$db_hostname=strtolower($result['hostname']); //Same hostname from last time?
$db_os=$result['os']; //Same OS from last time?
$db_timestamp=$result['timestamp']; //If it changed, since when?
$host_changed=$os_changed=$mac_changed=0; //To control if we need to update its record in the database
if (!empty($hostname)&&!empty($db_hostname)&&(strcasecmp($hostname,$db_hostname)!=0)) //Info about its hostname
{
if ((strcasecmp($db_hostname,'NULL')==0)&&(strcasecmp($hostname,'NULL')!=0))
{
update_queries("Host $ip has its hostname resolved now. $ip is $hostname\n",'m');
$host_changed++;
}
else if ((strcasecmp($db_hostname,'unknown')==0)&&(strcasecmp($hostname,'NULL')!=0))
{
update_queries("Host $ip has its hostname resolved now. $ip is $hostname\n",'m');
$host_changed++;
}
else if ((strcasecmp($db_hostname,'NULL')!=0)&&(strcasecmp($hostname,'NULL')==0))
{
update_queries("Unable to resolve $ip this time, old hostname $db_hostname preserved\n",'m');
$mac=$db_mac;
}
else
{
update_queries("Old hostname $db_hostname no longer valid. Renamed to $hostname\n",'m');
$host_changed++;
}
}
if (!empty($os)&&!empty($db_os)&&(strcasecmp($os,$db_os)!=0)) //Info about its OS
{
if ((strcasecmp($db_os,'NULL')==0)&&(strcasecmp($os,'NULL')!=0))
{
update_queries("OS from $ip now determined. $ip is using $os\n",'m');
$os_changed++;
}
else if ((strcasecmp($db_os, 'Firewalled')==0) && (strcasecmp($db_os, $os)!=0))
{
update_queries("OS from $ip now determined. $ip is using $os\n",'m');
$os_changed++;
}
else if ((strcasecmp($db_os,'NULL')!=0)&&(strcasecmp($os,'NULL')==0))
{
//update_queries("No OS info yet for $ip this time\n",'m');
$os=$db_os;
}
else
{
if (strcasecmp($db_os,'Unreachable')!=0)
update_queries("$ip has changed its OS since $db_timestamp. Now is using $os\n",'m');
$os_changed++;
}
}
$changes=$host_changed+$os_changed+$mac_changed;
if($changes>0)
{
$query=sprintf("update nac_hostscanned set hostname='%s',os='%s',timestamp='%s' where sid='%d' and ip='%s';",$hostname,$os,$timestamp,$id,$ip);
update_queries($query,'q');
}
$query=sprintf("select o.banner as banner,o.timestamp as timestamp, p.name as protocol, s.port as port from nac_openports o inner join services s on o.service=s.id inner join protocols p on s.protocol=p.protocol and o.sid='%s';",mysql_real_escape_string($id));
$res1=execute_query($query);
if ($res1) //Let's check info about ports
{
$db_ports=mysql_num_rows($res1);
$counter=0;
$db_tcp=0;
$db_udp=0;
while ($result=mysql_fetch_array($res1, MYSQL_ASSOC))
{
if (strcasecmp($result['protocol'],'tcp')==0)
{
$db_tmp_port_tcp[$db_tcp]['port']=$result['port'];
$db_tmp_port_tcp[$db_tcp]['timestamp']=$result['timestamp'];
$db_tmp_port_tcp[$db_tcp]['banner']=$result['banner'];
$db_tcp++;
}
else if (strcasecmp($result['protocol'],'udp')==0)
{
$db_tmp_port_udp[$db_udp]['port']=$result['port'];
$db_tmp_port_udp[$db_udp]['timestamp']=$result['timestamp'];
$db_tmp_port_udp[$db_udp]['banner']=$result['banner'];
$db_udp++;
}
}
if ((isset($db_tmp_port_tcp))&&(is_array($db_tmp_port_tcp)))
sort($db_tmp_port_tcp);
if ((isset($db_tmp_port_udp))&&(is_array($db_tmp_port_udp)))
sort($db_tmp_port_udp);
if (($db_tcp==0)&&($db_udp==0)) //In case we have no info in the db
{
$db_protocol[0]='tcp';
$db_port[0]=0;
$db_porttstmp[0]='0000-00-00 00:00:00';
$db_banner[0]=':';
}
else
{
for ($i=0;$i<$db_tcp;$i++)
{
$db_protocol[$i]='tcp';
$db_port[$i]=$db_tmp_port_tcp[$i]['port'];
$db_porttstmp[$i]=$db_tmp_port_tcp[$i]['timestamp'];
$db_banner[$i]=$db_tmp_port_tcp[$i]['banner'];
}
for (;$i<($db_tcp+$db_udp);$i++)
{
$db_protocol[$i]='udp';
$db_port[$i]=$db_tmp_port_udp[($i-$db_tcp)]['port'];
$db_porttstmp[$i]=$db_tmp_port_udp[($i-$db_tcp)]['timestamp'];
$db_banner[$i]=$db_tmp_port_udp[($i-$db_tcp)]['banner'];
}
}
$tcp=0;
$udp=0;
for ($i=0;$i<$ports;$i++)
{
if ($data['port'][$i]['protocol']=='tcp')
{
$tmp_port_tcp[$tcp]['port']=$data['port'][$i]['portid'];
$tmp_port_tcp[$tcp]['banner']=$data['port'][$i]['description'];
$tcp++;
}
else if ($data['port'][$i]['protocol']=='udp')
{
$tmp_port_udp[

Source for file port_scan.php