glazed 0.1.0

data/lib/glazed/dialects/base.rb

@@ -0,0 +1,246 @@
+# typed: strict
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: Apache-2.0
+
+require 'glazed/dialect'
+require 'glazed/dialect/actions'
+require 'glazed/dialect/communication_config'
+require 'glazed/dialect/interaction'
+require 'glazed/dialect/runbook'
+require 'glazed/dialect/sensitive_pattern'
+
+module Glazed
+  module Dialects
+    # Base class of dialects. A dialect describes how to talk to one kind of
+    # device and how to collect its configuration, through class-level
+    # declarations that subclasses inherit.
+    #
+    # Lists (data and output filters, interactions, sensitive patterns,
+    # communication blocks) accumulate from parent to child. The prompt, comment
+    # prefix and each runbook are replaced by a child's own declaration.
+    #
+    # @example
+    #   class Rootware < Glazed::Dialects::Base
+    #     prompt(/^\S+[#>]\s?$/)
+    #     comment_prefix '! '
+    #     runbook :get do |book|
+    #       book.command('show version') { |result| comment(result.output) }
+    #       book.command('show running-config')
+    #     end
+    #   end
+    class Base
+      # Shorthand for {Dialect::Actions} inside dialect definitions.
+      Actions = Glazed::Dialect::Actions
+
+      # Comment prefix used when a dialect declares none.
+      DEFAULT_COMMENT_PREFIX = '# ' #: String
+
+      @parent = nil #: singleton(Base)?
+      @prompt = nil #: Regexp?
+      @comment_prefix = nil #: String?
+      @data_filters = nil #: Array[Dialect::data_filter]?
+      @output_filters = nil #: Array[Dialect::data_filter]?
+      @interactions = nil #: Array[Dialect::Interaction]?
+      @sensitive_patterns = nil #: Array[Dialect::SensitivePattern]?
+      @communications = nil #: Array[[Array[Symbol], ^(Dialect::CommunicationConfig) -> void]]?
+      @runbooks = nil #: Hash[Symbol, Dialect::Runbook]?
+
+
+      class << self
+        # Records the parent so subclasses inherit declarations.
+        #
+        # @param subclass [Class<Base>] the new dialect
+        # @return [void]
+        #: (singleton(Base) subclass) -> void
+        def inherited(subclass)
+          super
+          subclass.parent = self
+        end
+
+        # Declares the command prompt pattern.
+        #
+        # @param pattern [Regexp] prompt pattern, matched against the session buffer
+        # @return [void]
+        # @example
+        #   prompt(/^\S+[#>]\s?$/)
+        #: (Regexp pattern) -> void
+        def prompt(pattern)
+          @prompt = pattern
+        end
+
+        # @return [Regexp] the declared or inherited prompt pattern
+        # @raise [NotImplementedError] when no prompt is declared
+        #: () -> Regexp
+        def prompt_pattern
+          @prompt || @parent&.prompt_pattern || raise(NotImplementedError, "#{name} declares no prompt")
+        end
+
+        # Declares the prefix of comment lines in collected configuration.
+        #
+        # @param prefix [String] such as "! " or "# "
+        # @return [void]
+        # @example
+        #   comment_prefix '! '
+        #: (String prefix) -> void
+        def comment_prefix(prefix)
+          @comment_prefix = prefix
+        end
+
+        # @return [String] the declared or inherited comment prefix
+        #: () -> String
+        def comment_prefix_value
+          @comment_prefix || @parent&.comment_prefix_value || DEFAULT_COMMENT_PREFIX
+        end
+
+        # Turns text into comment lines.
+        #
+        # @param text [String] text to comment out
+        # @return [String] every line prefixed, ending with a newline
+        #: (String text) -> String
+        def comment(text)
+          prefix = comment_prefix_value
+          text.each_line.map { |line| "#{prefix}#{line.chomp}".rstrip + "\n" }.join
+        end
+
+        # Declares a filter for each fragment of received data, such as one
+        # removing ANSI sequences. Fragments split at arbitrary points.
+        #
+        # @yieldparam fragment [String] received data
+        # @yieldreturn [String] filtered data
+        # @return [void]
+        # @example
+        #   filter_data { |fragment| fragment.delete("\r") }
+        #: () { (String fragment) -> String } -> void
+        def filter_data(&filter)
+          (@data_filters ||= []) << filter
+        end
+
+        # @return [Array<Proc>] inherited then own data filters
+        #: () -> Array[Dialect::data_filter]
+        def data_filters = (@parent&.data_filters || []) + (@data_filters || [])
+
+        # Declares a filter for the whole output of each runbook command. The
+        # output arrives as bytes and must be valid UTF-8 once every filter ran,
+        # so a dialect for a device using another encoding converts it here.
+        #
+        # @yieldparam output [String] command output, as bytes (ASCII-8BIT)
+        # @yieldreturn [String] filtered output
+        # @return [void]
+        # @example
+        #   filter_output { |output| output.gsub(/ +$/, '') }
+        #: () { (String output) -> String } -> void
+        def filter_output(&filter)
+          (@output_filters ||= []) << filter
+        end
+
+        # @return [Array<Proc>] inherited then own output filters
+        #: () -> Array[Dialect::data_filter]
+        def output_filters = (@parent&.output_filters || []) + (@output_filters || [])
+
+        # Declares a response to a pattern appearing in the session buffer.
+        # The responder must remove the pattern from the buffer, or it fires
+        # again on the next received data.
+        #
+        # @param pattern [Regexp] pattern to watch for
+        # @yieldparam session [CliSession] the session
+        # @yieldparam buffer [String] copy of the buffer
+        # @yieldparam match [MatchData] the match in the buffer
+        # @yieldreturn [Actions::Append, Actions::Replace, Actions::Multi, String, nil] action applied to the buffer
+        # @return [void]
+        # @example
+        #   interact(/--More--/) do |cli, _buffer, match|
+        #     cli.write(' ')
+        #     Actions::Replace.new(content: match.pre_match + match.post_match)
+        #   end
+        #: (Regexp pattern) { (CliSession session, String buffer, MatchData match) -> Dialect::Actions::action? } -> void
+        def interact(pattern, &responder)
+          (@interactions ||= []) << Dialect::Interaction.new(pattern:, responder:)
+        end
+
+        # @return [Array<Dialect::Interaction>] inherited then own interactions
+        #: () -> Array[Dialect::Interaction]
+        def interactions = (@parent&.interactions || []) + (@interactions || [])
+
+        # Declares where secrets appear in collected configuration.
+        #
+        # @param pattern [Regexp] pattern matched against the whole configuration
+        # @yieldparam match [MatchData] a match
+        # @yieldreturn [String, Range<Integer>, nil] the secret within the match, or its offsets in the configuration
+        # @return [void]
+        # @example
+        #   sensitive_pattern(/^enable secret \d (\S+)/) { it[1] }
+        #: (Regexp pattern) { (MatchData match) -> (String | Range[Integer])? } -> void
+        def sensitive_pattern(pattern, &determiner)
+          (@sensitive_patterns ||= []) << Dialect::SensitivePattern.new(pattern:, determiner:)
+        end
+
+        # @return [Array<Dialect::SensitivePattern>] inherited then own sensitive patterns
+        #: () -> Array[Dialect::SensitivePattern]
+        def sensitive_patterns = (@parent&.sensitive_patterns || []) + (@sensitive_patterns || [])
+
+        # Declares communication settings for transports.
+        #
+        # @param kinds [Array<Symbol>] transport names, such as :ssh and :telnet
+        # @yieldparam config [Dialect::CommunicationConfig] config to adjust
+        # @return [void]
+        # @example
+        #   communication :ssh, :telnet do |config|
+        #     config.post_login { |run| run.cli.command('terminal length 0') }
+        #   end
+        #: (*Symbol kinds) { (Dialect::CommunicationConfig config) -> void } -> void
+        def communication(*kinds, &configure)
+          (@communications ||= []) << [kinds, configure]
+        end
+
+        # Builds the communication settings for a transport.
+        #
+        # @param kind [Symbol] transport name
+        # @return [Dialect::CommunicationConfig] config with inherited then own blocks applied
+        #: (Symbol kind) -> Dialect::CommunicationConfig
+        def communication_config(kind)
+          config = @parent&.communication_config(kind) || Dialect::CommunicationConfig.new
+          (@communications || []).each do |kinds, configure|
+            configure.call(config) if kinds.include?(kind)
+          end
+          config
+        end
+
+        # Declares the runbook for an operation, replacing any inherited one.
+        #
+        # @param operation [Symbol] operation name; :get collects the configuration
+        # @yieldparam book [Dialect::Runbook::Builder] builder to add steps to
+        # @return [void]
+        # @example
+        #   runbook :get do |book|
+        #     book.command('show running-config')
+        #   end
+        #: (Symbol operation) { (Dialect::Runbook::Builder book) -> void } -> void
+        def runbook(operation, &definition)
+          builder = Dialect::Runbook::Builder.new
+          definition.call(builder)
+          (@runbooks ||= {})[operation] = builder.build
+        end
+
+        # @param operation [Symbol] operation name
+        # @return [Dialect::Runbook] the declared or inherited runbook
+        # @raise [NotImplementedError] when no runbook is declared for the operation
+        #: (Symbol operation) -> Dialect::Runbook
+        def runbook_for(operation)
+          @runbooks&.[](operation) || @parent&.runbook_for(operation) ||
+            raise(NotImplementedError, "#{name} declares no #{operation} runbook")
+        end
+
+        # @param parent [Class<Base>, nil] dialect to inherit declarations from
+        # @return [void]
+        #: (singleton(Base)? parent) -> void
+        protected def parent=(parent)
+          @parent = parent
+        end
+      end
+
+      # A PTY ends lines with CRLF; normalised on whole output, as a fragment may split the pair.
+      filter_output { it.gsub(/\r+\n/, "\n") }
+    end
+  end
+end

data/lib/glazed/dialects/ios.rb

@@ -0,0 +1,173 @@
+# typed: strict
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: Apache-2.0
+
+# Derived from Oxidized (https://github.com/ytti/oxidized) lib/oxidized/model/ios.rb,
+# Copyright 2013-2015 Saku Ytti, Samer Abdel-Hafez and Oxidized contributors,
+# licensed under the Apache License, Version 2.0. Modified for the glazed dialect API.
+
+require 'glazed/dialects/base'
+
+module Glazed
+  module Dialects
+    # Cisco IOS and IOS XE. Ported from oxidized's ios model.
+    #
+    # Node params: "ios_rbac" set to "true" collects `show running-config view full`.
+    # Node secrets: "enable" is sent as the enable password; without it, param
+    # "enable" set to "true" runs `enable` without one.
+    class Ios < Base
+      prompt(/^([\w.@()-]+[#>]\s?)$/)
+      comment_prefix '! '
+
+      # Commands some platforms lack leave an error behind.
+      filter_output { it.gsub(/^% Invalid input detected at '\^' marker\.$|^\s+\^$/, '') }
+
+      sensitive_pattern(/^snmp-server community (\S+)/) { it[1] }
+      # SNMPv3 hosts carry a user name, not a community.
+      sensitive_pattern(/^snmp-server host (?!.* version 3 )\S+(?> vrf \S+)?(?> informs?| traps)?(?> version (?:1|2c))? +(\S+)/) { it[1] }
+      sensitive_pattern(/^username .+ (?:password|secret) \d (.+)$/) { it[1] }
+      sensitive_pattern(/^enable (?:password|secret)(?: level \d+)? \d (.+)$/) { it[1] }
+      sensitive_pattern(/^ +(?:password|secret) (?:\d )?(\S+)/) { it[1] }
+      sensitive_pattern(/^.*wpa-psk ascii \d (\S+)/) { it[1] }
+      sensitive_pattern(/^.*key 7 (\d.+)$/) { it[1] }
+      sensitive_pattern(/^tacacs-server (?:.+ )?key (?:\d )?(.+)$/) { it[1] }
+      sensitive_pattern(/^crypto isakmp key (\S+) /) { it[1] }
+      sensitive_pattern(/^ +ip ospf message-digest-key \d+ md5 (?:\d )?(.+)$/) { it[1] }
+      sensitive_pattern(/^ +ip ospf authentication-key (?:\d )?(.+)$/) { it[1] }
+      sensitive_pattern(/^ +neighbor \S+ password (?:\d )?(.+)$/) { it[1] }
+      sensitive_pattern(/^ +vrrp \d+ authentication text (.+)$/) { it[1] }
+      sensitive_pattern(/^ +standby \d+ authentication (?!md5 )(.{1,8})$/) { it[1] }
+      sensitive_pattern(/^ +standby \d+ authentication md5 key-string (?:\d )?(.+?)(?: timeout \d+)?$/) { it[1] }
+      sensitive_pattern(/^ +key-string (?:\d )?(.+)$/) { it[1] }
+      sensitive_pattern(/^(?:tacacs|radius) server [^\n]+\n(?: +[^\n]+\n)*? +key (?:\d+ )?(\S+)/) { it[1] }
+      sensitive_pattern(/^ +ppp (?:chap|pap) password \d (.+)$/) { it[1] }
+      sensitive_pattern(/^ +security wpa psk set-key (?:ascii|hex) \d (.+)$/) { it[1] }
+      sensitive_pattern(/^ +dot1x username \S+ password \d (.+)$/) { it[1] }
+      sensitive_pattern(/^ +mgmtuser username \S+ password \d (.*) secret \d /) { it[1] }
+      sensitive_pattern(/^ +mgmtuser username \S+ password \d .* secret \d (.*)$/) { it[1] }
+      sensitive_pattern(/^ +client \S+ server-key \d (.+)$/) { it[1] }
+      sensitive_pattern(/^ +domain-password (\S+)/) { it[1] }
+      sensitive_pattern(/^ +pre-shared-key (.+)$/) { it[1] }
+
+      runbook :get do |book|
+        book.command('show version') { comment(version_summary(it.output)) }
+        book.command('show vtp status') do |result|
+          vtp = result.output.gsub(/^\s*\n/, '').gsub(/Configuration last modified by.*\n/, '')
+          comment("#{vtp.gsub(/^/, 'VTP: ')}\n")
+        end
+        book.command('show inventory') { comment(it.output) }
+        book.raw('show running-config') do |run|
+          line = run.param('ios_rbac') == 'true' ? 'show running-config view full' : 'show running-config'
+          run.emit(running_config(run.command(line).output))
+        end
+      end
+
+      communication :telnet do |config|
+        config.username_prompt = /^Username:/i
+        config.password_prompt = /^Password:/i
+      end
+
+      communication :ssh, :telnet do |config|
+        config.post_login do |run|
+          if (enable = run.secret('enable'))
+            run.cli.write("enable\n")
+            run.cli.expect(/^[pP]assword:/)
+            run.cli.write("#{enable.value}\n")
+            run.cli.expect(run.cli.prompt)
+          elsif run.param('enable') == 'true'
+            run.cli.command('enable')
+          end
+          run.cli.command('terminal length 0')
+          run.cli.command('terminal width 0')
+        end
+        config.pre_logout { |run| run.cli.write("exit\n") }
+      end
+
+      class << self
+        # Summarises `show version` into stable facts, as oxidized does.
+        #
+        # @param output [String] output of `show version`
+        # @return [String] summary lines, ending with a blank line
+        #: (String output) -> String
+        def version_summary(output)
+          lines = output.lines
+          facts = lines.first(1)
+          lines.each_with_index do |line, index|
+            facts.concat(version_facts(line, lines[index + 1], lines[index + 2]))
+          end
+          facts << "\n"
+          facts.join("\n")
+        end
+
+        # Cleans `show running-config` of lines that change without configuration changes.
+        #
+        # @param output [String] output of `show running-config`
+        # @return [String] the configuration
+        #: (String output) -> String
+        def running_config(output)
+          config = output
+                   .sub(/\A\s*Building configuration\.\.\.\n\s*\n?/, '')
+                   .sub(/^Current configuration : [^\n]*\n/, '')
+          config = config.each_line.reject do |line|
+            line.start_with?('ntp clock-period ') ||
+              (line.match?(/^! (Last|No) configuration change (at|since).*/) && !line.match?(/\d+\sby\s\S+$/))
+          end.join
+          config
+            .gsub(/^ tunnel mpls traffic-eng bandwidth[^\n]*\n*((?: [^\n]*\n*)*tunnel mpls traffic-eng auto-bw)/m, '\1')
+            .gsub(/^(\s+expression) \d+$/, '\1 <value removed>')
+        end
+
+        # @param line [String] a line of `show version`
+        # @param next_line [String, nil] the line after it
+        # @param line_after [String, nil] the line after that
+        # @return [Array<String>] facts found on the line
+        #: (String line, String? next_line, String? line_after) -> Array[String]
+        private def version_facts(line, next_line, line_after)
+          slave = (slot = line[/^Slave in slot (\d+) is running/, 1]) ? ' Slave:' : ''
+          slave_slot = slot ? ", slot #{slot}" : ''
+          facts = [] #: Array[String]
+          if (m = line.match(/^Compiled (.*)$/))
+            facts << "Image:#{slave} Compiled: #{m[1]}"
+          end
+          if (m = line.match(/^(?:Cisco )?IOS .* Software,? \(([A-Za-z0-9_-]*)\), .*Version\s+(.*)$/))
+            facts << "Image:#{slave} Software: #{m[1]}, #{m[2]}"
+          end
+          if (m = line.match(/^ROM: (IOS \S+ )?(System )?Bootstrap.*(Version.*)$/))
+            facts << "ROM Bootstrap: #{m[3]}"
+          end
+          if (m = line.match(/^BOOTFLASH: .*(Version.*)$/))
+            facts << "BOOTFLASH: #{m[1]}"
+          end
+          if (m = line.match(/^(\d+[kK]) bytes of (non-volatile|NVRAM)/))
+            facts << "Memory: nvram #{m[1]}"
+          end
+          if (m = line.match(/^(\d+[kK]) bytes of (flash memory|flash internal|processor board System flash|ATA CompactFlash)/i))
+            facts << "Memory: flash #{m[1]}"
+          end
+          if (m = line.match(/^(\d+[kK]) bytes of (Flash|ATA)?.*PCMCIA .*(slot|disk) ?(\d)/i))
+            facts << "Memory: pcmcia #{m[2]} #{m[3]}#{m[4]} #{m[1]}"
+          end
+          if (m = line.match(/(\S+(?:\sseries)?)\s+(?:\(([\S ]+)\)\s+processor|\(revision[^)]+\)).*\s+with (\S+k) bytes/i))
+            cpu = m[2]
+            facts << "Chassis type:#{slave} #{m[1]}"
+            facts << "Memory:#{slave} main #{m[3]}"
+            if (id = next_line&.match(/processor board id (\S+)/i))
+              facts << "Processor ID: #{id[1]}"
+            end
+            cpu_extra = if line_after&.match?(/(cpu at |processor: |#{cpu} processor,)/i)
+              line_after.gsub('implementation', 'impl').gsub(/^/, ', ').chomp
+            else
+              ''
+                        end
+            facts << "CPU:#{slave} #{cpu}#{cpu_extra}#{slave_slot}"
+          end
+          if (m = line.match(/^System image file is "([^"]*)"$/))
+            facts << "Image: #{m[1]}"
+          end
+          facts
+        end
+      end
+    end
+  end
+end

data/lib/glazed/dialects/junos.rb

@@ -0,0 +1,78 @@
+# typed: strict
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: Apache-2.0
+
+# Derived from Oxidized (https://github.com/ytti/oxidized) lib/oxidized/model/junos.rb,
+# Copyright 2013-2015 Saku Ytti, Samer Abdel-Hafez and Oxidized contributors,
+# licensed under the Apache License, Version 2.0. Modified for the glazed dialect API.
+
+require 'glazed/dialects/base'
+
+module Glazed
+  module Dialects
+    # Juniper Junos OS.
+    #
+    # Node params: "junos_license" set to "false" skips the license commands,
+    # whose usage counts change without configuration changes.
+    class Junos < Base
+      prompt(/^(\r?[\w.@:\/-]+[#>]\s?)$/)
+      comment_prefix '# '
+
+      filter_output { |output| output.gsub(/[ \t\r]+$/, '') }
+      # Counters that change without configuration changes.
+      filter_output do |output|
+        output
+          .gsub(/  scale-subscriber (\s+)(\d+)/, '  scale-subscriber                <count>')
+          .gsub(/VMX-BANDWIDTH\s+(\d+) (.*)/, 'VMX-BANDWIDTH                  <count> \2')
+      end
+
+      sensitive_pattern(/ community (.+) \{$/) { it[1] }
+      sensitive_pattern(/"(.+)".*; ## SECRET-DATA$/) { it[1] }
+
+      runbook :get do |book|
+        book.raw('show version') do |run|
+          output = run.command('show version').output
+          run.vars[:model] = output[/^Model: (\S+)/, 1]
+          run.emit(comment(output))
+        end
+        book.command('show chassis hardware') { comment(it.output) }
+        book.raw('licenses') do |run|
+          next if run.param('junos_license') == 'false'
+
+          run.emit(
+            comment(
+              run.command('show system license').output
+                .gsub(/  fib-scale\s+(\d+)/, '  fib-scale                       <count>')
+                .gsub(/  rib-scale\s+(\d+)/, '  rib-scale                       <count>'),
+            ),
+          )
+          run.emit(comment(run.command('show system license keys').output))
+        end
+        book.command('show configuration | display omit')
+        book.raw('model-specific status') do |run|
+          case run.vars[:model]
+          when 'mx960'
+            run.emit(comment(run.command('show chassis fabric reachability').output))
+          when /^(ex22|ex3[34]|ex4|ex8|qfx)/
+            run.emit(comment(run.command('show virtual-chassis').output))
+          end
+        end
+      end
+
+      communication :telnet do |config|
+        config.username_prompt = /^login:/i
+        config.password_prompt = /^password:/i
+        config.post_login do |run|
+          run.cli.command('set cli screen-length 0')
+          run.cli.command('set cli screen-width 0')
+        end
+        config.pre_logout { |run| run.cli.write("exit\n") }
+      end
+
+      communication :ssh do |config|
+        config.exec = true
+      end
+    end
+  end
+end

data/lib/glazed/dialects/nec_ix.rb

@@ -0,0 +1,71 @@
+# typed: strict
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: Apache-2.0
+
+# Derived from Oxidized (https://github.com/ytti/oxidized) lib/oxidized/model/necix.rb,
+# Copyright 2013-2015 Saku Ytti, Samer Abdel-Hafez and Oxidized contributors,
+# licensed under the Apache License, Version 2.0. Modified for the glazed dialect API.
+
+require 'glazed/dialects/base'
+
+module Glazed
+  module Dialects
+    # NEC UNIVERGE IX series.
+    class NecIx < Base
+      prompt(/^(\([\w.-]*\)\s[#$]|^\S+[$#]\s?)$/)
+      comment_prefix '! '
+
+      interact(/^--More--$/) do |cli, _buffer, match|
+        cli.write(' ')
+        Actions::Replace.new(content: match.pre_match + match.post_match)
+      end
+
+      sensitive_pattern(/^username \S+ password \S+ (\S+)/) { it[1] }
+      sensitive_pattern(/^snmp-agent \S+ community (\S+).*/) { it[1] }
+      sensitive_pattern(/^ikev2 authentication psk id .+ key \S+ (\S+).*/) { it[1] }
+      sensitive_pattern(/^ike policy ike-policy .+ key \S+ (\S+).*/) { it[1] }
+      sensitive_pattern(/^radius host .+ key \S+ (\S+).*/) { it[1] }
+      sensitive_pattern(/^\s*authentication (?:secret-)?password \S+ (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*ngn radius-auth password \S+ (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*usbmem authentication .+ password-file \S+ \S+ (\S+)/) { it[1] }
+      sensitive_pattern(/^web-auth username \S+ (?:secret-)?password (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*area \S+ virtual-link .* authentication-key (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*ip ospf authentication-key (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*ip ospf message-digest-key (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*neighbor \S+ password (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*password (?:plain |secret )?(\S+)/) { it[1] }
+      sensitive_pattern(/^\s*l2tp password \S+ (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*vrrp \S+ authentication (\S+)/) { it[1] }
+      sensitive_pattern(/^\s*nm account \S+ password \S+ (\S+)/) { it[1] }
+      sensitive_pattern(/^snmpv3 user \S+ .+ priv \S+ (?:plain|secret) (\S+)/) { it[1] }
+      sensitive_pattern(/^snmpv3 user \S+ .+? (?:plain|secret) (\S+)/) { it[1] }
+      sensitive_pattern(/^http-server cross-site (?:secret-)?password (\S+)/) { it[1] }
+      sensitive_pattern(/^http-server (?:guest-|monitor-)?username \S+ (?:secret-)?password (\S+)/) { it[1] }
+      sensitive_pattern(/^startup (?:config-download|software-update) .+ (?:secret-)?password (\S+)/) { it[1] }
+
+      runbook :get do |book|
+        book.command('show running-config') do |result|
+          result.output.each_line.grep_v(/^!.*Current time.*$/).join
+        end
+      end
+
+      communication :telnet do |config|
+        config.username_prompt = /^Username:\s/i
+        config.password_prompt = /^Password:\s/i
+      end
+
+      communication :ssh, :telnet do |config|
+        config.post_login do |run|
+          raise Glazed::Error, 'CONFIG process is occupied' if run.cli.command('configure').output.match?(/CONFIG process is occupied/)
+
+          run.cli.command('terminal length 0')
+        end
+        config.pre_logout do |run|
+          run.cli.write("\cZ")
+          run.cli.write("exit\n")
+        end
+      end
+    end
+  end
+end

data/lib/glazed/dialects/wlc.rb

@@ -0,0 +1,56 @@
+# typed: strict
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: Apache-2.0
+
+# Derived from Oxidized (https://github.com/ytti/oxidized) lib/oxidized/model/aireos.rb,
+# Copyright 2013-2015 Saku Ytti, Samer Abdel-Hafez and Oxidized contributors,
+# licensed under the Apache License, Version 2.0. Modified for the glazed dialect API.
+
+require 'glazed/dialects/base'
+
+module Glazed
+  module Dialects
+    # Cisco Wireless LAN Controller on AireOS. Ported from oxidized's aireos model.
+    #
+    # AireOS asks for the user name and password inside the session, after SSH
+    # authentication as well.
+    class Wlc < Base
+      prompt(/^\([^)]+\)\s>/)
+      comment_prefix '# '
+
+      sensitive_pattern(/^config snmp community create (\S+)/) { it[1] }
+      sensitive_pattern(/^config wlan security wpa akm psk set-key (?:ascii|hex) (\S+)/) { it[1] }
+      sensitive_pattern(/^config (?:radius|tacacs) (?:auth|acct|athr) add \d+ \S+ \d+ (?:ascii|hex) (\S+)/) { it[1] }
+
+      runbook :get do |book|
+        book.command('show udi') { comment("#{clean(it.output)}\n") }
+        book.command('show boot') { comment("#{clean(it.output)}\n") }
+        book.command('show run-config commands') { clean(it.output) }
+      end
+
+      communication :ssh, :telnet do |config|
+        config.username_prompt = /^User:\s*/
+        config.password_prompt = /^Password:\s*/
+        config.post_login { |run| run.cli.command('config paging disable') }
+        # Logout asks whether to save unsaved changes.
+        config.pre_logout do |run|
+          run.cli.write("logout\n")
+          run.cli.write('n')
+        end
+      end
+
+      # Drops blank lines, rogue alerts and surrounding spaces.
+      #
+      # @param output [String] command output
+      # @return [String] cleaned lines, ending with a newline
+      #: (String output) -> String
+      def self.clean(output)
+        lines = output.each_line.map(&:strip).reject do |line|
+          line.empty? || line.match?(/rogue (adhoc|client) (alert|Unknown) [\da-f]{2}:/)
+        end
+        "#{lines.join("\n")}\n"
+      end
+    end
+  end
+end