itrp 0.1.0

data/lib/handlers/flow.rb

@@ -0,0 +1,29 @@
+module ITRP
+
+class Cmd_flow < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :any
+		@attach_cmd  = 'set'
+		@trigger = 'flow'
+	end
+
+
+    def completions(patt)
+        [ 
+			"IP Flows {99A78737-4B41-4387-8F31-8077DB917336}"
+        ].grep( /#{Regexp.escape(patt)}/i)  
+    end
+
+	def enter(s)
+        patt = s.scan(/set\s+flow\s+(.*)\s+({.*}$)/).flatten 
+		patt = ["IP Flows",   "{99A78737-4B41-4387-8F31-8077DB917336}"]  if  patt.empty?
+		print("\nContext set to flow group [#{patt[0]}] [#{patt[1]}]\n\n")
+		@appenv.prompt = "iTRP F:(#{patt[0]})> "
+		@appenv.context_data[:cgguid] = patt[1]
+		@appenv.context_data[:cgname] = patt[0]
+		@appenv.context = :flow
+	end
+end
+
+end 

data/lib/handlers/fts.rb

@@ -0,0 +1,32 @@
+module ITRP
+
+class Cmd_fts < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :any
+		@attach_cmd  = 'set'
+		@trigger = 'fts'
+	end
+
+
+    def completions(patt)
+        [ "HTTP Headers  {28217924-E7A5-4523-993C-44B52758D5A8}",
+          "SSL Certs     {9FEB8ADE-ADBB-49AD-BC68-C6A02F389C71}",
+        ].grep( /#{Regexp.escape(patt)}/i)  
+    end
+
+
+	def enter(s)
+        patt = s.scan(/set\s+fts\s+(.*)\s+({.*}$)/).flatten 
+		patt[0].strip!
+		print("\nContext set to FTS (Full Text Search) [#{patt[0]}] [#{patt[1]}]\n\n")
+		@appenv.prompt = "iTRP D:(#{patt[0]})> "
+		@appenv.context_data[:cgguid] = patt[1]
+		@appenv.context_data[:cgname] = patt[0]
+		@appenv.context = :fts
+	end
+end
+
+
+
+end 

data/lib/handlers/getkey.rb

@@ -0,0 +1,38 @@
+module ITRP 
+
+class Cmd_getkey  < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :counter
+		@attach_cmd  = ''
+		@trigger = 'getkey'
+	end
+
+
+
+	def enter(cmdline)
+
+        patt = cmdline.scan(/getkey (.*)/).flatten
+
+        print("Search [#{patt[0]}]\n")
+        req =mk_request(TRP::Message::Command::SEARCH_KEYS_REQUEST,
+                         :counter_group => appstate(:cgguid),
+                         :label  => patt[0])
+
+
+        rows = []
+        get_response_zmq(@appenv.zmq_endpt,req) do |resp|
+            resp.keys.each do |k|
+                rows << [ k.key, k.label, k.readable ]
+            end
+        end
+
+
+        table = Terminal::Table.new( :headings => %w(Key  Label Readable ), :rows => rows)
+        puts(table) 
+
+    end
+
+end
+end
+

data/lib/handlers/getlabel.rb

@@ -0,0 +1,39 @@
+module ITRP
+
+class Cmd_getlabel  < Cmd 
+
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :counter
+		@attach_cmd  = ''
+		@trigger = 'getlabel'
+	end
+
+	def enter(cmdline)
+
+        patt = cmdline.scan(/getlabel (.*)/).flatten
+
+        print("Search [#{patt[0]}]\n")
+        req =mk_request(TRP::Message::Command::SEARCH_KEYS_REQUEST,
+                         :counter_group => appstate(:cgguid),
+                         :pattern  => patt[0])
+
+
+        rows = []
+        get_response_zmq(@appenv.zmq_endpt,req) do |resp|
+            resp.keys.each do |k|
+                rows << [ k.key, k.label, k.readable ]
+            end
+        end
+
+
+        table = Terminal::Table.new( :headings => %w(Key  Label Readable ), :rows => rows)
+        puts(table) 
+
+    end
+
+end
+end
+
+
+

data/lib/handlers/help.rb

@@ -0,0 +1,13 @@
+module ITRP
+
+class Cmd_help < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :any
+		@attach_cmd  = ''
+		@trigger = 'help'
+	end
+end
+
+end
+

data/lib/handlers/list.rb

@@ -0,0 +1,13 @@
+module ITRP
+
+class Cmd_list < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :any
+		@attach_cmd  = ''
+		@trigger = 'list'
+	end
+end
+
+end
+

data/lib/handlers/list_counters.rb

@@ -0,0 +1,32 @@
+module ITRP
+
+class Cmd_cglist  < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :any
+		@attach_cmd  = 'list'
+		@trigger = 'counters'
+	end
+
+
+	def enter(cmdline)
+		req =mk_request(TRP::Message::Command::COUNTER_GROUP_INFO_REQUEST)
+
+		rows = []
+		get_response_zmq(@appenv.zmq_endpt,req) do |resp|
+			  resp.group_details.each do |group_detail|
+			  	rows << [ group_detail.name,
+						  group_detail.guid,
+						  group_detail.bucket_size.to_i/1000
+				        ]
+			  end
+		end
+
+		table = Terminal::Table.new :headings => %w(name guid bs), :rows => rows
+		puts(table) 
+	end
+
+end
+end
+
+

data/lib/handlers/meters.rb

@@ -0,0 +1,40 @@
+module ITRP
+
+class Cmd_meters < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :counter
+		@attach_cmd  = ''
+		@trigger = 'meters'
+	end
+
+	def enter(cmdline)
+		req =mk_request(TRP::Message::Command::COUNTER_GROUP_INFO_REQUEST,
+						 :counter_group => @appenv.context_data[:cgguid],
+						 :get_meter_info => true )
+
+		rows = []
+		get_response_zmq(@appenv.zmq_endpt,req) do |resp|
+			  resp.group_details.each do |group_detail|
+			  	group_detail.meters.each do |meter|
+					rows << [ meter.id, 
+							  meter.name,
+							  meter.description,
+							  meter.type,
+							  meter.topcount,
+							  meter.units] 
+				end
+			  end
+		end
+
+		table = Terminal::Table.new( 
+				:headings => %w(MeterNo Name Description Type TopperCount Units),
+				:rows => rows)
+
+		puts(table) 
+
+	end
+end
+
+end
+

data/lib/handlers/options.rb

@@ -0,0 +1,33 @@
+module ITRP
+
+class Cmd_options   < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :any
+		@attach_cmd  = 'set'
+		@trigger = 'options'
+	end
+
+	def completions(patt)
+		 [ "maxitems", "key", "resolve_keys" ].grep( /^#{Regexp.escape(patt)}/i)
+	end
+
+	def enter(cmdline)
+
+		terms = cmdline.scan( /(\w+)\s*=\s*([\w\-_\.\:,]+)+/ )
+
+		terms.each do |a|
+			val = case a[0]
+				when 'maxitems';  a[1].to_i
+				when 'resolve_keys';  a[1] == "true"
+				else; a[1]
+			end
+			@appenv.context_data.store( a[0].to_sym,   val )
+		end
+
+	end
+
+end
+end
+
+

data/lib/handlers/query_alerts.rb

@@ -0,0 +1,77 @@
+module ITRP
+
+class Cmd_query_alerts   < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :alerts
+		@attach_cmd  = ''
+		@trigger = 'query'
+	end
+
+	def completions(patt)
+		TRP::QueryAlertsRequest
+		        .fields
+				.values
+				.collect { |a| a.name }
+				.grep( /^#{Regexp.escape(patt)}/i)
+	end
+
+    def enter(patt)
+
+		terms = patt.scan( /(\w+)\s*=\s*([\w\-_\.\:,]+)+/ )
+		qparams = terms.inject({}) { |acc,t| acc.store( t[0].to_sym, t[1]);acc}
+
+		[:maxitems].each do |a|
+			qparams[a] = qparams[a].to_i if qparams.key? a
+		end
+
+		[:idlist].each do |a|
+			qparams[a] = qparams[a].split(',')  if qparams.key? a
+		end
+
+	    p qparams 
+
+
+		req =mk_request(TRP::Message::Command::QUERY_ALERTS_REQUEST,
+						 { 	:alert_group  => appstate(:cgguid),
+                         	:time_interval =>  appstate(:time_interval)
+						 }.merge(qparams))
+
+
+        rows = [] 
+
+		labelfmt = lambda do |fld|
+			fld.label.empty? ? fld.key : fld.label
+		end
+
+		get_response_zmq(@zmq_endpt,req) do |resp|
+
+            resp.alerts.each do | res |
+
+
+            rows << [ "#{res.alert_id}",
+                      Time.at( res.time.tv_sec).to_s(),
+					  res.occurrances, 
+                      res.source_ip.label,
+                      res.source_port.label,
+                      res.destination_ip.label,
+                      res.destination_port.label,
+                      res.sigid.key,
+                      res.priority.key,
+                      res.classification.key
+            ]
+            end
+
+        end
+
+		table = Terminal::Table.new( 
+				:headings => %w(ID Time Count SourceIP Port DestIP Port SigID Prio Class ),
+				:rows => rows)
+		puts(table) 
+
+    end
+
+end
+end
+
+

data/lib/handlers/query_flow.rb

@@ -0,0 +1,73 @@
+module ITRP
+
+class Cmd_query_flow   < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :flow
+		@attach_cmd  = ''
+		@trigger = 'query'
+	end
+
+	def completions(patt)
+		TRP::QuerySessionsRequest
+		        .fields
+				.values
+				.collect { |a| a.name }
+				.grep( /^#{Regexp.escape(patt)}/i)
+	end
+
+    def enter(patt)
+
+		terms = patt.scan( /(\w+)\s*=\s*([\w\-_\.\:,]+)+/ )
+		qparams = terms.inject({}) { |acc,t| acc.store( t[0].to_sym, t[1]);acc}
+
+		[:maxitems].each do |a|
+			qparams[a] = qparams[a].to_i if qparams.key? a
+		end
+
+		[:idlist].each do |a|
+			qparams[a] = qparams[a].split(',')  if qparams.key? a
+		end
+
+	    p qparams 
+
+		# meter names 
+		req =mk_request(TRP::Message::Command::QUERY_SESSIONS_REQUEST ,
+						{
+						 :session_group  => appstate(:cgguid),
+                         :time_interval => appstate(:time_interval),
+						 :resolve_keys => true,
+						}.merge(qparams))
+
+        rows = [] 
+
+		get_response_zmq(@appenv.zmq_endpt,req) do |resp|
+
+            resp.sessions.each do | sess |
+
+            rows << [ "#{sess.session_id}",
+                      Time.at( sess.time_interval.from.tv_sec).to_s(),
+					  sess.time_interval.to.tv_sec - sess.time_interval.from.tv_sec,
+                      sess.protocol.label,
+                      sess.key1A.label,
+                      sess.key1Z.label,
+                      sess.key2A.label,
+                      sess.key2Z.label,
+                      sess.az_bytes + sess.za_bytes
+					]
+            end
+
+        end
+
+		table = Terminal::Table.new( 
+				:headings => %w(ID Time Dur Prot SourceIP DestIP SPort DPort Volume),
+				:rows => rows)
+		puts(table) 
+
+    end
+
+
+end
+end
+
+

data/lib/handlers/query_fts.rb

@@ -0,0 +1,51 @@
+module ITRP
+
+class Cmd_query_fts   < Cmd 
+	def initialize (e)
+		super(e)
+		@enabled_in_state = :fts
+		@attach_cmd  = ''
+		@trigger = 'query'
+	end
+
+	def completions(patt)
+		%w( keywords ) 
+	end
+
+    def enter(patt)
+
+	   terms = patt.scan( /keywords\s*=\s*(.+)/ )
+
+		req =mk_request(TRP::Message::Command::QUERY_FTS_REQUEST,
+						 { 	:fts_group  => appstate(:cgguid),
+                         	:time_interval =>  appstate(:time_interval),
+							:maxitems => 20,
+							:keywords => terms.flatten.first 
+						})
+
+
+        rows = [] 
+
+		get_response_zmq(@appenv.zmq_endpt,req) do |resp|
+
+            resp.documents.each do | doc |
+                rows << [ doc.dockey, 
+                          doc.flows.inject("") do |acc,item|
+                            item.key 
+                          end,
+                          'wrap(doc.fullcontent,60)', 
+                       ]
+            end
+
+        end
+
+		table = Terminal::Table.new( 
+				:headings => %w(DocID Flows Content),
+				:rows => rows)
+		puts(table) 
+    end
+
+end
+end
+
+