trisulrp 1.5.7 → 1.5.8
Sign up to get free protection for your applications and to get access to all the features.
- data/VERSION +1 -1
- data/lib/trisulrp/guids.rb +11 -11
- data/lib/trisulrp/keys.rb +271 -269
- data/lib/trisulrp/protocol.rb +296 -292
- data/lib/trisulrp/trp.pb.rb +10 -1
- data/lib/trisulrp/trp.proto +11 -2
- data/lib/trisulrp/utils.rb +111 -111
- data/trisulrp.gemspec +2 -2
- metadata +3 -3
data/lib/trisulrp/utils.rb
CHANGED
|
@@ -14,128 +14,128 @@
|
|
|
14
14
|
#
|
|
15
15
|
module TrisulRP::Utils
|
|
16
16
|
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
17
|
+
# Print session (flow) details
|
|
18
|
+
#
|
|
19
|
+
# [conn] active TRP connection opened earlier
|
|
20
|
+
# [sessions] an array of SessionIDs
|
|
21
|
+
#
|
|
22
|
+
# ==== Returns
|
|
23
|
+
# ==== Yields
|
|
24
|
+
# Nothing
|
|
25
|
+
#
|
|
26
|
+
# Prints details about the list of sessions (flows) passed
|
|
27
|
+
#
|
|
28
|
+
# ==== On error
|
|
29
|
+
def print_session_details(conn,sessions)
|
|
30
|
+
all_sids = sessions.collect{ |ai| TRP::SessionID.new(
|
|
31
|
+
:slice_id => ai.slice_id,
|
|
32
|
+
:session_id => ai.session_id ) }
|
|
33
33
|
|
|
34
|
-
|
|
35
|
-
|
|
34
|
+
follow_up = TrisulRP::Protocol.mk_request(TRP::Message::Command::SESSION_ITEM_REQUEST,
|
|
35
|
+
:session_ids => all_sids)
|
|
36
36
|
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
37
|
+
TrisulRP::Protocol.get_response(conn,follow_up) do |resp|
|
|
38
|
+
resp.items.each do |item|
|
|
39
|
+
print "#{item.session_id.slice_id},#{item.session_id.session_id} "
|
|
40
|
+
print "#{Time.at(item.time_interval.from.tv_sec)} "
|
|
41
|
+
print "#{item.time_interval.to.tv_sec-item.time_interval.from.tv_sec} ".rjust(8)
|
|
42
|
+
print "#{item.key1A.label}".ljust(28)
|
|
43
|
+
print "#{item.key2A.label}".ljust(11)
|
|
44
|
+
print "#{item.key1Z.label}".ljust(28)
|
|
45
|
+
print "#{item.key2Z.label}".ljust(11)
|
|
46
|
+
print "#{item.az_bytes}".rjust(10)
|
|
47
|
+
print "#{item.za_bytes}".rjust(10)
|
|
48
|
+
print "\n"
|
|
49
|
+
end
|
|
50
|
+
end
|
|
51
51
|
end
|
|
52
52
|
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
53
|
+
# Make key
|
|
54
|
+
#
|
|
55
|
+
# Convert an item into Trisul Key format.
|
|
56
|
+
#
|
|
57
|
+
# Example
|
|
58
|
+
#
|
|
59
|
+
# == Pass a hostname
|
|
60
|
+
# mk_trisul_key(conn,GUID_HOSTS,"www.trisul.org") => "D0.D1.01.EA"
|
|
61
|
+
# mk_trisul_key(conn,GUID_APPS,"https") => "p-01BB"
|
|
62
|
+
#
|
|
63
|
+
# == Pass a IP
|
|
64
|
+
# mk_trisul_key(conn,GUID_HOSTS,"192.168.1.5") => "C0.A8.01.05"
|
|
65
|
+
# mk_trisul_key(conn,GUID_APPS,"Port-443") => "p-01BB"
|
|
66
|
+
#
|
|
67
|
+
#
|
|
68
|
+
# [conn] active TRP connection opened earlier
|
|
69
|
+
# [guid] counter group id (eg hosts, apps, countries)
|
|
70
|
+
# [str] eg a resolved name (eg a host like www.blue.net)
|
|
71
|
+
#
|
|
72
|
+
# ==== Returns
|
|
73
|
+
# A string containing the key in Trisul format corresponding to the
|
|
74
|
+
# label passed in via ''str''
|
|
75
|
+
#
|
|
76
|
+
# ==== Yields
|
|
77
|
+
# Nothing
|
|
78
|
+
#
|
|
79
|
+
# ==== On error
|
|
80
|
+
def mk_trisul_key(conn,guid,str)
|
|
81
|
+
req = TrisulRP::Protocol.mk_request(TRP::Message::Command::SEARCH_KEYS_REQUEST,
|
|
82
|
+
:pattern => str,
|
|
83
|
+
:counter_group => guid,
|
|
84
|
+
:maxitems => 1)
|
|
85
85
|
|
|
86
|
-
|
|
86
|
+
resp = TrisulRP::Protocol.get_response(conn,req)
|
|
87
87
|
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
88
|
+
if resp.found_keys.size > 0
|
|
89
|
+
resp.found_keys[0].key
|
|
90
|
+
else
|
|
91
|
+
TrisulRP::Keys::make_key(str)
|
|
92
|
+
end
|
|
93
93
|
end
|
|
94
94
|
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
95
|
+
# Print alert details
|
|
96
|
+
#
|
|
97
|
+
# [conn] active TRP connection opened earlier
|
|
98
|
+
# [alerts] an array of AlertIDs
|
|
99
|
+
#
|
|
100
|
+
# ==== Returns
|
|
101
|
+
# ==== Yields
|
|
102
|
+
# Nothing
|
|
103
|
+
#
|
|
104
|
+
# Prints details about the list of alerts passed
|
|
105
|
+
#
|
|
106
|
+
# ==== On error
|
|
107
|
+
def print_alert_details(conn, alerts)
|
|
108
108
|
|
|
109
|
-
|
|
109
|
+
return if alerts.empty?
|
|
110
110
|
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
111
|
+
# retrieve details of alerts from server
|
|
112
|
+
follow_up = TrisulRP::Protocol.mk_request(TRP::Message::Command::ALERT_ITEM_REQUEST,
|
|
113
|
+
:alert_group => TrisulRP::Guids::AG_IDS,
|
|
114
|
+
:alert_ids => alerts.collect do |al|
|
|
115
|
+
TRP::AlertID.new(:slice_id => al.slice_id,
|
|
116
|
+
:alert_id => al.alert_id)
|
|
117
|
+
end
|
|
118
|
+
)
|
|
119
119
|
|
|
120
120
|
|
|
121
121
|
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
122
|
+
TrisulRP::Protocol.get_response(conn,follow_up) do | resp |
|
|
123
|
+
resolv_candidates = resp.items.collect { |item| [item.source_ip, item.source_port, item.destination_ip, item.destination_port,item.sigid] }
|
|
124
|
+
resolv_arr = resolv_candidates.transpose
|
|
125
|
+
sip_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOST, resolv_arr[0])
|
|
126
|
+
sport_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_APP, resolv_arr[1])
|
|
127
|
+
dip_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOST, resolv_arr[2])
|
|
128
|
+
dport_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_APP, resolv_arr[3])
|
|
129
|
+
sigid_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_ALERT_SIGNATURES, resolv_arr[4])
|
|
130
|
+
resp.items.each do |item|
|
|
131
|
+
print "#{Time.at(item.time.tv_sec)} "
|
|
132
|
+
print "#{sip_names[item.source_ip]}".ljust(28)
|
|
133
|
+
print "#{sport_names[item.source_port]}".ljust(11)
|
|
134
|
+
print "#{dip_names[item.destination_ip]}".ljust(28)
|
|
135
|
+
print "#{dport_names[item.destination_port]}".ljust(11)
|
|
136
|
+
print "#{sigid_names[item.sigid]}".rjust(10)
|
|
137
|
+
print "\n"
|
|
138
|
+
end
|
|
139
|
+
end
|
|
140
|
+
end
|
|
141
141
|
end
|
data/trisulrp.gemspec
CHANGED
|
@@ -5,11 +5,11 @@
|
|
|
5
5
|
|
|
6
6
|
Gem::Specification.new do |s|
|
|
7
7
|
s.name = "trisulrp"
|
|
8
|
-
s.version = "1.5.
|
|
8
|
+
s.version = "1.5.8"
|
|
9
9
|
|
|
10
10
|
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
|
11
11
|
s.authors = ["vivek"]
|
|
12
|
-
s.date = "2013-
|
|
12
|
+
s.date = "2013-11-21"
|
|
13
13
|
s.description = "This gem deals about the trisul remote protocol"
|
|
14
14
|
s.email = "vivek_rajagopal@yahoo.com"
|
|
15
15
|
s.extra_rdoc_files = [
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: trisulrp
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.5.
|
|
4
|
+
version: 1.5.8
|
|
5
5
|
prerelease:
|
|
6
6
|
platform: ruby
|
|
7
7
|
authors:
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2013-
|
|
12
|
+
date: 2013-11-21 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
15
|
name: ruby-protocol-buffers
|
|
@@ -158,7 +158,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
158
158
|
version: '0'
|
|
159
159
|
segments:
|
|
160
160
|
- 0
|
|
161
|
-
hash: -
|
|
161
|
+
hash: -727236621149825974
|
|
162
162
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
163
163
|
none: false
|
|
164
164
|
requirements:
|