trisulrp 1.5.7 → 1.5.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/VERSION +1 -1
- data/lib/trisulrp/guids.rb +11 -11
- data/lib/trisulrp/keys.rb +271 -269
- data/lib/trisulrp/protocol.rb +296 -292
- data/lib/trisulrp/trp.pb.rb +10 -1
- data/lib/trisulrp/trp.proto +11 -2
- data/lib/trisulrp/utils.rb +111 -111
- data/trisulrp.gemspec +2 -2
- metadata +3 -3
data/lib/trisulrp/utils.rb
CHANGED
|
@@ -14,128 +14,128 @@
|
|
|
14
14
|
#
|
|
15
15
|
module TrisulRP::Utils
|
|
16
16
|
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
17
|
+
# Print session (flow) details
|
|
18
|
+
#
|
|
19
|
+
# [conn] active TRP connection opened earlier
|
|
20
|
+
# [sessions] an array of SessionIDs
|
|
21
|
+
#
|
|
22
|
+
# ==== Returns
|
|
23
|
+
# ==== Yields
|
|
24
|
+
# Nothing
|
|
25
|
+
#
|
|
26
|
+
# Prints details about the list of sessions (flows) passed
|
|
27
|
+
#
|
|
28
|
+
# ==== On error
|
|
29
|
+
def print_session_details(conn,sessions)
|
|
30
|
+
all_sids = sessions.collect{ |ai| TRP::SessionID.new(
|
|
31
|
+
:slice_id => ai.slice_id,
|
|
32
|
+
:session_id => ai.session_id ) }
|
|
33
33
|
|
|
34
|
-
|
|
35
|
-
|
|
34
|
+
follow_up = TrisulRP::Protocol.mk_request(TRP::Message::Command::SESSION_ITEM_REQUEST,
|
|
35
|
+
:session_ids => all_sids)
|
|
36
36
|
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
37
|
+
TrisulRP::Protocol.get_response(conn,follow_up) do |resp|
|
|
38
|
+
resp.items.each do |item|
|
|
39
|
+
print "#{item.session_id.slice_id},#{item.session_id.session_id} "
|
|
40
|
+
print "#{Time.at(item.time_interval.from.tv_sec)} "
|
|
41
|
+
print "#{item.time_interval.to.tv_sec-item.time_interval.from.tv_sec} ".rjust(8)
|
|
42
|
+
print "#{item.key1A.label}".ljust(28)
|
|
43
|
+
print "#{item.key2A.label}".ljust(11)
|
|
44
|
+
print "#{item.key1Z.label}".ljust(28)
|
|
45
|
+
print "#{item.key2Z.label}".ljust(11)
|
|
46
|
+
print "#{item.az_bytes}".rjust(10)
|
|
47
|
+
print "#{item.za_bytes}".rjust(10)
|
|
48
|
+
print "\n"
|
|
49
|
+
end
|
|
50
|
+
end
|
|
51
51
|
end
|
|
52
52
|
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
53
|
+
# Make key
|
|
54
|
+
#
|
|
55
|
+
# Convert an item into Trisul Key format.
|
|
56
|
+
#
|
|
57
|
+
# Example
|
|
58
|
+
#
|
|
59
|
+
# == Pass a hostname
|
|
60
|
+
# mk_trisul_key(conn,GUID_HOSTS,"www.trisul.org") => "D0.D1.01.EA"
|
|
61
|
+
# mk_trisul_key(conn,GUID_APPS,"https") => "p-01BB"
|
|
62
|
+
#
|
|
63
|
+
# == Pass a IP
|
|
64
|
+
# mk_trisul_key(conn,GUID_HOSTS,"192.168.1.5") => "C0.A8.01.05"
|
|
65
|
+
# mk_trisul_key(conn,GUID_APPS,"Port-443") => "p-01BB"
|
|
66
|
+
#
|
|
67
|
+
#
|
|
68
|
+
# [conn] active TRP connection opened earlier
|
|
69
|
+
# [guid] counter group id (eg hosts, apps, countries)
|
|
70
|
+
# [str] eg a resolved name (eg a host like www.blue.net)
|
|
71
|
+
#
|
|
72
|
+
# ==== Returns
|
|
73
|
+
# A string containing the key in Trisul format corresponding to the
|
|
74
|
+
# label passed in via ''str''
|
|
75
|
+
#
|
|
76
|
+
# ==== Yields
|
|
77
|
+
# Nothing
|
|
78
|
+
#
|
|
79
|
+
# ==== On error
|
|
80
|
+
def mk_trisul_key(conn,guid,str)
|
|
81
|
+
req = TrisulRP::Protocol.mk_request(TRP::Message::Command::SEARCH_KEYS_REQUEST,
|
|
82
|
+
:pattern => str,
|
|
83
|
+
:counter_group => guid,
|
|
84
|
+
:maxitems => 1)
|
|
85
85
|
|
|
86
|
-
|
|
86
|
+
resp = TrisulRP::Protocol.get_response(conn,req)
|
|
87
87
|
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
88
|
+
if resp.found_keys.size > 0
|
|
89
|
+
resp.found_keys[0].key
|
|
90
|
+
else
|
|
91
|
+
TrisulRP::Keys::make_key(str)
|
|
92
|
+
end
|
|
93
93
|
end
|
|
94
94
|
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
95
|
+
# Print alert details
|
|
96
|
+
#
|
|
97
|
+
# [conn] active TRP connection opened earlier
|
|
98
|
+
# [alerts] an array of AlertIDs
|
|
99
|
+
#
|
|
100
|
+
# ==== Returns
|
|
101
|
+
# ==== Yields
|
|
102
|
+
# Nothing
|
|
103
|
+
#
|
|
104
|
+
# Prints details about the list of alerts passed
|
|
105
|
+
#
|
|
106
|
+
# ==== On error
|
|
107
|
+
def print_alert_details(conn, alerts)
|
|
108
108
|
|
|
109
|
-
|
|
109
|
+
return if alerts.empty?
|
|
110
110
|
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
111
|
+
# retrieve details of alerts from server
|
|
112
|
+
follow_up = TrisulRP::Protocol.mk_request(TRP::Message::Command::ALERT_ITEM_REQUEST,
|
|
113
|
+
:alert_group => TrisulRP::Guids::AG_IDS,
|
|
114
|
+
:alert_ids => alerts.collect do |al|
|
|
115
|
+
TRP::AlertID.new(:slice_id => al.slice_id,
|
|
116
|
+
:alert_id => al.alert_id)
|
|
117
|
+
end
|
|
118
|
+
)
|
|
119
119
|
|
|
120
120
|
|
|
121
121
|
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
122
|
+
TrisulRP::Protocol.get_response(conn,follow_up) do | resp |
|
|
123
|
+
resolv_candidates = resp.items.collect { |item| [item.source_ip, item.source_port, item.destination_ip, item.destination_port,item.sigid] }
|
|
124
|
+
resolv_arr = resolv_candidates.transpose
|
|
125
|
+
sip_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOST, resolv_arr[0])
|
|
126
|
+
sport_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_APP, resolv_arr[1])
|
|
127
|
+
dip_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOST, resolv_arr[2])
|
|
128
|
+
dport_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_APP, resolv_arr[3])
|
|
129
|
+
sigid_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_ALERT_SIGNATURES, resolv_arr[4])
|
|
130
|
+
resp.items.each do |item|
|
|
131
|
+
print "#{Time.at(item.time.tv_sec)} "
|
|
132
|
+
print "#{sip_names[item.source_ip]}".ljust(28)
|
|
133
|
+
print "#{sport_names[item.source_port]}".ljust(11)
|
|
134
|
+
print "#{dip_names[item.destination_ip]}".ljust(28)
|
|
135
|
+
print "#{dport_names[item.destination_port]}".ljust(11)
|
|
136
|
+
print "#{sigid_names[item.sigid]}".rjust(10)
|
|
137
|
+
print "\n"
|
|
138
|
+
end
|
|
139
|
+
end
|
|
140
|
+
end
|
|
141
141
|
end
|
data/trisulrp.gemspec
CHANGED
|
@@ -5,11 +5,11 @@
|
|
|
5
5
|
|
|
6
6
|
Gem::Specification.new do |s|
|
|
7
7
|
s.name = "trisulrp"
|
|
8
|
-
s.version = "1.5.
|
|
8
|
+
s.version = "1.5.8"
|
|
9
9
|
|
|
10
10
|
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
|
11
11
|
s.authors = ["vivek"]
|
|
12
|
-
s.date = "2013-
|
|
12
|
+
s.date = "2013-11-21"
|
|
13
13
|
s.description = "This gem deals about the trisul remote protocol"
|
|
14
14
|
s.email = "vivek_rajagopal@yahoo.com"
|
|
15
15
|
s.extra_rdoc_files = [
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: trisulrp
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.5.
|
|
4
|
+
version: 1.5.8
|
|
5
5
|
prerelease:
|
|
6
6
|
platform: ruby
|
|
7
7
|
authors:
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2013-
|
|
12
|
+
date: 2013-11-21 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
15
|
name: ruby-protocol-buffers
|
|
@@ -158,7 +158,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
158
158
|
version: '0'
|
|
159
159
|
segments:
|
|
160
160
|
- 0
|
|
161
|
-
hash: -
|
|
161
|
+
hash: -727236621149825974
|
|
162
162
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
163
163
|
none: false
|
|
164
164
|
requirements:
|