[Sguil-cvs] sguil/client/lib extdata.tcl,1.30,1.31 qrybuild.tcl,1.33,1.34 qrylib.tcl,1.26,1.27 sancp.tcl,1.5,1.6

[Bamm V. <ba...@us...>]

Update of /cvsroot/sguil/sguil/client/lib
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv17757/lib

Modified Files:
	extdata.tcl qrybuild.tcl qrylib.tcl sancp.tcl 
Log Message:
Initial UNION support for the query builder. Not yet bug-free.


Index: extdata.tcl
===================================================================
RCS file: /cvsroot/sguil/sguil/client/lib/extdata.tcl,v
retrieving revision 1.30
retrieving revision 1.31
diff -C2 -d -r1.30 -r1.31
*** extdata.tcl	16 Nov 2005 22:27:12 -0000	1.30
--- extdata.tcl	22 Dec 2005 23:12:01 -0000	1.31
***************
*** 912,920 ****
      if { $status == 1 } {
  
!         label $win -text "UP" -background green -relief raised -width 5
  
      } else {
  
!         label $win -text "DOWN" -background red -relief raised -width 5
  
      }
--- 912,920 ----
      if { $status == 1 } {
  
!         label $win -text "UP" -background green -relief flat -width 5
  
      } else {
  
!         label $win -text "DOWN" -background red -relief flat -width 5
  
      }

Index: qrylib.tcl
===================================================================
RCS file: /cvsroot/sguil/sguil/client/lib/qrylib.tcl,v
retrieving revision 1.26
retrieving revision 1.27
diff -C2 -d -r1.26 -r1.27
*** qrylib.tcl	16 Nov 2005 22:27:12 -0000	1.26
--- qrylib.tcl	22 Dec 2005 23:12:01 -0000	1.27
***************
*** 8,12 ****
  proc QueryRequest { tableName queryType { incidentCat {NULL} } { build {"build"}}} {
  
!     global CUR_SEL_PANE
  
      set eventtimestamp [lindex [GetCurrentTimeStamp "1 week ago"] 0]
--- 8,38 ----
  proc QueryRequest { tableName queryType { incidentCat {NULL} } { build {"build"}}} {
  
!     global CUR_SEL_PANE 
! 
!     # Example sancp UNION
!     # (
!     #
!     #   SELECT sensor.hostname, sancp.sancpid, sancp.start_time as datetime, sancp.end_time, 
!     #          INET_NTOA(sancp.src_ip), sancp.src_port, INET_NTOA(sancp.dst_ip), sancp.dst_port,
!     #          sancp.ip_proto, sancp.src_pkts, sancp.src_bytes, sancp.dst_pkts, sancp.dst_bytes
!     #   FROM sancp
!     #   IGNORE INDEX (p_key) 
!     #   INNER JOIN sensor ON sancp.sid=sensor.sid
!     #   WHERE sancp.start_time > '2005-08-02' AND sancp.src_ip = INET_ATON('82.96.96.3')
!     #
!     # ) UNION (
!     #
!     #   SELECT sensor.hostname, sancp.sancpid, sancp.start_time as datetime, sancp.end_time,
!     #          INET_NTOA(sancp.src_ip), sancp.src_port, INET_NTOA(sancp.dst_ip), sancp.dst_port,
!     #          sancp.ip_proto, sancp.src_pkts, sancp.src_bytes, sancp.dst_pkts, sancp.dst_bytes
!     #   FROM sancp
!     #   IGNORE INDEX (p_key)
!     #   INNER JOIN sensor ON sancp.sid=sensor.sid
!     #   WHERE sancp.start_time > '2005-08-02' AND sancp.dst_ip = INET_ATON('82.96.96.3')
!     #
!     # ) 
!     #
!     # ORDER BY datetime
!     # LIMIT 500;
  
      set eventtimestamp [lindex [GetCurrentTimeStamp "1 week ago"] 0]
***************
*** 17,23 ****
  
  	if { $incidentCat == "RT" } {
! 	    set whereTmp "WHERE event.status = 0 AND "
  	} else {
! 	    set whereTmp "WHERE $tableName.timestamp > '$eventtimestamp' AND "
  	}   
  
--- 43,49 ----
  
  	if { $incidentCat == "RT" } {
! 	    set globalWhere "WHERE event.status = 0 AND "
  	} else {
! 	    set globalWhere "WHERE $tableName.timestamp > '$eventtimestamp' AND "
  	}   
  
***************
*** 30,38 ****
  	    set tminus [clock format $starttime -f "%Y-%m-%d %T"]
  	    set tplus [clock format $endtime -f "%Y-%m-%d %T"]
! 	    set whereTmp "WHERE $tableName.start_time > '$tminus' AND $tableName.start_time < '$tplus' AND "
  
  	} else {
  
! 	    set whereTmp "WHERE $tableName.start_time > '$ssntimestamp' AND "
  
  	}  
--- 56,64 ----
  	    set tminus [clock format $starttime -f "%Y-%m-%d %T"]
  	    set tplus [clock format $endtime -f "%Y-%m-%d %T"]
! 	    set globalWhere "WHERE $tableName.start_time > '$tminus' AND $tableName.start_time < '$tplus' AND "
  
  	} else {
  
! 	    set globalWhere "WHERE $tableName.start_time > '$ssntimestamp' AND "
  
  	}  
***************
*** 43,66 ****
  
  	set srcIP [$CUR_SEL_PANE(name) getcells $selectedIndex,srcip]
! 	set whereTmp "$whereTmp ($tableName.src_ip = INET_ATON('$srcIP') OR $tableName.dst_ip = INET_ATON('$srcIP'))"
  
      } elseif { $queryType == "srcport" } {
  
  	set srcport [$CUR_SEL_PANE(name) getcells $selectedIndex,srcport]
! 	set whereTmp "$whereTmp ($tableName.src_port = '$srcport' OR $tableName.dst_port = '$srcport')"
  
      } elseif { $queryType == "dstport" } {
  
  	set dstport [$CUR_SEL_PANE(name) getcells $selectedIndex,dstport]
! 	set whereTmp "$whereTmp ($tableName.src_port = '$dstport' OR $tableName.dst_port = '$dstport')"
  
      } elseif { $queryType == "dstip" } {
  
  	set dstIP [$CUR_SEL_PANE(name) getcells $selectedIndex,dstip]
! 	set whereTmp "$whereTmp ($tableName.src_ip  = INET_ATON('$dstIP') OR $tableName.dst_ip = INET_ATON('$dstIP'))"
  
      } elseif { $queryType == "empty" } {
  
! 	set whereTmp "$whereTmp <Insert Query Here>"
  
      } elseif { $queryType == "src2dst" } {
--- 69,96 ----
  
  	set srcIP [$CUR_SEL_PANE(name) getcells $selectedIndex,srcip]
! 	lappend whereTmp "$globalWhere $tableName.src_ip = INET_ATON('$srcIP')"
!         lappend whereTmp "$globalWhere $tableName.dst_ip = INET_ATON('$srcIP')"
  
      } elseif { $queryType == "srcport" } {
  
  	set srcport [$CUR_SEL_PANE(name) getcells $selectedIndex,srcport]
! 	lappend whereTmp "$globalWhere $tableName.src_port = '$srcport'"
!         lappend whereTmp "$globalWhere $tableName.dst_port = '$srcport'"
  
      } elseif { $queryType == "dstport" } {
  
  	set dstport [$CUR_SEL_PANE(name) getcells $selectedIndex,dstport]
! 	lappend whereTmp "$globalWhere $tableName.src_port = '$dstport'"
!         lappend whereTmp "$globalWhere $tableName.dst_port = '$dstport'"
  
      } elseif { $queryType == "dstip" } {
  
  	set dstIP [$CUR_SEL_PANE(name) getcells $selectedIndex,dstip]
! 	lappend whereTmp "$globalWhere $tableName.src_ip = INET_ATON('$dstIP')"
!         lappend whereTmp "$globalWhere $tableName.dst_ip = INET_ATON('$dstIP')"
  
      } elseif { $queryType == "empty" } {
  
! 	lappend whereTmp "$globalWhere <Insert Query Here>"
  
      } elseif { $queryType == "src2dst" } {
***************
*** 68,86 ****
  	set srcIP [$CUR_SEL_PANE(name) getcells $selectedIndex,srcip]
  	set dstIP [$CUR_SEL_PANE(name) getcells $selectedIndex,dstip]
! 	set whereTmp "$whereTmp $tableName.src_ip  = INET_ATON('$srcIP') AND $tableName.dst_ip = INET_ATON('$dstIP')"
  
      } elseif { $queryType == "category" } {
  
! 	set whereTmp "$whereTmp event.status = $incidentCat"
  
      } elseif { $queryType == "signature" } {
  
  	set eventMsg [$CUR_SEL_PANE(name) getcells $selectedIndex,event]
! 	set whereTmp "$whereTmp event.signature = '$eventMsg'"
  
      }
  
      # if it is a sancp query tack a order by start_time on it.  MERGE tables mess up the returned order.
!     if { $tableName == "sancp" } { set whereTmp "$whereTmp ORDER BY $tableName.start_time" }
  
      if { $build != "quick" } {
--- 98,116 ----
  	set srcIP [$CUR_SEL_PANE(name) getcells $selectedIndex,srcip]
  	set dstIP [$CUR_SEL_PANE(name) getcells $selectedIndex,dstip]
! 	lappend whereTmp "$globalWhere $tableName.src_ip  = INET_ATON('$srcIP') AND $tableName.dst_ip = INET_ATON('$dstIP')"
  
      } elseif { $queryType == "category" } {
  
! 	lappend whereTmp "$globalWhere event.status = $incidentCat"
  
      } elseif { $queryType == "signature" } {
  
  	set eventMsg [$CUR_SEL_PANE(name) getcells $selectedIndex,event]
! 	lappend whereTmp "$globalWhere event.signature = '$eventMsg'"
  
      }
  
      # if it is a sancp query tack a order by start_time on it.  MERGE tables mess up the returned order.
!     #if { $tableName == "sancp" } { set whereTmp "$whereTmp ORDER BY $tableName.start_time" }
  
      if { $build != "quick" } {
***************
*** 92,96 ****
      } else {
  
!         set whereStatement "$whereTmp LIMIT 500"
  
      }
--- 122,126 ----
      } else {
  
!         set whereStatement $whereTmp
  
      }
***************
*** 181,249 ****
  # Build an event query tab and send the query to sguild.
  #
! proc DBQueryRequest { whereStatement {winTitle {none} } } {
!   global eventTabs QUERY_NUMBER socketID DEBUG
!   global CONNECTED
!   if {!$CONNECTED} {ErrorMessage "Not connected to sguild. Query aborted."; return}
    
!   set selectQuery "SELECT event.status, event.priority, sensor.hostname, event.timestamp,\
!    event.sid, event.cid, event.signature,\
!    INET_NTOA(event.src_ip), INET_NTOA(event.dst_ip), event.ip_proto,\
!    event.src_port, event.dst_port"
!   # Parse the WHERE and determine what tables we need to SELECT from.
!   # We'll always have 'event' and 'sensor'.
!   set fromQuery " FROM event INNER JOIN sensor ON event.sid=sensor.sid"
!   if { [regexp {\s+user_info\.} $whereStatement] } {
!     set fromQuery "$fromQuery INNER JOIN user_info ON user_info.uid=event.last_uid"
!   }
!   if { [regexp {\s+tcphdr\.} $whereStatement] } {
!     set fromQuery "$fromQuery INNER JOIN tcphdr ON event.sid=tcphdr.sid AND event.cid=tcphdr.cid"
!   }
!   if { [regexp {\s+udphdr\.} $whereStatement] } {
!     set fromQuery "$fromQuery INNER JOIN udphdr ON event.sid=udphdr.sid AND event.cid=udphdr.cid"
!   }
!   if { [regexp {\s+icmphdr\.} $whereStatement] } {
!     set fromQuery "$fromQuery INNER JOIN icmphdr ON event.sid=icmphdr.sid AND event.cid=icmphdr.cid"
!   }
!   if { [regexp {\s+data\.} $whereStatement] } {
!     set fromQuery "$fromQuery INNER JOIN data ON event.sid=data.sid AND event.cid=data.cid"
!   }
!   set selectQuery "$selectQuery $fromQuery $whereStatement"
!   regsub -all {\n} $selectQuery {} selectQuery
!   incr QUERY_NUMBER
!   if { $winTitle == "none" } {
!     $eventTabs add -label "Event Query $QUERY_NUMBER"
!   } else {
!     $eventTabs add -label "Event Query $winTitle"
!   }
!   set currentTab [$eventTabs childsite end]
!   set tabIndex [$eventTabs index end]
!   set queryFrame [frame $currentTab.query_$QUERY_NUMBER -background black -borderwidth 1]
!   $eventTabs select end
!   CreateEventLists $queryFrame 1 0
!   set buttonFrame [frame $currentTab.buttonFrame]
!   set whereText [text $buttonFrame.text -background white -height 1 -wrap none]
!   $whereText insert 0.0 $whereStatement
!   bind $whereText <Return> {
!     set whereStatement [%W get 0.0 end]
!     DBQueryRequest $whereStatement
!     break
!   }
!   set closeButton [button $buttonFrame.close -text "Close" \
! 	  -relief raised -borderwidth 2 -pady 0 \
! 	  -command "DeleteTab $eventTabs $currentTab"]
!   set exportButton [button $buttonFrame.export -text "Export " \
! 	  -relief raised -borderwidth 2 -pady 0 \
! 	  -command "ExportResults $queryFrame event"]
!   set rsubmitButton [button $buttonFrame.rsubmit -text "Submit " \
! 	  -relief raised -borderwidth 2 -pady 0 \
! 	  -command "DBQueryRequest \[$whereText get 0.0 end\] "]
!   pack $closeButton $exportButton -side left
!   pack $whereText -side left -fill x -expand true
!   pack $rsubmitButton  -side left
!   pack $buttonFrame -side top -fill x
!   pack $queryFrame -side bottom -fill both
!   $queryFrame configure -cursor watch
!   if {$DEBUG} { puts "Sending Server: QueryDB $queryFrame.tablelist $selectQuery" }
!   SendToSguild "QueryDB $queryFrame.tablelist $selectQuery"
  }
  # Depreciated
--- 211,316 ----
  # Build an event query tab and send the query to sguild.
  #
! proc DBQueryRequest { whereList {winTitle {none} } } {
! 
!     global eventTabs QUERY_NUMBER socketID DEBUG
!     global CONNECTED SELECT_LIMIT
! 
!     if {!$CONNECTED} {ErrorMessage "Not connected to sguild. Query aborted."; return}
    
!     set COLUMNS "event.status, event.priority, sensor.hostname, \
!      event.timestamp as datetime, event.sid, event.cid, event.signature,\
!      INET_NTOA(event.src_ip), INET_NTOA(event.dst_ip), event.ip_proto,\
!      event.src_port, event.dst_port"
! 
!     # Parse the WHERE's and determine what tables we need to SELECT from.
! 
!     # We'll always have 'event' and 'sensor'.
!     set JOINS "INNER JOIN sensor ON event.sid=sensor.sid"
! 
!     foreach whereStatement $whereList {
! 
!         #  user_info
!         if { [regexp {\s+user_info\.} $whereStatement] } {
!             set JOINS "$JOINS INNER JOIN user_info ON user_info.uid=event.last_uid"
!         }
! 
!          # tcphdr
!         if { [regexp {\s+tcphdr\.} $whereStatement] } {
!             set JOINS "$JOINS INNER JOIN tcphdr ON event.sid=tcphdr.sid AND event.cid=tcphdr.cid"
!         }
! 
!         # udphdr
!         if { [regexp {\s+udphdr\.} $whereStatement] } {
!             set JOINS "$JOINS INNER JOIN udphdr ON event.sid=udphdr.sid AND event.cid=udphdr.cid"
!         }
! 
!         # icmphdr
!         if { [regexp {\s+icmphdr\.} $whereStatement] } {
!             set JOINS "$JOINS INNER JOIN icmphdr ON event.sid=icmphdr.sid AND event.cid=icmphdr.cid"
!         }
! 
!         # data
!         if { [regexp {\s+data\.} $whereStatement] } {
!             set JOINS "$JOINS INNER JOIN data ON event.sid=data.sid AND event.cid=data.cid"
!         }
! 
!         lappend queries "SELECT $COLUMNS FROM event IGNORE INDEX (event_p_key, sid_time) $JOINS $whereStatement"
! 
!     }
! 
!     # Union queries have a llength > 0
!     if { [llength $queries] > 1 } {
!  
!         set tmpQry [join $queries " ) UNION ( "]
!         set fQuery "( $tmpQry ) ORDER BY datetime DESC LIMIT $SELECT_LIMIT"
!     
!     } else {
! 
!         set fQuery "[lindex $queries 0] ORDER BY datetime DESC LIMIT $SELECT_LIMIT"
! 
!     }
! 
!     regsub -all {\n} $fQuery {} selectQuery
! 
!     incr QUERY_NUMBER
! 
!     if { $winTitle == "none" } {
!         $eventTabs add -label "Event Query $QUERY_NUMBER"
!     } else {
!         $eventTabs add -label "Event Query $winTitle"
!     }
! 
!     set currentTab [$eventTabs childsite end]
!     set tabIndex [$eventTabs index end]
!     set queryFrame [frame $currentTab.query_$QUERY_NUMBER -background black -borderwidth 1]
!     $eventTabs select end
!     CreateEventLists $queryFrame 1 0
!     set buttonFrame [frame $currentTab.buttonFrame]
!     set whereText [scrolledtext $buttonFrame.text -textbackground white -visibleitems 30x2 -wrap word \
!       -vscrollmode dynamic -hscrollmode none -sbwidth 10]
!     $whereText insert 0.0 $selectQuery
!     bind $whereText <Return> {
!         set whereStatement [%W get 0.0 end]
!         DBQueryRequest $whereStatement
!         break
!     }
!     set closeButton [button $buttonFrame.close -text "Close" \
! 	    -relief raised -borderwidth 2 -pady 0 \
! 	    -command "DeleteTab $eventTabs $currentTab"]
!     set exportButton [button $buttonFrame.export -text "Export " \
! 	    -relief raised -borderwidth 2 -pady 0 \
! 	    -command "ExportResults $queryFrame event"]
!     set rsubmitButton [button $buttonFrame.rsubmit -text "Submit " \
! 	    -relief raised -borderwidth 2 -pady 0 \
! 	    -command "DBQueryRequest \[$whereText get 0.0 end\] "]
!     pack $closeButton $exportButton -side left
!     pack $whereText -side left -fill x -expand true
!     pack $rsubmitButton  -side left
!     pack $buttonFrame -side top -fill x
!     pack $queryFrame -side bottom -fill both
!     $queryFrame configure -cursor watch
!     if {$DEBUG} { puts "Sending Server: QueryDB $queryFrame.tablelist $selectQuery" }
!     SendToSguild "QueryDB $queryFrame.tablelist $selectQuery"
! 
  }
  # Depreciated

Index: sancp.tcl
===================================================================
RCS file: /cvsroot/sguil/sguil/client/lib/sancp.tcl,v
retrieving revision 1.5
retrieving revision 1.6
diff -C2 -d -r1.5 -r1.6
*** sancp.tcl	16 Nov 2005 22:27:12 -0000	1.5
--- sancp.tcl	22 Dec 2005 23:12:01 -0000	1.6
***************
*** 3,17 ****
  # Build a sancp query tab and send the query to sguild.
  #
! proc SancpQueryRequest { whereStatement } {
  
!     global eventTabs SANCP_QUERY_NUMBER DEBUG CONNECTED
  
      if {!$CONNECTED} {ErrorMessage "Not connected to sguild. Query aborted"; return}
  
!     set selectQuery "SELECT sensor.hostname, sancp.sancpid, sancp.start_time, sancp.end_time,\
       INET_NTOA(sancp.src_ip), sancp.src_port, INET_NTOA(sancp.dst_ip), sancp.dst_port,\
!      sancp.ip_proto, sancp.src_pkts, sancp.src_bytes, sancp.dst_pkts, sancp.dst_bytes\
!      FROM sancp INNER JOIN sensor ON sancp.sid=sensor.sid $whereStatement"
!     regsub -all {\n} $selectQuery {} selectQuery
  
      incr SANCP_QUERY_NUMBER
--- 3,36 ----
  # Build a sancp query tab and send the query to sguild.
  #
! proc SancpQueryRequest { whereList } {
  
!     global eventTabs SANCP_QUERY_NUMBER DEBUG CONNECTED SELECT_LIMIT
  
      if {!$CONNECTED} {ErrorMessage "Not connected to sguild. Query aborted"; return}
  
!     set COLUMNS "sensor.hostname, sancp.sancpid, sancp.start_time as datetime, sancp.end_time,\
       INET_NTOA(sancp.src_ip), sancp.src_port, INET_NTOA(sancp.dst_ip), sancp.dst_port,\
!      sancp.ip_proto, sancp.src_pkts, sancp.src_bytes, sancp.dst_pkts, sancp.dst_bytes"
! 
!     foreach whereStatement $whereList {
! 
!         lappend queries "SELECT $COLUMNS FROM sancp IGNORE INDEX (p_key) \
!                          INNER JOIN sensor ON sancp.sid=sensor.sid $whereStatement" 
! 
!     }
! 
!     # Build UNION if required
!     if { [llength $queries] > 1 } {
! 
!         set tmpQry [join $queries " ) UNION ( "]
!         set fQuery "( $tmpQry ) ORDER BY datetime DESC LIMIT $SELECT_LIMIT"
! 
!     } else {
! 
!         set fQuery "[lindex $queries 0] ORDER BY datetime DESC LIMIT $SELECT_LIMIT"
! 
!     }
! 
!     regsub -all {\n} $fQuery {} selectQuery
  
      incr SANCP_QUERY_NUMBER
***************
*** 26,30 ****
      set buttonFrame [frame $currentTab.buttonFrame]
      set whereText [text $buttonFrame.text -height 1 -background white -wrap none]
!     $whereText insert 0.0 $whereStatement
      bind $whereText <Return> {
        set whereStatement [%W get 0.0 end]
--- 45,49 ----
      set buttonFrame [frame $currentTab.buttonFrame]
      set whereText [text $buttonFrame.text -height 1 -background white -wrap none]
!     $whereText insert 0.0 $selectQuery
      bind $whereText <Return> {
        set whereStatement [%W get 0.0 end]

Index: qrybuild.tcl
===================================================================
RCS file: /cvsroot/sguil/sguil/client/lib/qrybuild.tcl,v
retrieving revision 1.33
retrieving revision 1.34
diff -C2 -d -r1.33 -r1.34
*** qrybuild.tcl	14 Feb 2005 17:02:08 -0000	1.33
--- qrybuild.tcl	22 Dec 2005 23:12:01 -0000	1.34
***************
*** 1,6 ****
  # $Id$ #
! proc QryBuild {tableSelected whereTmp } {
!     global RETURN_FLAG SELECTEDTABLE
!     global  tableColumnArray tableList funcList
      set RETURN_FLAG 0
      set SELECTEDTABLE $tableSelected
--- 1,8 ----
  # $Id$ #
! proc QryBuild { tableSelected whereTmp } {
! 
!     global RETURN_FLAG SELECTEDTABLE SELECT_LIMIT
!     global  tableColumnArray tableList funcList whereBoxList
! 
      set RETURN_FLAG 0
      set SELECTEDTABLE $tableSelected
***************
*** 71,103 ****
      set editFrame [frame $mainFrame.eFrame -background black -borderwidth 1]
        
!       # main edit box
!       set editBox [scrolledtext $editFrame.eBox -textbackground white -vscrollmode dynamic \
! 		-sbwidth 10 -hscrollmode none -wrap word -visibleitems 60x10 -textfont ourFixedFont \
! 		-labeltext "Edit Where Clause"]
!       
!       if { ![string match -nocase *limit* $whereTmp] } { set whereTmp "$whereTmp  LIMIT 500" }
!       $editBox insert end $whereTmp
!       $editBox mark set insert "end -11 c"
!       
  
        # Button box on left of edit box 
        set mainBB1 [buttonbox $editFrame.mbb1 -padx 0 -pady 0 -orient vertical]
        foreach logical $funcList(Logical) {
! 	  set command "$editBox insert insert \"[lindex $logical 1] \""
! 	  $mainBB1 add [lindex $logical 0] -text [lindex $logical 0] -padx 0 -pady 0 -command "$command"
        }
        # One last button for the left side that acts differently
!       $mainBB1 add ipAddress -text "IP Address" -padx 0 -pady 0 -command "IPAddress2SQL builder $editBox"
        
        # button box to right of main edit box
        set mainBB2 [buttonbox $editFrame.mbb2 -padx 0 -pady 0 -orient vertical]
        foreach comparison $funcList(Comparison) {
! 	  set command "$editBox insert insert \"[lindex $comparison 1] \""
! 	  $mainBB2 add [lindex $comparison 0] -text [lindex $comparison 0] -padx 0 -pady 0 -command "$command"
        }
        
        # packing children of edit frame
        pack $mainBB1 -side left -fill y
!       pack $editBox -side left -fill both -expand true
        pack $mainBB2 -side left -fill y
  
--- 73,119 ----
      set editFrame [frame $mainFrame.eFrame -background black -borderwidth 1]
        
!     set whereFrame [frame $editFrame.whereFrame]
!     set cnt 0
!     foreach where $whereTmp {
!         set f ${whereFrame}.frame${cnt}
!         set b ${f}.ub
!         if [info exists editBox] {
!             $b configure -text "Delete" -command "DeleteWhereBox $f $editBox"
!         }
! 
!         set editBox [AddWhereBox $whereFrame $cnt]
!         lappend whereBoxList $editBox
!         incr cnt
! 
!         $editBox insert end $where
!         $editBox mark set insert "end -11 c"
! 
!     }
! 
!     # Define LIMIT
!     set SELECT_LIMIT 1000
!     set maxRowsText [entryfield $whereFrame.maxRows -labeltext "LIMIT" -labelpos w -width 5 \
!                      -textvariable SELECT_LIMIT]
!     pack $maxRowsText -side bottom -expand no
! 
  
+       
        # Button box on left of edit box 
        set mainBB1 [buttonbox $editFrame.mbb1 -padx 0 -pady 0 -orient vertical]
        foreach logical $funcList(Logical) {
! 	      $mainBB1 add [lindex $logical 0] -text [lindex $logical 0] -padx 0 -pady 0 -command "ScrolledTextInsert [lindex $logical 1]"
        }
        # One last button for the left side that acts differently
!       $mainBB1 add ipAddress -text "IP Address" -padx 0 -pady 0 -command "IPAddress2SQL builder"
        
        # button box to right of main edit box
        set mainBB2 [buttonbox $editFrame.mbb2 -padx 0 -pady 0 -orient vertical]
        foreach comparison $funcList(Comparison) {
!           $mainBB2 add [lindex $comparison 0] -text [lindex $comparison 0] -padx 0 -pady 0 -command "SrolledTextInsert [lindex $comparison 1]"
        }
        
        # packing children of edit frame
        pack $mainBB1 -side left -fill y
!       pack $whereFrame -side left -fill both -expand true
        pack $mainBB2 -side left -fill y
  
***************
*** 114,118 ****
  	      -visibleitems 20x10 -foreground darkblue -textbackground lightblue]
        set itemList [scrolledlistbox $selectFrame.iList -hscrollmode dynamic -sbwidth 10\
! 	     -dblclickcommand "addToEditBox $editBox $selectFrame" \
  	     -scrollmargin 5 -labeltext "Items" \
  	     -labelpos n -vscrollmode static -hscrollmode static\
--- 130,134 ----
  	      -visibleitems 20x10 -foreground darkblue -textbackground lightblue]
        set itemList [scrolledlistbox $selectFrame.iList -hscrollmode dynamic -sbwidth 10\
! 	     -dblclickcommand "addToEditBox $selectFrame" \
  	     -scrollmargin 5 -labeltext "Items" \
  	     -labelpos n -vscrollmode static -hscrollmode static\
***************
*** 133,137 ****
  	  $logicBox add not -text "NOT selected flags"
  	  $logicBox select only
! 	set insertButton [button $flagFrame.iButton -command "addToEditBoxFlags $editBox $flagFrame" -text "Insert"]
  	
  	# packing children of flag Frame
--- 149,153 ----
  	  $logicBox add not -text "NOT selected flags"
  	  $logicBox select only
! 	set insertButton [button $flagFrame.iButton -command "addToEditBoxFlags $flagFrame" -text "Insert"]
  	
  	# packing children of flag Frame
***************
*** 162,177 ****
  
      tkwait variable RETURN_FLAG
!     set returnWhere [list cancel cancel]
      if {$RETURN_FLAG} {
!         # No \n for you!
!         regsub -all {\n} [$editBox get 0.0 end] {} returnWhere
! 	set returnWhere "[list $SELECTEDTABLE $returnWhere]"
      } else {
! 	set returnWhere [list cancel cancel]
      }
      destroy $qryBldWin
      return $returnWhere  
  }
  
  
  proc updateCatList { selectFrame } {
--- 178,286 ----
  
      tkwait variable RETURN_FLAG
!     set returnWhere [list cancel [list cancel]]
      if {$RETURN_FLAG} {
!         foreach box $whereBoxList {
!             # No \n for you!
!             regsub -all {\n} [$box get 0.0 end] {} tmpWhere
!             lappend whereList $tmpWhere
!         }
! 	set returnWhere "[list $SELECTEDTABLE $whereList]"
      } else {
! 	set returnWhere [list cancel [list cancel]]
      }
      destroy $qryBldWin
+ 
+     set whereBoxList ""
+ 
      return $returnWhere  
+ 
+ }
+ 
+ proc AddWhereBox { frame cnt } {
+ 
+     incr cnt
+     set f $frame.frame$cnt
+     set st $f.st
+     set ub $f.ub
+ 
+     frame $f 
+     scrolledtext $st -textbackground white -vscrollmode dynamic \
+ 		-sbwidth 10 -hscrollmode none -wrap word -visibleitems 60x3 -textfont ourFixedFont \
+ 		-labeltext "Edit Where Clause $cnt"
+     button $ub -text "Add Union" -command "AddUnion $frame $f $st $ub $cnt"
+ 
+     pack $st -side top -expand true -fill both
+     pack $ub -side bottom -expand false
+     pack $f -side top -expand true -fill both
+ 
+     return $st
+ 
+ }
+ 
+ proc DeleteWhereBox { oldFrame oldSt } {
+ 
+     global whereBoxList
+    
+     set whereBoxList [ldelete $whereBoxList $oldSt]
+     destroy $oldFrame 
+ 
+ }
+ 
+ proc AddUnion { frame oldFrame oldSt oldUb cnt } {
+ 
+     global whereBoxList
+ 
+     # Change the button on the calling where box.
+     $oldUb configure -text "Delete" -command "DeleteWhereBox $oldFrame $oldSt"
+     
+     # Create new where box
+     set st [AddWhereBox $frame $cnt]
+     lappend whereBoxList $st
+ 
+     # Copy data from old into new
+     set whereTmp [$oldSt get 0.0 end]
+     $st insert end $whereTmp
+     $st  mark set insert "end -11 c"
+ 
+ }
+ 
+ proc IsWhereBox { win } {
+ 
+     global whereBoxList
+ 
+     set FOCUS 0
+     foreach whereBox $whereBoxList {
+ 
+         if { $win == [$whereBox component text] } {
+ 
+             set FOCUS 1
+             break
+ 
+         }
+         
+     }
+ 
+     return $FOCUS
+ 
  }
  
+ proc ScrolledTextInsert { data } {
+ 
+     global whereBoxList
+ 
+     set currentWin [focus]
+ 
+     if { [IsWhereBox $currentWin] } { 
+ 
+         $currentWin insert insert "$data "
+ 
+     } else {
+ 
+         tk_messageBox -type ok -parent .qryBldWin \
+           -message "Cannot insert \"$data\" into SQL. None of the text boxes have focus."
+ 
+     }
+ 
+ }
  
  proc updateCatList { selectFrame } {
***************
*** 229,236 ****
  }
  
! proc addToEditBox { editBox selectFrame } {
      global catSelection metaSelection funcList
      
      
      #if Meta is set to table, prepend tablename. to the item
      if {$metaSelection == "Tables"} {
--- 338,352 ----
  }
  
! proc addToEditBox { selectFrame } {
! 
      global catSelection metaSelection funcList
      
      
+     set currentWin [focus]
+     if { ![IsWhereBox $currentWin] } {
+         tk_messageBox -type ok -parent .qryBldWin \
+           -message "Click in the text box you want to insert data into first."
+         return
+     }
      #if Meta is set to table, prepend tablename. to the item
      if {$metaSelection == "Tables"} {
***************
*** 241,249 ****
      }
      
!     $editBox insert insert "$addText "
  }
  
! proc addToEditBoxFlags {editBox flagFrame} {
      
      # add up the flags selected to get the decimal representation
      set flaglist [$flagFrame.fBox get]
--- 357,371 ----
      }
      
!     $currentWin insert insert "$addText "
  }
  
! proc addToEditBoxFlags { flagFrame } {
      
+     set currentWin [focus]
+     if { ![IsWhereBox $currentWin] } {
+         tk_messageBox -type ok -parent .qryBldWin \
+           -message "Click in the text box you want to insert data into first."
+         return
+     }
      # add up the flags selected to get the decimal representation
      set flaglist [$flagFrame.fBox get]
***************
*** 274,278 ****
      }
      
!     $editBox insert insert $insert
  }	
  
--- 396,400 ----
      }
      
!     $currentWin insert insert $insert
  }	
  
***************
*** 305,314 ****
  #  InvokeQryBuild:  Call this proc if you need QueryBuilder to run stand-alone.
  #     Calls DBQryRequest or SSNQryRequest after QryBuild is done
! proc InvokeQryBuild { tableSelected whereTmp } {
      
!     set tmpWhereStatement [QryBuild $tableSelected $whereTmp]
!     set whereStatement [lindex $tmpWhereStatement 1]
      set tableName [lindex $tmpWhereStatement 0]
!     if { $whereStatement == "cancel" } { return }
      if { $tableName == "event" } {
  	DBQueryRequest $whereStatement
--- 427,436 ----
  #  InvokeQryBuild:  Call this proc if you need QueryBuilder to run stand-alone.
  #     Calls DBQryRequest or SSNQryRequest after QryBuild is done
! proc InvokeQryBuild { tableSelected whereTmpList } {
      
!     set tmpWhereStatement [QryBuild $tableSelected $whereTmpList]
      set tableName [lindex $tmpWhereStatement 0]
!     if { $tableName == "cancel" } { return }
!     set whereStatement [lindex $tmpWhereStatement 1]
      if { $tableName == "event" } {
  	DBQueryRequest $whereStatement
***************
*** 330,334 ****
  proc IPAddress2SQL { caller {parameter {NULL}} } {
  
!     global SELECTEDTABLE RETURN_FLAG_IP
  
      # Create the window
--- 452,469 ----
  proc IPAddress2SQL { caller {parameter {NULL}} } {
  
!     global SELECTEDTABLE RETURN_FLAG_IP whereBoxList
! 
!     # If we came in thru the query builder then we check to see
!     # which WHERE is active.
!     if { $caller == "builder" } {
! 
!         set currentWin [focus]
!         if { ![IsWhereBox $currentWin] } {
!             tk_messageBox -type ok -parent .qryBldWin \
!               -message "Click in the text box you want to insert data into first."
!             return
!         }
! 
!     }
  
      # Create the window
***************
*** 391,395 ****
  	ErrorMessage "Error.  Invalid IP Address"
  	    destroy $ipAddressWin
! 	    IPAddress2SQL $caller $parameter
      }
      
--- 526,530 ----
  	ErrorMessage "Error.  Invalid IP Address"
  	    destroy $ipAddressWin
! 	    IPAddress2SQL $caller
      }
      
***************
*** 397,401 ****
      set bcastaddress [lindex $iplist 3]
      # find the decimal values for the ip network and broadcast addresses
-     set editBox $parameter
      set decNetwork [InetAtoN $networknumber]
      set decBcast [InetAtoN $bcastaddress]
--- 532,535 ----
***************
*** 416,420 ****
      # do something depending on who called us
      if { $caller == "builder" } {
! 	$editBox insert insert $inserttext
  	destroy $ipAddressWin 
  	return
--- 550,554 ----
      # do something depending on who called us
      if { $caller == "builder" } {
! 	$currentWin insert insert $inserttext
  	destroy $ipAddressWin 
  	return