mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 05:28:20 +00:00
Rename Pacf to NetControl
This commit is contained in:
Johanna Amann
parent
eb9fbd1258
commit
0e213352d7
61 changed files with 498 additions and 498 deletions
111
testing/btest/scripts/base/frameworks/netcontrol/acld.bro
Normal file
111
testing/btest/scripts/base/frameworks/netcontrol/acld.bro
Normal file
|
|
@ -0,0 +1,111 @@
|
|||
# @TEST-SERIALIZE: brokercomm
|
||||
# @TEST-REQUIRES: grep -q ENABLE_BROKER $BUILD/CMakeCache.txt
|
||||
# @TEST-EXEC: btest-bg-run recv "bro -b ../recv.bro broker_port=$BROKER_PORT >recv.out"
|
||||
# @TEST-EXEC: btest-bg-run send "bro -b -r $TRACES/smtp.trace --pseudo-realtime ../send.bro broker_port=$BROKER_PORT >send.out"
|
||||
|
||||
# @TEST-EXEC: btest-bg-wait 20
|
||||
# @TEST-EXEC: btest-diff recv/recv.out
|
||||
# @TEST-EXEC: btest-diff send/send.out
|
||||
|
||||
@TEST-START-FILE send.bro
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
const broker_port: port &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
suspend_processing();
|
||||
local netcontrol_acld = NetControl::create_acld(NetControl::AcldConfig($acld_host=127.0.0.1, $acld_port=broker_port, $acld_topic="bro/event/netcontroltest"));
|
||||
NetControl::activate(netcontrol_acld, 0);
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_established(peer_address: string,
|
||||
peer_port: port,
|
||||
peer_name: string)
|
||||
{
|
||||
print "BrokerComm::outgoing_connection_established", peer_address, peer_port;
|
||||
continue_processing();
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_broken(peer_address: string,
|
||||
peer_port: port)
|
||||
{
|
||||
terminate();
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
|
||||
local flow1 = NetControl::Flow(
|
||||
$src_h=addr_to_subnet(c$id$orig_h),
|
||||
$dst_h=addr_to_subnet(c$id$resp_h)
|
||||
);
|
||||
local e1: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow1];
|
||||
local r1: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e1, $expire=10hrs, $location="here"];
|
||||
|
||||
local flow2 = NetControl::Flow(
|
||||
$dst_p=c$id$resp_p
|
||||
);
|
||||
local e2: NetControl::Entity = [$ty=NetControl::FLOW, $flow=flow2];
|
||||
local r2: NetControl::Rule = [$ty=NetControl::DROP, $target=NetControl::FORWARD, $entity=e2, $expire=10hrs, $location="here"];
|
||||
|
||||
NetControl::add_rule(r1);
|
||||
NetControl::add_rule(r2);
|
||||
NetControl::drop_address(id$orig_h, 10hrs);
|
||||
}
|
||||
|
||||
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
|
||||
{
|
||||
print "rule added", r;
|
||||
NetControl::remove_rule(r$id);
|
||||
}
|
||||
|
||||
event NetControl::rule_removed(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
|
||||
{
|
||||
print "rule removed", r;
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE recv.bro
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
@load base/frameworks/broker
|
||||
|
||||
const broker_port: port &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::subscribe_to_events("bro/event/netcontroltest");
|
||||
BrokerComm::listen(broker_port, "127.0.0.1");
|
||||
}
|
||||
|
||||
event BrokerComm::incoming_connection_established(peer_name: string)
|
||||
{
|
||||
print "BrokerComm::incoming_connection_established";
|
||||
}
|
||||
|
||||
event NetControl::acld_add_rule(id: count, r: NetControl::Rule, ar: NetControl::AclRule)
|
||||
{
|
||||
print "add_rule", id, r, ar;
|
||||
|
||||
BrokerComm::event("bro/event/netcontroltest", BrokerComm::event_args(NetControl::acld_rule_added, id, r, ar$command));
|
||||
}
|
||||
|
||||
event NetControl::acld_remove_rule(id: count, r: NetControl::Rule, ar: NetControl::AclRule)
|
||||
{
|
||||
print "remove_rule", id, r, ar;
|
||||
|
||||
BrokerComm::event("bro/event/netcontroltest", BrokerComm::event_args(NetControl::acld_rule_removed, id, r, ar$command));
|
||||
|
||||
if ( r$cid == 4 )
|
||||
terminate();
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run manager-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=manager-1 bro %INPUT"
|
||||
# @TEST-EXEC: sleep 1
|
||||
# @TEST-EXEC: btest-bg-run worker-1 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-1 bro --pseudo-realtime -C -r $TRACES/smtp.trace %INPUT"
|
||||
# @TEST-EXEC: sleep 1
|
||||
# @TEST-EXEC: btest-bg-run worker-2 "cp ../cluster-layout.bro . && CLUSTER_NODE=worker-2 bro --pseudo-realtime -C -r $TRACES/smtp.trace %INPUT"
|
||||
# @TEST-EXEC: btest-bg-wait 20
|
||||
# @TEST-EXEC: btest-diff manager-1/netcontrol.log
|
||||
# @TEST-EXEC: btest-diff worker-1/.stdout
|
||||
# @TEST-EXEC: btest-diff worker-2/.stdout
|
||||
|
||||
@TEST-START-FILE cluster-layout.bro
|
||||
redef Cluster::nodes = {
|
||||
["manager-1"] = [$node_type=Cluster::MANAGER, $ip=127.0.0.1, $p=37757/tcp, $workers=set("worker-1", "worker-2")],
|
||||
["worker-1"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37760/tcp, $manager="manager-1", $interface="eth0"],
|
||||
["worker-2"] = [$node_type=Cluster::WORKER, $ip=127.0.0.1, $p=37761/tcp, $manager="manager-1", $interface="eth0"],
|
||||
};
|
||||
@TEST-END-FILE
|
||||
|
||||
redef Log::default_rotation_interval = 0secs;
|
||||
#redef exit_only_after_terminate = T;
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
|
||||
NetControl::drop_address(id$orig_h, 15sec);
|
||||
}
|
||||
|
||||
event terminate_me() {
|
||||
terminate();
|
||||
}
|
||||
|
||||
event remote_connection_closed(p: event_peer) {
|
||||
schedule 1sec { terminate_me() };
|
||||
}
|
||||
|
||||
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string &default="")
|
||||
{
|
||||
print "Rule added", r$id, r$cid;
|
||||
}
|
||||
20
testing/btest/scripts/base/frameworks/netcontrol/basic.bro
Normal file
20
testing/btest/scripts/base/frameworks/netcontrol/basic.bro
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-sort' btest-diff netcontrol.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff .stdout
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
|
||||
NetControl::drop_address(id$orig_h, 15sec);
|
||||
NetControl::whitelist_address(id$orig_h, 15sec);
|
||||
NetControl::redirect_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 5, 30sec);
|
||||
}
|
||||
102
testing/btest/scripts/base/frameworks/netcontrol/broker.bro
Normal file
102
testing/btest/scripts/base/frameworks/netcontrol/broker.bro
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
# @TEST-SERIALIZE: brokercomm
|
||||
# @TEST-REQUIRES: grep -q ENABLE_BROKER $BUILD/CMakeCache.txt
|
||||
# @TEST-EXEC: btest-bg-run recv "bro -b ../recv.bro broker_port=$BROKER_PORT >recv.out"
|
||||
# @TEST-EXEC: btest-bg-run send "bro -b -r $TRACES/smtp.trace --pseudo-realtime ../send.bro broker_port=$BROKER_PORT >send.out"
|
||||
|
||||
# @TEST-EXEC: btest-bg-wait 20
|
||||
# @TEST-EXEC: btest-diff recv/recv.out
|
||||
# @TEST-EXEC: btest-diff send/send.out
|
||||
|
||||
@TEST-START-FILE send.bro
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
const broker_port: port &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
suspend_processing();
|
||||
local netcontrol_broker = NetControl::create_broker(127.0.0.1, broker_port, "bro/event/netcontroltest", T);
|
||||
NetControl::activate(netcontrol_broker, 0);
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_established(peer_address: string,
|
||||
peer_port: port,
|
||||
peer_name: string)
|
||||
{
|
||||
print "BrokerComm::outgoing_connection_established", peer_address, peer_port;
|
||||
continue_processing();
|
||||
}
|
||||
|
||||
event BrokerComm::outgoing_connection_broken(peer_address: string,
|
||||
peer_port: port)
|
||||
{
|
||||
terminate();
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 10hrs);
|
||||
NetControl::drop_address(id$orig_h, 10hrs);
|
||||
}
|
||||
|
||||
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
|
||||
{
|
||||
print "rule added", r;
|
||||
NetControl::remove_rule(r$id);
|
||||
}
|
||||
|
||||
event NetControl::rule_removed(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
|
||||
{
|
||||
print "rule removed", r;
|
||||
}
|
||||
|
||||
event NetControl::rule_timeout(r: NetControl::Rule, i: NetControl::FlowInfo, p: NetControl::PluginState)
|
||||
{
|
||||
print "rule timeout", r, i;
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE recv.bro
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
@load base/frameworks/broker
|
||||
|
||||
const broker_port: port &redef;
|
||||
redef exit_only_after_terminate = T;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
BrokerComm::enable();
|
||||
BrokerComm::subscribe_to_events("bro/event/netcontroltest");
|
||||
BrokerComm::listen(broker_port, "127.0.0.1");
|
||||
}
|
||||
|
||||
event BrokerComm::incoming_connection_established(peer_name: string)
|
||||
{
|
||||
print "BrokerComm::incoming_connection_established";
|
||||
}
|
||||
|
||||
event NetControl::broker_add_rule(id: count, r: NetControl::Rule)
|
||||
{
|
||||
print "add_rule", id, r;
|
||||
|
||||
BrokerComm::event("bro/event/netcontroltest", BrokerComm::event_args(NetControl::broker_rule_added, id, r, ""));
|
||||
}
|
||||
|
||||
event NetControl::broker_remove_rule(id: count, r: NetControl::Rule)
|
||||
{
|
||||
print "remove_rule", id, r;
|
||||
|
||||
BrokerComm::event("bro/event/netcontroltest", BrokerComm::event_args(NetControl::broker_rule_timeout, id, r, NetControl::FlowInfo()));
|
||||
BrokerComm::event("bro/event/netcontroltest", BrokerComm::event_args(NetControl::broker_rule_removed, id, r, ""));
|
||||
|
||||
if ( r$cid == 3 )
|
||||
terminate();
|
||||
}
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-sort' btest-diff netcontrol.log
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff .stdout
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
module NetControl;
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::drop_address_catch_release(id$orig_h);
|
||||
# second one should be ignored because duplicate
|
||||
NetControl::drop_address_catch_release(id$orig_h);
|
||||
|
||||
# mean call directly into framework - simulate new connection
|
||||
delete current_blocks[id$orig_h];
|
||||
check_conn(id$orig_h);
|
||||
delete current_blocks[id$orig_h];
|
||||
check_conn(id$orig_h);
|
||||
delete current_blocks[id$orig_h];
|
||||
check_conn(id$orig_h);
|
||||
delete current_blocks[id$orig_h];
|
||||
check_conn(id$orig_h);
|
||||
}
|
||||
|
||||
27
testing/btest/scripts/base/frameworks/netcontrol/hook.bro
Normal file
27
testing/btest/scripts/base/frameworks/netcontrol/hook.bro
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff netcontrol.log
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
NetControl::activate(netcontrol_debug, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
|
||||
NetControl::drop_address(id$orig_h, 15sec);
|
||||
NetControl::whitelist_address(id$orig_h, 15sec);
|
||||
NetControl::redirect_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 5, 30sec);
|
||||
}
|
||||
|
||||
hook NetControl::rule_policy(r: NetControl::Rule)
|
||||
{
|
||||
if ( r$expire == 15sec )
|
||||
break;
|
||||
|
||||
r$entity$flow$src_h = 0.0.0.0/0;
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-sort' btest-diff netcontrol.log
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local netcontrol_debug = NetControl::create_debug(T);
|
||||
local netcontrol_debug_2 = NetControl::create_debug(T);
|
||||
local of_controller = OpenFlow::log_new(42);
|
||||
local netcontrol_of = NetControl::create_openflow(of_controller);
|
||||
NetControl::activate(netcontrol_debug, 10);
|
||||
NetControl::activate(netcontrol_of, 10);
|
||||
NetControl::activate(netcontrol_debug_2, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
|
||||
NetControl::drop_address(id$orig_h, 15sec);
|
||||
NetControl::whitelist_address(id$orig_h, 15sec);
|
||||
NetControl::redirect_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 5, 30sec);
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff netcontrol.log
|
||||
# @TEST-EXEC: btest-diff openflow.log
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
global of_controller: OpenFlow::Controller;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
of_controller = OpenFlow::log_new(42);
|
||||
local netcontrol_of = NetControl::create_openflow(of_controller);
|
||||
NetControl::activate(netcontrol_of, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
NetControl::shunt_flow([$src_h=id$orig_h, $src_p=id$orig_p, $dst_h=id$resp_h, $dst_p=id$resp_p], 30sec);
|
||||
NetControl::drop_address(id$orig_h, 15sec);
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
local netcontrol_packetfilter = NetControl::create_packetfilter();
|
||||
NetControl::activate(netcontrol_packetfilter, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
local e = NetControl::Entity($ty=NetControl::ADDRESS, $ip=addr_to_subnet(c$id$orig_h));
|
||||
local r = NetControl::Rule($ty=NetControl::DROP, $target=NetControl::MONITOR, $entity=e, $expire=10min);
|
||||
|
||||
NetControl::add_rule(r);
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff netcontrol.log
|
||||
# @TEST-EXEC: btest-diff openflow.log
|
||||
|
||||
@load base/frameworks/netcontrol
|
||||
|
||||
global of_controller: OpenFlow::Controller;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
of_controller = OpenFlow::log_new(42);
|
||||
local netcontrol_of = NetControl::create_openflow(of_controller);
|
||||
NetControl::activate(netcontrol_of, 0);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
NetControl::quarantine_host(c$id$orig_h, 8.8.8.8, 192.169.18.1, 10hrs);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue