Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Management framework: add websocket support to controller

Browse source 
The controller now listens on an additional port, defaulting to 2149, for Broker
connections via websockets. Configuration works as for the existing traditional
Broker port (2150), via ZEEK_CONTROLLER_WEBSOCKET_ADDR and
ZEEK_CONTROLLER_WEBSOCKET_PORT environment variables, as well as corresponding
redef'able constants.

To disable the websockets feature, leave ZEEK_CONTROLLER_WEBSOCKET_PORT unset
and redefine Management::Controller::default_port_websocket to 0/unknown.
This commit is contained in:
Christian Kreibich 2022-09-06 11:53:23 -07:00
parent aa00a5cf20
commit 147283c8f5
2 changed files with 89 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/policy/frameworks/management/controller/main.zeek
View file

@ -1504,14 +1504,30 @@ event zeek_init()
# via configurations uploaded by a client, with connections established
# upon deployment.
local broker_info = "no Broker port";
local websocket_info = "no Websocket port";
local cni = Management::Controller::network_info();
Broker::listen(cat(cni$address), cni$bound_port);
if ( cni$bound_port != 0/unknown )
{
Broker::listen(cat(cni$address), cni$bound_port);
broker_info = fmt("Broker port %s:%s", cni$address, cni$bound_port);
}
cni = Management::Controller::network_info_websocket();
if ( cni$bound_port != 0/unknown )
{
Broker::listen_websocket(cat(cni$address), cni$bound_port);
websocket_info = fmt("websocket port %s:%s", cni$address, cni$bound_port);
}
Broker::subscribe(Management::Agent::topic_prefix);
Broker::subscribe(Management::Controller::topic);
Management::Log::info(fmt("controller is live, Broker ID %s", Broker::node_id()));
Management::Log::info(fmt("controller is live, Broker ID %s, %s, %s",
Broker::node_id(), broker_info, websocket_info));
# If we have a persisted deployed configuration, we need to make sure
# it's actually running. The agents involved might be gone, running a