Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add pcap_file option to supervised nodes.

Browse source 
This allows to start Supervised nodes with a pcap_file argument
rather than interface.

This is based on changes from @J-Gras.
This commit is contained in:
Jan Grashoefer 2022-07-08 17:31:20 +02:00 • committed by Arne Welzel
parent 859ecc7b8b
commit 1882307cf3
7 changed files with 169 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/supervisor/Supervisor.cc
View file

@ -1233,6 +1233,11 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromRecord(const RecordVal* node)
if ( iface_val )
rval.interface = iface_val->AsString()->CheckString();
const auto& pcap_file_val = node->GetField("pcap_file");
if ( pcap_file_val )
rval.pcap_file = pcap_file_val->AsString()->CheckString();
const auto& directory_val = node->GetField("directory");
if ( directory_val )
@ -1326,6 +1331,11 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromRecord(const RecordVal* node)
if ( iface )
ep.interface = iface->AsStringVal()->ToStdString();
const auto& pcap_file = rv->GetField("pcap_file");
if ( pcap_file )
ep.pcap_file = pcap_file->AsStringVal()->ToStdString();
rval.cluster.emplace(name, std::move(ep));
}
@ -1342,6 +1352,9 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromJSON(std::string_view json)
if ( auto it = j.FindMember("interface"); it != j.MemberEnd() )
rval.interface = it->value.GetString();
if ( auto it = j.FindMember("pcap_file"); it != j.MemberEnd() )
rval.pcap_file = it->value.GetString();
if ( auto it = j.FindMember("directory"); it != j.MemberEnd() )
rval.directory = it->value.GetString();
@ -1402,6 +1415,9 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromJSON(std::string_view json)
if ( auto it = val.FindMember("interface"); it != val.MemberEnd() )
ep.interface = it->value.GetString();
if ( auto it = val.FindMember("pcap_file"); it != val.MemberEnd() )
ep.pcap_file = it->value.GetString();
rval.cluster.emplace(key, std::move(ep));
}
@ -1423,6 +1439,9 @@ RecordValPtr Supervisor::NodeConfig::ToRecord() const
if ( interface )
rval->AssignField("interface", *interface);
if ( pcap_file )
rval->AssignField("pcap_file", *pcap_file);
if ( directory )
rval->AssignField("directory", *directory);
@ -1499,6 +1518,9 @@ RecordValPtr Supervisor::NodeConfig::ToRecord() const
if ( ep.interface )
val->AssignField("interface", *ep.interface);
if ( ep.pcap_file )
val->AssignField("pcap_file", *ep.pcap_file);
cluster_val->Assign(std::move(key), std::move(val));
}
@ -1666,6 +1688,9 @@ void SupervisedNode::Init(Options* options) const
if ( config.interface )
options->interface = *config.interface;
if ( config.pcap_file )
options->pcap_file = *config.pcap_file;
auto& stl = options->scripts_to_load;
stl.insert(stl.begin(), config.addl_base_scripts.begin(), config.addl_base_scripts.end());
@ -1732,6 +1757,9 @@ std::string Supervisor::Create(const Supervisor::NodeConfig& node)
if ( nodes.find(node.name) != nodes.end() )
return util::fmt("node with name '%s' already exists", node.name.data());
if ( node.interface.has_value() && node.pcap_file.has_value() )
return util::fmt("node with name '%s' has interface and pcap_file set", node.name.data());
if ( node.directory )
{
auto res = util::detail::ensure_intermediate_dirs(node.directory->data());

9
src/supervisor/Supervisor.h
View file

@ -138,6 +138,11 @@ public:
* Typically used by worker nodes.
*/
std::optional<std::string> interface;
/**
* The PCAP file name from which the node read/analyze packets.
* Typically used by worker nodes.
*/
std::optional<std::string> pcap_file;
};
/**
@ -199,6 +204,10 @@ public:
* The interface name from which the node should read/analyze packets.
*/
std::optional<std::string> interface;
/**
* The PCAP file name from which the node should read/analyze packets.
*/
std::optional<std::string> pcap_file;
/**
* The working directory that should be used by the node.
*/