Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add pcap_file option to supervised nodes.

Browse source 
This allows to start Supervised nodes with a pcap_file argument
rather than interface.

This is based on changes from @J-Gras.
This commit is contained in:
Jan Grashoefer 2022-07-08 17:31:20 +02:00 • committed by Arne Welzel
parent 859ecc7b8b
commit 1882307cf3
7 changed files with 169 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

70
testing/btest/supervisor/config-cluster-pcap.zeek Normal file
View file

@ -0,0 +1,70 @@
# @TEST-DOC: Test support for pcap_file on Supervisor::ClusterEndpoint and Supervisor::NodeConfig
#
# @TEST-PORT: MANAGER_PORT
# @TEST-PORT: WORKER_PORT
# @TEST-EXEC: btest-bg-run zeek zeek -j %INPUT
# @TEST-EXEC: btest-bg-wait 45
# @TEST-EXEC: mv zeek/worker/conn.log zeek/worker/conn.log.orig
# @TEST-EXEC: zeek-cut ts uid id.orig_h id.resp_h history service < zeek/worker/conn.log.orig > zeek/worker/conn.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff zeek/worker/conn.log
redef Log::default_rotation_interval = 0sec;
@if ( Supervisor::is_supervisor() )
redef SupervisorControl::enable_listen = T;
event zeek_init()
{
local cluster: table[string] of Supervisor::ClusterEndpoint;
cluster["manager"] = [$role=Supervisor::MANAGER, $host=127.0.0.1,
$p=to_port(getenv("MANAGER_PORT"))];
cluster["worker"] = [$role=Supervisor::WORKER, $host=127.0.0.1,
$p=to_port(getenv("WORKER_PORT")),
$pcap_file=(getenv("TRACES") + "/wikipedia.trace")];
for ( n, ep in cluster )
{
local sn = Supervisor::NodeConfig($name = n);
sn$cluster = cluster;
sn$directory = n;
sn$stdout_file = "stdout";
sn$stderr_file = "stderr";
if ( ep?$pcap_file )
sn$pcap_file = ep$pcap_file;
local res = Supervisor::create(sn);
if ( res != "" )
print fmt("failed to create node %s: %s", n, res);
}
}
global ready_for_shutdown = F;
# Immediately terminate the supervisor once we get a report about the worker
# starting for a second time.
event Supervisor::node_status(node: string, pid: count)
{
if ( node != "worker" )
return;
if ( ready_for_shutdown )
terminate();
ready_for_shutdown = T;
}
@else
redef Log::enable_local_logging = T;
redef Log::enable_remote_logging = F;
# Even though we run with a pcap_file, we will not terminate
# once fully read, trigger terminate() directly.
event Pcap::file_done(path: string)
{
terminate();
}
@endif

19
testing/btest/supervisor/create-interface-pcap-file-error.zeek Normal file
View file

@ -0,0 +1,19 @@
# @TEST-DOC: Creating a node with inteface and pcap_file fails.
# @TEST-EXEC: zeek -j -b %INPUT >out
# @TEST-EXEC: btest-diff out
# Providing interface and pcap_file is an error.
event zeek_init()
{
print "is_supervisor", Supervisor::is_supervisor();
local sn = Supervisor::NodeConfig(
$name="grault",
$interface="lo",
$pcap_file="/dev/null",
);
local res = Supervisor::create(sn);
print res != "" ? "PASS (got error)" : " FAIL (no error)", res;
terminate();
}