Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

NetControl: allow reasons in remove_rule calls.

Browse source 
This adds the capability for the user to attach a reason when removing
or destroying a rule. The message will both be logged in netcontrol.log
and forwarded to the responsible plugins.

Addresses BIT-1655
This commit is contained in:
Johanna Amann 2016-08-05 10:47:58 -07:00
parent 9d9c7bafd3
commit 4f1a2c7b62
21 changed files with 129 additions and 115 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/scripts/base/frameworks/netcontrol/broker.bro
View file

@ -50,7 +50,7 @@ event connection_established(c: connection)
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
{
print "rule added", r$entity, r$ty;
NetControl::remove_rule(r$id);
NetControl::remove_rule(r$id, "removing");
}
event NetControl::rule_exists(r: NetControl::Rule, p: NetControl::PluginState, msg: string)
@ -103,9 +103,9 @@ event NetControl::broker_add_rule(id: count, r: NetControl::Rule)
Broker::send_event("bro/event/netcontroltest", Broker::event_args(NetControl::broker_rule_timeout, id, r, NetControl::FlowInfo()));
}
event NetControl::broker_remove_rule(id: count, r: NetControl::Rule)
event NetControl::broker_remove_rule(id: count, r: NetControl::Rule, reason: string)
{
print "remove_rule", id, r$entity, r$ty;
print "remove_rule", id, r$entity, r$ty, reason;
Broker::send_event("bro/event/netcontroltest", Broker::event_args(NetControl::broker_rule_removed, id, r, ""));

2
testing/btest/scripts/base/frameworks/netcontrol/catch-and-release-cluster.bro
View file

@ -83,7 +83,7 @@ event connection_established(c: connection)
NetControl::drop_address_catch_release(id$orig_h);
if ( info$current_block_id != "" )
{
NetControl::unblock_address_catch_release(id$orig_h);
NetControl::unblock_address_catch_release(id$orig_h, "reason here");
}
}

2
testing/btest/scripts/base/frameworks/netcontrol/catch-and-release.bro
View file

@ -26,7 +26,7 @@ event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, ms
return;
# delete directly, without notifying anything.
NetControl::delete_rule(r$id);
NetControl::delete_rule(r$id, "testing");
NetControl::catch_release_seen(subnet_to_addr(r$entity$ip));
}