Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Management framework: expand notify_agent_hello event arguments

Browse source 
This swaps the host event argument for the Broker ID. The latter is more useful,
since the sending agent doesn't necessarily know its IP address as visible to
the controller, and the controller can pull up the full Broker context via the
ID.

It also adds an explicit argument to the event to indicate whether the agent
connected to the controller or vice versa. This simplifies the controller's
internal logic.

Also minor tweaks to logging to show Broker IDs.
This commit is contained in:
Christian Kreibich 2022-06-02 18:11:56 -07:00
parent aa689807fa
commit 72acf24f52
5 changed files with 18 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/policy/frameworks/management/agent/api.zeek
View file

@ -145,17 +145,20 @@ export {
## The agent sends this event upon peering as a "check-in", informing
## the controller that an agent of the given name is now available to
## communicate with. It is a controller-level equivalent of
## `:zeek:see:`Broker::peer_added`.
## `:zeek:see:`Broker::peer_added` and triggered by it.
##
## instance: an instance name, really the agent's name as per
## :zeek:see:`Management::Agent::get_name`.
##
## host: the IP address of the agent. (This may change in the future.)
## id: the Broker ID of the agent.
##
## connecting: true if this agent connected to the controller,
## false if the controller connected to the agent.
##
## api_version: the API version of this agent.
##
global notify_agent_hello: event(instance: string, host: addr,
api_version: count);
global notify_agent_hello: event(instance: string, id: string,
connecting: bool, api_version: count);
# The following are not yet implemented.

5
scripts/policy/frameworks/management/agent/main.zeek
View file

@ -694,7 +694,8 @@ event Broker::peer_added(peer: Broker::EndpointInfo, msg: string)
Broker::publish(agent_topic(),
Management::Agent::API::notify_agent_hello,
epi$id, to_addr(epi$network$address),
epi$id, Broker::node_id(),
Management::Agent::controller$address != "0.0.0.0",
Management::Agent::API::version);
}
@ -736,5 +737,5 @@ event zeek_init()
# If the controller connects to us, it also uses this port.
Broker::listen(cat(epi$network$address), epi$network$bound_port);
Management::Log::info("agent is live");
Management::Log::info(fmt("agent is live, Broker ID %s", Broker::node_id()));
}

9
scripts/policy/frameworks/management/controller/main.zeek
View file

@ -273,9 +273,10 @@ event Management::Controller::API::notify_agents_ready(instances: set[string])
send_config_to_agents(req, req$set_configuration_state$config);
}
event Management::Agent::API::notify_agent_hello(instance: string, host: addr, api_version: count)
event Management::Agent::API::notify_agent_hello(instance: string, id: string, connecting: bool, api_version: count)
{
Management::Log::info(fmt("rx Management::Agent::API::notify_agent_hello %s %s", instance, host));
Management::Log::info(fmt("rx Management::Agent::API::notify_agent_hello %s %s %s",
instance, id, connecting));
# When an agent checks in with a mismatching API version, we log the
# fact and drop its state, if any.
@ -283,7 +284,7 @@ event Management::Agent::API::notify_agent_hello(instance: string, host: addr, a
{
Management::Log::warning(
fmt("instance %s/%s has checked in with incompatible API version %s",
instance, host, api_version));
instance, id, api_version));
if ( instance in g_instances )
drop_instance(g_instances[instance]);
@ -882,5 +883,5 @@ event zeek_init()
Broker::subscribe(Management::Agent::topic_prefix);
Broker::subscribe(Management::Controller::topic);
Management::Log::info("controller is live");
Management::Log::info(fmt("controller is live, Broker ID %s", Broker::node_id()));
}