Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Management framework: expand notify_agent_hello event arguments

Browse source 
This swaps the host event argument for the Broker ID. The latter is more useful,
since the sending agent doesn't necessarily know its IP address as visible to
the controller, and the controller can pull up the full Broker context via the
ID.

It also adds an explicit argument to the event to indicate whether the agent
connected to the controller or vice versa. This simplifies the controller's
internal logic.

Also minor tweaks to logging to show Broker IDs.
This commit is contained in:
Christian Kreibich 2022-06-02 18:11:56 -07:00
parent aa689807fa
commit 72acf24f52
5 changed files with 18 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.policy.frameworks.management.controller.agent-checkin/zeek.nodes.controller.stdout
View file

@ -1,2 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
notify_agent_hello agent 127.0.0.1 1
notify_agent_hello agent 1

6
testing/btest/scripts/policy/frameworks/management/controller/agent-checkin.zeek
View file

@ -40,14 +40,12 @@ event zeek_init()
}
}
event Management::Agent::API::notify_agent_hello(instance: string, host: addr, api_version: count)
event Management::Agent::API::notify_agent_hello(instance: string, id: string, connecting: bool, api_version: count)
{
if ( Management::role == Management::CONTROLLER )
{
# On rare occasion it can happen that we log this twice, which'll need
# investigating. For now we ensure we only do so once.
if ( ! logged )
print(fmt("notify_agent_hello %s %s %s", instance, host, api_version));
print(fmt("notify_agent_hello %s %s", instance, api_version));
logged = T;