Subscribe every WebSocket client to a unique topic, by default under
zeek/cluster/websocket/client/<identifier>/
Add tests that verify that WebSocket clients receive messages on these topics
even if they didn't explicitly pass them in their handshake message.
This is somewhere between feature and bug fix. It aids the ZeroMQ backend
implementation: A WebSocket client that doesn't provide any subscriptions
and immediately starts publishing would discard events until receiving
other nodes subscriptions from the central XPUB/XSUB proxy. ZeroMQ does sender
side topic filtering. When using subscriptions, the client waits until
its own subscriptions are returned from the central XPUB/XSUB proxy,
thereby also learning about other node's subscriptions.
Also, make the no-subscriptions.zeek test use 32 clients sequentially to
trigger potential issues more quickly.
Limit the number WebSocket events queued from external clients to
dispatcher instances to produce back pressure to the clients if
Zeek's IO loop is overloaded.
Logic to detect this error already existed, but due to enum identifiers
not having a value set, it never triggered before.
Should probably backport this one.
Due to prefix matching, worker-1's node_topic() also matched worker-10,
worker-11, etc. Suffix the node topic with a `.`. The original implementation
came from NATS, where subjects are separated by `.`.
Adapt nodeid_topic() for consistency.
The number of args being passed to the put() methods was getting to be
fairly long, with more on the horizon. Changing to a record means simplifying
things a little bit.
The new Broker API allows us to provide a custom logger to Broker that
pulls previously unattainable context information out of Broker to put
them into broker.log for users of Zeek.
Since Broker log events happen asynchronously, we cache them in a queue
and use a flare to notify Zeek of activity. Furthermore, the Broker
manager now implements the `ProcessFd` function to avoid unnecessary
polling of the new log queue. As a side effect, data stores are polled
less as well.
* origin/topic/johanna/dpd-changes:
DPD: failed services logging alignment
DPD: update test baselines; change options for external tests.
DPD: change policy script for service violation logging; add NEWS
DPD changes - small script fixes and renames.
Update public and private test suite for DPD changes.
Allow to track service violations in conn.log.
Make conn.log service field ordered
DPD: change handling of pre-confirmation violations, remove max_violations
DPD: log analyzers that have confirmed
IRC analyzer - make protocol confirmation more robust.
