mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
789cb376fd
This also installs symlinks from "zeek" and "bro-config" to a wrapper script that prints a deprecation warning. The btests pass, but this is still WIP. broctl renaming is still missing. #239
61 lines
1.5 KiB
Text
61 lines
1.5 KiB
Text
# @TEST-EXEC: zeek -r $TRACES/tls/ecdhe.pcap %INPUT
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-remove-timestamps' btest-diff netcontrol.log
|
|
# @TEST-EXEC: btest-diff netcontrol_catch_release.log
|
|
|
|
@load base/frameworks/netcontrol
|
|
|
|
event NetControl::init()
|
|
{
|
|
local netcontrol_debug = NetControl::create_debug(T);
|
|
NetControl::activate(netcontrol_debug, 0);
|
|
}
|
|
|
|
global i: count = 0;
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
local id = c$id;
|
|
NetControl::drop_address_catch_release(id$orig_h);
|
|
# second one should be ignored because duplicate
|
|
NetControl::drop_address_catch_release(id$orig_h);
|
|
}
|
|
|
|
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string &default="")
|
|
{
|
|
if ( ++i == 6 )
|
|
return;
|
|
|
|
# delete directly, without notifying anything.
|
|
NetControl::delete_rule(r$id, "testing");
|
|
NetControl::catch_release_seen(subnet_to_addr(r$entity$ip));
|
|
}
|
|
|
|
@TEST-START-NEXT
|
|
|
|
@load base/frameworks/netcontrol
|
|
|
|
event NetControl::init()
|
|
{
|
|
local netcontrol_debug = NetControl::create_debug(T);
|
|
NetControl::activate(netcontrol_debug, 0);
|
|
}
|
|
|
|
global i: count = 0;
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
local id = c$id;
|
|
NetControl::drop_address(id$orig_h, 2min);
|
|
NetControl::drop_address_catch_release(id$orig_h, "test drop");
|
|
}
|
|
|
|
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string &default="")
|
|
{
|
|
if ( ++i == 3 )
|
|
return;
|
|
|
|
# delete directly, without notifying anything.
|
|
NetControl::delete_rule(r$id);
|
|
NetControl::catch_release_seen(subnet_to_addr(r$entity$ip));
|
|
}
|
|
|