mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
b5050437fa
These are no longer loaded by default due to the performance impact they cause simply by being loaded (they have event handlers for commonly generated events) and they aren't generally useful enough to justify it.
63 lines
1.6 KiB
Text
63 lines
1.6 KiB
Text
# @TEST-EXEC: zeek -r $TRACES/tls/ecdhe.pcap %INPUT
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER='grep -v ^# | $SCRIPTS/diff-remove-timestamps' btest-diff netcontrol.log
|
|
# @TEST-EXEC: btest-diff netcontrol_catch_release.log
|
|
|
|
@load base/frameworks/netcontrol
|
|
@load policy/frameworks/netcontrol/catch-and-release
|
|
|
|
event NetControl::init()
|
|
{
|
|
local netcontrol_debug = NetControl::create_debug(T);
|
|
NetControl::activate(netcontrol_debug, 0);
|
|
}
|
|
|
|
global i: count = 0;
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
local id = c$id;
|
|
NetControl::drop_address_catch_release(id$orig_h);
|
|
# second one should be ignored because duplicate
|
|
NetControl::drop_address_catch_release(id$orig_h);
|
|
}
|
|
|
|
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string &default="")
|
|
{
|
|
if ( ++i == 6 )
|
|
return;
|
|
|
|
# delete directly, without notifying anything.
|
|
NetControl::delete_rule(r$id, "testing");
|
|
NetControl::catch_release_seen(subnet_to_addr(r$entity$ip));
|
|
}
|
|
|
|
@TEST-START-NEXT
|
|
|
|
@load base/frameworks/netcontrol
|
|
@load policy/frameworks/netcontrol/catch-and-release
|
|
|
|
event NetControl::init()
|
|
{
|
|
local netcontrol_debug = NetControl::create_debug(T);
|
|
NetControl::activate(netcontrol_debug, 0);
|
|
}
|
|
|
|
global i: count = 0;
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
local id = c$id;
|
|
NetControl::drop_address(id$orig_h, 2min);
|
|
NetControl::drop_address_catch_release(id$orig_h, "test drop");
|
|
}
|
|
|
|
event NetControl::rule_added(r: NetControl::Rule, p: NetControl::PluginState, msg: string &default="")
|
|
{
|
|
if ( ++i == 3 )
|
|
return;
|
|
|
|
# delete directly, without notifying anything.
|
|
NetControl::delete_rule(r$id);
|
|
NetControl::catch_release_seen(subnet_to_addr(r$entity$ip));
|
|
}
|
|
|