mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
42e4072673
This does not really have many user-facing changes. The one big change is that users now should initialize plugins in the NetControl::init() event instead of bro_init. Once all plugins finished initializing and the NetControl framework starts operations, the NetControl::init_done() event is raised. Rules that are sent to NetControl before the plugins have finished initializing are ignored - this is important when several plugins that require external connections have to be initialized at the beginning. Without this delay, rules could end up at the wrong plugin.
19 lines
512 B
Text
19 lines
512 B
Text
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff netcontrol.log
|
|
# @TEST-EXEC: btest-diff openflow.log
|
|
|
|
@load base/frameworks/netcontrol
|
|
|
|
global of_controller: OpenFlow::Controller;
|
|
|
|
event NetControl::init()
|
|
{
|
|
of_controller = OpenFlow::log_new(42);
|
|
local netcontrol_of = NetControl::create_openflow(of_controller);
|
|
NetControl::activate(netcontrol_of, 0);
|
|
}
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
NetControl::quarantine_host(c$id$orig_h, 8.8.8.8, 192.169.18.1, 10hrs);
|
|
}
|