mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
597a4d6704
- policy/ renamed to scripts/ - By default BROPATH now contains: - scripts/ - scripts/policy - scripts/site - *Nearly* all tests pass. - All of scripts/base/ is loaded by main.cc - Can be disabled by setting $BRO_NO_BASE_SCRIPTS - Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script). - The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building. - The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead. - All "detection" activity happens through scripts in scripts/policy/. - Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1) - This is so the communications framework can be loaded as part of the base without causing trouble when it's not needed. - This will be removed once a resolution to ticket #540 is reached.
87 lines
3.2 KiB
Text
87 lines
3.2 KiB
Text
##! This is a utility script that sends the current values of all &redef'able
|
|
##! consts to a remote Bro then sends the :bro:id:`configuration_update` event
|
|
##! and terminates processing.
|
|
##!
|
|
##! Intended to be used from the command line like this when starting a controller:
|
|
##! bro <scripts> frameworks/control/controller Control::host=<host_addr> Control::port=<host_port> Control::cmd=<command> [Control::arg=<arg>]
|
|
##!
|
|
##! A controllee only needs to load the controllee script in addition
|
|
##! to the specific analysis scripts desired. It may also need a node
|
|
##! configured as a controller node in the communications nodes configuration.
|
|
##! bro <scripts> frameworks/control/controllee
|
|
##!
|
|
##! To use the framework as a controllee, it only needs to be loaded and
|
|
##! the controlled node need to accept all events in the "Control::" namespace
|
|
##! from the host where the control actions will be performed from along with
|
|
##! using the "control" class.
|
|
|
|
module Control;
|
|
|
|
export {
|
|
## This is the address of the host that will be controlled.
|
|
const host = 0.0.0.0 &redef;
|
|
|
|
## This is the port of the host that will be controlled.
|
|
const host_port = 0/tcp &redef;
|
|
|
|
## This is the command that is being done. It's typically set on the
|
|
## command line and influences whether this instance starts up as a
|
|
## controller or controllee.
|
|
const cmd = "" &redef;
|
|
|
|
## This can be used by commands that take an argument.
|
|
const arg = "" &redef;
|
|
|
|
const controller_events = /Control::.*_request/ &redef;
|
|
const controllee_events = /Control::.*_response/ &redef;
|
|
|
|
## These are the commands that can be given on the command line for
|
|
## remote control.
|
|
const commands: set[string] = {
|
|
"id_value",
|
|
"peer_status",
|
|
"net_stats",
|
|
"configuration_update",
|
|
"shutdown",
|
|
};
|
|
|
|
## Variable IDs that are to be ignored by the update process.
|
|
const ignore_ids: set[string] = {
|
|
# FIXME: Bro crashes if it tries to send this ID.
|
|
"Log::rotation_control",
|
|
};
|
|
|
|
## Event for requesting the value of an ID (a variable).
|
|
global id_value_request: event(id: string);
|
|
## Event for returning the value of an ID after an :bro:id:`id_request` event.
|
|
global id_value_response: event(id: string, val: string);
|
|
|
|
## Requests the current communication status.
|
|
global peer_status_request: event();
|
|
## Returns the current communication status.
|
|
global peer_status_response: event(s: string);
|
|
|
|
## Requests the current net_stats.
|
|
global net_stats_request: event();
|
|
## Returns the current net_stats.
|
|
global net_stats_response: event(s: string);
|
|
|
|
## Inform the remote Bro instance that it's configuration may have been updated.
|
|
global configuration_update_request: event();
|
|
## This event is a wrapper and alias for the :bro:id:`configuration_update_request` event.
|
|
## This event is also a primary hooking point for the control framework.
|
|
global configuration_update: event();
|
|
## Message in response to a configuration update request.
|
|
global configuration_update_response: event();
|
|
|
|
## Requests that the Bro instance begins shutting down.
|
|
global shutdown_request: event();
|
|
## Message in response to a shutdown request.
|
|
global shutdown_response: event();
|
|
}
|
|
|
|
|
|
event terminate_event()
|
|
{
|
|
terminate_communication();
|
|
}
|