mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
2233521de7
BIT-1550 #merged * origin/topic/johanna/netcontrol: (72 commits) Update baselines and news Move prefixtable back to all IPv6 internal handling. NetControl: Add functions to search for rules affecting IPs/subnets Add check_subnet bif that allows exact membership test for subnet tables. Rewrite internal handling of rules. Add bif that allows searching for all matching subnets in table. Add signaling of succesful initialization of plugins to NetControl. Add rule hooks to the acld plugin. Add new logfiles for shunting and drops to netcontrol Extend NetControl logging and fix bugs. Update OpenFlow API and events. small acld plugin fix Revert "introduce &weaken attribute" Fix crash when printing type of recursive structures. Testcase for crash when a record contains a function referencing a record. Rename Pacf to NetControl fix acld plugin to use address instead of subnet (and add functions for conversion) implement quarantine miscelaneous missing bits and pieces Acld implementation for Pacf - Bro side. ...
98 lines
2.9 KiB
Text
98 lines
2.9 KiB
Text
##! Implementation of the drop functionality for NetControl.
|
|
|
|
module NetControl;
|
|
|
|
@load ./main
|
|
|
|
export {
|
|
redef enum Log::ID += { DROP };
|
|
|
|
## Stops all packets involving an IP address from being forwarded.
|
|
##
|
|
## a: The address to be dropped.
|
|
##
|
|
## t: How long to drop it, with 0 being indefinitly.
|
|
##
|
|
## location: An optional string describing where the drop was triggered.
|
|
##
|
|
## Returns: The id of the inserted rule on succes and zero on failure.
|
|
global drop_address: function(a: addr, t: interval, location: string &default="") : string;
|
|
|
|
## Stops all packets involving an connection address from being forwarded.
|
|
##
|
|
## c: The connection to be dropped.
|
|
##
|
|
## t: How long to drop it, with 0 being indefinitly.
|
|
##
|
|
## location: An optional string describing where the drop was triggered.
|
|
##
|
|
## Returns: The id of the inserted rule on succes and zero on failure.
|
|
global drop_connection: function(c: conn_id, t: interval, location: string &default="") : string;
|
|
|
|
type DropInfo: record {
|
|
## Time at which the recorded activity occurred.
|
|
ts: time &log;
|
|
## ID of the rule; unique during each Bro run
|
|
rule_id: string &log;
|
|
orig_h: addr &log; ##< The originator's IP address.
|
|
orig_p: port &log &optional; ##< The originator's port number.
|
|
resp_h: addr &log &optional; ##< The responder's IP address.
|
|
resp_p: port &log &optional; ##< The responder's port number.
|
|
## Expiry time of the shunt
|
|
expire: interval &log;
|
|
## Location where the underlying action was triggered.
|
|
location: string &log &optional;
|
|
};
|
|
|
|
## Event that can be handled to access the :bro:type:`NetControl::ShuntInfo`
|
|
## record as it is sent on to the logging framework.
|
|
global log_netcontrol_drop: event(rec: DropInfo);
|
|
}
|
|
|
|
event bro_init() &priority=5
|
|
{
|
|
Log::create_stream(NetControl::DROP, [$columns=DropInfo, $ev=log_netcontrol_drop, $path="netcontrol_drop"]);
|
|
}
|
|
|
|
function drop_connection(c: conn_id, t: interval, location: string &default="") : string
|
|
{
|
|
local e: Entity = [$ty=CONNECTION, $conn=c];
|
|
local r: Rule = [$ty=DROP, $target=FORWARD, $entity=e, $expire=t, $location=location];
|
|
|
|
local id = add_rule(r);
|
|
|
|
# Error should already be logged
|
|
if ( id == "" )
|
|
return id;
|
|
|
|
local log = DropInfo($ts=network_time(), $rule_id=id, $orig_h=c$orig_h, $orig_p=c$orig_p, $resp_h=c$resp_h, $resp_p=c$resp_p, $expire=t);
|
|
|
|
if ( location != "" )
|
|
log$location=location;
|
|
|
|
Log::write(DROP, log);
|
|
|
|
return id;
|
|
}
|
|
|
|
function drop_address(a: addr, t: interval, location: string &default="") : string
|
|
{
|
|
local e: Entity = [$ty=ADDRESS, $ip=addr_to_subnet(a)];
|
|
local r: Rule = [$ty=DROP, $target=FORWARD, $entity=e, $expire=t, $location=location];
|
|
|
|
local id = add_rule(r);
|
|
|
|
# Error should already be logged
|
|
if ( id == "" )
|
|
return id;
|
|
|
|
local log = DropInfo($ts=network_time(), $rule_id=id, $orig_h=a, $expire=t);
|
|
|
|
if ( location != "" )
|
|
log$location=location;
|
|
|
|
Log::write(DROP, log);
|
|
|
|
return id;
|
|
}
|
|
|