コード例 #1
0
    def test_count(self):
        self.check_to_broker_and_back(broker.Count(42), '42',
                                      broker.Data.Type.Count)

        # Test a value that is beyond range of unsigned 32-bit integer
        self.check_to_broker_and_back(broker.Count(5123123123), '5123123123',
                                      broker.Data.Type.Count)
コード例 #2
0
ファイル: data.py プロジェクト: zpx2012/zeek_3.0.8
    def test_count(self):
        self.check_to_broker_and_back(broker.Count(42), '42', broker.Data.Type.Count)

        # Test a value that is beyond range of unsigned 32-bit integer (on
        # 32-bit python 2.x systems, this will be type 'long')
        self.check_to_broker_and_back(broker.Count(5123123123), '5123123123', broker.Data.Type.Count)

        if py2:
            # Explicitly pass a 'long' value (this is not relevant for python 3)
            self.check_to_broker_and_back(broker.Count(long(5)), '5', broker.Data.Type.Count)
コード例 #3
0
    def _test_table_impl(self, table_itype, table_otype=None):
        # Common table testing functionality for an input type into Broker and a
        # corresponding output type (table_itype/table_otype). When the output
        # type isn't provided, use the input type:
        table_otype = table_itype if table_otype is None else table_otype

        # Test an empty table
        self.check_to_broker_and_back(table_itype({}), '{}',
                                      broker.Data.Type.Table, table_otype())

        # Test a simple table
        d = {"a": 1, "b": 2, "c": 3}
        pi, po = table_itype(d), table_otype(d)
        d = self.check_to_broker_and_back(pi, '{a -> 1, b -> 2, c -> 3}',
                                          broker.Data.Type.Table, po)

        for (i, (k, v)) in enumerate(d.as_table().items()):
            self.check_to_broker(k, ["a", "b", "c"][i],
                                 broker.Data.Type.String)
            self.check_to_py(k, ["a", "b", "c"][i])
            self.check_to_broker(v, str(i + 1), broker.Data.Type.Integer)
            self.check_to_py(v, i + 1)

        # Test a table that contains different data types
        p = table_itype({
            True: 42,
            broker.Port(22, broker.Port.TCP): False,
            (1, 2, 3): [4, 5, 6],
            broker.Count(13): "test",
        })
        d = self.check_to_broker(
            p, '{T -> 42, 13 -> test, 22/tcp -> F, (1, 2, 3) -> (4, 5, 6)}',
            broker.Data.Type.Table)

        t = d.as_table()

        self.check_to_broker(t[broker.Data(True)], "42",
                             broker.Data.Type.Integer)
        self.check_to_py(t[broker.Data(True)], 42)

        self.check_to_broker(t[broker.Data(broker.Port(22, broker.Port.TCP))],
                             "F", broker.Data.Type.Boolean)
        self.check_to_py(t[broker.Data(broker.Port(22, broker.Port.TCP))],
                         False)

        self.check_to_broker(t[broker.Data((1, 2, 3))], "(4, 5, 6)",
                             broker.Data.Type.Vector)
        self.check_to_py(t[broker.Data([1, 2, 3])], (4, 5, 6))

        self.check_to_broker(t[broker.Data(broker.Count(13))], "test",
                             broker.Data.Type.String)
        self.check_to_py(t[broker.Data(broker.Count(13))], "test")
コード例 #4
0
    def rule_event(self, event, id, arule, rule, msg):
        arule = self.record_to_record("acldrule", arule)
        self.logger.info(
            "Sending to Bro: NetControl::acld_rule_%s id=%d, arule=%s, msg=%s",
            event, id, arule, msg)

        args = [broker.Count(id), rule, msg]
        ev = broker.bro.Event("NetControl::acld_rule_" + event, args)
        self.epl.publish(self.queuename, ev)
コード例 #5
0
 def _rule_event(self, event, response, msg):
     args = [broker.Count(response.pluginid), response.rawrule, msg]
     ev = broker.zeek.Event("NetControl::broker_rule_" + event, args)
     self.epl.publish(self.queuename, ev)
コード例 #6
0
ファイル: data.py プロジェクト: zpx2012/zeek_3.0.8
 def test_count_overflow(self):
     with self.assertRaises(Exception) as context:
         # I've seen this raise either OverflowError or SystemError
         # depending on Python version is seems.
         self.check_to_broker(broker.Count(-1), '-1', broker.Data.Type.Count)
コード例 #7
0
    def _flow_removed_handler(self, ev):
        msg = ev.msg
        dp = msg.datapath
        ofp = dp.ofproto
        match = msg.match

        if dp.id not in self.dpids:
            self.logger.error("Flow remove for unknown DPID %d", dp.id)
            return

        #print "Flow removed"

        match_vec = vector_of_field([])
        match_vec = self.vec_add_field(match_vec, match, 'in_port');
        match_vec = self.vec_add_field(match_vec, match, 'eth_src');
        match_vec = self.vec_add_field(match_vec, match, 'eth_dst');
        match_vec = self.vec_add_field(match_vec, match, 'vlan_vid');
        match_vec = self.vec_add_field(match_vec, match, 'vlan_pcp');
        match_vec = self.vec_add_field(match_vec, match, 'eth_type');
        match_vec = self.vec_add_field(match_vec, match, 'ip_dscp');
        match_vec = self.vec_add_field(match_vec, match, 'ip_proto');

        src = match.get('ipv4_src', match.get('ipv6_src', match.get('nw_src', None)))
        dst = match.get('ipv4_dst', match.get('ipv6_dst', match.get('nw_dst', None)))

        if src != None:
            sn = None
            if ( not isinstance(src, tuple) ) and( ":" in src ):
                sn = subnet(address.from_string(src), 128)
            elif not isinstance(src, tuple):
                sn = subnet(address.from_string(src), 32)
            else:
                adr = address.from_string(src[0])
                ip = IPNetwork(src[0]+"/"+src[1])
                sn = subnet(adr, ip.prefixlen)
            match_vec.push_back(field(data(sn)))
        else:
            match_vec.push_back(field())

        if dst != None:
            sn = None
            if ( not isinstance(dst, tuple) ) and( ":" in dst ):
                sn = subnet(address.from_string(dst), 128)
            elif not isinstance(dst, tuple):
                sn = subnet(address.from_string(dst), 32)
            else:
                adr = address.from_string(dst[0])
                ip = IPNetwork(dst[0]+"/"+dst[1])
                sn = subnet(adr, ip.prefixlen)
            match_vec.push_back(field(data(sn)))
        else:
            match_vec.push_back(field())

        srcp = match.get('tcp_src', match.get('udp_src', match.get('icmpv4_type', match.get('tp_src', None))))
        dstp = match.get('tcp_dst', match.get('udp_dst', match.get('icmpv4_type', match.get('tp_dst', None))))

        if srcp != None:
            match_vec.push_back(field(data(srcp)))
        else:
            match_vec.push_back(field())

        if dstp != None:
            match_vec.push_back(field(data(dstp)))
        else:
            match_vec.push_back(field())

        args = [self.dpids[dp.id],
                match_vec,
                broker.Count(msg.cookie),
                broker.Count(msg.priority),
                broker.Count(msg.reason),
                broker.Count(msg.duration_sec),
                broker.Count(msg.idle_timeout),
                broker.Count(msg.packet_count),
                broker.Count(msg.byte_count)]
        ev = broker.zeek.Event("OpenFlow::flow_removed", args)
        self.epl.publish(queuename, ev)