provide way to customze Site::local_nets

[mmguero]

• Site::local_nets

Provide a way to specify this via environment variable. It should handle both the offline case (zeek -r) and the live case (networks.cfg in zeek_deploy.sh).

[mmguero]

When running with ZeekControl, you adjust Site::local_nets by configuring the networks.cfg file.

from quickstart

[mmguero]

• Added to zeek.env.example

# Specifies a comma-separated list of the networks that Zeek considers "local",
#   for Site::local_nets and networks.cfg. e.g., 1.2.3.0/24,5.6.7.0/24.
#   Note that by default, Zeek considers IANA-registered private address space
#   such as 10/8 and 192.168/16 site-local.
ZEEK_LOCAL_NETS=

• added to local.zeek

global zeek_local_nets_str = getenv("ZEEK_LOCAL_NETS");
...
  if (zeek_local_nets_str != "") {
    local nets_strs = split_string(zeek_local_nets_str, /,/);
    if (|nets_strs| > 0) {
      for (net_idx in nets_strs) {
        local local_subnet = to_subnet(nets_strs[net_idx]);
        if (local_subnet != [::]/0) {
          add Site::local_nets[local_subnet];
        }
      }
    }
  }

• Added to zeekdeploy.sh:

# populate networks.cfg from ZEEK_LOCAL_NETS
echo "# \$ZEEK_LOCAL_NETS:" > ./networks.cfg
echo "#   $ZEEK_LOCAL_NETS" >> ./networks.cfg
for NET in ${ZEEK_LOCAL_NETS//,/ }; do
  echo "$NET" | sed -re 's/^[[:blank:]]+|[[:blank:]]+$//g' -e 's/[[:blank:]]+/ /g' >> ./networks.cfg
done

• Example of networks.cfg created by zeekdeploy.sh

zeeker@seven:/$ cat /opt/zeek/etc/networks.cfg
# $ZEEK_LOCAL_NETS:
#   1.2.3.0/24,5.6.0.0/16,7.0.0.0/8
1.2.3.0/24
5.6.0.0/16
7.0.0.0/8

[mmguero]

Documentation updated as well, code added to local.zeek and zeekdeploy.sh to handle taking a comma-separated list of subnets (in the ZEEK_LOCAL_NETS environment variable) and using it to populate Site::local_nets in local.zeek and networks.cfg in the zeekcontrol-managed instance.