#!/bin/bash

# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.


# README - DO NOT DEFINE GLOBAL VARIABLES IN THIS FILE. Instead use so-variables.

### Begin Logging Section ###
log() {
	msg=$1
	level=${2:-I}
	now=$(TZ=GMT date +"%Y-%m-%dT%H:%M:%SZ")
	echo -e "$now | $level | $msg" 2>&1 | tee -a "$setup_log"
}

error() {
	log "$1" "ERROR"
}

info() {
	log "$1" "INFO"
}

title() {
	echo -e "\n-----------------------------\n $1\n-----------------------------\n" >> "$setup_log" 2>&1
}

fail_setup() {
	error "Setup encounted an unrecoverable failure, exiting"
	touch /root/failure
	exit 1
}

logCmd() {
	cmd=$1
	info "Executing command: $cmd"
	$cmd 2>&1 | tee -a $setup_log
}
### End Logging Section ###

airgap_rules() {
	# Copy the rules for suricata if using Airgap
	mkdir -p /nsm/rules
	cp -Rv /root/SecurityOnion/agrules/* /nsm/rules/
}

add_admin_user() {
	title "Adding $ADMINUSER to the system with sudo rights"
	logCmd "useradd '$ADMINUSER'"
	echo "$ADMINUSER":"$ADMINPASS1" | chpasswd --crypt-method=SHA512
	logCmd "usermod -aG wheel '$ADMINUSER'"	
}

add_mngr_ip_to_hosts() {
	info "Adding $MSRV to /etc/hosts with IP: $MSRVIP"
	echo "$MSRVIP   $MSRV" >> /etc/hosts
}

add_socore_user_manager() {
	info "Adding socore user"
	logCmd "so_add_user socore 939 939 /opt/so" 
}

add_web_user() {
	wait_for_file /nsm/kratos/db/db.sqlite 30 5
	{
		info "Attempting to add administrator user for web interface...";
		echo "$WEBPASSWD1" | /usr/sbin/so-user add --email "$WEBUSER" --role "superuser";
		info "Add user result: $?";
	} >> "/root/so-user-add.log" 2>&1
}

analyze_system() {
	title "System Characteristics"
	logCmd "uptime"
	logCmd "uname -a"
	logCmd "free -h"
	logCmd "lscpu"
	logCmd "df -h"
	logCmd "ip a"
}

desktop_salt_local() {

	SALTVERSION=$(egrep 'version: [0-9]{4}' ../salt/salt/master.defaults.yaml | sed 's/^.*version: //')
	# Install everything using local salt
	# Set the repo
	securityonion_repo
	gpg_rpm_import
	# Install salt
	logCmd "yum -y install salt-minion-$SALTVERSION httpd-tools python3 python3-dateutil yum-utils device-mapper-persistent-data lvm2 openssl jq"
	logCmd "yum -y update --exclude=salt*"

	salt_install_module_deps
	salt_patch_x509_v2

	logCmd "salt-call state.apply desktop --local --file-root=../salt/ -l info"
	read -r -d '' message <<- EOM
		Finished Security Onion Desktop installation.

		Press the Enter key to reboot.
	EOM

	if [[ -z "$TESTING" ]]; then
		whiptail --title "$whiptail_title" --msgbox "$message" 12 75
		reboot
	fi
	exit 0 

}

desktop_pillar() {

	local pillar_file=$local_salt_dir/pillar/minions/$MINION_ID.sls

	# Create the desktop pillar
	printf '%s\n'\
		"host:"\
		"  mainint: '$MNIC'"\
		"desktop:"\
		"  gui:"\
		"    enabled: true"\
		"sensoroni:"\
		"  config:"\
		"    node_description: '${NODE_DESCRIPTION//\'/''}'" > $pillar_file
}

calculate_useable_cores() {

	# Calculate reasonable core usage
	local cores_for_zeek=$(( (num_cpu_cores/2) - 1 ))
	local lb_procs_round
	lb_procs_round=$(printf "%.0f\n" $cores_for_zeek)

	if [ "$lb_procs_round" -lt 1 ]; then lb_procs=1; else lb_procs=$lb_procs_round; fi
	export lb_procs
}

check_admin_pass() {
	check_pass_match "$ADMINPASS1" "$ADMINPASS2" "APMATCH"
}

check_manager_connection() {
	# See if you can curl the manager. If not you can either try again or continue
	info "Checking manager connectivity"	
	man_test_err=$(curl -s $MSRVIP:4505 --connect-timeout 5 2>&1)
	
	local ret=$?

	if [[ $ret != 1 ]]; then
		info "Could not reach $MSRV"
		whiptail_manager_unreachable
	fi
}

check_network_manager_conf() {
	local gmdconf="/usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf"
	local nmconf="/etc/NetworkManager/NetworkManager.conf"
	local preupdir="/etc/NetworkManager/dispatcher.d/pre-up.d"

	if test -f "$gmdconf" && ! test -f "${gmdconf}.bak"; then
		{
			mv "$gmdconf" "${gmdconf}.bak"
			touch "$gmdconf"
			systemctl restart NetworkManager
		} >> "$setup_log" 2>&1
	fi

	if [[ ! -d "$preupdir" ]]; then
		mkdir "$preupdir" >> "$setup_log" 2>&1
	fi
}

check_pass_match() {
	info "Making sure passwords match"
	local pass=$1
	local confirm_pass=$2
	local var=$3

	if [ "$pass" = "$confirm_pass" ]; then
		export "$var=yes"
	else
		whiptail_passwords_dont_match
	fi
}

# False if stopped, true if running
check_service_status() {

	local service_name=$1
	info "Checking service $service_name status"
	systemctl status $service_name > /dev/null 2>&1
	local status=$?
	if [ $status -gt 0 ]; then
		info "  $service_name is not running" 
		return 1;
	else
		info "  $service_name is running"
		return 0;
	fi

}

check_web_pass() {
	info "Making sure web credential passwords match"
	check_pass_match "$WEBPASSWD1" "$WEBPASSWD2" "WPMATCH"
}

clear_manager() {
	# Clear out the old manager public key in case this is a re-install.
	# This only happens if you re-install the manager.
	if [ -f /etc/salt/pki/minion/minion_master.pub ]; then
		info "Clearing old Salt master key"
		logCmd "rm -f /etc/salt/pki/minion/minion_master.pub"
		info "Restarting Salt Minion"
		logCmd "systemctl -q restart salt-minion"
	fi

}

collect_adminuser_inputs() {
	whiptail_create_admin_user

	while ! valid_username "$ADMINUSER"; do
		whiptail_invalid_input
		whiptail_create_admin_user "$ADMINUSER"
	done

	APMATCH=no
	while [[ $APMATCH != yes ]]; do
		whiptail_create_admin_user_password1
		whiptail_create_admin_user_password2
		check_admin_pass
	done
}

collect_dns() {
	whiptail_management_interface_dns "8.8.8.8,8.8.4.4"

	while ! valid_dns_list "$MDNS"; do
		whiptail_invalid_input
		whiptail_management_interface_dns "$MDNS"
	done

	MDNS=$(echo "$MDNS" | tr -s "," " ") # MDNS needs to be space separated, we prompt for comma separated for consistency
}

collect_dns_domain() {
	whiptail_management_interface_dns_search "searchdomain.local"

	while ! valid_fqdn "$MSEARCH"; do
		whiptail_invalid_input
		whiptail_management_interface_dns_search "$MSEARCH"
	done
}

collect_dockernet() {
	if ! whiptail_dockernet_check; then
		whiptail_dockernet_sosnet "172.17.1.0"

		while ! valid_ip4 "$DOCKERNET" || [[ $DOCKERNET =~ "172.17.0." ]]; do
			whiptail_invalid_input
			whiptail_dockernet_sosnet "$DOCKERNET"
		done
	fi
}

collect_es_space_limit() {
	whiptail_log_size_limit "$log_size_limit"

	while ! valid_int "$log_size_limit"; do # Upper/lower bounds?
		whiptail_invalid_input
		whiptail_log_size_limit "$log_size_limit"
	done
}

collect_gateway() {
	whiptail_management_interface_gateway

	while ! valid_ip4 "$MGATEWAY"; do
		whiptail_invalid_input
		whiptail_management_interface_gateway "$MGATEWAY"
	done
}

collect_homenet_mngr() {
	whiptail_homenet_manager "10.0.0.0/8,192.168.0.0/16,172.16.0.0/12"
	
	while ! valid_cidr_list "$HNMANAGER"; do
		whiptail_invalid_input
		whiptail_homenet_manager "$HNMANAGER"
	done
}

collect_homenet_snsr() {
	if whiptail_homenet_sensor_inherit; then
		export HNSENSOR=inherit
	else
		whiptail_homenet_sensor "10.0.0.0/8,192.168.0.0/16,172.16.0.0/12"
		
		while ! valid_cidr_list "$HNSENSOR"; do
			whiptail_invalid_input
			whiptail_homenet_sensor "$HNSENSOR"
		done
	fi
}

collect_hostname() {
	collect_hostname_validate

	while has_uppercase "$HOSTNAME"; do
		if ! (whiptail_uppercase_warning); then
			collect_hostname_validate
		else
			no_use_hostname=true
			break
		fi
	done
}

collect_hostname_validate() {
	if [[ -z "$TESTING" ]] && [[ "$HOSTNAME" == *'localhost'* ]]; then HOSTNAME=securityonion; fi

	whiptail_set_hostname "$HOSTNAME"

	if [[ -z $default_hostname_flag ]] && [[ $HOSTNAME == 'securityonion' ]]; then # Will only check HOSTNAME=securityonion once
		if ! (whiptail_avoid_default_hostname); then
			whiptail_set_hostname "$HOSTNAME"
		fi
		default_hostname_flag=true
	fi

	while ! valid_hostname "$HOSTNAME"; do
		whiptail_invalid_hostname
		whiptail_set_hostname "$HOSTNAME"
	done
}

collect_idh_preferences() {
	IDH_MGTRESTRICT='False'
	whiptail_idh_preferences

	if [[ "$idh_preferences" != "" ]]; then IDH_MGTRESTRICT='True'; fi
}

collect_idh_services() {
	whiptail_idh_services

	case "$IDH_SERVICES" in
		'Linux Webserver (NAS Skin)')
			IDH_SERVICES='"HTTP","FTP","SSH"'
		;;
		'MySQL Server')
			IDH_SERVICES='"MYSQL","SSH"'
		;;
		'MSSQL Server')
			IDH_SERVICES='"MSSQL","VNC'
		;;
		'Custom')
			whiptail_idh_services_custom
			IDH_SERVICES=$(echo "$IDH_SERVICES" | tr '[:blank:]' ',' )
		;;
	esac
}

collect_int_ip_mask() {
	whiptail_management_interface_ip_mask

	while ! valid_ip4_cidr_mask "$manager_ip_mask"; do
		whiptail_invalid_input
		whiptail_management_interface_ip_mask "$manager_ip_mask"
	done

	MIP=$(echo "$manager_ip_mask" | sed 's/\/.*//' )
	MMASK=$(echo "$manager_ip_mask" | sed 's/.*\///')
}

collect_mngr_hostname() {
	whiptail_management_server

	while ! valid_hostname "$MSRV"; do
		whiptail_invalid_hostname
		whiptail_management_server "$MSRV"
	done

	while [[ $MSRV == "$HOSTNAME" ]]; do 
		whiptail_invalid_hostname 0
		whiptail_management_server "$MSRV"
	done

	# Remove the manager from /etc/hosts incase a user entered the wrong IP when prompted 
	# and they are going through the installer again
	if [[ "$HOSTNAME" != "$MSRV" ]]; then
		info "Removing $MSRV from /etc/hosts if present."
		sed -i "/$MSRV/d" /etc/hosts
	fi

	if [[ -z "$MSRVIP" ]]; then
		if ! getent hosts "$MSRV"; then
			whiptail_manager_ip

			while ! valid_ip4 "$MSRVIP" || [[ $MSRVIP == "$MAINIP" || $MSRVIP == "127.0.0.1" ]]; do
				whiptail_invalid_input
				whiptail_manager_ip "$MSRVIP"
			done
		else
			MSRVIP=$(getent hosts "$MSRV" | awk 'NR==1{print $1}')
			whiptail_manager_ip "$MSRVIP"
			while ! valid_ip4 "$MSRVIP" || [[ $MSRVIP == "$MAINIP" || $MSRVIP == "127.0.0.1" ]]; do
				whiptail_invalid_input
				whiptail_manager_ip "$MSRVIP"
			done
		fi
	fi
}

collect_net_method() { 
	whiptail_net_method
	if [[ "$network_traffic" == "PROXY"* ]]; then
		collect_proxy no_ask
		needs_proxy=true
	fi
}

collect_ntp_servers() {
	if whiptail_ntp_ask; then
		[[ $is_airgap ]] && ntp_string=""
		whiptail_ntp_servers "$ntp_string"

		while ! valid_ntp_list "$ntp_string"; do
			whiptail_invalid_input
			whiptail_ntp_servers "$ntp_string"
		done

		IFS="," read -r -a ntp_servers <<< "$ntp_string" # Split string on commas into array
	else
		ntp_servers=()
	fi
}

collect_oinkcode() {
	whiptail_oinkcode

	while ! valid_string "$OINKCODE" "" "128"; do
		whiptail_invalid_input
		whiptail_oinkcode "$OINKCODE"
	done
}

collect_patch_schedule() {
	whiptail_patch_schedule

	case "$patch_schedule" in
		'New Schedule')
			whiptail_patch_schedule_select_days
			whiptail_patch_schedule_select_hours
			collect_patch_schedule_name_new
			patch_schedule_os_new
		;;
		'Import Schedule')
			collect_patch_schedule_name_import
		;;
		'Automatic')
			PATCHSCHEDULENAME='auto'
		;;
		'Manual')
			PATCHSCHEDULENAME='manual'
		;;
	esac
}

collect_patch_schedule_name_new() {
	whiptail_patch_name_new_schedule

	while ! valid_string "$PATCHSCHEDULENAME"; do
		whiptail_invalid_string "schedule name"
		whiptail_patch_name_new_schedule "$PATCHSCHEDULENAME"
	done
}

collect_patch_schedule_name_import() {
	whiptail_patch_schedule_import

	while ! valid_string "$PATCHSCHEDULENAME"; do
		whiptail_invalid_string "schedule name"
		whiptail_patch_schedule_import "$PATCHSCHEDULENAME"
	done
}

collect_proxy() {
	[[ -n $TESTING ]] && return
	local ask=${1:-true}

	collect_proxy_details "$ask" || return
	while ! proxy_validate; do
		if whiptail_invalid_proxy; then
			collect_proxy_details no_ask
		else
			so_proxy=""
			break
		fi
	done
}

collect_proxy_details() {
	local ask=${1:-true}
	local use_proxy
	if [[ $ask != true ]]; then
		use_proxy=0
	else
		whiptail_proxy_ask
		use_proxy=$?
	fi

	if [[ $use_proxy == 0 ]]; then
		whiptail_proxy_addr "$proxy_addr"

		while ! valid_proxy "$proxy_addr"; do
			whiptail_invalid_input
			whiptail_proxy_addr "$proxy_addr"
		done

		if whiptail_proxy_auth_ask; then
			whiptail_proxy_auth_user "$proxy_user"
			whiptail_proxy_auth_pass "$proxy_pass"

			local url_prefixes=( 'http://' 'https://' )
			for prefix in "${url_prefixes[@]}"; do
				if echo "$proxy_addr" | grep -q "$prefix"; then
					local proxy=${proxy_addr#"$prefix"}
					so_proxy="${prefix}${proxy_user}:${proxy_pass}@${proxy}"
					break
				fi
			done
		else
			so_proxy="$proxy_addr"
		fi
		export so_proxy
	else
		return 1
	fi
}

collect_redirect_host() {
	collect_redirect_host_validate

	while has_uppercase "$REDIRECTHOST"; do
		local text
		! valid_hostname "$REDIRECTHOST" && text="domain name" || text="hostname"
		if ! (whiptail_uppercase_warning "$text"); then
			collect_redirect_host_validate "$REDIRECTHOST"
		else
			break
		fi
	done
}

collect_redirect_host_validate() {
	local prefill=${1:-$HOSTNAME}

	whiptail_set_redirect_host "$prefill"

	while ! valid_ip4 "$REDIRECTHOST" && ! valid_hostname "$REDIRECTHOST" && ! valid_fqdn "$REDIRECTHOST"; do
		whiptail_invalid_input
		whiptail_set_redirect_host "$REDIRECTHOST"
	done
}

collect_so_allow() {
	if whiptail_so_allow_yesno; then
		whiptail_so_allow

		while ! valid_cidr "$ALLOW_CIDR" && ! valid_ip4 "$ALLOW_CIDR"; do
			whiptail_invalid_input
			whiptail_so_allow "$ALLOW_CIDR"
		done
	fi
}

# Get an email & password for the web admin user
collect_webuser_inputs() {
	whiptail_create_web_user

	while ! so-user valemail --email "$WEBUSER" >> "$setup_log" 2>&1; do
		whiptail_invalid_user_warning
		whiptail_create_web_user "$WEBUSER"
	done

	WPMATCH=no
	while [[ $WPMATCH != yes ]]; do
		whiptail_create_web_user_password1
		while ! check_password "$WEBPASSWD1"; do
			whiptail_invalid_pass_characters_warning
			whiptail_create_web_user_password1
		done
		if echo "$WEBPASSWD1" | so-user valpass >> "$setup_log" 2>&1; then
			whiptail_create_web_user_password2
			check_web_pass
		else
			whiptail_invalid_pass_warning
		fi
	done
}

configure_minion() {
	local minion_type=$1
	if [[ $is_desktop ]]; then 
		minion_type=desktop
	fi
	info "Configuring minion type as $minion_type" 
	echo "role: so-$minion_type" > /etc/salt/grains
	
	local minion_config=/etc/salt/minion

	echo "id: '$MINION_ID'" > "$minion_config"

	case "$minion_type" in
		'workstation')
			echo "master: '$MSRV'" >> "$minion_config"
			;;
		'manager' | 'eval' | 'managersearch' | 'standalone' | 'import')
			cp -f ../salt/ca/files/signing_policies.conf /etc/salt/minion.d/signing_policies.conf
			printf '%s\n'\
				"master: '$HOSTNAME'"\
				"mysql.host: '$MAINIP'"\
				"mysql.port: '3306'"\
				"mysql.user: 'root'" >> "$minion_config"
			if [ ! -f $local_salt_dir/pillar/secrets.sls ]; then
				echo "mysql.pass: '$MYSQLPASS'" >> "$minion_config"
			else
				OLDPASS=$(grep "mysql" $local_salt_dir/pillar/secrets.sls | awk '{print $2}')
				echo "mysql.pass: '$OLDPASS'" >> "$minion_config"
			fi
			;;
		*)
			echo "master: '$MSRV'" >> "$minion_config"
			;;
	esac

	printf '%s\n'\
		"use_superseded:"\
		"  - module.run"\
		"features:"\
		"  x509_v2: true"\
		"log_level: info"\
		"log_level_logfile: info"\
		"log_file: /opt/so/log/salt/minion" >> "$minion_config"

	info "Running: salt-call state.apply salt.mine_functions --local --file-root=../salt/ -l info pillar='{"host": {"mainint": "$MNIC"}}'"
	salt-call state.apply salt.mine_functions --local --file-root=../salt/ -l info pillar="{'host': {'mainint': $MNIC}}"

	{
		logCmd "systemctl enable salt-minion";
		logCmd "systemctl restart salt-minion";
	} >> "$setup_log" 2>&1
}

configure_ntp() {
	local chrony_conf=/etc/chrony.conf

	# Install chrony if it isn't already installed
	if ! command -v chronyc &> /dev/null; then
		logCmd "dnf -y install chrony"
	fi

	[[ -f $chrony_conf ]] && mv $chrony_conf "$chrony_conf.bak"

	printf '%s\n' "# NTP server list" > $chrony_conf

	# Build list of servers
	for addr in "${ntp_servers[@]}"; do
		echo "server $addr iburst" >> $chrony_conf
	done

	printf '\n%s\n' "# Config options" >> $chrony_conf

	printf '%s\n' \
		'driftfile /var/lib/chrony/drift' \
		'makestep 1.0 3' \
		'rtcsync' \
		'logdir /var/log/chrony' >> $chrony_conf

	if [[ $is_rpm ]]; then
		systemctl enable chronyd
		systemctl restart chronyd
	else 
		systemctl enable chrony
		systemctl restart chrony
	fi

	# Tell the chrony daemon to sync time & update the system time
	# Since these commands only make a call to chronyd, wait after each command to make sure the changes are made
	printf "Syncing chrony time to server: "
	chronyc -a 'burst 4/4' && sleep 30
	printf "Forcing chrony to update the time: "
	chronyc -a makestep && sleep 30
}

checkin_at_boot() {
	local minion_config=/etc/salt/minion

	info "Enabling checkin at boot" 
	echo "startup_states: highstate" >> "$minion_config"
}

check_requirements() {
	local req_mem
	local req_cores
	local req_storage
	local nic_list
	readarray -t nic_list <<< "$(ip link| awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "bond0"  | sed 's/ //g' | sed -r 's/(.*)(\.[0-9]+)@\1/\1\2/g')"
	local num_nics=${#nic_list[@]}
	
	if [[ $is_eval ]]; then
		req_mem=12
		req_cores=4
		req_nics=2
	elif [[ $is_standalone ]]; then
		req_mem=24
		req_cores=4
		req_nics=2
	elif [[ $is_manager ]]; then
		req_mem=16
		req_cores=4
		req_nics=1
	elif [[ $is_managersearch ]]; then
		req_mem=16
		req_cores=8
		req_nics=1
	elif [[ $is_sensor ]]; then
		req_mem=12
		req_cores=4
		req_nics=2
	elif [[ $is_fleet ]]; then
		req_mem=4
		req_cores=4
		req_nics=1
	elif [[ $is_searchnode ]]; then
		req_mem=16
		req_cores=4
		req_nics=1
	elif [[ $is_heavynode ]]; then
		req_mem=24
		req_cores=4
		req_nics=2
	elif [[ $is_idh ]]; then
		req_mem=1
		req_cores=2
		req_nics=1
	elif [[ $is_import ]]; then
		req_mem=4
		req_cores=2
		req_nics=1
	elif [[ $is_receiver ]]; then
		req_mem=8
		req_cores=2
		req_nics=1
	fi

	if [[ $setup_type == 'network' ]] ; then
		if [[ -n $nsm_mount ]]; then # does a /nsm mount exist
			if [[ $is_import ]]; then
				req_storage=50
			elif [[ $is_idh ]]; then
			    req_storage=12
			else
				req_storage=100
			fi
			if [[ $free_space_root -lt $req_storage ]]; then
				whiptail_storage_requirements "/" "${free_space_root} GB" "${req_storage} GB"
			fi
			if [[ $free_space_nsm -lt $req_storage ]]; then
				whiptail_storage_requirements "/nsm" "${free_space_nsm} GB" "${req_storage} GB"
			fi
		else
			if [[ $is_import ]]; then
				req_storage=50
			elif [[ $is_idh ]]; then
			    req_storage=12
			else
				req_storage=200
			fi
			if [[ $free_space_root -lt $req_storage ]]; then
				whiptail_storage_requirements "/" "${free_space_root} GB" "${req_storage} GB"
			fi
		fi	
	fi

	if [[ $num_nics -lt $req_nics ]]; then
		if [[ $num_nics -eq 1 ]]; then
			whiptail_requirements_error "NIC" "$num_nics" "$req_nics"
		else
			whiptail_requirements_error "NICs" "$num_nics" "$req_nics"
		fi
	fi

	if [[ $num_cpu_cores -lt $req_cores ]]; then
		if [[ $num_cpu_cores -eq 1 ]]; then
			whiptail_requirements_error "core" "$num_cpu_cores" "$req_cores"
		else
			whiptail_requirements_error "cores" "$num_cpu_cores" "$req_cores"
		fi
		
	fi
	
	if [[ $total_mem_hr -lt $req_mem ]]; then
		whiptail_requirements_error "memory" "${total_mem_hr} GB" "${req_mem} GB"
	fi
}

check_sos_appliance() {
	if [ -f "/etc/SOSMODEL" ]; then
		local MODEL=$(cat /etc/SOSMODEL)
		info "Found SOS Model $MODEL"
		echo "sosmodel: $MODEL" >> /etc/salt/grains
	else
		info "Not an appliance"
	fi
}

compare_main_nic_ip() {
	if ! [[ $MNIC =~ ^(tun|wg|vpn).*$ ]]; then
	  if [[ "$MAINIP" != "$MNIC_IP" ]]; then
			error "[ERROR] Main gateway ($MAINIP) does not match ip address of management NIC ($MNIC_IP)."

		  read -r -d '' message <<- EOM
		  	The IP being routed by Linux is not the IP address assigned to the management interface ($MNIC).

			This is not a supported configuration, please remediate 
			and rerun setup.
			EOM

		  [[ -n $TESTING ]] || whiptail --title "$whiptail_title" --msgbox "$message" 11 75
		  kill -SIGINT "$(ps --pid $$ -oppid=)"; fail_setup
	  fi
	else
		# Setup uses MAINIP, but since we ignore the equality condition when using a VPN 
		# just set the variable to the IP of the VPN interface
		MAINIP=$MNIC_IP
	fi
	
}

configure_network_sensor() {
	info "Setting up sensor interface"

	if [[ $is_cloud ]]; then
                info "Configuring traditional interface settings, since this is a cloud installation..."
		local nmcli_con_args=( "type" "ethernet" )
	else 
                info "Configuring bond interface settings, since this is a not a cloud installation..."
		local nmcli_con_args=( "type" "bond" "mode" "0" )
	fi

	# Create the bond interface only if it doesn't already exist
	nmcli -f name,uuid -p con | grep -q '$INTERFACE'
	local found_int=$?

	if [[ $found_int != 0 ]]; then
		nmcli con add ifname "$INTERFACE" con-name "$INTERFACE" "${nmcli_con_args[@]}" -- \
			ipv4.method disabled \
			ipv6.method ignore \
			ethernet.mtu "$MTU" \
			connection.autoconnect "yes" >> "$setup_log" 2>&1
	else
		local int_uuid
		int_uuid=$(nmcli -f name,uuid -p con | sed -n "s/$INTERFACE //p" | tr -d ' ')

		nmcli con mod "$int_uuid" \
			ipv4.method disabled \
			ipv6.method ignore \
			ethernet.mtu "$MTU" \
			connection.autoconnect "yes" >> "$setup_log" 2>&1
	fi

	local err=0
	for BNIC in "${BNICS[@]}"; do
		add_interface_bond0 "$BNIC" --verbose >> "$setup_log" 2>&1
		local ret=$?
		[[ $ret -eq 0 ]] || err=$ret
	done
	return $err
}

copy_salt_master_config() {

	title "Copy the Salt master config template to the proper directory"
	if [ "$setup_type" = 'iso' ]; then
		logCmd "cp /root/SecurityOnion/files/salt/master/master /etc/salt/master"
		#logCmd "cp /root/SecurityOnion/files/salt/master/salt-master.service /usr/lib/systemd/system/salt-master.service"
	else
		logCmd "cp ../files/salt/master/master /etc/salt/master"
		#logCmd "cp ../files/salt/master/salt-master.service /usr/lib/systemd/system/salt-master.service"
	fi
	info "Copying pillar and salt files in $temp_install_dir to $local_salt_dir"
	logCmd "cp -Rv $temp_install_dir/pillar/ $local_salt_dir/"
	if [ -d "$temp_install_dir"/salt ] ; then
		logCmd "cp -Rv $temp_install_dir/salt/ $local_salt_dir/"
	fi

	# Restart the service so it picks up the changes
	logCmd "systemctl daemon-reload"
	logCmd "systemctl enable salt-master"
	logCmd "systemctl restart salt-master"
}

create_local_directories() {
	info "Creating local pillar and salt directories"
	PILLARSALTDIR=${SCRIPTDIR::-5}
	for i in "pillar" "salt"; do
		for d in $(find $PILLARSALTDIR/$i -type d); do
			suffixdir=${d//$PILLARSALTDIR/}
			if [ ! -d "$local_salt_dir/$suffixdir" ]; then
				logCmd "mkdir -pv $local_salt_dir$suffixdir"
			fi
		done
		logCmd "chown -R socore:socore $local_salt_dir/$i"
	done

}

create_local_nids_rules() {
	title "Create a local.rules file so it doesn't get removed on updates"
	logCmd "mkdir -p /opt/so/saltstack/local/salt/idstools"
	echo "# Custom Suricata rules go in this file" > /opt/so/saltstack/local/salt/idstools/local.rules
	logCmd "salt-run fileserver.clear_file_list_cache"
}

create_manager_pillars() {
	elasticfleet_pillar
	elasticsearch_pillar
	logstash_pillar
	manager_pillar
	create_global
	create_sensoroni_pillar
	backup_pillar
	soctopus_pillar
	docker_pillar
	redis_pillar
	idstools_pillar
	kratos_pillar
	soc_pillar
	idh_pillar
	influxdb_pillar
	logrotate_pillar
	patch_pillar
	nginx_pillar
	kibana_pillar
}

create_repo() {
	title "Create the repo directory"
	logCmd "dnf -y install yum-utils createrepo"
	logCmd "createrepo /nsm/repo"
}


detect_cloud() {
	info "Testing if setup is running on a cloud instance..."
	if [ -f /etc/SOCLOUD ] || \
	    dmidecode -s bios-version 2>&1 | grep -q amazon || \
		dmidecode -s bios-vendor 2>&1 | grep -q Amazon || \
		dmidecode -s bios-vendor 2>&1 | grep -q Google || \
		[ -f /var/log/waagent.log ]; then

		info "Detected a cloud installation..."
		export is_cloud="true"
	else
		info "This does not appear to be a cloud installation."
	fi
}

detect_os() {
	title "Detecting Base OS"
	if [ -f /etc/redhat-release ]; then
		if grep -q "Rocky Linux release 9" /etc/redhat-release; then
			OS=rocky
			OSVER=9
			is_rocky=true
			is_rpm=true
			not_supported=true
			unset is_supported
		elif grep -q "CentOS Stream release 9" /etc/redhat-release; then
			OS=centos
			OSVER=9
			is_centos=true
			is_rpm=true
			not_supported=true
			unset is_supported
		elif grep -q "AlmaLinux release 9" /etc/redhat-release; then
			OS=alma
			OSVER=9
			is_alma=true
			is_rpm=true
			not_supported=true
			unset is_supported
		elif grep -q "Red Hat Enterprise Linux release 9" /etc/redhat-release; then
			if [ -f /etc/oracle-release ]; then
				OS=oracle
				OSVER=9
				is_oracle=true
				is_rpm=true
				is_supported=true
			else
				OS=rhel
				OSVER=9
				is_rhel=true
				is_rpm=true
				not_supported=true
				unset is_supported
			fi
		fi
	elif [ -f /etc/os-release ]; then
		if grep -q "UBUNTU_CODENAME=focal" /etc/os-release; then
			OSVER=focal
			UBVER=20.04
			OS=ubuntu
			is_ubuntu=true
			is_deb=true
			not_supported=true
			unset is_supported
		elif grep -q "UBUNTU_CODENAME=jammy" /etc/os-release; then
			OSVER=jammy
			UBVER=22.04
			OS=ubuntu
			is_ubuntu=true
			is_deb=true
			not_supported=true
			unset is_supported
		elif grep -q "VERSION_CODENAME=bookworm" /etc/os-release; then
			OSVER=bookworm
			DEBVER=12
			is_debian=true
			OS=debian
			is_deb=true
			not_supported=true
			unset is_supported
		fi
		installer_prereq_packages

	else
		info "We were unable to determine if you are using a supported OS."
		fail_setup
	fi

	info "Found OS: $OS $OSVER"
}

download_elastic_agent_artifacts() {
	if ! update_elastic_agent 2>&1 | tee -a "$setup_log"; then
		fail_setup
	fi
}

installer_progress_loop() {
	local i=0
	local msg="${1:-Performing background actions...}"
	while true; do
		[[ $i -lt 98 ]] && ((i++))
		set_progress_str "$i" "$msg" nolog
		[[ $i -gt 0 ]] && sleep 5s
	done
}

installer_prereq_packages() {	
	if [[ $is_deb ]]; then
		# Print message to stdout so the user knows setup is doing something
		info "Running apt-get update"
		retry 150 10 "apt-get update" "" "Err:" >> "$setup_log" 2>&1 || fail_setup
		# Install network manager so we can do interface stuff
		if ! command -v nmcli > /dev/null 2>&1; then
			info "Installing network-manager"
			retry 150 10 "apt-get -y install network-manager ethtool" >> "$setup_log" 2>&1 || fail_setup
			logCmd "systemctl enable NetworkManager"
			logCmd "systemctl start NetworkManager"
		fi
		if ! command -v curl > /dev/null 2>&1; then
			retry 150 10 "apt-get -y install curl"  >> "$setup_log" 2>&1 || fail_setup
		fi
	fi
}

disable_auto_start() {
	
	if crontab -l -u $INSTALLUSERNAME 2>&1 | grep -q so-setup; then
		# Remove the automated setup script from crontab, if it exists
		logCmd "crontab -u $INSTALLUSERNAME -r"
	fi

	if grep -s -q so-setup /home/$INSTALLUSERNAME/.bash_profile; then
		# Truncate last line of the bash profile
		info "Removing auto-run of setup from bash profile"
		sed -i '$ d' /home/$INSTALLUSERNAME/.bash_profile >> "$setup_log" 2>&1
	fi
}

disable_ipv6() {
	{
		info "Disabling ipv6"
		logCmd "sysctl -w net.ipv6.conf.all.disable_ipv6=1"
		logCmd "sysctl -w net.ipv6.conf.default.disable_ipv6=1"
	}  >> "$setup_log" 2>&1
	{
		echo "net.ipv6.conf.all.disable_ipv6 = 1"
		echo "net.ipv6.conf.default.disable_ipv6 = 1"
		echo "net.ipv6.conf.lo.disable_ipv6 = 1" 
	} >> /etc/sysctl.conf
}

docker_seed_update() {
	local name=$1
	local percent_delta=1
	((docker_seed_update_percent+=percent_delta))

	set_progress_str "$docker_seed_update_percent" "Downloading $name"
}

docker_seed_registry() {
	local VERSION="$SOVERSION"

	if ! [ -f /nsm/docker-registry/docker/registry.tar ]; then
		if [ "$install_type" == 'IMPORT' ]; then
			container_list 'so-import'
		elif [ "$install_type" == 'HELIXSENSOR' ]; then
			container_list 'so-helix'
		else
			container_list
		fi

		docker_seed_update_percent=25

		update_docker_containers 'netinstall' '' 'docker_seed_update' '/dev/stdout' 2>&1 | tee -a "$setup_log"
	else
		logCmd "tar xvf /nsm/docker-registry/docker/registry.tar -C /nsm/docker-registry/docker"
		logCmd "rm /nsm/docker-registry/docker/registry.tar"
	fi
}

elasticfleet_pillar() {
    logCmd "mkdir -p $local_salt_dir/pillar/elasticfleet"
    touch $adv_elasticfleet_pillar_file
    touch $elasticfleet_pillar_file
}

elasticsearch_pillar() {
	title "Create Advanced File"
	logCmd "touch $adv_elasticsearch_pillar_file"
	# Create the Elasticsearch pillar
	printf '%s\n'\
		"elasticsearch:"\
		"  config:"\
		"    cluster:"\
		"      name: securityonion"\
		"      routing:"\
        "        allocation:"\
        "          disk:"\
        "            threshold_enabled: true"\
        "            watermark:"\
        "              low: 80%"\
        "              high: 85%"\
        "              flood_stage: 90%"\
		"    script:"\
        "      max_compilations_rate: 20000/1m"\
        "    indices:"\
        "      query:"\
        "        bool:"\
        "          max_clause_count: 3500"\
                "  index_settings: {}" > $elasticsearch_pillar_file
}

es_heapsize() {

	title "Determine ES Heap Size"
	if [ "$total_mem" -lt 8000 ] ; then
		ES_HEAP_SIZE="600m"
	elif [ "$total_mem" -ge 100000 ]; then
		# Set a max of 25GB for heap size
		# https://www.elastic.co/guide/en/elasticsearch/guide/current/heap-sizing.html
		ES_HEAP_SIZE="25000m"
	else
		# Set heap size to 33% of available memory
		ES_HEAP_SIZE=$(( total_mem / 3 ))
		if [ "$ES_HEAP_SIZE" -ge 25001 ] ; then
			ES_HEAP_SIZE="25000m"
		else
			ES_HEAP_SIZE=$ES_HEAP_SIZE"m"
		fi
	fi
	export ES_HEAP_SIZE

	if [[ "$install_type" =~ ^(EVAL|MANAGERSEARCH|STANDALONE|IMPORT)$ ]]; then
		NODE_ES_HEAP_SIZE=$ES_HEAP_SIZE
		export NODE_ES_HEAP_SIZE
	fi
}

filter_unused_nics() {

	if [[ $MNIC ]]; then local grep_string="$MNIC\|bond0"; else local grep_string="bond0"; fi

	# If we call this function and NICs have already been assigned to the bond interface then add them to the grep search string
	if [[ $BNICS ]]; then
		grep_string="$grep_string"
		for BONDNIC in "${BNICS[@]}"; do
			grep_string="$grep_string\|$BONDNIC"
		done
	fi

	# Finally, set filtered_nics to any NICs we aren't using (and ignore interfaces that aren't of use)
	filtered_nics=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}' | grep -vwe "$grep_string"  | sed 's/ //g' | sed -r 's/(.*)(\.[0-9]+)@\1/\1\2/g')
	readarray -t filtered_nics <<< "$filtered_nics"
	
	nic_list=()
	nic_list_management=()
	for nic in "${filtered_nics[@]}"; do
		local nic_mac=$(cat "/sys/class/net/${nic}/address" 2>/dev/null)
		case $(cat "/sys/class/net/${nic}/carrier" 2>/dev/null) in
			1)
				nic_list+=("$nic" "$nic_mac  Link UP " "OFF")
				nic_list_management+=("$nic" "$nic_mac  Link UP " )
				;;
			0)
				nic_list+=("$nic" "$nic_mac  Link DOWN " "OFF")
				nic_list_management+=("$nic" "$nic_mac  Link DOWN " )
				;;
			*)
				nic_list+=("$nic" "$nic_mac  Link UNKNOWN " "OFF")
				nic_list_management+=("$nic" "$nic_mac  Link UNKNOWN " )
				;;
		esac
	done

	export nic_list nic_list_management
}

# Generate Firewall Templates
firewall_generate_templates() {
	title "Generate Firewall Template"

	local firewall_pillar_path=$local_salt_dir/salt/firewall
	logCmd "mkdir -p $firewall_pillar_path"
   
	logCmd "cp -r ../files/firewall/* /opt/so/saltstack/local/salt/firewall/"

}

generate_ca() {
	title "Generating the certificate authority"
	logCmd "salt-call state.apply ca -l info"
	info "Confirming existence of the CA certificate"
	logCmd "openssl x509 -in /etc/pki/ca.crt -noout -subject -issuer -dates"
}

generate_ssl() {
	# if the install type is a manager then we need to wait for the minion to be ready before trying
	# to run the ssl state since we need the minion to sign the certs
	if [[ "$install_type" =~ ^(EVAL|MANAGER|MANAGERSEARCH|STANDALONE|IMPORT|HELIXSENSOR)$ ]]; then
		wait_for_salt_minion
	fi
	info "Applying SSL state"
	logCmd "salt-call state.apply ssl -l info"
}

generate_passwords(){
  title "Generate Random Passwords"
  MYSQLPASS=$(get_random_value)
  PLAYBOOKDBPASS=$(get_random_value)
  PLAYBOOKADMINPASS=$(get_random_value)
  PLAYBOOKAUTOMATIONPASS=$(get_random_value)
  INFLUXPASS=$(get_random_value)
  INFLUXTOKEN=$(head -c 64 /dev/urandom | base64 --wrap=0)
  SENSORONIKEY=$(get_random_value)
  KRATOSKEY=$(get_random_value)
  REDISPASS=$(get_random_value)
  SOCSRVKEY=$(get_random_value 64)
  IMPORTPASS=$(get_random_value)
}

generate_interface_vars() {
	title "Setting the MTU to 9000 on all monitor NICS"
	MTU=9000
	export MTU

	# Set interface variable
	if [[ $is_cloud ]]; then
		INTERFACE=${BNICS[0]}
	else 
		INTERFACE='bond0'
	fi
        info "Interface set to $INTERFACE"
	export INTERFACE
}

get_redirect() {
	whiptail_set_redirect
	if [ "$REDIRECTINFO" = "OTHER" ]; then
		collect_redirect_host
	fi
}

get_minion_type() {
	local minion_type
	case "$install_type" in
		'EVAL' | 'MANAGERSEARCH' | 'MANAGER' | 'SENSOR' | 'HEAVYNODE' | 'SEARCHNODE' | 'FLEET' | 'IDH' | 'STANDALONE' | 'IMPORT' | 'RECEIVER' | 'DESKTOP')
			minion_type=$(echo "$install_type" | tr '[:upper:]' '[:lower:]')
			;;
	esac
	echo "$minion_type"
}

install_cleanup() {
	if [ -f "$temp_install_dir" ]; then
		info "Installer removing the following files:"
		logCmd "ls -lR $temp_install_dir"

		# Clean up after ourselves
		logCmd "rm -rf $temp_install_dir"
	fi
	
	# All cleanup prior to this statement must be compatible with automated testing. Cleanup
	# that will disrupt automated tests should be placed beneath this statement.
	[ -n "$TESTING" ] && return

	# If Mysql is running stop it
	if docker ps --format "{{.Names}}" 2>&1 | grep -q "so-mysql"; then
		logVmd "/usr/sbin/so-mysql-stop"
	fi

	if [[ $setup_type == 'iso' ]]; then
		info "Removing so-setup permission entry from sudoers file"
		logCmd "sed -i '/so-setup/d' /etc/sudoers"
	fi

	if [[ -z $SO_ERROR ]]; then
		info "Setup completed at $(date)" 
	fi
}

import_registry_docker() {
	if [ -f /nsm/docker-registry/docker/registry_image.tar ]; then
	  logCmd "service docker start"
	  logCmd "docker load -i /nsm/docker-registry/docker/registry_image.tar" 
	else
	  info "Need to download registry"
	fi
}

idh_pillar() {
	touch $adv_idh_pillar_file
}

kibana_pillar() {
	logCmd "mkdir -p $local_salt_dir/pillar/kibana"
	logCmd "touch $adv_kibana_pillar_file"
	logCmd "touch $kibana_pillar_file"
}

logrotate_pillar() {
	logCmd "mkdir -p $local_salt_dir/pillar/logrotate"
	logCmd "touch $adv_logrotate_pillar_file"
	logCmd "touch $logrotate_pillar_file"
}

patch_pillar() {
	touch $adv_patch_pillar_file
	touch $patch_pillar_file
}

logstash_pillar() {
	# Create the logstash advanced pillar
	touch $adv_logstash_pillar_file
	touch $logstash_pillar_file
}

# Set Logstash heap size based on total memory
ls_heapsize() {
	title "Setting Logstash heap size"
	if [ "$total_mem" -ge 32000 ]; then
		LS_HEAP_SIZE='1000m'
		return
	fi

	case "$install_type" in
		'MANAGERSEARCH' | 'HEAVYNODE' | 'HELIXSENSOR' | 'STANDALONE')
			LS_HEAP_SIZE='1000m'
			;;
		'EVAL')
			LS_HEAP_SIZE='700m'
			;;
		*)
			LS_HEAP_SIZE='500m'
			;;
	esac
	export LS_HEAP_SIZE

}

idstools_pillar() {
	title "Ading IDSTOOLS pillar options"
	touch $adv_idstools_pillar_file
}

nginx_pillar() {
	title "Creating the NGINX pillar"
	[[ -z "$TESTING" ]] && return

	# When testing, set the login rate limiting to high values to avoid failing automated logins
	printf '%s\n'\
		"nginx:"\
		"  config:"\
		"    throttle_login_burst: 9999"\
		"    throttle_login_rate: 9999"\
		"" > "$nginx_pillar_file"
}

soc_pillar() {
	title "Creating the SOC pillar"
	touch $adv_soc_pillar_file
	printf '%s\n'\
		"soc:"\
		"  config:"\
		"    server:"\
		"      srvKey: '$SOCSRVKEY'"\
		"" > "$soc_pillar_file"
}

telegraf_pillar() {
	title "Creating telegraf pillar"
	touch $adv_telegraf_pillar_file
	touch $telegraf_pillar_file
}

manager_pillar() {
	touch $adv_manager_pillar_file
	title "Create the manager pillar"
	if [[ $is_import ]]; then
		PLAYBOOK=0
	else
		PLAYBOOK=1
	fi
	printf '%s\n'\
		"manager:"\
		"  proxy: '$so_proxy'"\
		"  no_proxy: '$no_proxy_string'"\
		"  elastalert: 1"\
		"  playbook: $PLAYBOOK"\
		"" > "$manager_pillar_file"
}

kratos_pillar() {
	title "Create the Kratos pillar file"
	touch $adv_kratos_pillar_file
	printf '%s\n'\
		"kratos:"\
		"  config:"\
		"    secrets:"\
		"      default:"\
		"        - '$KRATOSKEY'"\
		"" > "$kratos_pillar_file"
}

create_global() {
	title "Creating the global.sls"
	touch $adv_global_pillar_file
	if [ -z "$NODE_CHECKIN_INTERVAL_MS" ]; then
		NODE_CHECKIN_INTERVAL_MS=10000
		if [ "$install_type" = 'EVAL' ] || [ "$install_type" = 'STANDALONE' ] || [ "$install_type" = 'IMPORT' ]; then
			NODE_CHECKIN_INTERVAL_MS=1000
		fi
	fi

	if [ -f "$global_pillar_file" ]; then
		rm $global_pillar_file
	fi

	# Create a global file for global values
	echo "global:" >> $global_pillar_file
	echo "  soversion: '$SOVERSION'" >> $global_pillar_file
	echo "  managerip: '$MAINIP'" >> $global_pillar_file
	echo "  mdengine: 'ZEEK'" >> $global_pillar_file
	echo "  ids: 'Suricata'" >> $global_pillar_file
	echo "  url_base: '$REDIRECTIT'" >> $global_pillar_file
	if [[ $HIGHLANDER == 'True' ]]; then
		echo "  highlander: True" >> $global_pillar_file
	fi
	if [[ $is_airgap ]]; then
		echo "  airgap: True" >> $global_pillar_file
	else 
		echo "  airgap: False" >> $global_pillar_file
	fi

	# Continue adding other details	
	echo "  imagerepo: '$IMAGEREPO'" >> $global_pillar_file
	echo "  pipeline: 'redis'" >> $global_pillar_file
	echo "  repo_host: '$HOSTNAME'" >> $global_pillar_file
	echo "  influxdb_host: '$HOSTNAME'" >> $global_pillar_file
	echo "  registry_host: '$HOSTNAME'" >> $global_pillar_file
	echo "  endgamehost: '$ENDGAMEHOST'" >> $global_pillar_file
}

create_sensoroni_pillar() {
	title "Create the sensoroni pillar file"
	touch $adv_sensoroni_pillar_file
	
	printf '%s\n'\
		"sensoroni:"\
		"  config:"\
		"    node_checkin_interval_ms: $NODE_CHECKIN_INTERVAL_MS"\
		"    sensoronikey: '$SENSORONIKEY'"\
		"    soc_host: '$REDIRECTIT'" > $sensoroni_pillar_file

}

backup_pillar() {
	title "Create the backup pillar file"
	touch $adv_backup_pillar_file
}

soctopus_pillar() {
	title "Create the soctopus pillar file"
	touch $adv_soctopus_pillar_file
	printf '%s\n'\
		"soctopus:"\
		"  playbook:"\
		"    rulesets:"\
		"      - windows" > "$soctopus_pillar_file"
}

docker_pillar() {
	title "Create the docker pillar file"
	touch $adv_docker_pillar_file
	touch $docker_pillar_file

	if [ ! -z "$DOCKERNET" ]; then
		DOCKERGATEWAY=$(echo $DOCKERNET | awk -F'.' '{print $1,$2,$3,1}' OFS='.')
		printf '%s\n'\
			"docker:"\
			"  range: '$DOCKERNET/24'"\
			"  gateway: '$DOCKERGATEWAY'" > $docker_pillar_file
	fi
}

redis_pillar() {
	title "Create the redis pillar file"
	touch $adv_redis_pillar_file
	printf '%s\n'\
		"redis:"\
		"  config:"\
		"    requirepass: '$REDISPASS'" > $redis_pillar_file
}

influxdb_pillar() {
	title "Create the influxdb pillar file"
	touch $adv_influxdb_pillar_file
	touch $influxdb_pillar_file
	printf '%s\n'\
		"influxdb:"\
		"  token: $INFLUXTOKEN" > $local_salt_dir/pillar/influxdb/token.sls
}

make_some_dirs() {
	mkdir -p /nsm
	mkdir -p "$default_salt_dir"
	mkdir -p "$local_salt_dir"
	mkdir -p $local_salt_dir/pillar/minions
	mkdir -p $local_salt_dir/salt/firewall/hostgroups
	mkdir -p $local_salt_dir/salt/firewall/portgroups
	mkdir -p $local_salt_dir/salt/firewall/ports

	for THEDIR in bpf pcap elasticsearch ntp firewall redis backup influxdb strelka sensoroni curator soc soctopus docker zeek suricata nginx telegraf logstash soc manager kratos idstools idh elastalert global;do
	mkdir -p $local_salt_dir/pillar/$THEDIR
	touch $local_salt_dir/pillar/$THEDIR/adv_$THEDIR.sls
	touch $local_salt_dir/pillar/$THEDIR/soc_$THEDIR.sls
	done
}

mark_version() {
	title "Marking the current version"
	echo "$SOVERSION" > /etc/soversion
}

network_init() {
	title "Initializing Network"
	disable_ipv6
	set_hostname
	if [[ ( $is_iso || $is_desktop_iso || $is_debian ) ]]; then
		set_management_interface
	fi
}

network_init_whiptail() {
	case "$setup_type" in
		'iso')
			whiptail_management_nic
			whiptail_dhcp_or_static

			if [ "$address_type" != 'DHCP' ]; then
				collect_int_ip_mask
				collect_gateway
				collect_dns
				collect_dns_domain
			fi
			;;
		'network')
			whiptail_network_notice
			whiptail_dhcp_warn
			whiptail_management_nic
			;;
	esac
}

networking_needful() {
	[[ -f $net_init_file ]] && whiptail_net_reinit && reinit_networking=true

	if [[ $reinit_networking ]] || ! [[ -f $net_init_file ]]; then
		collect_hostname
	fi
	[[ ! ( $is_eval || $is_import ) ]] && whiptail_node_description
	if [[ $reinit_networking ]] || ! [[ -f $net_init_file ]]; then
		network_init_whiptail
	else
		source "$net_init_file"
	fi
	if [[ $reinit_networking ]] || ! [[ -f $net_init_file ]]; then
		network_init
	fi
	set_main_ip
	compare_main_nic_ip

	# Attempt to autodetect the manager IP, if an offset value exists 
	if [[ -n "$MSRVIP_OFFSET" && -z "$MSRVIP" ]]; then
		mips1=$(echo "$MNIC_IP" | awk -F. '{print $1}') 
		mips2=$(echo "$MNIC_IP" | awk -F. '{print $2}') 
		mips3=$(echo "$MNIC_IP" | awk -F. '{print $3}') 
		mips4=$(echo "$MNIC_IP" | awk -F. '{print $4}') 
		MSRVIP="$mips1.$mips2.$mips3.$((mips4+$MSRVIP_OFFSET))"
	fi
}

network_setup() {
	info "Finishing up network setup"
	info "... Copying 99-so-checksum-offload-disable"
	logCmd "cp ./install_scripts/99-so-checksum-offload-disable /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable"
	info "... Modifying 99-so-checksum-offload-disable";
	logCmd "sed -i '/\$MNIC/${INTERFACE}/g' /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable"
}

ntp_pillar_entries() {

	local pillar_file=$local_salt_dir/pillar/minions/$MINION_ID.sls

	
	if [[ ${#ntp_servers[@]} -gt 0 ]]; then
		printf '%s\n'\
			"ntp:"\
			"  servers:" > "$pillar_file"
			for addr in "${ntp_servers[@]}"; do
				printf '%s\n' "    - '$addr'" >> "$pillar_file"
			done
	fi
}

parse_install_username() {
	# parse out the install username so things copy correctly
	INSTALLUSERNAME=${SUDO_USER:-${USER}}
}

print_salt_state_apply() {
	local state=$1

	info "Applying $state Salt state"
}

process_installtype() {
	if [ "$install_type" = 'EVAL' ]; then
		is_eval=true
		STRELKARULES=1
	elif [ "$install_type" = 'STANDALONE' ]; then
		is_standalone=true
	elif [ "$install_type" = 'MANAGERSEARCH' ]; then
		is_managersearch=true
	elif [ "$install_type" = 'MANAGER' ]; then
		is_manager=true
	elif [ "$install_type" = 'SENSOR' ]; then
		is_sensor=true
	elif [ "$install_type" = 'SEARCHNODE' ]; then
		is_searchnode=true
	elif [ "$install_type" = 'HEAVYNODE' ]; then
		is_heavynode=true
	elif [ "$install_type" = 'FLEET' ]; then
		is_fleet=true
	elif [ "$install_type" = 'IDH' ]; then
		is_idh=true
	elif [ "$install_type" = 'IMPORT' ]; then
		is_import=true
	elif [ "$install_type" = 'RECEIVER' ]; then
		is_receiver=true
	elif [ "$install_type" = 'DESKTOP' ]; then
		is_desktop=true
	fi

}

proxy_validate() {
	info "Testing proxy..."
	local test_url="https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS"
	proxy_test_err=$(curl -sS "$test_url" --proxy "$so_proxy" --connect-timeout 5 2>&1) # set short connection timeout so user doesn't sit waiting for proxy test to timeout
	local ret=$?

	if [[ $ret != 0 ]]; then
		error "Could not reach $test_url using proxy provided"
		error "Received error: $proxy_test_err"
		if [[ -n $TESTING ]]; then
			error "Exiting setup"
			kill -SIGINT "$(ps --pid $$ -oppid=)"; fail_setup
		fi
	fi
	return $ret
}

reserve_group_ids() {
	# This is a hack to fix OS from taking group IDs that we need
	logCmd "groupadd -g 928 kratos"
	logCmd "groupadd -g 930 elasticsearch"
	logCmd "groupadd -g 931 logstash"
	logCmd "groupadd -g 932 kibana"
	logCmd "groupadd -g 933 elastalert"
	logCmd "groupadd -g 934 curator"
	logCmd "groupadd -g 937 zeek"
	logCmd "groupadd -g 940 suricata"
	logCmd "groupadd -g 941 stenographer"
	logCmd "groupadd -g 945 ossec"
	logCmd "groupadd -g 946 cyberchef"
}

reserve_ports() {
	# These are also set via salt but need to be set pre-install to avoid conflicts before salt runs
	if ! sysctl net.ipv4.ip_local_reserved_ports | grep 55000 | grep 57314; then
		info "Reserving ephemeral ports used by Security Onion components to avoid collisions"
		sysctl -w net.ipv4.ip_local_reserved_ports="55000,57314"
	else
		info "Ephemeral ports already reserved"
	fi
}

reinstall_init() {
	info "Putting system in state to run setup again"

	if [[ $install_type =~ ^(MANAGER|EVAL|MANAGERSEARCH|STANDALONE|FLEET|IMPORT)$ ]]; then
		local salt_services=( "salt-master" "salt-minion" )
	else
		local salt_services=( "salt-minion" )
	fi

	local service_retry_count=20

	# Disregard previous install outcomes
	rm -f /root/failure
	rm -f /root/success

	{
		# remove all of root's cronjobs
		logCmd "crontab -r -u root"

		if command -v salt-call &> /dev/null && grep -q "master:" /etc/salt/minion 2> /dev/null; then
			# Disable schedule so highstate doesn't start running during the install
			salt-call -l info schedule.disable --local

			# Kill any currently running salt jobs, also to prevent issues with highstate.
			salt-call -l info saltutil.kill_all_jobs --local
		fi

		# Kill any salt processes (safely)
		for service in "${salt_services[@]}"; do
			# Stop the service in the background so we can exit after a certain amount of time
			systemctl stop "$service" &
			local pid=$!

			local count=0
			while check_service_status "$service"; do
				if [[ $count -gt $service_retry_count ]]; then
					info "Could not stop $service after 1 minute, exiting setup."

					# Stop the systemctl process trying to kill the service, show user a message, then exit setup
					kill -9 $pid
					fail_setup
				fi
				
				sleep 5
				((count++))
			done
		done

		logCmd "salt-call state.apply ca.remove -linfo --local --file-root=../salt"
		logCmd "salt-call state.apply ssl.remove -linfo --local --file-root=../salt"

		# Remove all salt configs
		rm -rf /etc/salt/engines/* /etc/salt/grains /etc/salt/master /etc/salt/master.d/* /etc/salt/minion /etc/salt/minion.d/* /etc/salt/pki/* /etc/salt/proxy /etc/salt/proxy.d/* /var/cache/salt/

		if command -v docker &> /dev/null; then
			# Stop and remove all so-* containers so files can be changed with more safety
			if [[ $(docker ps -a -q --filter "name=so-" | wc -l) -gt 0 ]]; then
				docker stop $(docker ps -a -q --filter "name=so-")
				docker rm -f $(docker ps -a -q --filter "name=so-")
			fi
		fi

		local date_string
		date_string=$(date +%s)

		# Backup /opt/so since we'll be rebuilding this directory during setup
		backup_dir /opt/so "$date_string"
		# If the elastic license has been accepted restore the state file
		restore_file "/opt/so_old_$date_string/state/yeselastic.txt" "/opt/so/state/"

		# Backup (and erase) directories in /nsm to prevent app errors
		backup_dir /nsm/mysql "$date_string"
		backup_dir /nsm/kratos "$date_string"
		backup_dir /nsm/influxdb "$date_string"

		# Remove the old launcher package in case the config changes
		remove_package launcher-final

		if [[ $is_deb ]]; then
			info "Unholding previously held packages."
			apt-mark unhold $(apt-mark showhold)
		fi

	} >> "$setup_log" 2>&1

	info "System reinstall init has been completed."
}

reset_proxy() {
	[[ -f /etc/profile.d/so-proxy.sh ]] && rm -f /etc/profile.d/so-proxy.sh
	
	[[ -f /etc/systemd/system/docker.service.d/http-proxy.conf ]] && rm -f /etc/systemd/system/docker.service.d/http-proxy.conf
	systemctl daemon-reload
	command -v docker &> /dev/null && info "Restarting Docker..." && logCmd "systemctl restart docker"
	
	[[ -f /root/.docker/config.json ]] && rm -f /root/.docker/config.json

	[[ -f /etc/gitconfig ]] && rm -f /etc/gitconfig
	
	if [[ $is_rpm ]]; then
		sed -i "/proxy=/d" /etc/dnf/dnf.conf
	else
		[[ -f /etc/apt/apt.conf.d/00-proxy.conf ]] && rm -f /etc/apt/apt.conf.d/00-proxy.conf
	fi
}

restore_file() {
	src=$1
	dst=$2
	if [ -f "$src" ]; then
		[ ! -d "$dst" ] && mkdir -v -p "$dst"
		info "Restoring $src to $dst."
		cp -v "$src" "$dst" >> "$setup_log" 2>&1
	fi
}

backup_dir() {
	dir=$1
	backup_suffix=$2

	if [[ -d $dir ]]; then
		mv "$dir" "${dir}_old_${backup_suffix}"
	fi
}

drop_install_options() {
	# Drop the install Variable
	echo "MAINIP=$MAINIP" > /opt/so/install.txt
	echo "MNIC=$MNIC" >> /opt/so/install.txt
	echo "NODE_DESCRIPTION='$NODE_DESCRIPTION'" >> /opt/so/install.txt
	echo "ES_HEAP_SIZE=$ES_HEAP_SIZE" >> /opt/so/install.txt
	echo "PATCHSCHEDULENAME=$PATCHSCHEDULENAME" >> /opt/so/install.txt
	echo "INTERFACE=$INTERFACE" >> /opt/so/install.txt
	NODETYPE=${install_type^^}
	echo "NODETYPE=$NODETYPE" >> /opt/so/install.txt
	echo "CORECOUNT=$lb_procs" >> /opt/so/install.txt
	echo "LSHOSTNAME=$HOSTNAME" >> /opt/so/install.txt
	echo "LSHEAP=$LS_HEAP_SIZE" >> /opt/so/install.txt
	echo "CPUCORES=$num_cpu_cores" >> /opt/so/install.txt
	echo "IDH_MGTRESTRICT=$IDH_MGTRESTRICT" >> /opt/so/install.txt
	echo "IDH_SERVICES=$IDH_SERVICES" >> /opt/so/install.txt
}

remove_package() {
	local package_name=$1
	if [[ $is_rpm ]]; then
		if rpm -qa | grep -q "$package_name"; then
			logCmd "dnf remove -y $package_name"
		fi
	else
		if dpkg -l | grep -q "$package_name"; then
			retry 150 10 "apt purge -y \"$package_name\""
		fi
	fi
}

# When updating the salt version, also update the version in securityonion-builds/images/iso-task/Dockerfile and salt/salt/master.defaults.yaml and salt/salt/minion.defaults.yaml
# CAUTION! SALT VERSION UDDATES - READ BELOW
# When updating the salt version, also update the version in:
# - securityonion-builds/iso-resources/build.sh
# - securityonion-builds/iso-resources/packages.lst
# - securityonion/salt/salt/master.defaults.yaml
# - securityonion/salt/salt/minion.defaults.yaml

securityonion_repo() {
	# Remove all the current repos
	if [[ $is_oracle ]]; then
		logCmd "dnf -v clean all"
		logCmd "mkdir -vp /root/oldrepos"
		if [ -n "$(ls -A /etc/yum.repos.d/ 2>/dev/null)" ]; then
			logCmd "mv -v /etc/yum.repos.d/* /root/oldrepos/"
		fi
		if ! $is_desktop_grid; then
			gpg_rpm_import
			if [[ ! $is_airgap ]]; then
				echo "https://repo.securityonion.net/file/so-repo/prod/2.4/oracle/9" > /etc/yum/mirror.txt
				echo "https://so-repo-east.s3.us-east-005.backblazeb2.com/prod/2.4/oracle/9" >> /etc/yum/mirror.txt
				echo "[main]" > /etc/yum.repos.d/securityonion.repo
				echo "gpgcheck=1" >> /etc/yum.repos.d/securityonion.repo
				echo "installonly_limit=3" >> /etc/yum.repos.d/securityonion.repo
				echo "clean_requirements_on_remove=True" >> /etc/yum.repos.d/securityonion.repo
				echo "best=True" >> /etc/yum.repos.d/securityonion.repo
				echo "skip_if_unavailable=False" >> /etc/yum.repos.d/securityonion.repo
				echo "cachedir=/opt/so/conf/reposync/cache" >> /etc/yum.repos.d/securityonion.repo
				echo "keepcache=0" >> /etc/yum.repos.d/securityonion.repo
				echo "[securityonionsync]" >> /etc/yum.repos.d/securityonion.repo
				echo "name=Security Onion Repo repo" >> /etc/yum.repos.d/securityonion.repo
				echo "mirrorlist=file:///etc/yum/mirror.txt" >> /etc/yum.repos.d/securityonion.repo
				echo "enabled=1" >> /etc/yum.repos.d/securityonion.repo
				echo "gpgcheck=1" >> /etc/yum.repos.d/securityonion.repo
				logCmd "dnf repolist"
			else
				echo "[securityonion]" > /etc/yum.repos.d/securityonion.repo
				echo "name=Security Onion Repo" >> /etc/yum.repos.d/securityonion.repo
				echo "baseurl=https://$MSRV/repo" >> /etc/yum.repos.d/securityonion.repo
				echo "enabled=1" >> /etc/yum.repos.d/securityonion.repo
				echo "gpgcheck=1" >> /etc/yum.repos.d/securityonion.repo
				echo "sslverify=0" >> /etc/yum.repos.d/securityonion.repo
				logCmd "dnf repolist"
			fi
		elif [[ ! $waitforstate ]]; then
			echo "[securityonion]" > /etc/yum.repos.d/securityonion.repo
			echo "name=Security Onion Repo" >> /etc/yum.repos.d/securityonion.repo
			echo "baseurl=https://$MSRV/repo" >> /etc/yum.repos.d/securityonion.repo
			echo "enabled=1" >> /etc/yum.repos.d/securityonion.repo
			echo "gpgcheck=1" >> /etc/yum.repos.d/securityonion.repo
			echo "sslverify=0" >> /etc/yum.repos.d/securityonion.repo		
		elif [[ $waitforstate ]]; then
			echo "[securityonion]" > /etc/yum.repos.d/securityonion.repo
			echo "name=Security Onion Repo" >> /etc/yum.repos.d/securityonion.repo
			echo "baseurl=file:///nsm/repo/" >> /etc/yum.repos.d/securityonion.repo
			echo "enabled=1" >> /etc/yum.repos.d/securityonion.repo
			echo "gpgcheck=1" >> /etc/yum.repos.d/securityonion.repo
		fi
	fi
	if [[ $is_rpm ]]; then logCmd "dnf repolist all"; fi
	if [[ $waitforstate ]]; then
		if [[ $is_rpm ]]; then
				# Build the repo locally so we can use it
				echo "Syncing Repos"
				repo_sync_local
		fi
	fi
}

repo_sync_local() {
	info "Repo Sync"
	if [[ $is_supported ]]; then
		# Sync the repo from the the SO repo locally.
		# Check for reposync
		info "Adding Repo Download Configuration"
		mkdir -p /nsm/repo
		mkdir -p /opt/so/conf/reposync/cache
		echo "https://repo.securityonion.net/file/so-repo/prod/2.4/oracle/9" > /opt/so/conf/reposync/mirror.txt
		echo "https://so-repo-east.s3.us-east-005.backblazeb2.com/prod/2.4/oracle/9" >> /opt/so/conf/reposync/mirror.txt
		echo "[main]" > /opt/so/conf/reposync/repodownload.conf
		echo "gpgcheck=1" >> /opt/so/conf/reposync/repodownload.conf
		echo "installonly_limit=3" >> /opt/so/conf/reposync/repodownload.conf
		echo "clean_requirements_on_remove=True" >> /opt/so/conf/reposync/repodownload.conf
		echo "best=True" >> /opt/so/conf/reposync/repodownload.conf
		echo "skip_if_unavailable=False" >> /opt/so/conf/reposync/repodownload.conf
		echo "cachedir=/opt/so/conf/reposync/cache" >> /opt/so/conf/reposync/repodownload.conf
		echo "keepcache=0" >> /opt/so/conf/reposync/repodownload.conf
		echo "[securityonionsync]" >> /opt/so/conf/reposync/repodownload.conf
		echo "name=Security Onion Repo repo" >> /opt/so/conf/reposync/repodownload.conf
		echo "mirrorlist=file:///opt/so/conf/reposync/mirror.txt" >> /opt/so/conf/reposync/repodownload.conf
		echo "enabled=1" >> /opt/so/conf/reposync/repodownload.conf
		echo "gpgcheck=1" >> /opt/so/conf/reposync/repodownload.conf
	
		logCmd "dnf repolist"
		
		if [[ ! $is_airgap ]]; then
        	curl --retry 5 --retry-delay 60 -A "netinstall/$SOVERSION/$OS/$(uname -r)/1" https://sigs.securityonion.net/checkup --output /tmp/install
			logCmd "dnf reposync --norepopath -g --delete -m -c /opt/so/conf/reposync/repodownload.conf --repoid=securityonionsync --download-metadata -p /nsm/repo/"
			# After the download is complete run createrepo
			create_repo
		fi

	else
		# Add the proper repos for unsupported stuff
		echo "Adding Repos"
		if [[ $is_rpm ]]; then
			if [[ $is_rhel ]]; then
				logCmd "subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms"
				info "Install epel for rhel" 
				logCmd "dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm"
				logCmd "dnf -y install https://dl.fedoraproject.org/pub/epel/epel-next-release-latest-9.noarch.rpm"
			else  
				logCmd "dnf config-manager --set-enabled crb"
				logCmd "dnf -y install epel-release"
			fi
			dnf install -y yum-utils device-mapper-persistent-data lvm2
			curl -fsSL https://repo.securityonion.net/file/so-repo/prod/2.4/so/so.repo | tee /etc/yum.repos.d/so.repo
			rpm --import https://repo.saltproject.io/salt/py3/redhat/9/x86_64/SALT-PROJECT-GPG-PUBKEY-2023.pub
			dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
			curl -fsSL https://repo.saltproject.io/salt/py3/redhat/9/x86_64/minor/3006.1.repo | tee /etc/yum.repos.d/salt.repo
			dnf repolist
			curl --retry 5 --retry-delay 60 -A "netinstall/$SOVERSION/$OS/$(uname -r)/1" https://sigs.securityonion.net/checkup --output /tmp/install
		else
			echo "Not sure how you got here."
			exit 1
		fi
	fi
}

saltify() {
	info "Installing Salt"
	SALTVERSION=$(egrep 'version: [0-9]{4}' ../salt/salt/master.defaults.yaml | sed 's/^.*version: //')
	if [[ $is_deb ]]; then

		DEBIAN_FRONTEND=noninteractive retry 150 20 "apt-get -y -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\" upgrade" >> "$setup_log" 2>&1 || fail_setup
		if [ $OSVER == "focal" ]; then update-alternatives --install /usr/bin/python python /usr/bin/python3.10 10; fi
		local pkg_arr=(
			'apache2-utils'
			'ca-certificates'
			'curl'
			'software-properties-common'
			'apt-transport-https'
			'openssl'
			'netcat-openbsd'
			'jq'
			'gnupg'
		)
		retry 150 20 "apt-get -y install ${pkg_arr[*]}" || fail_setup

		logCmd "mkdir -vp /etc/apt/keyrings"
		logCmd "wget -q --inet4-only -O /etc/apt/keyrings/docker.pub https://download.docker.com/linux/ubuntu/gpg"

		if [[ $is_ubuntu ]]; then

			# Add Salt Repo
			logCmd "curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/ubuntu/$UBVER/amd64/minor/$SALTVERSION/SALT-PROJECT-GPG-PUBKEY-2023.gpg"
			echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg] https://repo.saltproject.io/salt/py3/ubuntu/$UBVER/amd64/minor/$SALTVERSION/ $OSVER main" | sudo tee /etc/apt/sources.list.d/salt.list

			# Add Docker Repo
			add-apt-repository -y "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" 
		
		else
			# Add Salt Repo *NOTE* You have to use debian 11 since it isn't out for 12
			logCmd "curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/$SALTVERSION/SALT-PROJECT-GPG-PUBKEY-2023.gpg"
			echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg] https://repo.saltproject.io/salt/py3/debian/11/amd64/minor/$SALTVERSION/ bullseye main" | sudo tee /etc/apt/sources.list.d/salt.list

			# Add Docker Repo
			curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
			echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $OSVER stable" > /etc/apt/sources.list.d/docker.list 
		
		fi

		logCmd "apt-key add /etc/apt/keyrings/salt-archive-keyring-2023.gpg"

		#logCmd "apt-key add /opt/so/gpg/SALTSTACK-GPG-KEY.pub"
		logCmd "apt-key add /etc/apt/keyrings/docker.pub"

		# Add SO Saltstack Repo
		#echo "deb https://repo.securityonion.net/file/securityonion-repo/ubuntu/20.04/amd64/salt3004.2/ focal main" > /etc/apt/sources.list.d/saltstack.list

		# Ain't nothing but a GPG 

		retry 150 20 "apt-get update" "" "Err:" || fail_setup
		if [[ $waitforstate ]]; then
			retry 150 20 "apt-get -y install salt-common=$SALTVERSION salt-minion=$SALTVERSION salt-master=$SALTVERSION" || fail_setup
			retry 150 20 "apt-mark hold salt-minion salt-common salt-master" || fail_setup
			retry 150 20 "apt-get -y install python3-pip python3-dateutil python3-m2crypto python3-packaging python3-influxdb python3-lxml" || exit 1
		else
			retry 150 20 "apt-get -y install salt-common=$SALTVERSION salt-minion=$SALTVERSION" || fail_setup
			retry 150 20 "apt-mark hold salt-minion salt-common" || fail_setup
		fi
	fi
		
	if [[ $is_rpm ]]; then
		if [[ $waitforstate ]]; then 
			# install all for a manager
			logCmd "dnf -y install salt-$SALTVERSION salt-master-$SALTVERSION salt-minion-$SALTVERSION"
		else
			# We just need the minion
			logCmd "dnf -y install salt-$SALTVERSION salt-minion-$SALTVERSION"
		fi
	fi

	logCmd "mkdir -p /etc/salt/minion.d"
	salt_install_module_deps
	salt_patch_x509_v2

}

salt_install_module_deps() {
    logCmd "salt-pip install docker --no-index --only-binary=:all: --find-links files/salt_module_deps/docker/"
    logCmd "salt-pip install pymysql --no-index --only-binary=:all: --find-links files/salt_module_deps/pymysql/"
}

salt_patch_x509_v2() {
	# this can be removed when https://github.com/saltstack/salt/issues/64195 is resolved
	if [ $SALTVERSION == "3006.1" ]; then
		info "Salt version 3006.1 found. Patching /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/x509_v2.py"
		\cp -v ./files/patch/states/x509_v2.py /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/x509_v2.py
	fi
}

# Create an secrets pillar so that passwords survive re-install
secrets_pillar(){
  if [ ! -f $local_salt_dir/pillar/secrets.sls ]; then
	info "Creating Secrets Pillar"
	mkdir -p $local_salt_dir/pillar
	printf '%s\n'\
		"secrets:"\
		"  mysql: $MYSQLPASS"\
		"  playbook_db: $PLAYBOOKDBPASS"\
		"  playbook_admin: $PLAYBOOKADMINPASS"\
		"  playbook_automation: $PLAYBOOKAUTOMATIONPASS"\
		"  playbook_automation_api_key: "\
		"  import_pass: $IMPORTPASS"\
		"  influx_pass: $INFLUXPASS" > $local_salt_dir/pillar/secrets.sls
  fi
}

set_network_dev_status_list() {
	readarray -t nmcli_dev_status_list <<< "$(nmcli -t -f DEVICE,STATE -c no dev status)"
	export nmcli_dev_status_list
}

set_main_ip() {
	local count=0
	local progress='.'
	local c=0
	local m=3.3
	local max_attempts=30
	info "Gathering the management IP. "
	while ! valid_ip4 "$MAINIP" || ! valid_ip4 "$MNIC_IP"; do
		MAINIP=$(ip route get 1 | awk '{print $7;exit}')
		MNIC_IP=$(ip a s "$MNIC" | grep -oE 'inet [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d' ' -f2)
		((count=count+1))
		p=$(awk -vp=$m -vq=$count 'BEGIN{printf "%.0f" ,p * q}')
		printf "%-*s" $((count+1)) '[' | tr ' ' '#'
		printf "%*s%3d%%\r"  $((max_attempts-count))  "]" "$p"
		if [ $count = $max_attempts ]; then
			info "ERROR: Could not determine MAINIP or MNIC_IP."
			info "MAINIP=$MAINIP"
			info "MNIC_IP=$MNIC_IP"
			whiptail_error_message "The management IP could not be determined. Please check the log at /root/sosetup.log and verify the network configuration. Select OK to exit."
			fail_setup
		fi
		sleep 1
	done
}

# Add /usr/sbin to everyone's path
set_path() {
	echo "complete -cf sudo" >> /etc/profile.d/securityonion.sh
}

set_minion_info() {
	short_name=$(echo "$HOSTNAME" | awk -F. '{print $1}')

	if [[ $is_desktop ]]; then
		MINION_ID=$(echo "${short_name}_desktop" | tr '[:upper:]' '[:lower:]')
	fi
	if [[ ! $is_desktop ]]; then
		MINION_ID=$(echo "${short_name}_${install_type}" | tr '[:upper:]' '[:lower:]')
	fi
	export MINION_ID

	info "MINION_ID = $MINION_ID"

	minion_type=$(get_minion_type)
}

set_proxy() {

	# Don't proxy localhost, local ip, and management ip
	no_proxy_string="localhost, 127.0.0.1, ${MAINIP}, ${HOSTNAME}"
	if [[ -n $MSRV ]] && [[ -n $MSRVIP ]];then
		no_proxy_string="${no_proxy_string}, ${MSRVIP}, ${MSRV}"
	fi

	# Set proxy environment variables used by curl, wget, docker, and others
	{
		echo "export use_proxy=on"
		echo "export http_proxy=\"${so_proxy}\""
		echo "export https_proxy=\"\$http_proxy\""
		echo "export ftp_proxy=\"\$http_proxy\""
		echo "export no_proxy=\"${no_proxy_string}\""
	} > /etc/profile.d/so-proxy.sh

	source /etc/profile.d/so-proxy.sh

	[[ -d '/etc/systemd/system/docker.service.d' ]] || mkdir -p /etc/systemd/system/docker.service.d

	# Create proxy config for dockerd 
	printf '%s\n'\
		"[Service]"\
		"Environment=\"HTTP_PROXY=${so_proxy}\""\
		"Environment=\"HTTPS_PROXY=${so_proxy}\""\
		"Environment=\"NO_PROXY=${no_proxy_string}\"" > /etc/systemd/system/docker.service.d/http-proxy.conf

	systemctl daemon-reload
	command -v docker &> /dev/null && systemctl restart docker

	# Create config.json for docker containers
	[[ -d /root/.docker ]] || mkdir /root/.docker
	printf '%s\n'\
		"{"\
		"  \"proxies\":"\
		"  {"\
		"    \"default\":"\
		"    {"\
		"      \"httpProxy\":\"${so_proxy}\","\
		"      \"httpsProxy\":\"${so_proxy}\","\
		"      \"ftpProxy\":\"${so_proxy}\","\
		"      \"noProxy\":\"${no_proxy_string}\""\
		"    }"\
		"  }"\
		"}" > /root/.docker/config.json

	# Set proxy for package manager
	if [[ $is_rpm ]]; then
		echo "proxy=$so_proxy" >> /etc/yum.conf
	else
		# Set it up so the updates roll through the manager
		printf '%s\n'\
			"Acquire::http::Proxy \"$so_proxy\";"\
			"Acquire::https::Proxy \"$so_proxy\";" > /etc/apt/apt.conf.d/00-proxy.conf
	fi

	# Set global git proxy
	printf '%s\n'\
		"[http]"\
		"  proxy = ${so_proxy}" > /etc/gitconfig
}

setup_salt_master_dirs() {
	# Create salt master directories
	mkdir -p $default_salt_dir/pillar
	mkdir -p $default_salt_dir/salt
	mkdir -p $local_salt_dir/pillar
	mkdir -p $local_salt_dir/salt

	# Copy over the salt code and templates
	if [ "$setup_type" = 'iso' ]; then
		logCmd "rsync -avh --exclude 'TRANS.TBL' /home/$INSTALLUSERNAME/SecurityOnion/pillar/* $default_salt_dir/pillar/"
		logCmd "rsync -avh --exclude 'TRANS.TBL' /home/$INSTALLUSERNAME/SecurityOnion/salt/* $default_salt_dir/salt/"
		logCmd "mkdir -p $local_salt_dir/salt/zeek/policy/intel"
		logCmd "touch $local_salt_dir/salt/zeek/policy/intel/intel.dat"
	else
		logCmd "cp -Rv ../pillar/* $default_salt_dir/pillar/"
		logCmd "cp -Rv ../salt/* $default_salt_dir/salt/"
		logCmd "mkdir -p $local_salt_dir/salt/zeek/policy/intel"
		logCmd "touch $local_salt_dir/salt/zeek/policy/intel/intel.dat"
	fi

	info "Chown the salt dirs on the manager for socore"
	logCmd "chown -R socore:socore /opt/so"
}

set_progress_str() {
	local percentage_input=$1
	progress_bar_text=$2
	export progress_bar_text
	local nolog=$2

	if (( "$percentage_input" >= "$percentage" )); then
		percentage="$percentage_input"
	fi

	percentage_str="XXX\n${percentage}\n${progress_bar_text}\nXXX"

	echo -e "$percentage_str"

	if [[ -z $nolog ]]; then
		info "Progressing ($percentage%): $progress_bar_text"

		# printf '%s\n' \
		# 	'----'\
		# 	"$percentage% - ${progress_bar_text^^}"\
		# 	"----" >> "$setup_log" 2>&1
	fi
}

set_default_log_size() {
	local percentage

	case $install_type in
		STANDALONE | EVAL | HEAVYNODE)
			percentage=50
		;;
		*)
			percentage=80
		;;
	esac

	local disk_dir="/"
	if [ -d /nsm ]; then
		disk_dir="/nsm"
	fi
	if [ -d /nsm/elasticsearch ]; then
		disk_dir="/nsm/elasticsearch"
	fi
	
	local disk_size_1k
	disk_size_1k=$(df $disk_dir | grep -v "^Filesystem" | awk '{print $2}')

	local ratio="1048576"

	local disk_size_gb
	disk_size_gb=$( echo "$disk_size_1k" "$ratio" | awk '{print($1/$2)}' )

	log_size_limit=$( echo "$disk_size_gb" "$percentage" | awk '{printf("%.0f", $1 * ($2/100))}')
}

set_desktop_background() {

	logCmd "mkdir /usr/local/share/backgrounds"
	logCmd "cp ../salt/desktop/files/so-wallpaper.jpg /usr/local/share/backgrounds/so-wallpaper.jpg"
	logCmd "cp ../salt/desktop/files/00-background /etc/dconf/db/local.d/00-background"
	logCmd "dconf update"

}

set_hostname() {

	logCmd "hostnamectl set-hostname --static $HOSTNAME"
	echo "127.0.0.1   $HOSTNAME $HOSTNAME.localdomain localhost localhost.localdomain localhost4 localhost4.localdomain" > /etc/hosts
	echo "::1   $HOSTNAME $HOSTNAME.localdomain localhost localhost.localdomain localhost6 localhost6.localdomain6" >> /etc/hosts
	echo "$HOSTNAME" > /etc/hostname

	logCmd "hostname -F /etc/hostname"
}

set_initial_firewall_policy() {
	case "$install_type" in
		'EVAL' | 'MANAGER' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT')
			so-firewall includehost $minion_type $MAINIP --apply
			;;
	esac
}

set_initial_firewall_access() {
	if [[ ! -z "$ALLOW_CIDR" ]]; then
		so-firewall includehost analyst $ALLOW_CIDR --apply
	fi
	if [[ ! -z "$MINION_CIDR" ]]; then
		so-firewall includehost sensor $MINION_CIDR
		so-firewall includehost searchnode $MINION_CIDR --apply
	fi
}

# Set up the management interface on the ISO
set_management_interface() {
	title "Setting up the main interface"
	if [ "$address_type" = 'DHCP' ]; then
		logCmd "nmcli con mod $MNIC connection.autoconnect yes"
		logCmd "nmcli con up $MNIC"
		logCmd "nmcli -p connection show $MNIC"
	else
		# Set Static IP
		nmcli con mod "$MNIC" ipv4.addresses "$MIP"/"$MMASK"\
			ipv4.gateway "$MGATEWAY" \
			ipv4.dns "$MDNS"\
			ipv4.dns-search "$MSEARCH"\
			connection.autoconnect yes\
			ipv4.method manual >> "$setup_log" 2>&1
		nmcli con up "$MNIC" >> "$setup_log" 2>&1
	fi
}

set_redirect() {
	title "Setting redirect host"
	case $REDIRECTINFO in
		'IP')
			REDIRECTIT="$MAINIP"
			;;
		'HOSTNAME')
			REDIRECTIT="$HOSTNAME"
			;;
		*)
			REDIRECTIT="$REDIRECTHOST"
			;;
	esac
}

set_timezone() {

	logCmd "timedatectl set-timezone Etc/UTC"

}

so_add_user() {
	local username=$1
	local uid=$2
	local gid=$3
	local home_dir=$4
	if [ "$5" ]; then local pass=$5; fi

	info "Add $username user"
	logCmd "groupadd --gid $gid $username"
	logCmd "useradd -m --uid $uid --gid $gid --home-dir $home_dir $username"

	# If a password has been passed in, set the password
	if [ "$pass" ]; then
		echo "$username":"$pass" | chpasswd --crypt-method=SHA512
	fi
}

update_sudoers_for_testing() {
	if [ -n "$TESTING" ]; then
		info "Ensuring $INSTALLUSERNAME has password-less sudo access for automated testing purposes."
		sed -i "s/^$INSTALLUSERNAME   ALL=(ALL)       ALL/$INSTALLUSERNAME   ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers
	fi
}

update_packages() {
	if [[ $is_oracle ]]; then
		logCmd "dnf repolist"
		logCmd "dnf -y update --allowerasing --exclude=salt*,docker*,containerd*"
		RMREPOFILES=("oracle-linux-ol9.repo" "uek-ol9.repo" "virt-ol9.repo")
		info "Removing repo files added by oracle-repos package update"
		for FILE in ${RMREPOFILES[@]}; do
			logCmd "rm -f /etc/yum.repos.d/$FILE"
		done
	elif [[ $is_deb ]]; then
		info "Running apt-get update"
		retry 150 10 "apt-get -y update" "" "Err:" >> "$setup_log" 2>&1 || fail_setup
		info "Running apt-get upgrade"
		retry 150 10 "apt-get -y upgrade" >> "$setup_log" 2>&1 || fail_setup
	fi
}

# This is used for development to speed up network install tests.
use_turbo_proxy() {
	if [[ ! $install_type =~ ^(MANAGER|EVAL|HELIXSENSOR|MANAGERSEARCH|STANDALONE)$ ]]; then
		info "turbo is not supported on this install type"
		return
	fi

	if [[ $OS == 'centos' ]]; then
		printf '%s\n' "proxy=${TURBO}:3142" >> /etc/yum.conf
	else
		printf '%s\n'\
			"Acquire {"\
			"  HTTP::proxy \"${TURBO}:3142\";"\
			"  HTTPS::proxy \"${TURBO}:3142\";"\
			"}" > /etc/apt/apt.conf.d/proxy.conf
	fi
}

wait_for_file() {
	local filename=$1
	local max_attempts=$2 # this is multiplied by the wait interval, so make sure it isn't too large
	local cur_attempts=0
	local wait_interval=$3
	local total_time=$(( max_attempts * wait_interval ))
	local date
	date=$(date)

	while [[ $cur_attempts -lt $max_attempts ]]; do
		if [ -f "$filename" ]; then
			info "File $filename found at $date"
			return 0
		else
			((cur_attempts++))
			info "File $filename does not exist; waiting ${wait_interval}s then checking again ($cur_attempts/$max_attempts)..."
			sleep "$wait_interval"
		fi
	done
	info "Could not find $filename after waiting ${total_time}s"
	return 1
}

wait_for_salt_minion() {
	retry 60 5 "journalctl -u salt-minion.service | grep 'Minion is ready to receive requests'" >> "$setup_log" 2>&1 || fail_setup
	local attempt=0
	# each attempts would take about 15 seconds
	local maxAttempts=20
	until check_salt_minion_status; do
		attempt=$((attempt+1))
		if [[ $attempt -eq $maxAttempts ]]; then
			fail_setup
		fi
		sleep 10
	done
}

verify_setup() {
	info "Verifying setup"
	set -o pipefail
	./so-verify "$setup_type" 2>&1 | tee -a $setup_log
	result=$?
	set +o pipefail
	if [[ $result -eq 0 ]]; then
		whiptail_setup_complete
	else
		whiptail_setup_failed
	fi
}
