diff --git a/salt/common/tools/sbin/so-rule b/salt/common/tools/sbin/so-rule index 8be26fcdf..07d6cd2cc 100755 --- a/salt/common/tools/sbin/so-rule +++ b/salt/common/tools/sbin/so-rule @@ -37,11 +37,9 @@ def print_err(string: str): def check_apply(args: dict, prompt: bool = True): - cmd_arr = ['salt-call', 'state.apply', 'idstools', 'queue=True'] - if args.apply: - print('Configuration updated. Applying idstools state...') - return subprocess.run(cmd_arr) + print('Configuration updated. Applying changes:') + return apply() else: if prompt: message = 'Configuration updated. Would you like to apply your changes now? (y/N) ' @@ -51,12 +49,24 @@ def check_apply(args: dict, prompt: bool = True): if answer.lower() in [ 'n', '' ]: return 0 else: - print('Applying idstools state...') - return subprocess.run(cmd_arr) + print('Applying changes:') + return apply() else: return 0 +def apply(): + salt_cmd = ['salt-call', 'state.apply', '-l', 'quiet', 'idstools.sync_files', 'queue=True'] + update_cmd = ['so-rule-update'] + print('Syncing config files...') + cmd = subprocess.run(salt_cmd, stdout=subprocess.DEVNULL) + if cmd.returncode == 0: + print('Updating rules...') + return subprocess.run(update_cmd).returncode + else: + return cmd.returncode + + def find_minion_pillar() -> str: regex = '^.*_(manager|managersearch|standalone|import|eval)\.sls$' @@ -442,10 +452,7 @@ def main(): modify.print_help() sys.exit(0) - if isinstance(exit_code, subprocess.CompletedProcess): - sys.exit(exit_code.returncode) - else: - sys.exit(exit_code) + sys.exit(exit_code) if __name__ == '__main__': diff --git a/salt/idstools/init.sls b/salt/idstools/init.sls index 725520928..6282ede6c 100644 --- a/salt/idstools/init.sls +++ b/salt/idstools/init.sls @@ -20,13 +20,11 @@ {% set MANAGER = salt['grains.get']('master') %} {% set ENGINE = salt['pillar.get']('global:mdengine', '') %} {% set proxy = salt['pillar.get']('manager:proxy') %} + +include: + - idstools.sync_files + # IDSTools Setup -idstoolsdir: - file.directory: - - name: /opt/so/conf/idstools/etc - - user: 939 - - group: 939 - - makedirs: True idstoolslogdir: file.directory: @@ -35,14 +33,6 @@ idstoolslogdir: - group: 939 - makedirs: True -idstoolsetcsync: - file.recurse: - - name: /opt/so/conf/idstools/etc - - source: salt://idstools/etc - - user: 939 - - group: 939 - - template: jinja - so-ruleupdatecron: cron.present: - name: /usr/sbin/so-rule-update > /opt/so/log/idstools/download.log 2>&1 @@ -50,23 +40,6 @@ so-ruleupdatecron: - minute: '1' - hour: '7' -rulesdir: - file.directory: - - name: /opt/so/rules/nids - - user: 939 - - group: 939 - - makedirs: True - -# Don't show changes because all.rules can be large -synclocalnidsrules: - file.recurse: - - name: /opt/so/rules/nids/ - - source: salt://idstools/ - - user: 939 - - group: 939 - - show_changes: False - - include_pat: 'E@.rules' - so-idstools: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-idstools:{{ VERSION }} diff --git a/salt/idstools/sync_files.sls b/salt/idstools/sync_files.sls new file mode 100644 index 000000000..ad1e62239 --- /dev/null +++ b/salt/idstools/sync_files.sls @@ -0,0 +1,46 @@ +# Copyright 2014,2015,2016,2017,2018 Security Onion Solutions, LLC + +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +idstoolsdir: + file.directory: + - name: /opt/so/conf/idstools/etc + - user: 939 + - group: 939 + - makedirs: True + +idstoolsetcsync: + file.recurse: + - name: /opt/so/conf/idstools/etc + - source: salt://idstools/etc + - user: 939 + - group: 939 + - template: jinja + +rulesdir: + file.directory: + - name: /opt/so/rules/nids + - user: 939 + - group: 939 + - makedirs: True + +# Don't show changes because all.rules can be large +synclocalnidsrules: + file.recurse: + - name: /opt/so/rules/nids/ + - source: salt://idstools/ + - user: 939 + - group: 939 + - show_changes: False + - include_pat: 'E@.rules'