CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-25 05:57:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

use vrt

Browse Source
This commit is contained in:
Josh Patterson
2025-04-03 13:44:13 -04:00
parent 3083e3bc63
commit 445afca6ee
27 changed files with 41 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/_runners/setup_hypervisor.py
+4 -9
View File
@@ -121,8 +121,8 @@ def _check_license():
log.error("LICENSE: No license_id found in license file") log.error("LICENSE: No license_id found in license file")
return False return False
if 'hvn' not in features: if 'vrt' not in features:
log.error("LICENSE: 'hvn' feature not found in license") log.error("LICENSE: 'vrt' feature not found in license")
return False return False
log.info("LICENSE: License validation successful") log.info("LICENSE: License validation successful")
@@ -506,7 +506,7 @@ def setup_environment(vm_name: str = 'sool9', disk_size: str = '220G', minion_id
if not _check_license(): if not _check_license():
return { return {
'success': False, 'success': False,
'error': 'Invalid license or missing hvn feature', 'error': 'Invalid license or missing vrt feature',
'vm_result': None 'vm_result': None
} }
@@ -670,7 +670,7 @@ def create_vm(vm_name: str, disk_size: str = '220G'):
if not _check_license(): if not _check_license():
return { return {
'success': False, 'success': False,
'error': 'Invalid license or missing hvn feature', 'error': 'Invalid license or missing vrt feature',
} }
try: try:
@@ -958,11 +958,6 @@ def regenerate_ssh_keys():
else: else:
print("Failed to regenerate SSH keys") print("Failed to regenerate SSH keys")
""" """
# Check license before proceeding
if not _check_license():
log.error("MAIN: Invalid license or missing hvn feature")
return False
log.info("MAIN: Starting SSH key regeneration") log.info("MAIN: Starting SSH key regeneration")
try: try:
# Verify current state # Verify current state
salt/common/tools/sbin_jinja/so-salt-emit-vm-deployment-status-event
+1 -1
View File
@@ -11,7 +11,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) -%} {% if 'vrt' in salt['pillar.get']('features', []) -%}
""" """
Script for emitting VM deployment status events to the Salt event bus. Script for emitting VM deployment status events to the Salt event bus.
salt/hypervisor/init.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %} {% if sls in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
hypervisor_log_dir: hypervisor_log_dir:
file.directory: file.directory:
salt/hypervisor/map.jinja
+1 -1
View File
@@ -9,7 +9,7 @@
in the software, and you may not remove or obscure any functionality in the in the software, and you may not remove or obscure any functionality in the
software that is protected by the license key." #} software that is protected by the license key." #}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{# Import defaults.yaml for model hardware capabilities #} {# Import defaults.yaml for model hardware capabilities #}
{% import_yaml 'hypervisor/defaults.yaml' as DEFAULTS %} {% import_yaml 'hypervisor/defaults.yaml' as DEFAULTS %}
salt/hypervisor/tools/sbin_jinja/so-kvm-modify-hardware
+1 -1
View File
@@ -11,7 +11,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
""" """
Script for managing hardware configurations of KVM virtual machines. This script provides Script for managing hardware configurations of KVM virtual machines. This script provides
salt/hypervisor/tools/sbin_jinja/so-qcow2-modify-network
+1 -1
View File
@@ -11,7 +11,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) -%} {% if 'vrt' in salt['pillar.get']('features', []) -%}
""" """
Script for modifying network configurations within QCOW2 virtual machine images. This script provides Script for modifying network configurations within QCOW2 virtual machine images. This script provides
salt/libvirt/images/init.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states or sls in allowed_states %} {% if sls.split('.')[0] in allowed_states or sls in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
include: include:
- libvirt.packages - libvirt.packages
salt/libvirt/init.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %} {% if sls in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% from 'libvirt/map.jinja' import LIBVIRTMERGED %} {% from 'libvirt/map.jinja' import LIBVIRTMERGED %}
include: include:
salt/libvirt/packages.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states or sls in allowed_states %} {% if sls.split('.')[0] in allowed_states or sls in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
# allows for creating vm images # allows for creating vm images
# any node manipulating images needs this # any node manipulating images needs this
salt/libvirt/ssh/users.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states or sls in allowed_states %} {% if sls.split('.')[0] in allowed_states or sls in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% from 'vars/globals.map.jinja' import GLOBALS %} {% from 'vars/globals.map.jinja' import GLOBALS %}
{% if GLOBALS.is_manager %} {% if GLOBALS.is_manager %}
salt/manager/hypervisor.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %} {% if sls.split('.')[0] in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% set manager_hostname = grains.id.split('_')[0] %} {% set manager_hostname = grains.id.split('_')[0] %}
# Check if hypervisor environment has been set up # Check if hypervisor environment has been set up
salt/manager/tools/sbin/so-minion
+4 -4
View File
@@ -235,7 +235,7 @@ function acceptminion() {
if [[ "$MINION_ID" == *"_hypervisor" ]]; then if [[ "$MINION_ID" == *"_hypervisor" ]]; then
FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features) FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features)
if [[ $? -ne 0 || ! "$FEATURES" =~ "hvn" ]]; then if [[ $? -ne 0 || ! "$FEATURES" =~ "vrt" ]]; then
error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature." error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature."
log "ERROR" "$error_msg" log "ERROR" "$error_msg"
echo -e "Error: $error_msg" echo -e "Error: $error_msg"
@@ -869,7 +869,7 @@ function createRECEIVER() {
function createHYPERVISOR() { function createHYPERVISOR() {
log "INFO" "Creating HYPERVISOR configuration for minion $MINION_ID" log "INFO" "Creating HYPERVISOR configuration for minion $MINION_ID"
FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features) FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features)
if [[ $? -ne 0 || ! "$FEATURES" =~ "hvn" ]]; then if [[ $? -ne 0 || ! "$FEATURES" =~ "vrt" ]]; then
error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature." error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature."
log "ERROR" "$error_msg" log "ERROR" "$error_msg"
echo -e "Error: $error_msg" echo -e "Error: $error_msg"
@@ -964,7 +964,7 @@ function updateMineAndApplyStates() {
# We don't want a hypervisor node to highstate until the image is downloaded and built. This will be triggered from the setup_hypervisor runner # We don't want a hypervisor node to highstate until the image is downloaded and built. This will be triggered from the setup_hypervisor runner
if [[ "$NODETYPE" == "HYPERVISOR" ]]; then if [[ "$NODETYPE" == "HYPERVISOR" ]]; then
FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features) FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features)
if [[ $? -ne 0 || ! "$FEATURES" =~ "hvn" ]]; then if [[ $? -ne 0 || ! "$FEATURES" =~ "vrt" ]]; then
error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature." error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature."
log "ERROR" "$error_msg" log "ERROR" "$error_msg"
echo -e "Error: $error_msg" echo -e "Error: $error_msg"
@@ -1058,7 +1058,7 @@ case "$OPERATION" in
"addVM") "addVM")
log "INFO" "Adding VM minion $MINION_ID" log "INFO" "Adding VM minion $MINION_ID"
FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features) FEATURES=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/soc/license.sls features)
if [[ $? -ne 0 || ! "$FEATURES" =~ "hvn" ]]; then if [[ $? -ne 0 || ! "$FEATURES" =~ "vrt" ]]; then
error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature." error_msg="Hypervisor nodes are a feature supported only for customers with a valid license.\n Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n for more information about purchasing a license to enable this feature."
log "ERROR" "$error_msg" log "ERROR" "$error_msg"
echo -e "Error: $error_msg" echo -e "Error: $error_msg"
salt/manager/tools/sbin_jinja/so-salt-cloud
+1 -1
View File
@@ -11,7 +11,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) -%} {% if 'vrt' in salt['pillar.get']('features', []) -%}
""" """
Script for automated virtual machine provisioning and configuration in Security Onion's virtualization infrastructure. Script for automated virtual machine provisioning and configuration in Security Onion's virtualization infrastructure.
salt/orch/dyanno_hypervisor.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% do salt.log.info('dyanno_hypervisor_orch: Running') %} {% do salt.log.info('dyanno_hypervisor_orch: Running') %}
{% set vm_name = None %} {% set vm_name = None %}
salt/orch/vm_pillar_clean.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% do salt.log.debug('vm_pillar_clean_orch: Running') %} {% do salt.log.debug('vm_pillar_clean_orch: Running') %}
{% set vm_name = pillar.get('vm_name') %} {% set vm_name = pillar.get('vm_name') %}
salt/salt/cloud/init.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %} {% if sls in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% from 'salt/map.jinja' import SALTVERSION %} {% from 'salt/map.jinja' import SALTVERSION %}
{% set HYPERVISORS = salt['pillar.get']('hypervisor:nodes', {} ) %} {% set HYPERVISORS = salt['pillar.get']('hypervisor:nodes', {} ) %}
salt/salt/cloud/reactor_config_hypervisor.sls
+1 -1
View File
@@ -11,7 +11,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[:2]|join('.') in allowed_states %} {% if sls.split('.')[:2]|join('.') in allowed_states %}
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
reactor_config_hypervisor: reactor_config_hypervisor:
file.managed: file.managed:
- name: /etc/salt/master.d/reactor_hypervisor.conf - name: /etc/salt/master.d/reactor_hypervisor.conf
salt/salt/engines/master/virtual_node_manager.py
+5 -5
View File
@@ -63,7 +63,7 @@ State Files:
- <vm_name>.error: Error state with detailed message - <vm_name>.error: Error state with detailed message
Notes: Notes:
- Requires 'hvn' feature license - Requires 'vrt' feature license
- Uses hypervisor's sosmodel grain for hardware capabilities - Uses hypervisor's sosmodel grain for hardware capabilities
- Hardware allocation based on model-specific configurations - Hardware allocation based on model-specific configurations
- All created files maintain socore ownership - All created files maintain socore ownership
@@ -80,7 +80,7 @@ Description:
- Lock remains until clean shutdown or error - Lock remains until clean shutdown or error
2. License Validation 2. License Validation
- Verifies 'hvn' feature is licensed - Verifies 'vrt' feature is licensed
- Prevents operation if license is invalid - Prevents operation if license is invalid
3. Configuration Processing 3. Configuration Processing
@@ -567,7 +567,7 @@ def mark_invalid_hardware(hypervisor_path: str, vm_name: str, config: dict, erro
log.error("Failed to create invalid hardware file: %s", str(e)) log.error("Failed to create invalid hardware file: %s", str(e))
raise raise
def validate_hvn_license() -> bool: def validate_vrt_license() -> bool:
"""Check if the license file exists and contains required values.""" """Check if the license file exists and contains required values."""
if not os.path.exists(LICENSE_PATH): if not os.path.exists(LICENSE_PATH):
log.error("License file not found at %s", LICENSE_PATH) log.error("License file not found at %s", LICENSE_PATH)
@@ -588,7 +588,7 @@ def validate_hvn_license() -> bool:
log.error("No license_id found in license file") log.error("No license_id found in license file")
return False return False
if 'hvn' not in features: if 'vrt' not in features:
log.error("Hypervisor nodes are a feature supported only for customers with a valid license.\n" log.error("Hypervisor nodes are a feature supported only for customers with a valid license.\n"
"Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n" "Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com\n"
"for more information about purchasing a license to enable this feature.") "for more information about purchasing a license to enable this feature.")
@@ -889,7 +889,7 @@ def start(interval: int = DEFAULT_INTERVAL,
""" """
log.info("Starting virtual node manager engine") log.info("Starting virtual node manager engine")
if not validate_hvn_license(): if not validate_vrt_license():
return return
# Attempt to acquire lock # Attempt to acquire lock
salt/salt/files/hvn_engine.conf → salt/salt/files/vrt_engine.conf
View File
salt/salt/master.sls
+5 -5
View File
@@ -14,7 +14,7 @@
include: include:
- salt.minion - salt.minion
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
- salt.cloud - salt.cloud
- salt.cloud.reactor_config_hypervisor - salt.cloud.reactor_config_hypervisor
@@ -48,11 +48,11 @@ pillarWatch_engine:
- name: /etc/salt/engines/pillarWatch.py - name: /etc/salt/engines/pillarWatch.py
- source: salt://salt/engines/master/pillarWatch.py - source: salt://salt/engines/master/pillarWatch.py
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
hvn_engine_config: vrt_engine_config:
file.managed: file.managed:
- name: /etc/salt/master.d/hvn_engine.conf - name: /etc/salt/master.d/vrt_engine.conf
- source: salt://salt/files/hvn_engine.conf - source: salt://salt/files/vrt_engine.conf
- watch_in: - watch_in:
- service: salt_master_service - service: salt_master_service
salt/sensor/init.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features') and salt['grains.get']('salt-cloud', {}) %} {% if 'vrt' in salt['pillar.get']('features') and salt['grains.get']('salt-cloud', {}) %}
include: include:
- sensor.vm.network - sensor.vm.network
salt/sensor/vm/network.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% set mainint = salt['pillar.get']('host:mainint', 'enp1s0') %} {% set mainint = salt['pillar.get']('host:mainint', 'enp1s0') %}
{% set interfaces = salt['network.interfaces']() %} {% set interfaces = salt['network.interfaces']() %}
salt/soc/dyanno/hypervisor/init.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{% from 'hypervisor/map.jinja' import HYPERVISORS %} {% from 'hypervisor/map.jinja' import HYPERVISORS %}
salt/soc/dyanno/hypervisor/soc_hypervisor.yaml.jinja
+1 -1
View File
@@ -9,7 +9,7 @@
in the software, and you may not remove or obscure any functionality in the in the software, and you may not remove or obscure any functionality in the
software that is protected by the license key." #} software that is protected by the license key." #}
{%- if 'hvn' in salt['pillar.get']('features', []) -%} {%- if 'vrt' in salt['pillar.get']('features', []) -%}
{%- import_yaml 'soc/dyanno/hypervisor/hypervisor.yaml' as ANNOTATION -%} {%- import_yaml 'soc/dyanno/hypervisor/hypervisor.yaml' as ANNOTATION -%}
{%- from 'hypervisor/map.jinja' import HYPERVISORS -%} {%- from 'hypervisor/map.jinja' import HYPERVISORS -%}
salt/soc/dyanno/hypervisor/write_status.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
{# Import the process steps from map.jinja #} {# Import the process steps from map.jinja #}
{% from 'soc/dyanno/hypervisor/map.jinja' import PROCESS_STEPS %} {% from 'soc/dyanno/hypervisor/map.jinja' import PROCESS_STEPS %}
salt/top.sls
+2 -2
View File
@@ -155,7 +155,7 @@ base:
- stig - stig
- kafka - kafka
'*_managerhype and I@features:hvn and G@saltversion:{{saltversion}}': '*_managerhype and I@features:vrt and G@saltversion:{{saltversion}}':
- match: compound - match: compound
- manager.hypervisor - manager.hypervisor
@@ -299,7 +299,7 @@ base:
- elasticfleet.install_agent_grid - elasticfleet.install_agent_grid
- schedule - schedule
'*_hypervisor and I@features:hvn and G@saltversion:{{saltversion}}': '*_hypervisor and I@features:vrt and G@saltversion:{{saltversion}}':
- match: compound - match: compound
- ssl - ssl
- sensoroni - sensoroni
salt/vm_status/init.sls
+1 -1
View File
@@ -9,7 +9,7 @@
# in the software, and you may not remove or obscure any functionality in the # in the software, and you may not remove or obscure any functionality in the
# software that is protected by the license key." # software that is protected by the license key."
{% if 'hvn' in salt['pillar.get']('features', []) %} {% if 'vrt' in salt['pillar.get']('features', []) %}
# Send highstate trigger event for VM deployment status tracking # Send highstate trigger event for VM deployment status tracking
# so-salt-emit-vm-deployment-status sets event_tag = f'soc/dyanno/hypervisor/{status.lower()}' # so-salt-emit-vm-deployment-status sets event_tag = f'soc/dyanno/hypervisor/{status.lower()}'