From 4e0558d2d3b2f092b7d632073446ea9d151f7460 Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Tue, 10 Nov 2026 17:30:01 -0600 Subject: [PATCH] remove unused localrules config --- salt/docker/defaults.yaml | 1 - salt/firewall/defaults.yaml | 10 -- salt/firewall/soc_firewall.yaml | 3 - salt/manager/tools/sbin/so-yaml.py | 29 ++++ salt/manager/tools/sbin/so-yaml_test.py | 217 ++++++++++++++++++++++++ salt/manager/tools/sbin/soup | 20 +++ salt/nginx/enabled.sls | 1 - salt/nginx/etc/nginx.conf | 15 -- 8 files changed, 266 insertions(+), 30 deletions(-) diff --git a/salt/docker/defaults.yaml b/salt/docker/defaults.yaml index b1e0d9162..2b3cd7605 100644 --- a/salt/docker/defaults.yaml +++ b/salt/docker/defaults.yaml @@ -103,7 +103,6 @@ docker: - 80:80 - 443:443 - 8443:8443 - - 7788:7788 - 7789:7789 custom_bind_mounts: [] extra_hosts: [] diff --git a/salt/firewall/defaults.yaml b/salt/firewall/defaults.yaml index 5c1229787..74edd8dba 100644 --- a/salt/firewall/defaults.yaml +++ b/salt/firewall/defaults.yaml @@ -118,10 +118,6 @@ firewall: tcp: - 5601 udp: [] - localrules: - tcp: - - 7788 - udp: [] nginx: tcp: - 80 @@ -200,7 +196,6 @@ firewall: - postgres - elasticsearch_rest - elasticsearch_node - - localrules sensor: portgroups: - beats_5044 @@ -391,7 +386,6 @@ firewall: - elastic_agent_control - elastic_agent_data - elastic_agent_update - - localrules - sensoroni fleet: portgroups: @@ -611,7 +605,6 @@ firewall: - elastic_agent_control - elastic_agent_data - elastic_agent_update - - localrules - sensoroni fleet: portgroups: @@ -829,7 +822,6 @@ firewall: - elastic_agent_control - elastic_agent_data - elastic_agent_update - - localrules - sensoroni fleet: portgroups: @@ -1058,7 +1050,6 @@ firewall: - elastic_agent_update - endgame - strelka_frontend - - localrules fleet: portgroups: - elasticsearch_rest @@ -1518,7 +1509,6 @@ firewall: - elasticsearch_rest - elasticsearch_node - elastic_agent_control - - localrules sensor: portgroups: - beats_5044 diff --git a/salt/firewall/soc_firewall.yaml b/salt/firewall/soc_firewall.yaml index a5181e50f..1e855c8af 100644 --- a/salt/firewall/soc_firewall.yaml +++ b/salt/firewall/soc_firewall.yaml @@ -138,9 +138,6 @@ firewall: kibana: tcp: *tcpsettings udp: *udpsettings - localrules: - tcp: *tcpsettings - udp: *udpsettings nginx: tcp: *tcpsettings udp: *udpsettings diff --git a/salt/manager/tools/sbin/so-yaml.py b/salt/manager/tools/sbin/so-yaml.py index d6465e97b..a4126bedf 100755 --- a/salt/manager/tools/sbin/so-yaml.py +++ b/salt/manager/tools/sbin/so-yaml.py @@ -20,6 +20,7 @@ def showUsage(args): print(' append - Append a list item to a yaml key, if it exists and is a list. Requires KEY and LISTITEM args.', file=sys.stderr) print(' appendlistobject - Append an object to a yaml list key. Requires KEY and JSON_OBJECT args.', file=sys.stderr) print(' removelistitem - Remove a list item from a yaml key, if it exists and is a list. Requires KEY and LISTITEM args.', file=sys.stderr) + print(' purgelistitem - Remove every occurrence of a list item from all lists nested under a yaml key, if it exists. Requires KEY and LISTITEM args.', file=sys.stderr) print(' replacelistobject - Replace a list object based on a condition. Requires KEY, CONDITION_FIELD, CONDITION_VALUE, and JSON_OBJECT args.', file=sys.stderr) print(' add - Add a new key and set its value. Fails if key already exists. Requires KEY and VALUE args.', file=sys.stderr) print(' get [-r] - Displays (to stdout) the value stored in the given key. Requires KEY arg. Use -r for raw output without YAML formatting.', file=sys.stderr) @@ -199,6 +200,33 @@ def removelistitem(args): return 0 +def purgeListItem(content, listItem): + if isinstance(content, dict): + for value in content.values(): + purgeListItem(value, listItem) + elif isinstance(content, list): + content[:] = [item for item in content if item != listItem] + for item in content: + purgeListItem(item, listItem) + + +def purgelistitem(args): + if len(args) != 3: + print('Missing filename, key arg, or list item to purge', file=sys.stderr) + showUsage(None) + return 1 + + filename = args[0] + key = args[1] + listItem = args[2] + + content = loadYaml(filename) + purgeListItem(getKeyValue(content, key), convertType(listItem)) + writeYaml(filename, content) + + return 0 + + def replaceListObjectByCondition(content, key, conditionField, conditionValue, newObject): pieces = key.split(".", 1) if len(pieces) > 1: @@ -385,6 +413,7 @@ def main(): "append": append, "appendlistobject": appendlistobject, "removelistitem": removelistitem, + "purgelistitem": purgelistitem, "replacelistobject": replacelistobject, "get": get, "remove": remove, diff --git a/salt/manager/tools/sbin/so-yaml_test.py b/salt/manager/tools/sbin/so-yaml_test.py index 7fa4cf8a7..72a82f44e 100644 --- a/salt/manager/tools/sbin/so-yaml_test.py +++ b/salt/manager/tools/sbin/so-yaml_test.py @@ -709,6 +709,223 @@ class TestRemoveListItem(unittest.TestCase): self.assertEqual("The existing value for the given key is not a list. No action was taken on the file.\n", mock_stderr.getvalue()) +class TestPurgeListItem(unittest.TestCase): + + def test_purgelistitem_missing_arg(self): + with patch('sys.exit', new=MagicMock()) as sysmock: + with patch('sys.stderr', new=StringIO()) as mock_stderr: + sys.argv = ["cmd", "help"] + soyaml.purgelistitem(["file", "key"]) + sysmock.assert_called() + self.assertIn("Missing filename, key arg, or list item to purge", mock_stderr.getvalue()) + + def test_purgelistitem(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [a,b,c], key2: false}") + file.close() + + soyaml.purgelistitem([filename, "key1", "b"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- a\n- c\nkey2: false\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_nested_lists(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: { child1: [a,b,c], child2: { deep1: [b,d], deep2: 45 } }, key2: [b,e]}") + file.close() + + soyaml.purgelistitem([filename, "key1", "b"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n child1:\n - a\n - c\n child2:\n deep1:\n - d\n deep2: 45\nkey2:\n- b\n- e\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_duplicates(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [b,a,b,c,b]}") + file.close() + + soyaml.purgelistitem([filename, "key1", "b"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- a\n- c\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_list_of_objects(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [{name: item1, values: [a,b]}, b, {name: item2, values: [b,c]}]}") + file.close() + + soyaml.purgelistitem([filename, "key1", "b"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- name: item1\n values:\n - a\n- name: item2\n values:\n - c\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_typed(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [1, '1', 2]}") + file.close() + + soyaml.purgelistitem([filename, "key1", "1"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- '1'\n- 2\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_item_not_in_list(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: { child1: [a,b,c] }}") + file.close() + + soyaml.purgelistitem([filename, "key1", "d"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n child1:\n - a\n - b\n - c\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_key_noexist(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [a,b,c]}") + file.close() + + result = soyaml.purgelistitem([filename, "key2.child1", "b"]) + self.assertEqual(result, 0) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- a\n- b\n- c\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_key_noexist_deep(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: { child1: [a,b,c] }}") + file.close() + + result = soyaml.purgelistitem([filename, "key1.child2.deep1", "b"]) + self.assertEqual(result, 0) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n child1:\n - a\n - b\n - c\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_scalar_and_null_values(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: { child1: b, child2: null, child3: [b] }}") + file.close() + + soyaml.purgelistitem([filename, "key1", "b"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n child1: b\n child2: null\n child3: []\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_lists_of_lists(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [[a,b], [b,[b,c]], b]}") + file.close() + + soyaml.purgelistitem([filename, "key1", "b"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- - a\n- - - c\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_file_object(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: [{name: x}, a, {name: y}, {name: x}]}") + file.close() + + itemfile = "/tmp/so-yaml_test-purgelistitem-item.yaml" + file = open(itemfile, "w") + file.write("name: x\n") + file.close() + + soyaml.purgelistitem([filename, "key1", "file:" + itemfile]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n- a\n- name: y\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_main(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: { child1: [a,b,c] }, key2: [b]}") + file.close() + + with patch('sys.exit', new=MagicMock()) as sysmock: + sys.argv = ["cmd", "purgelistitem", filename, "key1", "b"] + soyaml.main() + sysmock.assert_called_once_with(0) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n child1:\n - a\n - c\nkey2:\n- b\n" + self.assertEqual(actual, expected) + + def test_purgelistitem_with_remove(self): + filename = "/tmp/so-yaml_test-purgelistitem.yaml" + file = open(filename, "w") + file.write("{key1: { child1: { deep1: [a] }, child2: [b] }, key2: { group1: { items: [x,child1,y] }, group2: { items: [child1] } }}") + file.close() + + soyaml.remove([filename, "key1.child1"]) + soyaml.purgelistitem([filename, "key2", "child1"]) + + file = open(filename, "r") + actual = file.read() + file.close() + + expected = "key1:\n child2:\n - b\nkey2:\n group1:\n items:\n - x\n - y\n group2:\n items: []\n" + self.assertEqual(actual, expected) + + class TestAppendListObject(unittest.TestCase): def test_appendlistobject_missing_arg(self): diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index ba27ca004..89527d051 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -527,6 +527,7 @@ preupgrade_changes() { [[ "$INSTALLEDVERSION" == "3.1.0" ]] && up_to_3.2.0 [[ "$INSTALLEDVERSION" == "3.2.0" ]] && up_to_3.3.0 [[ "$INSTALLEDVERSION" == "3.3.0" ]] && up_to_3.4.0 + [[ "$INSTALLEDVERSION" == "3.4.0" ]] && up_to_3.5.0 true } @@ -1202,6 +1203,25 @@ add_detection_runtime_fields() { } ### 3.4.0 End ### +### 3.5.0 Scripts ### +up_to_3.5.0() { + remove_localrules_portgroup + + INSTALLEDVERSION=3.5.0 +} + +remove_localrules_portgroup() { + local pillar_file + + for pillar_file in /opt/so/saltstack/local/pillar/firewall/{soc,adv}_firewall.sls; do + grep -qs localrules "$pillar_file" || continue + echo "Removing the localrules portgroup from $pillar_file." + so-yaml.py remove "$pillar_file" firewall.portgroups.localrules + so-yaml.py purgelistitem "$pillar_file" firewall.role localrules + done +} +### 3.5.0 End ### + repo_sync() { echo "Sync the local repo." diff --git a/salt/nginx/enabled.sls b/salt/nginx/enabled.sls index f1a71238a..b25199ed9 100644 --- a/salt/nginx/enabled.sls +++ b/salt/nginx/enabled.sls @@ -64,7 +64,6 @@ so-nginx: - /opt/so/conf/navigator/config.json:/opt/socore/html/navigator/assets/config.json:ro - /nsm/repo:/opt/socore/html/repo:ro - /nsm/kernelrepo:/opt/socore/html/kernelrepo:ro - - /nsm/rules:/nsm/rules:ro {% if NGINXMERGED.external_suricata %} - /opt/so/rules/nids/suri:/surirules:ro {% endif %} diff --git a/salt/nginx/etc/nginx.conf b/salt/nginx/etc/nginx.conf index 5f9f9858d..e30b21adc 100644 --- a/salt/nginx/etc/nginx.conf +++ b/salt/nginx/etc/nginx.conf @@ -92,21 +92,6 @@ http { {%- endif %} {%- if GLOBALS.is_manager %} - - server { - listen 7788; - server_name {{ full_server_name }}; - root /nsm/rules; - location / { - allow all; - sendfile on; - sendfile_max_chunk 1m; - autoindex on; - autoindex_exact_size off; - autoindex_format html; - autoindex_localtime on; - } - } {%- if NGINXMERGED.external_suricata %} server { listen 7789 ssl;