From 51e8839daf621ec8612760a0959f8bb3921fc86e Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Thu, 25 Feb 2021 11:46:00 -0500 Subject: [PATCH] Inverse NIC offload --- salt/common/tools/sbin/so-common | 189 ++++++++++-------- .../99-so-checksum-offload-disable | 24 ++- 2 files changed, 123 insertions(+), 90 deletions(-) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 3cf1f5e88..a706831fa 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -86,10 +86,82 @@ add_interface_bond0() { fi } +check_container() { + docker ps | grep "$1:" > /dev/null 2>&1 + return $? +} + +check_password() { + local password=$1 + echo "$password" | egrep -v "'|\"|\\$|\\\\" > /dev/null 2>&1 + return $? +} + +fail() { + msg=$1 + echo "ERROR: $msg" + echo "Exiting." + exit 1 +} + +get_random_value() { + length=${1:-20} + head -c 5000 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 +} + header() { printf '%s\n' "" "$banner" " $*" "$banner" } +init_monitor() { + MONITORNIC=$1 + + if [[ $MONITORNIC == "bond0" ]]; then + BIFACES=$(lookup_bond_interfaces) + else + BIFACES=$MONITORNIC + fi + + for DEVICE_IFACE in $BIFACES; do + for i in rx tx sg tso ufo gso gro lro; do + ethtool -K "$DEVICE_IFACE" "$i" off; + done + ip link set dev "$DEVICE_IFACE" arp off multicast off allmulticast off promisc on + done +} + +is_manager_node() { + # Check to see if this is a manager node + role=$(lookup_role) + is_single_node_grid && return 0 + [ $role == 'manager' ] && return 0 + [ $role == 'managersearch' ] && return 0 + [ $role == 'helix' ] && return 0 + return 1 +} + +is_sensor_node() { + # Check to see if this is a sensor (forward) node + role=$(lookup_role) + is_single_node_grid && return 0 + [ $role == 'sensor' ] && return 0 + [ $role == 'heavynode' ] && return 0 + [ $role == 'helix' ] && return 0 + return 1 +} + +is_single_node_grid() { + role=$(lookup_role) + [ $role == 'eval' ] && return 0 + [ $role == 'standalone' ] && return 0 + [ $role == 'import' ] && return 0 + return 1 +} + +lookup_bond_interfaces() { + cat /proc/net/bonding/bond0 | grep "Slave Interface:" | sed -e "s/Slave Interface: //g" +} + lookup_salt_value() { key=$1 group=$2 @@ -129,15 +201,41 @@ lookup_role() { echo ${pieces[1]} } -check_container() { - docker ps | grep "$1:" > /dev/null 2>&1 - return $? +require_manager() { + if is_manager_node; then + echo "This is a manager, We can proceed." + else + echo "Please run this command on the manager; the manager controls the grid." + exit 1 + fi } -check_password() { - local password=$1 - echo "$password" | egrep -v "'|\"|\\$|\\\\" > /dev/null 2>&1 - return $? +retry() { + maxAttempts=$1 + sleepDelay=$2 + cmd=$3 + expectedOutput=$4 + attempt=0 + while [[ $attempt -lt $maxAttempts ]]; do + attempt=$((attempt+1)) + echo "Executing command with retry support: $cmd" + output=$(eval "$cmd") + exitcode=$? + echo "Results: $output ($exitcode)" + if [ -n "$expectedOutput" ]; then + if [[ "$output" =~ "$expectedOutput" ]]; then + return $exitCode + else + echo "Expected '$expectedOutput' but got '$output'" + fi + elif [[ $exitcode -eq 0 ]]; then + return $exitCode + fi + echo "Command failed with exit code $exitcode; will retry in $sleepDelay seconds ($attempt / $maxAttempts)..." + sleep $sleepDelay + done + echo "Command continues to fail; giving up." + return 1 } set_os() { @@ -171,83 +269,6 @@ set_version() { fi } -require_manager() { - if is_manager_node; then - echo "This is a manager, We can proceed." - else - echo "Please run this command on the manager; the manager controls the grid." - exit 1 - fi -} - -is_manager_node() { - # Check to see if this is a manager node - role=$(lookup_role) - is_single_node_grid && return 0 - [ $role == 'manager' ] && return 0 - [ $role == 'managersearch' ] && return 0 - [ $role == 'helix' ] && return 0 - return 1 -} - -is_sensor_node() { - # Check to see if this is a sensor (forward) node - role=$(lookup_role) - is_single_node_grid && return 0 - [ $role == 'sensor' ] && return 0 - [ $role == 'heavynode' ] && return 0 - [ $role == 'helix' ] && return 0 - return 1 -} - -is_single_node_grid() { - role=$(lookup_role) - [ $role == 'eval' ] && return 0 - [ $role == 'standalone' ] && return 0 - [ $role == 'import' ] && return 0 - return 1 -} - -fail() { - msg=$1 - echo "ERROR: $msg" - echo "Exiting." - exit 1 -} - -get_random_value() { - length=${1:-20} - head -c 5000 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 -} - -retry() { - maxAttempts=$1 - sleepDelay=$2 - cmd=$3 - expectedOutput=$4 - attempt=0 - while [[ $attempt -lt $maxAttempts ]]; do - attempt=$((attempt+1)) - echo "Executing command with retry support: $cmd" - output=$(eval "$cmd") - exitcode=$? - echo "Results: $output ($exitcode)" - if [ -n "$expectedOutput" ]; then - if [[ "$output" =~ "$expectedOutput" ]]; then - return $exitCode - else - echo "Expected '$expectedOutput' but got '$output'" - fi - elif [[ $exitcode -eq 0 ]]; then - return $exitCode - fi - echo "Command failed with exit code $exitcode; will retry in $sleepDelay seconds ($attempt / $maxAttempts)..." - sleep $sleepDelay - done - echo "Command continues to fail; giving up." - return 1 -} - valid_cidr() { # Verify there is a backslash in the string echo "$1" | grep -qP "^[^/]+/[^/]+$" || return 1 diff --git a/setup/install_scripts/99-so-checksum-offload-disable b/setup/install_scripts/99-so-checksum-offload-disable index e12049301..63f9c0a4c 100755 --- a/setup/install_scripts/99-so-checksum-offload-disable +++ b/setup/install_scripts/99-so-checksum-offload-disable @@ -1,8 +1,20 @@ #!/bin/bash +# +# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . -if [[ "$DEVICE_IFACE" != "$MNIC" && "$DEVICE_IFACE" != *"docker"* && "$DEVICE_IFACE" != *"tun"* && "DEVICE_IFACE" != *"wg"* ]]; then - for i in rx tx sg tso ufo gso gro lro; do - ethtool -K "$DEVICE_IFACE" "$i" off; - done - ip link set dev "$DEVICE_IFACE" arp off multicast off allmulticast off promisc on -fi +. /usr/sbin/so-common + +init_monitor $MNIC