From 813c243d3daaf6f46026d21f1bbfe63558a6ec05 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Fri, 26 Jun 2020 13:26:08 -0400
Subject: [PATCH 1/3] Update so-yara-update

---
 salt/common/tools/sbin/so-yara-update | 32 +++++++++++++++++++++------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/salt/common/tools/sbin/so-yara-update b/salt/common/tools/sbin/so-yara-update
index e6b682690..884c13728 100755
--- a/salt/common/tools/sbin/so-yara-update
+++ b/salt/common/tools/sbin/so-yara-update
@@ -1,4 +1,21 @@
 #!/bin/bash
+
+# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+clone_dir="/tmp"
 output_dir="/opt/so/saltstack/default/salt/strelka/rules"
 #mkdir -p $output_dir
 repos="$output_dir/repos.txt"
@@ -19,13 +36,14 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
     [ -d $repo_name ] && rm -rf $repo_name
 
     # Clone repo and make appropriate directories for rules
-    git clone $repo
-    echo "Analyzing rules from $repo_name..."
+
+    git clone $repo $clone_dir/$repo_name
+    echo "Analyzing rules from $clone_dir/$repo_name..."
     mkdir -p $output_dir/$repo_name
-    [ -f $repo_name/LICENSE ] && cp $repo_name/LICENSE $output_dir/$repo_name
+    [ -f $clone_dir/$repo_name/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
 
     # Copy over rules
-    for i in $(find $repo_name -name "*.yar*"); do
+    for i in $(find $clone_dir/$repo_name -name "*.yar*"); do
       rule_name=$(echo $i | awk -F '/' '{print $NF}')
       repo_sum=$(sha256sum $i | awk '{print $1}')
 
@@ -50,17 +68,17 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
         fi
       fi;
     done
-
+    
     # Check to see if we have any old rules that need to be removed
     for i in $(find $output_dir/$repo_name -name "*.yar*" | awk -F '/' '{print $NF}'); do
-      is_repo_rule=$(find $repo_name -name "$i" | wc -l)
+      is_repo_rule=$(find $clone_dir/$repo_name -name "$i" | wc -l)
       if [ $is_repo_rule -eq 0 ]; then
         echo "Could not find $i in source $repo_name repo...removing from $output_dir/$repo_name..."
         rm $output_dir/$repo_name/$i
         ((deletecounter++))
       fi
     done
-    #rm -rf $repo_name
+    rm -rf $clone_dir/$repo_name
   done < $repos
 
   echo "Done!"

From 8c47723bc9f278e7ba907c98b2a387b815a5d8d7 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Fri, 26 Jun 2020 15:45:52 -0400
Subject: [PATCH 2/3] Run YARA update script after applying state

---
 setup/so-setup | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup/so-setup b/setup/so-setup
index bfd3d506c..ff8792e9a 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -257,9 +257,6 @@ if [[ $is_master ]]; then
 	whiptail_enable_components
 	if [[ $STRELKA == 1 ]]; then
 	    whiptail_strelka_rules
-		if [[ $STRELKARULES == 1 ]]; then
-			strelka_yara_update
-		fi
 	fi
 	collect_webuser_inputs
 	get_redirect
@@ -554,6 +551,9 @@ fi
 	if [[ "$STRELKA" = 1 ]]; then
 		set_progress_str 77 "$(print_salt_state_apply 'strelka')"
 		salt-call state.apply -l info strelka >> $setup_log 2>&1
+		if [[ $STRELKARULES == 1 ]]; then
+			/usr/sbin/so-yara-update >> $setup_log 2>&1	
+		fi
 	fi
 
 	if [[ "$PLAYBOOK" = 1 ]]; then

From c421bd464a20e32234b85e2b498e929cea5be2bc Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Fri, 26 Jun 2020 16:42:44 -0400
Subject: [PATCH 3/3] Remove Strelka function (in favor of direct script
 execution in so-setup)

---
 setup/so-functions | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/setup/so-functions b/setup/so-functions
index 0595874ed..37145e12b 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1622,7 +1622,3 @@ es_heapsize() {
 		export NODE_ES_HEAP_SIZE
 	fi
 }
-
-strelka_yara_update() {
-	so-yara-update
-}