Merge pull request #897 from Security-Onion-Solutions/fix/strelka_rules

Fix/strelka rules

salt/common/tools/sbin/so-yara-update

@@ -1,4 +1,21 @@
 #!/bin/bash
+
+# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+clone_dir="/tmp"
 output_dir="/opt/so/saltstack/default/salt/strelka/rules"
 #mkdir -p $output_dir
 repos="$output_dir/repos.txt"
@@ -19,13 +36,14 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
     [ -d $repo_name ] && rm -rf $repo_name
 
     # Clone repo and make appropriate directories for rules
-    git clone $repo
+
-    echo "Analyzing rules from $repo_name..."
+    git clone $repo $clone_dir/$repo_name
+    echo "Analyzing rules from $clone_dir/$repo_name..."
     mkdir -p $output_dir/$repo_name
-    [ -f $repo_name/LICENSE ] && cp $repo_name/LICENSE $output_dir/$repo_name
+    [ -f $clone_dir/$repo_name/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
 
     # Copy over rules
-    for i in $(find $repo_name -name "*.yar*"); do
+    for i in $(find $clone_dir/$repo_name -name "*.yar*"); do
       rule_name=$(echo $i | awk -F '/' '{print $NF}')
       repo_sum=$(sha256sum $i | awk '{print $1}')
 
@@ -53,14 +71,14 @@ if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
     
     # Check to see if we have any old rules that need to be removed
     for i in $(find $output_dir/$repo_name -name "*.yar*" | awk -F '/' '{print $NF}'); do
-      is_repo_rule=$(find $repo_name -name "$i" | wc -l)
+      is_repo_rule=$(find $clone_dir/$repo_name -name "$i" | wc -l)
       if [ $is_repo_rule -eq 0 ]; then
         echo "Could not find $i in source $repo_name repo...removing from $output_dir/$repo_name..."
         rm $output_dir/$repo_name/$i
         ((deletecounter++))
       fi
     done
-    #rm -rf $repo_name
+    rm -rf $clone_dir/$repo_name
   done < $repos
 
   echo "Done!"

setup/so-functions

@@ -1620,7 +1620,3 @@ es_heapsize() {
 		export NODE_ES_HEAP_SIZE
 	fi
 }
-
-strelka_yara_update() {
-	so-yara-update
-}

setup/so-setup

@@ -257,9 +257,6 @@ if [[ $is_master ]]; then
 	whiptail_enable_components
 	if [[ $STRELKA == 1 ]]; then
 	    whiptail_strelka_rules
-		if [[ $STRELKARULES == 1 ]]; then
-			strelka_yara_update
-		fi
 	fi
 	collect_webuser_inputs
 	get_redirect
@@ -554,6 +551,9 @@ fi
 	if [[ "$STRELKA" = 1 ]]; then
 		set_progress_str 77 "$(print_salt_state_apply 'strelka')"
 		salt-call state.apply -l info strelka >> $setup_log 2>&1
+		if [[ $STRELKARULES == 1 ]]; then
+			/usr/sbin/so-yara-update >> $setup_log 2>&1	
+		fi
 	fi
 
 	if [[ "$PLAYBOOK" = 1 ]]; then