mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Steno BPF - cleanup & simplify
This commit is contained in:
@@ -14,6 +14,10 @@
|
|||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
|
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
|
||||||
{% set MASTER = salt['grains.get']('master') %}
|
{% set MASTER = salt['grains.get']('master') %}
|
||||||
|
{% set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
|
||||||
|
{% set bpf_steno = salt['pillar.get']('steno:bpf', None) %}
|
||||||
|
{% set bpf_compiled = "" %}
|
||||||
|
|
||||||
# PCAP Section
|
# PCAP Section
|
||||||
|
|
||||||
# Create the logstash group
|
# Create the logstash group
|
||||||
@@ -36,31 +40,18 @@ stenoconfdir:
|
|||||||
- group: 939
|
- group: 939
|
||||||
- makedirs: True
|
- makedirs: True
|
||||||
|
|
||||||
{% set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
|
# BPF compilation and configuration
|
||||||
{% set bpf_global = salt['pillar.get']('static:steno:bpf', None) %}
|
{% if bpf_steno %}
|
||||||
{% set bpf_steno = salt['pillar.get']('steno:bpf', None) %}
|
{% set bpf_calc = salt['cmd.script']('salt://pcap/files/compile_bpf.sh', interface + ' ' + bpf_steno) %}
|
||||||
|
|
||||||
{% if bpf_steno != None or bpf_global != None %}
|
|
||||||
{% if bpf_steno != None %}
|
|
||||||
{% set bpf_calc = salt['cmd.script']('salt://pcap/files/compile_bpf.sh', interface + ' ' + bpf_steno) %}
|
|
||||||
{% else %}
|
|
||||||
{% set bpf_calc = salt['cmd.script']('salt://pcap/files/compile_bpf.sh', interface + ' ' + bpf_global) %}
|
|
||||||
{% endif %}
|
|
||||||
{% if bpf_calc['stderr'] == "" %}
|
{% if bpf_calc['stderr'] == "" %}
|
||||||
{% set bpf_compiled = bpf_calc['stdout'] %}
|
{% set bpf_compiled = ",\\\"--filter=" + bpf_calc['stdout'] + "\\\"" %}
|
||||||
{% else %}
|
{% else %}
|
||||||
{% set bpf_compiled = None %}
|
|
||||||
|
|
||||||
bpfcompilationfailure:
|
bpfcompilationfailure:
|
||||||
test.configurable_test_state:
|
test.configurable_test_state:
|
||||||
- name: bpfcompfailure
|
|
||||||
- changes: False
|
- changes: False
|
||||||
- result: False
|
- result: False
|
||||||
- comment: "BPF Compilation Failed - Discarding specified BPF"
|
- comment: "BPF Compilation Failed - Discarding Specified BPF"
|
||||||
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% else %}
|
|
||||||
{% set bpf_compiled = None %}
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
stenoconf:
|
stenoconf:
|
||||||
@@ -72,11 +63,7 @@ stenoconf:
|
|||||||
- mode: 644
|
- mode: 644
|
||||||
- template: jinja
|
- template: jinja
|
||||||
- defaults:
|
- defaults:
|
||||||
bpf_compiled: ""
|
bpf_compiled: "{{ bpf_compiled }}"
|
||||||
{% if bpf_compiled != None %}
|
|
||||||
- context:
|
|
||||||
bpf_compiled: ',"--filter={{ bpf_compiled }}"'
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
sensoroniagentconf:
|
sensoroniagentconf:
|
||||||
file.managed:
|
file.managed:
|
||||||
|
|||||||
Reference in New Issue
Block a user