Fix indent in main(), re-add trap, remove ERR_HANDLED variable

2025-12-08 02:02:50 +01:00 · 2021-05-12 13:20:59 -04:00
parent 807b525c79
commit 9ced391c11
2 changed files with 309 additions and 226 deletions
--- a/salt/common/tools/sbin/so-common
+++ b/salt/common/tools/sbin/so-common
@@ -334,7 +334,6 @@ run_check_net_err() {
 	exit_code=$?
 	
 	if [[ $exit_code -ne 0 ]]; then
-		ERR_HANDLED=true
 		echo "Command failed with error $exit_code"
 		echo "$err_msg"
 		exit $exit_code
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -26,6 +26,72 @@ SOUP_LOG=/root/soup.log
 INFLUXDB_MIGRATION_LOG=/opt/so/log/influxdb/soup_migration.log
 WHATWOULDYOUSAYYAHDOHERE=soup

+check_err() {
+  local exit_code=$1
+  local lineno=$2
+  local err_msg="Unhandled error occured, please check $SOUP_LOG for details."
+
+  if [[ $exit_code -ne 0 ]]; then
+    printf '%s' "Soup failed on line $lineno with error $exit_code: "
+    case $exit_code in
+      2)
+        echo 'No such file or directory'
+      ;;
+      5)
+        echo 'Interrupted system call'
+      ;;
+      12)
+        echo 'Out of memory'
+      ;;
+      28)
+        echo 'No space left on device'
+        echo 'Likely ran out of space on disk, please review hardware requirements for Security Onion: https://docs.securityonion.net/en/2.3/hardware.html'
+      ;;
+      30)
+        echo 'Read-only file system'
+      ;;
+      35)
+        echo 'Resource temporarily unavailable'
+      ;;
+      64)
+        echo 'Machine is not on the network'
+      ;;
+      67)
+        echo 'Link has been severed'
+      ;;
+      100)
+        echo 'Netowrk is down'
+      ;;
+      101)
+        echo 'Network is unreachable'
+      ;;
+      102)
+        echo 'Network reset'
+      ;;
+      110)
+        echo 'Connection timed out'
+      ;;
+      111)
+        echo 'Connection refused'
+      ;;
+      112)
+        echo 'Host is down'
+      ;;
+      113)
+        echo 'No route to host'
+      ;;
+      *)
+        echo 'Unhandled error'
+        echo "$err_msg"
+      ;;
+    esac
+    if [[ $exit_code -ge 64 && $exit_code -le 113 ]]; then
+      echo "$err_msg"
+    fi
+    exit $exit_code
+  fi
+
+}

 add_common() {
  cp $UPDATE_DIR/salt/common/tools/sbin/so-common $DEFAULT_SALT_DIR/salt/common/tools/sbin/
@@ -48,8 +114,8 @@ airgap_mounted() {
    echo "Example: /home/user/securityonion-2.X.0.iso"
    echo "Example: /dev/sdx1"
    echo ""
-    read -p 'Enter the location of the iso: ' ISOLOC
-    if [ -f $ISOLOC ]; then
+    read -rp 'Enter the location of the iso: ' ISOLOC
+    if [[ -f $ISOLOC ]]; then
      # Mounting the ISO image
      mkdir -p /tmp/soagupdate
      mount -t iso9660 -o loop $ISOLOC /tmp/soagupdate
@@ -61,7 +127,7 @@ airgap_mounted() {
      else
        echo "ISO has been mounted!"
      fi  
-    elif [ -f $ISOLOC/SecurityOnion/VERSION ]; then
+    elif [[ -f $ISOLOC/SecurityOnion/VERSION ]]; then
      ln -s $ISOLOC /tmp/soagupdate
      echo "Found the update content"
    else 
@@ -79,9 +145,9 @@ airgap_mounted() {
 }

 airgap_update_dockers() {
-  if [ $is_airgap -eq 0 ]; then
+  if [[ $is_airgap -eq 0 ]]; then
    # Let's copy the tarball
-    if [ ! -f $AGDOCKER/registry.tar ]; then
+    if [[ ! -f $AGDOCKER/registry.tar ]]; then
      echo "Unable to locate registry. Exiting"
      exit 1
    else
@@ -179,7 +245,9 @@ check_os_updates() {
          echo "Continuing without updating packages"
      elif [[ "$confirm" == [uU] ]]; then
          echo "Applying Grid Updates"
+          set +e
          run_check_net_err "salt '*' -b 5 state.apply patch.os queue=True" 'Could not apply OS updates, please check your network connection.'
+          set -e
      else
          echo "Exiting soup"
          exit 0
@@ -207,7 +275,9 @@ clone_to_tmp() {
  if [ -n "$BRANCH" ]; then
    SOUP_BRANCH="-b $BRANCH"
  fi
+  set +e
  run_check_net_err "git clone $SOUP_BRANCH https://github.com/Security-Onion-Solutions/securityonion.git" "Could not clone repo, please ensure network access to https://github.com"
+  set -e
  cd /tmp
  if [ ! -f $UPDATE_DIR/VERSION ]; then
    echo "Update was unable to pull from github. Please check your internet."
@@ -253,7 +323,11 @@ preupgrade_changes_2.3.50_repo() {
    # We made repo changes in 2.3.50 and this prepares for that on upgrade
    echo "Checking to see if 2.3.50 repo changes are needed."

-    [[ "$INSTALLEDVERSION" == 2.3.30 || "$INSTALLEDVERSION" == 2.3.40 ]] && up_2.3.3X_to_2.3.50_repo
+    if [[ "$INSTALLEDVERSION" == 2.3.30 || "$INSTALLEDVERSION" == 2.3.40 ]]; then
+      up_2.3.3X_to_2.3.50_repo
+    else
+      echo "No changes needed."
+    fi
 }

 preupgrade_changes() {
@@ -433,7 +507,7 @@ up_2.3.2X_to_2.3.30() {
  sed -i "/  imagerepo: securityonion/c\  imagerepo: 'security-onion-solutions'" /opt/so/saltstack/local/pillar/global.sls 

  # Strelka rule repo pillar addition
-  if [ $is_airgap -eq 0 ]; then
+  if [[ $is_airgap -eq 0 ]]; then
      # Add manager as default Strelka YARA rule repo
      sed -i "/^strelka:/a \\  repos: \n    - https://$HOSTNAME/repo/rules/strelka" /opt/so/saltstack/local/pillar/global.sls;
  else
@@ -460,7 +534,7 @@ up_2.3.3X_to_2.3.50_repo() {
        rm -f "/etc/yum.repos.d/$DELREPO.repo"
      fi
    done
-    if [ $is_airgap -eq 1 ]; then
+    if [[ $is_airgap -eq 1 ]]; then
      # Copy the new repo file if not airgap
      cp $UPDATE_DIR/salt/repo/client/files/centos/securityonion.repo /etc/yum.repos.d/
      yum clean all
@@ -613,9 +687,11 @@ upgrade_salt() {
    yum versionlock delete "salt-*"
    echo "Updating Salt packages and restarting services."
    echo ""
+    set +e
    run_check_net_err \
    "sh $UPDATE_DIR/salt/salt/scripts/bootstrap-salt.sh -r -F -M -x python3 stable \"$NEWSALTVERSION\"" \
    "Could not update soup, please check $SOUP_LOG for details."
+    set -e
    echo "Applying yum versionlock for Salt."
    echo ""
    yum versionlock add "salt-*"
@@ -628,9 +704,11 @@ upgrade_salt() {
    apt-mark unhold "salt-minion"
    echo "Updating Salt packages and restarting services."
    echo ""
+    set +e
    run_check_net_err \
    "sh $UPDATE_DIR/salt/salt/scripts/bootstrap-salt.sh -F -M -x python3 stable \"$NEWSALTVERSION\"" \
    "Could not update soup, please check $SOUP_LOG for details."
+    set -e
    echo "Applying apt hold for Salt."
    echo ""
    apt-mark hold "salt-common"
@@ -662,9 +740,12 @@ verify_latest_update_script() {
  fi
 }

-main () {
-echo "### Preparing soup at $(date) ###"
-while getopts ":b" opt; do
+main() {
+  set -e
+  trap 'check_err $? $BASH_LINENO' EXIT
+  
+  echo "### Preparing soup at $(date) ###"
+  while getopts ":b" opt; do
    case "$opt" in
      b ) # process option b
        shift
@@ -678,82 +759,85 @@ while getopts ":b" opt; do
        echo "Usage: cmd [-b]"
      ;;
    esac
-done
+  done

-echo "Checking to see if this is a manager."
-echo ""
-require_manager
-set_minionid
-echo "Checking to see if this is an airgap install"
-echo ""
-check_airgap
-echo "Found that Security Onion $INSTALLEDVERSION is currently installed."
-echo ""
-set_os
-set_palette
-check_elastic_license
-echo ""
-if [ $is_airgap -eq 0 ]; then
+  echo "Checking to see if this is a manager."
+  echo ""
+  require_manager
+  set_minionid
+  echo "Checking to see if this is an airgap install"
+  echo ""
+  check_airgap
+  echo "Found that Security Onion $INSTALLEDVERSION is currently installed."
+  echo ""
+  set_os
+  set_palette
+  check_elastic_license
+  echo ""
+  if [[ $is_airgap -eq 0 ]]; then
    # Let's mount the ISO since this is airgap
    airgap_mounted
-else
+  else
    echo "Cloning Security Onion github repo into $UPDATE_DIR."
    echo "Removing previous upgrade sources."
    rm -rf $UPDATE_DIR
    clone_to_tmp
-fi
-check_os_updates
-echo ""
-echo "Verifying we have the latest soup script."
-verify_latest_update_script
-echo ""
+  fi
+  check_os_updates
+  echo ""
+  echo "Verifying we have the latest soup script."
+  verify_latest_update_script
+  echo ""

-echo "Generating new repo archive"
-generate_and_clean_tarballs
-if [ -f /usr/sbin/so-image-common ]; then
+  echo "Generating new repo archive"
+  generate_and_clean_tarballs
+  if [ -f /usr/sbin/so-image-common ]; then
    . /usr/sbin/so-image-common
-else 
-add_common
-fi
+  else 
+  add_common
+  fi

-echo "Let's see if we need to update Security Onion."
-echo "DEBUG: before upgrade_check"
-upgrade_check
-echo "DEBUG: after upgrade_check"
-upgrade_space
+  echo "Let's see if we need to update Security Onion."
+  echo "DEBUG: before upgrade_check"
+  upgrade_check
+  echo "DEBUG: after upgrade_check"
+  upgrade_space

-echo "Checking for Salt Master and Minion updates."
-upgrade_check_salt
+  echo "Checking for Salt Master and Minion updates."
+  upgrade_check_salt


-if [ "$is_hotfix" == "true" ]; then
+  if [ "$is_hotfix" == "true" ]; then
    echo "Applying $HOTFIXVERSION" 
    copy_new_files
    echo ""
    update_version
    salt-call state.highstate -l info queue=True
-  
-else
+  else
    echo ""
    echo "Performing upgrade from Security Onion $INSTALLEDVERSION to Security Onion $NEWVERSION."
    echo ""

    echo "Updating dockers to $NEWVERSION."
-  if [ $is_airgap -eq 0 ]; then
+    if [[ $is_airgap -eq 0 ]]; then
      airgap_update_dockers
      update_centos_repo
      yum clean all
      check_os_updates
    else
      update_registry
+      set +e
      update_docker_containers "soup"
+      set -e
    fi

    echo ""
    echo "Stopping Salt Minion service."
    systemctl stop salt-minion
    echo "Killing any remaining Salt Minion processes."
+    set +e
    pkill -9 -ef /usr/bin/salt-minion
+    set -e
    echo ""
    echo "Stopping Salt Master service."
    systemctl stop salt-master
@@ -762,7 +846,7 @@ else
    preupgrade_changes_2.3.50_repo

    # Does salt need upgraded. If so update it.
-  if [ "$UPGRADESALT" == "1" ]; then
+    if [[ $UPGRADESALT -eq 1 ]]; then
      echo "Upgrading Salt"
      # Update the repo files so it can actually upgrade
      upgrade_salt
@@ -786,13 +870,13 @@ else
    preupgrade_changes
    echo ""

-  if [ $is_airgap -eq 0 ]; then
+    if [[ $is_airgap -eq 0 ]]; then
      echo "Updating Rule Files to the Latest."
      update_airgap_rules
    fi

    # Only update the repo if its airgap
-  if [[ $is_airgap -eq 0 ]] && [[ "$UPGRADESALT" != "1" ]]; then
+    if [[ $is_airgap -eq 0 ]] && [[ $UPGRADESALT -ne 1 ]]; then
      update_centos_repo
    fi

@@ -853,8 +937,8 @@ else
    unmount_update
    thehive_maint

-  if [ "$UPGRADESALT" == "1" ]; then
-    if [ $is_airgap -eq 0 ]; then
+    if [[ $UPGRADESALT -eq 1 ]]; then
+      if [[ $is_airgap -eq 0 ]]; then
        echo ""
        echo "Cleaning repos on remote Security Onion nodes."
        salt -C 'not *_eval and not *_helixsensor and not *_manager and not *_managersearch and not *_standalone and G@os:CentOS' cmd.run "yum clean all"
@@ -882,7 +966,7 @@ else

    NUM_MINIONS=$(ls /opt/so/saltstack/local/pillar/minions/*_*.sls | wc -l)

-  if [ $NUM_MINIONS -gt 1 ]; then
+    if [[ $NUM_MINIONS -gt 1 ]]; then

      cat << EOF
    
@@ -899,9 +983,9 @@ For more information, please see https://docs.securityonion.net/en/2.3/soup.html
 EOF

    fi
-fi
+  fi

-echo "### soup has been served at $(date) ###"
+  echo "### soup has been served at $(date) ###"
 }

 cat << EOF