Merge pull request #265 from Security-Onion-Solutions/feature/bpf-steno

Steno bpf - final tweaks

salt/pcap/files/compile_bpf.sh

@@ -1,37 +0,0 @@
-#!/bin/bash
-
-# Copyright 2014 Google Inc. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-if [ "$#" -lt 2 ]; then
-  cat 1>&2 <<EOF
-$0 compiles a BPF expression to be passed to stenotype to apply a socket filter.
-Its first argument is the interface (link type is required) and all other arguments
-are passed to TCPDump.
-
-Examples:
- $0 eth0 dst port 80
- $0 eth0 udp port 53
-EOF
-  exit 1
-fi
-
-interface="$1"
-shift
-sudo tcpdump -i $interface -ddd $@ | tail -n+2 |
-while read line; do
-  cols=( $line )
-  printf "%04x%02x%02x%08x" ${cols[0]} ${cols[1]} ${cols[2]} ${cols[3]}
-done
-echo ""

salt/pcap/files/config

@@ -11,6 +11,6 @@
   , "Interface": "{{ interface }}"
   , "Port": 1234
   , "Host": "127.0.0.1"
-  , "Flags": ["-v", "--uid=stenographer", "--gid=stenographer"{{ bpf_compiled }}]
+  , "Flags": ["-v", "--uid=stenographer", "--gid=stenographer"{{ BPF_COMPILED }}]
   , "CertPath": "/etc/stenographer/certs"
 }

salt/pcap/init.sls

@@ -14,9 +14,9 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
 {% set MASTER = salt['grains.get']('master') %}
-{% set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
+{% set INTERFACE = salt['pillar.get']('sensor:interface', 'bond0') %}
-{% set bpf_steno = salt['pillar.get']('steno:bpf', None) %}
+{% set BPF_STENO = salt['pillar.get']('steno:bpf', None) %}
-{% set bpf_compiled = "" %}
+{% set BPF_COMPILED = "" %}
 
 # PCAP Section
 
@@ -40,12 +40,12 @@ stenoconfdir:
     - group: 939
     - makedirs: True
 
-# BPF compilation and configuration
+{% if BPF_STENO %}
-{% if bpf_steno %}
+   {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_STENO|join(" ")  ) %}
-   {% set bpf_calc = salt['cmd.script']('salt://pcap/files/compile_bpf.sh', interface + ' ' + bpf_steno) %}
+   {% if BPF_CALC['stderr'] == "" %}
-   {% if bpf_calc['stderr'] == "" %}
+      {% set BPF_COMPILED =  ",\\\"--filter=" + BPF_CALC['stdout'] + "\\\""  %}
-      {% set bpf_compiled =  ",\\\"--filter=" + bpf_calc['stdout'] + "\\\""  %}
    {% else  %}
+
 bpfcompilationfailure:
   test.configurable_test_state:
    - changes: False
@@ -63,7 +63,7 @@ stenoconf:
     - mode: 644
     - template: jinja
     - defaults:
-        bpf_compiled: "{{ bpf_compiled }}"
+        BPF_COMPILED: "{{ BPF_COMPILED }}"
 
 sensoroniagentconf:
   file.managed: