CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-03-23 21:12:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15608 from Security-Onion-Solutions/moresoup

Browse Source 
Improve soup version checks and migrate pcap to suricata
This commit is contained in:
Mike Reeves
2026-03-13 14:59:57 -04:00
committed by GitHub
parent e55ac7062c 18f971954b
commit d1156ee3fd
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
salt/manager/tools/sbin/soup
View File

@@ -362,7 +362,7 @@ preupgrade_changes() {
# This function is to add any new pillar items if needed.
echo "Checking to see if changes are needed."
[[ "$INSTALLEDVERSION" == 2.4.210 ]] && up_to_3.0.0
[[ "$INSTALLEDVERSION" =~ ^2\.4\.21[0-9]+$ ]] && up_to_3.0.0
true
}
@@ -370,12 +370,12 @@ postupgrade_changes() {
# This function is to add any new pillar items if needed.
echo "Running post upgrade processes."
[[ "$POSTVERSION" == 2.4.210 ]] && post_to_3.0.0
[[ "$POSTVERSION" =~ ^2\.4\.21[0-9]+$ ]] && post_to_3.0.0
true
}
check_minimum_version() {
if [[ "$INSTALLEDVERSION" != "2.4.210" ]] && [[ "$INSTALLEDVERSION" != "2.4.211" ]] && [[ ! "$INSTALLEDVERSION" =~ ^3\. ]]; then
if [[ ! "$INSTALLEDVERSION" =~ ^(2\.4\.21[0-9]+|3\.) ]]; then
echo "You must be on at least Security Onion 2.4.210 to upgrade. Currently installed version: $INSTALLEDVERSION"
exit 1
fi
@@ -385,10 +385,23 @@ check_minimum_version() {
up_to_3.0.0() {
determine_elastic_agent_upgrade
migrate_pcap_to_suricata
INSTALLEDVERSION=3.0.0
}
migrate_pcap_to_suricata() {
local MINIONDIR=/opt/so/saltstack/local/pillar/minions
local PCAPFILE=/opt/so/saltstack/local/pillar/pcap/soc_pcap.sls
for pillar_file in "$PCAPFILE" "$MINIONDIR"/*.sls; do
[[ -f "$pillar_file" ]] || continue
pcap_enabled=$(so-yaml.py get "$pillar_file" pcap.enabled 2>/dev/null) || continue
so-yaml.py add "$pillar_file" suricata.pcap.enabled "$pcap_enabled"
so-yaml.py remove "$pillar_file" pcap
done
}
post_to_3.0.0() {
echo "Nothing to apply"
POSTVERSION=3.0.0