From 2e277bf4879f1ee384c0d313ba1dba30f7a2dcf9 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 26 Jul 2021 10:08:59 -0400
Subject: [PATCH 1/3] change container to abesent of pcap is disabled

---
 salt/pcap/init.sls  | 7 +++++--
 salt/pcap/map.jinja | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls
index 6679215e4..a64b9d90a 100644
--- a/salt/pcap/init.sls
+++ b/salt/pcap/init.sls
@@ -111,6 +111,7 @@ stenolog:
 
 so-steno:
   docker_container.{{ STENOOPTIONS.status }}:
+  {% if STENOOPTIONS.status == 'running' %}
     - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-steno:{{ VERSION }}
     - start: {{ STENOOPTIONS.start }}
     - network_mode: host
@@ -126,6 +127,9 @@ so-steno:
       - /opt/so/log/stenographer:/var/log/stenographer:rw
     - watch:
       - file: /opt/so/conf/steno/config
+  {% else %} {# if stenographer isn't enabled, then stop and remove the container #}
+    - force: True
+  {% endif %}
 
 append_so-steno_so-status.conf:
   file.append:
@@ -133,7 +137,6 @@ append_so-steno_so-status.conf:
     - text: so-steno
     - unless: grep -q so-steno /opt/so/conf/so-status/so-status.conf
 
-
   {% if not STENOOPTIONS.start %}
 so-steno_so-status.disabled:
   file.comment:
@@ -152,4 +155,4 @@ delete_so-steno_so-status.disabled:
   test.fail_without_changes:
     - name: {{sls}}_state_not_allowed
 
-{% endif %}
\ No newline at end of file
+{% endif %}
diff --git a/salt/pcap/map.jinja b/salt/pcap/map.jinja
index b3c746bcc..ad23f763b 100644
--- a/salt/pcap/map.jinja
+++ b/salt/pcap/map.jinja
@@ -9,7 +9,7 @@
 {% endif %}
 
 {% if ENABLED is sameas false %}
-  {% do STENOOPTIONS.update({'status': 'stopped'}) %}
+  {% do STENOOPTIONS.update({'status': 'absent'}) %}
 {% else %}
   {% do STENOOPTIONS.update({'status': 'running'}) %}
-{% endif %}
\ No newline at end of file
+{% endif %}

From 7aa5e857edb896d994df809728382f1841104f77 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 26 Jul 2021 10:46:52 -0400
Subject: [PATCH 2/3] update hotfix file

---
 HOTFIX | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/HOTFIX b/HOTFIX
index d3f5a12fa..b1fe67394 100644
--- a/HOTFIX
+++ b/HOTFIX
@@ -1 +1 @@
-
+STENODOCKER

From 26741bdb53da194ae9264f889133f1fee4390c4a Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 26 Jul 2021 10:55:30 -0400
Subject: [PATCH 3/3] Add wss: to CSP for browsers that enforce wss distinctly
 from other protocols

---
 salt/nginx/etc/nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/nginx/etc/nginx.conf b/salt/nginx/etc/nginx.conf
index 4fa5c8435..7ee97b16f 100644
--- a/salt/nginx/etc/nginx.conf
+++ b/salt/nginx/etc/nginx.conf
@@ -149,7 +149,7 @@ http {
 		root         /opt/socore/html;
 		index        index.html;
 
-		add_header 	Content-Security-Policy     "default-src 'self' 'unsafe-inline' 'unsafe-eval' https: data: blob:; frame-ancestors 'self'";
+		add_header 	Content-Security-Policy     "default-src 'self' 'unsafe-inline' 'unsafe-eval' https: data: blob: wss:; frame-ancestors 'self'";
 		add_header 	X-Frame-Options             SAMEORIGIN;
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;