mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-09 18:52:52 +01:00
Refactored so-common node type checks for improved readability; Updated so-tcpreplay to support distributed grids
This commit is contained in:
@@ -111,9 +111,7 @@ set_version() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
require_manager() {
|
require_manager() {
|
||||||
# Check to see if this is a manager
|
if is_manager; then
|
||||||
MANAGERCHECK=$(cat /etc/salt/grains | grep role | awk '{print $2}')
|
|
||||||
if [ $MANAGERCHECK == 'so-eval' ] || [ $MANAGERCHECK == 'so-manager' ] || [ $MANAGERCHECK == 'so-managersearch' ] || [ $MANAGERCHECK == 'so-standalone' ] || [ $MANAGERCHECK == 'so-helix' ] || [ $MANAGERCHECK == 'so-import' ]; then
|
|
||||||
echo "This is a manager, We can proceed."
|
echo "This is a manager, We can proceed."
|
||||||
else
|
else
|
||||||
echo "Please run this command on the manager; the manager controls the grid."
|
echo "Please run this command on the manager; the manager controls the grid."
|
||||||
@@ -121,12 +119,32 @@ require_manager() {
|
|||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
|
is_manager() {
|
||||||
|
# Check to see if this is a manager node
|
||||||
|
role=$(lookup_role)
|
||||||
|
is_single_node_grid && return 0
|
||||||
|
[ $role == 'manager' ] && return 0
|
||||||
|
[ $role == 'managersearch' ] && return 0
|
||||||
|
[ $role == 'helix' ] && return 0
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
is_sensor() {
|
||||||
|
# Check to see if this is a sensor (forward) node
|
||||||
|
role=$(lookup_role)
|
||||||
|
is_single_node_grid && return 0
|
||||||
|
[ $role == 'sensor' ] && return 0
|
||||||
|
[ $role == 'heavynode' ] && return 0
|
||||||
|
[ $role == 'helix' ] && return 0
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
is_single_node_grid() {
|
is_single_node_grid() {
|
||||||
role=$(lookup_role)
|
role=$(lookup_role)
|
||||||
if [ "$role" != "eval" ] && [ "$role" != "standalone" ] && [ "$role" != "import" ]; then
|
[ $role == 'eval' ] && return 0
|
||||||
return 1
|
[ $role == 'standalone' ] && return 0
|
||||||
fi
|
[ $role == 'import' ] && return 0
|
||||||
return 0
|
return 1
|
||||||
}
|
}
|
||||||
|
|
||||||
fail() {
|
fail() {
|
||||||
|
|||||||
@@ -47,13 +47,27 @@ if ! docker ps | grep -q so-tcpreplay; then
|
|||||||
echo "Replay functionality not enabled; attempting to enable now (may require Internet access)..."
|
echo "Replay functionality not enabled; attempting to enable now (may require Internet access)..."
|
||||||
echo
|
echo
|
||||||
|
|
||||||
TRUSTED_CONTAINERS=("so-tcpreplay")
|
if is_manager; then
|
||||||
mkdir -p /opt/so/log/tcpreplay
|
TRUSTED_CONTAINERS=("so-tcpreplay")
|
||||||
update_docker_containers "tcpreplay" "" "" "/opt/so/log/tcpreplay/init.log"
|
mkdir -p /opt/so/log/tcpreplay
|
||||||
so-tcpreplay-start || fail "Unable to initialize tcpreplay"
|
update_docker_containers "tcpreplay" "" "" "/opt/so/log/tcpreplay/init.log"
|
||||||
|
elif is_sensor; then
|
||||||
|
if ! is_manager; then
|
||||||
|
echo "Attempting to start replay container. If this fails then you may need to run this command on the manager first."
|
||||||
|
fi
|
||||||
|
so-tcpreplay-start || fail "Unable to initialize tcpreplay"
|
||||||
|
else
|
||||||
|
echo "Unable to enable replay functionality on this node type."
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo "Replaying PCAP(s) at ${REPLAYSPEED} Mbps on interface ${REPLAYIFACE}..."
|
if is_sensor; then
|
||||||
docker exec so-tcpreplay /usr/bin/bash -c "/usr/local/bin/tcpreplay -i ${REPLAYIFACE} -M${REPLAYSPEED} $@"
|
echo "Replaying PCAP(s) at ${REPLAYSPEED} Mbps on interface ${REPLAYIFACE}..."
|
||||||
|
docker exec so-tcpreplay /usr/bin/bash -c "/usr/local/bin/tcpreplay -i ${REPLAYIFACE} -M${REPLAYSPEED} $@"
|
||||||
|
|
||||||
echo "Replay completed. Warnings shown above are typically expected."
|
echo "Replay completed. Warnings shown above are typically expected."
|
||||||
|
elif is_manager; then
|
||||||
|
echo "The sensor nodes in this grid can now replay traffic."
|
||||||
|
else
|
||||||
|
echo "Unable to replay traffic since this node is not a sensor node."
|
||||||
|
fi
|
||||||
|
|||||||
@@ -852,7 +852,7 @@ if [[ -n $SO_ERROR ]]; then
|
|||||||
else
|
else
|
||||||
echo "Successfully completed setup! Continuing with post-installation steps" >> $setup_log 2>&1
|
echo "Successfully completed setup! Continuing with post-installation steps" >> $setup_log 2>&1
|
||||||
{
|
{
|
||||||
[[ -n "$TESTING" && $is_sensor ]] && logCmd so-test
|
[[ -n "$TESTING" ]] && logCmd so-test
|
||||||
|
|
||||||
export percentage=95 # set to last percentage used in previous subshell
|
export percentage=95 # set to last percentage used in previous subshell
|
||||||
if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then
|
if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then
|
||||||
|
|||||||
Reference in New Issue
Block a user