CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 18:52:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactored so-common node type checks for improved readability; Updated so-tcpreplay to support distributed grids

Browse Source
This commit is contained in:
Jason Ertel
2021-01-13 12:42:41 -05:00
parent 59b016695f
commit ea1ab75072
3 changed files with 47 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
salt/common/tools/sbin/so-common
View File

@@ -111,9 +111,7 @@ set_version() {
}
require_manager() {
# Check to see if this is a manager
MANAGERCHECK=$(cat /etc/salt/grains | grep role | awk '{print $2}')
if [ $MANAGERCHECK == 'so-eval' ] || [ $MANAGERCHECK == 'so-manager' ] || [ $MANAGERCHECK == 'so-managersearch' ] || [ $MANAGERCHECK == 'so-standalone' ] || [ $MANAGERCHECK == 'so-helix' ] || [ $MANAGERCHECK == 'so-import' ]; then
if is_manager; then
echo "This is a manager, We can proceed."
else
echo "Please run this command on the manager; the manager controls the grid."
@@ -121,12 +119,32 @@ require_manager() {
fi
}
is_manager() {
# Check to see if this is a manager node
role=$(lookup_role)
is_single_node_grid && return 0
[ $role == 'manager' ] && return 0
[ $role == 'managersearch' ] && return 0
[ $role == 'helix' ] && return 0
return 1
}
is_sensor() {
# Check to see if this is a sensor (forward) node
role=$(lookup_role)
is_single_node_grid && return 0
[ $role == 'sensor' ] && return 0
[ $role == 'heavynode' ] && return 0
[ $role == 'helix' ] && return 0
return 1
}
is_single_node_grid() {
role=$(lookup_role)
if [ "$role" != "eval" ] && [ "$role" != "standalone" ] && [ "$role" != "import" ]; then
return 1
fi
return 0
[ $role == 'eval' ] && return 0
[ $role == 'standalone' ] && return 0
[ $role == 'import' ] && return 0
return 1
}
fail() {

28
salt/common/tools/sbin/so-tcpreplay
View File

@@ -47,13 +47,27 @@ if ! docker ps | grep -q so-tcpreplay; then
echo "Replay functionality not enabled; attempting to enable now (may require Internet access)..."
echo
TRUSTED_CONTAINERS=("so-tcpreplay")
mkdir -p /opt/so/log/tcpreplay
update_docker_containers "tcpreplay" "" "" "/opt/so/log/tcpreplay/init.log"
so-tcpreplay-start || fail "Unable to initialize tcpreplay"
if is_manager; then
TRUSTED_CONTAINERS=("so-tcpreplay")
mkdir -p /opt/so/log/tcpreplay
update_docker_containers "tcpreplay" "" "" "/opt/so/log/tcpreplay/init.log"
elif is_sensor; then
if ! is_manager; then
echo "Attempting to start replay container. If this fails then you may need to run this command on the manager first."
fi
so-tcpreplay-start || fail "Unable to initialize tcpreplay"
else
echo "Unable to enable replay functionality on this node type."
fi
fi
echo "Replaying PCAP(s) at ${REPLAYSPEED} Mbps on interface ${REPLAYIFACE}..."
docker exec so-tcpreplay /usr/bin/bash -c "/usr/local/bin/tcpreplay -i ${REPLAYIFACE} -M${REPLAYSPEED} $@"
if is_sensor; then
echo "Replaying PCAP(s) at ${REPLAYSPEED} Mbps on interface ${REPLAYIFACE}..."
docker exec so-tcpreplay /usr/bin/bash -c "/usr/local/bin/tcpreplay -i ${REPLAYIFACE} -M${REPLAYSPEED} $@"
echo "Replay completed. Warnings shown above are typically expected."
echo "Replay completed. Warnings shown above are typically expected."
elif is_manager; then
echo "The sensor nodes in this grid can now replay traffic."
else
echo "Unable to replay traffic since this node is not a sensor node."
fi

2
setup/so-setup
View File

@@ -852,7 +852,7 @@ if [[ -n $SO_ERROR ]]; then
else
echo "Successfully completed setup! Continuing with post-installation steps" >> $setup_log 2>&1
{
[[ -n "$TESTING" && $is_sensor ]] && logCmd so-test
[[ -n "$TESTING" ]] && logCmd so-test
export percentage=95 # set to last percentage used in previous subshell
if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then