From fb7ebcac7ef718f9bee6898ffdfcbaf7071fdc77 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 8 Feb 2023 09:18:05 -0500
Subject: [PATCH] 2.4 fw changes

---
 salt/firewall/hostgroups/anywhere  |  1 +
 salt/firewall/hostgroups/dockernet |  2 ++
 salt/firewall/hostgroups/localhost |  1 +
 salt/firewall/hostgroups/self      |  2 ++
 salt/firewall/map.jinja            | 32 ++++++++----------------------
 5 files changed, 14 insertions(+), 24 deletions(-)
 create mode 100644 salt/firewall/hostgroups/anywhere
 create mode 100644 salt/firewall/hostgroups/dockernet
 create mode 100644 salt/firewall/hostgroups/localhost
 create mode 100644 salt/firewall/hostgroups/self

diff --git a/salt/firewall/hostgroups/anywhere b/salt/firewall/hostgroups/anywhere
new file mode 100644
index 000000000..b04387011
--- /dev/null
+++ b/salt/firewall/hostgroups/anywhere
@@ -0,0 +1 @@
+0.0.0.0/0
diff --git a/salt/firewall/hostgroups/dockernet b/salt/firewall/hostgroups/dockernet
new file mode 100644
index 000000000..ccbd6e89c
--- /dev/null
+++ b/salt/firewall/hostgroups/dockernet
@@ -0,0 +1,2 @@
+{% from 'docker/docker.map.jinja' import DOCKER -%}
+{{ DOCKER.sorange }}
diff --git a/salt/firewall/hostgroups/localhost b/salt/firewall/hostgroups/localhost
new file mode 100644
index 000000000..7b9ad531d
--- /dev/null
+++ b/salt/firewall/hostgroups/localhost
@@ -0,0 +1 @@
+127.0.0.1
diff --git a/salt/firewall/hostgroups/self b/salt/firewall/hostgroups/self
new file mode 100644
index 000000000..488f25de4
--- /dev/null
+++ b/salt/firewall/hostgroups/self
@@ -0,0 +1,2 @@
+{% from 'vars/globals.map.jinja' import GLOBALS -%}
+{{ GLOBALS.node_ip }}
diff --git a/salt/firewall/map.jinja b/salt/firewall/map.jinja
index 2fa295447..191155fbd 100644
--- a/salt/firewall/map.jinja
+++ b/salt/firewall/map.jinja
@@ -3,7 +3,7 @@
 
 {% import_yaml 'firewall/ports/ports.yaml' as default_portgroups %}
 {% set default_portgroups = default_portgroups.firewall.ports %}
-{% import_yaml 'firewall/portgroups.local.yaml' as local_portgroups %}
+{% import_yaml 'firewall/ports/ports.local.yaml' as local_portgroups %}
 {% if local_portgroups.firewall.ports %}
   {% set local_portgroups = local_portgroups.firewall.ports %}
 {% else %}
@@ -15,30 +15,14 @@
 {% import_yaml 'firewall/hostgroups.yaml' as default_hostgroups %}
 {#% import_yaml 'firewall/hostgroups.local.yaml' as local_hostgroups %#}
 {% set local_hostgroups = {'firewall': {'hostgroups': {}}} %}
-{% set hostgroup_list = [
-         'analyst',
-         'analyst_workstations',
-         'eval',
-         'heavynodes',
-         'idh',
-         'manager',
-         'managersearch',
-         'receivers',
-         'searchnodes',
-         'sensors',
-         'standalone',
-         'beats_endpoint',
-         'beats_endpoint_ssl',
-         'elasticsearch_rest',
-         'elastic_agent_endpoint',
-         'endgame',
-         'strelka_frontend',
-         'syslog'
-       ]
-%}
+
+{% set hostgroup_list =  salt['cp.list_master'](prefix='firewall/hostgroups') %}
+{% do hostgroup_list.remove('firewall/hostgroups.local.yaml') %}
+{% do hostgroup_list.remove('firewall/hostgroups.yaml') %}
+
 {% for hg in hostgroup_list %}
-{%   import_text 'firewall/hostgroups/' ~ hg as hg_ips %}
-{%   do local_hostgroups.firewall.hostgroups.update({hg: {'ips': {'insert': hg_ips.split(), 'delete': []}}}) %}
+{%   import_text hg as hg_ips %}
+{%   do local_hostgroups.firewall.hostgroups.update({hg.split('/')[2]: {'ips': {'insert': hg_ips.split(), 'delete': []}}}) %}
 {% endfor %}
 
 {% set hostgroups = salt['defaults.merge'](default_hostgroups.firewall.hostgroups, local_hostgroups.firewall.hostgroups, in_place=False) %}