Merge pull request #16125 from Security-Onion-Solutions/3/dev

3.2.0

.github/DISCUSSION_TEMPLATE/3-0.yml

@@ -12,7 +12,6 @@ body:
         - 3.0.0
         - 3.1.0
         - 3.2.0
-        - 3.3.0
         - Other (please provide detail below)
     validations:
       required: true

VERSION

@@ -1 +1 @@
-3.3.0
+3.2.0

salt/manager/tools/sbin/soup

@@ -479,7 +479,6 @@ preupgrade_changes() {
     [[ "$INSTALLEDVERSION" =~ ^2\.4\.21[0-9]+$ ]] && up_to_3.0.0
     [[ "$INSTALLEDVERSION" == "3.0.0" ]] && up_to_3.1.0
     [[ "$INSTALLEDVERSION" == "3.1.0" ]] && up_to_3.2.0
-    [[ "$INSTALLEDVERSION" == "3.2.0" ]] && up_to_3.3.0
     true
 }
 
@@ -497,7 +496,6 @@ postupgrade_changes() {
     [[ "$POSTVERSION" =~ ^2\.4\.21[0-9]+$ ]] && post_to_3.0.0
     [[ "$POSTVERSION" == "3.0.0" ]] && post_to_3.1.0
     [[ "$POSTVERSION" == "3.1.0" ]] && post_to_3.2.0
-    [[ "$POSTVERSION" == "3.2.0" ]] && post_to_3.3.0
     # All applicable post-upgrade steps completed; clear the resume marker.
     rm -f "$POSTVERSION_FILE"
     true
@@ -880,7 +878,7 @@ post_to_3.1.0() {
 recollate_postgres() {
   echo ""
   echo "Recollating PostgreSQL databases. The following output may contain warnings about a version mismatch, followed by a note indicating that the collation version has been changed."
-  for db in template1 postgres securityonion so_telegraf; do
+  for db in postgres securityonion so_telegraf; do
     docker exec so-postgres psql -U postgres $db -c "reindex database $db"
     docker exec so-postgres psql -U postgres $db -c "alter database $db refresh collation version"
   done
@@ -1006,19 +1004,9 @@ post_to_3.2.0() {
 
   set_postversion 3.2.0
 }
+
 ### 3.2.0 End ###
 
-### 3.2.0 Scripts ###
-up_to_3.3.0() {
-  INSTALLEDVERSION=3.3.0
-}
-
-post_to_3.3.0() {
-  # Recollate again since some internal DBs were excluded during 3.2.0 soup
-  recollate_postgres
-}
-### 3.3.0 End ###
-
 
 repo_sync() {
   echo "Sync the local repo."

salt/nginx/etc/nginx.conf

@@ -96,14 +96,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	Referrer-Policy             no-referrer;
+		add_header 	referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve X25519:secp521r1:secp384r1;
+		ssl_ecdh_curve secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
 	}
@@ -138,14 +138,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	Referrer-Policy             no-referrer;
+		add_header 	referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve X25519:secp521r1:secp384r1;
+		ssl_ecdh_curve secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
         location / {
@@ -172,14 +172,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	Referrer-Policy             no-referrer;
+		add_header 	referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve X25519:secp521r1:secp384r1;
+		ssl_ecdh_curve secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
 
@@ -198,10 +198,6 @@ http {
 		}
 
 		location / {
-			if ($http_authorization ~* "^Bearer .*$") {
-				return 401;
-			}
-
 			auth_request            /auth/sessions/whoami;
 			auth_request_set        $userid $upstream_http_x_kratos_authenticated_identity_id;
 			proxy_set_header        x-user-id $userid;
@@ -222,13 +218,6 @@ http {
 			add_header              Cache-Control "no-cache, no-store, must-revalidate";
 			add_header              Pragma "no-cache";
 			add_header              Expires "0";
-
-			add_header 	Content-Security-Policy     "default-src 'self' 'unsafe-inline' 'unsafe-eval' https: data: blob: wss:; frame-ancestors 'self'";
-			add_header 	X-Frame-Options             SAMEORIGIN;
-			add_header 	X-XSS-Protection            "1; mode=block";
-			add_header 	X-Content-Type-Options      nosniff;
-			add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-			add_header 	Referrer-Policy             no-referrer;
 		}
 
 		location ~ ^/auth/.*?(login|oidc/callback) {
@@ -394,11 +383,6 @@ http {
 			if ($http_authorization = "") {
 				return 403;
 			}
-
-			if ($http_authorization ~* "^Bearer .*$") {
-				return 401;
-			}
-
 			proxy_pass            http://{{ GLOBALS.manager }}:9822/;
 			proxy_read_timeout    90;
 			proxy_connect_timeout 90;
@@ -415,7 +399,7 @@ http {
 		error_page 429 = @error429;
 
 		location @error401 {
-			if ($request_uri ~* (^.*/api/.*|^.*/login.*|^.*/logout.*|^/connect/.*|^/oauth2/.*|^/.*\.map$)) {
+			if ($request_uri ~* (^.*/api/.*|^/connect/.*|^/oauth2/.*|^/.*\.map$)) {
 				return    401;
 			}