Merge pull request #15167 from Security-Onion-Solutions/2.4/dev

2.4.190

.github/DISCUSSION_TEMPLATE/2-4.yml

@@ -32,7 +32,6 @@ body:
         - 2.4.170
         - 2.4.180
         - 2.4.190
-        - 2.4.200
         - Other (please provide detail below)
     validations:
       required: true

.github/workflows/pythontest.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
     paths:
       - "salt/sensoroni/files/analyzers/**"
-      - "salt/manager/tools/sbin/**"
+      - "salt/manager/tools/sbin"
 
 jobs:
   build:

VERSION

@@ -1 +1 @@
-2.4.200
+2.4.190

salt/manager/tools/sbin/so-yaml.py

@@ -26,8 +26,8 @@ def showUsage(args):
     print('  Where:', file=sys.stderr)
     print('   YAML_FILE       - Path to the file that will be modified. Ex: /opt/so/conf/service/conf.yaml', file=sys.stderr)
     print('   KEY             - YAML key, does not support \' or " characters at this time. Ex: level1.level2', file=sys.stderr)
-    print('   VALUE           - Value to set for a given key. Can be a literal value or file:<path> to load from a YAML file.', file=sys.stderr)
-    print('   LISTITEM        - Item to append to a given key\'s list value. Can be a literal value or file:<path> to load from a YAML file.', file=sys.stderr)
+    print('   VALUE           - Value to set for a given key', file=sys.stderr)
+    print('   LISTITEM        - Item to append to a given key\'s list value', file=sys.stderr)
     sys.exit(1)
 
 
@@ -58,13 +58,7 @@ def appendItem(content, key, listItem):
 
 
 def convertType(value):
-    if isinstance(value, str) and value.startswith("file:"):
-        path = value[5:]  # Remove "file:" prefix
-        if not os.path.exists(path):
-            print(f"File '{path}' does not exist.", file=sys.stderr)
-            sys.exit(1)
-        return loadYaml(path)
-    elif isinstance(value, str) and len(value) > 0 and (not value.startswith("0") or len(value) == 1):
+    if isinstance(value, str) and len(value) > 0 and (not value.startswith("0") or len(value) == 1):
         if "." in value:
             try:
                 value = float(value)

salt/manager/tools/sbin/so-yaml_test.py

@@ -361,29 +361,6 @@ class TestRemove(unittest.TestCase):
         self.assertEqual(soyaml.convertType("FALSE"), False)
         self.assertEqual(soyaml.convertType(""), "")
 
-    def test_convert_file(self):
-        import tempfile
-        import os
-
-        # Create a temporary YAML file
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
-            f.write("test:\n  - name: hi\n    color: blue\n")
-            temp_file = f.name
-
-        try:
-            result = soyaml.convertType(f"file:{temp_file}")
-            expected = {"test": [{"name": "hi", "color": "blue"}]}
-            self.assertEqual(result, expected)
-        finally:
-            os.unlink(temp_file)
-
-    def test_convert_file_nonexistent(self):
-        with self.assertRaises(SystemExit) as cm:
-            with patch('sys.stderr', new=StringIO()) as mock_stderr:
-                soyaml.convertType("file:/nonexistent/file.yaml")
-                self.assertEqual(cm.exception.code, 1)
-                self.assertIn("File '/nonexistent/file.yaml' does not exist.", mock_stderr.getvalue())
-
     def test_get_int(self):
         with patch('sys.stdout', new=StringIO()) as mock_stdout:
             filename = "/tmp/so-yaml_test-get.yaml"

salt/manager/tools/sbin/soup

@@ -271,7 +271,7 @@ check_os_updates() {
         if [[ "$confirm" == [cC] ]]; then
           echo "Continuing without updating packages"
         elif [[ "$confirm" == [uU] ]]; then
-          echo "Applying Grid Updates. The following patch.os salt state may take a while depending on how many packages need to be updated."
+          echo "Applying Grid Updates"
           update_flag=true
         else
           echo "Exiting soup"

salt/sensoroni/defaults.yaml

@@ -15,7 +15,7 @@ sensoroni:
     sensoronikey:
     soc_host:
     suripcap:
-      pcapMaxCount: 100000
+      pcapMaxCount: 999999
   analyzers:
       echotrail:
         base_url: https://api.echotrail.io/insights/

salt/soc/defaults.yaml

@@ -1364,8 +1364,6 @@ soc:
         cases: soc
         filedatastore:
           jobDir: jobs
-          retryFailureIntervalMs: 600000
-          retryFailureMaxAttempts: 5
         kratos:
           hostUrl:
         hydra:

salt/soc/soc_soc.yaml

@@ -424,17 +424,6 @@ soc:
             description: The maximum number of documents to request in a single Elasticsearch scroll request.
           bulkIndexWorkerCount:
             description: The number of worker threads to use when bulk indexing data into Elasticsearch. A value below 1 will default to the number of CPUs available.
-        filedatastore:
-          jobDir:
-            description: The location where local job files are stored on the manager.
-            global: True
-            advanced: True
-          retryFailureIntervalMs:
-            description: The interval, in milliseconds, to wait before attempting to reprocess a failed job.
-            global: True
-          retryFailureMaxAttempts:
-            description: The max number of attempts to process a job, in the event the job fails to complete.
-            global: True
         sostatus:
           refreshIntervalMs:
             description: Duration (in milliseconds) between refreshes of the grid status. Shortening this duration may not have expected results, as the backend systems feeding this sostatus data will continue their updates as scheduled.

setup/so-functions

@@ -1646,12 +1646,6 @@ reserve_ports() {
 	fi
 }
 
-clear_previous_setup_results() {
-	# Disregard previous setup outcomes.
-	rm -f /root/failure
-	rm -f /root/success
-}
-
 reinstall_init() {
 	info "Putting system in state to run setup again"
 
@@ -1663,6 +1657,10 @@ reinstall_init() {
 
 	local service_retry_count=20
 
+	# Disregard previous install outcomes
+	rm -f /root/failure
+	rm -f /root/success
+
 	{
 		# remove all of root's cronjobs
 		logCmd "crontab -r -u root"

setup/so-setup

@@ -132,10 +132,6 @@ if [[ -f /root/accept_changes ]]; then
 	reset_proxy
 fi
 
-# Previous setup attempts, even if setup doesn't actually start the installation,
-# can leave behind results that may interfere with the current setup attempt.
-clear_previous_setup_results
-
 title "Parsing Username for Install"
 parse_install_username