Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor elastic-agent download for soup ctrl+c anomalies #10931

Merged
merged 1 commit into from
Aug 2, 2023
Merged

refactor elastic-agent download for soup ctrl+c anomalies #10931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 63 additions & 1 deletion salt/common/tools/sbin/so-common
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,16 @@
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.

# Elastic agent is not managed by salt. Because of this we must store this base information in a
# script that accompanies the soup system. Since so-common is one of those special soup files,
# and since this same logic is required during installation, it's included in this file.
ELASTIC_AGENT_TARBALL_VERSION="8.8.2"
ELASTIC_AGENT_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"
ELASTIC_AGENT_MD5_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5"
ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"
ELASTIC_AGENT_MD5="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5"
ELASTIC_AGENT_EXPANSION_DIR=/nsm/elastic-fleet/artifacts/beats/elastic-agent

DEFAULT_SALT_DIR=/opt/so/saltstack/default
DOC_BASE_URL="https://docs.securityonion.net/en/2.4"

Expand Down Expand Up @@ -161,6 +170,37 @@ disable_fastestmirror() {
sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
}

download_and_verify() {
source_url=$1
source_md5_url=$2
dest_file=$3
md5_file=$4
expand_dir=$5

if [[ -n "$expand_dir" ]]; then
mkdir -p "$expand_dir"
fi

if ! verify_md5_checksum "$dest_file" "$md5_file"; then
retry 15 10 "curl --fail --retry 5 --retry-delay 15 -L '$source_url' --output '$dest_file'" "" ""
retry 15 10 "curl --fail --retry 5 --retry-delay 15 -L '$source_md5_url' --output '$md5_file'" "" ""

SOURCEHASH=$(md5sum "$dest_file" | awk '{ print $1 }')
HASH=$(cat "$md5_file")

if verify_md5_checksum "$dest_file" "$md5_file"; then
echo "Source file and checksum are good."
else
echo "Unable to download and verify the source file and checksum."
return 1
fi
fi

if [[ -n "$expand_dir" ]]; then
tar -xf "$dest_file" -C "$expand_dir"
fi
}

elastic_license() {

read -r -d '' message <<- EOM
Expand Down Expand Up @@ -211,7 +251,7 @@ gpg_rpm_import() {
echo "Imported $RPMKEY"
done
elif [[ $is_rpm ]]; then
info "Importing the security onion GPG key"
echo "Importing the security onion GPG key"
rpm --import ../salt/repo/client/files/oracle/keys/securityonion.pub
fi
}
Expand Down Expand Up @@ -470,6 +510,11 @@ has_uppercase() {
|| return 1
}

update_elastic_agent() {
echo "Checking if Elastic Agent update is necessary..."
download_and_verify "$ELASTIC_AGENT_URL" "$ELASTIC_AGENT_MD5_URL" "$ELASTIC_AGENT_FILE" "$ELASTIC_AGENT_MD5" "$ELASTIC_AGENT_EXPANSION_DIR"
}

valid_cidr() {
# Verify there is a backslash in the string
echo "$1" | grep -qP "^[^/]+/[^/]+$" || return 1
Expand Down Expand Up @@ -623,6 +668,23 @@ valid_username() {
echo "$user" | grep -qP '^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)$' && return 0 || return 1
}

verify_md5_checksum() {
data_file=$1
md5_file=${2:-${data_file}.md5}

if [[ ! -f "$dest_file" || ! -f "$md5_file" ]]; then
return 2
fi

SOURCEHASH=$(md5sum "$data_file" | awk '{ print $1 }')
HASH=$(cat "$md5_file")

if [[ "$HASH" == "$SOURCEHASH" ]]; then
return 0
fi
return 1
}

wait_for_web_response() {
url=$1
expected=$2
Expand Down
18 changes: 9 additions & 9 deletions salt/manager/tools/sbin/soup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -467,21 +467,21 @@ stop_salt_minion() {


up_to_2.4.3() {
echo "Nothing to do for 2.4.3"
##
INSTALLEDVERSION=2.4.3
echo "Nothing to do for 2.4.3"

INSTALLEDVERSION=2.4.3
}

up_to_2.4.4() {
echo "Nothing to do for 2.4.4"
##
INSTALLEDVERSION=2.4.4
echo "Nothing to do for 2.4.4"

INSTALLEDVERSION=2.4.4
}

up_to_2.4.5() {
echo "Nothing to do for 2.4.5"
##
INSTALLEDVERSION=2.4.5
update_elastic_agent

INSTALLEDVERSION=2.4.5
}

verify_upgradespace() {
Expand Down
20 changes: 2 additions & 18 deletions setup/so-functions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1014,25 +1014,9 @@ detect_os() {
}

download_elastic_agent_artifacts() {
agentArchive=/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz
agentMd5=/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5
beatsDir=/nsm/elastic-fleet/artifacts/beats/elastic-agent
logCmd "mkdir -p $beatsDir"
if [[ ! -f "$agentArchive" ]]; then
retry 15 10 "curl --fail --retry 5 --retry-delay 15 -L https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz --output $agentArchive" "" ""
retry 15 10 "curl --fail --retry 5 --retry-delay 15 -L https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5 --output $agentMd5" "" ""

SOURCEHASH=$(md5sum $agentArchive | awk '{ print $1 }')
HASH=$(cat $agentMd5)

if [[ "$HASH" == "$SOURCEHASH" ]]; then
info "Elastic Agent source hash is good."
else
info "Unable to download the Elastic Agent source files."
fail_setup
fi
if ! update_elastic_agent 2>&1 | tee -a "$setup_log"; then
fail_setup
fi
logCmd "tar -xf $agentArchive -C $beatsDir"
}

installer_progress_loop() {
Expand Down