Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,13 @@
cookbook-barnyard2 CHANGELOG
===============

## 0.1.7

- David
- [79c8e55] Merge pull request #22 from redBorder/bugfix/#24045_barnyard_fails_in_case_the_sensor_name_contains_a_space
- Rafael Gomez
- [3e09021] Sanitize sensor name

## 0.1.6

- manegron
Expand Down
2 changes: 1 addition & 1 deletion resources/metadata.rb
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@
maintainer_email 'git@redborder.com'
license 'AGPL-3.0'
description 'Installs/Configures cookbook-barnyard2'
version '0.1.6'
version '0.1.7'
6 changes: 4 additions & 2 deletions resources/templates/default/barnyard2.conf.erb
Original file line number Diff line number Diff line change
Expand Up @@ -25,14 +25,16 @@ config reference_file: /etc/snort/<%= @group["instances_group"] %>/reference
config classification_file: /etc/snort/<%= @group["instances_group"] %>/classification.config
config sid_file: /etc/snort/<%= @group["instances_group"] %>/sid-msg.map

config hostname: <%= node["rbname"] %>
<% sanitized_rbname = node["rbname"].to_s.gsub(/\s+/, '_').gsub(/[^A-Za-z0-9_\-]/, '') %>

config hostname: <%= sanitized_rbname %>

input unified2

# Kafka
<% if !@sensor_id.nil? and @sensor_id>0 and !node["redborder"]["sensor_uuid"].nil? %>
<% out = [ "deployment", "deployment_uuid", "namespace", "namespace_uuid", "market", "market_uuid", "organization", "organization_uuid", "service_provider", "service_provider_uuid" ].map { |x| (@group[x].nil? ? "" : "\"#{x}\":\"#{@group[x].to_s.gsub(" ","\\ ")}\"")}.select{|x| x!="" }.join(",") %>
output alert_json: <%= (!node["redborder"]["cloud"].nil? and (node["redborder"]["cloud"]==1 or node["redborder"]["cloud"]=="1" or node["redborder"]["cloud"]==true or node["redborder"]["cloud"]=="true")) ? "https://http2k.#{node['redborder']['cdomain']}/rbdata/#{node["redborder"]["sensor_uuid"]}/rb_event http.max_connections=5 http.max_queued_messages=10000 http.conn_timeout=10000 http.req_timeout=30000 http.insecure=1 http.mode=0" : "kafka://kafka.#{ node["redborder"]["cdomain"] }@rb_event rdkafka.socket.max.fails=1" %> default enrich_with={<%= (out == "" or out.nil? ) ? "" : "#{out}," %>"sensor_uuid":"<%= node["redborder"]["sensor_uuid"].to_s.gsub(" ", "\\ ") %>","sensor_name":"<%= node["rbname"] %>","group_uuid":"<%= (@group["group_uuid"].nil? ? "0" : @group["group_uuid"].to_s.gsub(' ','') ) %>","group_name":"<%= @name.nil? ? "default" : @name.to_s.gsub(" ","\\ ").to_s.gsub(',','') %>","sensor_type":"ips","domain_name":"<%= (@group["domain_name"].nil? ? "0" : @group["domain_name"].to_s.gsub(" ","\\ ") ) %>","sensor_ip":"<%= node["ipaddress"] %>"} hosts=/etc/objects/hosts networks=/etc/objects/networks services=/etc/objects/services protocols=/etc/objects/protocols vlans=/etc/objects/vlans<%= ((File.exists?"/share/GeoIP/country.dat") ? " geoip=/share/GeoIP/country.dat " : "") %><%= ((File.exists?"/share/GeoIP/countryv6.dat") ? " geoip6=/share/GeoIP/countryv6.dat" : "") %><%= ((File.exists?"/share/GeoIP/asnv6.dat") ? " geoip6_org=/share/GeoIP/asnv6.dat" : "") %><%= ((File.exists?"/share/GeoIP/asn.dat") ? " geoip_org=/share/GeoIP/asn.dat" : "") %><%= ((File.exists?"/etc/objects/mac_vendors") ? " eth_vendors=/etc/objects/mac_vendors" : "") %>
output alert_json: <%= (!node["redborder"]["cloud"].nil? and (node["redborder"]["cloud"]==1 or node["redborder"]["cloud"]=="1" or node["redborder"]["cloud"]==true or node["redborder"]["cloud"]=="true")) ? "https://http2k.#{node['redborder']['cdomain']}/rbdata/#{node["redborder"]["sensor_uuid"]}/rb_event http.max_connections=5 http.max_queued_messages=10000 http.conn_timeout=10000 http.req_timeout=30000 http.insecure=1 http.mode=0" : "kafka://kafka.#{ node["redborder"]["cdomain"] }@rb_event rdkafka.socket.max.fails=1" %> default enrich_with={<%= (out == "" or out.nil? ) ? "" : "#{out}," %>"sensor_uuid":"<%= node["redborder"]["sensor_uuid"].to_s.gsub(" ", "\\ ") %>","sensor_name":"<%= sanitized_rbname %>","group_uuid":"<%= (@group["group_uuid"].nil? ? "0" : @group["group_uuid"].to_s.gsub(' ','') ) %>","group_name":"<%= @name.nil? ? "default" : @name.to_s.gsub(" ","\\ ").to_s.gsub(',','') %>","sensor_type":"ips","domain_name":"<%= (@group["domain_name"].nil? ? "0" : @group["domain_name"].to_s.gsub(" ","\\ ") ) %>","sensor_ip":"<%= node["ipaddress"] %>"} hosts=/etc/objects/hosts networks=/etc/objects/networks services=/etc/objects/services protocols=/etc/objects/protocols vlans=/etc/objects/vlans<%= ((File.exists?"/share/GeoIP/country.dat") ? " geoip=/share/GeoIP/country.dat " : "") %><%= ((File.exists?"/share/GeoIP/countryv6.dat") ? " geoip6=/share/GeoIP/countryv6.dat" : "") %><%= ((File.exists?"/share/GeoIP/asnv6.dat") ? " geoip6_org=/share/GeoIP/asnv6.dat" : "") %><%= ((File.exists?"/share/GeoIP/asn.dat") ? " geoip_org=/share/GeoIP/asn.dat" : "") %><%= ((File.exists?"/etc/objects/mac_vendors") ? " eth_vendors=/etc/objects/mac_vendors" : "") %>
<% end %>

# Syslog
Expand Down
Loading