Skip to content

Commit f038964

Browse files
basepibasepi
authored
Merge pull request #232 from hubblestack/develop
Merge to master (prep v2.2.9)
2 parents 552c5f6 + 0a6adc0 commit f038964

File tree

19 files changed

+70
-38
lines changed

19 files changed

+70
-38
lines changed

‎conf/afterinstall-systemd.sh

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
systemctl daemon-reload
2+
service hubble start

‎conf/afterinstall.sh

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
service hubble start

‎conf/afterupgrade.sh

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
service hubble restart

‎hubblestack/__init__.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
__version__ = '2.2.8'
1+
__version__ = '2.2.9'

‎hubblestack/cloud_details.py

+6-6
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,14 @@ def _get_azure_details():
5454
# Gather azure information if present
5555
azure = {}
5656
azure['azure_vmId'] = None
57-
57+
azure['azure_subscriptionId'] = None
5858
azureHeader = {'Metadata': 'true'}
59-
6059
try:
61-
r = requests.get('http://169.254.169.254/metadata/instance/compute/vmId?api-version=2017-03-01&format=text',
62-
timeout=1, headers=azureHeader)
63-
r.raise_for_status()
64-
azure['azure_vmId'] = r.text
60+
id = requests.get('http://169.254.169.254/metadata/instance/compute?api-version=2017-08-01',
61+
headers=azureHeader, timeout=1).json()
62+
azure['azure_vmId'] = id['vmId']
63+
azure['azure_subscriptionId'] = id['subscriptionId']
64+
6565
except (requests.exceptions.RequestException, ValueError):
6666
# Not on an Azure box
6767
azure = None

‎hubblestack/extmods/fileserver/azurefs.py

+4-1
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,15 @@
2424
2525
You must have either an account_key or a sas_token defined for each container,
2626
if it is private. If you use a sas_token, it must have READ and LIST
27-
permissions.
27+
permissions. Proxy can also be provided in the configuration.
2828
2929
.. code-block:: yaml
3030
3131
azurefs:
3232
- account_name: my_storage
3333
account_key: 'fNH9cRp0+qVIVYZ+5rnZAhHc9ycOUcJnHtzpfOr0W0sxrtL2KVLuMe1xDfLwmfed+JJInZaEdWVCPHD4d/oqeA=='
3434
container_name: my_container
35+
proxy: 10.10.10.10:8080
3536
- account_name: my_storage
3637
sas_token: 'ss=b&sp=&sv=2015-07-08&sig=cohxXabx8FQdXsSEHyUXMjsSfNH2tZ2OB97Ou44pkRE%3D&srt=co&se=2017-04-18T21%3A38%3A01Z'
3738
container_name: my_dev_container
@@ -362,6 +363,8 @@ def _get_container_service(container):
362363
else:
363364
account = azure.storage.CloudStorageAccount(container['account_name'])
364365
blob_service = account.create_block_blob_service()
366+
if 'proxy' in container and len(container['proxy'].split(':'))==2:
367+
blob_service.set_proxy(container['proxy'].split(':')[0],container['proxy'].split(':')[1])
365368
return blob_service
366369

367370

‎hubblestack/extmods/returners/splunk_nebula_return.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ def returner(ret):
7878

7979
# Set up the fields to be extracted at index time. The field values must be strings.
8080
# Note that these fields will also still be available in the event data
81-
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId']
81+
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId', 'azure_subscriptionId']
8282
try:
8383
index_extracted_fields.extend(opts['index_extracted_fields'])
8484
except TypeError:

‎hubblestack/extmods/returners/splunk_nova_return.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ def returner(ret):
7777

7878
# Set up the fields to be extracted at index time. The field values must be strings.
7979
# Note that these fields will also still be available in the event data
80-
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId']
80+
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId', 'azure_subscriptionId']
8181
try:
8282
index_extracted_fields.extend(opts['index_extracted_fields'])
8383
except TypeError:

‎hubblestack/extmods/returners/splunk_pulsar_return.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ def returner(ret):
8282

8383
# Set up the fields to be extracted at index time. The field values must be strings.
8484
# Note that these fields will also still be available in the event data
85-
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId']
85+
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId', 'azure_subscriptionId']
8686
try:
8787
index_extracted_fields.extend(opts['index_extracted_fields'])
8888
except TypeError:

‎hubblestack/files/hubblestack_nova/win_secedit.py

+19-2
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,9 @@ def _translate_value_type(current, value, evaluator, __sidaccounts__=False):
283283
return False
284284
elif 'equal' in value:
285285
if ',' not in evaluator and type(evaluator) != list:
286-
evaluator = _evaluator_translator(evaluator)
286+
tmp_evaluator = _evaluator_translator(evaluator)
287+
if tmp_evaluator != 'undefined':
288+
evaluator = tmp_evaluator
287289
if type(current) == list:
288290
ret_final = []
289291
for item in current:
@@ -300,6 +302,21 @@ def _translate_value_type(current, value, evaluator, __sidaccounts__=False):
300302
return True
301303
else:
302304
return False
305+
elif 'contains' in value:
306+
if type(evaluator) != list:
307+
evaluator = evaluator.split(',')
308+
if type(current) != list:
309+
current = current.lower().split(',')
310+
ret_final = []
311+
for item in evaluator:
312+
if item in current:
313+
ret_final.append(True)
314+
else:
315+
ret_final.append(False)
316+
if False in ret_final:
317+
return False
318+
else:
319+
return True
303320
elif 'account' in value:
304321
evaluator = _account_audit(evaluator, __sidaccounts__)
305322
evaluator_list = evaluator.split(',')
@@ -327,7 +344,7 @@ def _translate_value_type(current, value, evaluator, __sidaccounts__=False):
327344
elif 'configured' in value:
328345
if current == '':
329346
return False
330-
elif current == value:
347+
elif current.lower().find(evaluator) != -1:
331348
return True
332349
else:
333350
return False

‎hubblestack/splunklogging.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ def __init__(self):
7777

7878
# Set up the fields to be extracted at index time. The field values must be strings.
7979
# Note that these fields will also still be available in the event data
80-
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId']
80+
index_extracted_fields = ['aws_instance_id', 'aws_account_id', 'azure_vmId', 'azure_subscriptionId']
8181
try:
8282
index_extracted_fields.extend(opts['index_extracted_fields'])
8383
except TypeError:

‎pkg/amazonlinux2016.09/Dockerfile

+4-4
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ RUN yum install -y ruby ruby-devel rpmbuild rubygems gcc make \
9191
#pyinstaller start
9292
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9393
#use the following variables to choose the version of hubble
94-
ENV HUBBLE_CHECKOUT=v2.2.8
95-
ENV HUBBLE_VERSION=2.2.8
94+
ENV HUBBLE_CHECKOUT=v2.2.9
95+
ENV HUBBLE_VERSION=2.2.9
9696
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
9797
ENV HUBBLE_SRC_PATH=/hubble_src
9898
ENV _HOOK_DIR="./pkg/"
@@ -123,8 +123,6 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
123123
&& tar -xzvf /data/hubblestack-${HUBBLE_VERSION}.tar.gz -C /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION} \
124124
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/init.d \
125125
&& cp /hubble_build/pkg/hubble /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/init.d/ \
126-
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/usr/lib/systemd/system \
127-
&& cp /hubble_build/pkg/hubble.service /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/usr/lib/systemd/system/ \
128126
&& cp -f /hubble_build/conf/hubble /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/hubble/ \
129127
#during container run, if a configuration file exists in a /data copy it over the existing one so it would be
130128
#possile to optionally include a custom one with the package
@@ -140,6 +138,8 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
140138
#todo: get rid of the git dependency with static bin in the future
141139
-d 'git' \
142140
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
141+
--after-install /hubble_build/conf/afterinstall.sh \
142+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
143143
etc/hubble etc/osquery etc/init.d opt usr \
144144
#edit to change iteration number, if necessary
145145
&& cp hubblestack-${HUBBLE_VERSION}-1.x86_64.rpm /data/hubblestack-${HUBBLE_VERSION}-1.al1609.x86_64.rpm" ]

‎pkg/amazonlinux2017.03/Dockerfile

+4-4
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ RUN yum install -y ruby ruby-devel rpmbuild rubygems gcc make \
9191
#pyinstaller start
9292
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9393
#use the following variables to choose the version of hubble
94-
ENV HUBBLE_CHECKOUT=v2.2.8
95-
ENV HUBBLE_VERSION=2.2.8
94+
ENV HUBBLE_CHECKOUT=v2.2.9
95+
ENV HUBBLE_VERSION=2.2.9
9696
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
9797
ENV HUBBLE_SRC_PATH=/hubble_src
9898
ENV _HOOK_DIR="./pkg/"
@@ -123,8 +123,6 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
123123
&& tar -xzvf /data/hubblestack-${HUBBLE_VERSION}.tar.gz -C /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION} \
124124
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/init.d \
125125
&& cp /hubble_build/pkg/hubble /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/init.d/ \
126-
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/usr/lib/systemd/system \
127-
&& cp /hubble_build/pkg/hubble.service /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/usr/lib/systemd/system/ \
128126
&& cp -f /hubble_build/conf/hubble /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/hubble/ \
129127
#during container run, if a configuration file exists in a /data copy it over the existing one so it would be
130128
#possile to optionally include a custom one with the package
@@ -140,6 +138,8 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
140138
#todo: get rid of the git dependency with static bin in the future
141139
-d 'git' \
142140
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
141+
--after-install /hubble_build/conf/afterinstall.sh \
142+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
143143
etc/hubble etc/osquery etc/init.d opt usr \
144144
#edit to change iteration number, if necessary
145145
&& cp hubblestack-${HUBBLE_VERSION}-1.x86_64.rpm /data/hubblestack-${HUBBLE_VERSION}-1.al1703.x86_64.rpm" ]

‎pkg/centos6/Dockerfile

+5-3
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ RUN ls -lahR /opt/osquery/ && /opt/osquery/osqueryi --version
5656
RUN yum -y install \
5757
libffi-devel openssl-devel libxml2-devel libxslt-devel \
5858
libjpeg-devel zlib-devel python-devel make cmake gcc \
59-
python-setuptools wget
59+
python-setuptools wget
6060

6161
#libgit2 install start
6262
#must precede pyinstaller requirements
@@ -93,8 +93,8 @@ RUN yum install -y rpmbuild gcc make rh-ruby23 rh-ruby23-ruby-devel \
9393
#pyinstaller start
9494
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9595
#use the following variables to choose the version of hubble
96-
ENV HUBBLE_CHECKOUT=v2.2.8
97-
ENV HUBBLE_VERSION=2.2.8
96+
ENV HUBBLE_CHECKOUT=v2.2.9
97+
ENV HUBBLE_VERSION=2.2.9
9898
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
9999
ENV HUBBLE_SRC_PATH=/hubble_src
100100
ENV _HOOK_DIR="./pkg/"
@@ -140,6 +140,8 @@ CMD [ "scl enable python27 'pyinstaller --onedir --noconfirm --log-level ${_BINA
140140
#todo: get rid of the git dependency with static bin in the future
141141
-d git \
142142
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
143+
--after-install /hubble_build/conf/afterinstall.sh \
144+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
143145
etc/hubble etc/osquery etc/init.d opt usr' \
144146
#edit to change iteration number, if necessary
145147
&& cp hubblestack-${HUBBLE_VERSION}-1.x86_64.rpm /data/hubblestack-${HUBBLE_VERSION}-1.el6.x86_64.rpm" ]

‎pkg/centos7/Dockerfile

+5-5
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,8 @@ RUN yum install -y ruby ruby-devel rpmbuild rubygems gcc make \
9090
#pyinstaller start
9191
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9292
#use the following variables to choose the version of hubble
93-
ENV HUBBLE_CHECKOUT=v2.2.8
94-
ENV HUBBLE_VERSION=2.2.8
93+
ENV HUBBLE_CHECKOUT=v2.2.9
94+
ENV HUBBLE_VERSION=2.2.9
9595
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
9696
ENV HUBBLE_SRC_PATH=/hubble_src
9797
ENV _HOOK_DIR="./pkg/"
@@ -120,8 +120,6 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
120120
&& tar -cPvzf /data/hubblestack-${HUBBLE_VERSION}.tar.gz /etc/hubble /etc/osquery /opt/hubble /opt/osquery /var/log/osquery /etc/profile.d/hubble-profile.sh \
121121
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION} \
122122
&& tar -xzvf /data/hubblestack-${HUBBLE_VERSION}.tar.gz -C /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION} \
123-
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/init.d \
124-
&& cp /hubble_build/pkg/hubble /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/init.d/ \
125123
&& mkdir -p /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/usr/lib/systemd/system \
126124
&& cp /hubble_build/pkg/hubble.service /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/usr/lib/systemd/system/ \
127125
&& cp -f /hubble_build/conf/hubble /hubble_build/debbuild/hubblestack-${HUBBLE_VERSION}/etc/hubble/ \
@@ -139,6 +137,8 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
139137
#todo: get rid of the git dependency with static bin in the future
140138
-d 'git' \
141139
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
142-
etc/hubble etc/osquery etc/init.d opt usr \
140+
--after-install /hubble_build/conf/afterinstall-systemd.sh \
141+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
142+
etc/hubble etc/osquery opt usr \
143143
#edit to change iteration number, if necessary
144144
&& cp hubblestack-${HUBBLE_VERSION}-1.x86_64.rpm /data/hubblestack-${HUBBLE_VERSION}-1.el7.x86_64.rpm" ]

‎pkg/coreos/Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,8 @@ RUN pip install --upgrade pip \
8888
#pyinstaller start
8989
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9090
#use the following variables to choose the version of hubble
91-
ENV HUBBLE_CHECKOUT=v2.2.8
92-
ENV HUBBLE_VERSION=2.2.8
91+
ENV HUBBLE_CHECKOUT=v2.2.9
92+
ENV HUBBLE_VERSION=2.2.9
9393
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
9494
ENV HUBBLE_SRC_PATH=/hubble_src
9595
ENV _HOOK_DIR="./pkg/"

‎pkg/debian7/Dockerfile

+4-2
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,8 @@ RUN apt-get install -y ruby ruby-dev rubygems gcc make \
115115
#pyinstaller start
116116
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
117117
#use the following variables to choose the version of hubble
118-
ENV HUBBLE_CHECKOUT=v2.2.8
119-
ENV HUBBLE_VERSION=2.2.8
118+
ENV HUBBLE_CHECKOUT=v2.2.9
119+
ENV HUBBLE_VERSION=2.2.9
120120
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
121121
ENV HUBBLE_SRC_PATH=/hubble_src
122122
ENV _HOOK_DIR="./pkg/"
@@ -162,6 +162,8 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
162162
-d 'git' \
163163
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
164164
--deb-no-default-config-files \
165+
--after-install /hubble_build/conf/afterinstall.sh \
166+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
165167
etc/hubble etc/osquery etc/init.d opt usr \
166168
&& cp hubblestack_${HUBBLE_VERSION}-1_amd64.deb /data/hubblestack_${HUBBLE_VERSION}-1deb7_amd64.deb" ]
167169

‎pkg/debian8/Dockerfile

+4-2
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,8 @@ RUN apt-get install -y ruby ruby-dev rubygems gcc make \
9696
#pyinstaller start
9797
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9898
#use the following variables to choose the version of hubble
99-
ENV HUBBLE_CHECKOUT=v2.2.8
100-
ENV HUBBLE_VERSION=2.2.8
99+
ENV HUBBLE_CHECKOUT=v2.2.9
100+
ENV HUBBLE_VERSION=2.2.9
101101
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
102102
ENV HUBBLE_SRC_PATH=/hubble_src
103103
ENV _HOOK_DIR="./pkg/"
@@ -145,6 +145,8 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
145145
-d 'git' \
146146
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
147147
--deb-no-default-config-files \
148+
--after-install /hubble_build/conf/afterinstall.sh \
149+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
148150
etc/hubble etc/osquery etc/init.d opt usr \
149151
&& cp hubblestack_${HUBBLE_VERSION}-1_amd64.deb /data/hubblestack_${HUBBLE_VERSION}-1deb8_amd64.deb" ]
150152

‎pkg/debian9/Dockerfile

+4-2
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,8 @@ RUN apt-get install -y ruby ruby-dev rubygems gcc make \
9292
#pyinstaller start
9393
#commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
9494
#use the following variables to choose the version of hubble
95-
ENV HUBBLE_CHECKOUT=v2.2.8
96-
ENV HUBBLE_VERSION=2.2.8
95+
ENV HUBBLE_CHECKOUT=v2.2.9
96+
ENV HUBBLE_VERSION=2.2.9
9797
ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
9898
ENV HUBBLE_SRC_PATH=/hubble_src
9999
ENV _HOOK_DIR="./pkg/"
@@ -141,6 +141,8 @@ CMD [ "pyinstaller --onedir --noconfirm --log-level ${_BINARY_LOG_LEVEL} --addit
141141
-d 'git' \
142142
--config-files /etc/hubble --config-files /etc/osquery/osquery.conf \
143143
--deb-no-default-config-files \
144+
--after-install /hubble_build/conf/afterinstall.sh \
145+
--after-upgrade /hubble_build/conf/afterupgrade.sh \
144146
etc/hubble etc/osquery etc/init.d opt usr \
145147
&& cp hubblestack_${HUBBLE_VERSION}-1_amd64.deb /data/hubblestack_${HUBBLE_VERSION}-1deb9_amd64.deb" ]
146148

0 commit comments

Comments
 (0)