Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hedgehog with OOB/VPN connection sets ARKIME_NODE_HOST incorrectly #560

Closed
mmguero opened this issue Sep 11, 2024 · 2 comments
Closed

Hedgehog with OOB/VPN connection sets ARKIME_NODE_HOST incorrectly #560

mmguero opened this issue Sep 11, 2024 · 2 comments
Assignees
Labels
bug Something isn't working sensor For issues dealing with the Hedgehog OS capture sensor
Milestone

Comments

@mmguero
Copy link
Collaborator

mmguero commented Sep 11, 2024

Issue for tracking #559 by @divinehawk.

When using Hedgehog that has an OOB/VPN connection, ARKIME_NODE_HOST is set incorrectly to the IP address of the default gateway interface.

This patch will use the IP interface of the route for the OS_HOST, if set, rather than the default.

PR commit staged into development fork for release as mmguero-dev/Malcolm@ef5e672

@mmguero mmguero added bug Something isn't working sensor For issues dealing with the Hedgehog OS capture sensor labels Sep 11, 2024
@mmguero mmguero added this to the v24.09.0 milestone Sep 11, 2024
@mmguero mmguero self-assigned this Sep 11, 2024
@mmguero
Copy link
Collaborator Author

mmguero commented Sep 11, 2024

Hmmm, one thing I just thought of is what if OS_HOST is a hostname rather than an IP address (this actually would also mean shared/bin/ufw_allow_requests.sh would need to be tweaked).

We should probably detect this case and try to resolve it (?) before doing the ip route, as:

$ ip route get example.org
Error: any valid prefix is expected rather than "example.org"

So, I'll do like dig +short $OS_HOST first if it's not already an IP address, e.g.:

$ ip route get $(dig +short "example.org") | grep -Po '(?<=src )(\d{1,3}.){4}' | sed "s/ //g"
172.16.0.20

mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Sep 11, 2024
@mmguero
Copy link
Collaborator Author

mmguero commented Sep 11, 2024

Here's what I ended up on for that logic:

  ROUTE_DEST_IP=
  if [[ -n "$OS_HOST" ]]; then
    if [[ "$OS_HOST" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
      ROUTE_DEST_IP="$OS_HOST"
    else
      ROUTE_DEST_IP=$(dig +short "$OS_HOST" 2>/dev/null | head -n 1)
    fi
  fi
  [[ -n "$ROUTE_DEST_IP" ]] || ROUTE_DEST_IP=255.255.255.255
  PRIMARY_IP=$(ip route get "$ROUTE_DEST_IP" | grep -Po '(?<=src )(\d{1,3}.){4}' | sed "s/ //g")

This was referenced Sep 18, 2024
@mmguero mmguero closed this as completed Sep 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working sensor For issues dealing with the Hedgehog OS capture sensor
Projects
Status: Released
Development

No branches or pull requests

1 participant