now that arkime v4.0.0 is out, bump internal arkime version

cisagov · Oct 13, 2022 · b40df91 · b40df91
2 parents 6edeff3 + 2e5f653
commit b40df91
Show file tree

Hide file tree

Showing 21 changed files with 38 additions and 151 deletions.
diff --git a/Dockerfiles/arkime.Dockerfile b/Dockerfiles/arkime.Dockerfile
@@ -4,7 +4,7 @@ FROM debian:11-slim AS build
 
 ENV DEBIAN_FRONTEND noninteractive
 
-ENV ARKIME_VERSION "3.4.2"
+ENV ARKIME_VERSION "v4.0.0"
 ENV ARKIME_DIR "/opt/arkime"
 ENV ARKIME_URL "https://github.com/arkime/arkime.git"
 ENV ARKIME_LOCALELASTICSEARCH no
@@ -51,7 +51,7 @@ RUN apt-get -q update && \
         zlib1g-dev && \
   pip3 install --no-cache-dir beautifulsoup4 && \
   cd /opt && \
-    git clone --depth=1 --single-branch --recurse-submodules --shallow-submodules --no-tags --branch="v$ARKIME_VERSION" "$ARKIME_URL" "./arkime-"$ARKIME_VERSION && \
+    git clone --recurse-submodules --branch="$ARKIME_VERSION" "$ARKIME_URL" "./arkime-"$ARKIME_VERSION && \
     cd "./arkime-"$ARKIME_VERSION && \
     bash -c 'for i in /opt/patches/*; do patch -p 1 -r - --no-backup-if-mismatch < $i || true; done' && \
     export PATH="$ARKIME_DIR/bin:${PATH}" && \

diff --git a/Dockerfiles/pcap-capture.Dockerfile b/Dockerfiles/pcap-capture.Dockerfile
@@ -34,8 +34,8 @@ ARG PCAP_IFACE=lo
 ARG PCAP_IFACE_TWEAK=false
 ARG PCAP_NETSNIFF_MAGIC=0xa1b2c3d4
 ARG PCAP_TCPDUMP_FILENAME_PATTERN=%Y%m%d%H%M%S.pcap
-ARG PCAP_ROTATE_MINUTES=30
-ARG PCAP_ROTATE_MEGABYTES=500
+ARG PCAP_ROTATE_MINUTES=10
+ARG PCAP_ROTATE_MEGABYTES=4096
 ARG PCAP_PATH=/pcap
 ARG PCAP_FILTER=
 ARG PCAP_SNAPLEN=0

diff --git a/arkime/etc/config.ini b/arkime/etc/config.ini
@@ -9,12 +9,13 @@ cronQueries=true
 rotateIndex=daily
 passwordSecret=Malcolm
 httpRealm=Arkime
+userAuthIps=::,0.0.0.0/0
 interface=eth0
 wiseHost=127.0.0.1
 wisePort=8081
 pcapDir=/data/pcap/processed
 readTruncatedPackets=true
-maxFileSizeG=1
+maxFileSizeG=4
 tcpTimeout=600
 tcpSaveTimeout=720
 udpTimeout=30

diff --git a/arkime/patch/capture_event_dataset.patch b/arkime/patch/capture_event_dataset.patch
diff --git a/arkime/patch/db_pl_quiet_backup_warning.patch b/arkime/patch/db_pl_quiet_backup_warning.patch
@@ -1,8 +1,8 @@
 diff --git a/db/db.pl b/db/db.pl
-index 1b24b6a1..c8034ec4 100755
+index bcb3948a..995c7e4e 100755
 --- a/db/db.pl
 +++ b/db/db.pl
-@@ -7111,7 +7111,7 @@ my $health = dbCheckHealth();
+@@ -7383,7 +7383,7 @@ my $health = dbCheckHealth();
 
  my $nodes = esGet("/_nodes");
  $main::numberOfNodes = dataNodes($nodes->{nodes});

diff --git a/arkime/patch/field_best_priority.patch b/arkime/patch/field_best_priority.patch
diff --git a/arkime/patch/fields_db_max_5000.patch b/arkime/patch/fields_db_max_5000.patch
@@ -1,8 +1,8 @@
 diff --git a/capture/db.c b/capture/db.c
-index c1350507..1ae57143 100644
+index 70be2c19..dd3bfad9 100644
 --- a/capture/db.c
 +++ b/capture/db.c
-@@ -2325,7 +2325,7 @@ LOCAL void moloch_db_load_fields()
+@@ -2321,7 +2321,7 @@ LOCAL void moloch_db_load_fields()
      char                   key[100];
      int                    key_len;
 
@@ -12,7 +12,7 @@ index c1350507..1ae57143 100644
 
      if (!data) {
 diff --git a/capture/moloch.h b/capture/moloch.h
-index 2a63d913..4b7dc4f0 100644
+index b5d866bf..b7bb2f09 100644
 --- a/capture/moloch.h
 +++ b/capture/moloch.h
 @@ -357,7 +357,7 @@ enum MolochRotate {
@@ -25,7 +25,7 @@ index 2a63d913..4b7dc4f0 100644
  #define MOLOCH_FIELDS_CNT_MAX (MOLOCH_FIELDS_DB_MAX*2)
  #define MOLOCH_FIELD_EXSPECIAL_START            (MOLOCH_FIELDS_CNT_MAX)
 diff --git a/capture/plugins/wise.c b/capture/plugins/wise.c
-index 2f98ebe1..0e7b4002 100644
+index 252683a0..e26d3ddb 100644
 --- a/capture/plugins/wise.c
 +++ b/capture/plugins/wise.c
 @@ -111,7 +111,7 @@ typedef struct wiseitem_head {
@@ -38,10 +38,10 @@ index 2f98ebe1..0e7b4002 100644
      BSB          bsb;
      WiseItem_t  *items[WISE_MAX_REQUEST_ITEMS];
 diff --git a/viewer/db.js b/viewer/db.js
-index 1eebc559..2046f17b 100644
+index 299d2f31..e5b853db 100644
 --- a/viewer/db.js
 +++ b/viewer/db.js
-@@ -1835,7 +1835,7 @@ exports.sid2Index = function (id, options) {
+@@ -1729,7 +1729,7 @@ exports.sid2Index = function (id, options) {
  };
 
  exports.loadFields = async () => {

diff --git a/arkime/patch/footer_links.patch b/arkime/patch/footer_links.patch
@@ -1,11 +1,11 @@
 diff --git a/viewer/vueapp/src/components/utils/Footer.vue b/viewer/vueapp/src/components/utils/Footer.vue
-index 50e30c99..d67dfb36 100644
+index 84b28a45..320dd70c 100644
 --- a/viewer/vueapp/src/components/utils/Footer.vue
 +++ b/viewer/vueapp/src/components/utils/Footer.vue
 @@ -4,9 +4,11 @@
      <p>
        <small>
-         Arkime v{{molochVersion}} |
+         Arkime v{{ version }} |
 -        <a href="https://arkime.com">arkime.com</a>
 +        <a href="https://arkime.com">arkime.com 🦉</a>
 +        | <a href="/readme/">Malc⦿lm 📄</a>

diff --git a/arkime/patch/hide_pcap_download_without_file.patch b/arkime/patch/hide_pcap_download_without_file.patch
diff --git a/arkime/patch/packetpos_arkime_issues_1952_1953.patch b/arkime/patch/packetpos_arkime_issues_1952_1953.patch
diff --git a/arkime/patch/remove_upload.patch b/arkime/patch/remove_upload.patch
@@ -1,16 +1,16 @@
 diff --git a/viewer/vueapp/src/router/index.js b/viewer/vueapp/src/router/index.js
-index 02494926..a3c974f9 100644
+index 104506cf..0850f2cd 100644
 --- a/viewer/vueapp/src/router/index.js
 +++ b/viewer/vueapp/src/router/index.js
-@@ -11,7 +11,6 @@ import Spiview from '@/components/spiview/Spiview';
+@@ -12,7 +12,6 @@ import Spiview from '@/components/spiview/Spiview';
  import Spigraph from '@/components/spigraph/Spigraph';
  import Connections from '@/components/connections/Connections';
  import Settings from '@/components/settings/Settings';
 -import Upload from '@/components/upload/Upload';
  import Hunt from '@/components/hunt/Hunt';
  import Moloch404 from '@/components/utils/404';
 
-@@ -86,11 +85,6 @@ const router = new Router({
+@@ -92,11 +91,6 @@ const router = new Router({
        name: 'Settings',
        component: Settings
      },

diff --git a/arkime/patch/spi_sort_zeek.patch → arkime/patch/spi_sort_malcolm.patch b/arkime/patch/spi_sort_zeek.patch → arkime/patch/spi_sort_malcolm.patch
@@ -1,13 +1,13 @@
 diff --git a/viewer/vueapp/src/components/spiview/Spiview.vue b/viewer/vueapp/src/components/spiview/Spiview.vue
-index 66e08ecf..f7156b80 100644
+index 76dd613b..b8117034 100644
 --- a/viewer/vueapp/src/components/spiview/Spiview.vue
 +++ b/viewer/vueapp/src/components/spiview/Spiview.vue
-@@ -915,6 +915,8 @@ export default {
-
+@@ -960,6 +960,8 @@ export default {
+ 
        // sorted list of categories for the view
        this.categoryList = Object.keys(this.categoryObjects).sort();
 +      this.categoryList.splice(this.categoryList.indexOf('malcolm'), 1);
 +      this.categoryList.unshift('malcolm');
        this.categoryList.splice(this.categoryList.indexOf('general'), 1);
        this.categoryList.unshift('general');
-
+ 
diff --git a/arkime/patch/viewer_db_opensearchv2_keyword_hack.patch b/arkime/patch/viewer_db_opensearchv2_keyword_hack.patch
@@ -1,8 +1,8 @@
 diff --git a/viewer/db.js b/viewer/db.js
-index 1eebc559..45645fd3 100644
+index 299d2f31..1b31cace 100644
 --- a/viewer/db.js
 +++ b/viewer/db.js
-@@ -382,7 +382,13 @@ function fixSessionFields (fields, unflatten) {
+@@ -386,7 +386,13 @@ function fixSessionFields (fields, unflatten) {
      delete fields[f];
      for (let i = 0; i < path.length; i++) {
        if (i === path.length - 1) {

diff --git a/arkime/patch/viewer_wider_field_detail.patch b/arkime/patch/viewer_wider_field_detail.patch
@@ -1,8 +1,8 @@
 diff --git a/viewer/vueapp/src/components/sessions/SessionDetail.vue b/viewer/vueapp/src/components/sessions/SessionDetail.vue
-index a15f3b52..e7b0cd7b 100644
+index 572c41f3..60143d82 100644
 --- a/viewer/vueapp/src/components/sessions/SessionDetail.vue
 +++ b/viewer/vueapp/src/components/sessions/SessionDetail.vue
-@@ -844,7 +844,7 @@ export default {
+@@ -846,7 +846,7 @@ export default {
  .session-detail dt {
    float: left;
    clear: left;
@@ -11,7 +11,7 @@ index a15f3b52..e7b0cd7b 100644
    text-align: right;
    margin-right: 6px;
    line-height: 1.7;
-@@ -852,7 +852,7 @@ export default {
+@@ -854,7 +854,7 @@ export default {
  }
 
  .session-detail dd {

diff --git a/arkime/scripts/arkime-needs-upgrade.sh b/arkime/scripts/arkime-needs-upgrade.sh
@@ -28,9 +28,12 @@ set -e
   [arkime_files_v]=arkime_files_v30
   [arkime_hunts_v]=arkime_hunts_v30
   [arkime_lookups_v]=arkime_lookups_v30
+  [arkime_notifiers_v]=arkime_notifiers_v40
   [arkime_queries_v]=arkime_queries_v30
+  [arkime_sequence_v]=arkime_sequence_v30
   [arkime_stats_v]=arkime_stats_v30
   [arkime_users_v]=arkime_users_v30
+  [arkime_views_v]=arkime_views_v40
 )
 
 # get a list of all current indices and loop over them

diff --git a/docker-compose-standalone.yml b/docker-compose-standalone.yml
@@ -342,7 +342,7 @@ x-pcap-capture-variables: &pcap-capture-variables
   PCAP_IFACE_TWEAK : 'false'
   # Specifies how large a locally-captured PCAP file can become (in megabytes) before
   #   it is closed for processing and a new PCAP file created
-  PCAP_ROTATE_MEGABYTES : 1024
+  PCAP_ROTATE_MEGABYTES : 4096
   # Specifies a time interval (in minutes) after which a locally-captured PCAP file
   #   will be closed for processing and a new PCAP file created
   PCAP_ROTATE_MINUTES : 10

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -342,7 +342,7 @@ x-pcap-capture-variables: &pcap-capture-variables
   PCAP_IFACE_TWEAK : 'false'
   # Specifies how large a locally-captured PCAP file can become (in megabytes) before
   #   it is closed for processing and a new PCAP file created
-  PCAP_ROTATE_MEGABYTES : 1024
+  PCAP_ROTATE_MEGABYTES : 4096
   # Specifies a time interval (in minutes) after which a locally-captured PCAP file
   #   will be closed for processing and a new PCAP file created
   PCAP_ROTATE_MINUTES : 10

diff --git a/sensor-iso/arkime/Dockerfile b/sensor-iso/arkime/Dockerfile
@@ -6,7 +6,7 @@ LABEL maintainer="[email protected]"
 
 ENV DEBIAN_FRONTEND noninteractive
 
-ENV ARKIME_VERSION "3.4.2"
+ENV ARKIME_VERSION "v4.0.0"
 ENV ARKIME_DIR "/opt/arkime"
 
 RUN sed -i "s/bullseye main/bullseye main contrib non-free/g" /etc/apt/sources.list && \

diff --git a/sensor-iso/arkime/build-arkime-deb.sh b/sensor-iso/arkime/build-arkime-deb.sh
@@ -21,7 +21,7 @@ fi
 apt-get -q update
 
 cd /tmp
-git clone --depth=1 --single-branch --recurse-submodules --shallow-submodules --no-tags --branch="v$ARKIME_VERSION" "$ARKIME_URL" "./arkime-"$ARKIME_VERSION
+git clone --recurse-submodules --branch="$ARKIME_VERSION" "$ARKIME_URL" "./arkime-"$ARKIME_VERSION
 cd "./arkime-"$ARKIME_VERSION
 for i in /opt/patches/*; do
   patch -p 1 -r - --no-backup-if-mismatch < $i || true

diff --git a/sensor-iso/interface/sensor_ctl/arkime/config.ini b/sensor-iso/interface/sensor_ctl/arkime/config.ini
@@ -8,7 +8,7 @@ passwordSecret=Malcolm
 httpRealm=Arkime
 interface=enp0s1
 pcapDir=/tmp
-maxFileSizeG=2
+maxFileSizeG=4
 maxFileTimeM=180
 tcpTimeout=600
 tcpSaveTimeout=720

diff --git a/sensor-iso/interface/sensor_ctl/control_vars.conf b/sensor-iso/interface/sensor_ctl/control_vars.conf
@@ -4,8 +4,8 @@ export CAPTURE_FILTER=""
 export PCAP_PATH=/home/sensor/net_cap
 export PCAP_TCPDUMP_FILENAME_PATTERN=%Y%m%d_%H%M%S.pcap
 export PCAP_NETSNIFF_MAGIC=0xa1b2c3d4
-export PCAP_ROTATE_SECONDS=10800
-export PCAP_ROTATE_MEGABYTES=500
+export PCAP_ROTATE_SECONDS=3600
+export PCAP_ROTATE_MEGABYTES=4096
 export PCAP_SNAPLEN=0
 export PCAP_MAX_DISK_FILL=90
 export PCAP_PRUNE_CHECK_SECONDS=60