Skip to content

Commit 216e9ab

Browse files
carlosmmatos-cscarlosmmatos-cs
committed
fix(bash): reach handle_curl_error when running under sh
Under set -e in POSIX mode, an assignment from a command substitution aborts the shell before the next line runs, so handle_curl_error was never reached and curl failures printed nothing. bash suppresses errexit inside a command substitution that is part of an assignment, which is why only sh was affected. Every handle_curl_error call site now runs from the || branch of the command it inspects. The same shape also silently aborted the EC2 metadata probe in check_aws_instance and the IMDS calls in aws_ssm_parameter; those now continue and report respectively.
1 parent dad81bf commit 216e9ab

4 files changed

Lines changed: 43 additions & 85 deletions

File tree

‎bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -299,8 +299,7 @@ fetch_tags() {
299299
# No -L, so --proto-redir is dropped too; nothing follows a redirect here.
300300
bearer_result=$(echo "-u $ART_USERNAME:$ART_PASSWORD" |
301301
curl -s --proto '=https' \
302-
"https://$cs_registry/v2/token?account=$ART_USERNAME&scope=repository:$registry_opts/$repository_name:pull&service=$cs_registry" -K-)
303-
handle_curl_error $?
302+
"https://$cs_registry/v2/token?account=$ART_USERNAME&scope=repository:$registry_opts/$repository_name:pull&service=$cs_registry" -K-) || handle_curl_error $?
304303
registry_bearer=$(echo "$bearer_result" | json_value "token" | sed 's/ *$//g' | sed 's/^ *//g')
305304
# Check if registry_bearer is not empty
306305
if [ -z "$registry_bearer" ]; then
@@ -697,8 +696,7 @@ cs_falcon_oauth_token=$(
697696
698697
auth_payload="client_id=$FALCON_CLIENT_ID&client_secret=$FALCON_CLIENT_SECRET"
699698
700-
token_result=$(echo "$auth_payload" | oauth_token_request "$(cs_cloud)" "$response_headers")
701-
handle_curl_error $?
699+
token_result=$(echo "$auth_payload" | oauth_token_request "$(cs_cloud)" "$response_headers") || handle_curl_error $?
702700
token=$(echo "$token_result" | json_value "access_token" | sed 's/ *$//g' | sed 's/^ *//g')
703701
if [ -z "$token" ]; then
704702
# Wrong region: retry against the x-cs-region hint instead of following
@@ -712,8 +710,7 @@ cs_falcon_oauth_token=$(
712710
# Separate file: --dump-header truncates, and region_hint below
713711
# still needs the original response.
714712
retry_headers=$(mktemp)
715-
token_result=$(echo "$auth_payload" | oauth_token_request "$retry_host" "$retry_headers")
716-
handle_curl_error $?
713+
token_result=$(echo "$auth_payload" | oauth_token_request "$retry_host" "$retry_headers") || handle_curl_error $?
717714
rm -f "$retry_headers"
718715
token=$(echo "$token_result" | json_value "access_token" | sed 's/ *$//g' | sed 's/^ *//g')
719716
fi
@@ -798,8 +795,7 @@ cs_falcon_cid_with_checksum=$(
798795
if [ -n "$FALCON_CID" ]; then
799796
echo "$FALCON_CID"
800797
else
801-
cs_target_cid=$(curl_command "$cs_falcon_oauth_token" "https://$(cs_cloud)/sensors/queries/installers/ccid/v1")
802-
handle_curl_error $?
798+
cs_target_cid=$(curl_command "$cs_falcon_oauth_token" "https://$(cs_cloud)/sensors/queries/installers/ccid/v1") || handle_curl_error $?
803799
if echo "$cs_target_cid" | grep -q "authorization failed"; then
804800
die "Failed to retrieve CID. Ensure the correct API Scopes are assigned: $(display_api_scopes "${SENSOR_TYPE}")"
805801
fi
@@ -895,8 +891,7 @@ elif [ "${SENSOR_TYPE}" = "falcon-registryassessmentexecutor" ]; then
895891
fi
896892

897893
#Set Docker token using the BEARER token captured earlier
898-
raw_docker_api_token=$(curl_command "$cs_falcon_oauth_token" "https://$(cs_cloud)/$registry_type/entities/image-registry-credentials/v1")
899-
handle_curl_error $?
894+
raw_docker_api_token=$(curl_command "$cs_falcon_oauth_token" "https://$(cs_cloud)/$registry_type/entities/image-registry-credentials/v1") || handle_curl_error $?
900895
docker_api_token=$(echo "$raw_docker_api_token" | json_value "token")
901896

902897
ART_PASSWORD=$(echo "$docker_api_token" | sed 's/ *$//g' | sed 's/^ *//g')

‎bash/install/falcon-linux-install.sh‎

Lines changed: 15 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -314,9 +314,7 @@ cs_sensor_policy_version() {
314314
sensor_update_policy=$(
315315
curl_command -G "https://$(cs_cloud)/policy/combined/sensor-update/v2" \
316316
--data-urlencode "filter=platform_name:\"Linux\"+name.raw:\"$cs_policy_name\""
317-
)
318-
319-
handle_curl_error $?
317+
) || handle_curl_error $?
320318

321319
if echo "$sensor_update_policy" | grep "authorization failed"; then
322320
die "Access denied: Please make sure that your Falcon API credentials allow access to sensor update policies (scope Sensor update policies [read])"
@@ -388,9 +386,7 @@ cs_sensor_download() {
388386
existing_installers=$(
389387
curl_command -G "https://$(cs_cloud)/sensors/combined/installers/v3?sort=version|desc" \
390388
--data-urlencode "filter=os:\"$cs_os_name\"$cs_os_version_filter$cs_api_version_filter$cs_os_arch_filter"
391-
)
392-
393-
handle_curl_error $?
389+
) || handle_curl_error $?
394390

395391
if echo "$existing_installers" | grep "authorization failed"; then
396392
die "Access denied: Please make sure that your Falcon API credentials allow sensor download (scope Sensor Download [read])"
@@ -415,9 +411,7 @@ cs_sensor_download() {
415411

416412
installer="${destination_dir}/falcon-sensor.${file_type}"
417413

418-
curl_command "https://$(cs_cloud)/sensors/entities/download-installer/v3?id=$sha" -o "${installer}"
419-
420-
handle_curl_error $?
414+
curl_command "https://$(cs_cloud)/sensors/entities/download-installer/v3?id=$sha" -o "${installer}" || handle_curl_error $?
421415

422416
verify_sha256 "$installer" "$sha"
423417

@@ -502,19 +496,20 @@ os_install_package() {
502496
}
503497

504498
aws_ssm_parameter() {
505-
local param_name="$1"
499+
local param_name="$1" imds_err
506500

507501
hmac_sha256() {
508502
key="$1"
509503
data="$2"
510504
echo -n "$data" | openssl dgst -sha256 -mac HMAC -macopt "$key" | sed 's/^.* //'
511505
}
512506

513-
token=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
507+
imds_err="Failed to query the EC2 instance metadata service. Reading an SSM parameter needs IMDSv2 access from this host."
508+
token=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") || die "$imds_err (curl exit $?)"
514509
api_endpoint="AmazonSSM.GetParameters"
515-
iam_role="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/)"
510+
iam_role="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/)" || die "$imds_err (curl exit $?)"
516511
aws_my_region="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/placement/availability-zone | sed s/.$//)"
517-
_security_credentials="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/"$iam_role")"
512+
_security_credentials="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/"$iam_role")" || die "$imds_err (curl exit $?)"
518513
access_key_id="$(echo "$_security_credentials" | grep AccessKeyId | sed -e 's/ "AccessKeyId" : "//' -e 's/",$//')"
519514
access_key_secret="$(echo "$_security_credentials" | grep SecretAccessKey | sed -e 's/ "SecretAccessKey" : "//' -e 's/",$//')"
520515
security_token="$(echo "$_security_credentials" | grep Token | sed -e 's/ "Token" : "//' -e 's/",$//')"
@@ -562,8 +557,7 @@ EOF
562557
} | curl -s "https://ssm.$aws_my_region.amazonaws.com/" \
563558
-x "$proxy" -K- \
564559
-d "$request_data"
565-
)
566-
handle_curl_error $?
560+
) || handle_curl_error $?
567561
if ! echo "$response" | grep -q '^.*"InvalidParameters":\[\].*$' ||
568562
! echo "$response" | grep -q '^.*'"${param_name}"'.*$'; then
569563
# The response body holds the decrypted parameter value, so report only
@@ -725,7 +719,8 @@ check_aws_instance() {
725719
aws_instance=true
726720
# Check if EC2 instance identity document is accessible
727721
else
728-
curl_output="$(curl -s --connect-timeout 5 http://169.254.169.254/latest/dynamic/instance-identity/)"
722+
# A probe failure means this is not an EC2 instance, so keep going.
723+
curl_output="$(curl -s --connect-timeout 5 http://169.254.169.254/latest/dynamic/instance-identity/ || true)"
729724
if [ -n "$curl_output" ] && ! echo "$curl_output" | grep --silent -i 'not.*found'; then
730725
aws_instance=true
731726
fi
@@ -790,9 +785,7 @@ get_oauth_token() {
790785
else
791786
auth_payload="client_id=$cs_falcon_client_id&client_secret=$cs_falcon_client_secret"
792787
793-
token_result=$(echo "$auth_payload" | oauth_token_request "$(cs_cloud)" "${response_headers}")
794-
795-
handle_curl_error $?
788+
token_result=$(echo "$auth_payload" | oauth_token_request "$(cs_cloud)" "${response_headers}") || handle_curl_error $?
796789
797790
token=$(echo "$token_result" | json_value "access_token" | sed 's/ *$//g' | sed 's/^ *//g')
798791
if [ -z "$token" ]; then
@@ -807,8 +800,7 @@ get_oauth_token() {
807800
# Separate file: --dump-header truncates, and region_hint below
808801
# still needs the original response.
809802
retry_headers=$(mktemp)
810-
token_result=$(echo "$auth_payload" | oauth_token_request "$retry_host" "$retry_headers")
811-
handle_curl_error $?
803+
token_result=$(echo "$auth_payload" | oauth_token_request "$retry_host" "$retry_headers") || handle_curl_error $?
812804
rm -f "$retry_headers"
813805
token=$(echo "$token_result" | json_value "access_token" | sed 's/ *$//g' | sed 's/^ *//g')
814806
fi
@@ -842,8 +834,7 @@ get_oauth_token() {
842834
get_provisioning_token() {
843835
local check_settings is_required token_value
844836
# First, let's check if installation tokens are required
845-
check_settings=$(curl_command "https://$(cs_cloud)/installation-tokens/entities/customer-settings/v1")
846-
handle_curl_error $?
837+
check_settings=$(curl_command "https://$(cs_cloud)/installation-tokens/entities/customer-settings/v1") || handle_curl_error $?
847838

848839
if echo "$check_settings" | grep "authorization failed" >/dev/null; then
849840
# For now we just return. We can error out once more people get a chance to update their API keys
@@ -875,9 +866,7 @@ get_falcon_cid() {
875866
if [ -n "$FALCON_CID" ]; then
876867
echo "$FALCON_CID"
877868
else
878-
cs_target_cid=$(curl_command "https://$(cs_cloud)/sensors/queries/installers/ccid/v1")
879-
880-
handle_curl_error $?
869+
cs_target_cid=$(curl_command "https://$(cs_cloud)/sensors/queries/installers/ccid/v1") || handle_curl_error $?
881870

882871
if [ -z "$cs_target_cid" ]; then
883872
die "Unable to obtain CrowdStrike Falcon CID. Response was $cs_target_cid"

‎bash/install/falcon-linux-uninstall.sh‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -194,9 +194,7 @@ cs_remove_host_from_console() {
194194
payload="{\"ids\": [\"$aid\"]}"
195195
url="https://$(cs_cloud)/devices/entities/devices-actions/v2?action_name=hide_host"
196196

197-
curl_command -X "POST" -H "Content-Type: application/json" -d "$payload" "$url" >/dev/null
198-
199-
handle_curl_error $?
197+
curl_command -X "POST" -H "Content-Type: application/json" -d "$payload" "$url" >/dev/null || handle_curl_error $?
200198
fi
201199
}
202200

@@ -234,9 +232,7 @@ get_maintenance_token() {
234232
payload="{\"device_id\": \"$aid\", \"audit_message\": \"CrowdStrike Falcon Uninstall Bash Script\"}"
235233
url="https://$(cs_cloud)/policy/combined/reveal-uninstall-token/v1"
236234

237-
response=$(curl_command -X "POST" -H "Content-Type: application/json" -d "$payload" "$url")
238-
239-
handle_curl_error $?
235+
response=$(curl_command -X "POST" -H "Content-Type: application/json" -d "$payload" "$url") || handle_curl_error $?
240236

241237
if echo "$response" | grep -q "\"uninstall_token\""; then
242238
cs_maintenance_token=$(echo "$response" | json_value "uninstall_token" 1 | sed 's/ *$//g' | sed 's/^ *//g')
@@ -303,19 +299,20 @@ if [ "${ALLOW_LEGACY_CURL:-false}" = "true" ]; then
303299
fi
304300

305301
aws_ssm_parameter() {
306-
local param_name="$1"
302+
local param_name="$1" imds_err
307303

308304
hmac_sha256() {
309305
key="$1"
310306
data="$2"
311307
echo -n "$data" | openssl dgst -sha256 -mac HMAC -macopt "$key" | sed 's/^.* //'
312308
}
313309

314-
token=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
310+
imds_err="Failed to query the EC2 instance metadata service. Reading an SSM parameter needs IMDSv2 access from this host."
311+
token=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") || die "$imds_err (curl exit $?)"
315312
api_endpoint="AmazonSSM.GetParameters"
316-
iam_role="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/)"
313+
iam_role="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/)" || die "$imds_err (curl exit $?)"
317314
aws_my_region="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/placement/availability-zone | sed s/.$//)"
318-
_security_credentials="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/"$iam_role")"
315+
_security_credentials="$(printf 'header = "X-aws-ec2-metadata-token: %s"\n' "$token" | curl -s -K- http://169.254.169.254/latest/meta-data/iam/security-credentials/"$iam_role")" || die "$imds_err (curl exit $?)"
319316
access_key_id="$(echo "$_security_credentials" | grep AccessKeyId | sed -e 's/ "AccessKeyId" : "//' -e 's/",$//')"
320317
access_key_secret="$(echo "$_security_credentials" | grep SecretAccessKey | sed -e 's/ "SecretAccessKey" : "//' -e 's/",$//')"
321318
security_token="$(echo "$_security_credentials" | grep Token | sed -e 's/ "Token" : "//' -e 's/",$//')"
@@ -363,8 +360,7 @@ EOF
363360
} | curl -s "https://ssm.$aws_my_region.amazonaws.com/" \
364361
-x "$proxy" -K- \
365362
-d "$request_data"
366-
)
367-
handle_curl_error $?
363+
) || handle_curl_error $?
368364
if ! echo "$response" | grep -q '^.*"InvalidParameters":\[\].*$' ||
369365
! echo "$response" | grep -q '^.*'"${param_name}"'.*$'; then
370366
# The response body holds the decrypted parameter value, so report only
@@ -386,7 +382,8 @@ check_aws_instance() {
386382
aws_instance=true
387383
# Check if EC2 instance identity document is accessible
388384
else
389-
curl_output="$(curl -s --connect-timeout 5 http://169.254.169.254/latest/dynamic/instance-identity/)"
385+
# A probe failure means this is not an EC2 instance, so keep going.
386+
curl_output="$(curl -s --connect-timeout 5 http://169.254.169.254/latest/dynamic/instance-identity/ || true)"
390387
if [ -n "$curl_output" ] && ! echo "$curl_output" | grep --silent -i 'not.*found'; then
391388
aws_instance=true
392389
fi
@@ -451,9 +448,7 @@ get_oauth_token() {
451448
else
452449
auth_payload="client_id=$cs_falcon_client_id&client_secret=$cs_falcon_client_secret"
453450
454-
token_result=$(echo "$auth_payload" | oauth_token_request "$(cs_cloud)" "${response_headers}")
455-
456-
handle_curl_error $?
451+
token_result=$(echo "$auth_payload" | oauth_token_request "$(cs_cloud)" "${response_headers}") || handle_curl_error $?
457452
458453
token=$(echo "$token_result" | json_value "access_token" | sed 's/ *$//g' | sed 's/^ *//g')
459454
if [ -z "$token" ]; then
@@ -468,8 +463,7 @@ get_oauth_token() {
468463
# Separate file: --dump-header truncates, and region_hint below
469464
# still needs the original response.
470465
retry_headers=$(mktemp)
471-
token_result=$(echo "$auth_payload" | oauth_token_request "$retry_host" "$retry_headers")
472-
handle_curl_error $?
466+
token_result=$(echo "$auth_payload" | oauth_token_request "$retry_host" "$retry_headers") || handle_curl_error $?
473467
rm -f "$retry_headers"
474468
token=$(echo "$token_result" | json_value "access_token" | sed 's/ *$//g' | sed 's/^ *//g')
475469
fi

0 commit comments

Comments
 (0)