jdratlif · December 23, 2021 21:02 · jdratlif · Dec 22, 2021 · jafolkerts · Dec 22, 2021
diff --git a/fix-elk-log4j.bash b/fix-elk-log4j.bash
 #! /bin/bash

 if [[ -z $LOG4J_VERSION ]]; then
    LOG4J_VERSION=2.17.0
 fi

 ################################################################################
 # cleanup handler

 function cleanup {
    test -d $TEMPDIR && echo $TEMPDIR | grep '^/tmp/' > /dev/null 2>&1 && rm -rf $TEMPDIR
 }

 ################################################################################
 # make temp paths and register cleanup handler

 TEMPDIR=$(mktemp -d)

 trap cleanup EXIT

 ################################################################################
 # default to elasticsearch if no ELK variable exists

 if [[ -z $ELK ]]; then
    ELK="elasticsearch"
 fi

 ################################################################################
 # bail if ELK is not elasticsearch or logstash -- that's all we can handle

 if [[ $ELK = "elasticsearch" ]]; then
    LOG4J_PATH="/usr/share/elasticsearch"
 elif [[ $ELK = "logstash" ]]; then
    LOG4J_PATH="/usr/share/logstash"
 else
    echo "ELK must be either 'elasticsearch' or 'logstash'"
    exit 1
 fi

 ################################################################################
 # if we can't find the ELK path, bail

 if [ ! -d $LOG4J_PATH ]; then
    echo "$LOG4J_PATH does not exist. Are you sure this server runs ${ELK}?"
    exit 1
 fi

 ################################################################################
 # make sure we have curl or wget

 CURL_BIN=$(which curl 2> /dev/null)

 if [[ $? -eq 0 ]]; then
    HAS_CURL=true
 else
    HAS_CURL=false
 fi

 WGET_BIN=$(which wget 2> /dev/null)

 if [[ $? -eq 0 ]]; then
    HAS_WGET=true
 else
    HAS_WGET=false
 fi

 if ! ($HAS_CURL || $HAS_WGET); then
    echo "No curl or wget found in path. This script requires one of them."
    exit 1
 fi

 ################################################################################
 # are we running in live mode or dry-run?

 if [[ $1 = "--live" ]]; then
    LIVE=true
 else
    LIVE=false
 fi

 if $LIVE; then
    echo "This is a live run"
 else
    echo "This is not a live run; no changes will be made."
 fi

 echo

 ################################################################################
 # find affected log4j jars and list them

 log4j=$(find $LOG4J_PATH 2> /dev/null | grep -E 'log4j(-[a-z0-9]*)*-2\.[0-9]*\.[0-9]\.jar$')

 if [[ $? -ne 0 ]]; then
    echo "No files were found in $LOG4J_PATH"
    exit 0
 fi

 echo "Found the following log4j jar files..."
 echo "--------------------------------------------------------------------------------"

 for file in $log4j
 do
    echo $file
 done

 echo

 ################################################################################
 # backup the current elk path

 if $LIVE; then
    TEMP_BACKUP=$(mktemp --suffix=.tar.gz)

    echo "Creating backup of $LOG4J_PATH in $TEMP_BACKUP"
    echo

    cmd="sudo tar czf $TEMP_BACKUP $LOG4J_PATH 2>/dev/null"
    echo "$cmd"
    echo
    echo "Please wait..."
    eval $cmd

    if [[ $? -ne 0 ]]; then
        echo "Unable to create backup of $LOG4J_PATH"
        exit 1
    fi

    echo
 fi

 ################################################################################
 # fetch log4j version from apache

 if $LIVE; then
    echo "Fetching the updated apache log4j $LOG4J_VERSION package"
    echo

    FILENAME="apache-log4j-${LOG4J_VERSION}-bin.tar.gz"
    ARCHIVE="https://archive.apache.org/dist/logging/log4j/${LOG4J_VERSION}/${FILENAME}"
    SHA512="${ARCHIVE}.sha512"

    pushd $TEMPDIR

    if $HAS_CURL; then
        curl -O $ARCHIVE
        curl -O $SHA512
    else
        wget $ARCHIVE
        wget $SHA512
    fi

    echo
    echo

    TARBALL=${TEMPDIR}/${FILENAME}
    APACHE_SHA512=${TARBALL}.sha512
    LINUX_SHA512=${TARBALL}.sha512.linux

    cat $APACHE_SHA512 | tr -d '\n' | sed -E -e 's/\s*//g' -e 's/^('${FILENAME}'):([A-F0-9]*)/\2\t\1/g' > $LINUX_SHA512

    echo "Verifying the archive SHA512 sum"
    sha512sum -c $LINUX_SHA512

    if [[ $? -ne 0 ]]; then
        echo "SHA512 sum does not match expected value"
        exit 1
    fi

    echo "Extracting the archive to $TEMPDIR"
    tar xzf $TARBALL > /dev/null 2>&1

    if [[ $? -ne 0 ]]; then
        echo "Unable to extract archive"
        exit 1
    fi

    popd

    echo
 fi

 ################################################################################
 # replace old log4j versions

 COUNT=0

 for file in $log4j
 do
    dir=$(dirname $file)
    base=$(basename $file)

    newfile=$(echo $base | sed -E -e 's/2\.[0-9]*\.[0-9]/'${LOG4J_VERSION}'/')
    path_newfile="${TEMPDIR}/apache-log4j-${LOG4J_VERSION}-bin/${newfile}"

    if $LIVE; then
        if [ ! -f $path_newfile ]; then
            echo "Unable to find replacement library ${path_newfile}"
            continue
        fi
    fi

    echo "--------------------------------------------------------------------------------"
    echo $file | grep -E 'log4j(-[a-z0-9]*)*-'${LOG4J_VERSION}'\.jar$' > /dev/null 2>&1

    if [[ $? -eq 0 ]]; then
        echo "$file has already been updated to $LOG4J_VERSION"
    else
        COUNT=$(expr $COUNT + 1)

        echo "Replacing $file with $path_newfile"
        echo

        cmd="sudo rm -f $file"
        echo "$cmd"

        $LIVE && eval $cmd

        cmd="sudo cp -f ${TEMPDIR}/apache-log4j-${LOG4J_VERSION}-bin/${newfile} ${dir}"
        echo "$cmd"

        $LIVE && eval $cmd

        ############################################################################
        # ruby gems need their paths and dependency files updated, too

        GEM_PATH=$(echo $file | grep -o -E '(/[^/]*)*/gems/[^/]*')

        if [ ! -z $GEM_PATH ]; then
            echo
            echo "Found ruby GEM $GEM_PATH"
            echo

            jar_dir=$(dirname $file)
            new_jar_dir=$(echo $jar_dir | sed -E -e 's/2\.[0-9]*\.[0-9]$/'${LOG4J_VERSION}'/')

            echo "Renaming ${jar_dir} to ${new_jar_dir}"
            echo

            cmd="sudo mv '${jar_dir}' '${new_jar_dir}'"
            echo "$cmd"

            $LIVE && eval $cmd

            echo

            GEM_PATH="${GEM_PATH}/lib"

            rb_files=$(find $GEM_PATH -maxdepth 2 -iname "*.rb")

            for rb_file in $rb_files
            do
                echo "Fixing ruby dependency file $rb_file"
                echo

                cmd="sudo sed -E -i.bak -e '/org.apache.logging.log4j/ s/2\.[0-9]*\.[0-9]/'${LOG4J_VERSION}'/' $rb_file"
                echo "$cmd"

                if $LIVE; then
                    eval $cmd

                    cmd="diff -u ${rb_file}.bak $rb_file"
                    echo "$cmd"
                    echo
                    eval $cmd
                fi
            done
        fi
    fi

    echo "--------------------------------------------------------------------------------"
    echo
 done

 ################################################################################
 # tell the user what happened and the location of the backup path

 if $LIVE; then
    echo "Updated $COUNT log4j libraries"
    echo
    echo "--------------------------------------------------------------------------------"
    echo "A backup of $LOG4J_PATH has been saved in $TEMP_BACKUP if you need to revert."
    echo "You can delete this file if everything looks okay"
    echo "Don't forget to restart your elasticsearch or logstash process now"
    echo "--------------------------------------------------------------------------------"
    echo
 fi
	#! /bin/bash

	if [[ -z $LOG4J_VERSION ]]; then
	LOG4J_VERSION=2.17.0
	fi

	################################################################################
	# cleanup handler

	function cleanup {
	test -d $TEMPDIR && echo $TEMPDIR \| grep '^/tmp/' > /dev/null 2>&1 && rm -rf $TEMPDIR
	}

	################################################################################
	# make temp paths and register cleanup handler

	TEMPDIR=$(mktemp -d)

	trap cleanup EXIT

	################################################################################
	# default to elasticsearch if no ELK variable exists

	if [[ -z $ELK ]]; then
	ELK="elasticsearch"
	fi

	################################################################################
	# bail if ELK is not elasticsearch or logstash -- that's all we can handle

	if [[ $ELK = "elasticsearch" ]]; then
	LOG4J_PATH="/usr/share/elasticsearch"
	elif [[ $ELK = "logstash" ]]; then
	LOG4J_PATH="/usr/share/logstash"
	else
	echo "ELK must be either 'elasticsearch' or 'logstash'"
	exit 1
	fi

	################################################################################
	# if we can't find the ELK path, bail

	if [ ! -d $LOG4J_PATH ]; then
	echo "$LOG4J_PATH does not exist. Are you sure this server runs ${ELK}?"
	exit 1
	fi

	################################################################################
	# make sure we have curl or wget

	CURL_BIN=$(which curl 2> /dev/null)

	if [[ $? -eq 0 ]]; then
	HAS_CURL=true
	else
	HAS_CURL=false
	fi

	WGET_BIN=$(which wget 2> /dev/null)

	if [[ $? -eq 0 ]]; then
	HAS_WGET=true
	else
	HAS_WGET=false
	fi

	if ! ($HAS_CURL \|\| $HAS_WGET); then
	echo "No curl or wget found in path. This script requires one of them."
	exit 1
	fi

	################################################################################
	# are we running in live mode or dry-run?

	if [[ $1 = "--live" ]]; then
	LIVE=true
	else
	LIVE=false
	fi

	if $LIVE; then
	echo "This is a live run"
	else
	echo "This is not a live run; no changes will be made."
	fi

	echo

	################################################################################
	# find affected log4j jars and list them

	log4j=$(find $LOG4J_PATH 2> /dev/null \| grep -E 'log4j(-[a-z0-9])-2\.[0-9]*\.[0-9]\.jar$')

	if [[ $? -ne 0 ]]; then
	echo "No files were found in $LOG4J_PATH"
	exit 0
	fi

	echo "Found the following log4j jar files..."
	echo "--------------------------------------------------------------------------------"

	for file in $log4j
	do
	echo $file
	done

	echo

	################################################################################
	# backup the current elk path

	if $LIVE; then
	TEMP_BACKUP=$(mktemp --suffix=.tar.gz)

	echo "Creating backup of $LOG4J_PATH in $TEMP_BACKUP"
	echo

	cmd="sudo tar czf $TEMP_BACKUP $LOG4J_PATH 2>/dev/null"
	echo "$cmd"
	echo
	echo "Please wait..."
	eval $cmd

	if [[ $? -ne 0 ]]; then
	echo "Unable to create backup of $LOG4J_PATH"
	exit 1
	fi

	echo
	fi

	################################################################################
	# fetch log4j version from apache

	if $LIVE; then
	echo "Fetching the updated apache log4j $LOG4J_VERSION package"
	echo

	FILENAME="apache-log4j-${LOG4J_VERSION}-bin.tar.gz"
	ARCHIVE="https://archive.apache.org/dist/logging/log4j/${LOG4J_VERSION}/${FILENAME}"
	SHA512="${ARCHIVE}.sha512"

	pushd $TEMPDIR

	if $HAS_CURL; then
	curl -O $ARCHIVE
	curl -O $SHA512
	else
	wget $ARCHIVE
	wget $SHA512
	fi

	echo
	echo

	TARBALL=${TEMPDIR}/${FILENAME}
	APACHE_SHA512=${TARBALL}.sha512
	LINUX_SHA512=${TARBALL}.sha512.linux

	cat $APACHE_SHA512 \| tr -d '\n' \| sed -E -e 's/\s//g' -e 's/^('${FILENAME}'):([A-F0-9])/\2\t\1/g' > $LINUX_SHA512

	echo "Verifying the archive SHA512 sum"
	sha512sum -c $LINUX_SHA512

	if [[ $? -ne 0 ]]; then
	echo "SHA512 sum does not match expected value"
	exit 1
	fi

	echo "Extracting the archive to $TEMPDIR"
	tar xzf $TARBALL > /dev/null 2>&1

	if [[ $? -ne 0 ]]; then
	echo "Unable to extract archive"
	exit 1
	fi

	popd

	echo
	fi

	################################################################################
	# replace old log4j versions

	COUNT=0

	for file in $log4j
	do
	dir=$(dirname $file)
	base=$(basename $file)

	newfile=$(echo $base \| sed -E -e 's/2\.[0-9]*\.[0-9]/'${LOG4J_VERSION}'/')
	path_newfile="${TEMPDIR}/apache-log4j-${LOG4J_VERSION}-bin/${newfile}"

	if $LIVE; then
	if [ ! -f $path_newfile ]; then
	echo "Unable to find replacement library ${path_newfile}"
	continue
	fi
	fi

	echo "--------------------------------------------------------------------------------"
	echo $file \| grep -E 'log4j(-[a-z0-9])-'${LOG4J_VERSION}'\.jar$' > /dev/null 2>&1

	if [[ $? -eq 0 ]]; then
	echo "$file has already been updated to $LOG4J_VERSION"
	else
	COUNT=$(expr $COUNT + 1)

	echo "Replacing $file with $path_newfile"
	echo

	cmd="sudo rm -f $file"
	echo "$cmd"

	$LIVE && eval $cmd

	cmd="sudo cp -f ${TEMPDIR}/apache-log4j-${LOG4J_VERSION}-bin/${newfile} ${dir}"
	echo "$cmd"

	$LIVE && eval $cmd

	############################################################################
	# ruby gems need their paths and dependency files updated, too

	GEM_PATH=$(echo $file \| grep -o -E '(/[^/])/gems/[^/]*')

	if [ ! -z $GEM_PATH ]; then
	echo
	echo "Found ruby GEM $GEM_PATH"
	echo

	jar_dir=$(dirname $file)
	new_jar_dir=$(echo $jar_dir \| sed -E -e 's/2\.[0-9]*\.[0-9]$/'${LOG4J_VERSION}'/')

	echo "Renaming ${jar_dir} to ${new_jar_dir}"
	echo

	cmd="sudo mv '${jar_dir}' '${new_jar_dir}'"
	echo "$cmd"

	$LIVE && eval $cmd

	echo

	GEM_PATH="${GEM_PATH}/lib"

	rb_files=$(find $GEM_PATH -maxdepth 2 -iname "*.rb")

	for rb_file in $rb_files
	do
	echo "Fixing ruby dependency file $rb_file"
	echo

	cmd="sudo sed -E -i.bak -e '/org.apache.logging.log4j/ s/2\.[0-9]*\.[0-9]/'${LOG4J_VERSION}'/' $rb_file"
	echo "$cmd"

	if $LIVE; then
	eval $cmd

	cmd="diff -u ${rb_file}.bak $rb_file"
	echo "$cmd"
	echo
	eval $cmd
	fi
	done
	fi
	fi

	echo "--------------------------------------------------------------------------------"
	echo
	done

	################################################################################
	# tell the user what happened and the location of the backup path

	if $LIVE; then
	echo "Updated $COUNT log4j libraries"
	echo
	echo "--------------------------------------------------------------------------------"
	echo "A backup of $LOG4J_PATH has been saved in $TEMP_BACKUP if you need to revert."
	echo "You can delete this file if everything looks okay"
	echo "Don't forget to restart your elasticsearch or logstash process now"
	echo "--------------------------------------------------------------------------------"
	echo
	fi