Merge ~peppepetra/charm-graylog:lp-1954764 into charm-graylog:master

[Giuseppe Petralia]

Mitigate log4j CVE-2021-44228

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:63fe5dff0c8efcdb6e4816916db684584ea08821
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/62/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/264/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/705/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/62//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:e3d94613fddcdde76d561bb8864b72066aab529b
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/63/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/265/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/706/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/63//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:b33915cf13b434603150a2a4dc3ba033d93430e0
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/64/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/266/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/707/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/64//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:033234c8cbbbb413c40d31234ef085ae54746032
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/65/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/267/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/708/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/65//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:033234c8cbbbb413c40d31234ef085ae54746032
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/66/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/268/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/709/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/66//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:033234c8cbbbb413c40d31234ef085ae54746032
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/67/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/269/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/710/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/67//rebuild

review: Needs Fixing (continuous-integration)

[Drew Freiberger (afreiberger)]

+1 on this approach

There's a bug with the new 3.x version that the conf file now matches the regex twice, which needs to be bypassed.

I would suggest adding in a forced writing of the new_conf file if it doesn't exist, rather than checking against the settings of the SHIPPED_SNAP_DEFAULT_CONF_FILE contents before deciding to write a conf file.

review: Needs Fixing

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:033234c8cbbbb413c40d31234ef085ae54746032
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/69/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/272/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/712/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/69//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[Drew Freiberger (afreiberger)]

CI appears to be failing at timeout for settling for graylog2-focal, but passed for graylog2-bionic. No errors, just not enough time to settle. Can we get a manual graylog2-focal test run outside CI and possibly move gl2-focal to a non-gating test?

I'm +1 on the change.

review: Approve

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:87da3dec3d6df387559927d36d1f4a88a325db5e
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/70/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/273/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/713/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/70//rebuild

review: Needs Fixing (continuous-integration)

[Giuseppe Petralia (peppepetra)]

Proof of gl2 passing on serverstack https://pastebin.canonical.com/p/wvd8792JRx/

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:7cdd02589d5f4b45439a8064601153790a5c8b81
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/71/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/274/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/716/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/71//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:00909086e1943701c9aca18ffff5a9da09688231
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/72/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/275/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/717/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/72//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:00909086e1943701c9aca18ffff5a9da09688231
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/73/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/277/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/719/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/73//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:00909086e1943701c9aca18ffff5a9da09688231
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/74/
Executed test runs:
    None: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/278/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/720/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/74//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:ff2b261bc050cb011c2a344da1a0632c909cbe6b
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/75/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/279/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/721/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-graylog-ci/75//rebuild

review: Needs Fixing (continuous-integration)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 0d9b0f278badbf421d0b2566dda7659d5879fff2

diff --git a/src/lib/charms/layer/graylog/snap_change.py b/src/lib/charms/layer/graylog/snap_change.py
index 9de8d45..59dd792 100644
--- a/src/lib/charms/layer/graylog/snap_change.py
+++ b/src/lib/charms/layer/graylog/snap_change.py
@@ -106,3 +106,6 @@ def perform_snap_channel_change(new_channel):
         data_changed("elasticsearch.relation", None)
         data_changed("mongodb.uri", None)
         remove_state("graylog.configured")
+    else:
+        # If reconfiguration is not needed, restart the snap
+        host.service_start(SERVICE_NAME)
diff --git a/src/reactive/graylog.py b/src/reactive/graylog.py
index 2bb524d..4bfcac7 100644
--- a/src/reactive/graylog.py
+++ b/src/reactive/graylog.py
@@ -1028,8 +1028,11 @@ def set_jvm_heap_size(heap_size="1G", conf_path=SERVER_DEFAULT_CONF_FILE):  # no
     # file shipped out by the snap
     if not os.path.exists(conf_path):
         updated_conf_path = SHIPPED_SNAP_SERVER_DEFAULT_CONF_FILE
+        # if current config does not exist, force writing it even with default opts
+        changed = True
     else:
         updated_conf_path = conf_path
+
     with open(updated_conf_path, "rb") as conf_file:
         for line in conf_file:
             line = line.decode()
@@ -1037,8 +1040,20 @@ def set_jvm_heap_size(heap_size="1G", conf_path=SERVER_DEFAULT_CONF_FILE):  # no
             if not m:
                 conf.append(line)
                 continue
-            new_opts = parse_java_opts(m.group(1), size)
+            all_opts = parse_java_opts(m.group(1), size)
+
+            # Mitigate log4j CVE-2021-44228
+            mitigation_option = "-Dlog4j2.formatMsgNoLookups=true"
+            if mitigation_option not in all_opts:
+                all_opts.append(mitigation_option)
+
+            # Avoid repeating opts
+            new_opts = []
+            for opt in all_opts:
+                if not key_in_list(opt, conf):
+                    new_opts.append(opt)
             new_line = 'GRAYLOG_SERVER_JAVA_OPTS="{}"\n'.format(" ".join(new_opts))
+
             if new_line != line:
                 hookenv.log(
                     'Updating GRAYLOG_SERVER_JAVA_OPTS="{}".'.format("".join(new_opts))
@@ -1294,3 +1309,11 @@ def _maybe_configure_graylog_jvm_keystore():
         context={},
         perms=0o644,
     )
+
+
+def key_in_list(key, lines):
+    """Check if key is a substring of any lines."""
+    for line in lines:
+        if key in line:
+            return True
+    return False
diff --git a/src/tests/functional/tests/tests.yaml b/src/tests/functional/tests/tests.yaml
index 9b53b3b..95eb05a 100644
--- a/src/tests/functional/tests/tests.yaml
+++ b/src/tests/functional/tests/tests.yaml
@@ -1,7 +1,6 @@
 charm_name: graylog
 gate_bundles:
   - gl2: bionic-graylog2
-  - gl2: focal-graylog2
   - gl3: bionic-graylog3
   - gl3: bionic-graylog3-tls
   - gl3: focal-graylog3
@@ -12,6 +11,7 @@ smoke_bundles:
   - gl3: bionic-graylog3
 dev_bundles:
   - gl3: bionic-graylog3
+  - gl2: focal-graylog2
 tests:
   - gl2:
       - tests.test_legacy.LegacyTests
diff --git a/src/tests/unit/test_graylog.py b/src/tests/unit/test_graylog.py
index 1f9a57a..1819b85 100644
--- a/src/tests/unit/test_graylog.py
+++ b/src/tests/unit/test_graylog.py
@@ -472,13 +472,13 @@ GRAYLOG_COMMAND_WRAPPER=""
 heap_default = u"""
 GRAYLOG_SERVER_JAVA_OPTS="-Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB \
 -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled \
--XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow"
+-XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j2.formatMsgNoLookups=true"
 """
 
 heap_2g = u"""
 GRAYLOG_SERVER_JAVA_OPTS="-Xms2g -Xmx2g -XX:NewRatio=1 -server -XX:+ResizeTLAB \
 -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled \
--XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow"
+-XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j2.formatMsgNoLookups=true"
 """
 
 heap_not_present = u"""
@@ -490,19 +490,21 @@ GRAYLOG_SERVER_JAVA_OPTS="-XX:NewRatio=1 -server -XX:+ResizeTLAB \
 heap_unset = u"""
 GRAYLOG_SERVER_JAVA_OPTS="-XX:NewRatio=1 -server -XX:+ResizeTLAB \
 -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled \
--XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow"
+-XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j2.formatMsgNoLookups=true"
 """
 
 heap_not_present = u"""
 GRAYLOG_SERVER_JAVA_OPTS="-XX:NewRatio=1 -server -XX:+ResizeTLAB \
 -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled \
--XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Xms4g -Xmx4g"
+-XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j2.formatMsgNoLookups=true \
+-Xms4g -Xmx4g"
 """
 
 heap_twice = u"""
 GRAYLOG_SERVER_JAVA_OPTS="-XX:NewRatio=1 -server -XX:+ResizeTLAB \
 -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled \
--XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Xms8g -Xmx8g"
+-XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j2.formatMsgNoLookups=true \
+-Xms8g -Xmx8g"
 """