Skip to content

fix(purpur): apply log4j mitigations specific to Purpur #1280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jan 17, 2022
Merged

fix(purpur): apply log4j mitigations specific to Purpur #1280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
135a557
fix(purpur): apply log4j mitigations specific to Purpur
itzg Jan 15, 2022
e31b9d8
Test the test branches
itzg Jan 15, 2022
40e5e1a
Put back the push attribute
itzg Jan 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/workflows/build-multiarch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ on:
- java11*
- java16*
- java17*
- test/**
tags:
- "[0-9]+.[0-9]+.[0-9]+"
- "[0-9]+.[0-9]+.[0-9]+-java8-multiarch"
Expand Down Expand Up @@ -56,7 +57,7 @@ jobs:

- name: Build for test
uses: docker/build-push-action@v2.7.0
if: github.ref_name == 'master'
if: github.ref_name == 'master' || startsWith(github.ref_name, 'test/')
with:
context: .
platforms: linux/amd64
Expand All @@ -70,7 +71,7 @@ jobs:

- name: Run tests
# It is assumed that image variants are merged from master and tested there
if: github.ref_name == 'master'
if: github.ref_name == 'master' || startsWith(github.ref_name, 'test/')
run: |
tests/test.sh

Expand All @@ -80,7 +81,7 @@ jobs:
with:
context: .
platforms: linux/amd64,linux/arm/v7,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
push: true
tags: ${{ steps.meta.outputs.tags }}
# ensure latest base image is used
pull: true
Expand Down
3 changes: 1 addition & 2 deletions scripts/start-deployAirplane
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,7 @@ if [ ! -f "$SERVER" ] || isTrue "${FORCE_REDOWNLOAD:-false}"; then
fi

# Normalize on Spigot for later operations
export TYPE=SPIGOT
export FAMILY=SPIGOT
export SKIP_LOG4J_CONFIG=true

exec ${SCRIPTS:-/}start-spiget "$@"
exec "${SCRIPTS:-/}start-spiget" "$@"
1 change: 0 additions & 1 deletion scripts/start-deployBukkitSpigot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,6 @@ else
fi

# Normalize on Spigot for operations below
export TYPE=SPIGOT
export FAMILY=SPIGOT
export SKIP_LOG4J_CONFIG=true

Expand Down
1 change: 0 additions & 1 deletion scripts/start-deployCanyon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,6 @@ if [ ! -f "$SERVER" ]; then
fi

# Normalize on Spigot for later operations
export TYPE=SPIGOT
export FAMILY=SPIGOT
export SKIP_LOG4J_CONFIG=true

Expand Down
1 change: 0 additions & 1 deletion scripts/start-deployPaper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,6 @@ else
fi

# Normalize on Spigot for downstream operations
export TYPE=SPIGOT
export FAMILY=SPIGOT
export SKIP_LOG4J_CONFIG=true

Expand Down
1 change: 0 additions & 1 deletion scripts/start-deployPufferfish
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ if [ ! -f "$SERVER" ] || isTrue "${FORCE_REDOWNLOAD:-false}"; then
fi

# Normalize on Spigot for later operations
export TYPE=SPIGOT
export FAMILY=SPIGOT
export SKIP_LOG4J_CONFIG=true

Expand Down
1 change: 0 additions & 1 deletion scripts/start-deployPurpur
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ if [ ! -f "$SERVER" ] || isTrue "$FORCE_REDOWNLOAD"; then
fi

# Normalize on Spigot for later operations
export TYPE=SPIGOT
export FAMILY=SPIGOT
export SKIP_LOG4J_CONFIG=true

Expand Down
5 changes: 5 additions & 0 deletions scripts/start-finalExec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,11 @@ elif isFamily VANILLA && versionLessThan 1.12; then
patchLog4jConfig log4j2_17-111.xml https://launcher.mojang.com/v1/objects/dd2b723346a8dcd48e7f4d245f6bf09e98db9696/log4j2_17-111.xml
elif isFamily VANILLA && versionLessThan 1.17; then
patchLog4jConfig log4j2_112-116.xml https://launcher.mojang.com/v1/objects/02937d122c86ce73319ef9975b58896fc1b491d1/log4j2_112-116.xml
# See https://purpurmc.org/docs/Log4j/
elif isType PURPUR && versionLessThan 1.17; then
patchLog4jConfig purpur_log4j2_1141-1165.xml https://purpurmc.org/docs/xml/purpur_log4j2_1141-1165.xml
elif isType PURPUR && versionLessThan 1.18.1; then
patchLog4jConfig purpur_log4j2_117.xml https://purpurmc.org/docs/xml/purpur_log4j2_117.xml
elif versionLessThan 1.18.1; then
JVM_OPTS="-Dlog4j2.formatMsgNoLookups=true ${JVM_OPTS}"
fi
Expand Down
7 changes: 4 additions & 3 deletions scripts/start-setupModconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
#!/bin/bash

. ${SCRIPTS:-/}start-utils
# shellcheck source=start-utils
. "${SCRIPTS:-/}start-utils"

# If supplied with a URL for a config (simple zip of configurations), download it and unpack
if [[ "$MODCONFIG" ]]; then
Expand All @@ -9,7 +10,7 @@ case "X$MODCONFIG" in
log "Downloading mod/plugin configs via HTTP"
log " from $MODCONFIG ..."
curl -sSL -o /tmp/modconfig.zip "$MODCONFIG"
if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
mkdir -p /data/plugins
unzip -o -d /data/plugins /tmp/modconfig.zip
else
Expand All @@ -24,4 +25,4 @@ case "X$MODCONFIG" in
esac
fi

exec ${SCRIPTS:-/}start-setupMounts $@
exec "${SCRIPTS:-/}start-setupMounts" "$@"
6 changes: 3 additions & 3 deletions scripts/start-setupModpack
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ if [[ "$MODPACK" ]]; then
exit 1
fi

if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
mkdir -p /data/plugins
if ! unzip -o -d /data/plugins /tmp/modpack.zip; then
log "ERROR: failed to unzip the modpack from ${MODPACK}"
Expand All @@ -81,7 +81,7 @@ if [[ "$MODPACK" ]]; then
rm -f /tmp/modpack.zip

elif [[ "$MODS" ]]; then
if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
out_dir=/data/plugins
else
out_dir=/data/mods
Expand Down Expand Up @@ -118,7 +118,7 @@ elif [[ "$MODS_FILE" ]]; then
exit 2
fi

if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
out_dir=/data/plugins
else
out_dir=/data/mods
Expand Down
27 changes: 14 additions & 13 deletions scripts/start-setupMounts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,15 @@
#!/bin/bash

. ${SCRIPTS:-/}start-utils
# shellcheck source=start-utils
. "${SCRIPTS:-/}start-utils"

: ${SYNC_SKIP_NEWER_IN_DESTINATION:=${PLUGINS_SYNC_UPDATE:-true}}
: ${REPLACE_ENV_DURING_SYNC:=true}
: ${REPLACE_ENV_SUFFIXES:=yml,yaml,txt,cfg,conf,properties,hjson,json,tml,toml}
: ${REPLACE_ENV_VARIABLE_PREFIX:=${ENV_VARIABLE_PREFIX:-CFG_}}
: ${REPLACE_ENV_VARIABLES_EXCLUDES:=}
: ${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS:=}
: ${DEBUG:=false}
: "${SYNC_SKIP_NEWER_IN_DESTINATION:=${PLUGINS_SYNC_UPDATE:-true}}"
: "${REPLACE_ENV_DURING_SYNC:=true}"
: "${REPLACE_ENV_SUFFIXES:=yml,yaml,txt,cfg,conf,properties,hjson,json,tml,toml}"
: "${REPLACE_ENV_VARIABLE_PREFIX:=${ENV_VARIABLE_PREFIX:-CFG_}}"
: "${REPLACE_ENV_VARIABLES_EXCLUDES:=}"
: "${REPLACE_ENV_VARIABLES_EXCLUDE_PATHS:=}"
: "${DEBUG:=false}"

set -e
isDebugging && set -x
Expand All @@ -24,8 +25,8 @@ else
fi

if [ -d /plugins ]; then
case ${TYPE} in
SPIGOT|BUKKIT|PAPER|MAGMA)
case ${FAMILY} in
SPIGOT|HYBRID)
Copy link
Contributor

@shotah shotah Jan 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

excuse my ignorance, but where is HYBRID coming from?

Copy link
Owner Author

@itzg itzg Jan 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a convention I had to make up for grouping all the various server types. Here's one example

docker-minecraft-server/scripts/start-deployMagma

Line 92 in f29f098

export FAMILY=HYBRID

Copy link
Contributor

@shotah shotah Jan 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see it now. This looks good to me if you've tested it. 👍

Copy link
Owner Author

@itzg itzg Jan 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I'll go ahead and merge it since I had already forgotten about this PR 😊

mkdir -p /data/plugins
log "Copying plugins over..."
mc-image-helper \
Expand All @@ -40,7 +41,7 @@ if [ -d /plugins ]; then
fi

# If any modules have been provided, copy them over
: ${COPY_MODS_DEST:="/data/mods"}
: "${COPY_MODS_DEST:="/data/mods"}"

if [ -d /mods ]; then
log "Copying any mods over..."
Expand All @@ -53,7 +54,7 @@ if [ -d /mods ]; then
/mods "${COPY_MODS_DEST}"
fi

: ${COPY_CONFIG_DEST:="/data/config"}
: "${COPY_CONFIG_DEST:="/data/config"}"

if [ -d /config ]; then
log "Copying any configs from /config to ${COPY_CONFIG_DEST}"
Expand All @@ -66,4 +67,4 @@ if [ -d /config ]; then
/config "${COPY_CONFIG_DEST}"
fi

exec ${SCRIPTS:-/}start-setupServerProperties $@
exec "${SCRIPTS:-/}start-setupServerProperties" "$@"
6 changes: 3 additions & 3 deletions scripts/start-setupWorld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ if [[ "$WORLD" ]] && ( isTrue "${FORCE_WORLD_COPY}" || [ ! -d "$worldDest" ] );
mkdir -p /tmp/world-data
(cd /tmp/world-data && unzip -o -q "$zipSrc")

if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
baseDirs=$(find /tmp/world-data -name "level.dat" -not -path "*_nether*" -not -path "*_the_end*" -exec dirname "{}" \;)
else
baseDirs=$(find /tmp/world-data -name "level.dat" -exec dirname "{}" \;)
Expand All @@ -51,7 +51,7 @@ if [[ "$WORLD" ]] && ( isTrue "${FORCE_WORLD_COPY}" || [ ! -d "$worldDest" ] );
exit 1
fi
rsync --remove-source-files --recursive --delete "$baseDir/" "$worldDest"
if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
log "Copying end and nether ..."
[ -d "${baseDir}_nether" ] && rsync --remove-source-files --recursive --delete "${baseDir}_nether/" "${worldDest}_nether"
[ -d "${baseDir}_the_end" ] && rsync --remove-source-files --recursive --delete "${baseDir}_the_end/" "${worldDest}_the_end"
Expand All @@ -61,7 +61,7 @@ if [[ "$WORLD" ]] && ( isTrue "${FORCE_WORLD_COPY}" || [ ! -d "$worldDest" ] );
rsync --recursive --delete "${WORLD%/}"/ "$worldDest"
fi

if [ "$TYPE" = "SPIGOT" ]; then
if [ "$FAMILY" = "SPIGOT" ]; then
# Reorganise if a Spigot server
log "Moving End and Nether maps to Spigot location"
[ -d "$worldDest/DIM1" ] && mv -f "$worldDest/DIM1" "${worldDest}_the_end"
Expand Down
9 changes: 9 additions & 0 deletions scripts/start-utils
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,5 +178,14 @@ function isFamily() {
return 0
fi
done

return 1
}
function isType() {
for t in "${@}"; do
if [[ $TYPE == "$t" ]]; then
return 0
fi
done
return 1
}