@oneuptime/common 12.0.27 → 12.0.29

package/Server/Utils/Greenlock/Greenlock.ts

@@ -16,11 +16,64 @@ import ServerException from "../../../Types/Exception/ServerException";
 import Text from "../../../Types/Text";
 import AcmeCertificate from "../../../Models/DatabaseModels/AcmeCertificate";
 import AcmeChallenge from "../../../Models/DatabaseModels/AcmeChallenge";
+import ArrayUtil from "../../../Utils/Array";
 import acme from "acme-client";
 import { Challenge } from "acme-client/types/rfc8555";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 
 export default class GreenlockUtil {
+  /*
+   * How early a certificate is renewed, as a range rather than a single value.
+   *
+   * Let's Encrypt issues for 90 days, so every domain ordered on the same day
+   * expires on the same day. Renewing them all at one fixed lead time keeps
+   * that batch together for every cycle that follows, and a single bad day -
+   * an upstream outage, a rate limit, a run that does not finish - then expires
+   * the whole batch at once instead of one domain.
+   *
+   * Spreading the lead time across a range pulls the batch apart: domains that
+   * expire on the same day come due days apart, and having been renewed days
+   * apart they expire days apart next cycle too. The offset is derived from the
+   * domain name so it is stable - a domain must not drift in and out of
+   * eligibility between two runs, which would leave it renewed by neither.
+   */
+  public static readonly RENEW_LEAD_TIME_MAX_IN_DAYS: number = 40;
+  public static readonly RENEW_LEAD_TIME_MIN_IN_DAYS: number = 25;
+
+  /*
+   * A run renews at most this many domains, at most this many at a time.
+   *
+   * Both bound how much of a backlog is dispatched at once. Let's Encrypt
+   * allows 300 new orders per account per three hours, and the reactive
+   * provisioning sweep spends from the same allowance, so a run that tried to
+   * clear a large backlog in one pass would spend the account's budget and get
+   * the renewals behind it refused. At the schedule this job runs on the cap
+   * still clears far more per day than one sequential daily pass ever did,
+   * while leaving room under the limit.
+   */
+  public static readonly RENEW_MAX_PER_RUN: number = 10;
+  public static readonly RENEW_CONCURRENCY: number = 5;
+
+  /*
+   * Stable per-domain lead time, somewhere in the range above. Same domain,
+   * same answer, on every run and every replica.
+   */
+  public static getRenewalLeadTimeInDays(domain: string): number {
+    const spanInDays: number =
+      GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS -
+      GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS;
+
+    let hash: number = 0;
+
+    for (let i: number = 0; i < domain.length; i++) {
+      hash = (hash * 31 + domain.charCodeAt(i)) % 1000003;
+    }
+
+    return (
+      GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS + (hash % (spanInDays + 1))
+    );
+  }
+
   @CaptureSpan()
   public static async renewAllCertsWhichAreExpiringSoon(data: {
     validateCname: (domain: string) => Promise<boolean>;
@@ -29,15 +82,17 @@ export default class GreenlockUtil {
     try {
       logger.debug("Renewing all certificates");
 
-      // get all certificates which are expiring soon
-
+      /*
+       * Read the widest window any domain's lead time can make it due in, then
+       * keep only the domains whose own lead time has actually been reached.
+       */
       const certificates: AcmeCertificate[] =
         await AcmeCertificateService.findBy({
           query: {
             expiresAt: QueryHelper.lessThanEqualTo(
               OneUptimeDate.addRemoveDays(
                 OneUptimeDate.getCurrentDate(),
-                40, // 40 days before expiry
+                GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS,
               ),
             ),
           },
@@ -45,6 +100,7 @@ export default class GreenlockUtil {
           skip: 0,
           select: {
             domain: true,
+            expiresAt: true,
           },
           sort: {
             expiresAt: SortOrder.Ascending,
@@ -54,76 +110,118 @@ export default class GreenlockUtil {
           },
         });
 
+      const now: Date = OneUptimeDate.getCurrentDate();
+
+      const dueCertificates: AcmeCertificate[] = certificates.filter(
+        (certificate: AcmeCertificate) => {
+          if (!certificate.domain || !certificate.expiresAt) {
+            return false;
+          }
+
+          const renewAt: Date = OneUptimeDate.addRemoveDays(
+            certificate.expiresAt,
+            -GreenlockUtil.getRenewalLeadTimeInDays(certificate.domain),
+          );
+
+          return !OneUptimeDate.isAfter(renewAt, now);
+        },
+      );
+
+      /*
+       * Still sorted by expiry, so a run that cannot take the whole backlog
+       * spends itself on the domains closest to expiring and leaves the rest -
+       * which by construction still have weeks of lead time - to the next run.
+       */
+      const batch: AcmeCertificate[] = dueCertificates.slice(
+        0,
+        GreenlockUtil.RENEW_MAX_PER_RUN,
+      );
+
       logger.debug(
-        `Found ${certificates.length} certificates which are expiring soon`,
-        { certificateCount: certificates.length },
+        `Found ${dueCertificates.length} certificates due for renewal, renewing ${batch.length} in this run`,
+        {
+          dueCount: dueCertificates.length,
+          batchCount: batch.length,
+        },
+      );
+
+      await ArrayUtil.forEachWithConcurrency(
+        batch,
+        GreenlockUtil.RENEW_CONCURRENCY,
+        async (certificate: AcmeCertificate): Promise<void> => {
+          await GreenlockUtil.renewCertForDomain({
+            domain: certificate.domain as string,
+            validateCname: data.validateCname,
+            notifyDomainRemoved: data.notifyDomainRemoved,
+          });
+        },
       );
+    } catch (e) {
+      logger.error("Error renewing all certificates");
+      logger.error(e);
 
-      // order certificate for each domain
+      throw e;
+    }
+  }
 
-      for (const certificate of certificates) {
-        if (!certificate.domain) {
-          continue;
-        }
+  /*
+   * Renew one domain. Never throws: one domain that cannot be renewed - a CNAME
+   * that no longer points here, a challenge the CA would not accept - must not
+   * take down the rest of the run with it.
+   */
+  private static async renewCertForDomain(data: {
+    domain: string;
+    validateCname: (domain: string) => Promise<boolean>;
+    notifyDomainRemoved: (domain: string) => Promise<void>;
+  }): Promise<void> {
+    const { domain } = data;
+
+    const certLogAttributes: LogAttributes = {
+      domain: domain,
+    };
 
-        const certLogAttributes: LogAttributes = {
-          domain: certificate.domain,
-        };
+    logger.debug(
+      `Renewing certificate for domain: ${domain}`,
+      certLogAttributes,
+    );
 
+    try {
+      //validate cname
+      const isValidCname: boolean = await data.validateCname(domain);
+
+      if (!isValidCname) {
         logger.debug(
-          `Renewing certificate for domain: ${certificate.domain}`,
+          `CNAME is not valid for domain: ${domain}`,
           certLogAttributes,
         );
 
-        try {
-          //validate cname
-          const isValidCname: boolean = await data.validateCname(
-            certificate.domain,
-          );
-
-          if (!isValidCname) {
-            logger.debug(
-              `CNAME is not valid for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
-
-            // if cname is not valid then remove the domain
-            await GreenlockUtil.removeDomain(certificate.domain);
-            await data.notifyDomainRemoved(certificate.domain);
+        // if cname is not valid then remove the domain
+        await GreenlockUtil.removeDomain(domain);
+        await data.notifyDomainRemoved(domain);
 
-            logger.error(
-              `Cname is not valid for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
-          } else {
-            logger.debug(
-              `CNAME is valid for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
+        logger.error(
+          `Cname is not valid for domain: ${domain}`,
+          certLogAttributes,
+        );
+      } else {
+        logger.debug(`CNAME is valid for domain: ${domain}`, certLogAttributes);
 
-            await GreenlockUtil.orderCert({
-              domain: certificate.domain,
-              validateCname: data.validateCname,
-            });
+        await GreenlockUtil.orderCert({
+          domain: domain,
+          validateCname: data.validateCname,
+        });
 
-            logger.debug(
-              `Certificate renewed for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
-          }
-        } catch (e) {
-          logger.error(
-            `Error renewing certificate for domain: ${certificate.domain}`,
-            certLogAttributes,
-          );
-          logger.error(e, certLogAttributes);
-        }
+        logger.debug(
+          `Certificate renewed for domain: ${domain}`,
+          certLogAttributes,
+        );
       }
     } catch (e) {
-      logger.error("Error renewing all certificates");
-      logger.error(e);
-
-      throw e;
+      logger.error(
+        `Error renewing certificate for domain: ${domain}`,
+        certLogAttributes,
+      );
+      logger.error(e, certLogAttributes);
     }
   }
 

package/Server/Utils/LogPipelineProcessorValidation.ts

@@ -0,0 +1,112 @@
+import BadDataException from "../../Types/Exception/BadDataException";
+import { JSONObject } from "../../Types/JSON";
+import LogPipelineProcessorType, {
+  GrokParserConfig,
+} from "../../Types/Log/LogPipelineProcessorType";
+import { compileGrokPattern } from "../../Utils/Grok/Grok";
+
+/*
+ * Save-time validation for log pipeline processors.
+ *
+ * A processor that cannot do anything is worse than a rejected one: it
+ * sits in the pipeline list looking configured while every log flows
+ * past it untouched, and nothing surfaces the fact. That is exactly how
+ * GrokParser behaved before it was implemented
+ * (OneUptime/oneuptime#2515).
+ *
+ * The grok pattern is the one field where a typo is both easy and
+ * invisible - `%{IPV4:client ip}` or a stray bracket compiles to
+ * nothing. Compiling it here is cheap, happens once per human edit, and
+ * puts the error in front of the only person who can fix it. The ingest
+ * path stays defensive anyway: rows saved before this validation
+ * existed still fail closed to "leave the log alone".
+ */
+
+/*
+ * Prefixes become the leading part of an attribute key, so hold them to
+ * what an attribute key can sensibly be.
+ */
+const TARGET_PREFIX_REGEX: RegExp = /^[A-Za-z_][A-Za-z0-9_.@:-]*$/;
+
+export interface LogPipelineProcessorCandidate {
+  processorType: string | undefined | null;
+  configuration: JSONObject | string | undefined | null;
+}
+
+/*
+ * `configuration` is a jsonb column, but the dashboard's JSON form field
+ * has historically persisted it as a JSON string literal - so both
+ * shapes reach here (see LogPipelineService.normalizeProcessorConfig).
+ */
+function readConfiguration(
+  configuration: JSONObject | string | undefined | null,
+): JSONObject | null {
+  if (configuration && typeof configuration === "object") {
+    return configuration as JSONObject;
+  }
+
+  if (typeof configuration === "string") {
+    try {
+      const parsed: unknown = JSON.parse(configuration);
+
+      if (parsed && typeof parsed === "object") {
+        return parsed as JSONObject;
+      }
+    } catch {
+      throw new BadDataException("Processor configuration is not valid JSON.");
+    }
+  }
+
+  return null;
+}
+
+export function validateLogPipelineProcessor(
+  candidate: LogPipelineProcessorCandidate,
+): void {
+  if (candidate.processorType !== LogPipelineProcessorType.GrokParser) {
+    return;
+  }
+
+  const configuration: JSONObject | null = readConfiguration(
+    candidate.configuration,
+  );
+
+  if (!configuration) {
+    throw new BadDataException(
+      "A Grok Parser processor needs a configuration with a grok pattern.",
+    );
+  }
+
+  const config: GrokParserConfig = configuration as unknown as GrokParserConfig;
+  const pattern: string =
+    typeof config.pattern === "string" ? config.pattern.trim() : "";
+
+  if (!pattern) {
+    throw new BadDataException(
+      "A Grok Parser processor needs a grok pattern, for example: %{IPV4:client_ip} %{WORD:verb}",
+    );
+  }
+
+  // Throws BadDataException with a message written for the person editing.
+  compileGrokPattern(pattern);
+
+  if (config.targetPrefix !== undefined && config.targetPrefix !== null) {
+    if (typeof config.targetPrefix !== "string") {
+      throw new BadDataException("Target prefix must be text.");
+    }
+
+    const targetPrefix: string = config.targetPrefix.trim();
+
+    if (targetPrefix && !TARGET_PREFIX_REGEX.test(targetPrefix)) {
+      throw new BadDataException(
+        `"${config.targetPrefix}" is not a valid target prefix. Use letters, digits, and . _ - : @ (starting with a letter or underscore).`,
+      );
+    }
+  }
+
+  if (config.source !== undefined && config.source !== null) {
+    if (typeof config.source !== "string") {
+      throw new BadDataException("Source field must be text.");
+    }
+  }
+}