From 680939a2898eeb4ffa443e1ce652c1c0e388748c Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Tue, 14 Nov 2017 14:13:24 +0100
Subject: [PATCH 01/57] Fix incorrect socket handling for the HTTP client

---
 lib/base/stream.cpp         |  3 +++
 lib/remote/httpresponse.cpp | 39 +++++++++++++++++++++++--------------
 2 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/lib/base/stream.cpp b/lib/base/stream.cpp
index 9390d97b9..57791d305 100644
--- a/lib/base/stream.cpp
+++ b/lib/base/stream.cpp
@@ -145,6 +145,9 @@ bool StreamReadContext::FillFromStream(const Stream::Ptr& stream, bool may_wait)
 		if (!Buffer)
 			throw std::bad_alloc();
 
+		if (stream->IsEof())
+			break;
+
 		size_t rc = stream->Read(Buffer + Size, 4096, true);
 
 		Size += rc;
diff --git a/lib/remote/httpresponse.cpp b/lib/remote/httpresponse.cpp
index 7f77ed386..ab7458655 100644
--- a/lib/remote/httpresponse.cpp
+++ b/lib/remote/httpresponse.cpp
@@ -159,12 +159,7 @@ bool HttpResponse::Parse(StreamReadContext& src, bool may_wait)
 
 			if (line == "") {
 				m_State = HttpResponseBody;
-
-				/* we're done if the request doesn't contain a message body */
-				if (!Headers->Contains("content-length") && !Headers->Contains("transfer-encoding"))
-					Complete = true;
-				else
-					m_Body = new FIFO();
+				m_Body = new FIFO();
 
 				return true;
 
@@ -204,27 +199,41 @@ bool HttpResponse::Parse(StreamReadContext& src, bool may_wait)
 				return true;
 			}
 		} else {
-			if (src.Eof)
+			bool hasLengthIndicator = false;
+			size_t lengthIndicator = 0;
+			Value contentLengthHeader;
+
+			if (Headers->Get("content-length", &contentLengthHeader)) {
+				hasLengthIndicator = true;
+				lengthIndicator = Convert::ToLong(contentLengthHeader);
+			}
+
+			if (hasLengthIndicator && src.Eof)
 				BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
 
 			if (src.MustRead) {
-				if (!src.FillFromStream(m_Stream, false)) {
+				if (!src.FillFromStream(m_Stream, may_wait))
 					src.Eof = true;
-					BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
-				}
 
 				src.MustRead = false;
 			}
 
-			size_t length_indicator = Convert::ToLong(Headers->Get("content-length"));
+			if (!hasLengthIndicator)
+				lengthIndicator = src.Size;
 
-			if (src.Size < length_indicator) {
+			if (src.Size < lengthIndicator) {
 				src.MustRead = true;
-				return false;
+				return may_wait;
+			}
+
+			m_Body->Write(src.Buffer, lengthIndicator);
+			src.DropData(lengthIndicator);
+
+			if (!hasLengthIndicator && !src.Eof) {
+				src.MustRead = true;
+				return may_wait;
 			}
 
-			m_Body->Write(src.Buffer, length_indicator);
-			src.DropData(length_indicator);
 			Complete = true;
 			return true;
 		}

From 7f92016e383252013e13aa3f17b7a6dc6424d3a0 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Tue, 24 Oct 2017 15:23:58 +0200
Subject: [PATCH 02/57] Fix performance issues for InfluxdbWriter

---
 lib/perfdata/influxdbwriter.cpp | 182 +++++++++++++++-----------------
 lib/perfdata/influxdbwriter.hpp |  12 +--
 2 files changed, 90 insertions(+), 104 deletions(-)

diff --git a/lib/perfdata/influxdbwriter.cpp b/lib/perfdata/influxdbwriter.cpp
index aa35fec0e..499e77a89 100644
--- a/lib/perfdata/influxdbwriter.cpp
+++ b/lib/perfdata/influxdbwriter.cpp
@@ -49,6 +49,24 @@
 
 using namespace icinga;
 
+class InfluxdbInteger : public Object
+{
+public:
+	DECLARE_PTR_TYPEDEFS(InfluxdbInteger);
+
+	InfluxdbInteger(int value)
+	    : m_Value(value)
+	{ }
+
+	int GetValue(void) const
+	{
+		return m_Value;
+	}
+
+private:
+	int m_Value;
+};
+
 REGISTER_TYPE(InfluxdbWriter);
 
 REGISTER_STATSFUNCTION(InfluxdbWriter, &InfluxdbWriter::StatsFunc);
@@ -106,7 +124,7 @@ void InfluxdbWriter::Start(bool runtimeCreated)
 	m_FlushTimer->Reschedule(0);
 
 	/* Register for new metrics. */
-	Service::OnNewCheckResult.connect(boost::bind(&InfluxdbWriter::CheckResultHandler, this, _1, _2));
+	Checkable::OnNewCheckResult.connect(boost::bind(&InfluxdbWriter::CheckResultHandler, this, _1, _2));
 }
 
 void InfluxdbWriter::Stop(bool runtimeRemoved)
@@ -134,7 +152,7 @@ void InfluxdbWriter::ExceptionHandler(boost::exception_ptr exp)
 	//TODO: Close the connection, if we keep it open.
 }
 
-Stream::Ptr InfluxdbWriter::Connect()
+Stream::Ptr InfluxdbWriter::Connect(void)
 {
 	TcpSocket::Ptr socket = new TcpSocket();
 
@@ -176,10 +194,10 @@ Stream::Ptr InfluxdbWriter::Connect()
 
 void InfluxdbWriter::CheckResultHandler(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr)
 {
-	m_WorkQueue.Enqueue(boost::bind(&InfluxdbWriter::InternalCheckResultHandler, this, checkable, cr));
+	m_WorkQueue.Enqueue(boost::bind(&InfluxdbWriter::CheckResultHandlerWQ, this, checkable, cr), PriorityLow);
 }
 
-void InfluxdbWriter::InternalCheckResultHandler(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr)
+void InfluxdbWriter::CheckResultHandlerWQ(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr)
 {
 	AssertOnWorkQueue();
 
@@ -211,28 +229,16 @@ void InfluxdbWriter::InternalCheckResultHandler(const Checkable::Ptr& checkable,
 	if (tags) {
 		ObjectLock olock(tags);
 		for (const Dictionary::Pair& pair : tags) {
-			// Prevent missing macros from warning; will return an empty value
-			// which will be filtered out in SendMetric()
 			String missing_macro;
-			tags->Set(pair.first, MacroProcessor::ResolveMacros(pair.second, resolvers, cr, &missing_macro));
+			Value value = MacroProcessor::ResolveMacros(pair.second, resolvers, cr, &missing_macro);
+
+			if (!missing_macro.IsEmpty())
+				continue;
+
+			tags->Set(pair.first, value);
 		}
 	}
 
-	SendPerfdata(tmpl, checkable, cr, ts);
-}
-
-String InfluxdbWriter::FormatInteger(int val)
-{
-	return Convert::ToString(val) + "i";
-}
-
-String InfluxdbWriter::FormatBoolean(bool val)
-{
-	return val ? "true" : "false";
-}
-
-void InfluxdbWriter::SendPerfdata(const Dictionary::Ptr& tmpl, const Checkable::Ptr& checkable, const CheckResult::Ptr& cr, double ts)
-{
 	Array::Ptr perfdata = cr->GetPerformanceData();
 	if (perfdata) {
 		ObjectLock olock(perfdata);
@@ -277,16 +283,16 @@ void InfluxdbWriter::SendPerfdata(const Dictionary::Ptr& tmpl, const Checkable::
 		Dictionary::Ptr fields = new Dictionary();
 
 		if (service)
-			fields->Set("state", FormatInteger(service->GetState()));
+			fields->Set("state", new InfluxdbInteger(service->GetState()));
 		else
-			fields->Set("state", FormatInteger(host->GetState()));
+			fields->Set("state", new InfluxdbInteger(host->GetState()));
 
-		fields->Set("current_attempt", FormatInteger(checkable->GetCheckAttempt()));
-		fields->Set("max_check_attempts", FormatInteger(checkable->GetMaxCheckAttempts()));
-		fields->Set("state_type", FormatInteger(checkable->GetStateType()));
-		fields->Set("reachable", FormatBoolean(checkable->IsReachable()));
-		fields->Set("downtime_depth", FormatInteger(checkable->GetDowntimeDepth()));
-		fields->Set("acknowledgement", FormatInteger(checkable->GetAcknowledgement()));
+		fields->Set("current_attempt", new InfluxdbInteger(checkable->GetCheckAttempt()));
+		fields->Set("max_check_attempts", new InfluxdbInteger(checkable->GetMaxCheckAttempts()));
+		fields->Set("state_type", new InfluxdbInteger(checkable->GetStateType()));
+		fields->Set("reachable", checkable->IsReachable());
+		fields->Set("downtime_depth", new InfluxdbInteger(checkable->GetDowntimeDepth()));
+		fields->Set("acknowledgement", new InfluxdbInteger(checkable->GetAcknowledgement()));
 		fields->Set("latency", cr->CalculateLatency());
 		fields->Set("execution_time", cr->CalculateExecutionTime());
 
@@ -294,7 +300,7 @@ void InfluxdbWriter::SendPerfdata(const Dictionary::Ptr& tmpl, const Checkable::
 	}
 }
 
-String InfluxdbWriter::EscapeKey(const String& str)
+String InfluxdbWriter::EscapeKeyOrTagValue(const String& str)
 {
 	// Iterate over the key name and escape commas and spaces with a backslash
 	String result = str;
@@ -302,57 +308,28 @@ String InfluxdbWriter::EscapeKey(const String& str)
 	boost::algorithm::replace_all(result, "=", "\\=");
 	boost::algorithm::replace_all(result, ",", "\\,");
 	boost::algorithm::replace_all(result, " ", "\\ ");
-
-	// InfluxDB 'feature': although backslashes are allowed in keys they also act
-	// as escape sequences when followed by ',' or ' '.  When your tag is like
-	// 'metric=C:\' bad things happen.  Backslashes themselves cannot be escaped
-	// and through experimentation they also escape '='.  To be safe we replace
-	// trailing backslashes with and underscore.
-	size_t length = result.GetLength();
-	if (result[length - 1] == '\\')
-		result[length - 1] = '_';
-
 	return result;
 }
 
-String InfluxdbWriter::EscapeField(const String& str)
+String InfluxdbWriter::EscapeValue(const Value& value)
 {
-	//TODO: Evaluate whether boost::regex is really needed here.
-
-	// Handle integers
-	boost::regex integer("-?\\d+i");
-	if (boost::regex_match(str.GetData(), integer)) {
-		return str;
+	if (value.IsObjectType<InfluxdbInteger>()) {
+		std::ostringstream os;
+		os << static_cast<InfluxdbInteger::Ptr>(value)->GetValue()
+		   << "i";
+		return os.str();
 	}
 
-	// Handle numerics
-	boost::regex numeric("-?\\d+(\\.\\d+)?((e|E)[+-]?\\d+)?");
-	if (boost::regex_match(str.GetData(), numeric)) {
-		return str;
-	}
+	if (value.IsBoolean())
+		return value ? "true" : "false";
 
-	// Handle booleans
-	boost::regex boolean_true("t|true", boost::regex::icase);
-	if (boost::regex_match(str.GetData(), boolean_true))
-		return "true";
-	boost::regex boolean_false("f|false", boost::regex::icase);
-	if (boost::regex_match(str.GetData(), boolean_false))
-		return "false";
-
-	// Handle NaNs
-	if (boost::math::isnan(str))
-		return 0;
-
-	// Otherwise it's a string and needs escaping and quoting
-	String result = str;
-	boost::algorithm::replace_all(result, "\"", "\\\"");
-	return "\"" + result + "\"";
+	return value;
 }
 
 void InfluxdbWriter::SendMetric(const Dictionary::Ptr& tmpl, const String& label, const Dictionary::Ptr& fields, double ts)
 {
 	std::ostringstream msgbuf;
-	msgbuf << EscapeKey(tmpl->Get("measurement"));
+	msgbuf << EscapeKeyOrTagValue(tmpl->Get("measurement"));
 
 	Dictionary::Ptr tags = tmpl->Get("tags");
 	if (tags) {
@@ -360,14 +337,14 @@ void InfluxdbWriter::SendMetric(const Dictionary::Ptr& tmpl, const String& label
 		for (const Dictionary::Pair& pair : tags) {
 			// Empty macro expansion, no tag
 			if (!pair.second.IsEmpty()) {
-				msgbuf << "," << EscapeKey(pair.first) << "=" << EscapeKey(pair.second);
+				msgbuf << "," << EscapeKeyOrTagValue(pair.first) << "=" << EscapeKeyOrTagValue(pair.second);
 			}
 		}
 	}
 
-	// Label is may be empty in the case of metadata
+	// Label may be empty in the case of metadata
 	if (!label.IsEmpty())
-		msgbuf << ",metric=" << EscapeKey(label);
+		msgbuf << ",metric=" << EscapeKeyOrTagValue(label);
 
 	msgbuf << " ";
 
@@ -381,45 +358,54 @@ void InfluxdbWriter::SendMetric(const Dictionary::Ptr& tmpl, const String& label
 			else
 				msgbuf << ",";
 
-			msgbuf << EscapeKey(pair.first) << "=" << EscapeField(pair.second);
+			msgbuf << EscapeKeyOrTagValue(pair.first) << "=" << EscapeValue(pair.second);
 		}
 	}
 
 	msgbuf << " " <<  static_cast<unsigned long>(ts);
 
+#ifdef I2_DEBUG
 	Log(LogDebug, "InfluxdbWriter")
 	    << "Add to metric list: '" << msgbuf.str() << "'.";
+#endif /* I2_DEBUG */
 
-	// Atomically buffer the data point
-	boost::mutex::scoped_lock lock(m_DataBufferMutex);
-	m_DataBuffer.push_back(String(msgbuf.str()));
+	// Buffer the data point
+	m_DataBuffer.push_back(msgbuf.str());
 
 	// Flush if we've buffered too much to prevent excessive memory use
 	if (static_cast<int>(m_DataBuffer.size()) >= GetFlushThreshold()) {
 		Log(LogDebug, "InfluxdbWriter")
 		    << "Data buffer overflow writing " << m_DataBuffer.size() << " data points";
-		Flush();
+
+		try {
+			Flush();
+		} catch (...) {
+			/* Do nothing. */
+		}
 	}
 }
 
 void InfluxdbWriter::FlushTimeout(void)
 {
-	// Prevent new data points from being added to the array, there is a
-	// race condition where they could disappear
-	boost::mutex::scoped_lock lock(m_DataBufferMutex);
+	m_WorkQueue.Enqueue(boost::bind(&InfluxdbWriter::FlushTimeoutWQ, this), PriorityHigh);
+}
+
+void InfluxdbWriter::FlushTimeoutWQ(void)
+{
+	AssertOnWorkQueue();
 
 	// Flush if there are any data available
-	if (m_DataBuffer.size() > 0) {
-		Log(LogDebug, "InfluxdbWriter")
-		    << "Timer expired writing " << m_DataBuffer.size() << " data points";
-		Flush();
-	}
+	if (m_DataBuffer.empty())
+		return;
+
+	Log(LogDebug, "InfluxdbWriter")
+	    << "Timer expired writing " << m_DataBuffer.size() << " data points";
+
+	Flush();
 }
 
 void InfluxdbWriter::Flush(void)
 {
-	// Ensure you hold a lock against m_DataBuffer so that things
-	// don't go missing after creating the body and clearing the buffer
 	String body = boost::algorithm::join(m_DataBuffer, "\n");
 	m_DataBuffer.clear();
 
@@ -457,25 +443,27 @@ void InfluxdbWriter::Flush(void)
 		throw ex;
 	}
 
-	//TODO: Evaluate whether waiting for the result makes sense here. KeepAlive and close are options.
 	HttpResponse resp(stream, req);
 	StreamReadContext context;
 
 	try {
-		resp.Parse(context, true);
+		while (resp.Parse(context, true) && !resp.Complete)
+			; /* Do nothing */
 	} catch (const std::exception& ex) {
 		Log(LogWarning, "InfluxdbWriter")
-		    << "Cannot read from TCP socket from host '" << GetHost() << "' port '" << GetPort() << "'.";
+		    << "Failed to parse HTTP response from host '" << GetHost() << "' port '" << GetPort() << "': " << DiagnosticInformation(ex);
 		throw ex;
 	}
 
+	if (!resp.Complete) {
+		Log(LogWarning, "InfluxdbWriter")
+		    << "Failed to read a complete HTTP response from the InfluxDB server.";
+		return;
+	}
+
 	if (resp.StatusCode != 204) {
 		Log(LogWarning, "InfluxdbWriter")
-		    << "Unexpected response code " << resp.StatusCode;
-
-		// Finish parsing the headers and body
-		while (!resp.Complete)
-			resp.Parse(context, true);
+		    << "Unexpected response code: " << resp.StatusCode;
 
 		String contentType = resp.Headers->Get("content-type");
 		if (contentType != "application/json") {
@@ -502,6 +490,8 @@ void InfluxdbWriter::Flush(void)
 
 		Log(LogCritical, "InfluxdbWriter")
 		    << "InfluxDB error message:\n" << error;
+
+		return;
 	}
 }
 
diff --git a/lib/perfdata/influxdbwriter.hpp b/lib/perfdata/influxdbwriter.hpp
index e0a149c3a..97546bc84 100644
--- a/lib/perfdata/influxdbwriter.hpp
+++ b/lib/perfdata/influxdbwriter.hpp
@@ -59,20 +59,16 @@ private:
 	WorkQueue m_WorkQueue;
 	Timer::Ptr m_FlushTimer;
 	std::vector<String> m_DataBuffer;
-	boost::mutex m_DataBufferMutex;
 
 	void CheckResultHandler(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr);
-	void InternalCheckResultHandler(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr);
-	void SendPerfdata(const Dictionary::Ptr& tmpl, const Checkable::Ptr& checkable, const CheckResult::Ptr& cr, double ts);
+	void CheckResultHandlerWQ(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr);
 	void SendMetric(const Dictionary::Ptr& tmpl, const String& label, const Dictionary::Ptr& fields, double ts);
 	void FlushTimeout(void);
+	void FlushTimeoutWQ(void);
 	void Flush(void);
 
-	static String FormatInteger(int val);
-	static String FormatBoolean(bool val);
-
-	static String EscapeKey(const String& str);
-	static String EscapeField(const String& str);
+	static String EscapeKeyOrTagValue(const String& str);
+	static String EscapeValue(const Value& value);
 
 	Stream::Ptr Connect();
 

From 157358c24f65bc287c88fdc4c5eb72be29e17ecd Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Wed, 17 Jan 2018 10:25:00 +0100
Subject: [PATCH 03/57] Fix HTTP response parsing for HTTP 1.1

refs #5987
---
 lib/remote/httpresponse.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/remote/httpresponse.cpp b/lib/remote/httpresponse.cpp
index ab7458655..fd7578ed0 100644
--- a/lib/remote/httpresponse.cpp
+++ b/lib/remote/httpresponse.cpp
@@ -208,6 +208,11 @@ bool HttpResponse::Parse(StreamReadContext& src, bool may_wait)
 				lengthIndicator = Convert::ToLong(contentLengthHeader);
 			}
 
+			if (!hasLengthIndicator && ProtocolVersion != HttpVersion10 && !Headers->Contains("transfer-encoding")) {
+				Complete = true;
+				return true;
+			}
+
 			if (hasLengthIndicator && src.Eof)
 				BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
 

From 6dba6a0bfb9cb8b7ad450fd64f68dd30bbb905f2 Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Wed, 17 Jan 2018 10:25:42 +0100
Subject: [PATCH 04/57] Add missing string escaping

fixes #5987
---
 lib/perfdata/influxdbwriter.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/perfdata/influxdbwriter.cpp b/lib/perfdata/influxdbwriter.cpp
index 499e77a89..ac149e7cb 100644
--- a/lib/perfdata/influxdbwriter.cpp
+++ b/lib/perfdata/influxdbwriter.cpp
@@ -323,6 +323,9 @@ String InfluxdbWriter::EscapeValue(const Value& value)
 	if (value.IsBoolean())
 		return value ? "true" : "false";
 
+	if (value.IsString())
+		return "\"" + EscapeKeyOrTagValue(value) + "\"";
+
 	return value;
 }
 

From bd81264c76b4539dd27278ec47f87d6a217ccc40 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 15 Nov 2017 09:47:23 +0100
Subject: [PATCH 05/57] Make default getters and setters non-virtual

---
 tools/mkclass/class_lexer.ll    |  3 +++
 tools/mkclass/classcompiler.cpp | 25 ++++++++++++++++++-------
 tools/mkclass/classcompiler.hpp |  4 +++-
 3 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/tools/mkclass/class_lexer.ll b/tools/mkclass/class_lexer.ll
index 0b9195464..625a99f22 100644
--- a/tools/mkclass/class_lexer.ll
+++ b/tools/mkclass/class_lexer.ll
@@ -148,6 +148,9 @@ no_storage			{ yylval->num = FANoStorage; return T_FIELD_ATTRIBUTE; }
 no_user_modify			{ yylval->num = FANoUserModify; return T_FIELD_ATTRIBUTE; }
 no_user_view			{ yylval->num = FANoUserView; return T_FIELD_ATTRIBUTE; }
 deprecated			{ yylval->num = FADeprecated; return T_FIELD_ATTRIBUTE; }
+get_virtual			{ yylval->num = FAGetVirtual; return T_FIELD_ATTRIBUTE; }
+set_virtual			{ yylval->num = FASetVirtual; return T_FIELD_ATTRIBUTE; }
+virtual				{ yylval->num = FAGetVirtual | FASetVirtual; return T_FIELD_ATTRIBUTE; }
 navigation			{ return T_NAVIGATION; }
 validator			{ return T_VALIDATOR; }
 required			{ return T_REQUIRED; }
diff --git a/tools/mkclass/classcompiler.cpp b/tools/mkclass/classcompiler.cpp
index 04e9abdeb..7d068bcd5 100644
--- a/tools/mkclass/classcompiler.cpp
+++ b/tools/mkclass/classcompiler.cpp
@@ -706,7 +706,7 @@ void ClassCompiler::HandleClass(const Klass& klass, const ClassDebugInfo&)
 
 		/* NotifyField */
 		m_Header << "public:" << std::endl
-			 << "\t" << "virtual void NotifyField(int id, const Value& cookie = Empty) override;" << std::endl;
+			 << "\t" << "void NotifyField(int id, const Value& cookie = Empty) override;" << std::endl;
 
 		m_Impl << "void ObjectImpl<" << klass.Name << ">::NotifyField(int id, const Value& cookie)" << std::endl
 		       << "{" << std::endl;
@@ -784,7 +784,12 @@ void ClassCompiler::HandleClass(const Klass& klass, const ClassDebugInfo&)
 				prot = "public";
 
 			m_Header << prot << ":" << std::endl
-			 	 << "\t" << "virtual " << field.Type.GetRealType() << " Get" << field.GetFriendlyName() << "(void) const";
+				 << "\t";
+
+			if (field.Attributes & FAGetVirtual || field.PureGetAccessor)
+				m_Header << "virtual ";
+
+			m_Header << field.Type.GetRealType() << " Get" << field.GetFriendlyName() << "(void) const";
 
 			if (field.PureGetAccessor) {
 				m_Header << " = 0;" << std::endl;
@@ -813,7 +818,12 @@ void ClassCompiler::HandleClass(const Klass& klass, const ClassDebugInfo&)
 				prot = "public";
 
 			m_Header << prot << ":" << std::endl
-				 << "\t" << "virtual void Set" << field.GetFriendlyName() << "(" << field.Type.GetArgumentType() << " value, bool suppress_events = false, const Value& cookie = Empty)";
+				 << "\t";
+
+			if (field.Attributes & FASetVirtual || field.PureSetAccessor)
+				m_Header << "virtual ";
+
+			m_Header << "void Set" << field.GetFriendlyName() << "(" << field.Type.GetArgumentType() << " value, bool suppress_events = false, const Value& cookie = Empty)";
 
 			if (field.PureSetAccessor) {
 				m_Header << " = 0;" << std::endl;
@@ -859,7 +869,7 @@ void ClassCompiler::HandleClass(const Klass& klass, const ClassDebugInfo&)
 
 			needs_tracking = true;
 
-			m_Header << "\t" << "virtual void Track" << field.GetFriendlyName() << "(" << field.Type.GetArgumentType() << " oldValue, " << field.Type.GetArgumentType() << " newValue);";
+			m_Header << "\t" << "void Track" << field.GetFriendlyName() << "(" << field.Type.GetArgumentType() << " oldValue, " << field.Type.GetArgumentType() << " newValue);" << std::endl;
 
 			m_Impl << "void ObjectImpl<" << klass.Name << ">::Track" << field.GetFriendlyName() << "(" << field.Type.GetArgumentType() << " oldValue, " << field.Type.GetArgumentType() << " newValue)" << std::endl
 			       << "{" << std::endl;
@@ -930,7 +940,7 @@ void ClassCompiler::HandleClass(const Klass& klass, const ClassDebugInfo&)
 				continue;
 
 			m_Header << "public:" << std::endl
-				 << "\t" << "virtual Object::Ptr Navigate" << field.GetFriendlyName() << "(void) const";
+				 << "\t" << "Object::Ptr Navigate" << field.GetFriendlyName() << "(void) const";
 
 			if (field.PureNavigateAccessor) {
 				m_Header << " = 0;" << std::endl;
@@ -951,8 +961,9 @@ void ClassCompiler::HandleClass(const Klass& klass, const ClassDebugInfo&)
 
 		/* start/stop */
 		if (needs_tracking) {
-			m_Header << "virtual void Start(bool runtimeCreated = false) override;" << std::endl
-				 << "virtual void Stop(bool runtimeRemoved = false) override;" << std::endl;
+			m_Header << "protected:" << std::endl
+				 << "\tvirtual void Start(bool runtimeCreated = false) override;" << std::endl
+				 << "\tvirtual void Stop(bool runtimeRemoved = false) override;" << std::endl;
 
 			m_Impl << "void ObjectImpl<" << klass.Name << ">::Start(bool runtimeCreated)" << std::endl
 			       << "{" << std::endl
diff --git a/tools/mkclass/classcompiler.hpp b/tools/mkclass/classcompiler.hpp
index 06bf100d3..ab9422220 100644
--- a/tools/mkclass/classcompiler.hpp
+++ b/tools/mkclass/classcompiler.hpp
@@ -73,7 +73,9 @@ enum FieldAttribute
 	FANavigation = 512,
 	FANoUserModify = 1024,
 	FANoUserView = 2048,
-	FADeprecated = 4096
+	FADeprecated = 4096,
+	FAGetVirtual = 8192,
+	FASetVirtual = 16384
 };
 
 struct FieldType

From 7fe8b3b14f09747d762013437f971eecf1530b03 Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Thu, 18 Jan 2018 13:25:23 +0100
Subject: [PATCH 06/57] Fix wrong nscp-local include in the docs

refs #6006
---
 doc/06-distributed-monitoring.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/06-distributed-monitoring.md b/doc/06-distributed-monitoring.md
index 6030aa1d6..dafd55cde 100644
--- a/doc/06-distributed-monitoring.md
+++ b/doc/06-distributed-monitoring.md
@@ -2158,7 +2158,7 @@ Add the following `include` statement on all your nodes (master, satellite, clie
 
     vim /etc/icinga2/icinga2.conf
 
-    include <nscp-local>
+    include <nscp>
 
 The CheckCommand definitions will automatically determine the installed path
 to the `nscp.exe` binary.

From cf79724eb90682d96f95dd207253e859d096d931 Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Thu, 18 Jan 2018 17:50:39 +0100
Subject: [PATCH 07/57] Docs: Add IDO DB tuning tips

fixes #5622

refs #6014
---
 doc/14-features.md | 101 ++++++++++++++++++++++++++++++++++-----------
 1 file changed, 77 insertions(+), 24 deletions(-)

diff --git a/doc/14-features.md b/doc/14-features.md
index 9f4db6a78..b4e66931a 100644
--- a/doc/14-features.md
+++ b/doc/14-features.md
@@ -27,9 +27,9 @@ platforms. This configuration ensures that the `icinga2.log`, `error.log` and
 
 ## DB IDO <a id="db-ido"></a>
 
-The IDO (Icinga Data Output) modules for Icinga 2 take care of exporting all
+The IDO (Icinga Data Output) feature for Icinga 2 takes care of exporting all
 configuration and status information into a database. The IDO database is used
-by Icinga Web 2.
+by Icinga Web 2 as data backend.
 
 Details on the installation can be found in the [Configuring DB IDO](02-getting-started.md#configuring-db-ido-mysql)
 chapter. Details on the configuration can be found in the
@@ -39,9 +39,14 @@ object configuration documentation.
 The DB IDO feature supports [High Availability](06-distributed-monitoring.md#distributed-monitoring-high-availability-db-ido) in
 the Icinga 2 cluster.
 
-The following example query checks the health of the current Icinga 2 instance
-writing its current status to the DB IDO backend table `icinga_programstatus`
-every 10 seconds. By default it checks 60 seconds into the past which is a reasonable
+### DB IDO Health <a id="db-ido-health"></a>
+
+If the monitoring health indicator is critical in Icinga Web 2,
+you can use the following queries to manually check whether Icinga 2
+is actually updating the IDO database.
+
+Icinga 2 writes its current status to the `icinga_programstatus` table
+every 10 seconds. The query below checks 60 seconds into the past which is a reasonable
 amount of time -- adjust it for your requirements. If the condition is not met,
 the query returns an empty result.
 
@@ -53,34 +58,82 @@ Replace the `default` string with your instance name if different.
 
 Example for MySQL:
 
-    # mysql -u root -p icinga -e "SELECT status_update_time FROM icinga_programstatus ps
-      JOIN icinga_instances i ON ps.instance_id=i.instance_id
-      WHERE (UNIX_TIMESTAMP(ps.status_update_time) > UNIX_TIMESTAMP(NOW())-60)
-      AND i.instance_name='default';"
-
-    +---------------------+
-    | status_update_time  |
-    +---------------------+
-    | 2014-05-29 14:29:56 |
-    +---------------------+
+```
+# mysql -u root -p icinga -e "SELECT status_update_time FROM icinga_programstatus ps
+  JOIN icinga_instances i ON ps.instance_id=i.instance_id
+  WHERE (UNIX_TIMESTAMP(ps.status_update_time) > UNIX_TIMESTAMP(NOW())-60)
+  AND i.instance_name='default';"
 
++---------------------+
+| status_update_time  |
++---------------------+
+| 2014-05-29 14:29:56 |
++---------------------+
+```
 
 Example for PostgreSQL:
 
-    # export PGPASSWORD=icinga; psql -U icinga -d icinga -c "SELECT ps.status_update_time FROM icinga_programstatus AS ps
-      JOIN icinga_instances AS i ON ps.instance_id=i.instance_id
-      WHERE ((SELECT extract(epoch from status_update_time) FROM icinga_programstatus) > (SELECT extract(epoch from now())-60))
-      AND i.instance_name='default'";
-
-    status_update_time
-    ------------------------
-     2014-05-29 15:11:38+02
-    (1 Zeile)
+```
+# export PGPASSWORD=icinga; psql -U icinga -d icinga -c "SELECT ps.status_update_time FROM icinga_programstatus AS ps
+  JOIN icinga_instances AS i ON ps.instance_id=i.instance_id
+  WHERE ((SELECT extract(epoch from status_update_time) FROM icinga_programstatus) > (SELECT extract(epoch from now())-60))
+  AND i.instance_name='default'";
 
+status_update_time
+------------------------
+ 2014-05-29 15:11:38+02
+(1 Zeile)
+```
 
 A detailed list on the available table attributes can be found in the [DB IDO Schema documentation](24-appendix.md#schema-db-ido).
 
 
+### DB IDO Tuning <a id="db-ido-tuning"></a>
+
+As with any application database, there are ways to optimize and tune the database performance.
+
+General tips for performance tuning:
+
+* [MariaDB KB](https://mariadb.com/kb/en/library/optimization-and-tuning/)
+* [PostgreSQL Wiki](https://wiki.postgresql.org/wiki/Performance_Optimization)
+
+Re-creation of indexes, changed column values, etc. will increase the database size. Ensure to
+add health checks for this, and monitor the trend in your Grafana dashboards.
+
+In order to optimize the tables, there are different approaches. Always keep in mind to have a
+current backup and schedule maintenance downtime for these kind of tasks!
+
+MySQL:
+
+```
+mariadb> OPTIMIZE TABLE icinga_statehistory;
+```
+
+> **Important**
+>
+> Tables might not support optimization at runtime. This can take a **long** time.
+>
+> `Table does not support optimize, doing recreate + analyze instead`.
+
+If you want to optimize all tables in a specified database, there is a script called `mysqlcheck`.
+This also allows to repair broken tables in the case of emergency.
+
+```
+mysqlcheck --optimize icinga
+```
+
+PostgreSQL:
+
+```
+icinga=# vacuum;
+VACUUM
+```
+
+> **Note**
+>
+> Don't use `VACUUM FULL` as this has a severe impact on performance.
+
+
 ## External Commands <a id="external-commands"></a>
 
 > **Note**

From 5dab779df66177a5cf87f20e11d65661026b8ad2 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Mon, 18 Dec 2017 09:32:09 +0100
Subject: [PATCH 08/57] Fix incorrect ::Start call

---
 lib/base/filelogger.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/base/filelogger.cpp b/lib/base/filelogger.cpp
index 233692a25..44d5889e8 100644
--- a/lib/base/filelogger.cpp
+++ b/lib/base/filelogger.cpp
@@ -46,11 +46,11 @@ void FileLogger::StatsFunc(const Dictionary::Ptr& status, const Array::Ptr&)
  */
 void FileLogger::Start(bool runtimeCreated)
 {
-	ObjectImpl<FileLogger>::Start(runtimeCreated);
-
 	ReopenLogFile();
 
 	Application::OnReopenLogs.connect(boost::bind(&FileLogger::ReopenLogFile, this));
+
+	ObjectImpl<FileLogger>::Start(runtimeCreated);
 }
 
 void FileLogger::ReopenLogFile(void)

From 7f09fb1f659b434c0afbdfbe1e7f364de7fec483 Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Tue, 6 Feb 2018 12:44:45 +0100
Subject: [PATCH 09/57] Explain how to register functions in the global scope

refs #6075
---
 doc/08-advanced-topics.md | 313 ++++++++++++++++++++++++--------------
 1 file changed, 198 insertions(+), 115 deletions(-)

diff --git a/doc/08-advanced-topics.md b/doc/08-advanced-topics.md
index b0c2b79a0..c92f7a703 100644
--- a/doc/08-advanced-topics.md
+++ b/doc/08-advanced-topics.md
@@ -645,6 +645,204 @@ inside the `icinga2.log` file depending in your log severity
 * Use the `icinga2 console` to test basic functionality (e.g. iterating over a dictionary)
 * Build them step-by-step. You can always refactor your code later on.
 
+#### Register and Use Global Functions <a id="use-functions-global-register"></a>
+
+[Functions](17-language-reference.md#functions) can be registered into the global scope. This allows custom functions being available
+in objects and other functions. Keep in mind that these functions are not marked
+as side-effect-free and as such are not available via the REST API.
+
+Add a new configuration file `functions.conf` and include it into the [icinga2.conf](04-configuring-icinga-2.md#icinga2-conf)
+configuration file in the very beginning, e.g. after `constants.conf`. You can also manage global
+functions inside `constants.conf` if you prefer.
+
+The following function converts a given state parameter into a returned string value. The important
+bits for registering it into the global scope are:
+
+* `globals.<unique_function_name>` adds a new globals entry.
+* `function()` specifies that a call to `state_to_string()` executes a function.
+* Function parameters are defined inside the `function()` definition.
+
+```
+globals.state_to_string = function(state) {
+  if (state == 2) {
+    return "Critical"
+  } else if (state == 1) {
+    return "Warning"
+  } else if (state == 0) {
+    return "OK"
+  } else if (state == 3) {
+    return "Unknown"
+  } else {
+    log(LogWarning, "state_to_string", "Unknown state " + state + " provided.")
+  }
+}
+```
+
+The else-condition allows for better error handling. This warning will be shown in the Icinga 2
+log file once the function is called.
+
+> **Note**
+>
+> If these functions are used in a distributed environment, you must ensure to deploy them
+> everywhere needed.
+
+In order to test-drive the newly created function, restart Icinga 2 and use the [debug console](11-cli-commands.md#cli-command-console)
+to connect to the REST API.
+
+```
+$ ICINGA2_API_PASSWORD=icinga icinga2 console --connect 'https://root@localhost:5665/'
+Icinga 2 (version: v2.8.1-373-g4bea6d25c)
+<1> => globals.state_to_string(1)
+"Warning"
+<2> => state_to_string(2)
+"Critical"
+```
+
+You can see that this function is now registered into the [global scope](17-language-reference.md#variable-scopes). The function call
+`state_to_string()` can be used in any object at static config compile time or inside runtime
+lambda functions.
+
+The following service object example uses the service state and converts it to string output.
+The function definition is not optimized and is enrolled for better readability including a log message.
+
+```
+object Service "state-test" {
+  check_command = "dummy"
+  host_name = NodeName
+
+  vars.dummy_state = 2
+
+  vars.dummy_text = {{
+    var h = macro("$host.name$")
+    var s = macro("$service.name$")
+
+    var state = get_service(h, s).state
+
+    log(LogInformation, "dummy_state", "Host: " + h + " Service: " + s + " State: " + state)
+
+    return state_to_string(state)
+  }}
+}
+```
+
+
+#### Use Custom Functions as Attribute <a id="custom-functions-as-attribute"></a>
+
+To use custom functions as attributes, the function must be defined in a
+slightly unexpected way. The following example shows how to assign values
+depending on group membership. All hosts in the `slow-lan` host group use 300
+as value for `ping_wrta`, all other hosts use 100.
+
+    globals.group_specific_value = function(group, group_value, non_group_value) {
+        return function() use (group, group_value, non_group_value) {
+            if (group in host.groups) {
+                return group_value
+            } else {
+                return non_group_value
+            }
+        }
+    }
+
+    apply Service "ping4" {
+        import "generic-service"
+        check_command = "ping4"
+
+        vars.ping_wrta = group_specific_value("slow-lan", 300, 100)
+        vars.ping_crta = group_specific_value("slow-lan", 500, 200)
+
+        assign where true
+    }
+
+#### Use Functions in Assign Where Expressions <a id="use-functions-assign-where"></a>
+
+If a simple expression for matching a name or checking if an item
+exists in an array or dictionary does not fit, you should consider
+writing your own global [functions](17-language-reference.md#functions).
+You can call them inside `assign where` and `ignore where` expressions
+for [apply rules](03-monitoring-basics.md#using-apply-expressions) or
+[group assignments](03-monitoring-basics.md#group-assign-intro) just like
+any other global functions for example [match](18-library-reference.md#global-functions-match).
+
+The following example requires the host `myprinter` being added
+to the host group `printers-lexmark` but only if the host uses
+a template matching the name `lexmark*`.
+
+    template Host "lexmark-printer-host" {
+      vars.printer_type = "Lexmark"
+    }
+
+    object Host "myprinter" {
+      import "generic-host"
+      import "lexmark-printer-host"
+
+      address = "192.168.1.1"
+    }
+
+    /* register a global function for the assign where call */
+    globals.check_host_templates = function(host, search) {
+      /* iterate over all host templates and check if the search matches */
+      for (tmpl in host.templates) {
+        if (match(search, tmpl)) {
+          return true
+        }
+      }
+
+      /* nothing matched */
+      return false
+    }
+
+    object HostGroup "printers-lexmark" {
+      display_name = "Lexmark Printers"
+      /* call the global function and pass the arguments */
+      assign where check_host_templates(host, "lexmark*")
+    }
+
+
+Take a different more complex example: All hosts with the
+custom attribute `vars_app` as nested dictionary should be
+added to the host group `ABAP-app-server`. But only if the
+`app_type` for all entries is set to `ABAP`.
+
+It could read as wildcard match for nested dictionaries:
+
+    where host.vars.vars_app["*"].app_type == "ABAP"
+
+The solution for this problem is to register a global
+function which checks the `app_type` for all hosts
+with the `vars_app` dictionary.
+
+    object Host "appserver01" {
+      check_command = "dummy"
+      vars.vars_app["ABC"] = { app_type = "ABAP" }
+    }
+    object Host "appserver02" {
+      check_command = "dummy"
+      vars.vars_app["DEF"] = { app_type = "ABAP" }
+    }
+
+    globals.check_app_type = function(host, type) {
+      /* ensure that other hosts without the custom attribute do not match */
+      if (typeof(host.vars.vars_app) != Dictionary) {
+        return false
+      }
+
+      /* iterate over the vars_app dictionary */
+      for (key => val in host.vars.vars_app) {
+        /* if the value is a dictionary and if contains the app_type being the requested type */
+        if (typeof(val) == Dictionary && val.app_type == type) {
+          return true
+        }
+      }
+
+      /* nothing matched */
+      return false
+    }
+
+    object HostGroup "ABAP-app-server" {
+      assign where check_app_type(host, "ABAP")
+    }
+
+
 #### Use Functions in Command Arguments set_if <a id="use-functions-command-arguments-setif"></a>
 
 The `set_if` attribute inside the command arguments definition in the
@@ -778,121 +976,6 @@ You can omit the `log()` calls, they only help debugging.
       }
     }
 
-#### Use Custom Functions as Attribute <a id="custom-functions-as-attribute"></a>
-
-To use custom functions as attributes, the function must be defined in a
-slightly unexpected way. The following example shows how to assign values
-depending on group membership. All hosts in the `slow-lan` host group use 300
-as value for `ping_wrta`, all other hosts use 100.
-
-    globals.group_specific_value = function(group, group_value, non_group_value) {
-        return function() use (group, group_value, non_group_value) {
-            if (group in host.groups) {
-                return group_value
-            } else {
-                return non_group_value
-            }
-        }
-    }
-
-    apply Service "ping4" {
-        import "generic-service"
-        check_command = "ping4"
-
-        vars.ping_wrta = group_specific_value("slow-lan", 300, 100)
-        vars.ping_crta = group_specific_value("slow-lan", 500, 200)
-
-        assign where true
-    }
-
-#### Use Functions in Assign Where Expressions <a id="use-functions-assign-where"></a>
-
-If a simple expression for matching a name or checking if an item
-exists in an array or dictionary does not fit, you should consider
-writing your own global [functions](17-language-reference.md#functions).
-You can call them inside `assign where` and `ignore where` expressions
-for [apply rules](03-monitoring-basics.md#using-apply-expressions) or
-[group assignments](03-monitoring-basics.md#group-assign-intro) just like
-any other global functions for example [match](18-library-reference.md#global-functions-match).
-
-The following example requires the host `myprinter` being added
-to the host group `printers-lexmark` but only if the host uses
-a template matching the name `lexmark*`.
-
-    template Host "lexmark-printer-host" {
-      vars.printer_type = "Lexmark"
-    }
-
-    object Host "myprinter" {
-      import "generic-host"
-      import "lexmark-printer-host"
-
-      address = "192.168.1.1"
-    }
-
-    /* register a global function for the assign where call */
-    globals.check_host_templates = function(host, search) {
-      /* iterate over all host templates and check if the search matches */
-      for (tmpl in host.templates) {
-        if (match(search, tmpl)) {
-          return true
-        }
-      }
-
-      /* nothing matched */
-      return false
-    }
-
-    object HostGroup "printers-lexmark" {
-      display_name = "Lexmark Printers"
-      /* call the global function and pass the arguments */
-      assign where check_host_templates(host, "lexmark*")
-    }
-
-
-Take a different more complex example: All hosts with the
-custom attribute `vars_app` as nested dictionary should be
-added to the host group `ABAP-app-server`. But only if the
-`app_type` for all entries is set to `ABAP`.
-
-It could read as wildcard match for nested dictionaries:
-
-    where host.vars.vars_app["*"].app_type == "ABAP"
-
-The solution for this problem is to register a global
-function which checks the `app_type` for all hosts
-with the `vars_app` dictionary.
-
-    object Host "appserver01" {
-      check_command = "dummy"
-      vars.vars_app["ABC"] = { app_type = "ABAP" }
-    }
-    object Host "appserver02" {
-      check_command = "dummy"
-      vars.vars_app["DEF"] = { app_type = "ABAP" }
-    }
-
-    globals.check_app_type = function(host, type) {
-      /* ensure that other hosts without the custom attribute do not match */
-      if (typeof(host.vars.vars_app) != Dictionary) {
-        return false
-      }
-
-      /* iterate over the vars_app dictionary */
-      for (key => val in host.vars.vars_app) {
-        /* if the value is a dictionary and if contains the app_type being the requested type */
-        if (typeof(val) == Dictionary && val.app_type == type) {
-          return true
-        }
-      }
-
-      /* nothing matched */
-      return false
-    }
-
-    object HostGroup "ABAP-app-server" {
-      assign where check_app_type(host, "ABAP")
-    }
 
 ### Access Object Attributes at Runtime <a id="access-object-attributes-at-runtime"></a>
 

From 2fee533b321aa307c9446ea0d90371f836350a43 Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Mon, 12 Feb 2018 09:49:11 +0100
Subject: [PATCH 10/57] Upgrading: Make it more clear that the Director script
 is just an example

refs #6086
---
 doc/16-upgrading-icinga-2.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/doc/16-upgrading-icinga-2.md b/doc/16-upgrading-icinga-2.md
index b5a7f0500..e66505627 100644
--- a/doc/16-upgrading-icinga-2.md
+++ b/doc/16-upgrading-icinga-2.md
@@ -81,8 +81,11 @@ In order to support a smooth migration between versions older than 2.8 and futur
 the built-in certificate migration path is planned to exist as long as the deprecated
 `ApiListener` object attributes exist.
 
-You are safe to use the existing configuration paths inside the `api` feature. If you plan your migration,
-look at the following example taken from the Director Linux deployment script for clients.
+You are safe to use the existing configuration paths inside the `api` feature.
+
+**Example**
+
+Look at the following example taken from the Director Linux deployment script for clients.
 
 * Ensure that the default certificate path is changed from `/etc/icinga2/pki` to `/var/lib/icinga2/certs`.
 

From 6f7739b1cb6e8e39b618935dc19d38ff06e052c3 Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Wed, 14 Feb 2018 13:04:42 +0100
Subject: [PATCH 11/57] Docs: Fix bracket in notification example

refs #6089
---
 doc/03-monitoring-basics.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/03-monitoring-basics.md b/doc/03-monitoring-basics.md
index fc768cd88..dabcaf831 100644
--- a/doc/03-monitoring-basics.md
+++ b/doc/03-monitoring-basics.md
@@ -1675,7 +1675,7 @@ apply Notification "mail-host-notification" to Service {
 
   if (service.vars.notification.mail.groups) {
     user_groups = service.vars.notification.mail.groups
-  } else {host.vars.notification.mail.groups) {
+  } else (host.vars.notification.mail.groups) {
     user_groups = host.vars.notification.mail.groups
   }
 

From 3ba509086771b75654c76ccb81f38e0d869be25a Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Tue, 30 Jan 2018 11:26:07 +0100
Subject: [PATCH 12/57] Add marco RequireNotNull

This is used to fix a number of possible nullptr dereferences
---
 lib/base/array-script.cpp              | 17 +++++++++++++++++
 lib/base/configobject-script.cpp       |  2 ++
 lib/base/datetime-script.cpp           |  1 +
 lib/base/dictionary-script.cpp         | 10 ++++++++++
 lib/base/function-script.cpp           |  2 ++
 lib/base/object-script.cpp             |  3 +++
 lib/base/object.cpp                    |  5 +++++
 lib/base/object.hpp                    |  4 ++++
 lib/base/typetype-script.cpp           |  3 ++-
 lib/icinga/checkable-script.cpp        |  1 +
 lib/icinga/macroprocessor.cpp          |  6 ++++++
 lib/methods/clusterchecktask.cpp       |  3 +++
 lib/methods/clusterzonechecktask.cpp   |  3 +++
 lib/methods/exceptionchecktask.cpp     |  3 +++
 lib/methods/icingachecktask.cpp        |  3 +++
 lib/methods/nullchecktask.cpp          |  7 +++++--
 lib/methods/nulleventtask.cpp          |  6 ++++--
 lib/methods/pluginchecktask.cpp        |  3 +++
 lib/methods/plugineventtask.cpp        |  2 ++
 lib/methods/pluginnotificationtask.cpp |  3 +++
 lib/methods/randomchecktask.cpp        |  7 +++++--
 lib/methods/timeperiodtask.cpp         |  7 +++++--
 22 files changed, 92 insertions(+), 9 deletions(-)

diff --git a/lib/base/array-script.cpp b/lib/base/array-script.cpp
index 568037d9e..b9535ef98 100644
--- a/lib/base/array-script.cpp
+++ b/lib/base/array-script.cpp
@@ -30,6 +30,7 @@ static double ArrayLen(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->GetLength();
 }
 
@@ -37,6 +38,7 @@ static void ArraySet(int index, const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->Set(index, value);
 }
 
@@ -44,6 +46,7 @@ static Value ArrayGet(int index)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->Get(index);
 }
 
@@ -51,6 +54,7 @@ static void ArrayAdd(const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->Add(value);
 }
 
@@ -58,6 +62,7 @@ static void ArrayRemove(int index)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->Remove(index);
 }
 
@@ -65,6 +70,7 @@ static bool ArrayContains(const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->Contains(value);
 }
 
@@ -72,6 +78,7 @@ static void ArrayClear(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->Clear();
 }
 
@@ -87,6 +94,7 @@ static Array::Ptr ArraySort(const std::vector<Value>& args)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	Array::Ptr arr = self->ShallowClone();
 
@@ -110,6 +118,7 @@ static Array::Ptr ArrayShallowClone(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->ShallowClone();
 }
 
@@ -117,6 +126,7 @@ static Value ArrayJoin(const Value& separator)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	Value result;
 	bool first = true;
@@ -139,6 +149,7 @@ static Array::Ptr ArrayReverse(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->Reverse();
 }
 
@@ -146,6 +157,7 @@ static Array::Ptr ArrayMap(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Map function must be side-effect free."));
@@ -166,6 +178,7 @@ static Value ArrayReduce(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Reduce function must be side-effect free."));
@@ -190,6 +203,7 @@ static Array::Ptr ArrayFilter(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Filter function must be side-effect free."));
@@ -211,6 +225,7 @@ static bool ArrayAny(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Filter function must be side-effect free."));
@@ -230,6 +245,7 @@ static bool ArrayAll(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Filter function must be side-effect free."));
@@ -248,6 +264,7 @@ static Array::Ptr ArrayUnique(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	std::set<Value> result;
 
diff --git a/lib/base/configobject-script.cpp b/lib/base/configobject-script.cpp
index dfe4455b6..30d22ceff 100644
--- a/lib/base/configobject-script.cpp
+++ b/lib/base/configobject-script.cpp
@@ -29,6 +29,7 @@ static void ConfigObjectModifyAttribute(const String& attr, const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	ConfigObject::Ptr self = vframe->Self;
+	RequireNotNull(self);
 	return self->ModifyAttribute(attr, value);
 }
 
@@ -36,6 +37,7 @@ static void ConfigObjectRestoreAttribute(const String& attr)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	ConfigObject::Ptr self = vframe->Self;
+	RequireNotNull(self);
 	return self->RestoreAttribute(attr);
 }
 
diff --git a/lib/base/datetime-script.cpp b/lib/base/datetime-script.cpp
index 7d9a14cc2..2e2f2f10b 100644
--- a/lib/base/datetime-script.cpp
+++ b/lib/base/datetime-script.cpp
@@ -29,6 +29,7 @@ static String DateTimeFormat(const String& format)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	DateTime::Ptr self = static_cast<DateTime::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	return self->Format(format);
 }
diff --git a/lib/base/dictionary-script.cpp b/lib/base/dictionary-script.cpp
index 66aa26cbd..9059a0a51 100644
--- a/lib/base/dictionary-script.cpp
+++ b/lib/base/dictionary-script.cpp
@@ -29,6 +29,7 @@ static double DictionaryLen(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->GetLength();
 }
 
@@ -36,6 +37,7 @@ static void DictionarySet(const String& key, const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->Set(key, value);
 }
 
@@ -43,6 +45,7 @@ static Value DictionaryGet(const String& key)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->Get(key);
 }
 
@@ -50,6 +53,7 @@ static void DictionaryRemove(const String& key)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->Remove(key);
 }
 
@@ -57,6 +61,7 @@ static bool DictionaryContains(const String& key)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->Contains(key);
 }
 
@@ -64,6 +69,7 @@ static Dictionary::Ptr DictionaryShallowClone(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->ShallowClone();
 }
 
@@ -72,6 +78,8 @@ static Array::Ptr DictionaryKeys(void)
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
 	Array::Ptr keys = new Array();
+	RequireNotNull(self);
+
 	ObjectLock olock(self);
 	for (const Dictionary::Pair& kv : self) {
 		keys->Add(kv.first);
@@ -84,6 +92,8 @@ static Array::Ptr DictionaryValues(void)
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
 	Array::Ptr keys = new Array();
+	RequireNotNull(self);
+
 	ObjectLock olock(self);
 	for (const Dictionary::Pair& kv : self) {
 		keys->Add(kv.second);
diff --git a/lib/base/function-script.cpp b/lib/base/function-script.cpp
index dab4255de..cd40feacb 100644
--- a/lib/base/function-script.cpp
+++ b/lib/base/function-script.cpp
@@ -32,6 +32,7 @@ static Value FunctionCall(const std::vector<Value>& args)
 
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Function::Ptr self = static_cast<Function::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	std::vector<Value> uargs(args.begin() + 1, args.end());
 	return self->Invoke(args[0], uargs);
@@ -41,6 +42,7 @@ static Value FunctionCallV(const Value& thisArg, const Array::Ptr& args)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Function::Ptr self = static_cast<Function::Ptr>(vframe->Self);
+	RequireNotNull(self);
 
 	std::vector<Value> uargs;
 
diff --git a/lib/base/object-script.cpp b/lib/base/object-script.cpp
index c8112a402..27bc487da 100644
--- a/lib/base/object-script.cpp
+++ b/lib/base/object-script.cpp
@@ -29,6 +29,7 @@ static String ObjectToString(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Object::Ptr self = static_cast<Object::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->ToString();
 }
 
@@ -36,6 +37,7 @@ static void ObjectNotifyAttribute(const String& attribute)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Object::Ptr self = static_cast<Object::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	self->NotifyField(self->GetReflectionType()->GetFieldId(attribute));
 }
 
@@ -43,6 +45,7 @@ static Object::Ptr ObjectClone(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Object::Ptr self = static_cast<Object::Ptr>(vframe->Self);
+	RequireNotNull(self);
 	return self->Clone();
 }
 
diff --git a/lib/base/object.cpp b/lib/base/object.cpp
index e9f3cd1bd..b261fefe6 100644
--- a/lib/base/object.cpp
+++ b/lib/base/object.cpp
@@ -261,3 +261,8 @@ INITIALIZE_ONCE([]() {
 });
 #endif /* I2_LEAK_DEBUG */
 
+void icinga::RequireNotNullInternal(const intrusive_ptr<Object>& object, const char *description)
+{
+	if (!object)
+		BOOST_THROW_EXCEPTION(std::invalid_argument("Pointer must not be null: " + String(description)));
+}
diff --git a/lib/base/object.hpp b/lib/base/object.hpp
index d3abc4648..6159c5b5e 100644
--- a/lib/base/object.hpp
+++ b/lib/base/object.hpp
@@ -62,6 +62,10 @@ extern I2_BASE_API Value Empty;
 	DECLARE_PTR_TYPEDEFS(klass); \
 	IMPL_TYPE_LOOKUP();
 
+#define RequireNotNull(ptr) RequireNotNullInternal(ptr, #ptr)
+
+I2_BASE_API void RequireNotNullInternal(const intrusive_ptr<Object>& object, const char *description);
+
 template<typename T>
 intrusive_ptr<Object> DefaultObjectFactory(const std::vector<Value>& args)
 {
diff --git a/lib/base/typetype-script.cpp b/lib/base/typetype-script.cpp
index 5189845b3..591de4667 100644
--- a/lib/base/typetype-script.cpp
+++ b/lib/base/typetype-script.cpp
@@ -37,7 +37,8 @@ static void TypeRegisterAttributeHandler(const String& fieldName, const Function
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Type::Ptr self = static_cast<Type::Ptr>(vframe->Self);
-	
+	RequireNotNull(self);
+
 	int fid = self->GetFieldId(fieldName);
 	self->RegisterAttributeHandler(fid, boost::bind(&InvokeAttributeHandlerHelper, callback, _1, _2));
 }
diff --git a/lib/icinga/checkable-script.cpp b/lib/icinga/checkable-script.cpp
index 40626fef9..f7ba56e80 100644
--- a/lib/icinga/checkable-script.cpp
+++ b/lib/icinga/checkable-script.cpp
@@ -30,6 +30,7 @@ static void CheckableProcessCheckResult(const CheckResult::Ptr& cr)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Checkable::Ptr self = vframe->Self;
+	RequireNotNull(self);
 	self->ProcessCheckResult(cr);
 }
 
diff --git a/lib/icinga/macroprocessor.cpp b/lib/icinga/macroprocessor.cpp
index 2027ef82f..ac45f1c90 100644
--- a/lib/icinga/macroprocessor.cpp
+++ b/lib/icinga/macroprocessor.cpp
@@ -40,6 +40,9 @@ Value MacroProcessor::ResolveMacros(const Value& str, const ResolverList& resolv
     const MacroProcessor::EscapeCallback& escapeFn, const Dictionary::Ptr& resolvedMacros,
     bool useResolvedMacros, int recursionLevel)
 {
+	if (useResolvedMacros)
+		RequireNotNull(resolvedMacros);
+
 	Value result;
 
 	if (str.IsEmpty())
@@ -454,6 +457,9 @@ Value MacroProcessor::ResolveArguments(const Value& command, const Dictionary::P
     const MacroProcessor::ResolverList& resolvers, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros, int recursionLevel)
 {
+	if (useResolvedMacros)
+		RequireNotNull(resolvedMacros);
+
 	Value resolvedCommand;
 	if (!arguments || command.IsObjectType<Array>() || command.IsObjectType<Function>())
 		resolvedCommand = MacroProcessor::ResolveMacros(command, resolvers, cr, NULL,
diff --git a/lib/methods/clusterchecktask.cpp b/lib/methods/clusterchecktask.cpp
index 2ad7f6578..513a5a475 100644
--- a/lib/methods/clusterchecktask.cpp
+++ b/lib/methods/clusterchecktask.cpp
@@ -38,6 +38,9 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, ClusterCheck, &ClusterCheckTask::ScriptFunc
 void ClusterCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(checkable);
+	RequireNotNull(cr);
+
 	if (resolvedMacros && !useResolvedMacros)
 		return;
 
diff --git a/lib/methods/clusterzonechecktask.cpp b/lib/methods/clusterzonechecktask.cpp
index 919e7fbed..699ef9bf3 100644
--- a/lib/methods/clusterzonechecktask.cpp
+++ b/lib/methods/clusterzonechecktask.cpp
@@ -34,6 +34,9 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, ClusterZoneCheck, &ClusterZoneCheckTask::Sc
 void ClusterZoneCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(checkable);
+	RequireNotNull(cr);
+
 	ApiListener::Ptr listener = ApiListener::GetInstance();
 
 	if (!listener) {
diff --git a/lib/methods/exceptionchecktask.cpp b/lib/methods/exceptionchecktask.cpp
index 0410621ab..120264327 100644
--- a/lib/methods/exceptionchecktask.cpp
+++ b/lib/methods/exceptionchecktask.cpp
@@ -34,6 +34,9 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, ExceptionCheck, &ExceptionCheckTask::Script
 void ExceptionCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(service);
+	RequireNotNull(cr);
+
 	if (resolvedMacros && !useResolvedMacros)
 		return;
 
diff --git a/lib/methods/icingachecktask.cpp b/lib/methods/icingachecktask.cpp
index 3a4b668a9..d96dfedd1 100644
--- a/lib/methods/icingachecktask.cpp
+++ b/lib/methods/icingachecktask.cpp
@@ -35,6 +35,9 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, IcingaCheck, &IcingaCheckTask::ScriptFunc,
 void IcingaCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(service);
+	RequireNotNull(cr);
+
 	if (resolvedMacros && !useResolvedMacros)
 		return;
 
diff --git a/lib/methods/nullchecktask.cpp b/lib/methods/nullchecktask.cpp
index 09b060c2b..50d2409a1 100644
--- a/lib/methods/nullchecktask.cpp
+++ b/lib/methods/nullchecktask.cpp
@@ -32,9 +32,12 @@ using namespace icinga;
 
 REGISTER_SCRIPTFUNCTION_NS(Internal, NullCheck, &NullCheckTask::ScriptFunc, "checkable:cr:resolvedMacros:useResolvedMacros");
 
-void NullCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult::Ptr& cr,
+void NullCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(checkable);
+	RequireNotNull(cr);
+
 	if (resolvedMacros && !useResolvedMacros)
 		return;
 
@@ -48,5 +51,5 @@ void NullCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult:
 	cr->SetPerformanceData(perfdata);
 	cr->SetState(ServiceOK);
 
-	service->ProcessCheckResult(cr);
+	checkable->ProcessCheckResult(cr);
 }
diff --git a/lib/methods/nulleventtask.cpp b/lib/methods/nulleventtask.cpp
index 2d56e8a34..f80edd4e0 100644
--- a/lib/methods/nulleventtask.cpp
+++ b/lib/methods/nulleventtask.cpp
@@ -25,5 +25,7 @@ using namespace icinga;
 
 REGISTER_SCRIPTFUNCTION_NS(Internal, NullEvent, &NullEventTask::ScriptFunc, "checkable:resolvedMacros:useResolvedMacros");
 
-void NullEventTask::ScriptFunc(const Checkable::Ptr&, const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
-{ }
+void NullEventTask::ScriptFunc(const Checkable::Ptr& checkable, const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
+{
+	RequireNotNull(checkable);
+}
diff --git a/lib/methods/pluginchecktask.cpp b/lib/methods/pluginchecktask.cpp
index abf2b0cd5..ddd8dba38 100644
--- a/lib/methods/pluginchecktask.cpp
+++ b/lib/methods/pluginchecktask.cpp
@@ -38,6 +38,9 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, PluginCheck,  &PluginCheckTask::ScriptFunc,
 void PluginCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(checkable);
+	RequireNotNull(cr);
+
 	CheckCommand::Ptr commandObj = checkable->GetCheckCommand();
 
 	Host::Ptr host;
diff --git a/lib/methods/plugineventtask.cpp b/lib/methods/plugineventtask.cpp
index 48a0b9ce0..a1a49f066 100644
--- a/lib/methods/plugineventtask.cpp
+++ b/lib/methods/plugineventtask.cpp
@@ -36,6 +36,8 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, PluginEvent, &PluginEventTask::ScriptFunc,
 void PluginEventTask::ScriptFunc(const Checkable::Ptr& checkable,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(checkable);
+
 	EventCommand::Ptr commandObj = checkable->GetEventCommand();
 
 	Host::Ptr host;
diff --git a/lib/methods/pluginnotificationtask.cpp b/lib/methods/pluginnotificationtask.cpp
index 42403e7bb..730ae6770 100644
--- a/lib/methods/pluginnotificationtask.cpp
+++ b/lib/methods/pluginnotificationtask.cpp
@@ -39,6 +39,9 @@ void PluginNotificationTask::ScriptFunc(const Notification::Ptr& notification,
     const String& author, const String& comment, const Dictionary::Ptr& resolvedMacros,
     bool useResolvedMacros)
 {
+	RequireNotNull(notification);
+	RequireNotNull(user);
+
 	NotificationCommand::Ptr commandObj = notification->GetCommand();
 
 	NotificationType type = static_cast<NotificationType>(itype);
diff --git a/lib/methods/randomchecktask.cpp b/lib/methods/randomchecktask.cpp
index 0d31e795a..7afa0c7af 100644
--- a/lib/methods/randomchecktask.cpp
+++ b/lib/methods/randomchecktask.cpp
@@ -32,9 +32,12 @@ using namespace icinga;
 
 REGISTER_SCRIPTFUNCTION_NS(Internal, RandomCheck, &RandomCheckTask::ScriptFunc, "checkable:cr:resolvedMacros:useResolvedMacros");
 
-void RandomCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult::Ptr& cr,
+void RandomCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
+	RequireNotNull(checkable);
+	RequireNotNull(cr);
+
 	if (resolvedMacros && !useResolvedMacros)
 		return;
 
@@ -48,5 +51,5 @@ void RandomCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResul
 	cr->SetPerformanceData(perfdata);
 	cr->SetState(static_cast<ServiceState>(Utility::Random() % 4));
 
-	service->ProcessCheckResult(cr);
+	checkable->ProcessCheckResult(cr);
 }
diff --git a/lib/methods/timeperiodtask.cpp b/lib/methods/timeperiodtask.cpp
index c26b4cedd..92c57b3cf 100644
--- a/lib/methods/timeperiodtask.cpp
+++ b/lib/methods/timeperiodtask.cpp
@@ -25,15 +25,18 @@ using namespace icinga;
 REGISTER_SCRIPTFUNCTION_NS(Internal, EmptyTimePeriod, &TimePeriodTask::EmptyTimePeriodUpdate, "tp:begin:end");
 REGISTER_SCRIPTFUNCTION_NS(Internal, EvenMinutesTimePeriod, &TimePeriodTask::EvenMinutesTimePeriodUpdate, "tp:begin:end");
 
-Array::Ptr TimePeriodTask::EmptyTimePeriodUpdate(const TimePeriod::Ptr&, double, double)
+Array::Ptr TimePeriodTask::EmptyTimePeriodUpdate(const TimePeriod::Ptr& tp, double, double)
 {
+	RequireNotNull(tp);
+
 	Array::Ptr segments = new Array();
 	return segments;
 }
 
-Array::Ptr TimePeriodTask::EvenMinutesTimePeriodUpdate(const TimePeriod::Ptr&, double begin, double end)
+Array::Ptr TimePeriodTask::EvenMinutesTimePeriodUpdate(const TimePeriod::Ptr& tp, double begin, double end)
 {
 	Array::Ptr segments = new Array();
+	RequireNotNull(tp);
 
 	for (long t = begin / 60 - 1; t * 60 < end; t++) {
 		if ((t % 2) == 0) {

From 71c420d5014cd84e67acd1504945ee542d48cc39 Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Wed, 31 Jan 2018 10:17:49 +0100
Subject: [PATCH 13/57] Fix nullptr deref in cluster events

---
 lib/icinga/clusterevents.cpp         | 30 ----------------------------
 lib/remote/jsonrpcconnection-pki.cpp |  3 ---
 lib/remote/jsonrpcconnection.cpp     |  9 +++++----
 3 files changed, 5 insertions(+), 37 deletions(-)

diff --git a/lib/icinga/clusterevents.cpp b/lib/icinga/clusterevents.cpp
index 57b4691e1..a9d8ba825 100644
--- a/lib/icinga/clusterevents.cpp
+++ b/lib/icinga/clusterevents.cpp
@@ -114,9 +114,6 @@ Value ClusterEvents::CheckResultAPIHandler(const MessageOrigin::Ptr& origin, con
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	CheckResult::Ptr cr;
 	Array::Ptr vperf;
 
@@ -220,9 +217,6 @@ Value ClusterEvents::NextCheckChangedAPIHandler(const MessageOrigin::Ptr& origin
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -284,9 +278,6 @@ Value ClusterEvents::NextNotificationChangedAPIHandler(const MessageOrigin::Ptr&
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Notification::Ptr notification = Notification::GetByName(params->Get("notification"));
 
 	if (!notification)
@@ -344,9 +335,6 @@ Value ClusterEvents::ForceNextCheckChangedAPIHandler(const MessageOrigin::Ptr& o
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -409,9 +397,6 @@ Value ClusterEvents::ForceNextNotificationChangedAPIHandler(const MessageOrigin:
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -480,9 +465,6 @@ Value ClusterEvents::AcknowledgementSetAPIHandler(const MessageOrigin::Ptr& orig
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -546,9 +528,6 @@ Value ClusterEvents::AcknowledgementClearedAPIHandler(const MessageOrigin::Ptr&
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -717,9 +696,6 @@ Value ClusterEvents::SendNotificationsAPIHandler(const MessageOrigin::Ptr& origi
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -811,9 +787,6 @@ Value ClusterEvents::NotificationSentUserAPIHandler(const MessageOrigin::Ptr& or
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
@@ -927,9 +900,6 @@ Value ClusterEvents::NotificationSentToAllUsersAPIHandler(const MessageOrigin::P
 		return Empty;
 	}
 
-	if (!params)
-		return Empty;
-
 	Host::Ptr host = Host::GetByName(params->Get("host"));
 
 	if (!host)
diff --git a/lib/remote/jsonrpcconnection-pki.cpp b/lib/remote/jsonrpcconnection-pki.cpp
index 048d6c1c1..5a76524e2 100644
--- a/lib/remote/jsonrpcconnection-pki.cpp
+++ b/lib/remote/jsonrpcconnection-pki.cpp
@@ -40,9 +40,6 @@ REGISTER_APIFUNCTION(UpdateCertificate, pki, &UpdateCertificateHandler);
 
 Value RequestCertificateHandler(const MessageOrigin::Ptr& origin, const Dictionary::Ptr& params)
 {
-	if (!params)
-		return Empty;
-
 	String certText = params->Get("cert_request");
 
 	boost::shared_ptr<X509> cert;
diff --git a/lib/remote/jsonrpcconnection.cpp b/lib/remote/jsonrpcconnection.cpp
index e6cd9a3c8..0be3fb46e 100644
--- a/lib/remote/jsonrpcconnection.cpp
+++ b/lib/remote/jsonrpcconnection.cpp
@@ -212,7 +212,11 @@ void JsonRpcConnection::MessageHandler(const String& jsonString)
 			Log(LogNotice, "JsonRpcConnection")
 			    << "Call to non-existent function '" << method << "' from endpoint '" << m_Identity << "'.";
 		} else {
-			resultMessage->Set("result", afunc->Invoke(origin, message->Get("params")));
+			Dictionary::Ptr params = message->Get("params");
+			if (params)
+				resultMessage->Set("result", afunc->Invoke(origin, params));
+			else
+				resultMessage->Set("result", Empty);
 		}
 	} catch (const std::exception& ex) {
 		/* TODO: Add a user readable error message for the remote caller */
@@ -274,9 +278,6 @@ void JsonRpcConnection::DataAvailableHandler(void)
 
 Value SetLogPositionHandler(const MessageOrigin::Ptr& origin, const Dictionary::Ptr& params)
 {
-	if (!params)
-		return Empty;
-
 	double log_position = params->Get("log_position");
 	Endpoint::Ptr endpoint = origin->FromClient->GetEndpoint();
 

From 9de36c0999a1fe189e30a79acc8344c9d2dc90eb Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Wed, 21 Feb 2018 13:42:58 +0100
Subject: [PATCH 14/57] Rename macro RequireNotNull to REQUIRE_NOT_NULL

---
 lib/base/array-script.cpp              | 34 +++++++++++++-------------
 lib/base/configobject-script.cpp       |  4 +--
 lib/base/datetime-script.cpp           |  2 +-
 lib/base/dictionary-script.cpp         | 16 ++++++------
 lib/base/function-script.cpp           |  4 +--
 lib/base/object-script.cpp             |  6 ++---
 lib/base/object.hpp                    |  2 +-
 lib/base/typetype-script.cpp           |  2 +-
 lib/icinga/checkable-script.cpp        |  2 +-
 lib/icinga/macroprocessor.cpp          |  4 +--
 lib/methods/clusterchecktask.cpp       |  4 +--
 lib/methods/clusterzonechecktask.cpp   |  4 +--
 lib/methods/exceptionchecktask.cpp     |  6 ++---
 lib/methods/icingachecktask.cpp        |  8 +++---
 lib/methods/nullchecktask.cpp          |  4 +--
 lib/methods/nulleventtask.cpp          |  2 +-
 lib/methods/pluginchecktask.cpp        |  4 +--
 lib/methods/plugineventtask.cpp        |  2 +-
 lib/methods/pluginnotificationtask.cpp |  4 +--
 lib/methods/randomchecktask.cpp        |  4 +--
 lib/methods/timeperiodtask.cpp         |  4 +--
 21 files changed, 61 insertions(+), 61 deletions(-)

diff --git a/lib/base/array-script.cpp b/lib/base/array-script.cpp
index b9535ef98..d97873819 100644
--- a/lib/base/array-script.cpp
+++ b/lib/base/array-script.cpp
@@ -30,7 +30,7 @@ static double ArrayLen(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->GetLength();
 }
 
@@ -38,7 +38,7 @@ static void ArraySet(int index, const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->Set(index, value);
 }
 
@@ -46,7 +46,7 @@ static Value ArrayGet(int index)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->Get(index);
 }
 
@@ -54,7 +54,7 @@ static void ArrayAdd(const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->Add(value);
 }
 
@@ -62,7 +62,7 @@ static void ArrayRemove(int index)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->Remove(index);
 }
 
@@ -70,7 +70,7 @@ static bool ArrayContains(const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->Contains(value);
 }
 
@@ -78,7 +78,7 @@ static void ArrayClear(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->Clear();
 }
 
@@ -94,7 +94,7 @@ static Array::Ptr ArraySort(const std::vector<Value>& args)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	Array::Ptr arr = self->ShallowClone();
 
@@ -118,7 +118,7 @@ static Array::Ptr ArrayShallowClone(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->ShallowClone();
 }
 
@@ -126,7 +126,7 @@ static Value ArrayJoin(const Value& separator)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	Value result;
 	bool first = true;
@@ -149,7 +149,7 @@ static Array::Ptr ArrayReverse(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->Reverse();
 }
 
@@ -157,7 +157,7 @@ static Array::Ptr ArrayMap(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Map function must be side-effect free."));
@@ -178,7 +178,7 @@ static Value ArrayReduce(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Reduce function must be side-effect free."));
@@ -203,7 +203,7 @@ static Array::Ptr ArrayFilter(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Filter function must be side-effect free."));
@@ -225,7 +225,7 @@ static bool ArrayAny(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Filter function must be side-effect free."));
@@ -245,7 +245,7 @@ static bool ArrayAll(const Function::Ptr& function)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	if (vframe->Sandboxed && !function->IsSideEffectFree())
 		BOOST_THROW_EXCEPTION(ScriptError("Filter function must be side-effect free."));
@@ -264,7 +264,7 @@ static Array::Ptr ArrayUnique(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Array::Ptr self = static_cast<Array::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	std::set<Value> result;
 
diff --git a/lib/base/configobject-script.cpp b/lib/base/configobject-script.cpp
index 30d22ceff..a9de57d40 100644
--- a/lib/base/configobject-script.cpp
+++ b/lib/base/configobject-script.cpp
@@ -29,7 +29,7 @@ static void ConfigObjectModifyAttribute(const String& attr, const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	ConfigObject::Ptr self = vframe->Self;
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->ModifyAttribute(attr, value);
 }
 
@@ -37,7 +37,7 @@ static void ConfigObjectRestoreAttribute(const String& attr)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	ConfigObject::Ptr self = vframe->Self;
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->RestoreAttribute(attr);
 }
 
diff --git a/lib/base/datetime-script.cpp b/lib/base/datetime-script.cpp
index 2e2f2f10b..dd8207d63 100644
--- a/lib/base/datetime-script.cpp
+++ b/lib/base/datetime-script.cpp
@@ -29,7 +29,7 @@ static String DateTimeFormat(const String& format)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	DateTime::Ptr self = static_cast<DateTime::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	return self->Format(format);
 }
diff --git a/lib/base/dictionary-script.cpp b/lib/base/dictionary-script.cpp
index 9059a0a51..04e90aa69 100644
--- a/lib/base/dictionary-script.cpp
+++ b/lib/base/dictionary-script.cpp
@@ -29,7 +29,7 @@ static double DictionaryLen(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->GetLength();
 }
 
@@ -37,7 +37,7 @@ static void DictionarySet(const String& key, const Value& value)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->Set(key, value);
 }
 
@@ -45,7 +45,7 @@ static Value DictionaryGet(const String& key)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->Get(key);
 }
 
@@ -53,7 +53,7 @@ static void DictionaryRemove(const String& key)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->Remove(key);
 }
 
@@ -61,7 +61,7 @@ static bool DictionaryContains(const String& key)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->Contains(key);
 }
 
@@ -69,7 +69,7 @@ static Dictionary::Ptr DictionaryShallowClone(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->ShallowClone();
 }
 
@@ -78,7 +78,7 @@ static Array::Ptr DictionaryKeys(void)
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
 	Array::Ptr keys = new Array();
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	ObjectLock olock(self);
 	for (const Dictionary::Pair& kv : self) {
@@ -92,7 +92,7 @@ static Array::Ptr DictionaryValues(void)
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Dictionary::Ptr self = static_cast<Dictionary::Ptr>(vframe->Self);
 	Array::Ptr keys = new Array();
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	ObjectLock olock(self);
 	for (const Dictionary::Pair& kv : self) {
diff --git a/lib/base/function-script.cpp b/lib/base/function-script.cpp
index cd40feacb..ac7fed4ba 100644
--- a/lib/base/function-script.cpp
+++ b/lib/base/function-script.cpp
@@ -32,7 +32,7 @@ static Value FunctionCall(const std::vector<Value>& args)
 
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Function::Ptr self = static_cast<Function::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	std::vector<Value> uargs(args.begin() + 1, args.end());
 	return self->Invoke(args[0], uargs);
@@ -42,7 +42,7 @@ static Value FunctionCallV(const Value& thisArg, const Array::Ptr& args)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Function::Ptr self = static_cast<Function::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	std::vector<Value> uargs;
 
diff --git a/lib/base/object-script.cpp b/lib/base/object-script.cpp
index 27bc487da..df136b496 100644
--- a/lib/base/object-script.cpp
+++ b/lib/base/object-script.cpp
@@ -29,7 +29,7 @@ static String ObjectToString(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Object::Ptr self = static_cast<Object::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->ToString();
 }
 
@@ -37,7 +37,7 @@ static void ObjectNotifyAttribute(const String& attribute)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Object::Ptr self = static_cast<Object::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->NotifyField(self->GetReflectionType()->GetFieldId(attribute));
 }
 
@@ -45,7 +45,7 @@ static Object::Ptr ObjectClone(void)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Object::Ptr self = static_cast<Object::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	return self->Clone();
 }
 
diff --git a/lib/base/object.hpp b/lib/base/object.hpp
index 6159c5b5e..dc585665b 100644
--- a/lib/base/object.hpp
+++ b/lib/base/object.hpp
@@ -62,7 +62,7 @@ extern I2_BASE_API Value Empty;
 	DECLARE_PTR_TYPEDEFS(klass); \
 	IMPL_TYPE_LOOKUP();
 
-#define RequireNotNull(ptr) RequireNotNullInternal(ptr, #ptr)
+#define REQUIRE_NOT_NULL(ptr) RequireNotNullInternal(ptr, #ptr)
 
 I2_BASE_API void RequireNotNullInternal(const intrusive_ptr<Object>& object, const char *description);
 
diff --git a/lib/base/typetype-script.cpp b/lib/base/typetype-script.cpp
index 591de4667..c9d42f731 100644
--- a/lib/base/typetype-script.cpp
+++ b/lib/base/typetype-script.cpp
@@ -37,7 +37,7 @@ static void TypeRegisterAttributeHandler(const String& fieldName, const Function
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Type::Ptr self = static_cast<Type::Ptr>(vframe->Self);
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 
 	int fid = self->GetFieldId(fieldName);
 	self->RegisterAttributeHandler(fid, boost::bind(&InvokeAttributeHandlerHelper, callback, _1, _2));
diff --git a/lib/icinga/checkable-script.cpp b/lib/icinga/checkable-script.cpp
index f7ba56e80..89b98d3c8 100644
--- a/lib/icinga/checkable-script.cpp
+++ b/lib/icinga/checkable-script.cpp
@@ -30,7 +30,7 @@ static void CheckableProcessCheckResult(const CheckResult::Ptr& cr)
 {
 	ScriptFrame *vframe = ScriptFrame::GetCurrentFrame();
 	Checkable::Ptr self = vframe->Self;
-	RequireNotNull(self);
+	REQUIRE_NOT_NULL(self);
 	self->ProcessCheckResult(cr);
 }
 
diff --git a/lib/icinga/macroprocessor.cpp b/lib/icinga/macroprocessor.cpp
index ac45f1c90..a295156f7 100644
--- a/lib/icinga/macroprocessor.cpp
+++ b/lib/icinga/macroprocessor.cpp
@@ -41,7 +41,7 @@ Value MacroProcessor::ResolveMacros(const Value& str, const ResolverList& resolv
     bool useResolvedMacros, int recursionLevel)
 {
 	if (useResolvedMacros)
-		RequireNotNull(resolvedMacros);
+		REQUIRE_NOT_NULL(resolvedMacros);
 
 	Value result;
 
@@ -458,7 +458,7 @@ Value MacroProcessor::ResolveArguments(const Value& command, const Dictionary::P
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros, int recursionLevel)
 {
 	if (useResolvedMacros)
-		RequireNotNull(resolvedMacros);
+		REQUIRE_NOT_NULL(resolvedMacros);
 
 	Value resolvedCommand;
 	if (!arguments || command.IsObjectType<Array>() || command.IsObjectType<Function>())
diff --git a/lib/methods/clusterchecktask.cpp b/lib/methods/clusterchecktask.cpp
index 513a5a475..0f3935181 100644
--- a/lib/methods/clusterchecktask.cpp
+++ b/lib/methods/clusterchecktask.cpp
@@ -38,8 +38,8 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, ClusterCheck, &ClusterCheckTask::ScriptFunc
 void ClusterCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	if (resolvedMacros && !useResolvedMacros)
 		return;
diff --git a/lib/methods/clusterzonechecktask.cpp b/lib/methods/clusterzonechecktask.cpp
index 699ef9bf3..593b927d7 100644
--- a/lib/methods/clusterzonechecktask.cpp
+++ b/lib/methods/clusterzonechecktask.cpp
@@ -34,8 +34,8 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, ClusterZoneCheck, &ClusterZoneCheckTask::Sc
 void ClusterZoneCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	ApiListener::Ptr listener = ApiListener::GetInstance();
 
diff --git a/lib/methods/exceptionchecktask.cpp b/lib/methods/exceptionchecktask.cpp
index 120264327..9045155e8 100644
--- a/lib/methods/exceptionchecktask.cpp
+++ b/lib/methods/exceptionchecktask.cpp
@@ -31,11 +31,11 @@ using namespace icinga;
 
 REGISTER_SCRIPTFUNCTION_NS(Internal, ExceptionCheck, &ExceptionCheckTask::ScriptFunc, "checkable:cr:resolvedMacros:useResolvedMacros");
 
-void ExceptionCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult::Ptr& cr,
+void ExceptionCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(service);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	if (resolvedMacros && !useResolvedMacros)
 		return;
diff --git a/lib/methods/icingachecktask.cpp b/lib/methods/icingachecktask.cpp
index d96dfedd1..b288b6be2 100644
--- a/lib/methods/icingachecktask.cpp
+++ b/lib/methods/icingachecktask.cpp
@@ -32,11 +32,11 @@ using namespace icinga;
 
 REGISTER_SCRIPTFUNCTION_NS(Internal, IcingaCheck, &IcingaCheckTask::ScriptFunc, "checkable:cr:resolvedMacros:useResolvedMacros");
 
-void IcingaCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResult::Ptr& cr,
+void IcingaCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(service);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	if (resolvedMacros && !useResolvedMacros)
 		return;
@@ -115,5 +115,5 @@ void IcingaCheckTask::ScriptFunc(const Checkable::Ptr& service, const CheckResul
 	} else
 		cr->SetState(ServiceOK);
 
-	service->ProcessCheckResult(cr);
+	checkable->ProcessCheckResult(cr);
 }
diff --git a/lib/methods/nullchecktask.cpp b/lib/methods/nullchecktask.cpp
index 50d2409a1..d9b1a9e5f 100644
--- a/lib/methods/nullchecktask.cpp
+++ b/lib/methods/nullchecktask.cpp
@@ -35,8 +35,8 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, NullCheck, &NullCheckTask::ScriptFunc, "che
 void NullCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	if (resolvedMacros && !useResolvedMacros)
 		return;
diff --git a/lib/methods/nulleventtask.cpp b/lib/methods/nulleventtask.cpp
index f80edd4e0..21a96c230 100644
--- a/lib/methods/nulleventtask.cpp
+++ b/lib/methods/nulleventtask.cpp
@@ -27,5 +27,5 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, NullEvent, &NullEventTask::ScriptFunc, "che
 
 void NullEventTask::ScriptFunc(const Checkable::Ptr& checkable, const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
+	REQUIRE_NOT_NULL(checkable);
 }
diff --git a/lib/methods/pluginchecktask.cpp b/lib/methods/pluginchecktask.cpp
index ddd8dba38..bb1c25d2f 100644
--- a/lib/methods/pluginchecktask.cpp
+++ b/lib/methods/pluginchecktask.cpp
@@ -38,8 +38,8 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, PluginCheck,  &PluginCheckTask::ScriptFunc,
 void PluginCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	CheckCommand::Ptr commandObj = checkable->GetCheckCommand();
 
diff --git a/lib/methods/plugineventtask.cpp b/lib/methods/plugineventtask.cpp
index a1a49f066..5c0dc79ee 100644
--- a/lib/methods/plugineventtask.cpp
+++ b/lib/methods/plugineventtask.cpp
@@ -36,7 +36,7 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, PluginEvent, &PluginEventTask::ScriptFunc,
 void PluginEventTask::ScriptFunc(const Checkable::Ptr& checkable,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
+	REQUIRE_NOT_NULL(checkable);
 
 	EventCommand::Ptr commandObj = checkable->GetEventCommand();
 
diff --git a/lib/methods/pluginnotificationtask.cpp b/lib/methods/pluginnotificationtask.cpp
index 730ae6770..bfab41cc0 100644
--- a/lib/methods/pluginnotificationtask.cpp
+++ b/lib/methods/pluginnotificationtask.cpp
@@ -39,8 +39,8 @@ void PluginNotificationTask::ScriptFunc(const Notification::Ptr& notification,
     const String& author, const String& comment, const Dictionary::Ptr& resolvedMacros,
     bool useResolvedMacros)
 {
-	RequireNotNull(notification);
-	RequireNotNull(user);
+	REQUIRE_NOT_NULL(notification);
+	REQUIRE_NOT_NULL(user);
 
 	NotificationCommand::Ptr commandObj = notification->GetCommand();
 
diff --git a/lib/methods/randomchecktask.cpp b/lib/methods/randomchecktask.cpp
index 7afa0c7af..23ac841a7 100644
--- a/lib/methods/randomchecktask.cpp
+++ b/lib/methods/randomchecktask.cpp
@@ -35,8 +35,8 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, RandomCheck, &RandomCheckTask::ScriptFunc,
 void RandomCheckTask::ScriptFunc(const Checkable::Ptr& checkable, const CheckResult::Ptr& cr,
     const Dictionary::Ptr& resolvedMacros, bool useResolvedMacros)
 {
-	RequireNotNull(checkable);
-	RequireNotNull(cr);
+	REQUIRE_NOT_NULL(checkable);
+	REQUIRE_NOT_NULL(cr);
 
 	if (resolvedMacros && !useResolvedMacros)
 		return;
diff --git a/lib/methods/timeperiodtask.cpp b/lib/methods/timeperiodtask.cpp
index 92c57b3cf..e76949f7b 100644
--- a/lib/methods/timeperiodtask.cpp
+++ b/lib/methods/timeperiodtask.cpp
@@ -27,7 +27,7 @@ REGISTER_SCRIPTFUNCTION_NS(Internal, EvenMinutesTimePeriod, &TimePeriodTask::Eve
 
 Array::Ptr TimePeriodTask::EmptyTimePeriodUpdate(const TimePeriod::Ptr& tp, double, double)
 {
-	RequireNotNull(tp);
+	REQUIRE_NOT_NULL(tp);
 
 	Array::Ptr segments = new Array();
 	return segments;
@@ -36,7 +36,7 @@ Array::Ptr TimePeriodTask::EmptyTimePeriodUpdate(const TimePeriod::Ptr& tp, doub
 Array::Ptr TimePeriodTask::EvenMinutesTimePeriodUpdate(const TimePeriod::Ptr& tp, double begin, double end)
 {
 	Array::Ptr segments = new Array();
-	RequireNotNull(tp);
+	REQUIRE_NOT_NULL(tp);
 
 	for (long t = begin / 60 - 1; t * 60 < end; t++) {
 		if ((t % 2) == 0) {

From 3cb7d2dbd088c81a5f51becc5ec872f759ea79f3 Mon Sep 17 00:00:00 2001
From: Dirk Goetz <dirk.goetz@netways.de>
Date: Mon, 15 Jan 2018 15:05:09 +0100
Subject: [PATCH 15/57] SELinux: Allows icinga2_t to send sigkill to all
 domains it transitions to

Fixes #5916
---
 tools/selinux/icinga2.if | 1 +
 tools/selinux/icinga2.te | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/selinux/icinga2.if b/tools/selinux/icinga2.if
index f54ad4fe3..15fb03478 100644
--- a/tools/selinux/icinga2.if
+++ b/tools/selinux/icinga2.if
@@ -364,6 +364,7 @@ interface(`icinga2_execstrans',`
 	')
 
 	domtrans_pattern(icinga2_t, $1, $2)
+        allow icinga2_t $2:process sigkill;
 ')
 
 ######################################
diff --git a/tools/selinux/icinga2.te b/tools/selinux/icinga2.te
index 1db47d3f6..da6e8b884 100644
--- a/tools/selinux/icinga2.te
+++ b/tools/selinux/icinga2.te
@@ -1,4 +1,4 @@
-policy_module(icinga2, 0.1.4)
+policy_module(icinga2, 0.1.5)
 
 ########################################
 #

From 0339a2b8277c046909ccd17380f5848e0540615a Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 31 Jan 2018 07:59:49 +0100
Subject: [PATCH 16/57] Add validation for HTTP connection sizes

---
 lib/remote/httpchunkedencoding.cpp | 2 ++
 lib/remote/httprequest.cpp         | 7 ++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/remote/httpchunkedencoding.cpp b/lib/remote/httpchunkedencoding.cpp
index 8903a4305..32d7c199c 100644
--- a/lib/remote/httpchunkedencoding.cpp
+++ b/lib/remote/httpchunkedencoding.cpp
@@ -37,6 +37,8 @@ StreamReadStatus HttpChunkedEncoding::ReadChunkFromStream(const Stream::Ptr& str
 		msgbuf << std::hex << line;
 		msgbuf >> context.LengthIndicator;
 
+		if (context.LengthIndicator < 0)
+			BOOST_THROW_EXCEPTION(std::invalid_argument("HTTP chunk length must not be negative."));
 	}
 
 	StreamReadContext& scontext = context.StreamContext;
diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp
index 43918c322..0a2f161ab 100644
--- a/lib/remote/httprequest.cpp
+++ b/lib/remote/httprequest.cpp
@@ -131,7 +131,12 @@ bool HttpRequest::Parse(StreamReadContext& src, bool may_wait)
 				src.MustRead = false;
 			}
 
-			size_t length_indicator = Convert::ToLong(Headers->Get("content-length"));
+			long length_indicator_signed = Convert::ToLong(Headers->Get("content-length"));
+
+			if (length_indicator_signed < 0)
+				BOOST_THROW_EXCEPTION(std::invalid_argument("Content-Length must not be negative."));
+
+			size_t length_indicator = length_indicator_signed;
 
 			if (src.Size < length_indicator) {
 				src.MustRead = true;

From f5f8b90ec841dc3781b9947557c14b9337d778f0 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 31 Jan 2018 09:05:06 +0100
Subject: [PATCH 17/57] Add HTTP Header size limits

---
 lib/remote/httprequest.cpp | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp
index 0a2f161ab..b29088092 100644
--- a/lib/remote/httprequest.cpp
+++ b/lib/remote/httprequest.cpp
@@ -45,8 +45,15 @@ bool HttpRequest::Parse(StreamReadContext& src, bool may_wait)
 		String line;
 		StreamReadStatus srs = m_Stream->ReadLine(&line, src, may_wait);
 
-		if (srs != StatusNewItem)
+		if (srs != StatusNewItem) {
+			if (src.Size > 512)
+				BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded"));
+
 			return false;
+		}
+
+		if (line.GetLength() > 512)
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded"));
 
 		if (m_State == HttpRequestStart) {
 			/* ignore trailing new-lines */
@@ -84,6 +91,9 @@ bool HttpRequest::Parse(StreamReadContext& src, bool may_wait)
 				return true;
 
 			} else {
+				if (Headers->GetLength() > 128)
+					BOOST_THROW_EXCEPTION(std::invalid_argument("Maximum number of HTTP request headers exceeded"));
+
 				String::SizeType pos = line.FindFirstOf(":");
 				if (pos == String::NPos)
 					BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid HTTP request"));

From e1c46cedd1f104d3a9c61bec601b651d5c70e180 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Tue, 30 Jan 2018 13:34:26 +0100
Subject: [PATCH 18/57] Fix nullptr deref

---
 lib/remote/httpserverconnection.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index c2538b6eb..d13086b40 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -165,9 +165,12 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
 
 	String requestUrl = request.RequestUrl->Format();
 
+	Socket::Ptr socket = m_Stream->GetSocket();
+
 	Log(LogInformation, "HttpServerConnection")
-	    << "Request: " << request.RequestMethod << " " << requestUrl
-	    << " (from " << m_Stream->GetSocket()->GetPeerAddress() << ", user: " << (user ? user->GetName() : "<unauthenticated>") << ")";
+		<< "Request: " << request.RequestMethod << " " << requestUrl
+		<< " (from " << (socket ? socket->GetPeerAddress() : "<unkown>")
+		<< ", user: " << (user ? user->GetName() : "<unauthenticated>") << ")";
 
 	HttpResponse response(m_Stream, request);
 

From a46dc64e6a99742525e25b637844b81f30a0da81 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Thu, 1 Feb 2018 15:10:28 +0100
Subject: [PATCH 19/57] Only read body from authenticated connections

This means we are not allowing unauthenticated requests anymore
---
 lib/remote/httprequest.cpp          | 248 +++++++++++++++-------------
 lib/remote/httprequest.hpp          |   6 +-
 lib/remote/httpserverconnection.cpp |  46 ++++--
 3 files changed, 162 insertions(+), 138 deletions(-)

diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp
index b29088092..2c731c4fc 100644
--- a/lib/remote/httprequest.cpp
+++ b/lib/remote/httprequest.cpp
@@ -29,135 +29,147 @@
 using namespace icinga;
 
 HttpRequest::HttpRequest(const Stream::Ptr& stream)
-    : Complete(false),
-      ProtocolVersion(HttpVersion11),
-      Headers(new Dictionary()),
-      m_Stream(stream),
-      m_State(HttpRequestStart)
+	: CompleteHeaders(false),
+	CompleteBody(false),
+	ProtocolVersion(HttpVersion11),
+	Headers(new Dictionary()),
+	m_Stream(stream),
+	m_State(HttpRequestStart)
 { }
 
-bool HttpRequest::Parse(StreamReadContext& src, bool may_wait)
+bool HttpRequest::ParseHeader(StreamReadContext& src, bool may_wait)
 {
 	if (!m_Stream)
 		return false;
 
-	if (m_State != HttpRequestBody) {
-		String line;
-		StreamReadStatus srs = m_Stream->ReadLine(&line, src, may_wait);
+	if (m_State != HttpRequestStart && m_State != HttpRequestHeaders)
+		return false;
 
-		if (srs != StatusNewItem) {
-			if (src.Size > 512)
-				BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded"));
+	String line;
+	StreamReadStatus srs = m_Stream->ReadLine(&line, src, may_wait);
 
+	if (srs != StatusNewItem) {
+		if (src.Size > 512)
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded"));
+
+		return false;
+	}
+
+	if (line.GetLength() > 512)
+		BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded"));
+
+	if (m_State == HttpRequestStart) {
+		/* ignore trailing new-lines */
+		if (line == "")
+			return true;
+
+		std::vector<String> tokens = line.Split(" ");
+		Log(LogDebug, "HttpRequest")
+			<< "line: " << line << ", tokens: " << tokens.size();
+		if (tokens.size() != 3)
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid HTTP request"));
+
+		RequestMethod = tokens[0];
+		RequestUrl = new class Url(tokens[1]);
+
+		if (tokens[2] == "HTTP/1.0")
+			ProtocolVersion = HttpVersion10;
+		else if (tokens[2] == "HTTP/1.1") {
+			ProtocolVersion = HttpVersion11;
+		} else
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Unsupported HTTP version"));
+
+		m_State = HttpRequestHeaders;
+		return true;
+	} else { // m_State = HttpRequestHeaders
+		if (line == "") {
+			m_State = HttpRequestBody;
+			CompleteHeaders = true;
+			return true;
+
+		} else {
+			if (Headers->GetLength() > 128)
+				BOOST_THROW_EXCEPTION(std::invalid_argument("Maximum number of HTTP request headers exceeded"));
+
+			String::SizeType pos = line.FindFirstOf(":");
+			if (pos == String::NPos)
+				BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid HTTP request"));
+
+			String key = line.SubStr(0, pos).ToLower().Trim();
+			String value = line.SubStr(pos + 1).Trim();
+			Headers->Set(key, value);
+
+			if (key == "x-http-method-override")
+				RequestMethod = value;
+
+			return true;
+		}
+	}
+}
+
+bool HttpRequest::ParseBody(StreamReadContext& src, bool may_wait)
+{
+	if (!m_Stream || m_State != HttpRequestBody)
+		return false;
+
+	/* we're done if the request doesn't contain a message body */
+	if (!Headers->Contains("content-length") && !Headers->Contains("transfer-encoding")) {
+		CompleteBody = true;
+		return true;
+	} else if (!m_Body)
+		m_Body = new FIFO();
+
+	if (CompleteBody)
+		return true;
+
+	if (Headers->Get("transfer-encoding") == "chunked") {
+		if (!m_ChunkContext)
+			m_ChunkContext = boost::make_shared<ChunkReadContext>(boost::ref(src));
+
+		char *data;
+		size_t size;
+		StreamReadStatus srs = HttpChunkedEncoding::ReadChunkFromStream(m_Stream, &data, &size, *m_ChunkContext.get(), may_wait);
+
+		if (srs != StatusNewItem)
+			return false;
+
+		m_Body->Write(data, size);
+
+		delete [] data;
+
+		if (size == 0) {
+			CompleteBody = true;
+			return true;
+		}
+	} else {
+		if (src.Eof)
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
+
+		if (src.MustRead) {
+			if (!src.FillFromStream(m_Stream, false)) {
+				src.Eof = true;
+				BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
+			}
+
+			src.MustRead = false;
+		}
+
+		long length_indicator_signed = Convert::ToLong(Headers->Get("content-length"));
+
+		if (length_indicator_signed < 0)
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Content-Length must not be negative."));
+
+		size_t length_indicator = length_indicator_signed;
+
+		if (src.Size < length_indicator) {
+			src.MustRead = true;
 			return false;
 		}
 
-		if (line.GetLength() > 512)
-			BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded"));
-
-		if (m_State == HttpRequestStart) {
-			/* ignore trailing new-lines */
-			if (line == "")
-				return true;
-
-			std::vector<String> tokens;
-			boost::algorithm::split(tokens, line, boost::is_any_of(" "));
-			Log(LogDebug, "HttpRequest")
-			    << "line: " << line << ", tokens: " << tokens.size();
-			if (tokens.size() != 3)
-				BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid HTTP request"));
-
-			RequestMethod = tokens[0];
-			RequestUrl = new class Url(tokens[1]);
-
-			if (tokens[2] == "HTTP/1.0")
-				ProtocolVersion = HttpVersion10;
-			else if (tokens[2] == "HTTP/1.1") {
-				ProtocolVersion = HttpVersion11;
-			} else
-				BOOST_THROW_EXCEPTION(std::invalid_argument("Unsupported HTTP version"));
-
-			m_State = HttpRequestHeaders;
-		} else if (m_State == HttpRequestHeaders) {
-			if (line == "") {
-				m_State = HttpRequestBody;
-
-				/* we're done if the request doesn't contain a message body */
-				if (!Headers->Contains("content-length") && !Headers->Contains("transfer-encoding"))
-					Complete = true;
-				else
-					m_Body = new FIFO();
-
-				return true;
-
-			} else {
-				if (Headers->GetLength() > 128)
-					BOOST_THROW_EXCEPTION(std::invalid_argument("Maximum number of HTTP request headers exceeded"));
-
-				String::SizeType pos = line.FindFirstOf(":");
-				if (pos == String::NPos)
-					BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid HTTP request"));
-
-				String key = line.SubStr(0, pos).ToLower().Trim();
-				String value = line.SubStr(pos + 1).Trim();
-				Headers->Set(key, value);
-
-				if (key == "x-http-method-override")
-					RequestMethod = value;
-			}
-		} else {
-			VERIFY(!"Invalid HTTP request state.");
-		}
-	} else if (m_State == HttpRequestBody) {
-		if (Headers->Get("transfer-encoding") == "chunked") {
-			if (!m_ChunkContext)
-				m_ChunkContext = boost::make_shared<ChunkReadContext>(boost::ref(src));
-
-			char *data;
-			size_t size;
-			StreamReadStatus srs = HttpChunkedEncoding::ReadChunkFromStream(m_Stream, &data, &size, *m_ChunkContext.get(), may_wait);
-
-			if (srs != StatusNewItem)
-				return false;
-
-			m_Body->Write(data, size);
-
-			delete [] data;
-
-			if (size == 0) {
-				Complete = true;
-				return true;
-			}
-		} else {
-			if (src.Eof)
-				BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
-
-			if (src.MustRead) {
-				if (!src.FillFromStream(m_Stream, false)) {
-					src.Eof = true;
-					BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
-				}
-
-				src.MustRead = false;
-			}
-
-			long length_indicator_signed = Convert::ToLong(Headers->Get("content-length"));
-
-			if (length_indicator_signed < 0)
-				BOOST_THROW_EXCEPTION(std::invalid_argument("Content-Length must not be negative."));
-
-			size_t length_indicator = length_indicator_signed;
-
-			if (src.Size < length_indicator) {
-				src.MustRead = true;
-				return false;
-			}
-
-			m_Body->Write(src.Buffer, length_indicator);
-			src.DropData(length_indicator);
-			Complete = true;
-			return true;
-		}
+		m_Body->Write(src.Buffer, length_indicator);
+		src.DropData(length_indicator);
+		CompleteBody = true;
+		return true;
 	}
 
 	return true;
diff --git a/lib/remote/httprequest.hpp b/lib/remote/httprequest.hpp
index 5a98a2343..f58cfbbb1 100644
--- a/lib/remote/httprequest.hpp
+++ b/lib/remote/httprequest.hpp
@@ -52,7 +52,8 @@ enum HttpRequestState
 struct I2_REMOTE_API HttpRequest
 {
 public:
-	bool Complete;
+	bool CompleteHeaders;
+	bool CompleteBody;
 
 	String RequestMethod;
 	Url::Ptr RequestUrl;
@@ -62,7 +63,8 @@ public:
 
 	HttpRequest(const Stream::Ptr& stream);
 
-	bool Parse(StreamReadContext& src, bool may_wait);
+	bool ParseHeader(StreamReadContext& src, bool may_wait);
+	bool ParseBody(StreamReadContext& src, bool may_wait);
 	size_t ReadBody(char *data, size_t count);
 
 	void AddHeader(const String& key, const String& value);
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index d13086b40..3fbee20ba 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -92,7 +92,7 @@ bool HttpServerConnection::ProcessMessage(void)
 	bool res;
 
 	try {
-		res = m_CurrentRequest.Parse(m_Context, false);
+		res = m_CurrentRequest.ParseHeader(m_Context, false);
 	} catch (const std::invalid_argument& ex) {
 		HttpResponse response(m_Stream, m_CurrentRequest);
 		response.SetStatus(400, "Bad request");
@@ -113,7 +113,7 @@ bool HttpServerConnection::ProcessMessage(void)
 		return false;
 	}
 
-	if (m_CurrentRequest.Complete) {
+	if (m_CurrentRequest.CompleteHeaders) {
 		m_RequestQueue.Enqueue(boost::bind(&HttpServerConnection::ProcessMessageAsync,
 		    HttpServerConnection::Ptr(this), m_CurrentRequest));
 
@@ -241,25 +241,35 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
 			response.WriteBody(msg.CStr(), msg.GetLength());
 		}
 	} else {
-		try {
-			HttpHandler::ProcessRequest(user, request, response);
-		} catch (const std::exception& ex) {
-			Log(LogCritical, "HttpServerConnection")
-			    << "Unhandled exception while processing Http request: " << DiagnosticInformation(ex);
-			response.SetStatus(503, "Unhandled exception");
+		bool res = true;
+		while (!request.CompleteBody)
+			res = request.ParseBody(m_Context, false);
+		if (!res) {
+			Log(LogCritical, "HttpServerConnection", "Failed to read body");
+			Dictionary::Ptr result = new Dictionary;
+			result->Set("error", 404); 
+			result->Set("status", "Bad Request: Malformed body.");
+			HttpUtility::SendJsonBody(response, result);
+		} else {
+			try {
+				HttpHandler::ProcessRequest(user, request, response);
+			} catch (const std::exception& ex) {
+				Log(LogCritical, "HttpServerConnection")
+					<< "Unhandled exception while processing Http request: " << DiagnosticInformation(ex);
+				response.SetStatus(503, "Unhandled exception");
 
-			String errorInfo = DiagnosticInformation(ex);
+				String errorInfo = DiagnosticInformation(ex);
 
-			if (request.Headers->Get("accept") == "application/json") {
-				Dictionary::Ptr result = new Dictionary();
+				if (request.Headers->Get("accept") == "application/json") {
+					Dictionary::Ptr result = new Dictionary();
+					result->Set("error", 503);
+					result->Set("status", errorInfo);
 
-				result->Set("error", 503);
-				result->Set("status", errorInfo);
-
-				HttpUtility::SendJsonBody(response, result);
-			} else {
-				response.AddHeader("Content-Type", "text/plain");
-				response.WriteBody(errorInfo.CStr(), errorInfo.GetLength());
+					HttpUtility::SendJsonBody(response, result);
+				} else {
+					response.AddHeader("Content-Type", "text/plain");
+					response.WriteBody(errorInfo.CStr(), errorInfo.GetLength());
+				}
 			}
 		}
 	}

From aa1ccd7ada4a492ddd6c90d882730b750963ebc3 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Thu, 8 Feb 2018 14:54:52 +0100
Subject: [PATCH 20/57] Authenticate API user before parsing body

---
 lib/remote/apiuser.cpp              |  28 ++++
 lib/remote/apiuser.hpp              |   1 +
 lib/remote/httprequest.cpp          |  72 +++++-----
 lib/remote/httprequest.hpp          |   1 +
 lib/remote/httpserverconnection.cpp | 208 +++++++++++++---------------
 lib/remote/httpserverconnection.hpp |   6 +-
 6 files changed, 169 insertions(+), 147 deletions(-)

diff --git a/lib/remote/apiuser.cpp b/lib/remote/apiuser.cpp
index fd4aec9a5..fedcd7163 100644
--- a/lib/remote/apiuser.cpp
+++ b/lib/remote/apiuser.cpp
@@ -20,6 +20,7 @@
 #include "remote/apiuser.hpp"
 #include "remote/apiuser.tcpp"
 #include "base/configtype.hpp"
+#include "base/base64.hpp"
 
 using namespace icinga;
 
@@ -34,3 +35,30 @@ ApiUser::Ptr ApiUser::GetByClientCN(const String& cn)
 
 	return ApiUser::Ptr();
 }
+
+ApiUser::Ptr ApiUser::GetByAuthHeader(const String& auth_header) {
+	String::SizeType pos = auth_header.FindFirstOf(" ");
+	String username, password;
+
+	if (pos != String::NPos && auth_header.SubStr(0, pos) == "Basic") {
+		String credentials_base64 = auth_header.SubStr(pos + 1);
+		String credentials = Base64::Decode(credentials_base64);
+
+		String::SizeType cpos = credentials.FindFirstOf(":");
+
+		if (cpos != String::NPos) {
+			username = credentials.SubStr(0, cpos);
+			password = credentials.SubStr(cpos + 1);
+		}
+	}
+
+	const ApiUser::Ptr& user = ApiUser::GetByName(username);
+
+	/* Deny authentication if 1) given password is empty 2) configured password does not match. */
+	if (password.IsEmpty())
+		return nullptr;
+	else if (user && user->GetPassword() != password)
+		return nullptr;
+
+	return user;
+}
diff --git a/lib/remote/apiuser.hpp b/lib/remote/apiuser.hpp
index 34a994158..4021487b4 100644
--- a/lib/remote/apiuser.hpp
+++ b/lib/remote/apiuser.hpp
@@ -36,6 +36,7 @@ public:
 	DECLARE_OBJECTNAME(ApiUser);
 
 	static ApiUser::Ptr GetByClientCN(const String& cn);
+	static ApiUser::Ptr GetByAuthHeader(const String& auth_header);
 };
 
 }
diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp
index 2c731c4fc..a55e12638 100644
--- a/lib/remote/httprequest.cpp
+++ b/lib/remote/httprequest.cpp
@@ -30,6 +30,7 @@ using namespace icinga;
 
 HttpRequest::HttpRequest(const Stream::Ptr& stream)
 	: CompleteHeaders(false),
+	CompleteHeaderCheck(false),
 	CompleteBody(false),
 	ProtocolVersion(HttpVersion11),
 	Headers(new Dictionary()),
@@ -43,7 +44,7 @@ bool HttpRequest::ParseHeader(StreamReadContext& src, bool may_wait)
 		return false;
 
 	if (m_State != HttpRequestStart && m_State != HttpRequestHeaders)
-		return false;
+		BOOST_THROW_EXCEPTION(std::runtime_error("Invalid HTTP state"));
 
 	String line;
 	StreamReadStatus srs = m_Stream->ReadLine(&line, src, may_wait);
@@ -109,19 +110,19 @@ bool HttpRequest::ParseHeader(StreamReadContext& src, bool may_wait)
 
 bool HttpRequest::ParseBody(StreamReadContext& src, bool may_wait)
 {
-	if (!m_Stream || m_State != HttpRequestBody)
+	if (!m_Stream)
 		return false;
 
+	if (m_State != HttpRequestBody)
+		BOOST_THROW_EXCEPTION(std::runtime_error("Invalid HTTP state"));
+
 	/* we're done if the request doesn't contain a message body */
 	if (!Headers->Contains("content-length") && !Headers->Contains("transfer-encoding")) {
 		CompleteBody = true;
-		return true;
+		return false;
 	} else if (!m_Body)
 		m_Body = new FIFO();
 
-	if (CompleteBody)
-		return true;
-
 	if (Headers->Get("transfer-encoding") == "chunked") {
 		if (!m_ChunkContext)
 			m_ChunkContext = boost::make_shared<ChunkReadContext>(boost::ref(src));
@@ -139,39 +140,38 @@ bool HttpRequest::ParseBody(StreamReadContext& src, bool may_wait)
 
 		if (size == 0) {
 			CompleteBody = true;
-			return true;
-		}
-	} else {
-		if (src.Eof)
-			BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
-
-		if (src.MustRead) {
-			if (!src.FillFromStream(m_Stream, false)) {
-				src.Eof = true;
-				BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
-			}
-
-			src.MustRead = false;
-		}
-
-		long length_indicator_signed = Convert::ToLong(Headers->Get("content-length"));
-
-		if (length_indicator_signed < 0)
-			BOOST_THROW_EXCEPTION(std::invalid_argument("Content-Length must not be negative."));
-
-		size_t length_indicator = length_indicator_signed;
-
-		if (src.Size < length_indicator) {
-			src.MustRead = true;
 			return false;
-		}
-
-		m_Body->Write(src.Buffer, length_indicator);
-		src.DropData(length_indicator);
-		CompleteBody = true;
-		return true;
+		} else
+			return true;
 	}
 
+	if (src.Eof)
+		BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
+
+	if (src.MustRead) {
+		if (!src.FillFromStream(m_Stream, false)) {
+			src.Eof = true;
+			BOOST_THROW_EXCEPTION(std::invalid_argument("Unexpected EOF in HTTP body"));
+		}
+
+		src.MustRead = false;
+	}
+
+	long length_indicator_signed = Convert::ToLong(Headers->Get("content-length"));
+
+	if (length_indicator_signed < 0)
+		BOOST_THROW_EXCEPTION(std::invalid_argument("Content-Length must not be negative."));
+
+	size_t length_indicator = length_indicator_signed;
+
+	if (src.Size < length_indicator) {
+		src.MustRead = true;
+		return false;
+	}
+
+	m_Body->Write(src.Buffer, length_indicator);
+	src.DropData(length_indicator);
+	CompleteBody = true;
 	return true;
 }
 
diff --git a/lib/remote/httprequest.hpp b/lib/remote/httprequest.hpp
index f58cfbbb1..af7ebfbaa 100644
--- a/lib/remote/httprequest.hpp
+++ b/lib/remote/httprequest.hpp
@@ -53,6 +53,7 @@ struct I2_REMOTE_API HttpRequest
 {
 public:
 	bool CompleteHeaders;
+	bool CompleteHeaderCheck;
 	bool CompleteBody;
 
 	String RequestMethod;
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 3fbee20ba..955862756 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -90,100 +90,105 @@ void HttpServerConnection::Disconnect(void)
 bool HttpServerConnection::ProcessMessage(void)
 {
 	bool res;
+	HttpResponse response(m_Stream, m_CurrentRequest);
 
-	try {
-		res = m_CurrentRequest.ParseHeader(m_Context, false);
-	} catch (const std::invalid_argument& ex) {
-		HttpResponse response(m_Stream, m_CurrentRequest);
-		response.SetStatus(400, "Bad request");
-		String msg = String("<h1>Bad request</h1><p><pre>") + ex.what() + "</pre></p>";
-		response.WriteBody(msg.CStr(), msg.GetLength());
-		response.Finish();
+	if (!m_CurrentRequest.CompleteHeaders) {
+		try {
+			res = m_CurrentRequest.ParseHeader(m_Context, false);
+		} catch (const std::invalid_argument& ex) {
+			response.SetStatus(400, "Bad Request");
+			String msg = String("<h1>Bad Request</h1><p><pre>") + ex.what() + "</pre></p>";
+			response.WriteBody(msg.CStr(), msg.GetLength());
+			response.Finish();
 
-		m_Stream->Shutdown();
-		return false;
-	} catch (const std::exception& ex) {
-		HttpResponse response(m_Stream, m_CurrentRequest);
-		response.SetStatus(400, "Bad request");
-		String msg = "<h1>Bad request</h1><p><pre>" + DiagnosticInformation(ex) + "</pre></p>";
-		response.WriteBody(msg.CStr(), msg.GetLength());
-		response.Finish();
+			m_Stream->Shutdown();
+			return false;
+		} catch (const std::exception& ex) {
+			response.SetStatus(500, "Internal Server Error");
+			String msg = "<h1>Internal Server Error</h1><p><pre>" + DiagnosticInformation(ex) + "</pre></p>";
+			response.WriteBody(msg.CStr(), msg.GetLength());
+			response.Finish();
 
-		m_Stream->Shutdown();
-		return false;
+			m_Stream->Shutdown();
+			return false;
+		}
+		return res;
 	}
 
-	if (m_CurrentRequest.CompleteHeaders) {
-		m_RequestQueue.Enqueue(boost::bind(&HttpServerConnection::ProcessMessageAsync,
-		    HttpServerConnection::Ptr(this), m_CurrentRequest));
-
-		m_Seen = Utility::GetTime();
-		m_PendingRequests++;
-
-		m_CurrentRequest.~HttpRequest();
-		new (&m_CurrentRequest) HttpRequest(m_Stream);
-
-		return true;
-	}
-
-	return res;
-}
-
-void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
-{
-	String auth_header = request.Headers->Get("authorization");
-
-	String::SizeType pos = auth_header.FindFirstOf(" ");
-	String username, password;
-
-	if (pos != String::NPos && auth_header.SubStr(0, pos) == "Basic") {
-		String credentials_base64 = auth_header.SubStr(pos + 1);
-		String credentials = Base64::Decode(credentials_base64);
-
-		String::SizeType cpos = credentials.FindFirstOf(":");
-
-		if (cpos != String::NPos) {
-			username = credentials.SubStr(0, cpos);
-			password = credentials.SubStr(cpos + 1);
+	if (!m_CurrentRequest.CompleteHeaderCheck) {
+		m_CurrentRequest.CompleteHeaderCheck = true;
+		if (!ManageHeaders(response)) {
+			m_Stream->Shutdown();
+			return false;
 		}
 	}
 
-	ApiUser::Ptr user;
+	if (!m_CurrentRequest.CompleteBody) {
+		try {
+			res = m_CurrentRequest.ParseBody(m_Context, false);
+		} catch (const std::invalid_argument& ex) {
+			response.SetStatus(400, "Bad Request");
+			String msg = String("<h1>Bad Request</h1><p><pre>") + ex.what() + "</pre></p>";
+			response.WriteBody(msg.CStr(), msg.GetLength());
+			response.Finish();
+
+			m_Stream->Shutdown();
+			return false;
+		} catch (const std::exception& ex) {
+			response.SetStatus(500, "Internal Server Error");
+			String msg = "<h1>Internal Server Error</h1><p><pre>" + DiagnosticInformation(ex) + "</pre></p>";
+			response.WriteBody(msg.CStr(), msg.GetLength());
+			response.Finish();
+
+			m_Stream->Shutdown();
+			return false;
+		}
+		return res;
+	}
+
+	m_RequestQueue.Enqueue(std::bind(&HttpServerConnection::ProcessMessageAsync,
+		HttpServerConnection::Ptr(this), m_CurrentRequest, response, m_AuthenticatedUser));
+
+	m_Seen = Utility::GetTime();
+	m_PendingRequests++;
+
+	m_CurrentRequest.~HttpRequest();
+	new (&m_CurrentRequest) HttpRequest(m_Stream);
+
+	return false;
+}
+
+bool HttpServerConnection::ManageHeaders(HttpResponse& response)
+{
+	if (m_CurrentRequest.Headers->Get("expect") == "100-continue") {
+		String continueResponse = "HTTP/1.1 100 Continue\r\n\r\n";
+		m_Stream->Write(continueResponse.CStr(), continueResponse.GetLength());
+	}
 
 	/* client_cn matched. */
 	if (m_ApiUser)
-		user = m_ApiUser;
-	else {
-		user = ApiUser::GetByName(username);
+		m_AuthenticatedUser = m_ApiUser;
+	else
+		m_AuthenticatedUser = ApiUser::GetByAuthHeader(m_CurrentRequest.Headers->Get("authorization"));
 
-		/* Deny authentication if 1) given password is empty 2) configured password does not match. */
-		if (password.IsEmpty())
-			user.reset();
-		else if (user && user->GetPassword() != password)
-			user.reset();
-	}
-
-	String requestUrl = request.RequestUrl->Format();
+	String requestUrl = m_CurrentRequest.RequestUrl->Format();
 
 	Socket::Ptr socket = m_Stream->GetSocket();
 
 	Log(LogInformation, "HttpServerConnection")
-		<< "Request: " << request.RequestMethod << " " << requestUrl
+		<< "Request: " << m_CurrentRequest.RequestMethod << " " << requestUrl
 		<< " (from " << (socket ? socket->GetPeerAddress() : "<unkown>")
-		<< ", user: " << (user ? user->GetName() : "<unauthenticated>") << ")";
-
-	HttpResponse response(m_Stream, request);
+		<< ", user: " << (m_AuthenticatedUser ? m_AuthenticatedUser->GetName() : "<unauthenticated>") << ")";
 
 	ApiListener::Ptr listener = ApiListener::GetInstance();
 
 	if (!listener)
-		return;
+		return false;
 
 	Array::Ptr headerAllowOrigin = listener->GetAccessControlAllowOrigin();
 
 	if (headerAllowOrigin->GetLength() != 0) {
-		String origin = request.Headers->Get("origin");
-
+		String origin = m_CurrentRequest.Headers->Get("origin");
 		{
 			ObjectLock olock(headerAllowOrigin);
 
@@ -196,9 +201,9 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
 		if (listener->GetAccessControlAllowCredentials())
 			response.AddHeader("Access-Control-Allow-Credentials", "true");
 
-		String accessControlRequestMethodHeader = request.Headers->Get("access-control-request-method");
+		String accessControlRequestMethodHeader = m_CurrentRequest.Headers->Get("access-control-request-method");
 
-		if (!accessControlRequestMethodHeader.IsEmpty()) {
+		if (m_CurrentRequest.RequestMethod == "OPTIONS" && !accessControlRequestMethodHeader.IsEmpty()) {
 			response.SetStatus(200, "OK");
 
 			response.AddHeader("Access-Control-Allow-Methods", listener->GetAccessControlAllowMethods());
@@ -208,27 +213,27 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
 			response.WriteBody(msg.CStr(), msg.GetLength());
 
 			response.Finish();
-			m_PendingRequests--;
-
-			return;
+			return false;
 		}
 	}
 
-	String accept_header = request.Headers->Get("accept");
-
-	if (request.RequestMethod != "GET" && accept_header != "application/json") {
+	if (m_CurrentRequest.RequestMethod != "GET" && m_CurrentRequest.Headers->Get("accept") != "application/json") {
 		response.SetStatus(400, "Wrong Accept header");
 		response.AddHeader("Content-Type", "text/html");
 		String msg = "<h1>Accept header is missing or not set to 'application/json'.</h1>";
 		response.WriteBody(msg.CStr(), msg.GetLength());
-	} else if (!user) {
+		response.Finish();
+		return false;
+	}
+
+	if (!m_AuthenticatedUser) {
 		Log(LogWarning, "HttpServerConnection")
-		    << "Unauthorized request: " << request.RequestMethod << " " << requestUrl;
+			<< "Unauthorized request: " << m_CurrentRequest.RequestMethod << " " << requestUrl;
 
 		response.SetStatus(401, "Unauthorized");
 		response.AddHeader("WWW-Authenticate", "Basic realm=\"Icinga 2\"");
 
-		if (request.Headers->Get("accept") == "application/json") {
+		if (m_CurrentRequest.Headers->Get("accept") == "application/json") {
 			Dictionary::Ptr result = new Dictionary();
 
 			result->Set("error", 401);
@@ -240,42 +245,25 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
 			String msg = "<h1>Unauthorized. Please check your user credentials.</h1>";
 			response.WriteBody(msg.CStr(), msg.GetLength());
 		}
-	} else {
-		bool res = true;
-		while (!request.CompleteBody)
-			res = request.ParseBody(m_Context, false);
-		if (!res) {
-			Log(LogCritical, "HttpServerConnection", "Failed to read body");
-			Dictionary::Ptr result = new Dictionary;
-			result->Set("error", 404); 
-			result->Set("status", "Bad Request: Malformed body.");
-			HttpUtility::SendJsonBody(response, result);
-		} else {
-			try {
-				HttpHandler::ProcessRequest(user, request, response);
-			} catch (const std::exception& ex) {
-				Log(LogCritical, "HttpServerConnection")
-					<< "Unhandled exception while processing Http request: " << DiagnosticInformation(ex);
-				response.SetStatus(503, "Unhandled exception");
 
-				String errorInfo = DiagnosticInformation(ex);
+		response.Finish();
+		return false;
+	}
 
-				if (request.Headers->Get("accept") == "application/json") {
-					Dictionary::Ptr result = new Dictionary();
-					result->Set("error", 503);
-					result->Set("status", errorInfo);
+	return true;
+}
 
-					HttpUtility::SendJsonBody(response, result);
-				} else {
-					response.AddHeader("Content-Type", "text/plain");
-					response.WriteBody(errorInfo.CStr(), errorInfo.GetLength());
-				}
-			}
-		}
+void HttpServerConnection::ProcessMessageAsync(HttpRequest& request, HttpResponse& response, const ApiUser::Ptr& user)
+{
+	try {
+		HttpHandler::ProcessRequest(user, request, response);
+	} catch (const std::exception& ex) {
+		Log(LogCritical, "HttpServerConnection")
+			<< "Unhandled exception while processing Http request: " << DiagnosticInformation(ex);
+		HttpUtility::SendJsonError(response, 503, "Unhandled exception" , DiagnosticInformation(ex));
 	}
 
 	response.Finish();
-
 	m_PendingRequests--;
 }
 
diff --git a/lib/remote/httpserverconnection.hpp b/lib/remote/httpserverconnection.hpp
index e8f17dc36..22b036c2f 100644
--- a/lib/remote/httpserverconnection.hpp
+++ b/lib/remote/httpserverconnection.hpp
@@ -21,6 +21,7 @@
 #define HTTPSERVERCONNECTION_H
 
 #include "remote/httprequest.hpp"
+#include "remote/httpresponse.hpp"
 #include "remote/apiuser.hpp"
 #include "base/tlsstream.hpp"
 #include "base/timer.hpp"
@@ -51,6 +52,7 @@ public:
 
 private:
 	ApiUser::Ptr m_ApiUser;
+	ApiUser::Ptr m_AuthenticatedUser;
 	TlsStream::Ptr m_Stream;
 	double m_Seen;
 	HttpRequest m_CurrentRequest;
@@ -67,7 +69,9 @@ private:
 	static void TimeoutTimerHandler(void);
 	void CheckLiveness(void);
 
-	void ProcessMessageAsync(HttpRequest& request);
+	bool ManageHeaders(HttpResponse& response);
+
+	void ProcessMessageAsync(HttpRequest& request, HttpResponse& response, const ApiUser::Ptr&);
 };
 
 }

From 70c81734c51a7f3257da7273cf7738173fc82caa Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Tue, 13 Feb 2018 17:29:48 +0100
Subject: [PATCH 21/57] Add timeout for TLS handshakes

---
 lib/base/stream.cpp                 | 25 ++++++++++++++++++++-----
 lib/base/stream.hpp                 |  4 +++-
 lib/base/tlsstream.cpp              | 13 +++++++++++--
 lib/remote/apilistener.cpp          | 12 +++++++++---
 lib/remote/httpserverconnection.cpp |  8 +++++++-
 lib/remote/pkiutility.cpp           |  6 ++++--
 6 files changed, 54 insertions(+), 14 deletions(-)

diff --git a/lib/base/stream.cpp b/lib/base/stream.cpp
index 57791d305..4e0ad72dc 100644
--- a/lib/base/stream.cpp
+++ b/lib/base/stream.cpp
@@ -60,7 +60,7 @@ void Stream::SignalDataAvailable(void)
 	}
 }
 
-bool Stream::WaitForData(int timeout)
+bool Stream::WaitForData()
 {
 	if (!SupportsWaiting())
 		BOOST_THROW_EXCEPTION(std::runtime_error("Stream does not support waiting."));
@@ -68,10 +68,25 @@ bool Stream::WaitForData(int timeout)
 	boost::mutex::scoped_lock lock(m_Mutex);
 
 	while (!IsDataAvailable() && !IsEof())
-		if (timeout < 0)
-			m_CV.wait(lock);
-		else
-			m_CV.timed_wait(lock, boost::posix_time::milliseconds(timeout * 1000));
+		m_CV.wait(lock);
+
+	return IsDataAvailable() || IsEof();
+}
+
+bool Stream::WaitForData(int timeout)
+{
+	if (!SupportsWaiting())
+		BOOST_THROW_EXCEPTION(std::runtime_error("Stream does not support waiting."));
+
+	if (timeout < 0)
+		BOOST_THROW_EXCEPTION(std::runtime_error("Timeout can't be negative"));
+
+	boost::system_time const point_of_timeout = boost::get_system_time() + boost::posix_time::seconds(timeout);
+
+	boost::mutex::scoped_lock lock(m_Mutex);
+
+	while (!IsDataAvailable() && !IsEof() && point_of_timeout > boost::get_system_time())
+		m_CV.timed_wait(lock, point_of_timeout);
 
 	return IsDataAvailable() || IsEof();
 }
diff --git a/lib/base/stream.hpp b/lib/base/stream.hpp
index 6c39e79aa..63ac31599 100644
--- a/lib/base/stream.hpp
+++ b/lib/base/stream.hpp
@@ -124,8 +124,10 @@ public:
 
 	/**
 	 * Waits until data can be read from the stream.
+	 * Optionally with a timeout.
 	 */
-	bool WaitForData(int timeout = -1);
+	bool WaitForData();
+	bool WaitForData(int timeout);
 
 	virtual bool SupportsWaiting(void) const;
 
diff --git a/lib/base/tlsstream.cpp b/lib/base/tlsstream.cpp
index 78b1851da..953b2b8f0 100644
--- a/lib/base/tlsstream.cpp
+++ b/lib/base/tlsstream.cpp
@@ -28,6 +28,9 @@
 #	include <poll.h>
 #endif /* _WIN32 */
 
+#define TLS_TIMEOUT_SECONDS 10
+#define TLS_TIMEOUT_STEP_SECONDS 1
+
 using namespace icinga;
 
 int I2_EXPORT TlsStream::m_SSLIndex;
@@ -286,8 +289,14 @@ void TlsStream::Handshake(void)
 	m_CurrentAction = TlsActionHandshake;
 	ChangeEvents(POLLOUT);
 
-	while (!m_HandshakeOK && !m_ErrorOccurred && !m_Eof)
-		m_CV.wait(lock);
+	boost::system_time const timeout = boost::get_system_time() + boost::posix_time::seconds(TLS_TIMEOUT_SECONDS);
+
+	while (!m_HandshakeOK && !m_ErrorOccurred && !m_Eof && timeout > boost::get_system_time())
+		m_CV.timed_wait(lock, timeout);
+
+	// We should _NOT_ (underline, bold, itallic and wordart) throw an exception for a timeout.
+	if (timeout < boost::get_system_time())
+		BOOST_THROW_EXCEPTION(std::runtime_error("Timeout during handshake."));
 
 	if (m_Eof)
 		BOOST_THROW_EXCEPTION(std::runtime_error("Socket was closed during TLS handshake."));
diff --git a/lib/remote/apilistener.cpp b/lib/remote/apilistener.cpp
index b00c37f6a..107c142b7 100644
--- a/lib/remote/apilistener.cpp
+++ b/lib/remote/apilistener.cpp
@@ -511,11 +511,17 @@ void ApiListener::NewClientHandlerInternal(const Socket::Ptr& client, const Stri
 		JsonRpc::SendMessage(tlsStream, message);
 		ctype = ClientJsonRpc;
 	} else {
-		tlsStream->WaitForData(5);
+		tlsStream->WaitForData(10);
 
 		if (!tlsStream->IsDataAvailable()) {
-			Log(LogWarning, "ApiListener")
-			    << "No data received on new API connection for identity '" << identity << "'. Ensure that the remote endpoints are properly configured in a cluster setup.";
+			if (identity.IsEmpty())
+				Log(LogInformation, "ApiListener")
+					<< "No data received on new API connection. "
+					<< "Ensure that the remote endpoints are properly configured in a cluster setup.";
+			else
+				Log(LogWarning, "ApiListener")
+					<< "No data received on new API connection for identity '" << identity << "'. "
+					<< "Ensure that the remote endpoints are properly configured in a cluster setup.";
 			return;
 		}
 
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 955862756..706ee33a2 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -52,7 +52,7 @@ void HttpServerConnection::StaticInitialize(void)
 {
 	l_HttpServerConnectionTimeoutTimer = new Timer();
 	l_HttpServerConnectionTimeoutTimer->OnTimerExpired.connect(boost::bind(&HttpServerConnection::TimeoutTimerHandler));
-	l_HttpServerConnectionTimeoutTimer->SetInterval(15);
+	l_HttpServerConnectionTimeoutTimer->SetInterval(5);
 	l_HttpServerConnectionTimeoutTimer->Start();
 }
 
@@ -76,6 +76,12 @@ TlsStream::Ptr HttpServerConnection::GetStream(void) const
 
 void HttpServerConnection::Disconnect(void)
 {
+	boost::mutex::scoped_try_lock lock(m_DataHandlerMutex);
+	if (!lock.owns_lock()) {
+		Log(LogInformation, "HttpServerConnection", "Unable to disconnect Http client, I/O thread busy");
+		return;
+	}
+
 	Log(LogDebug, "HttpServerConnection", "Http client disconnected");
 
 	ApiListener::Ptr listener = ApiListener::GetInstance();
diff --git a/lib/remote/pkiutility.cpp b/lib/remote/pkiutility.cpp
index 6e8443bd5..b9da04ebe 100644
--- a/lib/remote/pkiutility.cpp
+++ b/lib/remote/pkiutility.cpp
@@ -121,8 +121,10 @@ boost::shared_ptr<X509> PkiUtility::FetchCert(const String& host, const String&
 
 	try {
 		stream->Handshake();
-	} catch (...) {
-
+	} catch (const std::exception& ex) {
+		Log(LogCritical, "pki")
+			<< "Client TLS handshake failed. (" << ex.what() << ")";
+		return std::shared_ptr<X509>();
 	}
 
 	return stream->GetPeerCertificate();

From 3fe818b44bc493c09940279039d1790aef89da2e Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Mon, 19 Feb 2018 10:47:14 +0100
Subject: [PATCH 22/57] Fix requests not being closed correctly

---
 lib/remote/httpserverconnection.cpp | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 706ee33a2..8b0bb5ce6 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -107,7 +107,11 @@ bool HttpServerConnection::ProcessMessage(void)
 			response.WriteBody(msg.CStr(), msg.GetLength());
 			response.Finish();
 
+			m_CurrentRequest.~HttpRequest();
+			new (&m_CurrentRequest) HttpRequest(m_Stream);
+
 			m_Stream->Shutdown();
+
 			return false;
 		} catch (const std::exception& ex) {
 			response.SetStatus(500, "Internal Server Error");
@@ -115,7 +119,11 @@ bool HttpServerConnection::ProcessMessage(void)
 			response.WriteBody(msg.CStr(), msg.GetLength());
 			response.Finish();
 
+			m_CurrentRequest.~HttpRequest();
+			new (&m_CurrentRequest) HttpRequest(m_Stream);
+
 			m_Stream->Shutdown();
+
 			return false;
 		}
 		return res;
@@ -124,7 +132,11 @@ bool HttpServerConnection::ProcessMessage(void)
 	if (!m_CurrentRequest.CompleteHeaderCheck) {
 		m_CurrentRequest.CompleteHeaderCheck = true;
 		if (!ManageHeaders(response)) {
+			m_CurrentRequest.~HttpRequest();
+			new (&m_CurrentRequest) HttpRequest(m_Stream);
+
 			m_Stream->Shutdown();
+
 			return false;
 		}
 	}
@@ -138,7 +150,11 @@ bool HttpServerConnection::ProcessMessage(void)
 			response.WriteBody(msg.CStr(), msg.GetLength());
 			response.Finish();
 
+			m_CurrentRequest.~HttpRequest();
+			new (&m_CurrentRequest) HttpRequest(m_Stream);
+
 			m_Stream->Shutdown();
+
 			return false;
 		} catch (const std::exception& ex) {
 			response.SetStatus(500, "Internal Server Error");
@@ -146,7 +162,11 @@ bool HttpServerConnection::ProcessMessage(void)
 			response.WriteBody(msg.CStr(), msg.GetLength());
 			response.Finish();
 
+			m_CurrentRequest.~HttpRequest();
+			new (&m_CurrentRequest) HttpRequest(m_Stream);
+
 			m_Stream->Shutdown();
+
 			return false;
 		}
 		return res;

From 4b77afedcd900b7c0f3a29e5bebf408ae039841a Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Mon, 19 Feb 2018 13:33:58 +0100
Subject: [PATCH 23/57] Limit HTTP body size

---
 doc/12-icinga2-api.md               | 34 ++++++++++++++++-------------
 lib/remote/apiuser.cpp              |  3 ++-
 lib/remote/httpserverconnection.cpp | 34 +++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 16 deletions(-)

diff --git a/doc/12-icinga2-api.md b/doc/12-icinga2-api.md
index 15471e9c6..acebac6e1 100644
--- a/doc/12-icinga2-api.md
+++ b/doc/12-icinga2-api.md
@@ -201,23 +201,27 @@ The [regex function](18-library-reference.md#global-functions-regex) is availabl
 
 More information about filters can be found in the [filters](12-icinga2-api.md#icinga2-api-filters) chapter.
 
+Note that the permissions a API user has also specify the max body size of their requests.
+A API user with `*` permissions is allowed to send 512 MB.
+
+
 Available permissions for specific URL endpoints:
 
-  Permissions                   | URL Endpoint  | Supports Filters
-  ------------------------------|---------------|-----------------
-  actions/&lt;action&gt;        | /v1/actions   | Yes
-  config/query                  | /v1/config    | No
-  config/modify                 | /v1/config    | No
-  console                       | /v1/console   | No
-  events/&lt;type&gt;           | /v1/events    | No
-  objects/query/&lt;type&gt;    | /v1/objects   | Yes
-  objects/create/&lt;type&gt;   | /v1/objects   | No
-  objects/modify/&lt;type&gt;   | /v1/objects   | Yes
-  objects/delete/&lt;type&gt;   | /v1/objects   | Yes
-  status/query                  | /v1/status    | Yes
-  templates/&lt;type&gt;        | /v1/templates | Yes
-  types                         | /v1/types     | Yes
-  variables                     | /v1/variables | Yes
+  Permissions                   | URL Endpoint  | Supports Filters  | Max Body Size in MB
+  ------------------------------|---------------|-------------------|---------------------
+  actions/&lt;action&gt;        | /v1/actions   | Yes               | 1
+  config/query                  | /v1/config    | No                | 1
+  config/modify                 | /v1/config    | No                | 512
+  console                       | /v1/console   | No                | 512
+  events/&lt;type&gt;           | /v1/events    | No                | 1
+  objects/query/&lt;type&gt;    | /v1/objects   | Yes               | 1
+  objects/create/&lt;type&gt;   | /v1/objects   | No                | 512
+  objects/modify/&lt;type&gt;   | /v1/objects   | Yes               | 512
+  objects/delete/&lt;type&gt;   | /v1/objects   | Yes               | 512
+  status/query                  | /v1/status    | Yes               | 1
+  templates/&lt;type&gt;        | /v1/templates | Yes               | 1
+  types                         | /v1/types     | Yes               | 1
+  variables                     | /v1/variables | Yes               | 1
 
 The required actions or types can be replaced by using a wildcard match ("\*").
 
diff --git a/lib/remote/apiuser.cpp b/lib/remote/apiuser.cpp
index fedcd7163..c3e95ebe6 100644
--- a/lib/remote/apiuser.cpp
+++ b/lib/remote/apiuser.cpp
@@ -36,7 +36,8 @@ ApiUser::Ptr ApiUser::GetByClientCN(const String& cn)
 	return ApiUser::Ptr();
 }
 
-ApiUser::Ptr ApiUser::GetByAuthHeader(const String& auth_header) {
+ApiUser::Ptr ApiUser::GetByAuthHeader(const String& auth_header)
+{
 	String::SizeType pos = auth_header.FindFirstOf(" ");
 	String username, password;
 
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 8b0bb5ce6..ae284df34 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -95,6 +95,7 @@ void HttpServerConnection::Disconnect(void)
 
 bool HttpServerConnection::ProcessMessage(void)
 {
+
 	bool res;
 	HttpResponse response(m_Stream, m_CurrentRequest);
 
@@ -186,6 +187,16 @@ bool HttpServerConnection::ProcessMessage(void)
 
 bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 {
+	static const size_t defaultContentLengthLimit = 1 * 1028 * 1028;
+	static const Dictionary::Ptr specialContentLengthLimits = new Dictionary({
+		  {"*", 512 * 1028 * 1028},
+		  {"config/modify", 512 * 1028 * 1028},
+		  {"console", 512 * 1028 * 1028},
+		  {"objects/create", 512 * 1028 * 1028},
+		  {"objects/modify", 512 * 1028 * 1028},
+		  {"objects/delete", 512 * 1028 * 1028}
+	});
+
 	if (m_CurrentRequest.Headers->Get("expect") == "100-continue") {
 		String continueResponse = "HTTP/1.1 100 Continue\r\n\r\n";
 		m_Stream->Write(continueResponse.CStr(), continueResponse.GetLength());
@@ -276,6 +287,29 @@ bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 		return false;
 	}
 
+	size_t maxSize = defaultContentLengthLimit;
+
+	Array::Ptr permissions = m_AuthenticatedUser->GetPermissions();
+	ObjectLock olock(permissions);
+
+	for (const Value& permission : permissions) {
+		std::vector<String> permissionParts = String(permission).Split("/");
+		String permissionPath = permissionParts[0] + (permissionParts.size() > 1 ? "/" + permissionParts[1] : "");
+		int size = specialContentLengthLimits->Get(permissionPath);
+		maxSize = size > maxSize ? size : maxSize;
+	}
+
+	size_t contentLength = m_CurrentRequest.Headers->Get("content-length");
+
+	if (contentLength > maxSize) {
+		response.SetStatus(400, "Bad Request");
+		String msg = String("<h1>Content length exceeded maximum</h1>");
+		response.WriteBody(msg.CStr(), msg.GetLength());
+		response.Finish();
+
+		return false;
+	}
+
 	return true;
 }
 

From c5b92defec03f989eb22da2ff769c2314dd7e618 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Wed, 21 Feb 2018 13:22:17 +0100
Subject: [PATCH 24/57] Minor codestyle and doc changes

---
 doc/12-icinga2-api.md               | 10 ++++------
 lib/base/tlsstream.cpp              |  1 -
 lib/remote/httprequest.cpp          |  2 +-
 lib/remote/httprequest.hpp          |  2 +-
 lib/remote/httpserverconnection.cpp | 13 +++++++------
 lib/remote/httpserverconnection.hpp |  1 -
 6 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/doc/12-icinga2-api.md b/doc/12-icinga2-api.md
index acebac6e1..b2e61765b 100644
--- a/doc/12-icinga2-api.md
+++ b/doc/12-icinga2-api.md
@@ -201,13 +201,12 @@ The [regex function](18-library-reference.md#global-functions-regex) is availabl
 
 More information about filters can be found in the [filters](12-icinga2-api.md#icinga2-api-filters) chapter.
 
-Note that the permissions a API user has also specify the max body size of their requests.
-A API user with `*` permissions is allowed to send 512 MB.
-
+Permissions are tied to a maximum HTTP request size to prevent abuse, responses sent by Icinga are not limited.
+An API user with all permissions ("\*") may send up to 512 MB regardless of the endpoint.
 
 Available permissions for specific URL endpoints:
 
-  Permissions                   | URL Endpoint  | Supports Filters  | Max Body Size in MB
+  Permissions                   | URL Endpoint  | Supports filters  | Max body size in MB
   ------------------------------|---------------|-------------------|---------------------
   actions/&lt;action&gt;        | /v1/actions   | Yes               | 1
   config/query                  | /v1/config    | No                | 1
@@ -227,8 +226,7 @@ The required actions or types can be replaced by using a wildcard match ("\*").
 
 ### Parameters <a id="icinga2-api-parameters"></a>
 
-Depending on the request method there are two ways of
-passing parameters to the request:
+Depending on the request method there are two ways of passing parameters to the request:
 
 * JSON object as request body (all request methods other than `GET`)
 * Query string as URL parameter (all request methods)
diff --git a/lib/base/tlsstream.cpp b/lib/base/tlsstream.cpp
index 953b2b8f0..1fda60382 100644
--- a/lib/base/tlsstream.cpp
+++ b/lib/base/tlsstream.cpp
@@ -29,7 +29,6 @@
 #endif /* _WIN32 */
 
 #define TLS_TIMEOUT_SECONDS 10
-#define TLS_TIMEOUT_STEP_SECONDS 1
 
 using namespace icinga;
 
diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp
index a55e12638..9e8f36c27 100644
--- a/lib/remote/httprequest.cpp
+++ b/lib/remote/httprequest.cpp
@@ -38,7 +38,7 @@ HttpRequest::HttpRequest(const Stream::Ptr& stream)
 	m_State(HttpRequestStart)
 { }
 
-bool HttpRequest::ParseHeader(StreamReadContext& src, bool may_wait)
+bool HttpRequest::ParseHeaders(StreamReadContext& src, bool may_wait)
 {
 	if (!m_Stream)
 		return false;
diff --git a/lib/remote/httprequest.hpp b/lib/remote/httprequest.hpp
index af7ebfbaa..a17732f4a 100644
--- a/lib/remote/httprequest.hpp
+++ b/lib/remote/httprequest.hpp
@@ -64,7 +64,7 @@ public:
 
 	HttpRequest(const Stream::Ptr& stream);
 
-	bool ParseHeader(StreamReadContext& src, bool may_wait);
+	bool ParseHeaders(StreamReadContext& src, bool may_wait);
 	bool ParseBody(StreamReadContext& src, bool may_wait);
 	size_t ReadBody(char *data, size_t count);
 
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index ae284df34..1c236ed5a 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -24,12 +24,13 @@
 #include "remote/apifunction.hpp"
 #include "remote/jsonrpc.hpp"
 #include "base/base64.hpp"
-#include "base/configtype.hpp"
-#include "base/objectlock.hpp"
-#include "base/utility.hpp"
-#include "base/logger.hpp"
-#include "base/exception.hpp"
 #include "base/convert.hpp"
+#include "base/configtype.hpp"
+#include "base/exception.hpp"
+#include "base/logger.hpp"
+#include "base/objectlock.hpp"
+#include "base/timer.hpp"
+#include "base/utility.hpp"
 #include <boost/thread/once.hpp>
 
 using namespace icinga;
@@ -101,7 +102,7 @@ bool HttpServerConnection::ProcessMessage(void)
 
 	if (!m_CurrentRequest.CompleteHeaders) {
 		try {
-			res = m_CurrentRequest.ParseHeader(m_Context, false);
+			res = m_CurrentRequest.ParseHeaders(m_Context, false);
 		} catch (const std::invalid_argument& ex) {
 			response.SetStatus(400, "Bad Request");
 			String msg = String("<h1>Bad Request</h1><p><pre>") + ex.what() + "</pre></p>";
diff --git a/lib/remote/httpserverconnection.hpp b/lib/remote/httpserverconnection.hpp
index 22b036c2f..3d9b04e2c 100644
--- a/lib/remote/httpserverconnection.hpp
+++ b/lib/remote/httpserverconnection.hpp
@@ -24,7 +24,6 @@
 #include "remote/httpresponse.hpp"
 #include "remote/apiuser.hpp"
 #include "base/tlsstream.hpp"
-#include "base/timer.hpp"
 #include "base/workqueue.hpp"
 
 namespace icinga

From adc054097dcd92d846a1ae6f980b2a5ab14219af Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 23 Feb 2018 10:27:55 +0100
Subject: [PATCH 25/57] Build/Merge fixes

---
 lib/remote/httpserverconnection.cpp | 15 +++++++--------
 lib/remote/pkiutility.cpp           |  2 +-
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 1c236ed5a..57f44f22b 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -189,14 +189,13 @@ bool HttpServerConnection::ProcessMessage(void)
 bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 {
 	static const size_t defaultContentLengthLimit = 1 * 1028 * 1028;
-	static const Dictionary::Ptr specialContentLengthLimits = new Dictionary({
-		  {"*", 512 * 1028 * 1028},
-		  {"config/modify", 512 * 1028 * 1028},
-		  {"console", 512 * 1028 * 1028},
-		  {"objects/create", 512 * 1028 * 1028},
-		  {"objects/modify", 512 * 1028 * 1028},
-		  {"objects/delete", 512 * 1028 * 1028}
-	});
+	static const Dictionary::Ptr specialContentLengthLimits = new Dictionary;
+    specialContentLengthLimits->Set("*", 512 * 1028 * 1028);
+	specialContentLengthLimits->Set("config/modify", 512 * 1028 * 1028);
+	specialContentLengthLimits->Set("console", 512 * 1028 * 1028);
+	specialContentLengthLimits->Set("objects/create", 512 * 1028 * 1028);
+	specialContentLengthLimits->Set("objects/modify", 512 * 1028 * 1028);
+	specialContentLengthLimits->Set("objects/delete", 512 * 1028 * 1028);
 
 	if (m_CurrentRequest.Headers->Get("expect") == "100-continue") {
 		String continueResponse = "HTTP/1.1 100 Continue\r\n\r\n";
diff --git a/lib/remote/pkiutility.cpp b/lib/remote/pkiutility.cpp
index b9da04ebe..080626af5 100644
--- a/lib/remote/pkiutility.cpp
+++ b/lib/remote/pkiutility.cpp
@@ -124,7 +124,7 @@ boost::shared_ptr<X509> PkiUtility::FetchCert(const String& host, const String&
 	} catch (const std::exception& ex) {
 		Log(LogCritical, "pki")
 			<< "Client TLS handshake failed. (" << ex.what() << ")";
-		return std::shared_ptr<X509>();
+		return boost::shared_ptr<X509>();
 	}
 
 	return stream->GetPeerCertificate();

From 6504606e23c9ce5f748925dc7445c0053d0f31e8 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 11 Aug 2017 16:23:24 +0200
Subject: [PATCH 26/57] Hash API password and comparison

fixes #4920
---
 doc/09-object-types.md      |  3 +-
 doc/11-cli-commands.md      | 11 +++--
 doc/12-icinga2-api.md       | 19 +++++++++
 lib/base/tlsutility.cpp     | 13 ++++++
 lib/base/tlsutility.hpp     |  1 +
 lib/cli/CMakeLists.txt      |  2 +-
 lib/cli/apisetupcommand.cpp |  2 +-
 lib/cli/apiusercommand.cpp  | 82 +++++++++++++++++++++++++++++++++++++
 lib/cli/apiusercommand.hpp  | 47 +++++++++++++++++++++
 lib/remote/apiuser.cpp      | 56 +++++++++++++++++++++++++
 lib/remote/apiuser.hpp      |  6 +++
 lib/remote/apiuser.ti       |  4 +-
 test/CMakeLists.txt         |  2 +
 test/remote-user.cpp        | 52 +++++++++++++++++++++++
 14 files changed, 292 insertions(+), 8 deletions(-)
 create mode 100644 lib/cli/apiusercommand.cpp
 create mode 100644 lib/cli/apiusercommand.hpp
 create mode 100644 test/remote-user.cpp

diff --git a/doc/09-object-types.md b/doc/09-object-types.md
index 2976356f0..33c2763ba 100644
--- a/doc/09-object-types.md
+++ b/doc/09-object-types.md
@@ -108,8 +108,9 @@ Configuration Attributes:
   Name                      | Type                  | Description
   --------------------------|-----------------------|----------------------------------
   password                  | String                | **Optional.** Password string. Note: This attribute is hidden in API responses.
+  hashed\_password          | String                | **Optional.** A hashed password string in the form of /etc/shadow. Note: This attribute is hidden in API responses.
   client\_cn                | String                | **Optional.** Client Common Name (CN).
-  permissions		    | Array                 | **Required.** Array of permissions. Either as string or dictionary with the keys `permission` and `filter`. The latter must be specified as function.
+  permissions               | Array                 | **Required.** Array of permissions. Either as string or dictionary with the keys `permission` and `filter`. The latter must be specified as function.
 
 Available permissions are explained in the [API permissions](12-icinga2-api.md#icinga2-api-permissions)
 chapter.
diff --git a/doc/11-cli-commands.md b/doc/11-cli-commands.md
index c5e9d289a..10acf727a 100644
--- a/doc/11-cli-commands.md
+++ b/doc/11-cli-commands.md
@@ -19,7 +19,8 @@ Usage:
   icinga2 <command> [<arguments>]
 
 Supported commands:
-  * api setup (setup for api)
+  * api setup (setup for API)
+  * api user (API user creation helper)
   * ca list (lists all certificate signing requests)
   * ca sign (signs an outstanding certificate request)
   * console (Icinga console)
@@ -135,8 +136,9 @@ added.
 
 ## CLI command: Api <a id="cli-command-api"></a>
 
-Provides the setup CLI command to enable the REST API. More details
-in the [Icinga 2 API](12-icinga2-api.md#icinga2-api-setup) chapter.
+Provides the helper functions `api setup` and `api user`. The first to enable the REST API, the second to create
+ApiUser objects with hashed password strings.
+More details in the [Icinga 2 API](12-icinga2-api.md#icinga2-api-setup) chapter.
 
 ```
 # icinga2 api --help
@@ -146,7 +148,8 @@ Usage:
   icinga2 <command> [<arguments>]
 
 Supported commands:
-  * api setup (setup for api)
+  * api setup (setup for API)
+  * api user (API user creation helper)
 
 Global options:
   -h [ --help ]             show this help message
diff --git a/doc/12-icinga2-api.md b/doc/12-icinga2-api.md
index b2e61765b..8351c90e0 100644
--- a/doc/12-icinga2-api.md
+++ b/doc/12-icinga2-api.md
@@ -21,6 +21,25 @@ If you prefer to set up the API manually, you will have to perform the following
 
 The next chapter provides a quick overview of how you can use the API.
 
+### Creating ApiUsers
+
+The CLI command `icinga2 api user` allows you to create an ApiUser object with a hashed password string, ready to be
+added to your configuration. Example:
+
+```
+$ icinga2 api user --user icingaweb2 --passwd icinga
+object ApiUser "icingaweb2" {
+  password_hash ="$5$d5f1a17ea308acb6$9e9fd5d24a9373a16e8811765cc5a5939687faf9ef8ed496db6e7f1d0ae9b2a9"
+  // client_cn = ""
+
+  permissions = [ "*" ]
+}
+```
+
+Optionally a salt can be provided with `--salt`, otherwise a random value will be used. When ApiUsers are stored this
+way, even somebody able to read the configuration files won't be able to authenticate using this information. There is
+no way to recover your password should you forget it, you'd need to create it anew.
+
 ## Introduction <a id="icinga2-api-introduction"></a>
 
 The Icinga 2 API allows you to manage configuration objects
diff --git a/lib/base/tlsutility.cpp b/lib/base/tlsutility.cpp
index eda13ba1d..f8bc136ad 100644
--- a/lib/base/tlsutility.cpp
+++ b/lib/base/tlsutility.cpp
@@ -624,6 +624,19 @@ String PBKDF2_SHA1(const String& password, const String& salt, int iterations)
 	return output;
 }
 
+String PBKDF2_SHA256(const String& password, const String& salt, int iterations)
+{
+	unsigned char digest[SHA256_DIGEST_LENGTH];
+	PKCS5_PBKDF2_HMAC(password.CStr(), password.GetLength(), reinterpret_cast<const unsigned char *>(salt.CStr()),
+		salt.GetLength(), iterations, EVP_sha256(), SHA256_DIGEST_LENGTH, digest);
+
+	char output[SHA256_DIGEST_LENGTH*2+1];
+	for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)
+		sprintf(output + 2 * i, "%02x", digest[i]);
+
+	return output;
+}
+
 String SHA1(const String& s, bool binary)
 {
 	char errbuf[120];
diff --git a/lib/base/tlsutility.hpp b/lib/base/tlsutility.hpp
index c2191cc51..2ab230f6c 100644
--- a/lib/base/tlsutility.hpp
+++ b/lib/base/tlsutility.hpp
@@ -52,6 +52,7 @@ boost::shared_ptr<X509> I2_BASE_API StringToCertificate(const String& cert);
 boost::shared_ptr<X509> I2_BASE_API CreateCertIcingaCA(EVP_PKEY *pubkey, X509_NAME *subject);
 boost::shared_ptr<X509> I2_BASE_API CreateCertIcingaCA(const boost::shared_ptr<X509>& cert);
 String I2_BASE_API PBKDF2_SHA1(const String& password, const String& salt, int iterations);
+String I2_BASE_API PBKDF2_SHA256(const String& password, const String& salt, int iterations);
 String I2_BASE_API SHA1(const String& s, bool binary = false);
 String I2_BASE_API SHA256(const String& s);
 String I2_BASE_API RandomString(int length);
diff --git a/lib/cli/CMakeLists.txt b/lib/cli/CMakeLists.txt
index 101577530..f4783fa6f 100644
--- a/lib/cli/CMakeLists.txt
+++ b/lib/cli/CMakeLists.txt
@@ -26,7 +26,7 @@ set(cli_SOURCES
   objectlistcommand.cpp objectlistutility.cpp
   pkinewcacommand.cpp pkinewcertcommand.cpp pkisigncsrcommand.cpp pkirequestcommand.cpp pkisavecertcommand.cpp pkiticketcommand.cpp
   variablegetcommand.cpp variablelistcommand.cpp variableutility.cpp
-  troubleshootcommand.cpp
+  apiusercommand.cpp troubleshootcommand.cpp
 )
 
 if(ICINGA2_UNITY_BUILD)
diff --git a/lib/cli/apisetupcommand.cpp b/lib/cli/apisetupcommand.cpp
index 6c6d79edd..9a91642f9 100644
--- a/lib/cli/apisetupcommand.cpp
+++ b/lib/cli/apisetupcommand.cpp
@@ -36,7 +36,7 @@ String ApiSetupCommand::GetDescription(void) const
 
 String ApiSetupCommand::GetShortDescription(void) const
 {
-	return "setup for api";
+	return "setup for API";
 }
 
 ImpersonationLevel ApiSetupCommand::GetImpersonationLevel(void) const
diff --git a/lib/cli/apiusercommand.cpp b/lib/cli/apiusercommand.cpp
new file mode 100644
index 000000000..9d43e120f
--- /dev/null
+++ b/lib/cli/apiusercommand.cpp
@@ -0,0 +1,82 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2017 Icinga Development Team (https://www.icinga.com/)  *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#include "cli/apiusercommand.hpp"
+#include "base/logger.hpp"
+#include "base/tlsutility.hpp"
+#include "remote/apiuser.hpp"
+#include <iostream>
+
+using namespace icinga;
+namespace po = boost::program_options;
+
+REGISTER_CLICOMMAND("api/user", ApiUserCommand);
+
+String ApiUserCommand::GetDescription(void) const
+{
+	return "Create a hashed user and password string for the Icinga 2 API";
+}
+
+String ApiUserCommand::GetShortDescription(void) const
+{
+	return "API user creation helper";
+}
+
+void ApiUserCommand::InitParameters(boost::program_options::options_description& visibleDesc,
+    boost::program_options::options_description& hiddenDesc) const
+{
+	visibleDesc.add_options()
+		("user", po::value<std::string>(), "API username")
+		("passwd", po::value<std::string>(), "Password in clear text")
+		("salt", po::value<std::string>(), "Optional salt (default: 8 random chars)");
+}
+
+/**
+ * The entry point for the "api user" CLI command.
+ *
+ * @returns An exit status.
+ */
+int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const
+{
+	if (!vm.count("user")) {
+		Log(LogCritical, "cli", "Username (--user) must be specified.");
+		return 1;
+	}
+
+	if (!vm.count("passwd")) {
+		Log(LogCritical, "cli", "Password (--passwd) must be specified.");
+		return 1;
+	}
+
+	String user = vm["user"].as<std::string>();
+	String passwd = vm["passwd"].as<std::string>();
+	String salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
+
+	String hashedPassword = ApiUser::CreateHashedPasswordString(passwd, salt, true);
+
+	std::cout
+		<< "object ApiUser \"" << user << "\" {\n"
+		<< "  password_hash =\"" << hashedPassword << "\"\n"
+		<< "  // client_cn = \"\"\n"
+		<< "\n"
+		<< "  permissions = [ \"*\" ]\n"
+		<< "}\n";
+
+	return 0;
+}
diff --git a/lib/cli/apiusercommand.hpp b/lib/cli/apiusercommand.hpp
new file mode 100644
index 000000000..4a4bfb280
--- /dev/null
+++ b/lib/cli/apiusercommand.hpp
@@ -0,0 +1,47 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2017 Icinga Development Team (https://www.icinga.com/)  *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#ifndef APIUSERCOMMAND_H
+#define APIUSERCOMMAND_H
+
+#include "cli/clicommand.hpp"
+
+namespace icinga
+{
+
+/**
+ * The "api user" command.
+ *
+ * @ingroup cli
+ */
+class ApiUserCommand : public CLICommand
+{
+public:
+	DECLARE_PTR_TYPEDEFS(ApiUserCommand);
+
+	virtual String GetDescription(void) const override;
+	virtual String GetShortDescription(void) const override;
+	virtual void InitParameters(boost::program_options::options_description& visibleDesc,
+		boost::program_options::options_description& hiddenDesc) const override;
+	virtual int Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const override;
+};
+
+}
+
+#endif /* APIUSERCOMMAND_H */
diff --git a/lib/remote/apiuser.cpp b/lib/remote/apiuser.cpp
index c3e95ebe6..fb847f9bb 100644
--- a/lib/remote/apiuser.cpp
+++ b/lib/remote/apiuser.cpp
@@ -21,11 +21,20 @@
 #include "remote/apiuser.tcpp"
 #include "base/configtype.hpp"
 #include "base/base64.hpp"
+#include "base/tlsutility.hpp"
 
 using namespace icinga;
 
 REGISTER_TYPE(ApiUser);
 
+void ApiUser::OnConfigLoaded(void)
+{
+	ObjectImpl<ApiUser>::OnConfigLoaded();
+
+	if (this->GetPasswordHash().IsEmpty())
+		SetPasswordHash(CreateHashedPasswordString(GetPassword(), RandomString(8), true));
+}
+
 ApiUser::Ptr ApiUser::GetByClientCN(const String& cn)
 {
 	for (const ApiUser::Ptr& user : ConfigType::GetObjectsByType<ApiUser>()) {
@@ -63,3 +72,50 @@ ApiUser::Ptr ApiUser::GetByAuthHeader(const String& auth_header)
 
 	return user;
 }
+
+bool ApiUser::ComparePassword(String password) const
+{
+	Dictionary::Ptr passwordDict = this->GetPasswordDict();
+	String thisPassword = passwordDict->Get("password");
+	String otherPassword = CreateHashedPasswordString(password, passwordDict->Get("salt"), false);
+
+	const char *p1 = otherPassword.CStr();
+	const char *p2 = thisPassword.CStr();
+
+	volatile char c = 0;
+
+	for (size_t i=0; i<64; ++i)
+		c |= p1[i] ^ p2[i];
+
+	return (c == 0);
+}
+
+Dictionary::Ptr ApiUser::GetPasswordDict(void) const
+{
+	String password = this->GetPasswordHash();
+	if (password.IsEmpty() || password[0] != '$')
+		return nullptr;
+
+	String::SizeType saltBegin = password.FindFirstOf('$', 1);
+	String::SizeType passwordBegin = password.FindFirstOf('$', saltBegin+1);
+
+	if (saltBegin == String::NPos || saltBegin == 1 || passwordBegin == String::NPos)
+		return nullptr;
+
+	Dictionary::Ptr passwordDict = new Dictionary();
+	passwordDict->Set("algorithm", password.SubStr(1, saltBegin - 1));
+	passwordDict->Set("salt", password.SubStr(saltBegin + 1, passwordBegin - saltBegin - 1));
+	passwordDict->Set("password", password.SubStr(passwordBegin + 1));
+
+	return passwordDict;
+}
+
+String ApiUser::CreateHashedPasswordString(const String& password, const String& salt, const bool shadow)
+{
+	if (shadow)
+		//Using /etc/shadow password format. The 5 means SHA256 is being used
+		return String("$5$" + salt + "$" + PBKDF2_SHA256(password, salt, 1000));
+	else
+		return PBKDF2_SHA256(password, salt, 1000);
+
+}
diff --git a/lib/remote/apiuser.hpp b/lib/remote/apiuser.hpp
index 4021487b4..09ee1a4d0 100644
--- a/lib/remote/apiuser.hpp
+++ b/lib/remote/apiuser.hpp
@@ -35,8 +35,14 @@ public:
 	DECLARE_OBJECT(ApiUser);
 	DECLARE_OBJECTNAME(ApiUser);
 
+	virtual void OnConfigLoaded(void) override;
+
 	static ApiUser::Ptr GetByClientCN(const String& cn);
 	static ApiUser::Ptr GetByAuthHeader(const String& auth_header);
+	static String CreateHashedPasswordString(const String& password, const String& salt, const bool shadow = false);
+
+	Dictionary::Ptr GetPasswordDict(void) const;
+	bool ComparePassword(String password) const;
 };
 
 }
diff --git a/lib/remote/apiuser.ti b/lib/remote/apiuser.ti
index effc804c2..32557d169 100644
--- a/lib/remote/apiuser.ti
+++ b/lib/remote/apiuser.ti
@@ -27,7 +27,9 @@ namespace icinga
 
 class ApiUser : ConfigObject
 {
-	[config, no_user_view] String password;
+	/* No show config */
+	[no_user_view, no_user_modify] String password;
+	[config, no_user_view] String password_hash;
 	[config] String client_cn (ClientCN);
 	[config] array(Value) permissions;
 };
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index 2a234419d..9d993feae 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -27,6 +27,7 @@ set(base_test_SOURCES
   base-value.cpp config-ops.cpp icinga-checkresult.cpp icinga-macros.cpp
   icinga-notification.cpp
   icinga-perfdata.cpp remote-url.cpp
+  remote-user.cpp
 )
 
 if(ICINGA2_UNITY_BUILD)
@@ -118,6 +119,7 @@ add_boost_test(base
         remote_url/get_and_set
         remote_url/format
         remote_url/illegal_legal_strings
+        api_user/password
 )
 
 if(ICINGA2_WITH_LIVESTATUS)
diff --git a/test/remote-user.cpp b/test/remote-user.cpp
new file mode 100644
index 000000000..eafa0e721
--- /dev/null
+++ b/test/remote-user.cpp
@@ -0,0 +1,52 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2017 Icinga Development Team (https://www.icinga.com/)  *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#include "remote/apiuser.hpp"
+#include "base/tlsutility.hpp"
+#include <BoostTestTargetConfig.h>
+
+#include <iostream>
+
+using namespace icinga;
+
+BOOST_AUTO_TEST_SUITE(api_user)
+
+BOOST_AUTO_TEST_CASE(password)
+{
+#ifndef I2_DEBUG
+	std::cout << "Only enabled in Debug builds..." << std::endl;
+#else
+	ApiUser::Ptr user = new ApiUser();
+	String passwd = RandomString(16);
+	String salt = RandomString(8);
+	user->SetPassword("ThisShouldBeIgnored");
+	user->SetPasswordHash(ApiUser::CreateHashedPasswordString(passwd, salt, true));
+
+	BOOST_CHECK(user->GetPasswordHash() != passwd);
+
+	Dictionary::Ptr passwdd = user->GetPasswordDict();
+
+	BOOST_CHECK(passwdd);
+	BOOST_CHECK(passwdd->Get("salt") == salt);
+	BOOST_CHECK(user->ComparePassword(passwd));
+	BOOST_CHECK(!user->ComparePassword("wrong password uwu!"));
+#endif
+}
+
+BOOST_AUTO_TEST_SUITE_END()

From 6387f5442ec92f56f2bdaa7379b7caf02e91938c Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 22 Dec 2017 12:14:31 +0100
Subject: [PATCH 27/57] Move new password functions into tlsutility

---
 lib/base/tlsutility.cpp             | 24 ++++++++++++++++++
 lib/base/tlsutility.hpp             |  2 ++
 lib/cli/apiusercommand.cpp          |  2 +-
 lib/remote/apiuser.cpp              | 38 ++++++-----------------------
 lib/remote/apiuser.hpp              |  2 --
 lib/remote/httpserverconnection.cpp |  1 +
 test/remote-user.cpp                |  6 ++---
 7 files changed, 38 insertions(+), 37 deletions(-)

diff --git a/lib/base/tlsutility.cpp b/lib/base/tlsutility.cpp
index f8bc136ad..04d8ea49f 100644
--- a/lib/base/tlsutility.cpp
+++ b/lib/base/tlsutility.cpp
@@ -761,4 +761,28 @@ bool VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost
 	return rc == 1;
 }
 
+bool ComparePassword(const String hash, const String password, const String salt)
+{
+	String otherHash = HashPassword(password, salt);
+
+	const char *p1 = otherHash.CStr();
+	const char *p2 = hash.CStr();
+
+	volatile char c = 0;
+
+	for (size_t i=0; i<64; ++i)
+		c |= p1[i] ^ p2[i];
+
+	return (c == 0);
+}
+
+String HashPassword(const String& password, const String& salt, const bool shadow)
+{
+	if (shadow)
+		//Using /etc/shadow password format. The 5 means SHA256 is being used
+		return String("$5$" + salt + "$" + PBKDF2_SHA256(password, salt, 1000));
+	else
+		return PBKDF2_SHA256(password, salt, 1000);
+}
+
 }
diff --git a/lib/base/tlsutility.hpp b/lib/base/tlsutility.hpp
index 2ab230f6c..96bdc63b0 100644
--- a/lib/base/tlsutility.hpp
+++ b/lib/base/tlsutility.hpp
@@ -57,6 +57,8 @@ String I2_BASE_API SHA1(const String& s, bool binary = false);
 String I2_BASE_API SHA256(const String& s);
 String I2_BASE_API RandomString(int length);
 bool I2_BASE_API VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate);
+bool I2_BASE_API ComparePassword(const String hash, const String password, const String Salt);
+String I2_BASE_API HashPassword(const String& password, const String& salt, const bool shadow = false);
 
 class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { };
 
diff --git a/lib/cli/apiusercommand.cpp b/lib/cli/apiusercommand.cpp
index 9d43e120f..1cd5b4858 100644
--- a/lib/cli/apiusercommand.cpp
+++ b/lib/cli/apiusercommand.cpp
@@ -68,7 +68,7 @@ int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const s
 	String passwd = vm["passwd"].as<std::string>();
 	String salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
 
-	String hashedPassword = ApiUser::CreateHashedPasswordString(passwd, salt, true);
+	String hashedPassword = HashPassword(passwd, salt, true);
 
 	std::cout
 		<< "object ApiUser \"" << user << "\" {\n"
diff --git a/lib/remote/apiuser.cpp b/lib/remote/apiuser.cpp
index fb847f9bb..0caac19ff 100644
--- a/lib/remote/apiuser.cpp
+++ b/lib/remote/apiuser.cpp
@@ -32,7 +32,7 @@ void ApiUser::OnConfigLoaded(void)
 	ObjectImpl<ApiUser>::OnConfigLoaded();
 
 	if (this->GetPasswordHash().IsEmpty())
-		SetPasswordHash(CreateHashedPasswordString(GetPassword(), RandomString(8), true));
+		SetPasswordHash(HashPassword(GetPassword(), RandomString(8), true));
 }
 
 ApiUser::Ptr ApiUser::GetByClientCN(const String& cn)
@@ -65,31 +65,17 @@ ApiUser::Ptr ApiUser::GetByAuthHeader(const String& auth_header)
 	const ApiUser::Ptr& user = ApiUser::GetByName(username);
 
 	/* Deny authentication if 1) given password is empty 2) configured password does not match. */
-	if (password.IsEmpty())
-		return nullptr;
-	else if (user && user->GetPassword() != password)
+	if (!user || password.IsEmpty())
 		return nullptr;
+	else {
+		Dictionary::Ptr passwordDict = user->GetPasswordDict();
+		if (!ComparePassword(passwordDict->Get("password"), password, passwordDict->Get("salt")))
+			return nullptr;
+	}
 
 	return user;
 }
 
-bool ApiUser::ComparePassword(String password) const
-{
-	Dictionary::Ptr passwordDict = this->GetPasswordDict();
-	String thisPassword = passwordDict->Get("password");
-	String otherPassword = CreateHashedPasswordString(password, passwordDict->Get("salt"), false);
-
-	const char *p1 = otherPassword.CStr();
-	const char *p2 = thisPassword.CStr();
-
-	volatile char c = 0;
-
-	for (size_t i=0; i<64; ++i)
-		c |= p1[i] ^ p2[i];
-
-	return (c == 0);
-}
-
 Dictionary::Ptr ApiUser::GetPasswordDict(void) const
 {
 	String password = this->GetPasswordHash();
@@ -109,13 +95,3 @@ Dictionary::Ptr ApiUser::GetPasswordDict(void) const
 
 	return passwordDict;
 }
-
-String ApiUser::CreateHashedPasswordString(const String& password, const String& salt, const bool shadow)
-{
-	if (shadow)
-		//Using /etc/shadow password format. The 5 means SHA256 is being used
-		return String("$5$" + salt + "$" + PBKDF2_SHA256(password, salt, 1000));
-	else
-		return PBKDF2_SHA256(password, salt, 1000);
-
-}
diff --git a/lib/remote/apiuser.hpp b/lib/remote/apiuser.hpp
index 09ee1a4d0..5aacbae0b 100644
--- a/lib/remote/apiuser.hpp
+++ b/lib/remote/apiuser.hpp
@@ -39,10 +39,8 @@ public:
 
 	static ApiUser::Ptr GetByClientCN(const String& cn);
 	static ApiUser::Ptr GetByAuthHeader(const String& auth_header);
-	static String CreateHashedPasswordString(const String& password, const String& salt, const bool shadow = false);
 
 	Dictionary::Ptr GetPasswordDict(void) const;
-	bool ComparePassword(String password) const;
 };
 
 }
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 57f44f22b..8a14b00e1 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -30,6 +30,7 @@
 #include "base/logger.hpp"
 #include "base/objectlock.hpp"
 #include "base/timer.hpp"
+#include "base/tlsutility.hpp"
 #include "base/utility.hpp"
 #include <boost/thread/once.hpp>
 
diff --git a/test/remote-user.cpp b/test/remote-user.cpp
index eafa0e721..1c327bacb 100644
--- a/test/remote-user.cpp
+++ b/test/remote-user.cpp
@@ -36,7 +36,7 @@ BOOST_AUTO_TEST_CASE(password)
 	String passwd = RandomString(16);
 	String salt = RandomString(8);
 	user->SetPassword("ThisShouldBeIgnored");
-	user->SetPasswordHash(ApiUser::CreateHashedPasswordString(passwd, salt, true));
+	user->SetPasswordHash(HashPassword(passwd, salt, true));
 
 	BOOST_CHECK(user->GetPasswordHash() != passwd);
 
@@ -44,8 +44,8 @@ BOOST_AUTO_TEST_CASE(password)
 
 	BOOST_CHECK(passwdd);
 	BOOST_CHECK(passwdd->Get("salt") == salt);
-	BOOST_CHECK(user->ComparePassword(passwd));
-	BOOST_CHECK(!user->ComparePassword("wrong password uwu!"));
+	BOOST_CHECK(ComparePassword(passwdd->Get("password"), passwd, salt));
+	BOOST_CHECK(!ComparePassword(passwdd->Get("password"), "wrong password uwu!", salt));
 #endif
 }
 

From 2e5aedd28a5e98628febd0025291405ce4390189 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 22 Dec 2017 12:58:39 +0100
Subject: [PATCH 28/57] Fix crash when using incorrectly formatted password
 hash

---
 lib/remote/apiuser.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/remote/apiuser.cpp b/lib/remote/apiuser.cpp
index 0caac19ff..606e66dcc 100644
--- a/lib/remote/apiuser.cpp
+++ b/lib/remote/apiuser.cpp
@@ -69,7 +69,7 @@ ApiUser::Ptr ApiUser::GetByAuthHeader(const String& auth_header)
 		return nullptr;
 	else {
 		Dictionary::Ptr passwordDict = user->GetPasswordDict();
-		if (!ComparePassword(passwordDict->Get("password"), password, passwordDict->Get("salt")))
+		if (!passwordDict || !ComparePassword(passwordDict->Get("password"), password, passwordDict->Get("salt")))
 			return nullptr;
 	}
 

From aad44dfbb2097443ef29871500a4dcaefcac96e3 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 22 Dec 2017 13:01:51 +0100
Subject: [PATCH 29/57] Improve api user command

--oneline can now be used to print out only the password hash string.
This can be used to update ApiUser passwords through the API. There is
also now a validation to make use salt does not contain a '$' which
would break verification.
---
 lib/cli/apiusercommand.cpp | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/lib/cli/apiusercommand.cpp b/lib/cli/apiusercommand.cpp
index 1cd5b4858..8c20f5568 100644
--- a/lib/cli/apiusercommand.cpp
+++ b/lib/cli/apiusercommand.cpp
@@ -44,7 +44,8 @@ void ApiUserCommand::InitParameters(boost::program_options::options_description&
 	visibleDesc.add_options()
 		("user", po::value<std::string>(), "API username")
 		("passwd", po::value<std::string>(), "Password in clear text")
-		("salt", po::value<std::string>(), "Optional salt (default: 8 random chars)");
+		("salt", po::value<std::string>(), "Optional salt (default: 8 random chars)")
+		("oneline", "Print only the password hash");
 }
 
 /**
@@ -54,29 +55,40 @@ void ApiUserCommand::InitParameters(boost::program_options::options_description&
  */
 int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const
 {
-	if (!vm.count("user")) {
+	String user, passwd, salt;
+	if (!vm.count("user") && !vm.count("oneline")) {
 		Log(LogCritical, "cli", "Username (--user) must be specified.");
 		return 1;
-	}
+	} else
+		user = vm["user"].as<std::string>();
 
 	if (!vm.count("passwd")) {
 		Log(LogCritical, "cli", "Password (--passwd) must be specified.");
 		return 1;
 	}
 
-	String user = vm["user"].as<std::string>();
-	String passwd = vm["passwd"].as<std::string>();
-	String salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
+	passwd = vm["passwd"].as<std::string>();
+	salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
+
+	std::cout << salt << '\n';
+	if (salt.FindFirstOf('$') != String::NPos) {
+		Log(LogCritical, "cli", "Salt (--salt) may not contain '$'");
+		return 1;
+	}
 
 	String hashedPassword = HashPassword(passwd, salt, true);
 
-	std::cout
-		<< "object ApiUser \"" << user << "\" {\n"
-		<< "  password_hash =\"" << hashedPassword << "\"\n"
-		<< "  // client_cn = \"\"\n"
-		<< "\n"
-		<< "  permissions = [ \"*\" ]\n"
-		<< "}\n";
+	if (vm.count("oneline"))
+		std::cout << '"' << hashedPassword << "\"\n";
+	else {
+		std::cout
+			<< "object ApiUser \"" << user << "\" {\n"
+			<< "  password_hash =\"" << hashedPassword << "\"\n"
+			<< "  // client_cn = \"\"\n"
+			<< "\n"
+			<< "  permissions = [ \"*\" ]\n"
+			<< "}\n";
+	}
 
 	return 0;
 }

From ed1dd36f090b73cbffd9edd1c3f553c399f71c2a Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Thu, 15 Feb 2018 15:48:53 +0100
Subject: [PATCH 30/57] Properly escape strings in ApiUserCommand::Run

---
 lib/cli/apiusercommand.cpp | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lib/cli/apiusercommand.cpp b/lib/cli/apiusercommand.cpp
index 8c20f5568..fc1ae6bc3 100644
--- a/lib/cli/apiusercommand.cpp
+++ b/lib/cli/apiusercommand.cpp
@@ -20,6 +20,7 @@
 #include "cli/apiusercommand.hpp"
 #include "base/logger.hpp"
 #include "base/tlsutility.hpp"
+#include "base/configwriter.hpp"
 #include "remote/apiuser.hpp"
 #include <iostream>
 
@@ -81,9 +82,16 @@ int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const s
 	if (vm.count("oneline"))
 		std::cout << '"' << hashedPassword << "\"\n";
 	else {
-		std::cout
-			<< "object ApiUser \"" << user << "\" {\n"
-			<< "  password_hash =\"" << hashedPassword << "\"\n"
+		std::cout << "object ApiUser ";
+
+		ConfigWriter::EmitString(std::cout, user);
+
+		std::cout << "{\n"
+			<< "  password_hash = ";
+
+		ConfigWriter::EmitString(std::cout, hashedPassword);
+
+		std::cout << "\n"
 			<< "  // client_cn = \"\"\n"
 			<< "\n"
 			<< "  permissions = [ \"*\" ]\n"

From 492b590a29ab00dbf9ebe0bf8fdb1ab54698d914 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Thu, 15 Feb 2018 15:49:23 +0100
Subject: [PATCH 31/57] Remove debug output in ApiUserCommand::Run

---
 lib/cli/apiusercommand.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/cli/apiusercommand.cpp b/lib/cli/apiusercommand.cpp
index fc1ae6bc3..6eb5c3bf3 100644
--- a/lib/cli/apiusercommand.cpp
+++ b/lib/cli/apiusercommand.cpp
@@ -71,7 +71,6 @@ int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const s
 	passwd = vm["passwd"].as<std::string>();
 	salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
 
-	std::cout << salt << '\n';
 	if (salt.FindFirstOf('$') != String::NPos) {
 		Log(LogCritical, "cli", "Salt (--salt) may not contain '$'");
 		return 1;

From 40e89c41844d8f181087b855307554d77d8ea1d4 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Thu, 22 Feb 2018 11:29:12 +0100
Subject: [PATCH 32/57] Add Upgrading to Icinga 2.8.2 chapter

---
 doc/16-upgrading-icinga-2.md | 16 ++++++++++++++++
 doc/17-language-reference.md | 14 +++++++-------
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/doc/16-upgrading-icinga-2.md b/doc/16-upgrading-icinga-2.md
index e66505627..b581afee1 100644
--- a/doc/16-upgrading-icinga-2.md
+++ b/doc/16-upgrading-icinga-2.md
@@ -7,6 +7,22 @@ Specific version upgrades are described below. Please note that version
 updates are incremental. An upgrade from v2.6 to v2.8 requires to
 follow the instructions for v2.7 too.
 
+## Upgrading to v2.8.2 <a id="upgrading-to-2-8-2"></a>
+
+With version 2.8.2 the location of settings formerly found in `/etc/icinga2/init.conf` has changed. They are now
+located in the sysconfig (`/etc/sysconfig/icinga2` on most systems). The `init.conf` has been removed and its settings
+will be ignored. These changes are only relevant if you edited the `init.conf`. Below is a table displaying the new
+names for the affected settings.
+
+ Old `init.conf` | New `sysconfig/icinga2`
+ ----------------|------------------------
+ RunAsUser       | ICINGA2\_USER
+ RunAsGroup      | ICINGA2\_GROUP
+ RLimitFiles     | ICINGA2\_RLIMIT\_FILES
+ RLimitProcesses | ICINGA2\_RLIMIT\_PROCESSES
+ RLimitStack     | ICINGA2\_RLIMIT\_STACK
+
+
 ## Upgrading to v2.8 <a id="upgrading-to-2-8"></a>
 
 ### DB IDO Schema Update to 2.8.0 <a id="upgrading-to-2-8-db-ido"></a>
diff --git a/doc/17-language-reference.md b/doc/17-language-reference.md
index e18a0a7c7..794f42839 100644
--- a/doc/17-language-reference.md
+++ b/doc/17-language-reference.md
@@ -402,13 +402,13 @@ BuildHostName       |**Read-only.** The name of the host Icinga was built on, e.
 
 Advanced runtime constants. Please only use them if advised by support or developers.
 
-Variable            |Description
---------------------|-------------------
-EventEngine         |**Read-write.** The name of the socket event engine, can be `poll` or `epoll`. The epoll interface is only supported on Linux.
-AttachDebugger      |**Read-write.** Whether to attach a debugger when Icinga 2 crashes. Defaults to `false`.
-RLimitFiles         |**Read-write.** Defines the resource limit for RLIMIT_NOFILE that should be set at start-up. Value cannot be set lower than the default `16 * 1024`. 0 disables the setting. Used in the `init.conf` configuration file.
-RLimitProcesses     |**Read-write.** Defines the resource limit for RLIMIT_NPROC that should be set at start-up. Value cannot be set lower than the default `16 * 1024`. 0 disables the setting. Used in the `init.conf` configuration file.
-RLimitStack         |**Read-write.** Defines the resource limit for RLIMIT_STACK that should be set at start-up. Value cannot be set lower than the default `256 * 1024`. 0 disables the setting. Used in the `init.conf` configuration file.
+Variable                   | Description
+---------------------------|-------------------
+EventEngine                |**Read-write.** The name of the socket event engine, can be `poll` or `epoll`. The epoll interface is only supported on Linux.
+AttachDebugger             |**Read-write.** Whether to attach a debugger when Icinga 2 crashes. Defaults to `false`.
+ICINGA2\_RLIMIT\_FILES     |**Read-write.** Defines the resource limit for RLIMIT_NOFILE that should be set at start-up. Value cannot be set lower than the default `16 * 1024`. 0 disables the setting. Set in Icinga 2 sysconfig.
+ICINGA2\_RLIMIT\_PROCESSES |**Read-write.** Defines the resource limit for RLIMIT_NPROC that should be set at start-up. Value cannot be set lower than the default `16 * 1024`. 0 disables the setting. Set in Icinga 2 sysconfig.
+ICINGA2\_RLIMIT\_STACK     |**Read-write.** Defines the resource limit for RLIMIT_STACK that should be set at start-up. Value cannot be set lower than the default `256 * 1024`. 0 disables the setting. Set in Icinga 2 sysconfig.
 
 ## Apply <a id="apply"></a>
 

From f282b68fbd36d7bb5c054d88cf3caee0facb4e09 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Thu, 22 Feb 2018 12:31:36 +0100
Subject: [PATCH 33/57] Add clarification on sysconfig location

---
 doc/16-upgrading-icinga-2.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/16-upgrading-icinga-2.md b/doc/16-upgrading-icinga-2.md
index b581afee1..fb91aba7b 100644
--- a/doc/16-upgrading-icinga-2.md
+++ b/doc/16-upgrading-icinga-2.md
@@ -10,9 +10,9 @@ follow the instructions for v2.7 too.
 ## Upgrading to v2.8.2 <a id="upgrading-to-2-8-2"></a>
 
 With version 2.8.2 the location of settings formerly found in `/etc/icinga2/init.conf` has changed. They are now
-located in the sysconfig (`/etc/sysconfig/icinga2` on most systems). The `init.conf` has been removed and its settings
-will be ignored. These changes are only relevant if you edited the `init.conf`. Below is a table displaying the new
-names for the affected settings.
+located in the sysconfig, `/etc/sysconfig/icinga2` (RPM) or `/etc/default/icinga2` (DPKG) on most systems. The
+`init.conf` file has been removed and its settings will be ignored. These changes are only relevant if you edited the
+`init.conf`. Below is a table displaying the new names for the affected settings.
 
  Old `init.conf` | New `sysconfig/icinga2`
  ----------------|------------------------

From 5aafc7eda5c1b026a993fc2782fa84b8f3e8e052 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Wed, 29 Nov 2017 13:56:10 +0100
Subject: [PATCH 34/57] Fix prepare-dirs permission exploit

refs #5793
---
 etc/initsystem/icinga2.sysconfig.cmake |  7 +++---
 etc/initsystem/prepare-dirs            | 35 +++++++++++---------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/etc/initsystem/icinga2.sysconfig.cmake b/etc/initsystem/icinga2.sysconfig.cmake
index e7fa54baf..7daf305be 100644
--- a/etc/initsystem/icinga2.sysconfig.cmake
+++ b/etc/initsystem/icinga2.sysconfig.cmake
@@ -3,9 +3,10 @@ ICINGA2_CONFIG_FILE=@CMAKE_INSTALL_FULL_SYSCONFDIR@/icinga2/icinga2.conf
 ICINGA2_RUN_DIR=@ICINGA2_RUNDIR@
 ICINGA2_STATE_DIR=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@
 ICINGA2_PID_FILE=$ICINGA2_RUN_DIR/icinga2/icinga2.pid
-ICINGA2_ERROR_LOG=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@/log/icinga2/error.log
-ICINGA2_STARTUP_LOG=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@/log/icinga2/startup.log
-ICINGA2_LOG=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@/log/icinga2/icinga2.log
+ICINGA2_LOG_DIR=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@/log/icinga2
+ICINGA2_ERROR_LOG=$ICINGA2_LOG_DIR/error.log
+ICINGA2_STARTUP_LOG=$ICINGA2_LOG_DIR/startup.log
+ICINGA2_LOG=$ICINGA2_LOG_DIR/icinga2.log
 ICINGA2_CACHE_DIR=$ICINGA2_STATE_DIR/cache/icinga2
 ICINGA2_USER=@ICINGA2_USER@
 ICINGA2_GROUP=@ICINGA2_GROUP@
diff --git a/etc/initsystem/prepare-dirs b/etc/initsystem/prepare-dirs
index 5d67d476d..799e3226f 100644
--- a/etc/initsystem/prepare-dirs
+++ b/etc/initsystem/prepare-dirs
@@ -29,33 +29,28 @@ getent passwd $ICINGA2_USER >/dev/null 2>&1 || (echo "Icinga user '$ICINGA2_USER
 getent group $ICINGA2_GROUP >/dev/null 2>&1 || (echo "Icinga group '$ICINGA2_GROUP' does not exist. Exiting." && exit 6)
 getent group $ICINGA2_COMMAND_GROUP >/dev/null 2>&1 || (echo "Icinga command group '$ICINGA2_COMMAND_GROUP' does not exist. Exiting." && exit 6)
 
-mkdir -p $(dirname -- $ICINGA2_PID_FILE)
-chown $ICINGA2_USER:$ICINGA2_COMMAND_GROUP $(dirname -- $ICINGA2_PID_FILE)
-if [ -f $ICINGA2_PID_FILE ]; then
-	chown $ICINGA2_USER:$ICINGA2_GROUP $ICINGA2_PID_FILE
+if [ ! -e "$ICINGA2_RUN_DIR"/icinga2 ]; then
+	mkdir "$ICINGA2_RUN_DIR"/icinga2
+	mkdir "$ICINGA2_RUN_DIR"/icinga2/cmd
+	chmod 755 "$ICINGA2_RUN_DIR"/icinga2
+	chmod 2750 "$ICINGA2_RUN_DIR"/icinga2/cmd
+	chown -R $ICINGA2_USER:$ICINGA2_COMMAND_GROUP "$ICINGA2_RUN_DIR"/icinga2
 fi
 
-mkdir -p $(dirname -- $ICINGA2_ERROR_LOG)
-chown $ICINGA2_USER:$ICINGA2_COMMAND_GROUP $(dirname -- $ICINGA2_ERROR_LOG)
-chmod 750 $(dirname -- $ICINGA2_ERROR_LOG)
-if [ -f $ICINGA2_ERROR_LOG ]; then
-	chown $ICINGA2_USER:$ICINGA2_COMMAND_GROUP $ICINGA2_ERROR_LOG
-fi
-if [ -f $ICINGA2_LOG ]; then
-	chown $ICINGA2_USER:$ICINGA2_COMMAND_GROUP $ICINGA2_LOG
+# Could be undefined in installations where sysconf is not overridden on upgrade
+if [ -z "$ICINGA2_LOG_DIR" ]; then
+	$ICINGA2_LOG_DIR=$(dirname -- "$ICINGA2_LOG")
 fi
 
-mkdir -p $ICINGA2_RUN_DIR/icinga2/cmd
-chown $ICINGA2_USER:$ICINGA2_COMMAND_GROUP $ICINGA2_RUN_DIR/icinga2/cmd
+test -e "$ICINGA2_LOG_DIR" || install -m 750 -o $ICINGA2_USER -g $ICINGA2_COMMAND_GROUP -d "$ICINGA2_LOG_DIR"
+
 if type restorecon >/dev/null 2>&1; then
-	restorecon -R $ICINGA2_RUN_DIR/icinga2/
+	restorecon -R "$ICINGA2_RUN_DIR"/icinga2/
 fi
-chmod 2750 $ICINGA2_RUN_DIR/icinga2/cmd
 
 # Add a fallback if the user did not specify this directory in the sysconfig file
 if [ -z "$ICINGA2_CACHE_DIR" ]; then
-	ICINGA2_CACHE_DIR=$ICINGA2_STATE_DIR/cache/icinga2
+	ICINGA2_CACHE_DIR="$ICINGA2_STATE_DIR"/cache/icinga2
 fi
-mkdir -p $ICINGA2_CACHE_DIR
-chown $ICINGA2_USER:$ICINGA2_GROUP $ICINGA2_CACHE_DIR
-chmod 750 $ICINGA2_CACHE_DIR
+
+test -e "$ICINGA2_CACHE_DIR" || install -m 750 -o $ICINGA2_USER -g $ICINGA2_COMMAND_GROUP -d "$ICINGA2_CACHE_DIR"

From 73dcebe25b766f8336efeb78eaa61d80fe0896af Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Wed, 17 Jan 2018 13:25:40 +0100
Subject: [PATCH 35/57] Get ICINGA2_USER and GROUP from sysconfig

---
 etc/initsystem/icinga2.init.d.cmake | 14 ++++++--------
 etc/initsystem/prepare-dirs         | 14 ++++++--------
 2 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/etc/initsystem/icinga2.init.d.cmake b/etc/initsystem/icinga2.init.d.cmake
index 080fb2779..ac494a8a2 100644
--- a/etc/initsystem/icinga2.init.d.cmake
+++ b/etc/initsystem/icinga2.init.d.cmake
@@ -31,16 +31,14 @@ if [ ! -e $ICINGA2_CONFIG_FILE ]; then
 	exit 6
 fi
 
-ICINGA2_USER=`$DAEMON variable get --current RunAsUser`
-if [ $? != 0 ]; then
-        echo "Could not fetch RunAsUser variable. Error '$ICINGA2_USER'. Exiting."
-        exit 6
+if [ ! $ICINGA2_USER ]; then
+	echo "Could not fetch \$ICINGA2_USER. Exiting."
+	exit 6
 fi
 
-ICINGA2_GROUP=`$DAEMON variable get --current RunAsGroup`
-if [ $? != 0 ]; then
-        echo "Could not fetch RunAsGroup variable. Error '$ICINGA2_GROUP'. Exiting."
-        exit 6
+if [ ! $ICINGA2_GROUP ]; then
+	echo "Could not fetch \$ICINGA2_GROUP. Exiting."
+	exit 6
 fi
 
 getent passwd $ICINGA2_USER >/dev/null 2>&1 || (echo "Icinga user '$ICINGA2_USER' does not exist. Exiting." && exit 6)
diff --git a/etc/initsystem/prepare-dirs b/etc/initsystem/prepare-dirs
index 799e3226f..44b8343a8 100644
--- a/etc/initsystem/prepare-dirs
+++ b/etc/initsystem/prepare-dirs
@@ -13,16 +13,14 @@ else
 fi
 
 
-ICINGA2_USER=`$DAEMON variable get --current RunAsUser`
-if [ $? != 0 ]; then
-        echo "Could not fetch RunAsUser variable. Error '$ICINGA2_USER'. Exiting."
-        exit 6
+if [ ! $ICINGA2_USER ]; then
+	echo "Could not fetch \$ICINGA2_USER. Exiting."
+	exit 6
 fi
 
-ICINGA2_GROUP=`$DAEMON variable get --current RunAsGroup`
-if [ $? != 0 ]; then
-        echo "Could not fetch RunAsGroup variable. Error '$ICINGA2_GROUP'. Exiting."
-        exit 6
+if [ ! $ICINGA2_GROUP ]; then
+	echo "Could not fetch \$ICINGA2_GROUP. Exiting."
+	exit 6
 fi
 
 getent passwd $ICINGA2_USER >/dev/null 2>&1 || (echo "Icinga user '$ICINGA2_USER' does not exist. Exiting." && exit 6)

From c6b86680a028f4f4c609aadd708e2454eae53cb0 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Wed, 17 Jan 2018 13:26:19 +0100
Subject: [PATCH 36/57] Add cli tool to send signals as Icinga user

fixes #5991
---
 etc/initsystem/icinga2.init.d.cmake | 88 ++++++++++++++---------------
 lib/cli/CMakeLists.txt              |  2 +-
 lib/cli/internalsignalcommand.cpp   | 84 +++++++++++++++++++++++++++
 lib/cli/internalsignalcommand.hpp   | 50 ++++++++++++++++
 4 files changed, 179 insertions(+), 45 deletions(-)
 create mode 100644 lib/cli/internalsignalcommand.cpp
 create mode 100644 lib/cli/internalsignalcommand.hpp

diff --git a/etc/initsystem/icinga2.init.d.cmake b/etc/initsystem/icinga2.init.d.cmake
index ac494a8a2..bc41ccf67 100644
--- a/etc/initsystem/icinga2.init.d.cmake
+++ b/etc/initsystem/icinga2.init.d.cmake
@@ -47,14 +47,14 @@ getent group $ICINGA2_COMMAND_GROUP >/dev/null 2>&1 || (echo "Icinga command gro
 
 # Get function from functions library
 if [ -f /etc/rc.d/init.d/functions ]; then
-        . /etc/rc.d/init.d/functions
+	. /etc/rc.d/init.d/functions
 elif [ -f /etc/init.d/functions ]; then
-        . /etc/init.d/functions
+	. /etc/init.d/functions
 fi
 
 # Load extra environment variables
 if [ -f /etc/default/icinga2 ]; then
-        . /etc/default/icinga2
+	. /etc/default/icinga2
 fi
 
 # Start Icinga 2
@@ -72,34 +72,33 @@ start() {
 
 # Restart Icinga 2
 stop() {
-        printf "Stopping Icinga 2: "
+	printf "Stopping Icinga 2: "
 
-        if [ ! -e $ICINGA2_PID_FILE ]; then
-                echo "The PID file '$ICINGA2_PID_FILE' does not exist."
-                if [ "x$1" = "xnofail" ]; then
+	if [ ! -e $ICINGA2_PID_FILE ]; then
+		echo "The PID file '$ICINGA2_PID_FILE' does not exist."
+		if [ "x$1" = "xnofail" ]; then
 			return
 		else
 			exit 7
 		fi
-        fi
+	fi
 
 	pid=`cat $ICINGA2_PID_FILE`
-	
-        if kill -INT $pid >/dev/null 2>&1; then
+
+	if icinga2 internal signal -s SIGINT -p $pid >/dev/null 2>&1; then
 		for i in 1 2 3 4 5 6 7 8 9 10; do
-			if ! kill -CHLD $pid >/dev/null 2>&1; then
+		if ! icinga2 internal signal -s SIGCHLD -p $pid >/dev/null 2>&1; then
 				break
 			fi
 		
 			printf '.'
-			
 			sleep 3
 		done
 	fi
 
-        if kill -CHLD $pid >/dev/null 2>&1; then
-                kill -KILL $pid
-        fi
+	if icinga2 internal signal -s SIGCHLD -p $pid >/dev/null 2>&1; then
+		icinga2 internal signal -s SIGKILL -p $pid >/dev/null 2>&1
+	fi
 
 	echo "Done"
 }
@@ -114,21 +113,21 @@ checkconfig() {
 	printf "Checking configuration: "
 
 	if ! $DAEMON daemon -c $ICINGA2_CONFIG_FILE -C > $ICINGA2_STARTUP_LOG 2>&1; then
-                if [ "x$1" = "x" ]; then
+		if [ "x$1" = "x" ]; then
 			cat $ICINGA2_STARTUP_LOG
 			echo "Icinga 2 detected configuration errors. Check '$ICINGA2_STARTUP_LOG' for details."
-                        exit 1
-                else
+			exit 1
+		else
 			echo "Not "$1"ing Icinga 2 due to configuration errors. Check '$ICINGA2_STARTUP_LOG' for details."
-                        if [ "x$2" = "xfail" ]; then
-                                exit 1
-                        fi
-                fi
-        fi
-	
+			if [ "x$2" = "xfail" ]; then
+				exit 1
+			fi
+		fi
+	fi
+
 	echo "Done"
 	# no arguments requires full output
-        if [ "x$1" = "x" ]; then
+	if [ "x$1" = "x" ]; then
 		cat $ICINGA2_STARTUP_LOG
 	fi
 }
@@ -143,7 +142,7 @@ status() {
 	fi
 
 	pid=`cat $ICINGA2_PID_FILE`
-	if kill -CHLD $pid >/dev/null 2>&1; then
+	if icinga2 internal signal -s SIGCHLD -p $pid >/dev/null 2>&1; then
 		echo "Running"
 	else
 		echo "Not running"
@@ -155,33 +154,34 @@ status() {
 case "$1" in
   start)
 	checkconfig start fail
-        start
-        ;;
+	start
+  ;;
   stop)
-        stop
-        ;;
+	stop
+	;;
   status)
-        status
-        ;;
+	status
+  ;;
   restart)
 	checkconfig restart fail
-        stop nofail
-        start
-        ;;
+	stop nofail
+	start
+  ;;
   condrestart)
-        status > /dev/null 2>&1 || exit 0
-        checkconfig restart fail
-        stop nofail
-        start
-        ;;
+	status > /dev/null 2>&1 || exit 0
+	checkconfig restart fail
+	stop nofail
+	start
+  ;;
   reload)
 	reload
-	;;
+  ;;
   checkconfig)
 	checkconfig
-	;;
+  ;;
   *)
-        echo "Usage: $0 {start|stop|restart|reload|checkconfig|status}"
-        exit 3
+	echo "Usage: $0 {start|stop|restart|reload|checkconfig|status}"
+	exit 3
 esac
+
 exit 0
diff --git a/lib/cli/CMakeLists.txt b/lib/cli/CMakeLists.txt
index f4783fa6f..941c983e1 100644
--- a/lib/cli/CMakeLists.txt
+++ b/lib/cli/CMakeLists.txt
@@ -26,7 +26,7 @@ set(cli_SOURCES
   objectlistcommand.cpp objectlistutility.cpp
   pkinewcacommand.cpp pkinewcertcommand.cpp pkisigncsrcommand.cpp pkirequestcommand.cpp pkisavecertcommand.cpp pkiticketcommand.cpp
   variablegetcommand.cpp variablelistcommand.cpp variableutility.cpp
-  apiusercommand.cpp troubleshootcommand.cpp
+  internalsignalcommand.cpp apiusercommand.cpp troubleshootcommand.cpp
 )
 
 if(ICINGA2_UNITY_BUILD)
diff --git a/lib/cli/internalsignalcommand.cpp b/lib/cli/internalsignalcommand.cpp
new file mode 100644
index 000000000..3e196728d
--- /dev/null
+++ b/lib/cli/internalsignalcommand.cpp
@@ -0,0 +1,84 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2018 Icinga Development Team (https://www.icinga.com/)  *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#include "cli/internalsignalcommand.hpp"
+#include "base/logger.hpp"
+#include <signal.h>
+
+using namespace icinga;
+namespace po = boost::program_options;
+
+REGISTER_CLICOMMAND("internal/signal", InternalSignalCommand);
+
+String InternalSignalCommand::GetDescription() const
+{
+	return "Send signal as Icinga user";
+}
+
+String InternalSignalCommand::GetShortDescription() const
+{
+	return "Send signal as Icinga user";
+}
+
+ImpersonationLevel InternalSignalCommand::GetImpersonationLevel() const
+{
+	return ImpersonateIcinga;
+}
+
+bool InternalSignalCommand::IsHidden() const
+{
+	return true;
+}
+
+void InternalSignalCommand::InitParameters(boost::program_options::options_description& visibleDesc,
+	boost::program_options::options_description& hiddenDesc) const
+{
+	visibleDesc.add_options()
+		("pid,p", po::value<int>(), "Target PID")
+		("sig,s", po::value<String>(), "Signal (POSIX string) to send")
+	;
+}
+
+/**
+ * The entry point for the "internal signal" CLI command.
+ *
+ * @returns An exit status.
+ */
+int InternalSignalCommand::Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const
+{
+#ifndef _WIN32
+	String signal = vm["sig"].as<String>();
+
+	/* Thank POSIX */
+	if (signal == "SIGKILL")
+		return kill(vm["pid"].as<int>(), SIGKILL);
+	if (signal == "SIGINT")
+		return kill(vm["pid"].as<int>(), SIGINT);
+	if (signal == "SIGCHLD")
+		return kill(vm["pid"].as<int>(), SIGCHLD);
+	if (signal == "SIGHUP")
+		return kill(vm["pid"].as<int>(), SIGHUP);
+
+	Log(LogCritical, "cli") << "Unsupported signal \"" << signal << "\"";
+#else
+	Log(LogCritical, "cli", "Unsupported action on Windows.");
+#endif /* _Win32 */
+	return 1;
+}
+
diff --git a/lib/cli/internalsignalcommand.hpp b/lib/cli/internalsignalcommand.hpp
new file mode 100644
index 000000000..44830ccd9
--- /dev/null
+++ b/lib/cli/internalsignalcommand.hpp
@@ -0,0 +1,50 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2018 Icinga Development Team (https://www.icinga.com/)  *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#ifndef INTERNALSIGNALCOMMAND_H
+#define INTERNALSIGNALCOMMAND_H
+
+#include "cli/clicommand.hpp"
+
+namespace icinga
+{
+
+/**
+ * The "internal signal" command.
+ *
+ * @ingroup cli
+ */
+class InternalSignalCommand final : public CLICommand
+{
+public:
+	DECLARE_PTR_TYPEDEFS(InternalSignalCommand);
+
+	String GetDescription() const override;
+	String GetShortDescription() const override;
+	ImpersonationLevel GetImpersonationLevel() const override;
+	bool IsHidden() const override;
+	void InitParameters(boost::program_options::options_description& visibleDesc,
+		boost::program_options::options_description& hiddenDesc) const override;
+	int Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const override;
+
+};
+
+}
+
+#endif /* INTERNALSIGNALCOMMAND_H */

From d4b336ad20e27eae08c7252c80f6052e5acdb261 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 26 Jan 2018 16:27:16 +0100
Subject: [PATCH 37/57] Remove need for RunAsUser/Group

They are now read form the sysconfig file which is owned by root
---
 config.h.cmake              |  2 +-
 etc/icinga2/init.conf.cmake |  2 --
 icinga-app/icinga.cpp       | 14 ++++++++++++--
 lib/base/application.cpp    | 21 +++++++++++++++++++++
 lib/base/application.hpp    |  3 +++
 lib/base/utility.cpp        | 32 ++++++++++++++++++++++++++++++++
 lib/base/utility.hpp        |  2 ++
 7 files changed, 71 insertions(+), 5 deletions(-)

diff --git a/config.h.cmake b/config.h.cmake
index 1903b287c..7529f05ab 100644
--- a/config.h.cmake
+++ b/config.h.cmake
@@ -20,7 +20,7 @@
 #define ICINGA_INCLUDECONFDIR "${CMAKE_INSTALL_FULL_DATADIR}/icinga2/include"
 #define ICINGA_USER "${ICINGA2_USER}"
 #define ICINGA_GROUP "${ICINGA2_GROUP}"
-
+#define ICINGA_SYSCONFIGFILE "${ICINGA2_SYSCONFIGFILE}"
 #define ICINGA_BUILD_HOST_NAME "${ICINGA2_BUILD_HOST_NAME}"
 #define ICINGA_BUILD_COMPILER_NAME "${ICINGA2_BUILD_COMPILER_NAME}"
 #define ICINGA_BUILD_COMPILER_VERSION "${ICINGA2_BUILD_COMPILER_VERSION}"
diff --git a/etc/icinga2/init.conf.cmake b/etc/icinga2/init.conf.cmake
index 9f57bca82..22406a998 100644
--- a/etc/icinga2/init.conf.cmake
+++ b/etc/icinga2/init.conf.cmake
@@ -3,5 +3,3 @@
  * configuration file (icinga2.conf) is processed.
  */
 
-const RunAsUser = "@ICINGA2_USER@"
-const RunAsGroup = "@ICINGA2_GROUP@"
diff --git a/icinga-app/icinga.cpp b/icinga-app/icinga.cpp
index f5665c983..368906876 100644
--- a/icinga-app/icinga.cpp
+++ b/icinga-app/icinga.cpp
@@ -142,6 +142,7 @@ int Main(void)
 
 #endif /* _WIN32 */
 		Application::DeclarePrefixDir(ICINGA_PREFIX);
+		Application::DeclareSysconfigFile(ICINGA_SYSCONFIGFILE);
 		Application::DeclareSysconfDir(ICINGA_SYSCONFDIR);
 		Application::DeclareRunDir(ICINGA_RUNDIR);
 		Application::DeclareLocalStateDir(ICINGA_LOCALSTATEDIR);
@@ -152,8 +153,17 @@ int Main(void)
 #endif /* _WIN32 */
 
 	Application::DeclareZonesDir(Application::GetSysconfDir() + "/icinga2/zones.d");
-	Application::DeclareRunAsUser(ICINGA_USER);
-	Application::DeclareRunAsGroup(ICINGA_GROUP);
+
+	String icinga_user = Utility::GetFromSysconfig("ICINGA2_USER");
+	if (icinga_user.IsEmpty())
+		icinga_user = ICINGA_USER;
+
+	String icinga_group = Utility::GetFromSysconfig("ICINGA2_GROUP");
+	if (icinga_group.IsEmpty())
+		icinga_group = ICINGA_GROUP;
+
+	Application::DeclareRunAsUser(icinga_user);
+	Application::DeclareRunAsGroup(icinga_group);
 #ifdef __linux__
 	Application::DeclareRLimitFiles(Application::GetDefaultRLimitFiles());
 	Application::DeclareRLimitProcesses(Application::GetDefaultRLimitProcesses());
diff --git a/lib/base/application.cpp b/lib/base/application.cpp
index ce4982e2a..70b2c40e9 100644
--- a/lib/base/application.cpp
+++ b/lib/base/application.cpp
@@ -1286,6 +1286,27 @@ void Application::DeclareStatePath(const String& path)
 		ScriptGlobal::Set("StatePath", path);
 }
 
+/**
+ * Retrives the path of the sysconfig file.
+ *
+ * @returns The path.
+ */
+String Application::GetSysconfigFile(void)
+{
+	return ScriptGlobal::Get("SysconfigFile");
+}
+
+/**
+ * Sets the path of the sysconfig file.
+ *
+ * @param path The new path.
+ */
+void Application::DeclareSysconfigFile(const String& path)
+{
+	if (!ScriptGlobal::Exists("SysconfigFile"))
+		ScriptGlobal::Set("SysconfigFile", path);
+}
+
 /**
  * Retrieves the path for the modified attributes file.
  *
diff --git a/lib/base/application.hpp b/lib/base/application.hpp
index bd04bbd02..05b2e5d91 100644
--- a/lib/base/application.hpp
+++ b/lib/base/application.hpp
@@ -105,6 +105,9 @@ public:
 	static String GetIncludeConfDir(void);
 	static void DeclareIncludeConfDir(const String& path);
 
+	static String GetSysconfigFile(void);
+	static void DeclareSysconfigFile(const String& path);
+
 	static String GetStatePath(void);
 	static void DeclareStatePath(const String& path);
 
diff --git a/lib/base/utility.cpp b/lib/base/utility.cpp
index 836393b03..9aaddb8ba 100644
--- a/lib/base/utility.cpp
+++ b/lib/base/utility.cpp
@@ -1950,3 +1950,35 @@ String Utility::GetIcingaDataPath(void)
 }
 
 #endif /* _WIN32 */
+
+String Utility::GetFromSysconfig(const String& env)
+{
+#ifndef _WIN32
+	String sysconf = Application::GetSysconfigFile();
+	if (sysconf.IsEmpty())
+		return "";
+
+	String cmdInner = ". " + EscapeShellArg(sysconf) + " 2>&1 >/dev/null;echo \"$" + env + "\"";
+	String cmd = "sh -c " + EscapeShellArg(cmdInner);
+
+	FILE *fp = popen(cmd.CStr(), "r");
+
+	if (!fp)
+		return "";
+
+	char line[1024];
+	String out;
+
+	if (fgets(line, sizeof(line), fp))
+		out = line;
+	else
+		return "";
+
+	pclose(fp);
+
+	return out.Trim();
+#else
+	//TODO: Figure out how to do this on windows
+	return "";
+#endif /* _WIN32 */
+}
diff --git a/lib/base/utility.hpp b/lib/base/utility.hpp
index 3e19301f0..08c1f1999 100644
--- a/lib/base/utility.hpp
+++ b/lib/base/utility.hpp
@@ -148,6 +148,8 @@ public:
 	static String GetIcingaDataPath(void);
 #endif /* _WIN32 */
 
+	static String GetFromSysconfig(const String& env);
+
 #ifdef I2_DEBUG
 	static void SetTime(double);
 	static void IncrementTime(double);

From 3970662bf4fb76dab0c194b029aeb88f81854fe0 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Mon, 29 Jan 2018 14:23:53 +0100
Subject: [PATCH 38/57] Remove need for init.conf

---
 doc/17-language-reference.md |  4 +--
 etc/CMakeLists.txt           |  4 ---
 etc/icinga2/init.conf.cmake  |  5 ---
 icinga-app/icinga.cpp        | 67 ++++++++++++++++++++++++++++--------
 4 files changed, 55 insertions(+), 25 deletions(-)
 delete mode 100644 etc/icinga2/init.conf.cmake

diff --git a/doc/17-language-reference.md b/doc/17-language-reference.md
index 794f42839..4afdb522e 100644
--- a/doc/17-language-reference.md
+++ b/doc/17-language-reference.md
@@ -389,8 +389,8 @@ ObjectsPath         |**Read-write.** Contains the path of the Icinga 2 objects f
 PidPath             |**Read-write.** Contains the path of the Icinga 2 PID file. Defaults to RunDir + "/icinga2/icinga2.pid".
 Vars                |**Read-write.** Contains a dictionary with global custom attributes. Not set by default.
 NodeName            |**Read-write.** Contains the cluster node name. Set to the local hostname by default.
-RunAsUser           |**Read-write.** Defines the user the Icinga 2 daemon is running as. Used in the `init.conf` configuration file.
-RunAsGroup          |**Read-write.** Defines the group the Icinga 2 daemon is running as. Used in the `init.conf` configuration file.
+RunAsUser           |**Read-write.** Defines the user the Icinga 2 daemon is running as. Set in the Icinga 2 sysconfig.
+RunAsGroup          |**Read-write.** Defines the group the Icinga 2 daemon is running as. Set in the Icinga 2 sysconfig.
 PlatformName        |**Read-only.** The name of the operating system, e.g. "Ubuntu".
 PlatformVersion     |**Read-only.** The version of the operating system, e.g. "14.04.3 LTS".
 PlatformKernel      |**Read-only.** The name of the operating system kernel, e.g. "Linux".
diff --git a/etc/CMakeLists.txt b/etc/CMakeLists.txt
index f6b005d25..83903093c 100644
--- a/etc/CMakeLists.txt
+++ b/etc/CMakeLists.txt
@@ -15,8 +15,6 @@
 # along with this program; if not, write to the Free Software Foundation
 # Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
 
-configure_file(icinga2/init.conf.cmake ${CMAKE_CURRENT_BINARY_DIR}/icinga2/init.conf @ONLY)
-
 if(NOT WIN32)
   configure_file(icinga2/constants.conf.cmake ${CMAKE_CURRENT_BINARY_DIR}/icinga2/constants.conf @ONLY)
 endif()
@@ -25,8 +23,6 @@ if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
   configure_file(logrotate.d/icinga2.cmake ${CMAKE_CURRENT_BINARY_DIR}/logrotate.d/icinga2 @ONLY)
 endif()
 
-install_if_not_exists(${CMAKE_CURRENT_BINARY_DIR}/icinga2/init.conf ${CMAKE_INSTALL_SYSCONFDIR}/icinga2)
-
 if(NOT WIN32)
   install_if_not_exists(${CMAKE_CURRENT_BINARY_DIR}/icinga2/constants.conf ${CMAKE_INSTALL_SYSCONFDIR}/icinga2)
 	install_if_not_exists(icinga2/icinga2.conf ${CMAKE_INSTALL_SYSCONFDIR}/icinga2)
diff --git a/etc/icinga2/init.conf.cmake b/etc/icinga2/init.conf.cmake
deleted file mode 100644
index 22406a998..000000000
--- a/etc/icinga2/init.conf.cmake
+++ /dev/null
@@ -1,5 +0,0 @@
-/**
- * This file is read by Icinga 2 before the main
- * configuration file (icinga2.conf) is processed.
- */
-
diff --git a/icinga-app/icinga.cpp b/icinga-app/icinga.cpp
index 368906876..a8caaabea 100644
--- a/icinga-app/icinga.cpp
+++ b/icinga-app/icinga.cpp
@@ -154,22 +154,61 @@ int Main(void)
 
 	Application::DeclareZonesDir(Application::GetSysconfDir() + "/icinga2/zones.d");
 
-	String icinga_user = Utility::GetFromSysconfig("ICINGA2_USER");
-	if (icinga_user.IsEmpty())
-		icinga_user = ICINGA_USER;
+	String icingaUser = Utility::GetFromSysconfig("ICINGA2_USER");
+	if (icingaUser.IsEmpty())
+		icingaUser = ICINGA_USER;
 
-	String icinga_group = Utility::GetFromSysconfig("ICINGA2_GROUP");
-	if (icinga_group.IsEmpty())
-		icinga_group = ICINGA_GROUP;
+	String icingaGroup = Utility::GetFromSysconfig("ICINGA2_GROUP");
+	if (icingaGroup.IsEmpty())
+		icingaGroup = ICINGA_GROUP;
 
-	Application::DeclareRunAsUser(icinga_user);
-	Application::DeclareRunAsGroup(icinga_group);
-#ifdef __linux__
-	Application::DeclareRLimitFiles(Application::GetDefaultRLimitFiles());
-	Application::DeclareRLimitProcesses(Application::GetDefaultRLimitProcesses());
-	Application::DeclareRLimitStack(Application::GetDefaultRLimitStack());
-#endif /* __linux__ */
-	Application::DeclareConcurrency(boost::thread::hardware_concurrency());
+	Application::DeclareRunAsUser(icingaUser);
+	Application::DeclareRunAsGroup(icingaGroup);
+
+#ifdef RLIMIT_NOFILE
+	String rLimitFiles = Utility::GetFromSysconfig("ICINGA2_RLIMIT_FILES");
+	if (rLimitFiles.IsEmpty())
+		Application::DeclareRLimitFiles(Application::GetDefaultRLimitFiles());
+	else {
+		try {
+			Application::DeclareRLimitFiles(Convert::ToLong(rLimitFiles));
+		} catch (const std::invalid_argument& ex) {
+			std::cout
+				<< "Error while parsing \"ICINGA2_RLIMIT_FILES\" from sysconfig: " << ex.what() << '\n';
+			return EXIT_FAILURE;
+		}
+	}
+#endif /* RLIMIT_NOFILE */
+
+#ifdef RLIMIT_NPROC
+	String rLimitProcesses = Utility::GetFromSysconfig("ICINGA2_RLIMIT_PROCESSES");
+	if (rLimitProcesses.IsEmpty())
+		Application::DeclareRLimitProcesses(Application::GetDefaultRLimitProcesses());
+	else {
+		try {
+			Application::DeclareRLimitProcesses(Convert::ToLong(rLimitProcesses));
+		} catch (const std::invalid_argument& ex) {
+			std::cout
+				<< "Error while parsing \"ICINGA2_RLIMIT_PROCESSES\" from sysconfig: " << ex.what() << '\n';
+			return EXIT_FAILURE;
+		}
+	}
+#endif /* RLIMIT_NPROC */
+
+#ifdef RLIMIT_STACK
+	String rLimitStack = Utility::GetFromSysconfig("ICINGA2_RLIMIT_STACK");
+	if (rLimitStack.IsEmpty())
+		Application::DeclareRLimitStack(Application::GetDefaultRLimitStack());
+	else {
+		try {
+			Application::DeclareRLimitStack(Convert::ToLong(rLimitStack));
+		} catch (const std::invalid_argument& ex) {
+			std::cout
+				<< "Error while parsing \"ICINGA2_RLIMIT_STACK\" from sysconfig: " << ex.what() << '\n';
+			return EXIT_FAILURE;
+		}
+	}
+#endif /* RLIMIT_STACK */
 
 	ScriptGlobal::Set("AttachDebugger", false);
 

From 360d1092110a177407c42de164976d463a5ec3f8 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 23 Feb 2018 13:25:59 +0100
Subject: [PATCH 39/57] Fix typo in prepare-dirs

refs #5850
---
 etc/initsystem/prepare-dirs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/initsystem/prepare-dirs b/etc/initsystem/prepare-dirs
index 44b8343a8..74bb85a5b 100644
--- a/etc/initsystem/prepare-dirs
+++ b/etc/initsystem/prepare-dirs
@@ -37,7 +37,7 @@ fi
 
 # Could be undefined in installations where sysconf is not overridden on upgrade
 if [ -z "$ICINGA2_LOG_DIR" ]; then
-	$ICINGA2_LOG_DIR=$(dirname -- "$ICINGA2_LOG")
+	ICINGA2_LOG_DIR=$(dirname -- "$ICINGA2_LOG")
 fi
 
 test -e "$ICINGA2_LOG_DIR" || install -m 750 -o $ICINGA2_USER -g $ICINGA2_COMMAND_GROUP -d "$ICINGA2_LOG_DIR"

From 952e3616e5ed9110e98f62e18ffc4cb2d02182b8 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 23 Feb 2018 14:29:18 +0100
Subject: [PATCH 40/57] Fix incorrect size of request limits

refs #6103
---
 lib/remote/httpserverconnection.cpp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 8a14b00e1..d5837a856 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -189,14 +189,14 @@ bool HttpServerConnection::ProcessMessage(void)
 
 bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 {
-	static const size_t defaultContentLengthLimit = 1 * 1028 * 1028;
+	static const size_t defaultContentLengthLimit = 1 * 1024 * 1024;
 	static const Dictionary::Ptr specialContentLengthLimits = new Dictionary;
-    specialContentLengthLimits->Set("*", 512 * 1028 * 1028);
-	specialContentLengthLimits->Set("config/modify", 512 * 1028 * 1028);
-	specialContentLengthLimits->Set("console", 512 * 1028 * 1028);
-	specialContentLengthLimits->Set("objects/create", 512 * 1028 * 1028);
-	specialContentLengthLimits->Set("objects/modify", 512 * 1028 * 1028);
-	specialContentLengthLimits->Set("objects/delete", 512 * 1028 * 1028);
+    specialContentLengthLimits->Set("*", 512 * 1024 * 1024);
+	specialContentLengthLimits->Set("config/modify", 512 * 1024 * 1024);
+	specialContentLengthLimits->Set("console", 512 * 1024 * 1024);
+	specialContentLengthLimits->Set("objects/create", 512 * 1024 * 1024);
+	specialContentLengthLimits->Set("objects/modify", 512 * 1024 * 1024);
+	specialContentLengthLimits->Set("objects/delete", 512 * 1024 * 1024);
 
 	if (m_CurrentRequest.Headers->Get("expect") == "100-continue") {
 		String continueResponse = "HTTP/1.1 100 Continue\r\n\r\n";

From 6400a300cd900aa4b8d7f6427f0ba55903803506 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 28 Feb 2018 10:50:33 +0100
Subject: [PATCH 41/57] Fix incorrect return value

---
 lib/remote/httprequest.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp
index 9e8f36c27..1f085c220 100644
--- a/lib/remote/httprequest.cpp
+++ b/lib/remote/httprequest.cpp
@@ -119,7 +119,7 @@ bool HttpRequest::ParseBody(StreamReadContext& src, bool may_wait)
 	/* we're done if the request doesn't contain a message body */
 	if (!Headers->Contains("content-length") && !Headers->Contains("transfer-encoding")) {
 		CompleteBody = true;
-		return false;
+		return true;
 	} else if (!m_Body)
 		m_Body = new FIFO();
 

From 6e7421eab079a13d7732037240dfae58003b4523 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 28 Feb 2018 11:07:19 +0100
Subject: [PATCH 42/57] Fix null ptr dereference in
 HttpServerConnection::ProcessMessageAsync

---
 lib/remote/httpresponse.cpp         | 17 +++++++++++------
 lib/remote/httpresponse.hpp         |  4 +++-
 lib/remote/httpserverconnection.cpp |  2 ++
 3 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/lib/remote/httpresponse.cpp b/lib/remote/httpresponse.cpp
index fd7578ed0..09076ed8c 100644
--- a/lib/remote/httpresponse.cpp
+++ b/lib/remote/httpresponse.cpp
@@ -29,7 +29,7 @@
 using namespace icinga;
 
 HttpResponse::HttpResponse(const Stream::Ptr& stream, const HttpRequest& request)
-    : Complete(false), m_State(HttpResponseStart), m_Request(request), m_Stream(stream)
+    : Complete(false), m_State(HttpResponseStart), m_Request(&request), m_Stream(stream)
 { }
 
 void HttpResponse::SetStatus(int code, const String& message)
@@ -44,7 +44,7 @@ void HttpResponse::SetStatus(int code, const String& message)
 
 	String status = "HTTP/";
 
-	if (m_Request.ProtocolVersion == HttpVersion10)
+	if (m_Request->ProtocolVersion == HttpVersion10)
 		status += "1.0";
 	else
 		status += "1.1";
@@ -64,7 +64,7 @@ void HttpResponse::AddHeader(const String& key, const String& value)
 void HttpResponse::FinishHeaders(void)
 {
 	if (m_State == HttpResponseHeaders) {
-		if (m_Request.ProtocolVersion == HttpVersion11)
+		if (m_Request->ProtocolVersion == HttpVersion11)
 			AddHeader("Transfer-Encoding", "chunked");
 
 		AddHeader("Server", "Icinga/" + Application::GetAppVersion());
@@ -81,7 +81,7 @@ void HttpResponse::WriteBody(const char *data, size_t count)
 {
 	ASSERT(m_State == HttpResponseHeaders || m_State == HttpResponseBody);
 
-	if (m_Request.ProtocolVersion == HttpVersion10) {
+	if (m_Request->ProtocolVersion == HttpVersion10) {
 		if (!m_Body)
 			m_Body = new FIFO();
 
@@ -97,7 +97,7 @@ void HttpResponse::Finish(void)
 {
 	ASSERT(m_State != HttpResponseEnd);
 
-	if (m_Request.ProtocolVersion == HttpVersion10) {
+	if (m_Request->ProtocolVersion == HttpVersion10) {
 		if (m_Body)
 			AddHeader("Content-Length", Convert::ToString(m_Body->GetAvailableBytes()));
 
@@ -115,7 +115,7 @@ void HttpResponse::Finish(void)
 
 	m_State = HttpResponseEnd;
 
-	if (m_Request.ProtocolVersion == HttpVersion10 || m_Request.Headers->Get("connection") == "close")
+	if (m_Request->ProtocolVersion == HttpVersion10 || m_Request->Headers->Get("connection") == "close")
 		m_Stream->Shutdown();
 }
 
@@ -267,3 +267,8 @@ bool HttpResponse::IsPeerConnected(void) const
 {
 	return !m_Stream->IsEof();
 }
+
+void HttpResponse::RebindRequest(const HttpRequest& request)
+{
+	m_Request = &request;
+}
diff --git a/lib/remote/httpresponse.hpp b/lib/remote/httpresponse.hpp
index da6afd66b..6137a65f5 100644
--- a/lib/remote/httpresponse.hpp
+++ b/lib/remote/httpresponse.hpp
@@ -65,10 +65,12 @@ public:
 
 	bool IsPeerConnected(void) const;
 
+	void RebindRequest(const HttpRequest& request);
+
 private:
 	HttpResponseState m_State;
 	boost::shared_ptr<ChunkReadContext> m_ChunkContext;
-	const HttpRequest& m_Request;
+	const HttpRequest *m_Request;
 	Stream::Ptr m_Stream;
 	FIFO::Ptr m_Body;
 	std::vector<String> m_Headers;
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index d5837a856..550778751 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -316,6 +316,8 @@ bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 
 void HttpServerConnection::ProcessMessageAsync(HttpRequest& request, HttpResponse& response, const ApiUser::Ptr& user)
 {
+	response.RebindRequest(request);
+
 	try {
 		HttpHandler::ProcessRequest(user, request, response);
 	} catch (const std::exception& ex) {

From 419103b407795525c2f37669cc68fd18559e33ed Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Tue, 27 Feb 2018 14:48:37 +0100
Subject: [PATCH 43/57] Add cork

---
 lib/base/stream.cpp | 12 +++++++++++-
 lib/base/stream.hpp |  5 +++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/base/stream.cpp b/lib/base/stream.cpp
index 4e0ad72dc..4a0ebd377 100644
--- a/lib/base/stream.cpp
+++ b/lib/base/stream.cpp
@@ -60,7 +60,7 @@ void Stream::SignalDataAvailable(void)
 	}
 }
 
-bool Stream::WaitForData()
+bool Stream::WaitForData(void)
 {
 	if (!SupportsWaiting())
 		BOOST_THROW_EXCEPTION(std::runtime_error("Stream does not support waiting."));
@@ -94,6 +94,16 @@ bool Stream::WaitForData(int timeout)
 static void StreamDummyCallback(void)
 { }
 
+void Stream::SetCorked(bool corked)
+{
+	m_Corked = corked;
+}
+
+bool Stream::IsCorked(void) const
+{
+	return m_Corked;
+}
+
 void Stream::Close(void)
 {
 	OnDataAvailable.disconnect_all_slots();
diff --git a/lib/base/stream.hpp b/lib/base/stream.hpp
index 63ac31599..79c8aa0c8 100644
--- a/lib/base/stream.hpp
+++ b/lib/base/stream.hpp
@@ -131,6 +131,9 @@ public:
 
 	virtual bool SupportsWaiting(void) const;
 
+	virtual void SetCorked(bool corked);
+	bool IsCorked(void) const;
+
 	virtual bool IsDataAvailable(void) const;
 
 	void RegisterDataHandler(const boost::function<void(const Stream::Ptr&)>& handler);
@@ -145,6 +148,8 @@ private:
 
 	boost::mutex m_Mutex;
 	boost::condition_variable m_CV;
+
+	bool m_Corked{false};
 };
 
 }

From 8b334fe25917c31aa8a60c9e45fbc0990c3eebef Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Tue, 27 Feb 2018 14:49:15 +0100
Subject: [PATCH 44/57] Use cork in tlsstream and HTTP connection

---
 lib/base/tlsstream.cpp              | 21 +++++++++++++++++++--
 lib/base/tlsstream.hpp              |  2 ++
 lib/remote/httpserverconnection.cpp |  4 +++-
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/lib/base/tlsstream.cpp b/lib/base/tlsstream.cpp
index 1fda60382..403daf336 100644
--- a/lib/base/tlsstream.cpp
+++ b/lib/base/tlsstream.cpp
@@ -152,12 +152,17 @@ void TlsStream::OnEvent(int revents)
 	char buffer[64 * 1024];
 
 	if (m_CurrentAction == TlsActionNone) {
-		if (revents & (POLLIN | POLLERR | POLLHUP))
+		bool corked = IsCorked();
+		if (!corked && (revents & (POLLIN | POLLERR | POLLHUP)))
 			m_CurrentAction = TlsActionRead;
 		else if (m_SendQ->GetAvailableBytes() > 0 && (revents & POLLOUT))
 			m_CurrentAction = TlsActionWrite;
 		else {
-			ChangeEvents(POLLIN);
+			if (corked)
+				ChangeEvents(0);
+			else
+				ChangeEvents(POLLIN);
+
 			return;
 		}
 	}
@@ -404,3 +409,15 @@ Socket::Ptr TlsStream::GetSocket(void) const
 {
 	return m_Socket;
 }
+
+void TlsStream::SetCorked(bool corked)
+{
+	Stream::SetCorked(corked);
+
+	boost::mutex::scoped_lock lock(m_Mutex);
+
+	if (corked)
+		m_CurrentAction = TlsActionNone;
+	else
+		ChangeEvents(POLLIN | POLLOUT);
+}
diff --git a/lib/base/tlsstream.hpp b/lib/base/tlsstream.hpp
index 6f7f71738..5c475500f 100644
--- a/lib/base/tlsstream.hpp
+++ b/lib/base/tlsstream.hpp
@@ -73,6 +73,8 @@ public:
 	bool IsVerifyOK(void) const;
 	String GetVerifyError(void) const;
 
+	virtual void SetCorked(bool corked) override;
+
 private:
 	boost::shared_ptr<SSL> m_SSL;
 	bool m_Eof;
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index 550778751..e087437e6 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -97,7 +97,6 @@ void HttpServerConnection::Disconnect(void)
 
 bool HttpServerConnection::ProcessMessage(void)
 {
-
 	bool res;
 	HttpResponse response(m_Stream, m_CurrentRequest);
 
@@ -175,6 +174,8 @@ bool HttpServerConnection::ProcessMessage(void)
 		return res;
 	}
 
+	m_Stream->SetCorked(true);
+
 	m_RequestQueue.Enqueue(std::bind(&HttpServerConnection::ProcessMessageAsync,
 		HttpServerConnection::Ptr(this), m_CurrentRequest, response, m_AuthenticatedUser));
 
@@ -328,6 +329,7 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request, HttpRespons
 
 	response.Finish();
 	m_PendingRequests--;
+	m_Stream->SetCorked(false);
 }
 
 void HttpServerConnection::DataAvailableHandler(void)

From 85858e6a36246dc5ac4e129d0f48f09b88b6558e Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 28 Feb 2018 11:42:05 +0100
Subject: [PATCH 45/57] Add SetCorked() calls to the JsonRpcConnection class

---
 lib/remote/jsonrpcconnection.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/remote/jsonrpcconnection.cpp b/lib/remote/jsonrpcconnection.cpp
index 0be3fb46e..161a9d015 100644
--- a/lib/remote/jsonrpcconnection.cpp
+++ b/lib/remote/jsonrpcconnection.cpp
@@ -144,6 +144,8 @@ void JsonRpcConnection::MessageHandlerWrapper(const String& jsonString)
 
 	try {
 		MessageHandler(jsonString);
+
+		m_Stream->SetCorked(false);
 	} catch (const std::exception& ex) {
 		Log(LogWarning, "JsonRpcConnection")
 		    << "Error while reading JSON-RPC message for identity '" << m_Identity
@@ -242,6 +244,8 @@ bool JsonRpcConnection::ProcessMessage(void)
 	if (srs != StatusNewItem)
 		return false;
 
+	m_Stream->SetCorked(true);
+
 	l_JsonRpcConnectionWorkQueues[m_ID % l_JsonRpcConnectionWorkQueueCount].Enqueue(boost::bind(&JsonRpcConnection::MessageHandlerWrapper, JsonRpcConnection::Ptr(this), message));
 
 	return true;

From 622127276b62846b699a5113aff387d1993455f4 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 28 Feb 2018 12:06:01 +0100
Subject: [PATCH 46/57] Fix incorrect HTTP content length limits

---
 doc/12-icinga2-api.md               |  8 +++---
 lib/remote/httpserverconnection.cpp | 39 ++++++++++++++++++-----------
 2 files changed, 28 insertions(+), 19 deletions(-)

diff --git a/doc/12-icinga2-api.md b/doc/12-icinga2-api.md
index 8351c90e0..01d0e2d28 100644
--- a/doc/12-icinga2-api.md
+++ b/doc/12-icinga2-api.md
@@ -230,12 +230,12 @@ Available permissions for specific URL endpoints:
   actions/&lt;action&gt;        | /v1/actions   | Yes               | 1
   config/query                  | /v1/config    | No                | 1
   config/modify                 | /v1/config    | No                | 512
-  console                       | /v1/console   | No                | 512
+  console                       | /v1/console   | No                | 1
   events/&lt;type&gt;           | /v1/events    | No                | 1
   objects/query/&lt;type&gt;    | /v1/objects   | Yes               | 1
-  objects/create/&lt;type&gt;   | /v1/objects   | No                | 512
-  objects/modify/&lt;type&gt;   | /v1/objects   | Yes               | 512
-  objects/delete/&lt;type&gt;   | /v1/objects   | Yes               | 512
+  objects/create/&lt;type&gt;   | /v1/objects   | No                | 1
+  objects/modify/&lt;type&gt;   | /v1/objects   | Yes               | 1
+  objects/delete/&lt;type&gt;   | /v1/objects   | Yes               | 1
   status/query                  | /v1/status    | Yes               | 1
   templates/&lt;type&gt;        | /v1/templates | Yes               | 1
   types                         | /v1/types     | Yes               | 1
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index e087437e6..fdb87097d 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -190,15 +190,6 @@ bool HttpServerConnection::ProcessMessage(void)
 
 bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 {
-	static const size_t defaultContentLengthLimit = 1 * 1024 * 1024;
-	static const Dictionary::Ptr specialContentLengthLimits = new Dictionary;
-    specialContentLengthLimits->Set("*", 512 * 1024 * 1024);
-	specialContentLengthLimits->Set("config/modify", 512 * 1024 * 1024);
-	specialContentLengthLimits->Set("console", 512 * 1024 * 1024);
-	specialContentLengthLimits->Set("objects/create", 512 * 1024 * 1024);
-	specialContentLengthLimits->Set("objects/modify", 512 * 1024 * 1024);
-	specialContentLengthLimits->Set("objects/delete", 512 * 1024 * 1024);
-
 	if (m_CurrentRequest.Headers->Get("expect") == "100-continue") {
 		String continueResponse = "HTTP/1.1 100 Continue\r\n\r\n";
 		m_Stream->Write(continueResponse.CStr(), continueResponse.GetLength());
@@ -289,16 +280,34 @@ bool HttpServerConnection::ManageHeaders(HttpResponse& response)
 		return false;
 	}
 
+	static const size_t defaultContentLengthLimit = 1 * 1024 * 1024;
 	size_t maxSize = defaultContentLengthLimit;
 
 	Array::Ptr permissions = m_AuthenticatedUser->GetPermissions();
-	ObjectLock olock(permissions);
 
-	for (const Value& permission : permissions) {
-		std::vector<String> permissionParts = String(permission).Split("/");
-		String permissionPath = permissionParts[0] + (permissionParts.size() > 1 ? "/" + permissionParts[1] : "");
-		int size = specialContentLengthLimits->Get(permissionPath);
-		maxSize = size > maxSize ? size : maxSize;
+	if (permissions) {
+		ObjectLock olock(permissions);
+
+		for (const Value& permissionInfo : permissions) {
+			String permission;
+
+			if (permissionInfo.IsObjectType<Dictionary>())
+				permission = static_cast<Dictionary::Ptr>(permissionInfo)->Get("permission");
+			else
+				permission = permissionInfo;
+
+			static std::vector<std::pair<String, size_t>> specialContentLengthLimits {
+				  { "config/modify", 512 * 1024 * 1024 }
+			};
+
+			for (const auto& limitInfo : specialContentLengthLimits) {
+				if (limitInfo.second <= maxSize)
+					continue;
+
+				if (Utility::Match(permission, limitInfo.first))
+					maxSize = limitInfo.second;
+			}
+		}
 	}
 
 	size_t contentLength = m_CurrentRequest.Headers->Get("content-length");

From fdf2dc43d55d1ed4287dd06b4381e954b1dff558 Mon Sep 17 00:00:00 2001
From: Noah Hilverling <noah.hilverling@icinga.com>
Date: Thu, 1 Mar 2018 09:47:29 +0100
Subject: [PATCH 47/57] Limit JSON-RPC message size

---
 lib/base/netstring.cpp           | 10 +++++++++-
 lib/base/netstring.hpp           |  5 +++--
 lib/remote/jsonrpc.cpp           |  4 ++--
 lib/remote/jsonrpc.hpp           |  4 ++--
 lib/remote/jsonrpcconnection.cpp |  7 ++++++-
 5 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/lib/base/netstring.cpp b/lib/base/netstring.cpp
index 934097e2b..e77a41285 100644
--- a/lib/base/netstring.cpp
+++ b/lib/base/netstring.cpp
@@ -32,7 +32,8 @@ using namespace icinga;
  * @exception invalid_argument The input stream is invalid.
  * @see https://github.com/PeterScott/netstring-c/blob/master/netstring.c
  */
-StreamReadStatus NetString::ReadStringFromStream(const Stream::Ptr& stream, String *str, StreamReadContext& context, bool may_wait)
+StreamReadStatus NetString::ReadStringFromStream(const Stream::Ptr& stream, String *str, StreamReadContext& context,
+	bool may_wait, ssize_t maxMessageLength)
 {
 	if (context.Eof)
 		return StatusEof;
@@ -84,6 +85,13 @@ StreamReadStatus NetString::ReadStringFromStream(const Stream::Ptr& stream, Stri
 	/* read the whole message */
 	size_t data_length = len + 1;
 
+	if (maxMessageLength >= 0 && data_length > maxMessageLength) {
+		std::stringstream errorMessage;
+		errorMessage << "Max data length exceeded: " << (maxMessageLength / 1024 / 1024) << " MB";
+
+		BOOST_THROW_EXCEPTION(std::invalid_argument(errorMessage.str()));
+	}
+
 	char *data = context.Buffer + header_length + 1;
 
 	if (context.Size < header_length + 1 + data_length) {
diff --git a/lib/base/netstring.hpp b/lib/base/netstring.hpp
index c24cba028..045ef5b0b 100644
--- a/lib/base/netstring.hpp
+++ b/lib/base/netstring.hpp
@@ -38,8 +38,9 @@ class String;
 class I2_BASE_API NetString
 {
 public:
-	static StreamReadStatus ReadStringFromStream(const Stream::Ptr& stream, String *message, StreamReadContext& context, bool may_wait = false);
-	static void WriteStringToStream(const Stream::Ptr& stream, const String& message);
+	static StreamReadStatus ReadStringFromStream(const Stream::Ptr& stream, String *message, StreamReadContext& context,
+		bool may_wait = false, ssize_t maxMessageLength = -1);
+	static size_t WriteStringToStream(const Stream::Ptr& stream, const String& message);
 	static void WriteStringToStream(std::ostream& stream, const String& message);
 
 private:
diff --git a/lib/remote/jsonrpc.cpp b/lib/remote/jsonrpc.cpp
index 1d3efd5ca..f0cca71f6 100644
--- a/lib/remote/jsonrpc.cpp
+++ b/lib/remote/jsonrpc.cpp
@@ -70,10 +70,10 @@ void JsonRpc::SendMessage(const Stream::Ptr& stream, const Dictionary::Ptr& mess
 	NetString::WriteStringToStream(stream, json);
 }
 
-StreamReadStatus JsonRpc::ReadMessage(const Stream::Ptr& stream, String *message, StreamReadContext& src, bool may_wait)
+StreamReadStatus JsonRpc::ReadMessage(const Stream::Ptr& stream, String *message, StreamReadContext& src, bool may_wait, ssize_t maxMessageLength)
 {
 	String jsonString;
-	StreamReadStatus srs = NetString::ReadStringFromStream(stream, &jsonString, src, may_wait);
+	StreamReadStatus srs = NetString::ReadStringFromStream(stream, &jsonString, src, may_wait, maxMessageLength);
 
 	if (srs != StatusNewItem)
 		return srs;
diff --git a/lib/remote/jsonrpc.hpp b/lib/remote/jsonrpc.hpp
index 3589b365a..6ab83e35f 100644
--- a/lib/remote/jsonrpc.hpp
+++ b/lib/remote/jsonrpc.hpp
@@ -35,8 +35,8 @@ namespace icinga
 class I2_REMOTE_API JsonRpc
 {
 public:
-	static void SendMessage(const Stream::Ptr& stream, const Dictionary::Ptr& message);
-	static StreamReadStatus ReadMessage(const Stream::Ptr& stream, String *message, StreamReadContext& src, bool may_wait = false);
+	static size_t SendMessage(const Stream::Ptr& stream, const Dictionary::Ptr& message);
+	static StreamReadStatus ReadMessage(const Stream::Ptr& stream, String *message, StreamReadContext& src, bool may_wait = false, ssize_t maxMessageLength = -1);
 	static Dictionary::Ptr DecodeMessage(const String& message);
 
 private:
diff --git a/lib/remote/jsonrpcconnection.cpp b/lib/remote/jsonrpcconnection.cpp
index 161a9d015..ac23a1060 100644
--- a/lib/remote/jsonrpcconnection.cpp
+++ b/lib/remote/jsonrpcconnection.cpp
@@ -237,9 +237,14 @@ void JsonRpcConnection::MessageHandler(const String& jsonString)
 
 bool JsonRpcConnection::ProcessMessage(void)
 {
+	ssize_t maxMessageLength = 64 * 1024;
+
+	if (m_Endpoint)
+		maxMessageLength = -1; /* no limit */
+
 	String message;
 
-	StreamReadStatus srs = JsonRpc::ReadMessage(m_Stream, &message, m_Context, false);
+	StreamReadStatus srs = JsonRpc::ReadMessage(m_Stream, &message, m_Context, false, maxMessageLength);
 
 	if (srs != StatusNewItem)
 		return false;

From fda4faac0622e095970a6be6304e62bb2af0ca2f Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Mon, 5 Mar 2018 13:22:43 +0100
Subject: [PATCH 48/57] Limit anonymous connections to 25

---
 lib/base/netstring.cpp     |  2 +-
 lib/remote/apilistener.cpp | 14 +++++++++++---
 lib/remote/apilistener.hpp |  2 +-
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/lib/base/netstring.cpp b/lib/base/netstring.cpp
index e77a41285..f23853864 100644
--- a/lib/base/netstring.cpp
+++ b/lib/base/netstring.cpp
@@ -87,7 +87,7 @@ StreamReadStatus NetString::ReadStringFromStream(const Stream::Ptr& stream, Stri
 
 	if (maxMessageLength >= 0 && data_length > maxMessageLength) {
 		std::stringstream errorMessage;
-		errorMessage << "Max data length exceeded: " << (maxMessageLength / 1024 / 1024) << " MB";
+		errorMessage << "Max data length exceeded: " << (maxMessageLength / 1024) << " KB";
 
 		BOOST_THROW_EXCEPTION(std::invalid_argument(errorMessage.str()));
 	}
diff --git a/lib/remote/apilistener.cpp b/lib/remote/apilistener.cpp
index 107c142b7..65adce3be 100644
--- a/lib/remote/apilistener.cpp
+++ b/lib/remote/apilistener.cpp
@@ -546,8 +546,12 @@ void ApiListener::NewClientHandlerInternal(const Socket::Ptr& client, const Stri
 			endpoint->AddClient(aclient);
 
 			m_SyncQueue.Enqueue(boost::bind(&ApiListener::SyncClient, this, aclient, endpoint, needSync));
-		} else
-			AddAnonymousClient(aclient);
+		} else {
+			if (!AddAnonymousClient(aclient)) {
+				Log(LogNotice, "ApiListener", "Ignoring anonymous JSON-RPC connection. Max connections exceeded.");
+				aclient->Disconnect();
+			}
+		}
 	} else {
 		Log(LogNotice, "ApiListener", "New HTTP client");
 
@@ -1358,10 +1362,14 @@ double ApiListener::CalculateZoneLag(const Endpoint::Ptr& endpoint)
 	return 0;
 }
 
-void ApiListener::AddAnonymousClient(const JsonRpcConnection::Ptr& aclient)
+bool ApiListener::AddAnonymousClient(const JsonRpcConnection::Ptr& aclient)
 {
 	boost::mutex::scoped_lock lock(m_AnonymousClientsLock);
+	if (m_AnonymousClients.size() > 25)
+		return false;
+
 	m_AnonymousClients.insert(aclient);
+	return true;
 }
 
 void ApiListener::RemoveAnonymousClient(const JsonRpcConnection::Ptr& aclient)
diff --git a/lib/remote/apilistener.hpp b/lib/remote/apilistener.hpp
index 1ce70316c..da492517c 100644
--- a/lib/remote/apilistener.hpp
+++ b/lib/remote/apilistener.hpp
@@ -79,7 +79,7 @@ public:
 	static void StatsFunc(const Dictionary::Ptr& status, const Array::Ptr& perfdata);
 	std::pair<Dictionary::Ptr, Dictionary::Ptr> GetStatus(void);
 
-	void AddAnonymousClient(const JsonRpcConnection::Ptr& aclient);
+	bool AddAnonymousClient(const JsonRpcConnection::Ptr& aclient);
 	void RemoveAnonymousClient(const JsonRpcConnection::Ptr& aclient);
 	std::set<JsonRpcConnection::Ptr> GetAnonymousClients(void) const;
 

From 0b9869917fa92dc2be4a801a8a29da8832ccb061 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Tue, 6 Mar 2018 08:54:47 +0100
Subject: [PATCH 49/57] Fix incorrect argument type for JsonRpc::SendMessage

---
 lib/base/win32.hpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/base/win32.hpp b/lib/base/win32.hpp
index 0965e1bd8..ef90352c1 100644
--- a/lib/base/win32.hpp
+++ b/lib/base/win32.hpp
@@ -40,6 +40,7 @@
 #endif /* __MINGW32__ */
 
 typedef int socklen_t;
+typedef SSIZE_T ssize_t;
 
 #define MAXPATHLEN MAX_PATH
 

From 6670024f625b554a1d5a91b2f39af50d46db4348 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Tue, 6 Mar 2018 08:49:43 +0100
Subject: [PATCH 50/57] Ensure that SetCorked() works properly

---
 lib/base/socketevents-poll.cpp      | 10 ++++++++--
 lib/base/tlsstream.cpp              |  8 ++++++--
 lib/remote/httpserverconnection.cpp |  8 +++++---
 lib/remote/jsonrpcconnection.cpp    |  8 ++++----
 4 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/lib/base/socketevents-poll.cpp b/lib/base/socketevents-poll.cpp
index 76c13cfc6..705ebed21 100644
--- a/lib/base/socketevents-poll.cpp
+++ b/lib/base/socketevents-poll.cpp
@@ -57,11 +57,17 @@ void SocketEventEnginePoll::ThreadProc(int tid)
 					if (desc.second.Events == 0)
 						continue;
 
-					if (desc.second.EventInterface)
+					int events = desc.second.Events;
+
+					if (desc.second.EventInterface) {
 						desc.second.EventInterface->m_EnginePrivate = &pfds[i];
 
+						if (!desc.second.EventInterface->m_Events)
+							events = 0;
+					}
+
 					pfds[i].fd = desc.first;
-					pfds[i].events = desc.second.Events;
+					pfds[i].events = events;
 					descriptors[i] = desc.second;
 
 					i++;
diff --git a/lib/base/tlsstream.cpp b/lib/base/tlsstream.cpp
index 403daf336..3d310c0bf 100644
--- a/lib/base/tlsstream.cpp
+++ b/lib/base/tlsstream.cpp
@@ -174,6 +174,8 @@ void TlsStream::OnEvent(int revents)
 	 */
 	ERR_clear_error();
 
+	size_t readTotal = 0;
+
 	switch (m_CurrentAction) {
 		case TlsActionRead:
 			do {
@@ -182,8 +184,10 @@ void TlsStream::OnEvent(int revents)
 				if (rc > 0) {
 					m_RecvQ->Write(buffer, rc);
 					success = true;
+
+					readTotal += rc;
 				}
-			} while (rc > 0);
+			} while (rc > 0 && readTotal < 64 * 1024);
 
 			if (success)
 				m_CV.notify_all();
@@ -265,7 +269,7 @@ void TlsStream::OnEvent(int revents)
 
 		lock.unlock();
 
-		while (m_RecvQ->IsDataAvailable() && IsHandlingEvents())
+		while (!IsCorked() && m_RecvQ->IsDataAvailable() && IsHandlingEvents())
 			SignalDataAvailable();
 	}
 
diff --git a/lib/remote/httpserverconnection.cpp b/lib/remote/httpserverconnection.cpp
index fdb87097d..69d57343d 100644
--- a/lib/remote/httpserverconnection.cpp
+++ b/lib/remote/httpserverconnection.cpp
@@ -174,9 +174,7 @@ bool HttpServerConnection::ProcessMessage(void)
 		return res;
 	}
 
-	m_Stream->SetCorked(true);
-
-	m_RequestQueue.Enqueue(std::bind(&HttpServerConnection::ProcessMessageAsync,
+	m_RequestQueue.Enqueue(boost::bind(&HttpServerConnection::ProcessMessageAsync,
 		HttpServerConnection::Ptr(this), m_CurrentRequest, response, m_AuthenticatedUser));
 
 	m_Seen = Utility::GetTime();
@@ -348,6 +346,8 @@ void HttpServerConnection::DataAvailableHandler(void)
 	if (!m_Stream->IsEof()) {
 		boost::mutex::scoped_lock lock(m_DataHandlerMutex);
 
+		m_Stream->SetCorked(true);
+
 		try {
 			while (ProcessMessage())
 				; /* empty loop body */
@@ -357,6 +357,8 @@ void HttpServerConnection::DataAvailableHandler(void)
 
 			close = true;
 		}
+
+		m_RequestQueue.Enqueue(boost::bind(&Stream::SetCorked, m_Stream, false));
 	} else
 		close = true;
 
diff --git a/lib/remote/jsonrpcconnection.cpp b/lib/remote/jsonrpcconnection.cpp
index ac23a1060..add6e1a70 100644
--- a/lib/remote/jsonrpcconnection.cpp
+++ b/lib/remote/jsonrpcconnection.cpp
@@ -144,8 +144,6 @@ void JsonRpcConnection::MessageHandlerWrapper(const String& jsonString)
 
 	try {
 		MessageHandler(jsonString);
-
-		m_Stream->SetCorked(false);
 	} catch (const std::exception& ex) {
 		Log(LogWarning, "JsonRpcConnection")
 		    << "Error while reading JSON-RPC message for identity '" << m_Identity
@@ -249,8 +247,6 @@ bool JsonRpcConnection::ProcessMessage(void)
 	if (srs != StatusNewItem)
 		return false;
 
-	m_Stream->SetCorked(true);
-
 	l_JsonRpcConnectionWorkQueues[m_ID % l_JsonRpcConnectionWorkQueueCount].Enqueue(boost::bind(&JsonRpcConnection::MessageHandlerWrapper, JsonRpcConnection::Ptr(this), message));
 
 	return true;
@@ -266,6 +262,8 @@ void JsonRpcConnection::DataAvailableHandler(void)
 	if (!m_Stream->IsEof()) {
 		boost::mutex::scoped_lock lock(m_DataHandlerMutex);
 
+		m_Stream->SetCorked(true);
+
 		try {
 			while (ProcessMessage())
 				; /* empty loop body */
@@ -278,6 +276,8 @@ void JsonRpcConnection::DataAvailableHandler(void)
 
 			return;
 		}
+
+		l_JsonRpcConnectionWorkQueues[m_ID % l_JsonRpcConnectionWorkQueueCount].Enqueue(boost::bind(&Stream::SetCorked, m_Stream, false));
 	} else
 		close = true;
 

From 9886f3914c7d08799ec4c16ce973fc30fbcd8978 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Tue, 6 Mar 2018 09:30:22 +0100
Subject: [PATCH 51/57] Fix ApiUser unit test

---
 test/remote-user.cpp | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/test/remote-user.cpp b/test/remote-user.cpp
index 1c327bacb..f43816a19 100644
--- a/test/remote-user.cpp
+++ b/test/remote-user.cpp
@@ -29,14 +29,13 @@ BOOST_AUTO_TEST_SUITE(api_user)
 
 BOOST_AUTO_TEST_CASE(password)
 {
-#ifndef I2_DEBUG
-	std::cout << "Only enabled in Debug builds..." << std::endl;
-#else
 	ApiUser::Ptr user = new ApiUser();
 	String passwd = RandomString(16);
 	String salt = RandomString(8);
-	user->SetPassword("ThisShouldBeIgnored");
-	user->SetPasswordHash(HashPassword(passwd, salt, true));
+	user->SetPasswordHash(CreateHashedPasswordString(passwd, salt));
+	user->OnConfigLoaded();
+	user->OnAllConfigLoaded();
+	user->Start();
 
 	BOOST_CHECK(user->GetPasswordHash() != passwd);
 
@@ -46,7 +45,6 @@ BOOST_AUTO_TEST_CASE(password)
 	BOOST_CHECK(passwdd->Get("salt") == salt);
 	BOOST_CHECK(ComparePassword(passwdd->Get("password"), passwd, salt));
 	BOOST_CHECK(!ComparePassword(passwdd->Get("password"), "wrong password uwu!", salt));
-#endif
 }
 
 BOOST_AUTO_TEST_SUITE_END()

From f357439485e4f2d57dda055b99a3496f6fd6a160 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Fri, 16 Feb 2018 10:31:00 +0100
Subject: [PATCH 52/57] Code style

---
 lib/base/tlsutility.cpp    | 24 +++++++++++++++---------
 lib/base/tlsutility.hpp    |  4 ++--
 lib/cli/apiusercommand.cpp | 12 ++++++++----
 lib/remote/apiuser.cpp     |  8 ++++++--
 4 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/lib/base/tlsutility.cpp b/lib/base/tlsutility.cpp
index 04d8ea49f..c28f8e44f 100644
--- a/lib/base/tlsutility.cpp
+++ b/lib/base/tlsutility.cpp
@@ -761,28 +761,34 @@ bool VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost
 	return rc == 1;
 }
 
-bool ComparePassword(const String hash, const String password, const String salt)
+bool ComparePassword(const String& hash, const String& password, const String& salt)
 {
-	String otherHash = HashPassword(password, salt);
+	String otherHash = PBKDF2_SHA256(password, salt, 1000);
+	VERIFY(otherHash.GetLength() == 64 && hash.GetLength() == 64);
 
 	const char *p1 = otherHash.CStr();
 	const char *p2 = hash.CStr();
 
+	/* By Novelocrat, https://stackoverflow.com/a/25374036 */
 	volatile char c = 0;
 
-	for (size_t i=0; i<64; ++i)
+	for (size_t i = 0; i < 64; ++i)
 		c |= p1[i] ^ p2[i];
 
 	return (c == 0);
 }
 
-String HashPassword(const String& password, const String& salt, const bool shadow)
+/* Returns a String in the format $algorithm$salt$hash or returns an empty string in case of an error */
+String CreateHashedPasswordString(const String& password, const String& salt, int algorithm)
 {
-	if (shadow)
-		//Using /etc/shadow password format. The 5 means SHA256 is being used
-		return String("$5$" + salt + "$" + PBKDF2_SHA256(password, salt, 1000));
-	else
-		return PBKDF2_SHA256(password, salt, 1000);
+	// We currently only support SHA256
+	if (algorithm != 5)
+		return String();
+
+	if (salt.FindFirstOf('$') != String::NPos)
+		return String();
+
+	return String("$5$" + salt + "$" + PBKDF2_SHA256(password, salt, 1000));
 }
 
 }
diff --git a/lib/base/tlsutility.hpp b/lib/base/tlsutility.hpp
index 96bdc63b0..6e5c68d29 100644
--- a/lib/base/tlsutility.hpp
+++ b/lib/base/tlsutility.hpp
@@ -57,8 +57,8 @@ String I2_BASE_API SHA1(const String& s, bool binary = false);
 String I2_BASE_API SHA256(const String& s);
 String I2_BASE_API RandomString(int length);
 bool I2_BASE_API VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate);
-bool I2_BASE_API ComparePassword(const String hash, const String password, const String Salt);
-String I2_BASE_API HashPassword(const String& password, const String& salt, const bool shadow = false);
+bool ComparePassword(const String& hash, const String& password, const String& Salt);
+String CreateHashedPasswordString(const String& password, const String& salt, int algorithm = 5);
 
 class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { };
 
diff --git a/lib/cli/apiusercommand.cpp b/lib/cli/apiusercommand.cpp
index 6eb5c3bf3..188691ae0 100644
--- a/lib/cli/apiusercommand.cpp
+++ b/lib/cli/apiusercommand.cpp
@@ -44,7 +44,7 @@ void ApiUserCommand::InitParameters(boost::program_options::options_description&
 {
 	visibleDesc.add_options()
 		("user", po::value<std::string>(), "API username")
-		("passwd", po::value<std::string>(), "Password in clear text")
+		("password", po::value<std::string>(), "Password in clear text")
 		("salt", po::value<std::string>(), "Optional salt (default: 8 random chars)")
 		("oneline", "Print only the password hash");
 }
@@ -63,8 +63,8 @@ int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const s
 	} else
 		user = vm["user"].as<std::string>();
 
-	if (!vm.count("passwd")) {
-		Log(LogCritical, "cli", "Password (--passwd) must be specified.");
+	if (!vm.count("password")) {
+		Log(LogCritical, "cli", "Password (--password) must be specified.");
 		return 1;
 	}
 
@@ -76,7 +76,11 @@ int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const s
 		return 1;
 	}
 
-	String hashedPassword = HashPassword(passwd, salt, true);
+	String hashedPassword = CreateHashedPasswordString(passwd, salt, 5);
+	if (hashedPassword == String()) {
+		Log(LogCritical, "cli") << "Failed to hash password \"" << passwd << "\" with salt \"" << salt << "\"";
+		return 1;
+	}
 
 	if (vm.count("oneline"))
 		std::cout << '"' << hashedPassword << "\"\n";
diff --git a/lib/remote/apiuser.cpp b/lib/remote/apiuser.cpp
index 606e66dcc..f3e2215ef 100644
--- a/lib/remote/apiuser.cpp
+++ b/lib/remote/apiuser.cpp
@@ -31,8 +31,12 @@ void ApiUser::OnConfigLoaded(void)
 {
 	ObjectImpl<ApiUser>::OnConfigLoaded();
 
-	if (this->GetPasswordHash().IsEmpty())
-		SetPasswordHash(HashPassword(GetPassword(), RandomString(8), true));
+	if (GetPasswordHash().IsEmpty()) {
+		String hashedPassword =	CreateHashedPasswordString(GetPassword(), RandomString(8), 5);
+		VERIFY(hashedPassword != String());
+		SetPasswordHash(hashedPassword);
+		SetPassword("********");
+	}
 }
 
 ApiUser::Ptr ApiUser::GetByClientCN(const String& cn)

From ddab94feb35050d4e50ab13a1958e65dfbc058b6 Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar.beutner@icinga.com>
Date: Wed, 7 Mar 2018 09:56:42 +0100
Subject: [PATCH 53/57] Build fix

---
 lib/base/netstring.hpp  | 2 +-
 lib/base/tlsutility.hpp | 4 ++--
 lib/remote/jsonrpc.hpp  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/base/netstring.hpp b/lib/base/netstring.hpp
index 045ef5b0b..a8aa91c4e 100644
--- a/lib/base/netstring.hpp
+++ b/lib/base/netstring.hpp
@@ -40,7 +40,7 @@ class I2_BASE_API NetString
 public:
 	static StreamReadStatus ReadStringFromStream(const Stream::Ptr& stream, String *message, StreamReadContext& context,
 		bool may_wait = false, ssize_t maxMessageLength = -1);
-	static size_t WriteStringToStream(const Stream::Ptr& stream, const String& message);
+	static void WriteStringToStream(const Stream::Ptr& stream, const String& message);
 	static void WriteStringToStream(std::ostream& stream, const String& message);
 
 private:
diff --git a/lib/base/tlsutility.hpp b/lib/base/tlsutility.hpp
index 6e5c68d29..21cb6ffa0 100644
--- a/lib/base/tlsutility.hpp
+++ b/lib/base/tlsutility.hpp
@@ -57,8 +57,8 @@ String I2_BASE_API SHA1(const String& s, bool binary = false);
 String I2_BASE_API SHA256(const String& s);
 String I2_BASE_API RandomString(int length);
 bool I2_BASE_API VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate);
-bool ComparePassword(const String& hash, const String& password, const String& Salt);
-String CreateHashedPasswordString(const String& password, const String& salt, int algorithm = 5);
+bool I2_BASE_API ComparePassword(const String& hash, const String& password, const String& Salt);
+String I2_BASE_API CreateHashedPasswordString(const String& password, const String& salt, int algorithm = 5);
 
 class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { };
 
diff --git a/lib/remote/jsonrpc.hpp b/lib/remote/jsonrpc.hpp
index 6ab83e35f..6463ca2ea 100644
--- a/lib/remote/jsonrpc.hpp
+++ b/lib/remote/jsonrpc.hpp
@@ -35,7 +35,7 @@ namespace icinga
 class I2_REMOTE_API JsonRpc
 {
 public:
-	static size_t SendMessage(const Stream::Ptr& stream, const Dictionary::Ptr& message);
+	static void SendMessage(const Stream::Ptr& stream, const Dictionary::Ptr& message);
 	static StreamReadStatus ReadMessage(const Stream::Ptr& stream, String *message, StreamReadContext& src, bool may_wait = false, ssize_t maxMessageLength = -1);
 	static Dictionary::Ptr DecodeMessage(const String& message);
 

From 1969a9071a488398a1bb906285e1f94b3c5f54bb Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Wed, 7 Mar 2018 13:27:31 +0100
Subject: [PATCH 54/57] Improve error handling for empty packages in
 /v1/config/packages

- If there is no package main directory, assume "empty packages".
- Catch exceptions thrown through GlobRecursive() and present a better http 500
to the user.

The packages directory tree is automatically created with the first
package creation, either from the user, or by the `_api` package.

fixes #6129
---
 lib/remote/configpackageshandler.cpp | 12 +++++++++---
 lib/remote/configpackageutility.cpp  | 12 ++++++++++--
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/lib/remote/configpackageshandler.cpp b/lib/remote/configpackageshandler.cpp
index 0b41cd65b..48a624cf3 100644
--- a/lib/remote/configpackageshandler.cpp
+++ b/lib/remote/configpackageshandler.cpp
@@ -49,7 +49,14 @@ void ConfigPackagesHandler::HandleGet(const ApiUser::Ptr& user, HttpRequest& req
 {
 	FilterUtility::CheckPermission(user, "config/query");
 
-	std::vector<String> packages = ConfigPackageUtility::GetPackages();
+	std::vector<String> packages;
+
+	try {
+		packages = ConfigPackageUtility::GetPackages();
+	} catch (const std::exception& ex) {
+		HttpUtility::SendJsonError(response, 500, "Could not retrieve packages.");
+		return;
+	}
 
 	Array::Ptr results = new Array();
 
@@ -91,8 +98,7 @@ void ConfigPackagesHandler::HandlePost(const ApiUser::Ptr& user, HttpRequest& re
 		boost::mutex::scoped_lock lock(ConfigPackageUtility::GetStaticMutex());
 		ConfigPackageUtility::CreatePackage(packageName);
 	} catch (const std::exception& ex) {
-		HttpUtility::SendJsonError(response, 500, "Could not create package.",
-			HttpUtility::GetLastParameter(params, "verboseErrors") ? DiagnosticInformation(ex) : "");
+		HttpUtility::SendJsonError(response, 500, "Could not create package.", "");
 	}
 
 	result1->Set("code", 200);
diff --git a/lib/remote/configpackageutility.cpp b/lib/remote/configpackageutility.cpp
index b7f04a18f..8760f9e25 100644
--- a/lib/remote/configpackageutility.cpp
+++ b/lib/remote/configpackageutility.cpp
@@ -58,9 +58,17 @@ void ConfigPackageUtility::DeletePackage(const String& name)
 
 std::vector<String> ConfigPackageUtility::GetPackages(void)
 {
+	String packageDir = GetPackageDir();
+
 	std::vector<String> packages;
-	Utility::Glob(GetPackageDir() + "/*", boost::bind(&ConfigPackageUtility::CollectDirNames,
-	    _1, boost::ref(packages)), GlobDirectory);
+
+	/* Package directory does not exist, no packages have been created thus far. */
+	if (!Utility::PathExists(packageDir))
+		return packages;
+
+	Utility::Glob(packageDir + "/*", boost::bind(&ConfigPackageUtility::CollectDirNames,
+		_1, std::ref(packages)), GlobDirectory);
+
 	return packages;
 }
 

From 4f12142d52db6b69e89f13f8aa498582179e4178 Mon Sep 17 00:00:00 2001
From: Michael Friedrich <michael.friedrich@icinga.com>
Date: Tue, 20 Mar 2018 11:50:52 +0100
Subject: [PATCH 55/57] Docs: Add a note to only query the NSClient++ API from
 the local Icinga 2 client

refs #6172
---
 doc/06-distributed-monitoring.md  | 8 ++++++--
 doc/10-icinga-template-library.md | 6 +++++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/doc/06-distributed-monitoring.md b/doc/06-distributed-monitoring.md
index dafd55cde..9ca5cec5f 100644
--- a/doc/06-distributed-monitoring.md
+++ b/doc/06-distributed-monitoring.md
@@ -1976,10 +1976,14 @@ you'll also need to ensure that port `5665` is enabled.
 #### NSClient++ API <a id="distributed-monitoring-windows-firewall-nsclient-api"></a>
 
 If the [check_nscp_api](06-distributed-monitoring.md#distributed-monitoring-windows-nscp-check-api)
-plugin is used to query NSClient++ remotely, you need to ensure that its port is enabled.
+plugin is used to query NSClient++, you need to ensure that its port is enabled.
 
     C:\WINDOWS\system32>netsh advfirewall firewall add rule name="Open port 8443 (NSClient++ API)" dir=in action=allow protocol=TCP localport=8443
 
+For security reasons, it is advised to enable the NSClient++ HTTP API for local
+connection from the Icinga 2 client only. Remote connections to the HTTP API
+are not recommended with using the legacy HTTP API.
+
 ### Windows Client and Plugins <a id="distributed-monitoring-windows-plugins"></a>
 
 The Icinga 2 package on Windows already provides several plugins.
@@ -2038,7 +2042,7 @@ for the requirements.
 
 There are two methods available for querying NSClient++:
 
-* Query the [HTTP API](06-distributed-monitoring.md#distributed-monitoring-windows-nscp-check-api) locally or remotely (requires a running NSClient++ service)
+* Query the [HTTP API](06-distributed-monitoring.md#distributed-monitoring-windows-nscp-check-api) locally from an Icinga 2 client (requires a running NSClient++ service)
 * Run a [local CLI check](06-distributed-monitoring.md#distributed-monitoring-windows-nscp-check-local) (does not require NSClient++ as a service)
 
 Both methods have their advantages and disadvantages. One thing to
diff --git a/doc/10-icinga-template-library.md b/doc/10-icinga-template-library.md
index 4b74930c0..0cb419ed5 100644
--- a/doc/10-icinga-template-library.md
+++ b/doc/10-icinga-template-library.md
@@ -1668,13 +1668,17 @@ users\_win\_crit | **Optional**. The critical threshold.
 
 There are two methods available for querying NSClient++:
 
-* Query the [HTTP API](10-icinga-template-library.md#nscp-check-api) locally or remotely (requires a running NSClient++ service)
+* Query the [HTTP API](06-distributed-monitoring.md#distributed-monitoring-windows-nscp-check-api) locally from an Icinga 2 client (requires a running NSClient++ service)
 * Run a [local CLI check](10-icinga-template-library.md#nscp-check-local) (does not require NSClient++ as a service)
 
 Both methods have their advantages and disadvantages. One thing to
 note: If you rely on performance counter delta calculations such as
 CPU utilization, please use the HTTP API instead of the CLI sample call.
 
+For security reasons, it is advised to enable the NSClient++ HTTP API for local
+connection from the Icinga 2 client only. Remote connections to the HTTP API
+are not recommended with using the legacy HTTP API.
+
 ### nscp_api <a id="nscp-check-api"></a>
 
 `check_nscp_api` is part of the Icinga 2 plugins. This plugin is available for

From e5539073c1fec18f5da5910b2a108d8c9fd72e26 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Thu, 22 Mar 2018 10:35:02 +0100
Subject: [PATCH 56/57] Update mailmap

---
 AUTHORS | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/AUTHORS b/AUTHORS
index de2060835..49ea4498d 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -10,6 +10,8 @@ Andrew Meyer <ameyer+secure@nodnetwork.org>
 Andy Grunwald <andygrunwald@gmail.com>
 Arnd Hannemann <arnd@arndnet.de>
 Assaf Flatto <assaf@aikilinux.com>
+Bård Dahlmo-Lerbæk <bard.dahlmo-lerbaek@skatteetaten.no>
+bascarsija <bascarsija.dev@gmail.com>
 Bastian Guse <bguse@nocopy.de>
 Benedikt Heine <bebe@bebehei.de>
 Bernd Erk <bernd.erk@icinga.com>
@@ -19,7 +21,6 @@ Brendan Jurd <direvus@gmail.com>
 Brian De Wolf <git@bldewolf.com>
 Brian Dockter <specus@gmail.com>
 Bruno Lingner <mail@hugo.ro>
-Bård Dahlmo-Lerbæk <bard.dahlmo-lerbaek@skatteetaten.no>
 Carlos Cesario <carloscesario@gmail.com>
 Carsten Köbke <carsten.koebke@gmx.de>
 Christian Birk <mail@birkc.de>
@@ -32,6 +33,8 @@ Christian Schmidt <github@chsc.dk>
 Claudio Bilotta <bilottalove@gmail.com>
 Claudio Kuenzler <ck@claudiokuenzler.com>
 Conrad Clement <cclement@printeron.com>
+cstegm <cstegm@users.noreply.github.com>
+ctrlaltca <ctrlaltca@gmail.com>
 Daniel Helgenberger <daniel.helgenberger@m-box.de>
 Daniel Kesselberg <mail@danielkesselberg.de>
 Daniil Yaroslavtsev <dyaroslavtsev@confyrm.com>
@@ -44,6 +47,7 @@ Dolf Schimmel <dolf@transip.nl>
 Edgar Fuß <ef@math.uni-bonn.de>
 Eduard Güldner <eduard.gueldner@gmail.com>
 Edvin Seferovic <edvin@seferovic.net>
+Élie Bouttier <elie@bouttier.eu>
 Eric Lippmann <eric.lippmann@icinga.com>
 Evgeni Golov <evgeni@golov.de>
 Ewoud Kohl van Wijngaarden <ewoud@kohlvanwijngaarden.nl>
@@ -55,6 +59,7 @@ Georg Faerber <georg@riseup.net>
 Georg Haas <hax404foogit@hax404.de>
 Gerd von Egidy <gerd@egidy.de>
 Gerhardt Roman <roman.gerhardt@cbc-x.com>
+gitmopp <mopp@gmx.net>
 Glauco Vinicius <gl4uc0@gmail.com>
 Gunnar Beutner <gunnar.beutner@icinga.com>
 Hannes Happle <info@h2-it.de>
@@ -72,16 +77,17 @@ Jean Flach <jean-marcel.flach@icinga.com>
 Jean-Louis Dupond <jean-louis@dupond.be>
 Jens Schanz <mail@jensschanz.de>
 Jeremy Armstrong <lepubel@gmail.com>
+Jérôme Drouet <jerome.drouet@gmail.com>
 Jesse Morgan <morgajel@gmail.com>
 Jo Goossens <jo.goossens@hosted-power.com>
 Johannes Meyer <johannes.meyer@icinga.com>
 Jonas Meurer <jonas@freesources.org>
 Joseph L. Casale <jcasale@activenetwerx.com>
 Julian Brost <julian@0x4a42.net>
-Jérôme Drouet <jerome.drouet@gmail.com>
 Kai Goller <kai.goller@netways.de>
-Konstantin Kelemen <konstantin@kel.mn>
 Kálmán Szalai - KAMI <kami911@gmail.com>
+Konstantin Kelemen <konstantin@kel.mn>
+krishna <gskrishna44@gmail.com>
 Lars Engels <lars.engels@0x20.net>
 Lars Krüger <krueger-lars@web.de>
 Lee Clemens <java@leeclemens.net>
@@ -91,8 +97,8 @@ Luca Lesinigo <luca@lm-net.it>
 Lucas Fairchild-Madar <lucas.madar@gmail.com>
 Malte Rabenseifner <mail@malte-rabenseifner.de>
 Manuel Reiter <reiter@csc.uni-frankfurt.de>
-Marcus van Dam <marcus@marcusvandam.nl>
 MarcusCaepio <MarcusCaepio@users.noreply.github.com>
+Marcus van Dam <marcus@marcusvandam.nl>
 Marianne Spiller <github@spiller.me>
 Marius Bergmann <marius@yeai.de>
 Marius Sturm <marius@graylog.com>
@@ -115,11 +121,13 @@ Michael Newton <miken32@gmail.com>
 Mikesch-mp <mikesch-mp@koebbes.de>
 Mirco Bauer <meebey@meebey.net>
 Mirko Nardin <mirko.nardin@gmx.net>
+mocruz <mocruz@theworkshop.com>
 Nicolai <nbuchwitz@users.noreply.github.com>
 Nicolas Limage <github@xephon.org>
 Nicole Lang <nicole.lang@icinga.com>
 Niflou <dubuscyr@gmail.com>
 Noah Hilverling <noah.hilverling@icinga.com>
+noobahoi <20069422+noobahoi@users.noreply.github.com>
 Pall Sigurdsson <palli-github@minor.is>
 Paolo Schiro <paolo.schiro@kpnqwest.it>
 Patrick Huy <frz@frz.cc>
@@ -130,6 +138,7 @@ Peter Eckel <pe-icinga2@hindenburgring.com>
 Petr Ruzicka <petr.ruzicka@gmail.com>
 Phil Hutchinson <phil@volumedia.co.uk>
 Philipp Dallig <philipp.dallig@gmail.com>
+pv2b <pvz@pvz.pp.se>
 Ralph Breier <ralph.breier@roedl.com>
 Reto Zeder <reto.zeder@arcade.ch>
 Ricardo Bartels <ricardo@bitchbrothers.com>
@@ -138,6 +147,7 @@ Roland Hopferwieser <rhopfer@ica.jku.at>
 Roman Gerhardt <roman.gerhardt@cbc-x.com>
 Rudy Gevaert <rudy.gevaert@ugent.be>
 Rune Darrud <theflyingcorpse@gmail.com>
+ryanohnemus <ryan.ohnemus@tradingtechnologies.com>
 Sam Kottler <shk@linux.com>
 Sebastian Brückner <mail@invlid.com>
 Sebastian Chrostek <sebastian@chrostek.net>
@@ -157,8 +167,8 @@ Thomas Gelf <thomas@gelf.net>
 Thomas Niedermeier <tniedermeier@thomas-krenn.com>
 Thomas Widhalm <thomas.widhalm@icinga.com>
 Tim Hardeck <thardeck@suse.de>
-Tim Weippert <weiti@weiti.eu>
 Timo Buhrmester <van.fstd@gmail.com>
+Tim Weippert <weiti@weiti.eu>
 Tobias Birnbaum <osterd@gmx.de>
 Tobias von der Krone <tobias.vonderkrone@profitbricks.com>
 Tom Geissler <Tom@d7031.de>
@@ -172,13 +182,3 @@ Yannick Charton <tontonitch-pro@yahoo.fr>
 Yohan Jarosz <yohanjarosz@yahoo.fr>
 Zachary McGibbon <zachary.mcgibbon@gmail.com>
 Zoltan Nagy <abesto@abesto.net>
-bascarsija <bascarsija.dev@gmail.com>
-cstegm <cstegm@users.noreply.github.com>
-ctrlaltca <ctrlaltca@gmail.com>
-gitmopp <mopp@gmx.net>
-krishna <gskrishna44@gmail.com>
-mocruz <mocruz@theworkshop.com>
-noobahoi <20069422+noobahoi@users.noreply.github.com>
-pv2b <pvz@pvz.pp.se>
-ryanohnemus <ryan.ohnemus@tradingtechnologies.com>
-Élie Bouttier <elie@bouttier.eu>

From ada573dcf0eead48d66652c8ef397b223a805295 Mon Sep 17 00:00:00 2001
From: Jean Flach <jean-marcel.flach@icinga.com>
Date: Thu, 22 Mar 2018 11:17:13 +0100
Subject: [PATCH 57/57] Release version 2.8.2

---
 CHANGELOG.md | 4530 +++++++++++++++++++++++++-------------------------
 icinga2.spec |    2 +-
 2 files changed, 2292 insertions(+), 2240 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc291c684..05c822087 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,53 +1,105 @@
 # Icinga 2.x CHANGELOG
 
+## 2.8.2 (2018-03-22)
+
+### Notes
+
+A bugfix release with a focus on security.
+
+Most of these have been brought to our attention by the community and we are very thankful for that. Special thanks to Michael H., Julian and Michael O., who helped by reporting and assisting us in fixing security bugs. CVEs have also been requested for these issues, they are as follows: CVE-2017-16933, CVE-2018-6532, CVE-2018-6533, CVE-2018-6534, CVE-2018-6535, CVE-2018-6536.
+
+### Enhancement
+
+* [#5715](https://github.com/icinga/icinga2/issues/5715) (API, PR): Hash API password and comparison
+
+### Bug
+
+* [#6153](https://github.com/icinga/icinga2/issues/6153) (API, PR): Improve error handling for empty packages in /v1/config/packages
+* [#6147](https://github.com/icinga/icinga2/issues/6147) (PR): Fix incorrect argument type for JsonRpc::SendMessage
+* [#6146](https://github.com/icinga/icinga2/issues/6146) (PR): Ensure that SetCorked\(\) works properly
+* [#6134](https://github.com/icinga/icinga2/issues/6134) (PR): Fix incorrect HTTP content length limits
+* [#6133](https://github.com/icinga/icinga2/issues/6133) (PR): Limit the number of HTTP/JSON-RPC requests we read in parallel
+* [#6132](https://github.com/icinga/icinga2/issues/6132) (PR): Fix HTTP parser crash/hang
+* [#6129](https://github.com/icinga/icinga2/issues/6129): api/packages not created by prepare-dir/daemon
+* [#5995](https://github.com/icinga/icinga2/issues/5995) (InfluxDB, PR): Fix InfluxDB requests
+* [#5991](https://github.com/icinga/icinga2/issues/5991): Partial privilege escalation via PID file manipulation
+* [#5987](https://github.com/icinga/icinga2/issues/5987) (Elasticsearch, InfluxDB, Metrics): InfluxDBWriter and ElasticsearchWriter stop writing to HTTP API
+* [#5943](https://github.com/icinga/icinga2/issues/5943) (PR): Fix incorrect ::Start call
+* [#5793](https://github.com/icinga/icinga2/issues/5793): CVE-2017-16933: root privilege escalation via prepare-dirs \(init script and systemd service file\)
+* [#5760](https://github.com/icinga/icinga2/issues/5760) (Crash, PR): Fix incorrect socket handling for the HTTP client
+
+### Documentation
+
+* [#6172](https://github.com/icinga/icinga2/issues/6172) (Documentation, PR): Docs: Add a note to only query the NSClient++ API from the local Icinga 2 client
+* [#6111](https://github.com/icinga/icinga2/issues/6111) (Documentation, PR): Add Upgrading to Icinga 2.8.2 chapter
+* [#6089](https://github.com/icinga/icinga2/issues/6089) (Documentation, PR): Docs: Fix bracket in notification example
+* [#6086](https://github.com/icinga/icinga2/issues/6086) (Documentation, PR): Upgrading: Make it more clear that the Director script is just an example
+* [#6075](https://github.com/icinga/icinga2/issues/6075) (Documentation, PR): Explain how to register functions in the global scope
+* [#6014](https://github.com/icinga/icinga2/issues/6014) (Documentation, PR): Docs: Add IDO DB tuning tips
+* [#6006](https://github.com/icinga/icinga2/issues/6006) (Documentation, PR): Fix wrong nscp-local include in the docs
+
+### Support
+
+* [#6148](https://github.com/icinga/icinga2/issues/6148) (PR): Fix ApiUser unit test
+* [#6135](https://github.com/icinga/icinga2/issues/6135) (API, Cluster, PR): Limit JSON RPC message size
+* [#6115](https://github.com/icinga/icinga2/issues/6115) (PR): Fix incorrect size of request limits
+* [#6114](https://github.com/icinga/icinga2/issues/6114) (PR): Fix typo in prepare-dirs
+* [#6104](https://github.com/icinga/icinga2/issues/6104) (PR): Fix nullptr dereferences
+* [#6103](https://github.com/icinga/icinga2/issues/6103) (PR): HTTP Security fixes
+* [#5982](https://github.com/icinga/icinga2/issues/5982) (Packages, PR): SELinux: Allows icinga2\_t to send sigkill to all domains it transitions to
+* [#5916](https://github.com/icinga/icinga2/issues/5916) (Packages): Unable to kill process group after check timeout if SElinux is enabled
+* [#5850](https://github.com/icinga/icinga2/issues/5850) (Installation, PR): init script security fixes
+* [#5764](https://github.com/icinga/icinga2/issues/5764) (InfluxDB, code-quality, PR): Improve InfluxdbWriter performance
+* [#5759](https://github.com/icinga/icinga2/issues/5759) (code-quality, PR): Make default getters and setters non-virtual
+
 ## 2.8.1 (2018-01-17)
 
 ### Enhancement
 
-* [#5856](https://github.com/Icinga/icinga2/issues/5856) (PR): Implement AppLocal deployment support for UCRT
+* [#5856](https://github.com/icinga/icinga2/issues/5856) (PR): Implement AppLocal deployment support for UCRT
 
 ### Bug
 
-* [#5986](https://github.com/Icinga/icinga2/issues/5986) (DB IDO, PR): Fix wrong schema constraint for fresh 2.8.0 installations
-* [#5947](https://github.com/Icinga/icinga2/issues/5947) (DB IDO): Duplicate entry constraint violations in 2.8
-* [#5907](https://github.com/Icinga/icinga2/issues/5907) (PR): Windows plugin check\_swap build fix
-* [#5808](https://github.com/Icinga/icinga2/issues/5808) (Crash, PR): Fix missing variable name which can lead to segfaults
-* [#5807](https://github.com/Icinga/icinga2/issues/5807) (Crash): icinga v2.8.0 crashes frequently with "segmentation fault" on Debian 8.9
-* [#5804](https://github.com/Icinga/icinga2/issues/5804) (Log, PR): Silence UpdateRepository message errors
-* [#5776](https://github.com/Icinga/icinga2/issues/5776) (Cluster, Log): 2.8.0: warning/JsonRpcConnection: Call to non-existent function 'event::UpdateRepository' 
-* [#5746](https://github.com/Icinga/icinga2/issues/5746) (Livestatus, PR): livestatus: custom variables return empty arrays instead of strings
-* [#5716](https://github.com/Icinga/icinga2/issues/5716) (Livestatus, PR): add bogus zero reply in livestatus when aggregate and non matching filter
-* [#5626](https://github.com/Icinga/icinga2/issues/5626) (Livestatus, help wanted): Empty result set with non-matching filters in Livestatus stats query
+* [#5986](https://github.com/icinga/icinga2/issues/5986) (DB IDO, PR): Fix wrong schema constraint for fresh 2.8.0 installations
+* [#5947](https://github.com/icinga/icinga2/issues/5947) (DB IDO): Duplicate entry constraint violations in 2.8
+* [#5907](https://github.com/icinga/icinga2/issues/5907) (PR): Windows plugin check\_swap build fix
+* [#5808](https://github.com/icinga/icinga2/issues/5808) (Crash, PR): Fix missing variable name which can lead to segfaults
+* [#5807](https://github.com/icinga/icinga2/issues/5807) (Crash): icinga v2.8.0 crashes frequently with "segmentation fault" on Debian 8.9
+* [#5804](https://github.com/icinga/icinga2/issues/5804) (Log, PR): Silence UpdateRepository message errors
+* [#5776](https://github.com/icinga/icinga2/issues/5776) (Cluster, Log): 2.8.0: warning/JsonRpcConnection: Call to non-existent function 'event::UpdateRepository' 
+* [#5746](https://github.com/icinga/icinga2/issues/5746) (Livestatus, PR): livestatus: custom variables return empty arrays instead of strings
+* [#5716](https://github.com/icinga/icinga2/issues/5716) (Livestatus, PR): add bogus zero reply in livestatus when aggregate and non matching filter
+* [#5626](https://github.com/icinga/icinga2/issues/5626) (Livestatus, help wanted): Empty result set with non-matching filters in Livestatus stats query
 
 ### ITL
 
-* [#5785](https://github.com/Icinga/icinga2/issues/5785) (ITL, PR): ITL: Drop ssl\_sni default setting
-* [#5775](https://github.com/Icinga/icinga2/issues/5775) (ITL): Default usage of ssl\_sni in check\_tcp
+* [#5785](https://github.com/icinga/icinga2/issues/5785) (ITL, PR): ITL: Drop ssl\_sni default setting
+* [#5775](https://github.com/icinga/icinga2/issues/5775) (ITL): Default usage of ssl\_sni in check\_tcp
 
 ### Documentation
 
-* [#5972](https://github.com/Icinga/icinga2/issues/5972) (Documentation, PR): Update 08-advanced-topics.md
-* [#5942](https://github.com/Icinga/icinga2/issues/5942) (Documentation, PR): Add some technical insights into the cluster-zone health check and log lag
-* [#5922](https://github.com/Icinga/icinga2/issues/5922) (Documentation, PR): Fix link format in documentation
-* [#5918](https://github.com/Icinga/icinga2/issues/5918) (Documentation, PR): Fix typo in SELinux documentation
-* [#5911](https://github.com/Icinga/icinga2/issues/5911) (Documentation, PR): Update ElasticsearchWriter docs for 5.x support only
-* [#5866](https://github.com/Icinga/icinga2/issues/5866) (Documentation, PR): Remove redundant FreeBSD from restart instructions and add openSUSE
-* [#5864](https://github.com/Icinga/icinga2/issues/5864) (Documentation, PR): Add missing initdb to PostgreSQL documentation
-* [#5835](https://github.com/Icinga/icinga2/issues/5835) (Documentation, PR): Fixes postgres schema upgrade path
-* [#5833](https://github.com/Icinga/icinga2/issues/5833) (Documentation, PR): fix formatting error
-* [#5790](https://github.com/Icinga/icinga2/issues/5790) (Documentation, PR): Documentation fixes
-* [#5783](https://github.com/Icinga/icinga2/issues/5783) (Documentation, PR): Fix formatting in value types docs
-* [#5773](https://github.com/Icinga/icinga2/issues/5773) (Documentation, Windows, PR): Update Windows Client requirements for 2.8
-* [#5757](https://github.com/Icinga/icinga2/issues/5757) (Documentation, PR): Add documentation about automatic service restarts with systemd
+* [#5972](https://github.com/icinga/icinga2/issues/5972) (Documentation, PR): Update 08-advanced-topics.md
+* [#5942](https://github.com/icinga/icinga2/issues/5942) (Documentation, PR): Add some technical insights into the cluster-zone health check and log lag
+* [#5922](https://github.com/icinga/icinga2/issues/5922) (Documentation, PR): Fix link format in documentation
+* [#5918](https://github.com/icinga/icinga2/issues/5918) (Documentation, PR): Fix typo in SELinux documentation
+* [#5911](https://github.com/icinga/icinga2/issues/5911) (Documentation, PR): Update ElasticsearchWriter docs for 5.x support only
+* [#5866](https://github.com/icinga/icinga2/issues/5866) (Documentation, PR): Remove redundant FreeBSD from restart instructions and add openSUSE
+* [#5864](https://github.com/icinga/icinga2/issues/5864) (Documentation, PR): Add missing initdb to PostgreSQL documentation
+* [#5835](https://github.com/icinga/icinga2/issues/5835) (Documentation, PR): Fixes postgres schema upgrade path
+* [#5833](https://github.com/icinga/icinga2/issues/5833) (Documentation, PR): fix formatting error
+* [#5790](https://github.com/icinga/icinga2/issues/5790) (Documentation, PR): Documentation fixes
+* [#5783](https://github.com/icinga/icinga2/issues/5783) (Documentation, PR): Fix formatting in value types docs
+* [#5773](https://github.com/icinga/icinga2/issues/5773) (Documentation, Windows, PR): Update Windows Client requirements for 2.8
+* [#5757](https://github.com/icinga/icinga2/issues/5757) (Documentation, PR): Add documentation about automatic service restarts with systemd
 
 ### Support
 
-* [#5989](https://github.com/Icinga/icinga2/issues/5989) (PR): changelog.py: Adjust categories and labels: Enhancement, Bug, ITL, Documentation, Support
-* [#5938](https://github.com/Icinga/icinga2/issues/5938) (Packages, Windows): chocolatey outdated version
-* [#5893](https://github.com/Icinga/icinga2/issues/5893) (code-quality, PR): Whitespace fix
-* [#5892](https://github.com/Icinga/icinga2/issues/5892) (Installation, PR): Enable installing the init scripts on Solaris
-* [#5851](https://github.com/Icinga/icinga2/issues/5851) (Plugins, Windows, PR): Fix check\_service returning Warning instead of Critical
-* [#5780](https://github.com/Icinga/icinga2/issues/5780) (Packages, Windows): Icinga Agent Windows 2.8.0 msvcr120.dll is missing
+* [#5989](https://github.com/icinga/icinga2/issues/5989) (PR): changelog.py: Adjust categories and labels: Enhancement, Bug, ITL, Documentation, Support
+* [#5938](https://github.com/icinga/icinga2/issues/5938) (Packages, Windows): chocolatey outdated version
+* [#5893](https://github.com/icinga/icinga2/issues/5893) (code-quality, PR): Whitespace fix
+* [#5892](https://github.com/icinga/icinga2/issues/5892) (Installation, PR): Enable installing the init scripts on Solaris
+* [#5851](https://github.com/icinga/icinga2/issues/5851) (Plugins, Windows, PR): Fix check\_service returning Warning instead of Critical
+* [#5780](https://github.com/icinga/icinga2/issues/5780) (Packages, Windows): Icinga Agent Windows 2.8.0 msvcr120.dll is missing
 
 ## 2.8.0 (2017-11-16)
 
@@ -70,132 +122,132 @@
 
 ### Enhancement
 
-* [#5682](https://github.com/Icinga/icinga2/issues/5682) (Cluster, Configuration, PR): Implement support for migrating certificates to /var/lib/icinga2/certs
-* [#5681](https://github.com/Icinga/icinga2/issues/5681) (CLI, Cluster, Windows): Update Windows wizard from enhanced CSR signing \(optional ticket\)
-* [#5679](https://github.com/Icinga/icinga2/issues/5679) (CLI, Cluster): Migration path for improved certificate signing in the cluster
-* [#5606](https://github.com/Icinga/icinga2/issues/5606) (Cluster, PR): Remove bottom-up client mode
-* [#5602](https://github.com/Icinga/icinga2/issues/5602) (Windows, PR): Add windows process elevation and log message if user does not have privileges to read/write files
-* [#5587](https://github.com/Icinga/icinga2/issues/5587) (Log, PR): SyslogLogger: Implement option to set syslog facility
-* [#5580](https://github.com/Icinga/icinga2/issues/5580) (Configuration, PR): Implement new script functions: path\_exists, glob and glob\_recursive
-* [#5571](https://github.com/Icinga/icinga2/issues/5571) (CLI, Cluster, PR): Implement support for forwarding certificate signing requests in the cluster
-* [#5569](https://github.com/Icinga/icinga2/issues/5569) (Performance Data, PR): ElasticWriter: Add basic auth and TLS support for Elasticsearch behind an HTTP proxy
-* [#5554](https://github.com/Icinga/icinga2/issues/5554) (API, Cluster, PR): Add subjectAltName extension for all non-CA certificates
-* [#5547](https://github.com/Icinga/icinga2/issues/5547) (API, PR): Add optional reload parameter to config stage upload
-* [#5538](https://github.com/Icinga/icinga2/issues/5538) (Performance Data): Add ElasticsearchWriter feature
-* [#5534](https://github.com/Icinga/icinga2/issues/5534) (Configuration, PR): Implement get\_services\(host {name,object}\) and add host object support for get\_service\(\)
-* [#5527](https://github.com/Icinga/icinga2/issues/5527) (API, PR): API: Add execution\_{start,end} attribute to 'process-check-result' action
-* [#5450](https://github.com/Icinga/icinga2/issues/5450) (CLI, Cluster): Enhance CSR Autosigning \(CA proxy, etc.\)
-* [#5443](https://github.com/Icinga/icinga2/issues/5443) (API, PR): Add CORS support and set response header 'Access-Control-Allow-Origin'
-* [#5435](https://github.com/Icinga/icinga2/issues/5435) (Plugins, Windows, PR): Add -d option to check\_service
-* [#5002](https://github.com/Icinga/icinga2/issues/5002) (API, wishlist): API process-check-result allow setting timestamp
-* [#4912](https://github.com/Icinga/icinga2/issues/4912) (Configuration): new function get\_services\(host\_name\)
-* [#4799](https://github.com/Icinga/icinga2/issues/4799) (Cluster): Remove cluster/client mode "bottom up" w/ repository.d and node update-config
-* [#4769](https://github.com/Icinga/icinga2/issues/4769) (API): Validate and activate config package stages without triggering a reload
-* [#4326](https://github.com/Icinga/icinga2/issues/4326) (API): API should provide CORS Header
-* [#3891](https://github.com/Icinga/icinga2/issues/3891) (Plugins): Add option to specify ServiceDescription instead of ServiceName with check\_service.exe
+* [#5682](https://github.com/icinga/icinga2/issues/5682) (Cluster, Configuration, PR): Implement support for migrating certificates to /var/lib/icinga2/certs
+* [#5681](https://github.com/icinga/icinga2/issues/5681) (CLI, Cluster, Windows): Update Windows wizard from enhanced CSR signing \(optional ticket\)
+* [#5679](https://github.com/icinga/icinga2/issues/5679) (CLI, Cluster): Migration path for improved certificate signing in the cluster
+* [#5606](https://github.com/icinga/icinga2/issues/5606) (Cluster, PR): Remove bottom-up client mode
+* [#5602](https://github.com/icinga/icinga2/issues/5602) (Windows, PR): Add windows process elevation and log message if user does not have privileges to read/write files
+* [#5587](https://github.com/icinga/icinga2/issues/5587) (Log, PR): SyslogLogger: Implement option to set syslog facility
+* [#5580](https://github.com/icinga/icinga2/issues/5580) (Configuration, PR): Implement new script functions: path\_exists, glob and glob\_recursive
+* [#5571](https://github.com/icinga/icinga2/issues/5571) (CLI, Cluster, PR): Implement support for forwarding certificate signing requests in the cluster
+* [#5569](https://github.com/icinga/icinga2/issues/5569) (Metrics, PR): ElasticWriter: Add basic auth and TLS support for Elasticsearch behind an HTTP proxy
+* [#5554](https://github.com/icinga/icinga2/issues/5554) (API, Cluster, PR): Add subjectAltName extension for all non-CA certificates
+* [#5547](https://github.com/icinga/icinga2/issues/5547) (API, PR): Add optional reload parameter to config stage upload
+* [#5538](https://github.com/icinga/icinga2/issues/5538) (Metrics): Add ElasticsearchWriter feature
+* [#5534](https://github.com/icinga/icinga2/issues/5534) (Configuration, PR): Implement get\_services\(host {name,object}\) and add host object support for get\_service\(\)
+* [#5527](https://github.com/icinga/icinga2/issues/5527) (API, PR): API: Add execution\_{start,end} attribute to 'process-check-result' action
+* [#5450](https://github.com/icinga/icinga2/issues/5450) (CLI, Cluster): Enhance CSR Autosigning \(CA proxy, etc.\)
+* [#5443](https://github.com/icinga/icinga2/issues/5443) (API, PR): Add CORS support and set response header 'Access-Control-Allow-Origin'
+* [#5435](https://github.com/icinga/icinga2/issues/5435) (Plugins, Windows, PR): Add -d option to check\_service
+* [#5002](https://github.com/icinga/icinga2/issues/5002) (API, wishlist): API process-check-result allow setting timestamp
+* [#4912](https://github.com/icinga/icinga2/issues/4912) (Configuration): new function get\_services\(host\_name\)
+* [#4799](https://github.com/icinga/icinga2/issues/4799) (Cluster): Remove cluster/client mode "bottom up" w/ repository.d and node update-config
+* [#4769](https://github.com/icinga/icinga2/issues/4769) (API): Validate and activate config package stages without triggering a reload
+* [#4326](https://github.com/icinga/icinga2/issues/4326) (API): API should provide CORS Header
+* [#3891](https://github.com/icinga/icinga2/issues/3891) (Plugins): Add option to specify ServiceDescription instead of ServiceName with check\_service.exe
 
 ### Bug
 
-* [#5728](https://github.com/Icinga/icinga2/issues/5728) (Plugins, Windows, PR): Fix check\_service not working with names
-* [#5720](https://github.com/Icinga/icinga2/issues/5720) (Check Execution): Flapping tests and bugs
-* [#5710](https://github.com/Icinga/icinga2/issues/5710) (CLI, Configuration, PR): Include default global zones during node wizard/setup
-* [#5707](https://github.com/Icinga/icinga2/issues/5707) (CLI): node wizard/setup override zones.conf but do not include default global zones \(director-global, global-templates\)
-* [#5696](https://github.com/Icinga/icinga2/issues/5696) (PR): Fix fork error handling
-* [#5641](https://github.com/Icinga/icinga2/issues/5641) (PR): Fix compiler warnings on macOS 10.13
-* [#5635](https://github.com/Icinga/icinga2/issues/5635) (Configuration, PR): Fix match\(\), regex\(\), cidr\_match\(\) behaviour with MatchAll and empty arrays
-* [#5634](https://github.com/Icinga/icinga2/issues/5634) (Configuration): match\(\) for arrays returns boolean true if array is empty
-* [#5620](https://github.com/Icinga/icinga2/issues/5620) (API, PR): Ensure that the REST API config package/stage creation is atomic
-* [#5617](https://github.com/Icinga/icinga2/issues/5617): Crash with premature EOF on resource limited OS
-* [#5614](https://github.com/Icinga/icinga2/issues/5614) (PR): Fixed missing include statement in unit tests
-* [#5584](https://github.com/Icinga/icinga2/issues/5584) (Windows): Build error on Windows
-* [#5581](https://github.com/Icinga/icinga2/issues/5581) (API, Cluster, Crash, PR): Fix possible race condition in ApiListener locking
-* [#5558](https://github.com/Icinga/icinga2/issues/5558) (API, PR): Don't sent scheme and hostname in request
-* [#5515](https://github.com/Icinga/icinga2/issues/5515) (Windows): Config validation fails on Windows with unprivileged account
-* [#5500](https://github.com/Icinga/icinga2/issues/5500) (Crash, PR): Process: Fix JSON parsing error on process helper crash
-* [#5497](https://github.com/Icinga/icinga2/issues/5497) (API, PR): API: Fix requested attrs/joins/meta type errors in object query response
-* [#5485](https://github.com/Icinga/icinga2/issues/5485) (DB IDO, PR): Ensure that expired/removed downtimes/comments are correctly updated in DB IDO
-* [#5377](https://github.com/Icinga/icinga2/issues/5377) (API, Log): Sending wrong value for key causes ugly stacktrace
-* [#5231](https://github.com/Icinga/icinga2/issues/5231) (Check Execution, PR): Report failure to kill check command after exceeding timeout
-* [#4981](https://github.com/Icinga/icinga2/issues/4981) (Check Execution): Failure to kill check command after exceeding timeout is not reported
+* [#5728](https://github.com/icinga/icinga2/issues/5728) (Plugins, Windows, PR): Fix check\_service not working with names
+* [#5720](https://github.com/icinga/icinga2/issues/5720) (Check Execution): Flapping tests and bugs
+* [#5710](https://github.com/icinga/icinga2/issues/5710) (CLI, Configuration, PR): Include default global zones during node wizard/setup
+* [#5707](https://github.com/icinga/icinga2/issues/5707) (CLI): node wizard/setup override zones.conf but do not include default global zones \(director-global, global-templates\)
+* [#5696](https://github.com/icinga/icinga2/issues/5696) (PR): Fix fork error handling
+* [#5641](https://github.com/icinga/icinga2/issues/5641) (PR): Fix compiler warnings on macOS 10.13
+* [#5635](https://github.com/icinga/icinga2/issues/5635) (Configuration, PR): Fix match\(\), regex\(\), cidr\_match\(\) behaviour with MatchAll and empty arrays
+* [#5634](https://github.com/icinga/icinga2/issues/5634) (Configuration): match\(\) for arrays returns boolean true if array is empty
+* [#5620](https://github.com/icinga/icinga2/issues/5620) (API, PR): Ensure that the REST API config package/stage creation is atomic
+* [#5617](https://github.com/icinga/icinga2/issues/5617): Crash with premature EOF on resource limited OS
+* [#5614](https://github.com/icinga/icinga2/issues/5614) (PR): Fixed missing include statement in unit tests
+* [#5584](https://github.com/icinga/icinga2/issues/5584) (Windows): Build error on Windows
+* [#5581](https://github.com/icinga/icinga2/issues/5581) (API, Cluster, Crash, PR): Fix possible race condition in ApiListener locking
+* [#5558](https://github.com/icinga/icinga2/issues/5558) (API, PR): Don't sent scheme and hostname in request
+* [#5515](https://github.com/icinga/icinga2/issues/5515) (Windows): Config validation fails on Windows with unprivileged account
+* [#5500](https://github.com/icinga/icinga2/issues/5500) (Crash, PR): Process: Fix JSON parsing error on process helper crash
+* [#5497](https://github.com/icinga/icinga2/issues/5497) (API, PR): API: Fix requested attrs/joins/meta type errors in object query response
+* [#5485](https://github.com/icinga/icinga2/issues/5485) (DB IDO, PR): Ensure that expired/removed downtimes/comments are correctly updated in DB IDO
+* [#5377](https://github.com/icinga/icinga2/issues/5377) (API, Log): Sending wrong value for key causes ugly stacktrace
+* [#5231](https://github.com/icinga/icinga2/issues/5231) (Check Execution, PR): Report failure to kill check command after exceeding timeout
+* [#4981](https://github.com/icinga/icinga2/issues/4981) (Check Execution): Failure to kill check command after exceeding timeout is not reported
 
 ### ITL
 
-* [#5678](https://github.com/Icinga/icinga2/issues/5678) (ITL, PR): Added missing "-q" parameter to check\_ntp\_peer
-* [#5672](https://github.com/Icinga/icinga2/issues/5672) (ITL, PR): add itl snmp-service for manubulon plugin check\_snmp\_win.pl
-* [#5647](https://github.com/Icinga/icinga2/issues/5647) (ITL, PR): Allow to disable thresholds for ipmi CheckCommand
-* [#5640](https://github.com/Icinga/icinga2/issues/5640) (ITL, PR): ITL: Support weathermap data in snmp\_interface CheckCommand
-* [#5638](https://github.com/Icinga/icinga2/issues/5638) (ITL, PR): Add support for check\_address as default in database CheckCommand objects
-* [#5578](https://github.com/Icinga/icinga2/issues/5578) (ITL, PR): ITL: Re-Add ssl\_sni attribute for check\_tcp
-* [#5577](https://github.com/Icinga/icinga2/issues/5577) (ITL): ssl CheckCommand does not support SNI
-* [#5570](https://github.com/Icinga/icinga2/issues/5570) (ITL, PR): check\_esxi\_hardware.py with new --no-lcd parameter
-* [#5559](https://github.com/Icinga/icinga2/issues/5559) (ITL, PR): Exclude configfs from disk checks
-* [#5427](https://github.com/Icinga/icinga2/issues/5427) (ITL): Update negate CheckCommand definition
-* [#5401](https://github.com/Icinga/icinga2/issues/5401) (ITL, PR): itl: Add manubulon/check\_snmp\_env.pl as CheckCommand snmp-env
-* [#5394](https://github.com/Icinga/icinga2/issues/5394) (ITL, PR): itl: add additional mssql\_health arguments
-* [#5387](https://github.com/Icinga/icinga2/issues/5387) (ITL, PR): Add missing options to snmp CheckCommand definition
+* [#5678](https://github.com/icinga/icinga2/issues/5678) (ITL, PR): Added missing "-q" parameter to check\_ntp\_peer
+* [#5672](https://github.com/icinga/icinga2/issues/5672) (ITL, PR): add itl snmp-service for manubulon plugin check\_snmp\_win.pl
+* [#5647](https://github.com/icinga/icinga2/issues/5647) (ITL, PR): Allow to disable thresholds for ipmi CheckCommand
+* [#5640](https://github.com/icinga/icinga2/issues/5640) (ITL, PR): ITL: Support weathermap data in snmp\_interface CheckCommand
+* [#5638](https://github.com/icinga/icinga2/issues/5638) (ITL, PR): Add support for check\_address as default in database CheckCommand objects
+* [#5578](https://github.com/icinga/icinga2/issues/5578) (ITL, PR): ITL: Re-Add ssl\_sni attribute for check\_tcp
+* [#5577](https://github.com/icinga/icinga2/issues/5577) (ITL): ssl CheckCommand does not support SNI
+* [#5570](https://github.com/icinga/icinga2/issues/5570) (ITL, PR): check\_esxi\_hardware.py with new --no-lcd parameter
+* [#5559](https://github.com/icinga/icinga2/issues/5559) (ITL, PR): Exclude configfs from disk checks
+* [#5427](https://github.com/icinga/icinga2/issues/5427) (ITL): Update negate CheckCommand definition
+* [#5401](https://github.com/icinga/icinga2/issues/5401) (ITL, PR): itl: Add manubulon/check\_snmp\_env.pl as CheckCommand snmp-env
+* [#5394](https://github.com/icinga/icinga2/issues/5394) (ITL, PR): itl: add additional mssql\_health arguments
+* [#5387](https://github.com/icinga/icinga2/issues/5387) (ITL, PR): Add missing options to snmp CheckCommand definition
 
 ### Documentation
 
-* [#5768](https://github.com/Icinga/icinga2/issues/5768) (Documentation, PR): Update .mailmap and AUTHORS
-* [#5761](https://github.com/Icinga/icinga2/issues/5761) (Documentation, PR): Fix wrong anchors in the documentation
-* [#5755](https://github.com/Icinga/icinga2/issues/5755) (Documentation, PR): Fix missing Accept header in troubleshooting docs
-* [#5754](https://github.com/Icinga/icinga2/issues/5754) (Documentation, PR): Improve documentation of cipher\_list
-* [#5752](https://github.com/Icinga/icinga2/issues/5752) (Documentation, PR): Add Noah Hilverling to .mailmap
-* [#5748](https://github.com/Icinga/icinga2/issues/5748) (Documentation, PR): Fix missing word in pin checks in a zone doc chapter
-* [#5741](https://github.com/Icinga/icinga2/issues/5741) (Documentation, PR): Fix manual certificate creation chapter in the docs
-* [#5738](https://github.com/Icinga/icinga2/issues/5738) (Documentation, PR): Update release docs
-* [#5734](https://github.com/Icinga/icinga2/issues/5734) (Documentation, PR): Fix broken links inside the documentation
-* [#5727](https://github.com/Icinga/icinga2/issues/5727) (Documentation, PR): Update upgrading documentation for 2.8
-* [#5708](https://github.com/Icinga/icinga2/issues/5708) (Documentation, PR): Fixed grammar and spelling mistakes
-* [#5703](https://github.com/Icinga/icinga2/issues/5703) (Documentation): Minor documentation typos in flapping detection description
-* [#5695](https://github.com/Icinga/icinga2/issues/5695) (Documentation, PR): Enhance Security chapter for Distributed Monitoring documentation
-* [#5691](https://github.com/Icinga/icinga2/issues/5691) (Documentation, PR): Fixed doc formatting
-* [#5690](https://github.com/Icinga/icinga2/issues/5690) (Documentation): Improve documentation of cipher\_list
-* [#5688](https://github.com/Icinga/icinga2/issues/5688) (Documentation, PR): Fixed typos and punctuation
-* [#5680](https://github.com/Icinga/icinga2/issues/5680) (Documentation): Review documentation for enhanced CSR signing and update migration chapter for 2.8
-* [#5677](https://github.com/Icinga/icinga2/issues/5677) (Documentation, PR): Fix typo in threshold syntax documentation
-* [#5668](https://github.com/Icinga/icinga2/issues/5668) (Documentation, PR): Enhance Monitoring Basics in the documentation
-* [#5667](https://github.com/Icinga/icinga2/issues/5667) (Documentation): Explain which values can be used for set\_if in command arguments
-* [#5666](https://github.com/Icinga/icinga2/issues/5666) (Documentation): Explain the notification with users defined on host/service in a dedicated docs chapter
-* [#5665](https://github.com/Icinga/icinga2/issues/5665) (Documentation): Better explanations and iteration details for "apply for" documentation
-* [#5664](https://github.com/Icinga/icinga2/issues/5664) (Documentation): Add usage examples to the "apply" chapter based on custom attribute values
-* [#5663](https://github.com/Icinga/icinga2/issues/5663) (Documentation): Explain custom attribute value types and nested dictionaries
-* [#5662](https://github.com/Icinga/icinga2/issues/5662) (Documentation): Explain how to use a different host check command
-* [#5655](https://github.com/Icinga/icinga2/issues/5655) (Documentation, PR): Enhance documentation with more details on value types for object attributes
-* [#5576](https://github.com/Icinga/icinga2/issues/5576) (Documentation, PR): Fixed downtime example in documentation
-* [#5568](https://github.com/Icinga/icinga2/issues/5568) (Documentation, PR): Add documentation for multi-line plugin output for API actions
-* [#5511](https://github.com/Icinga/icinga2/issues/5511) (Cluster, Documentation, Windows): SSL errors with leading zeros in certificate serials \(created \< v2.4\) with OpenSSL 1.1.0
-* [#5379](https://github.com/Icinga/icinga2/issues/5379) (Documentation, PR): Set shell prompt for commands to be \#
-* [#5186](https://github.com/Icinga/icinga2/issues/5186) (Documentation): Document boolean values understood by set\_if
-* [#5060](https://github.com/Icinga/icinga2/issues/5060) (Documentation): Missing documentation for macro\(\)
-* [#4015](https://github.com/Icinga/icinga2/issues/4015) (Documentation): Add documentation for host state calculation from plugin exit codes
+* [#5768](https://github.com/icinga/icinga2/issues/5768) (Documentation, PR): Update .mailmap and AUTHORS
+* [#5761](https://github.com/icinga/icinga2/issues/5761) (Documentation, PR): Fix wrong anchors in the documentation
+* [#5755](https://github.com/icinga/icinga2/issues/5755) (Documentation, PR): Fix missing Accept header in troubleshooting docs
+* [#5754](https://github.com/icinga/icinga2/issues/5754) (Documentation, PR): Improve documentation of cipher\_list
+* [#5752](https://github.com/icinga/icinga2/issues/5752) (Documentation, PR): Add Noah Hilverling to .mailmap
+* [#5748](https://github.com/icinga/icinga2/issues/5748) (Documentation, PR): Fix missing word in pin checks in a zone doc chapter
+* [#5741](https://github.com/icinga/icinga2/issues/5741) (Documentation, PR): Fix manual certificate creation chapter in the docs
+* [#5738](https://github.com/icinga/icinga2/issues/5738) (Documentation, PR): Update release docs
+* [#5734](https://github.com/icinga/icinga2/issues/5734) (Documentation, PR): Fix broken links inside the documentation
+* [#5727](https://github.com/icinga/icinga2/issues/5727) (Documentation, PR): Update upgrading documentation for 2.8
+* [#5708](https://github.com/icinga/icinga2/issues/5708) (Documentation, PR): Fixed grammar and spelling mistakes
+* [#5703](https://github.com/icinga/icinga2/issues/5703) (Documentation): Minor documentation typos in flapping detection description
+* [#5695](https://github.com/icinga/icinga2/issues/5695) (Documentation, PR): Enhance Security chapter for Distributed Monitoring documentation
+* [#5691](https://github.com/icinga/icinga2/issues/5691) (Documentation, PR): Fixed doc formatting
+* [#5690](https://github.com/icinga/icinga2/issues/5690) (Documentation): Improve documentation of cipher\_list
+* [#5688](https://github.com/icinga/icinga2/issues/5688) (Documentation, PR): Fixed typos and punctuation
+* [#5680](https://github.com/icinga/icinga2/issues/5680) (Documentation): Review documentation for enhanced CSR signing and update migration chapter for 2.8
+* [#5677](https://github.com/icinga/icinga2/issues/5677) (Documentation, PR): Fix typo in threshold syntax documentation
+* [#5668](https://github.com/icinga/icinga2/issues/5668) (Documentation, PR): Enhance Monitoring Basics in the documentation
+* [#5667](https://github.com/icinga/icinga2/issues/5667) (Documentation): Explain which values can be used for set\_if in command arguments
+* [#5666](https://github.com/icinga/icinga2/issues/5666) (Documentation): Explain the notification with users defined on host/service in a dedicated docs chapter
+* [#5665](https://github.com/icinga/icinga2/issues/5665) (Documentation): Better explanations and iteration details for "apply for" documentation
+* [#5664](https://github.com/icinga/icinga2/issues/5664) (Documentation): Add usage examples to the "apply" chapter based on custom attribute values
+* [#5663](https://github.com/icinga/icinga2/issues/5663) (Documentation): Explain custom attribute value types and nested dictionaries
+* [#5662](https://github.com/icinga/icinga2/issues/5662) (Documentation): Explain how to use a different host check command
+* [#5655](https://github.com/icinga/icinga2/issues/5655) (Documentation, PR): Enhance documentation with more details on value types for object attributes
+* [#5576](https://github.com/icinga/icinga2/issues/5576) (Documentation, PR): Fixed downtime example in documentation
+* [#5568](https://github.com/icinga/icinga2/issues/5568) (Documentation, PR): Add documentation for multi-line plugin output for API actions
+* [#5511](https://github.com/icinga/icinga2/issues/5511) (Cluster, Documentation, Windows): SSL errors with leading zeros in certificate serials \(created \< v2.4\) with OpenSSL 1.1.0
+* [#5379](https://github.com/icinga/icinga2/issues/5379) (Documentation, PR): Set shell prompt for commands to be \#
+* [#5186](https://github.com/icinga/icinga2/issues/5186) (Documentation): Document boolean values understood by set\_if
+* [#5060](https://github.com/icinga/icinga2/issues/5060) (Documentation): Missing documentation for macro\(\)
+* [#4015](https://github.com/icinga/icinga2/issues/4015) (Documentation): Add documentation for host state calculation from plugin exit codes
 
 ### Support
 
-* [#5765](https://github.com/Icinga/icinga2/issues/5765) (Configuration, PR): Fix default configuration example for ElasticsearchWriter
-* [#5739](https://github.com/Icinga/icinga2/issues/5739) (Performance Data, PR): Rename ElasticWriter to ElasticsearchWriter
-* [#5732](https://github.com/Icinga/icinga2/issues/5732) (Check Execution, DB IDO, PR): Fix flapping calculation and events
-* [#5730](https://github.com/Icinga/icinga2/issues/5730) (PR): Add missing trims to GetMasterHostPort and remove Convert.ToString from variables that are strings already
-* [#5719](https://github.com/Icinga/icinga2/issues/5719) (Cluster, Installation, Windows, PR): Update Windows Wizard for 2.8 and new signing methods
-* [#5687](https://github.com/Icinga/icinga2/issues/5687) (Cluster, Log, PR): Improve error message for unknown cluster message functions
-* [#5686](https://github.com/Icinga/icinga2/issues/5686) (Log): Ugly stacktrace with mismatching versions in cluster
-* [#5643](https://github.com/Icinga/icinga2/issues/5643) (PR): Fix debug builds on Apple Clang 9.0.0 \(macOS High Sierra\)
-* [#5637](https://github.com/Icinga/icinga2/issues/5637) (InfluxDB, PR): Fix unnecessary String\(\) casts in InfluxdbWriter
-* [#5629](https://github.com/Icinga/icinga2/issues/5629) (InfluxDB, Performance Data, code-quality): Remove the unnecessary String\(\) casts in influxdbwriter.cpp
-* [#5624](https://github.com/Icinga/icinga2/issues/5624) (PR): Fixed missing include statement in unit test
-* [#5619](https://github.com/Icinga/icinga2/issues/5619) (Packages, PR): Exit early in changelog.py if GitHub API fetch fails
-* [#5616](https://github.com/Icinga/icinga2/issues/5616) (PR): Fix a build warning
-* [#5608](https://github.com/Icinga/icinga2/issues/5608) (CLI, Cluster, PR): Fix certificate paths for installers
-* [#5604](https://github.com/Icinga/icinga2/issues/5604) (Packages, PR): Remove the icinga2-classicui-package and update documentation
-* [#5601](https://github.com/Icinga/icinga2/issues/5601) (Installation, Packages, PR): Ensure that the cache directory always is set and add a note to upgrading docs
-* [#5563](https://github.com/Icinga/icinga2/issues/5563) (Cluster, PR): Implement additional logging for the JsonRpc class
-* [#5545](https://github.com/Icinga/icinga2/issues/5545) (Installation, Windows, PR): Add Edit button to Windows Setup Wizard
-* [#5488](https://github.com/Icinga/icinga2/issues/5488) (code-quality, PR): Implement additional functions for printing values with LLDB/GDB
-* [#5486](https://github.com/Icinga/icinga2/issues/5486) (Graphite, PR): Graphite: Remove deprecated legacy schema mode
-* [#5301](https://github.com/Icinga/icinga2/issues/5301) (Installation, Packages): Remove the icinga2-classicui-config package
-* [#5258](https://github.com/Icinga/icinga2/issues/5258) (Installation, PR): Fix clang compiler detection on Fedora and macOS
-* [#4992](https://github.com/Icinga/icinga2/issues/4992) (Graphite): Remove deprecated GraphiteWriter feature enable\_legacy\_mode
-* [#4982](https://github.com/Icinga/icinga2/issues/4982) (Notifications, Tests): Verify and fix flapping detection
+* [#5765](https://github.com/icinga/icinga2/issues/5765) (Configuration, PR): Fix default configuration example for ElasticsearchWriter
+* [#5739](https://github.com/icinga/icinga2/issues/5739) (Metrics, PR): Rename ElasticWriter to ElasticsearchWriter
+* [#5732](https://github.com/icinga/icinga2/issues/5732) (Check Execution, DB IDO, PR): Fix flapping calculation and events
+* [#5730](https://github.com/icinga/icinga2/issues/5730) (PR): Add missing trims to GetMasterHostPort and remove Convert.ToString from variables that are strings already
+* [#5719](https://github.com/icinga/icinga2/issues/5719) (Cluster, Installation, Windows, PR): Update Windows Wizard for 2.8 and new signing methods
+* [#5687](https://github.com/icinga/icinga2/issues/5687) (Cluster, Log, PR): Improve error message for unknown cluster message functions
+* [#5686](https://github.com/icinga/icinga2/issues/5686) (Log): Ugly stacktrace with mismatching versions in cluster
+* [#5643](https://github.com/icinga/icinga2/issues/5643) (PR): Fix debug builds on Apple Clang 9.0.0 \(macOS High Sierra\)
+* [#5637](https://github.com/icinga/icinga2/issues/5637) (InfluxDB, PR): Fix unnecessary String\(\) casts in InfluxdbWriter
+* [#5629](https://github.com/icinga/icinga2/issues/5629) (InfluxDB, Metrics, code-quality): Remove the unnecessary String\(\) casts in influxdbwriter.cpp
+* [#5624](https://github.com/icinga/icinga2/issues/5624) (PR): Fixed missing include statement in unit test
+* [#5619](https://github.com/icinga/icinga2/issues/5619) (Packages, PR): Exit early in changelog.py if GitHub API fetch fails
+* [#5616](https://github.com/icinga/icinga2/issues/5616) (PR): Fix a build warning
+* [#5608](https://github.com/icinga/icinga2/issues/5608) (CLI, Cluster, PR): Fix certificate paths for installers
+* [#5604](https://github.com/icinga/icinga2/issues/5604) (Packages, PR): Remove the icinga2-classicui-package and update documentation
+* [#5601](https://github.com/icinga/icinga2/issues/5601) (Installation, Packages, PR): Ensure that the cache directory always is set and add a note to upgrading docs
+* [#5563](https://github.com/icinga/icinga2/issues/5563) (Cluster, PR): Implement additional logging for the JsonRpc class
+* [#5545](https://github.com/icinga/icinga2/issues/5545) (Installation, Windows, PR): Add Edit button to Windows Setup Wizard
+* [#5488](https://github.com/icinga/icinga2/issues/5488) (code-quality, PR): Implement additional functions for printing values with LLDB/GDB
+* [#5486](https://github.com/icinga/icinga2/issues/5486) (Graphite, PR): Graphite: Remove deprecated legacy schema mode
+* [#5301](https://github.com/icinga/icinga2/issues/5301) (Installation, Packages): Remove the icinga2-classicui-config package
+* [#5258](https://github.com/icinga/icinga2/issues/5258) (Installation, PR): Fix clang compiler detection on Fedora and macOS
+* [#4992](https://github.com/icinga/icinga2/issues/4992) (Graphite): Remove deprecated GraphiteWriter feature enable\_legacy\_mode
+* [#4982](https://github.com/icinga/icinga2/issues/4982) (Notifications, Tests): Verify and fix flapping detection
 
 ## 2.7.2 (2017-11-09)
 
@@ -208,20 +260,20 @@
 
 ### Bug
 
-* [#5636](https://github.com/Icinga/icinga2/issues/5636) (DB IDO, PR): Fix unique constraint matching for UPDATE downtime/comment runtime tables in DB IDO
-* [#5623](https://github.com/Icinga/icinga2/issues/5623) (DB IDO): Duplicate Key on MySQL after upgrading to v2.7.1
-* [#5603](https://github.com/Icinga/icinga2/issues/5603) (DB IDO): Icinga 2.7.1 IDO Unique Key Constraint Violation with PostgreSQL
+* [#5636](https://github.com/icinga/icinga2/issues/5636) (DB IDO, PR): Fix unique constraint matching for UPDATE downtime/comment runtime tables in DB IDO
+* [#5623](https://github.com/icinga/icinga2/issues/5623) (DB IDO): Duplicate Key on MySQL after upgrading to v2.7.1
+* [#5603](https://github.com/icinga/icinga2/issues/5603) (DB IDO): Icinga 2.7.1 IDO Unique Key Constraint Violation with PostgreSQL
 
 ### Documentation
 
-* [#5653](https://github.com/Icinga/icinga2/issues/5653) (Documentation, PR): Docs: Fix default value for `snmp\_nocrypt` for Manubulon CheckCommand definitions
-* [#5652](https://github.com/Icinga/icinga2/issues/5652) (Documentation, PR): Docs: Fix missing default value for cluster-zone checks
-* [#5632](https://github.com/Icinga/icinga2/issues/5632) (Documentation, PR): Docs: Mention SELinux in Getting Started chapter
+* [#5653](https://github.com/icinga/icinga2/issues/5653) (Documentation, PR): Docs: Fix default value for `snmp\_nocrypt` for Manubulon CheckCommand definitions
+* [#5652](https://github.com/icinga/icinga2/issues/5652) (Documentation, PR): Docs: Fix missing default value for cluster-zone checks
+* [#5632](https://github.com/icinga/icinga2/issues/5632) (Documentation, PR): Docs: Mention SELinux in Getting Started chapter
 
 ### Support
 
-* [#5736](https://github.com/Icinga/icinga2/issues/5736) (Packages, PR): Remove spec file
-* [#5612](https://github.com/Icinga/icinga2/issues/5612) (Documentation, Packages, PR): Improve documentation and systemd config on TaskMax
+* [#5736](https://github.com/icinga/icinga2/issues/5736) (Packages, PR): Remove spec file
+* [#5612](https://github.com/icinga/icinga2/issues/5612) (Documentation, Packages, PR): Improve documentation and systemd config on TaskMax
 
 ## 2.7.1 (2017-09-21)
 
@@ -237,69 +289,69 @@
 
 ### Enhancement
 
-* [#5523](https://github.com/Icinga/icinga2/issues/5523) (Cluster, Log, PR): Enhance client connect/sync logging and include bytes/zone in logs
-* [#5474](https://github.com/Icinga/icinga2/issues/5474) (Notifications, PR): Notification scripts - make HOSTADDRESS optional
-* [#5468](https://github.com/Icinga/icinga2/issues/5468) (Notifications, PR): Make notification mails more readable. Remove redundancy and cruft.
+* [#5523](https://github.com/icinga/icinga2/issues/5523) (Cluster, Log, PR): Enhance client connect/sync logging and include bytes/zone in logs
+* [#5474](https://github.com/icinga/icinga2/issues/5474) (Notifications, PR): Notification scripts - make HOSTADDRESS optional
+* [#5468](https://github.com/icinga/icinga2/issues/5468) (Notifications, PR): Make notification mails more readable. Remove redundancy and cruft.
 
 ### Bug
 
-* [#5585](https://github.com/Icinga/icinga2/issues/5585) (DB IDO, PR): Fix where clause for non-matching {downtime,comment}history IDO database updates
-* [#5566](https://github.com/Icinga/icinga2/issues/5566) (Cluster, Log, PR): Logs: Change config sync update to highlight an information, not an error
-* [#5539](https://github.com/Icinga/icinga2/issues/5539) (Plugins, Windows, PR): check\_nscp\_api: Allow arguments containing spaces
-* [#5537](https://github.com/Icinga/icinga2/issues/5537) (Plugins): check\_nscp\_api: support spaces in query arguments
-* [#5524](https://github.com/Icinga/icinga2/issues/5524) (Cluster, PR): Change FIFO::Optimize\(\) frequency for large messages
-* [#5513](https://github.com/Icinga/icinga2/issues/5513) (Cluster): Node in Cluster loses connection
-* [#5504](https://github.com/Icinga/icinga2/issues/5504) (InfluxDB, PR): Fix TLS Race Connecting to InfluxDB
-* [#5503](https://github.com/Icinga/icinga2/issues/5503) (Livestatus, PR): Fix grouping for Livestatus queries with 'Stats'
-* [#5502](https://github.com/Icinga/icinga2/issues/5502) (Notifications, PR): Fix duplicate variable in notification scripts
-* [#5495](https://github.com/Icinga/icinga2/issues/5495) (Notifications, PR): Fix parameter order for AcknowledgeSvcProblem / AcknowledgeHostProblem / apiactions:AcknowledgeProblem
-* [#5492](https://github.com/Icinga/icinga2/issues/5492) (DB IDO): Comments may not be removed correctly
-* [#5484](https://github.com/Icinga/icinga2/issues/5484) (Log): Timestamp comparison of config files logs a wrong message
-* [#5483](https://github.com/Icinga/icinga2/issues/5483) (DB IDO, PR): Fix config validation for DB IDO categories 'DbCatEverything'
-* [#5469](https://github.com/Icinga/icinga2/issues/5469) (InfluxDB): Failure to connect to InfluxDB increases CPU utilisation by 100%  for every failure
-* [#5466](https://github.com/Icinga/icinga2/issues/5466) (DB IDO, PR): DB IDO: Fix host's unreachable state in history tables
-* [#5460](https://github.com/Icinga/icinga2/issues/5460) (InfluxDB): Icinga 2.7 InfluxdbWriter fails to write metrics to InfluxDB over HTTPS
-* [#5458](https://github.com/Icinga/icinga2/issues/5458) (DB IDO): IDO donwtimehistory records orphaned from scheduleddowntime records following restart
-* [#5405](https://github.com/Icinga/icinga2/issues/5405) (DB IDO): IDO statehistory table does not show hosts going to "UNREACHABLE" state.
-* [#5078](https://github.com/Icinga/icinga2/issues/5078) (Compat, Livestatus): Livestatus hostsbygroup and servicesbyhostgroup do not work
+* [#5585](https://github.com/icinga/icinga2/issues/5585) (DB IDO, PR): Fix where clause for non-matching {downtime,comment}history IDO database updates
+* [#5566](https://github.com/icinga/icinga2/issues/5566) (Cluster, Log, PR): Logs: Change config sync update to highlight an information, not an error
+* [#5539](https://github.com/icinga/icinga2/issues/5539) (Plugins, Windows, PR): check\_nscp\_api: Allow arguments containing spaces
+* [#5537](https://github.com/icinga/icinga2/issues/5537) (Plugins): check\_nscp\_api: support spaces in query arguments
+* [#5524](https://github.com/icinga/icinga2/issues/5524) (Cluster, PR): Change FIFO::Optimize\(\) frequency for large messages
+* [#5513](https://github.com/icinga/icinga2/issues/5513) (Cluster): Node in Cluster loses connection
+* [#5504](https://github.com/icinga/icinga2/issues/5504) (InfluxDB, PR): Fix TLS Race Connecting to InfluxDB
+* [#5503](https://github.com/icinga/icinga2/issues/5503) (Livestatus, PR): Fix grouping for Livestatus queries with 'Stats'
+* [#5502](https://github.com/icinga/icinga2/issues/5502) (Notifications, PR): Fix duplicate variable in notification scripts
+* [#5495](https://github.com/icinga/icinga2/issues/5495) (Notifications, PR): Fix parameter order for AcknowledgeSvcProblem / AcknowledgeHostProblem / apiactions:AcknowledgeProblem
+* [#5492](https://github.com/icinga/icinga2/issues/5492) (DB IDO): Comments may not be removed correctly
+* [#5484](https://github.com/icinga/icinga2/issues/5484) (Log): Timestamp comparison of config files logs a wrong message
+* [#5483](https://github.com/icinga/icinga2/issues/5483) (DB IDO, PR): Fix config validation for DB IDO categories 'DbCatEverything'
+* [#5469](https://github.com/icinga/icinga2/issues/5469) (InfluxDB): Failure to connect to InfluxDB increases CPU utilisation by 100%  for every failure
+* [#5466](https://github.com/icinga/icinga2/issues/5466) (DB IDO, PR): DB IDO: Fix host's unreachable state in history tables
+* [#5460](https://github.com/icinga/icinga2/issues/5460) (InfluxDB): Icinga 2.7 InfluxdbWriter fails to write metrics to InfluxDB over HTTPS
+* [#5458](https://github.com/icinga/icinga2/issues/5458) (DB IDO): IDO donwtimehistory records orphaned from scheduleddowntime records following restart
+* [#5405](https://github.com/icinga/icinga2/issues/5405) (DB IDO): IDO statehistory table does not show hosts going to "UNREACHABLE" state.
+* [#5078](https://github.com/icinga/icinga2/issues/5078) (Compat, Livestatus): Livestatus hostsbygroup and servicesbyhostgroup do not work
 
 ### ITL
 
-* [#5543](https://github.com/Icinga/icinga2/issues/5543) (ITL, PR): ITL: Correct arguments for ipmi-sensor CheckCommand
+* [#5543](https://github.com/icinga/icinga2/issues/5543) (ITL, PR): ITL: Correct arguments for ipmi-sensor CheckCommand
 
 ### Documentation
 
-* [#5594](https://github.com/Icinga/icinga2/issues/5594) (Documentation, PR): Docs: Enhance certificate and configuration troubleshooting chapter
-* [#5593](https://github.com/Icinga/icinga2/issues/5593) (Documentation, PR): Docs: Add a note for upgrading to 2.7
-* [#5583](https://github.com/Icinga/icinga2/issues/5583) (Documentation, PR): Docs: Add example for Windows service monitoring with check\_nscp\_api
-* [#5582](https://github.com/Icinga/icinga2/issues/5582) (Documentation, PR): Docs: Add firewall details for check\_nscp\_api
-* [#5549](https://github.com/Icinga/icinga2/issues/5549) (Documentation, PR): Fix cli command used to enable debuglog feature on windows
-* [#5536](https://github.com/Icinga/icinga2/issues/5536) (Documentation, PR): Fixed nscp-disk service example
-* [#5522](https://github.com/Icinga/icinga2/issues/5522) (Documentation, PR): Docs: Update freshness checks; add chapter for external check results
-* [#5516](https://github.com/Icinga/icinga2/issues/5516) (Documentation, PR): Updates the install dependencies for Debian 9 'stretch'
-* [#5506](https://github.com/Icinga/icinga2/issues/5506) (Documentation, PR): Docs: Fix wrong parameter for ITL CheckCommand nscp\_api
-* [#5496](https://github.com/Icinga/icinga2/issues/5496) (Documentation, PR): Docs: Update examples for match/regex/cidr\_match and mode for arrays \(Match{All,Any}\)
-* [#5494](https://github.com/Icinga/icinga2/issues/5494) (Documentation, PR): Docs: Add section for multiple template imports
-* [#5491](https://github.com/Icinga/icinga2/issues/5491) (Documentation, PR): Update "Getting Started" documentation with Alpine Linux
-* [#5487](https://github.com/Icinga/icinga2/issues/5487) (Documentation, PR): Docs: Enhance Troubleshooting with nscp-local, check\_source, wrong thresholds
-* [#5476](https://github.com/Icinga/icinga2/issues/5476) (Documentation, PR): Docs: Fix ITL chapter TOC; add introduction with mini TOC
-* [#5475](https://github.com/Icinga/icinga2/issues/5475) (Documentation, PR): Docs: Add a note on required configuration updates for new notification scripts in v2.7.0
-* [#5461](https://github.com/Icinga/icinga2/issues/5461) (Documentation, PR): Update Icinga repository release rpm location
-* [#5457](https://github.com/Icinga/icinga2/issues/5457) (Documentation, PR): Add Changelog generation script for GitHub API
-* [#5428](https://github.com/Icinga/icinga2/issues/5428) (Documentation): "Plugin Check Commands" section inside ITL docs needs adjustments
+* [#5594](https://github.com/icinga/icinga2/issues/5594) (Documentation, PR): Docs: Enhance certificate and configuration troubleshooting chapter
+* [#5593](https://github.com/icinga/icinga2/issues/5593) (Documentation, PR): Docs: Add a note for upgrading to 2.7
+* [#5583](https://github.com/icinga/icinga2/issues/5583) (Documentation, PR): Docs: Add example for Windows service monitoring with check\_nscp\_api
+* [#5582](https://github.com/icinga/icinga2/issues/5582) (Documentation, PR): Docs: Add firewall details for check\_nscp\_api
+* [#5549](https://github.com/icinga/icinga2/issues/5549) (Documentation, PR): Fix cli command used to enable debuglog feature on windows
+* [#5536](https://github.com/icinga/icinga2/issues/5536) (Documentation, PR): Fixed nscp-disk service example
+* [#5522](https://github.com/icinga/icinga2/issues/5522) (Documentation, PR): Docs: Update freshness checks; add chapter for external check results
+* [#5516](https://github.com/icinga/icinga2/issues/5516) (Documentation, PR): Updates the install dependencies for Debian 9 'stretch'
+* [#5506](https://github.com/icinga/icinga2/issues/5506) (Documentation, PR): Docs: Fix wrong parameter for ITL CheckCommand nscp\_api
+* [#5496](https://github.com/icinga/icinga2/issues/5496) (Documentation, PR): Docs: Update examples for match/regex/cidr\_match and mode for arrays \(Match{All,Any}\)
+* [#5494](https://github.com/icinga/icinga2/issues/5494) (Documentation, PR): Docs: Add section for multiple template imports
+* [#5491](https://github.com/icinga/icinga2/issues/5491) (Documentation, PR): Update "Getting Started" documentation with Alpine Linux
+* [#5487](https://github.com/icinga/icinga2/issues/5487) (Documentation, PR): Docs: Enhance Troubleshooting with nscp-local, check\_source, wrong thresholds
+* [#5476](https://github.com/icinga/icinga2/issues/5476) (Documentation, PR): Docs: Fix ITL chapter TOC; add introduction with mini TOC
+* [#5475](https://github.com/icinga/icinga2/issues/5475) (Documentation, PR): Docs: Add a note on required configuration updates for new notification scripts in v2.7.0
+* [#5461](https://github.com/icinga/icinga2/issues/5461) (Documentation, PR): Update Icinga repository release rpm location
+* [#5457](https://github.com/icinga/icinga2/issues/5457) (Documentation, PR): Add Changelog generation script for GitHub API
+* [#5428](https://github.com/icinga/icinga2/issues/5428) (Documentation): "Plugin Check Commands" section inside ITL docs needs adjustments
 
 ### Support
 
-* [#5599](https://github.com/Icinga/icinga2/issues/5599) (PR): changelog.py: Add "backported" to the list of ignored labels
-* [#5590](https://github.com/Icinga/icinga2/issues/5590) (Cluster, Log, PR): Silence log level for configuration file updates
-* [#5529](https://github.com/Icinga/icinga2/issues/5529) (Log, PR): Change two more loglines for checkables so checkable is quoted
-* [#5528](https://github.com/Icinga/icinga2/issues/5528) (Log, PR): Change loglines for checkables so checkable is quoted
-* [#5501](https://github.com/Icinga/icinga2/issues/5501) (Installation, Packages, PR): SELinux: fixes for 2.7.0
-* [#5479](https://github.com/Icinga/icinga2/issues/5479) (Packages): Icinga2 2.7.0 requires SELinux boolean icinga2\_can\_connect\_all on CentOS 7 even for default port
-* [#5477](https://github.com/Icinga/icinga2/issues/5477) (Installation, Packages, PR): Systemd: Add DefaultTasksMax=infinity to service file
-* [#5392](https://github.com/Icinga/icinga2/issues/5392) (Packages, PR): Ensure the cache directory exists
-* [#4918](https://github.com/Icinga/icinga2/issues/4918) (Packages): cgroup: fork rejected by pids controller in /system.slice/icinga2.service
-* [#4414](https://github.com/Icinga/icinga2/issues/4414) (Packages): /usr/lib/icinga2/prepare-dirs does not create /var/cache/icinga2
+* [#5599](https://github.com/icinga/icinga2/issues/5599) (PR): changelog.py: Add "backported" to the list of ignored labels
+* [#5590](https://github.com/icinga/icinga2/issues/5590) (Cluster, Log, PR): Silence log level for configuration file updates
+* [#5529](https://github.com/icinga/icinga2/issues/5529) (Log, PR): Change two more loglines for checkables so checkable is quoted
+* [#5528](https://github.com/icinga/icinga2/issues/5528) (Log, PR): Change loglines for checkables so checkable is quoted
+* [#5501](https://github.com/icinga/icinga2/issues/5501) (Installation, Packages, PR): SELinux: fixes for 2.7.0
+* [#5479](https://github.com/icinga/icinga2/issues/5479) (Packages): Icinga2 2.7.0 requires SELinux boolean icinga2\_can\_connect\_all on CentOS 7 even for default port
+* [#5477](https://github.com/icinga/icinga2/issues/5477) (Installation, Packages, PR): Systemd: Add DefaultTasksMax=infinity to service file
+* [#5392](https://github.com/icinga/icinga2/issues/5392) (Packages, PR): Ensure the cache directory exists
+* [#4918](https://github.com/icinga/icinga2/issues/4918) (Packages): cgroup: fork rejected by pids controller in /system.slice/icinga2.service
+* [#4414](https://github.com/icinga/icinga2/issues/4414) (Packages): /usr/lib/icinga2/prepare-dirs does not create /var/cache/icinga2
 
 ## 2.7.0 (2017-08-02)
 
@@ -313,247 +365,247 @@
 
 ### Enhancement
 
-* [#5421](https://github.com/Icinga/icinga2/issues/5421) (Plugins, Windows, PR): Windows Plugins: Add new parameter to check\_disk to show used space
-* [#5348](https://github.com/Icinga/icinga2/issues/5348) (Configuration, PR): Implement support for handling exceptions in user scripts
-* [#5331](https://github.com/Icinga/icinga2/issues/5331) (Graylog, PR): GelfWriter: Add 'check\_command' to CHECK RESULT/\* NOTIFICATION/STATE CHANGE messages
-* [#5330](https://github.com/Icinga/icinga2/issues/5330) (Graphite, PR): GraphiteWriter: Add 'connected' to stats; fix reconnect exceptions
-* [#5329](https://github.com/Icinga/icinga2/issues/5329) (Graylog, PR): GelfWriter: Use async work queue and add feature metric stats
-* [#5320](https://github.com/Icinga/icinga2/issues/5320) (Configuration, PR): zones.conf: Add global-templates & director-global by default
-* [#5287](https://github.com/Icinga/icinga2/issues/5287) (Graphite, InfluxDB, Performance Data, PR): Use workqueues in Graphite and InfluxDB features
-* [#5284](https://github.com/Icinga/icinga2/issues/5284) (Check Execution, PR): Add feature stats to 'icinga' check as performance data metrics
-* [#5280](https://github.com/Icinga/icinga2/issues/5280) (API, Cluster, Log, PR): Implement WorkQueue metric stats and periodic logging
-* [#5266](https://github.com/Icinga/icinga2/issues/5266) (API, Cluster, PR): Add API & Cluster metric stats to /v1/status & icinga check incl. performance data
-* [#5264](https://github.com/Icinga/icinga2/issues/5264) (Configuration, PR): Implement new array match functionality
-* [#5247](https://github.com/Icinga/icinga2/issues/5247) (Log, PR): Add target object in cluster error messages to debug log
-* [#5246](https://github.com/Icinga/icinga2/issues/5246) (API, Cluster, PR): Add subjectAltName X509 ext for certificate requests
-* [#5242](https://github.com/Icinga/icinga2/issues/5242) (Configuration, PR): Allow expressions for the type in object/template declarations
-* [#5241](https://github.com/Icinga/icinga2/issues/5241) (InfluxDB, PR): Verbose InfluxDB Error Logging
-* [#5239](https://github.com/Icinga/icinga2/issues/5239) (Plugins, Windows, PR): Add NSCP API check plugin for NSClient++ HTTP API
-* [#5212](https://github.com/Icinga/icinga2/issues/5212) (Cluster, Log): Add additional logging for config sync
-* [#5145](https://github.com/Icinga/icinga2/issues/5145): Add a GitHub issue template
-* [#5133](https://github.com/Icinga/icinga2/issues/5133) (API, wishlist): ApiListener: Metrics for cluster data
-* [#5106](https://github.com/Icinga/icinga2/issues/5106) (Configuration): Add director-global as global zone to the default zones.conf configuration
-* [#4945](https://github.com/Icinga/icinga2/issues/4945) (API, Log): No hint for missing permissions in Icinga2 log for API user
-* [#4925](https://github.com/Icinga/icinga2/issues/4925): Update changelog generation scripts for GitHub
-* [#4411](https://github.com/Icinga/icinga2/issues/4411) (InfluxDB, Log, Performance Data): Better Debugging for InfluxdbWriter
-* [#4288](https://github.com/Icinga/icinga2/issues/4288) (Cluster, Log): Add check information to the debuglog when check result is discarded
-* [#4242](https://github.com/Icinga/icinga2/issues/4242) (Configuration): Default mail notification from header
-* [#3557](https://github.com/Icinga/icinga2/issues/3557) (Log): Log started and stopped features 
+* [#5421](https://github.com/icinga/icinga2/issues/5421) (Plugins, Windows, PR): Windows Plugins: Add new parameter to check\_disk to show used space
+* [#5348](https://github.com/icinga/icinga2/issues/5348) (Configuration, PR): Implement support for handling exceptions in user scripts
+* [#5331](https://github.com/icinga/icinga2/issues/5331) (Graylog, PR): GelfWriter: Add 'check\_command' to CHECK RESULT/\* NOTIFICATION/STATE CHANGE messages
+* [#5330](https://github.com/icinga/icinga2/issues/5330) (Graphite, PR): GraphiteWriter: Add 'connected' to stats; fix reconnect exceptions
+* [#5329](https://github.com/icinga/icinga2/issues/5329) (Graylog, PR): GelfWriter: Use async work queue and add feature metric stats
+* [#5320](https://github.com/icinga/icinga2/issues/5320) (Configuration, PR): zones.conf: Add global-templates & director-global by default
+* [#5287](https://github.com/icinga/icinga2/issues/5287) (Graphite, InfluxDB, Metrics, PR): Use workqueues in Graphite and InfluxDB features
+* [#5284](https://github.com/icinga/icinga2/issues/5284) (Check Execution, PR): Add feature stats to 'icinga' check as performance data metrics
+* [#5280](https://github.com/icinga/icinga2/issues/5280) (API, Cluster, Log, PR): Implement WorkQueue metric stats and periodic logging
+* [#5266](https://github.com/icinga/icinga2/issues/5266) (API, Cluster, PR): Add API & Cluster metric stats to /v1/status & icinga check incl. performance data
+* [#5264](https://github.com/icinga/icinga2/issues/5264) (Configuration, PR): Implement new array match functionality
+* [#5247](https://github.com/icinga/icinga2/issues/5247) (Log, PR): Add target object in cluster error messages to debug log
+* [#5246](https://github.com/icinga/icinga2/issues/5246) (API, Cluster, PR): Add subjectAltName X509 ext for certificate requests
+* [#5242](https://github.com/icinga/icinga2/issues/5242) (Configuration, PR): Allow expressions for the type in object/template declarations
+* [#5241](https://github.com/icinga/icinga2/issues/5241) (InfluxDB, PR): Verbose InfluxDB Error Logging
+* [#5239](https://github.com/icinga/icinga2/issues/5239) (Plugins, Windows, PR): Add NSCP API check plugin for NSClient++ HTTP API
+* [#5212](https://github.com/icinga/icinga2/issues/5212) (Cluster, Log): Add additional logging for config sync
+* [#5145](https://github.com/icinga/icinga2/issues/5145): Add a GitHub issue template
+* [#5133](https://github.com/icinga/icinga2/issues/5133) (API, wishlist): ApiListener: Metrics for cluster data
+* [#5106](https://github.com/icinga/icinga2/issues/5106) (Configuration): Add director-global as global zone to the default zones.conf configuration
+* [#4945](https://github.com/icinga/icinga2/issues/4945) (API, Log): No hint for missing permissions in Icinga2 log for API user
+* [#4925](https://github.com/icinga/icinga2/issues/4925): Update changelog generation scripts for GitHub
+* [#4411](https://github.com/icinga/icinga2/issues/4411) (InfluxDB, Log, Metrics): Better Debugging for InfluxdbWriter
+* [#4288](https://github.com/icinga/icinga2/issues/4288) (Cluster, Log): Add check information to the debuglog when check result is discarded
+* [#4242](https://github.com/icinga/icinga2/issues/4242) (Configuration): Default mail notification from header
+* [#3557](https://github.com/icinga/icinga2/issues/3557) (Log): Log started and stopped features 
 
 ### Bug
 
-* [#5433](https://github.com/Icinga/icinga2/issues/5433) (CLI, PR): Fix: update feature list help text
-* [#5367](https://github.com/Icinga/icinga2/issues/5367) (CLI, Crash): Unable to start icinga2 with kernel-3.10.0-514.21.2 RHEL7
-* [#5350](https://github.com/Icinga/icinga2/issues/5350) (Plugins): check\_nscp\_api not building on Debian wheezy
-* [#5316](https://github.com/Icinga/icinga2/issues/5316) (Livestatus, PR): Fix for stats min operator
-* [#5308](https://github.com/Icinga/icinga2/issues/5308) (Configuration, PR): Improve validation for attributes which must not be 'null'
-* [#5297](https://github.com/Icinga/icinga2/issues/5297) (PR): Fix compiler warnings
-* [#5295](https://github.com/Icinga/icinga2/issues/5295) (Notifications, PR): Fix missing apostrophe in notification log
-* [#5292](https://github.com/Icinga/icinga2/issues/5292) (PR): Build fix for OpenSSL 0.9.8 and stack\_st\_X509\_EXTENSION
-* [#5288](https://github.com/Icinga/icinga2/issues/5288) (Configuration): Hostgroup using assign for Host with groups = null segfault
-* [#5278](https://github.com/Icinga/icinga2/issues/5278) (PR): Build fix for I2\_LEAK\_DEBUG
-* [#5262](https://github.com/Icinga/icinga2/issues/5262) (Graylog, PR): Fix performance data processing in GelfWriter feature
-* [#5259](https://github.com/Icinga/icinga2/issues/5259) (API, PR): Don't allow acknowledgement expire timestamps in the past
-* [#5256](https://github.com/Icinga/icinga2/issues/5256) (Configuration): Config type changes break object serialization \(JsonEncode\)
-* [#5250](https://github.com/Icinga/icinga2/issues/5250) (API, Compat): Acknowledgement expire time in the past
-* [#5245](https://github.com/Icinga/icinga2/issues/5245) (Notifications, PR): Fix that host downtimes might be triggered even if their state is Up
-* [#5224](https://github.com/Icinga/icinga2/issues/5224) (Configuration, Notifications): Icinga sends notifications even though a Downtime object exists
-* [#5223](https://github.com/Icinga/icinga2/issues/5223) (Plugins, Windows): Wrong return Code for Windows ICMP
-* [#5219](https://github.com/Icinga/icinga2/issues/5219) (InfluxDB): InfluxDBWriter feature might block and leak memory
-* [#5211](https://github.com/Icinga/icinga2/issues/5211) (API, Cluster): Config received is always accepted by client even if own config is newer
-* [#5194](https://github.com/Icinga/icinga2/issues/5194) (API, CLI): No subjectAltName in Icinga CA created CSRs
-* [#5168](https://github.com/Icinga/icinga2/issues/5168) (Windows): include files from other volume/partition
-* [#5146](https://github.com/Icinga/icinga2/issues/5146) (Configuration): parsing of scheduled downtime object allow typing range instead of ranges
-* [#5132](https://github.com/Icinga/icinga2/issues/5132) (Graphite): GraphiteWriter can slow down Icinga's check result processing
-* [#5062](https://github.com/Icinga/icinga2/issues/5062) (Compat): icinga2 checkresults error
-* [#5043](https://github.com/Icinga/icinga2/issues/5043) (API): API POST request with 'attrs' as array returns bad\_cast error
-* [#5040](https://github.com/Icinga/icinga2/issues/5040) (Cluster): CRL loading fails due to incorrect return code check
-* [#5033](https://github.com/Icinga/icinga2/issues/5033) (DB IDO): Flexible downtimes which are not triggered must not update DB IDO's actual\_end\_time in downtimehistory table
-* [#4984](https://github.com/Icinga/icinga2/issues/4984) (API): Wrong response type when unauthorized
-* [#4983](https://github.com/Icinga/icinga2/issues/4983) (Livestatus): Typo in livestatus key worst\_services\_state for hostgroups table
-* [#4956](https://github.com/Icinga/icinga2/issues/4956) (DB IDO, PR): Fix persistent comments for Acknowledgements
-* [#4941](https://github.com/Icinga/icinga2/issues/4941) (Performance Data, PR): PerfData: Server Timeouts for InfluxDB Writer
-* [#4927](https://github.com/Icinga/icinga2/issues/4927) (InfluxDB, Performance Data): InfluxDbWriter error 500 hanging Icinga daemon
-* [#4913](https://github.com/Icinga/icinga2/issues/4913) (API): acknowledge-problem api sending notifications when notify is false
-* [#4909](https://github.com/Icinga/icinga2/issues/4909) (CLI): icinga2 feature disable fails on already disabled feature
-* [#4896](https://github.com/Icinga/icinga2/issues/4896) (Plugins): Windows Agent: performance data of check\_perfmon
-* [#4832](https://github.com/Icinga/icinga2/issues/4832) (API, Configuration): API max\_check\_attempts validation
-* [#4818](https://github.com/Icinga/icinga2/issues/4818): Acknowledgements marked with Persistent Comment are not honored
-* [#4779](https://github.com/Icinga/icinga2/issues/4779): Superflous error messages for non-exisiting lsb\_release/sw\_vers commands \(on NetBSD\)
-* [#4778](https://github.com/Icinga/icinga2/issues/4778): Fix for traditional glob\(3\) behaviour
-* [#4777](https://github.com/Icinga/icinga2/issues/4777): NetBSD execvpe.c fix
-* [#4709](https://github.com/Icinga/icinga2/issues/4709) (API): Posting config stage fails on FreeBSD
-* [#4696](https://github.com/Icinga/icinga2/issues/4696) (Notifications): Notifications are sent when reloading Icinga 2 even though they're deactivated via modified attributes
-* [#4666](https://github.com/Icinga/icinga2/issues/4666) (Graylog, Performance Data): GelfWriter with enable\_send\_perfdata breaks checks
-* [#4532](https://github.com/Icinga/icinga2/issues/4532) (Graylog, Performance Data): Icinga 2 "hangs" if the GelfWriter cannot send messages
-* [#4440](https://github.com/Icinga/icinga2/issues/4440) (DB IDO, Log): Exceptions might be better than exit in IDO
-* [#3664](https://github.com/Icinga/icinga2/issues/3664) (DB IDO): mysql\_error cannot be used for mysql\_init
-* [#3483](https://github.com/Icinga/icinga2/issues/3483) (Compat): Stacktrace on Command Pipe Error
-* [#3410](https://github.com/Icinga/icinga2/issues/3410) (Livestatus): Livestatus: Problem with stats min operator
-* [#121](https://github.com/Icinga/icinga2/issues/121) (CLI, PR): give only warnings if feature is already disabled
+* [#5433](https://github.com/icinga/icinga2/issues/5433) (CLI, PR): Fix: update feature list help text
+* [#5367](https://github.com/icinga/icinga2/issues/5367) (CLI, Crash): Unable to start icinga2 with kernel-3.10.0-514.21.2 RHEL7
+* [#5350](https://github.com/icinga/icinga2/issues/5350) (Plugins): check\_nscp\_api not building on Debian wheezy
+* [#5316](https://github.com/icinga/icinga2/issues/5316) (Livestatus, PR): Fix for stats min operator
+* [#5308](https://github.com/icinga/icinga2/issues/5308) (Configuration, PR): Improve validation for attributes which must not be 'null'
+* [#5297](https://github.com/icinga/icinga2/issues/5297) (PR): Fix compiler warnings
+* [#5295](https://github.com/icinga/icinga2/issues/5295) (Notifications, PR): Fix missing apostrophe in notification log
+* [#5292](https://github.com/icinga/icinga2/issues/5292) (PR): Build fix for OpenSSL 0.9.8 and stack\_st\_X509\_EXTENSION
+* [#5288](https://github.com/icinga/icinga2/issues/5288) (Configuration): Hostgroup using assign for Host with groups = null segfault
+* [#5278](https://github.com/icinga/icinga2/issues/5278) (PR): Build fix for I2\_LEAK\_DEBUG
+* [#5262](https://github.com/icinga/icinga2/issues/5262) (Graylog, PR): Fix performance data processing in GelfWriter feature
+* [#5259](https://github.com/icinga/icinga2/issues/5259) (API, PR): Don't allow acknowledgement expire timestamps in the past
+* [#5256](https://github.com/icinga/icinga2/issues/5256) (Configuration): Config type changes break object serialization \(JsonEncode\)
+* [#5250](https://github.com/icinga/icinga2/issues/5250) (API, Compat): Acknowledgement expire time in the past
+* [#5245](https://github.com/icinga/icinga2/issues/5245) (Notifications, PR): Fix that host downtimes might be triggered even if their state is Up
+* [#5224](https://github.com/icinga/icinga2/issues/5224) (Configuration, Notifications): Icinga sends notifications even though a Downtime object exists
+* [#5223](https://github.com/icinga/icinga2/issues/5223) (Plugins, Windows): Wrong return Code for Windows ICMP
+* [#5219](https://github.com/icinga/icinga2/issues/5219) (InfluxDB): InfluxDBWriter feature might block and leak memory
+* [#5211](https://github.com/icinga/icinga2/issues/5211) (API, Cluster): Config received is always accepted by client even if own config is newer
+* [#5194](https://github.com/icinga/icinga2/issues/5194) (API, CLI): No subjectAltName in Icinga CA created CSRs
+* [#5168](https://github.com/icinga/icinga2/issues/5168) (Windows): include files from other volume/partition
+* [#5146](https://github.com/icinga/icinga2/issues/5146) (Configuration): parsing of scheduled downtime object allow typing range instead of ranges
+* [#5132](https://github.com/icinga/icinga2/issues/5132) (Graphite): GraphiteWriter can slow down Icinga's check result processing
+* [#5062](https://github.com/icinga/icinga2/issues/5062) (Compat): icinga2 checkresults error
+* [#5043](https://github.com/icinga/icinga2/issues/5043) (API): API POST request with 'attrs' as array returns bad\_cast error
+* [#5040](https://github.com/icinga/icinga2/issues/5040) (Cluster): CRL loading fails due to incorrect return code check
+* [#5033](https://github.com/icinga/icinga2/issues/5033) (DB IDO): Flexible downtimes which are not triggered must not update DB IDO's actual\_end\_time in downtimehistory table
+* [#4984](https://github.com/icinga/icinga2/issues/4984) (API): Wrong response type when unauthorized
+* [#4983](https://github.com/icinga/icinga2/issues/4983) (Livestatus): Typo in livestatus key worst\_services\_state for hostgroups table
+* [#4956](https://github.com/icinga/icinga2/issues/4956) (DB IDO, PR): Fix persistent comments for Acknowledgements
+* [#4941](https://github.com/icinga/icinga2/issues/4941) (Metrics, PR): PerfData: Server Timeouts for InfluxDB Writer
+* [#4927](https://github.com/icinga/icinga2/issues/4927) (InfluxDB, Metrics): InfluxDbWriter error 500 hanging Icinga daemon
+* [#4913](https://github.com/icinga/icinga2/issues/4913) (API): acknowledge-problem api sending notifications when notify is false
+* [#4909](https://github.com/icinga/icinga2/issues/4909) (CLI): icinga2 feature disable fails on already disabled feature
+* [#4896](https://github.com/icinga/icinga2/issues/4896) (Plugins): Windows Agent: performance data of check\_perfmon
+* [#4832](https://github.com/icinga/icinga2/issues/4832) (API, Configuration): API max\_check\_attempts validation
+* [#4818](https://github.com/icinga/icinga2/issues/4818): Acknowledgements marked with Persistent Comment are not honored
+* [#4779](https://github.com/icinga/icinga2/issues/4779): Superflous error messages for non-exisiting lsb\_release/sw\_vers commands \(on NetBSD\)
+* [#4778](https://github.com/icinga/icinga2/issues/4778): Fix for traditional glob\(3\) behaviour
+* [#4777](https://github.com/icinga/icinga2/issues/4777): NetBSD execvpe.c fix
+* [#4709](https://github.com/icinga/icinga2/issues/4709) (API): Posting config stage fails on FreeBSD
+* [#4696](https://github.com/icinga/icinga2/issues/4696) (Notifications): Notifications are sent when reloading Icinga 2 even though they're deactivated via modified attributes
+* [#4666](https://github.com/icinga/icinga2/issues/4666) (Graylog, Metrics): GelfWriter with enable\_send\_perfdata breaks checks
+* [#4532](https://github.com/icinga/icinga2/issues/4532) (Graylog, Metrics): Icinga 2 "hangs" if the GelfWriter cannot send messages
+* [#4440](https://github.com/icinga/icinga2/issues/4440) (DB IDO, Log): Exceptions might be better than exit in IDO
+* [#3664](https://github.com/icinga/icinga2/issues/3664) (DB IDO): mysql\_error cannot be used for mysql\_init
+* [#3483](https://github.com/icinga/icinga2/issues/3483) (Compat): Stacktrace on Command Pipe Error
+* [#3410](https://github.com/icinga/icinga2/issues/3410) (Livestatus): Livestatus: Problem with stats min operator
+* [#121](https://github.com/icinga/icinga2/issues/121) (CLI, PR): give only warnings if feature is already disabled
 
 ### ITL
 
-* [#5384](https://github.com/Icinga/icinga2/issues/5384) (ITL, PR): Remove default value for 'dns\_query\_type'
-* [#5383](https://github.com/Icinga/icinga2/issues/5383) (ITL): Monitoring-Plugins check\_dns command does not support the `-q` flag
-* [#5372](https://github.com/Icinga/icinga2/issues/5372) (ITL, PR): Update ITL CheckCommand description attribute, part 2
-* [#5363](https://github.com/Icinga/icinga2/issues/5363) (ITL, PR): Update missing description attributes for ITL CheckCommand definitions
-* [#5347](https://github.com/Icinga/icinga2/issues/5347) (ITL, PR): Improve ITL CheckCommand description attribute
-* [#5344](https://github.com/Icinga/icinga2/issues/5344) (ITL, PR): Add ip4-or-ipv6 import to logstash ITL command
-* [#5343](https://github.com/Icinga/icinga2/issues/5343) (ITL): logstash ITL command misses import
-* [#5236](https://github.com/Icinga/icinga2/issues/5236) (ITL, PR): ITL: Add some missing arguments to ssl\_cert
-* [#5210](https://github.com/Icinga/icinga2/issues/5210) (ITL, PR): Add report mode to db2\_health
-* [#5170](https://github.com/Icinga/icinga2/issues/5170) (ITL, PR): Enhance mail notifications scripts and add support for command line parameters
-* [#5139](https://github.com/Icinga/icinga2/issues/5139) (ITL, PR): Add more options to ldap CheckCommand
-* [#5129](https://github.com/Icinga/icinga2/issues/5129) (ITL): Additional parameters for perfout manubulon scripts
-* [#5126](https://github.com/Icinga/icinga2/issues/5126) (ITL, PR): Added support to NRPE v2 in NRPE CheckCommand
-* [#5075](https://github.com/Icinga/icinga2/issues/5075) (ITL, PR): fix mitigation for nwc\_health
-* [#5063](https://github.com/Icinga/icinga2/issues/5063) (ITL, PR): Add additional arguments to mssql\_health
-* [#5046](https://github.com/Icinga/icinga2/issues/5046) (ITL): Add querytype to dns check
-* [#5019](https://github.com/Icinga/icinga2/issues/5019) (ITL, PR): Added CheckCommand definitions for SMART, RAID controller and IPMI ping check
-* [#5015](https://github.com/Icinga/icinga2/issues/5015) (ITL, PR): nwc\_health\_report attribute requires a value
-* [#4987](https://github.com/Icinga/icinga2/issues/4987) (ITL): Review `dummy` entry in ITL
-* [#4985](https://github.com/Icinga/icinga2/issues/4985) (ITL): Allow hpasm command from ITL to run in local mode
-* [#4964](https://github.com/Icinga/icinga2/issues/4964) (ITL, PR): ITL: check\_icmp: add missing TTL attribute
-* [#4839](https://github.com/Icinga/icinga2/issues/4839) (ITL): Remove deprecated dns\_expected\_answer attribute
-* [#4826](https://github.com/Icinga/icinga2/issues/4826) (ITL): Prepare icingacli-businessprocess for next release
-* [#4661](https://github.com/Icinga/icinga2/issues/4661) (ITL): ITL - check\_oracle\_health - report option to shorten output
-* [#124](https://github.com/Icinga/icinga2/issues/124) (ITL, PR): FreeBSD's /dev/fd can either be inside devfs, or be of type fdescfs.
-* [#123](https://github.com/Icinga/icinga2/issues/123) (ITL, PR): ITL: Update ipmi CheckCommand attributes 
-* [#120](https://github.com/Icinga/icinga2/issues/120) (ITL, PR): Add new parameter for check\_http: -L: Wrap output in HTML link
-* [#117](https://github.com/Icinga/icinga2/issues/117) (ITL, PR): Support --only-critical for check\_apt
-* [#115](https://github.com/Icinga/icinga2/issues/115) (ITL, PR): Inverse Interface Switch for snmp-interface
-* [#114](https://github.com/Icinga/icinga2/issues/114) (ITL, PR): Adding -A to snmp interfaces check
+* [#5384](https://github.com/icinga/icinga2/issues/5384) (ITL, PR): Remove default value for 'dns\_query\_type'
+* [#5383](https://github.com/icinga/icinga2/issues/5383) (ITL): Monitoring-Plugins check\_dns command does not support the `-q` flag
+* [#5372](https://github.com/icinga/icinga2/issues/5372) (ITL, PR): Update ITL CheckCommand description attribute, part 2
+* [#5363](https://github.com/icinga/icinga2/issues/5363) (ITL, PR): Update missing description attributes for ITL CheckCommand definitions
+* [#5347](https://github.com/icinga/icinga2/issues/5347) (ITL, PR): Improve ITL CheckCommand description attribute
+* [#5344](https://github.com/icinga/icinga2/issues/5344) (ITL, PR): Add ip4-or-ipv6 import to logstash ITL command
+* [#5343](https://github.com/icinga/icinga2/issues/5343) (ITL): logstash ITL command misses import
+* [#5236](https://github.com/icinga/icinga2/issues/5236) (ITL, PR): ITL: Add some missing arguments to ssl\_cert
+* [#5210](https://github.com/icinga/icinga2/issues/5210) (ITL, PR): Add report mode to db2\_health
+* [#5170](https://github.com/icinga/icinga2/issues/5170) (ITL, PR): Enhance mail notifications scripts and add support for command line parameters
+* [#5139](https://github.com/icinga/icinga2/issues/5139) (ITL, PR): Add more options to ldap CheckCommand
+* [#5129](https://github.com/icinga/icinga2/issues/5129) (ITL): Additional parameters for perfout manubulon scripts
+* [#5126](https://github.com/icinga/icinga2/issues/5126) (ITL, PR): Added support to NRPE v2 in NRPE CheckCommand
+* [#5075](https://github.com/icinga/icinga2/issues/5075) (ITL, PR): fix mitigation for nwc\_health
+* [#5063](https://github.com/icinga/icinga2/issues/5063) (ITL, PR): Add additional arguments to mssql\_health
+* [#5046](https://github.com/icinga/icinga2/issues/5046) (ITL): Add querytype to dns check
+* [#5019](https://github.com/icinga/icinga2/issues/5019) (ITL, PR): Added CheckCommand definitions for SMART, RAID controller and IPMI ping check
+* [#5015](https://github.com/icinga/icinga2/issues/5015) (ITL, PR): nwc\_health\_report attribute requires a value
+* [#4987](https://github.com/icinga/icinga2/issues/4987) (ITL): Review `dummy` entry in ITL
+* [#4985](https://github.com/icinga/icinga2/issues/4985) (ITL): Allow hpasm command from ITL to run in local mode
+* [#4964](https://github.com/icinga/icinga2/issues/4964) (ITL, PR): ITL: check\_icmp: add missing TTL attribute
+* [#4839](https://github.com/icinga/icinga2/issues/4839) (ITL): Remove deprecated dns\_expected\_answer attribute
+* [#4826](https://github.com/icinga/icinga2/issues/4826) (ITL): Prepare icingacli-businessprocess for next release
+* [#4661](https://github.com/icinga/icinga2/issues/4661) (ITL): ITL - check\_oracle\_health - report option to shorten output
+* [#124](https://github.com/icinga/icinga2/issues/124) (ITL, PR): FreeBSD's /dev/fd can either be inside devfs, or be of type fdescfs.
+* [#123](https://github.com/icinga/icinga2/issues/123) (ITL, PR): ITL: Update ipmi CheckCommand attributes 
+* [#120](https://github.com/icinga/icinga2/issues/120) (ITL, PR): Add new parameter for check\_http: -L: Wrap output in HTML link
+* [#117](https://github.com/icinga/icinga2/issues/117) (ITL, PR): Support --only-critical for check\_apt
+* [#115](https://github.com/icinga/icinga2/issues/115) (ITL, PR): Inverse Interface Switch for snmp-interface
+* [#114](https://github.com/icinga/icinga2/issues/114) (ITL, PR): Adding -A to snmp interfaces check
 
 ### Documentation
 
-* [#5448](https://github.com/Icinga/icinga2/issues/5448) (Documentation, PR): Update documentation for 2.7.0
-* [#5440](https://github.com/Icinga/icinga2/issues/5440) (Documentation, PR): Add missing notification state filter to documentation 
-* [#5425](https://github.com/Icinga/icinga2/issues/5425) (Documentation, PR): Fix formatting in API docs
-* [#5410](https://github.com/Icinga/icinga2/issues/5410) (Documentation): Update docs for better compatibility with mkdocs
-* [#5393](https://github.com/Icinga/icinga2/issues/5393) (Documentation, PR): Fix typo in the documentation
-* [#5378](https://github.com/Icinga/icinga2/issues/5378) (Documentation, PR): Fixed warnings when using mkdocs
-* [#5370](https://github.com/Icinga/icinga2/issues/5370) (Documentation, PR): Rename ChangeLog to CHANGELOG.md
-* [#5366](https://github.com/Icinga/icinga2/issues/5366) (Documentation, PR): Fixed wrong node in documentation chapter Client/Satellite Linux Setup
-* [#5365](https://github.com/Icinga/icinga2/issues/5365) (Documentation, PR): Update package documentation for Debian Stretch
-* [#5358](https://github.com/Icinga/icinga2/issues/5358) (Documentation, PR): Add documentation for securing mysql on Debian/Ubuntu.
-* [#5357](https://github.com/Icinga/icinga2/issues/5357) (Documentation, Notifications, PR): Notification Scripts: Ensure that mail from address works on Debian/RHEL/SUSE \(mailutils vs mailx\)
-* [#5354](https://github.com/Icinga/icinga2/issues/5354) (Documentation, PR): Docs: Fix built-in template description and URLs
-* [#5349](https://github.com/Icinga/icinga2/issues/5349) (Documentation, PR): Docs: Fix broken format for notes/tips in CLI command chapter
-* [#5339](https://github.com/Icinga/icinga2/issues/5339) (Documentation, ITL, PR): Add accept\_cname to dns CheckCommand
-* [#5336](https://github.com/Icinga/icinga2/issues/5336) (Documentation, PR): Docs: Fix formatting issues and broken URLs
-* [#5333](https://github.com/Icinga/icinga2/issues/5333) (Documentation, PR): Update documentation for enhanced notification scripts
-* [#5324](https://github.com/Icinga/icinga2/issues/5324) (Documentation, PR): Fix phrasing in Getting Started chapter
-* [#5317](https://github.com/Icinga/icinga2/issues/5317) (Documentation, PR): Fix typo in INSTALL.md
-* [#5315](https://github.com/Icinga/icinga2/issues/5315) (Documentation, PR): Docs: Replace nagios-plugins by monitoring-plugins for Debian/Ubuntu
-* [#5314](https://github.com/Icinga/icinga2/issues/5314) (Documentation, PR): Document Common name \(CN\) in client setup
-* [#5309](https://github.com/Icinga/icinga2/issues/5309) (Documentation, PR): Docs: Replace the command pipe w/ the REST API as Icinga Web 2 requirement in 'Getting Started' chapter
-* [#5291](https://github.com/Icinga/icinga2/issues/5291) (Documentation): Update docs for RHEL/CentOS 5 EOL
-* [#5285](https://github.com/Icinga/icinga2/issues/5285) (Documentation, PR): Fix sysstat installation in troubleshooting docs
-* [#5279](https://github.com/Icinga/icinga2/issues/5279) (Documentation, PR): Docs: Add API query example for acknowledgements w/o expire time
-* [#5275](https://github.com/Icinga/icinga2/issues/5275) (Documentation, PR): Add troubleshooting hints for cgroup fork errors
-* [#5244](https://github.com/Icinga/icinga2/issues/5244) (Documentation, PR): Add a PR review section to CONTRIBUTING.md
-* [#5237](https://github.com/Icinga/icinga2/issues/5237) (Documentation, PR): Docs: Add a note for Windows debuglog to the troubleshooting chapter
-* [#5227](https://github.com/Icinga/icinga2/issues/5227) (Documentation, ITL, PR): feature/itl-vmware-esx-storage-path-standbyok
-* [#5216](https://github.com/Icinga/icinga2/issues/5216) (Documentation, PR): Remove "... is is ..." in CONTRIBUTING.md
-* [#5206](https://github.com/Icinga/icinga2/issues/5206) (Documentation): Typo in Getting Started Guide
-* [#5203](https://github.com/Icinga/icinga2/issues/5203) (Documentation, PR): Fix typo in Getting Started chapter
-* [#5184](https://github.com/Icinga/icinga2/issues/5184) (Documentation, PR): Doc/appendix: fix malformed markdown links
-* [#5181](https://github.com/Icinga/icinga2/issues/5181) (Documentation, PR): List SELinux packages required for building RPMs
-* [#5178](https://github.com/Icinga/icinga2/issues/5178) (Documentation, Windows): Documentation vague on "update-windows" check plugin
-* [#5175](https://github.com/Icinga/icinga2/issues/5175) (Documentation): Add a note about flapping problems to the docs
-* [#5174](https://github.com/Icinga/icinga2/issues/5174) (Documentation, PR): Add missing object type to Apply Rules doc example
-* [#5173](https://github.com/Icinga/icinga2/issues/5173) (Documentation): Object type missing from ping Service example in docs
-* [#5167](https://github.com/Icinga/icinga2/issues/5167) (Documentation): Add more assign where expression examples
-* [#5166](https://github.com/Icinga/icinga2/issues/5166) (API, Documentation): Set zone attribute to no\_user\_modify for API POST requests
-* [#5165](https://github.com/Icinga/icinga2/issues/5165) (Documentation, PR): Syntax error In Dependencies chapter
-* [#5164](https://github.com/Icinga/icinga2/issues/5164) (Documentation, ITL, PR): ITL: Add CheckCommand ssl\_cert, fix ssl attributes
-* [#5161](https://github.com/Icinga/icinga2/issues/5161) (Documentation, PR): ITL documentation - disk-windows usage note with % thresholds
-* [#5157](https://github.com/Icinga/icinga2/issues/5157) (Documentation): "Three Levels with master, Satellites, and Clients" chapter is not clear about client config
-* [#5156](https://github.com/Icinga/icinga2/issues/5156) (Documentation): Add CONTRIBUTING.md
-* [#5155](https://github.com/Icinga/icinga2/issues/5155) (Documentation): 3.5. Apply Rules topic in the docs needs work.
-* [#5151](https://github.com/Icinga/icinga2/issues/5151) (Documentation, PR): Replace http:// links with https:// links where a secure website exists
-* [#5150](https://github.com/Icinga/icinga2/issues/5150) (Documentation): Invalid links in documentation
-* [#5149](https://github.com/Icinga/icinga2/issues/5149) (Documentation, PR): Update documentation, change http:// links to https:// links where a website exists
-* [#5144](https://github.com/Icinga/icinga2/issues/5144) (Documentation): Extend troubleshooting docs w/ environment analysis and common tools
-* [#5143](https://github.com/Icinga/icinga2/issues/5143) (Documentation): Docs: Explain how to include your own config tree instead of conf.d
-* [#5142](https://github.com/Icinga/icinga2/issues/5142) (Documentation): Add an Elastic Stack Integrations chapter to feature documentation
-* [#5140](https://github.com/Icinga/icinga2/issues/5140) (Documentation): Documentation should explain that runtime modifications are not immediately updated for "object list"
-* [#5137](https://github.com/Icinga/icinga2/issues/5137) (Documentation): Doc updates: Getting Started w/ own config, Troubleshooting w/ debug console
-* [#5111](https://github.com/Icinga/icinga2/issues/5111) (Documentation): Fix duration attribute requirement for schedule-downtime API action
-* [#5104](https://github.com/Icinga/icinga2/issues/5104) (Documentation, PR): Correct link to nscp documentation
-* [#5097](https://github.com/Icinga/icinga2/issues/5097) (Documentation): The last example for typeof\(\) is missing the result
-* [#5090](https://github.com/Icinga/icinga2/issues/5090) (Cluster, Documentation): EventHandler to be executed at the endpoint
-* [#5077](https://github.com/Icinga/icinga2/issues/5077) (Documentation): Replace the 'command' feature w/ the REST API for Icinga Web 2
-* [#5016](https://github.com/Icinga/icinga2/issues/5016) (Documentation, ITL, PR): Add fuse.gvfs-fuse-daemon to disk\_exclude\_type
-* [#5010](https://github.com/Icinga/icinga2/issues/5010) (Documentation): \[Documentation\] Missing parameter for SNMPv3 auth
-* [#3560](https://github.com/Icinga/icinga2/issues/3560) (Documentation): Explain check\_memorys and check\_disks thresholds
-* [#1880](https://github.com/Icinga/icinga2/issues/1880) (Documentation): add a section for 'monitoring the icinga2 node'
+* [#5448](https://github.com/icinga/icinga2/issues/5448) (Documentation, PR): Update documentation for 2.7.0
+* [#5440](https://github.com/icinga/icinga2/issues/5440) (Documentation, PR): Add missing notification state filter to documentation 
+* [#5425](https://github.com/icinga/icinga2/issues/5425) (Documentation, PR): Fix formatting in API docs
+* [#5410](https://github.com/icinga/icinga2/issues/5410) (Documentation): Update docs for better compatibility with mkdocs
+* [#5393](https://github.com/icinga/icinga2/issues/5393) (Documentation, PR): Fix typo in the documentation
+* [#5378](https://github.com/icinga/icinga2/issues/5378) (Documentation, PR): Fixed warnings when using mkdocs
+* [#5370](https://github.com/icinga/icinga2/issues/5370) (Documentation, PR): Rename ChangeLog to CHANGELOG.md
+* [#5366](https://github.com/icinga/icinga2/issues/5366) (Documentation, PR): Fixed wrong node in documentation chapter Client/Satellite Linux Setup
+* [#5365](https://github.com/icinga/icinga2/issues/5365) (Documentation, PR): Update package documentation for Debian Stretch
+* [#5358](https://github.com/icinga/icinga2/issues/5358) (Documentation, PR): Add documentation for securing mysql on Debian/Ubuntu.
+* [#5357](https://github.com/icinga/icinga2/issues/5357) (Documentation, Notifications, PR): Notification Scripts: Ensure that mail from address works on Debian/RHEL/SUSE \(mailutils vs mailx\)
+* [#5354](https://github.com/icinga/icinga2/issues/5354) (Documentation, PR): Docs: Fix built-in template description and URLs
+* [#5349](https://github.com/icinga/icinga2/issues/5349) (Documentation, PR): Docs: Fix broken format for notes/tips in CLI command chapter
+* [#5339](https://github.com/icinga/icinga2/issues/5339) (Documentation, ITL, PR): Add accept\_cname to dns CheckCommand
+* [#5336](https://github.com/icinga/icinga2/issues/5336) (Documentation, PR): Docs: Fix formatting issues and broken URLs
+* [#5333](https://github.com/icinga/icinga2/issues/5333) (Documentation, PR): Update documentation for enhanced notification scripts
+* [#5324](https://github.com/icinga/icinga2/issues/5324) (Documentation, PR): Fix phrasing in Getting Started chapter
+* [#5317](https://github.com/icinga/icinga2/issues/5317) (Documentation, PR): Fix typo in INSTALL.md
+* [#5315](https://github.com/icinga/icinga2/issues/5315) (Documentation, PR): Docs: Replace nagios-plugins by monitoring-plugins for Debian/Ubuntu
+* [#5314](https://github.com/icinga/icinga2/issues/5314) (Documentation, PR): Document Common name \(CN\) in client setup
+* [#5309](https://github.com/icinga/icinga2/issues/5309) (Documentation, PR): Docs: Replace the command pipe w/ the REST API as Icinga Web 2 requirement in 'Getting Started' chapter
+* [#5291](https://github.com/icinga/icinga2/issues/5291) (Documentation): Update docs for RHEL/CentOS 5 EOL
+* [#5285](https://github.com/icinga/icinga2/issues/5285) (Documentation, PR): Fix sysstat installation in troubleshooting docs
+* [#5279](https://github.com/icinga/icinga2/issues/5279) (Documentation, PR): Docs: Add API query example for acknowledgements w/o expire time
+* [#5275](https://github.com/icinga/icinga2/issues/5275) (Documentation, PR): Add troubleshooting hints for cgroup fork errors
+* [#5244](https://github.com/icinga/icinga2/issues/5244) (Documentation, PR): Add a PR review section to CONTRIBUTING.md
+* [#5237](https://github.com/icinga/icinga2/issues/5237) (Documentation, PR): Docs: Add a note for Windows debuglog to the troubleshooting chapter
+* [#5227](https://github.com/icinga/icinga2/issues/5227) (Documentation, ITL, PR): feature/itl-vmware-esx-storage-path-standbyok
+* [#5216](https://github.com/icinga/icinga2/issues/5216) (Documentation, PR): Remove "... is is ..." in CONTRIBUTING.md
+* [#5206](https://github.com/icinga/icinga2/issues/5206) (Documentation): Typo in Getting Started Guide
+* [#5203](https://github.com/icinga/icinga2/issues/5203) (Documentation, PR): Fix typo in Getting Started chapter
+* [#5184](https://github.com/icinga/icinga2/issues/5184) (Documentation, PR): Doc/appendix: fix malformed markdown links
+* [#5181](https://github.com/icinga/icinga2/issues/5181) (Documentation, PR): List SELinux packages required for building RPMs
+* [#5178](https://github.com/icinga/icinga2/issues/5178) (Documentation, Windows): Documentation vague on "update-windows" check plugin
+* [#5175](https://github.com/icinga/icinga2/issues/5175) (Documentation): Add a note about flapping problems to the docs
+* [#5174](https://github.com/icinga/icinga2/issues/5174) (Documentation, PR): Add missing object type to Apply Rules doc example
+* [#5173](https://github.com/icinga/icinga2/issues/5173) (Documentation): Object type missing from ping Service example in docs
+* [#5167](https://github.com/icinga/icinga2/issues/5167) (Documentation): Add more assign where expression examples
+* [#5166](https://github.com/icinga/icinga2/issues/5166) (API, Documentation): Set zone attribute to no\_user\_modify for API POST requests
+* [#5165](https://github.com/icinga/icinga2/issues/5165) (Documentation, PR): Syntax error In Dependencies chapter
+* [#5164](https://github.com/icinga/icinga2/issues/5164) (Documentation, ITL, PR): ITL: Add CheckCommand ssl\_cert, fix ssl attributes
+* [#5161](https://github.com/icinga/icinga2/issues/5161) (Documentation, PR): ITL documentation - disk-windows usage note with % thresholds
+* [#5157](https://github.com/icinga/icinga2/issues/5157) (Documentation): "Three Levels with master, Satellites, and Clients" chapter is not clear about client config
+* [#5156](https://github.com/icinga/icinga2/issues/5156) (Documentation): Add CONTRIBUTING.md
+* [#5155](https://github.com/icinga/icinga2/issues/5155) (Documentation): 3.5. Apply Rules topic in the docs needs work.
+* [#5151](https://github.com/icinga/icinga2/issues/5151) (Documentation, PR): Replace http:// links with https:// links where a secure website exists
+* [#5150](https://github.com/icinga/icinga2/issues/5150) (Documentation): Invalid links in documentation
+* [#5149](https://github.com/icinga/icinga2/issues/5149) (Documentation, PR): Update documentation, change http:// links to https:// links where a website exists
+* [#5144](https://github.com/icinga/icinga2/issues/5144) (Documentation): Extend troubleshooting docs w/ environment analysis and common tools
+* [#5143](https://github.com/icinga/icinga2/issues/5143) (Documentation): Docs: Explain how to include your own config tree instead of conf.d
+* [#5142](https://github.com/icinga/icinga2/issues/5142) (Documentation): Add an Elastic Stack Integrations chapter to feature documentation
+* [#5140](https://github.com/icinga/icinga2/issues/5140) (Documentation): Documentation should explain that runtime modifications are not immediately updated for "object list"
+* [#5137](https://github.com/icinga/icinga2/issues/5137) (Documentation): Doc updates: Getting Started w/ own config, Troubleshooting w/ debug console
+* [#5111](https://github.com/icinga/icinga2/issues/5111) (Documentation): Fix duration attribute requirement for schedule-downtime API action
+* [#5104](https://github.com/icinga/icinga2/issues/5104) (Documentation, PR): Correct link to nscp documentation
+* [#5097](https://github.com/icinga/icinga2/issues/5097) (Documentation): The last example for typeof\(\) is missing the result
+* [#5090](https://github.com/icinga/icinga2/issues/5090) (Cluster, Documentation): EventHandler to be executed at the endpoint
+* [#5077](https://github.com/icinga/icinga2/issues/5077) (Documentation): Replace the 'command' feature w/ the REST API for Icinga Web 2
+* [#5016](https://github.com/icinga/icinga2/issues/5016) (Documentation, ITL, PR): Add fuse.gvfs-fuse-daemon to disk\_exclude\_type
+* [#5010](https://github.com/icinga/icinga2/issues/5010) (Documentation): \[Documentation\] Missing parameter for SNMPv3 auth
+* [#3560](https://github.com/icinga/icinga2/issues/3560) (Documentation): Explain check\_memorys and check\_disks thresholds
+* [#1880](https://github.com/icinga/icinga2/issues/1880) (Documentation): add a section for 'monitoring the icinga2 node'
 
 ### Support
 
-* [#5359](https://github.com/Icinga/icinga2/issues/5359) (CLI, PR): Fixed missing closing bracket in CLI command pki new-cert.
-* [#5332](https://github.com/Icinga/icinga2/issues/5332) (Configuration, Notifications, PR): Notification Scripts: notification\_type is always required
-* [#5326](https://github.com/Icinga/icinga2/issues/5326) (Documentation, Installation, PR): Install the images directory containing the needed PNGs for the markd
-* [#5310](https://github.com/Icinga/icinga2/issues/5310) (Packages, PR): RPM: Disable SELinux policy hardlink
-* [#5306](https://github.com/Icinga/icinga2/issues/5306) (Documentation, Packages, PR): Remove CentOS 5 from 'Getting started' docs
-* [#5304](https://github.com/Icinga/icinga2/issues/5304) (Documentation, Packages, PR): Update INSTALL.md for RPM builds
-* [#5303](https://github.com/Icinga/icinga2/issues/5303) (Packages, PR): RPM: Fix builds on Amazon Linux
-* [#5299](https://github.com/Icinga/icinga2/issues/5299) (Notifications): Ensure that "mail from" works on RHEL/CentOS
-* [#5286](https://github.com/Icinga/icinga2/issues/5286) (Configuration, PR): Fix verbose mode in notifications scripts
-* [#5265](https://github.com/Icinga/icinga2/issues/5265) (PR): Move PerfdataValue\(\) class into base library
-* [#5252](https://github.com/Icinga/icinga2/issues/5252) (Tests, PR): travis: Update to trusty as CI environment
-* [#5251](https://github.com/Icinga/icinga2/issues/5251) (Tests): Update Travis CI environment to trusty
-* [#5248](https://github.com/Icinga/icinga2/issues/5248) (Tests, PR): Travis: Run config validation at the end
-* [#5238](https://github.com/Icinga/icinga2/issues/5238) (DB IDO, PR): Remove deprecated "DbCat1 | DbCat2" notation for DB IDO categories
-* [#5229](https://github.com/Icinga/icinga2/issues/5229) (Installation, PR): CMake: require a GCC version according to INSTALL.md
-* [#5226](https://github.com/Icinga/icinga2/issues/5226) (Packages, PR): RPM spec: don't enable features after an upgrade
-* [#5225](https://github.com/Icinga/icinga2/issues/5225) (DB IDO, PR): Don't call mysql\_error\(\) after a failure of mysql\_init\(\)
-* [#5218](https://github.com/Icinga/icinga2/issues/5218) (Packages): icinga2.spec: Allow selecting g++ compiler on older SUSE release builds
-* [#5189](https://github.com/Icinga/icinga2/issues/5189) (Documentation, Packages, PR): RPM packaging updates
-* [#5188](https://github.com/Icinga/icinga2/issues/5188) (Documentation, Packages): Boost \>= 1.48 required
-* [#5177](https://github.com/Icinga/icinga2/issues/5177) (Packages): Issues Packing icinga 2.6.3 tar.gz to RPM
-* [#5153](https://github.com/Icinga/icinga2/issues/5153) (Packages, PR): Changed dependency of selinux subpackage
-* [#5127](https://github.com/Icinga/icinga2/issues/5127) (Installation, PR): Improve systemd service file
-* [#5102](https://github.com/Icinga/icinga2/issues/5102) (Compat, Configuration, Packages): Deprecate the icinga2-classicui-config package
-* [#5101](https://github.com/Icinga/icinga2/issues/5101) (Packages, Windows): Fix incorrect metadata for the Chocolatey package
-* [#5100](https://github.com/Icinga/icinga2/issues/5100) (Packages, Windows): Update Chocolatey package to match current guidelines
-* [#5094](https://github.com/Icinga/icinga2/issues/5094) (Cluster, Configuration): Log message "Object cannot be deleted because it was not created using the API"
-* [#5087](https://github.com/Icinga/icinga2/issues/5087) (Configuration): Function metadata should show available arguments
-* [#5042](https://github.com/Icinga/icinga2/issues/5042) (DB IDO, PR): Add link to upgrade documentation to log message
-* [#4977](https://github.com/Icinga/icinga2/issues/4977) (Cluster, Installation): icinga2/api/log directory is not created
-* [#4921](https://github.com/Icinga/icinga2/issues/4921) (Installation, Packages): No network dependency for /etc/init.d/icinga2
-* [#4781](https://github.com/Icinga/icinga2/issues/4781) (Packages): Improve SELinux Policy
-* [#4776](https://github.com/Icinga/icinga2/issues/4776) (Installation): NetBSD install path fixes
-* [#4621](https://github.com/Icinga/icinga2/issues/4621) (Configuration, Notifications, Packages): notifications always enabled after update
+* [#5359](https://github.com/icinga/icinga2/issues/5359) (CLI, PR): Fixed missing closing bracket in CLI command pki new-cert.
+* [#5332](https://github.com/icinga/icinga2/issues/5332) (Configuration, Notifications, PR): Notification Scripts: notification\_type is always required
+* [#5326](https://github.com/icinga/icinga2/issues/5326) (Documentation, Installation, PR): Install the images directory containing the needed PNGs for the markd
+* [#5310](https://github.com/icinga/icinga2/issues/5310) (Packages, PR): RPM: Disable SELinux policy hardlink
+* [#5306](https://github.com/icinga/icinga2/issues/5306) (Documentation, Packages, PR): Remove CentOS 5 from 'Getting started' docs
+* [#5304](https://github.com/icinga/icinga2/issues/5304) (Documentation, Packages, PR): Update INSTALL.md for RPM builds
+* [#5303](https://github.com/icinga/icinga2/issues/5303) (Packages, PR): RPM: Fix builds on Amazon Linux
+* [#5299](https://github.com/icinga/icinga2/issues/5299) (Notifications): Ensure that "mail from" works on RHEL/CentOS
+* [#5286](https://github.com/icinga/icinga2/issues/5286) (Configuration, PR): Fix verbose mode in notifications scripts
+* [#5265](https://github.com/icinga/icinga2/issues/5265) (PR): Move PerfdataValue\(\) class into base library
+* [#5252](https://github.com/icinga/icinga2/issues/5252) (Tests, PR): travis: Update to trusty as CI environment
+* [#5251](https://github.com/icinga/icinga2/issues/5251) (Tests): Update Travis CI environment to trusty
+* [#5248](https://github.com/icinga/icinga2/issues/5248) (Tests, PR): Travis: Run config validation at the end
+* [#5238](https://github.com/icinga/icinga2/issues/5238) (DB IDO, PR): Remove deprecated "DbCat1 | DbCat2" notation for DB IDO categories
+* [#5229](https://github.com/icinga/icinga2/issues/5229) (Installation, PR): CMake: require a GCC version according to INSTALL.md
+* [#5226](https://github.com/icinga/icinga2/issues/5226) (Packages, PR): RPM spec: don't enable features after an upgrade
+* [#5225](https://github.com/icinga/icinga2/issues/5225) (DB IDO, PR): Don't call mysql\_error\(\) after a failure of mysql\_init\(\)
+* [#5218](https://github.com/icinga/icinga2/issues/5218) (Packages): icinga2.spec: Allow selecting g++ compiler on older SUSE release builds
+* [#5189](https://github.com/icinga/icinga2/issues/5189) (Documentation, Packages, PR): RPM packaging updates
+* [#5188](https://github.com/icinga/icinga2/issues/5188) (Documentation, Packages): Boost \>= 1.48 required
+* [#5177](https://github.com/icinga/icinga2/issues/5177) (Packages): Issues Packing icinga 2.6.3 tar.gz to RPM
+* [#5153](https://github.com/icinga/icinga2/issues/5153) (Packages, PR): Changed dependency of selinux subpackage
+* [#5127](https://github.com/icinga/icinga2/issues/5127) (Installation, PR): Improve systemd service file
+* [#5102](https://github.com/icinga/icinga2/issues/5102) (Compat, Configuration, Packages): Deprecate the icinga2-classicui-config package
+* [#5101](https://github.com/icinga/icinga2/issues/5101) (Packages, Windows): Fix incorrect metadata for the Chocolatey package
+* [#5100](https://github.com/icinga/icinga2/issues/5100) (Packages, Windows): Update Chocolatey package to match current guidelines
+* [#5094](https://github.com/icinga/icinga2/issues/5094) (Cluster, Configuration): Log message "Object cannot be deleted because it was not created using the API"
+* [#5087](https://github.com/icinga/icinga2/issues/5087) (Configuration): Function metadata should show available arguments
+* [#5042](https://github.com/icinga/icinga2/issues/5042) (DB IDO, PR): Add link to upgrade documentation to log message
+* [#4977](https://github.com/icinga/icinga2/issues/4977) (Cluster, Installation): icinga2/api/log directory is not created
+* [#4921](https://github.com/icinga/icinga2/issues/4921) (Installation, Packages): No network dependency for /etc/init.d/icinga2
+* [#4781](https://github.com/icinga/icinga2/issues/4781) (Packages): Improve SELinux Policy
+* [#4776](https://github.com/icinga/icinga2/issues/4776) (Installation): NetBSD install path fixes
+* [#4621](https://github.com/icinga/icinga2/issues/4621) (Configuration, Notifications, Packages): notifications always enabled after update
 
 ## 2.6.3 (2017-03-29)
 
 ### Bug
 
-* [#5080](https://github.com/Icinga/icinga2/issues/5080) (DB IDO): Missing index use can cause icinga\_downtimehistory queries to hang indefinitely
-* [#4989](https://github.com/Icinga/icinga2/issues/4989) (Check Execution): Icinga daemon runs with nice 5 after reload
-* [#4930](https://github.com/Icinga/icinga2/issues/4930) (Cluster): Change "Discarding 'config update object'" log messages to notice log level
-* [#4603](https://github.com/Icinga/icinga2/issues/4603) (DB IDO): With too many comments, Icinga reload process won't finish reconnecting to Database
+* [#5080](https://github.com/icinga/icinga2/issues/5080) (DB IDO): Missing index use can cause icinga\_downtimehistory queries to hang indefinitely
+* [#4989](https://github.com/icinga/icinga2/issues/4989) (Check Execution): Icinga daemon runs with nice 5 after reload
+* [#4930](https://github.com/icinga/icinga2/issues/4930) (Cluster): Change "Discarding 'config update object'" log messages to notice log level
+* [#4603](https://github.com/icinga/icinga2/issues/4603) (DB IDO): With too many comments, Icinga reload process won't finish reconnecting to Database
 
 ### Documentation
 
-* [#5057](https://github.com/Icinga/icinga2/issues/5057) (Documentation): Update Security section in the Distributed Monitoring chapter
-* [#5055](https://github.com/Icinga/icinga2/issues/5055) (Documentation, ITL): mysql\_socket attribute missing in the documentation for the mysql CheckCommand
-* [#5035](https://github.com/Icinga/icinga2/issues/5035) (Documentation): Docs: Typo in Distributed Monitoring chapter
-* [#5030](https://github.com/Icinga/icinga2/issues/5030) (Documentation): Advanced topics: Mention the API and explain stick acks, fixed/flexible downtimes
-* [#5029](https://github.com/Icinga/icinga2/issues/5029) (Documentation): Advanced topics: Wrong acknowledgement notification filter
-* [#4996](https://github.com/Icinga/icinga2/issues/4996) (Documentation): documentation: mixed up host names in 6-distributed-monitoring.md
-* [#4980](https://github.com/Icinga/icinga2/issues/4980) (Documentation): Add OpenBSD and AlpineLinux package repositories to the documentation
-* [#4955](https://github.com/Icinga/icinga2/issues/4955) (Documentation, ITL): Review CheckCommand documentation including external URLs
-* [#4954](https://github.com/Icinga/icinga2/issues/4954) (Documentation): Add an example for /v1/actions/process-check-result which uses filter/type
-* [#3133](https://github.com/Icinga/icinga2/issues/3133) (Documentation): Add practical examples for apply expressions
+* [#5057](https://github.com/icinga/icinga2/issues/5057) (Documentation): Update Security section in the Distributed Monitoring chapter
+* [#5055](https://github.com/icinga/icinga2/issues/5055) (Documentation, ITL): mysql\_socket attribute missing in the documentation for the mysql CheckCommand
+* [#5035](https://github.com/icinga/icinga2/issues/5035) (Documentation): Docs: Typo in Distributed Monitoring chapter
+* [#5030](https://github.com/icinga/icinga2/issues/5030) (Documentation): Advanced topics: Mention the API and explain stick acks, fixed/flexible downtimes
+* [#5029](https://github.com/icinga/icinga2/issues/5029) (Documentation): Advanced topics: Wrong acknowledgement notification filter
+* [#4996](https://github.com/icinga/icinga2/issues/4996) (Documentation): documentation: mixed up host names in 6-distributed-monitoring.md
+* [#4980](https://github.com/icinga/icinga2/issues/4980) (Documentation): Add OpenBSD and AlpineLinux package repositories to the documentation
+* [#4955](https://github.com/icinga/icinga2/issues/4955) (Documentation, ITL): Review CheckCommand documentation including external URLs
+* [#4954](https://github.com/icinga/icinga2/issues/4954) (Documentation): Add an example for /v1/actions/process-check-result which uses filter/type
+* [#3133](https://github.com/icinga/icinga2/issues/3133) (Documentation): Add practical examples for apply expressions
 
 ## 2.6.2 (2017-02-13)
 
 ### Bug
 
-* [#4952](https://github.com/Icinga/icinga2/issues/4952) (API, CLI): Icinga crashes while trying to remove configuration files for objects which no longer exist
+* [#4952](https://github.com/icinga/icinga2/issues/4952) (API, CLI): Icinga crashes while trying to remove configuration files for objects which no longer exist
 
 ## 2.6.1 (2017-01-31)
 
@@ -565,32 +617,32 @@ The documentation changes reflect our recent move to GitHub.
 
 ### Enhancement
 
-* [#4923](https://github.com/Icinga/icinga2/issues/4923): Migration to Github
-* [#4813](https://github.com/Icinga/icinga2/issues/4813): Include argument name for log message about incorrect set\_if values
+* [#4923](https://github.com/icinga/icinga2/issues/4923): Migration to Github
+* [#4813](https://github.com/icinga/icinga2/issues/4813): Include argument name for log message about incorrect set\_if values
 
 ### Bug
 
-* [#4950](https://github.com/Icinga/icinga2/issues/4950): IDO schema update is not compatible to MySQL 5.7
-* [#4882](https://github.com/Icinga/icinga2/issues/4882): Crash - Error: parse error: premature EOF
-* [#4877](https://github.com/Icinga/icinga2/issues/4877) (DB IDO): IDO MySQL schema not working on MySQL 5.7
-* [#4874](https://github.com/Icinga/icinga2/issues/4874) (DB IDO): IDO: Timestamps in PostgreSQL may still have a time zone offset
-* [#4867](https://github.com/Icinga/icinga2/issues/4867): SIGPIPE shutdown on config reload
+* [#4950](https://github.com/icinga/icinga2/issues/4950): IDO schema update is not compatible to MySQL 5.7
+* [#4882](https://github.com/icinga/icinga2/issues/4882): Crash - Error: parse error: premature EOF
+* [#4877](https://github.com/icinga/icinga2/issues/4877) (DB IDO): IDO MySQL schema not working on MySQL 5.7
+* [#4874](https://github.com/icinga/icinga2/issues/4874) (DB IDO): IDO: Timestamps in PostgreSQL may still have a time zone offset
+* [#4867](https://github.com/icinga/icinga2/issues/4867): SIGPIPE shutdown on config reload
 
 ### Documentation
 
-* [#4944](https://github.com/Icinga/icinga2/issues/4944) (Documentation, PR): doc/6-distributed-monitoring.md: Fix typo
-* [#4934](https://github.com/Icinga/icinga2/issues/4934) (Documentation): Update contribution section for GitHub
-* [#4917](https://github.com/Icinga/icinga2/issues/4917) (Documentation): Incorrect license file mentioned in README.md
-* [#4916](https://github.com/Icinga/icinga2/issues/4916) (Documentation): Add travis-ci build status logo to README.md
-* [#4908](https://github.com/Icinga/icinga2/issues/4908) (Documentation): Move domain to icinga.com
-* [#4885](https://github.com/Icinga/icinga2/issues/4885) (Documentation): SLES 12 SP2 libboost\_thread package requires libboost\_chrono
-* [#4869](https://github.com/Icinga/icinga2/issues/4869) (Documentation): Update RELEASE.md
-* [#4868](https://github.com/Icinga/icinga2/issues/4868) (Documentation): Add more build details to INSTALL.md
-* [#4803](https://github.com/Icinga/icinga2/issues/4803) (Documentation): Update Repositories in Docs
+* [#4944](https://github.com/icinga/icinga2/issues/4944) (Documentation, PR): doc/6-distributed-monitoring.md: Fix typo
+* [#4934](https://github.com/icinga/icinga2/issues/4934) (Documentation): Update contribution section for GitHub
+* [#4917](https://github.com/icinga/icinga2/issues/4917) (Documentation): Incorrect license file mentioned in README.md
+* [#4916](https://github.com/icinga/icinga2/issues/4916) (Documentation): Add travis-ci build status logo to README.md
+* [#4908](https://github.com/icinga/icinga2/issues/4908) (Documentation): Move domain to icinga.com
+* [#4885](https://github.com/icinga/icinga2/issues/4885) (Documentation): SLES 12 SP2 libboost\_thread package requires libboost\_chrono
+* [#4869](https://github.com/icinga/icinga2/issues/4869) (Documentation): Update RELEASE.md
+* [#4868](https://github.com/icinga/icinga2/issues/4868) (Documentation): Add more build details to INSTALL.md
+* [#4803](https://github.com/icinga/icinga2/issues/4803) (Documentation): Update Repositories in Docs
 
 ### Support
 
-* [#4870](https://github.com/Icinga/icinga2/issues/4870) (Packages): SLES11 SP4 dependency on Postgresql \>= 8.4
+* [#4870](https://github.com/icinga/icinga2/issues/4870) (Packages): SLES11 SP4 dependency on Postgresql \>= 8.4
 
 ## 2.6.0 (2016-12-13)
 
@@ -620,149 +672,149 @@ The documentation changes reflect our recent move to GitHub.
 
 ### Enhancement
 
-* [#4798](https://github.com/Icinga/icinga2/issues/4798) (Cluster): Deprecate cluster/client mode "bottom up" w/ repository.d and node update-config
-* [#4770](https://github.com/Icinga/icinga2/issues/4770) (API): Allow to evaluate macros through the API
-* [#4713](https://github.com/Icinga/icinga2/issues/4713) (Cluster): Check whether nodes are synchronizing the API log before putting them into UNKNOWN
-* [#4651](https://github.com/Icinga/icinga2/issues/4651) (Plugins): Review windows plugins performance output
-* [#4631](https://github.com/Icinga/icinga2/issues/4631) (Configuration): Suppress compiler warnings for auto-generated code
-* [#4622](https://github.com/Icinga/icinga2/issues/4622) (Cluster): Improve log message for ignored config updates
-* [#4590](https://github.com/Icinga/icinga2/issues/4590): Make sure that libmethods is automatically loaded even when not using the ITL
-* [#4587](https://github.com/Icinga/icinga2/issues/4587) (Configuration): Implement support for default templates
-* [#4580](https://github.com/Icinga/icinga2/issues/4580) (API): Provide location information for objects and templates in the API
-* [#4576](https://github.com/Icinga/icinga2/issues/4576): Use lambda functions for INITIALIZE\_ONCE
-* [#4575](https://github.com/Icinga/icinga2/issues/4575): Use 'auto' for iterator declarations
-* [#4571](https://github.com/Icinga/icinga2/issues/4571): Implement an rvalue constructor for the String and Value classes
-* [#4570](https://github.com/Icinga/icinga2/issues/4570) (Configuration): Implement a command-line argument for "icinga2 console" to allow specifying a script file
-* [#4563](https://github.com/Icinga/icinga2/issues/4563) (Configuration): Remove unused method: ApplyRule::DiscardRules
-* [#4559](https://github.com/Icinga/icinga2/issues/4559): Replace BOOST\_FOREACH with range-based for loops
-* [#4557](https://github.com/Icinga/icinga2/issues/4557): Add -fvisibility=hidden to the default compiler flags
-* [#4537](https://github.com/Icinga/icinga2/issues/4537): Implement an environment variable to keep Icinga from closing FDs on startup
-* [#4536](https://github.com/Icinga/icinga2/issues/4536): Avoid unnecessary string copies
-* [#4535](https://github.com/Icinga/icinga2/issues/4535): Remove deprecated functions
-* [#3684](https://github.com/Icinga/icinga2/issues/3684) (Configuration): Command line option for config syntax validation
-* [#2968](https://github.com/Icinga/icinga2/issues/2968): Better message for apply errors
+* [#4798](https://github.com/icinga/icinga2/issues/4798) (Cluster): Deprecate cluster/client mode "bottom up" w/ repository.d and node update-config
+* [#4770](https://github.com/icinga/icinga2/issues/4770) (API): Allow to evaluate macros through the API
+* [#4713](https://github.com/icinga/icinga2/issues/4713) (Cluster): Check whether nodes are synchronizing the API log before putting them into UNKNOWN
+* [#4651](https://github.com/icinga/icinga2/issues/4651) (Plugins): Review windows plugins performance output
+* [#4631](https://github.com/icinga/icinga2/issues/4631) (Configuration): Suppress compiler warnings for auto-generated code
+* [#4622](https://github.com/icinga/icinga2/issues/4622) (Cluster): Improve log message for ignored config updates
+* [#4590](https://github.com/icinga/icinga2/issues/4590): Make sure that libmethods is automatically loaded even when not using the ITL
+* [#4587](https://github.com/icinga/icinga2/issues/4587) (Configuration): Implement support for default templates
+* [#4580](https://github.com/icinga/icinga2/issues/4580) (API): Provide location information for objects and templates in the API
+* [#4576](https://github.com/icinga/icinga2/issues/4576): Use lambda functions for INITIALIZE\_ONCE
+* [#4575](https://github.com/icinga/icinga2/issues/4575): Use 'auto' for iterator declarations
+* [#4571](https://github.com/icinga/icinga2/issues/4571): Implement an rvalue constructor for the String and Value classes
+* [#4570](https://github.com/icinga/icinga2/issues/4570) (Configuration): Implement a command-line argument for "icinga2 console" to allow specifying a script file
+* [#4563](https://github.com/icinga/icinga2/issues/4563) (Configuration): Remove unused method: ApplyRule::DiscardRules
+* [#4559](https://github.com/icinga/icinga2/issues/4559): Replace BOOST\_FOREACH with range-based for loops
+* [#4557](https://github.com/icinga/icinga2/issues/4557): Add -fvisibility=hidden to the default compiler flags
+* [#4537](https://github.com/icinga/icinga2/issues/4537): Implement an environment variable to keep Icinga from closing FDs on startup
+* [#4536](https://github.com/icinga/icinga2/issues/4536): Avoid unnecessary string copies
+* [#4535](https://github.com/icinga/icinga2/issues/4535): Remove deprecated functions
+* [#3684](https://github.com/icinga/icinga2/issues/3684) (Configuration): Command line option for config syntax validation
+* [#2968](https://github.com/icinga/icinga2/issues/2968): Better message for apply errors
 
 ### Bug
 
-* [#4831](https://github.com/Icinga/icinga2/issues/4831) (CLI): Wrong help string for node setup cli command argument --master\_host
-* [#4828](https://github.com/Icinga/icinga2/issues/4828) (API): Crash in CreateObjectHandler \(regression from \#11684
-* [#4802](https://github.com/Icinga/icinga2/issues/4802): Icinga tries to delete Downtime objects that were statically configured
-* [#4801](https://github.com/Icinga/icinga2/issues/4801): Sending a HUP signal to the child process for execution actually kills it
-* [#4791](https://github.com/Icinga/icinga2/issues/4791) (DB IDO): PostgreSQL: Don't use timestamp with timezone for UNIX timestamp columns
-* [#4789](https://github.com/Icinga/icinga2/issues/4789) (Notifications): Recovery notifications sent for Not-Problem notification type if notified before
-* [#4775](https://github.com/Icinga/icinga2/issues/4775) (Cluster): Crash w/ SendNotifications cluster handler and check result with empty perfdata
-* [#4771](https://github.com/Icinga/icinga2/issues/4771): Config validation crashes when using command\_endpoint without also having an ApiListener object
-* [#4752](https://github.com/Icinga/icinga2/issues/4752) (Graphite): Performance data writer for Graphite : Values without fraction limited to 2147483647 \(7FFFFFFF\)
-* [#4740](https://github.com/Icinga/icinga2/issues/4740): SIGALRM handling may be affected by recent commit
-* [#4726](https://github.com/Icinga/icinga2/issues/4726) (Notifications): Flapping notifications sent for soft state changes
-* [#4717](https://github.com/Icinga/icinga2/issues/4717) (API): Icinga crashes while deleting a config file which doesn't exist anymore
-* [#4678](https://github.com/Icinga/icinga2/issues/4678) (Configuration): Configuration validation fails when setting tls\_protocolmin to TLSv1.2
-* [#4674](https://github.com/Icinga/icinga2/issues/4674) (CLI): Parse error: "premature EOF" when running "icinga2 node update-config"
-* [#4665](https://github.com/Icinga/icinga2/issues/4665): Crash in ClusterEvents::SendNotificationsAPIHandler
-* [#4646](https://github.com/Icinga/icinga2/issues/4646) (Notifications): Forced custom notification is setting "force\_next\_notification": true permanently
-* [#4644](https://github.com/Icinga/icinga2/issues/4644) (API): Crash in HttpRequest::Parse while processing HTTP request
-* [#4630](https://github.com/Icinga/icinga2/issues/4630) (Configuration): Validation does not highlight the correct attribute
-* [#4629](https://github.com/Icinga/icinga2/issues/4629) (CLI): broken: icinga2 --version
-* [#4620](https://github.com/Icinga/icinga2/issues/4620) (API): Invalid API filter error messages
-* [#4619](https://github.com/Icinga/icinga2/issues/4619) (CLI): Cli: boost::bad\_get on icinga::String::String\(icinga::Value&&\) 
-* [#4616](https://github.com/Icinga/icinga2/issues/4616): Build fails with Visual Studio 2015
-* [#4606](https://github.com/Icinga/icinga2/issues/4606): Remove unused last\_in\_downtime field
-* [#4602](https://github.com/Icinga/icinga2/issues/4602) (CLI): Last option highlighted as the wrong one, even when it is not the culprit
-* [#4599](https://github.com/Icinga/icinga2/issues/4599): Unexpected state changes with max\_check\_attempts = 2
-* [#4583](https://github.com/Icinga/icinga2/issues/4583) (Configuration): Debug hints for dictionary expressions are nested incorrectly
-* [#4574](https://github.com/Icinga/icinga2/issues/4574) (Notifications): Don't send Flapping\* notifications when downtime is active
-* [#4573](https://github.com/Icinga/icinga2/issues/4573) (DB IDO): Getting error during schema update 
-* [#4572](https://github.com/Icinga/icinga2/issues/4572) (Configuration): Config validation shouldnt allow 'endpoints = \[ "" \]'
-* [#4566](https://github.com/Icinga/icinga2/issues/4566) (Notifications): Fixed downtimes scheduled for a future date trigger DOWNTIMESTART notifications
-* [#4564](https://github.com/Icinga/icinga2/issues/4564): Add missing initializer for WorkQueue::m\_NextTaskID
-* [#4555](https://github.com/Icinga/icinga2/issues/4555): Fix compiler warnings
-* [#4541](https://github.com/Icinga/icinga2/issues/4541) (DB IDO): Don't link against libmysqlclient\_r
-* [#4538](https://github.com/Icinga/icinga2/issues/4538): Don't update TimePeriod ranges for inactive objects
-* [#4423](https://github.com/Icinga/icinga2/issues/4423) (Performance Data): InfluxdbWriter does not write state other than 0
-* [#4369](https://github.com/Icinga/icinga2/issues/4369) (Plugins): check\_network performance data in invalid format - ingraph
-* [#4169](https://github.com/Icinga/icinga2/issues/4169) (Cluster): Cluster resync problem with API created objects
-* [#4098](https://github.com/Icinga/icinga2/issues/4098) (API): Objects created in a global zone are not synced to child endpoints
-* [#4010](https://github.com/Icinga/icinga2/issues/4010) (API): API requests from execute-script action are too verbose
-* [#3802](https://github.com/Icinga/icinga2/issues/3802) (Compat): SCHEDULE\_AND\_PROPAGATE\_HOST\_DOWNTIME command missing
-* [#3801](https://github.com/Icinga/icinga2/issues/3801) (Compat): SCHEDULE\_AND\_PROPAGATE\_TRIGGERED\_HOST\_DOWNTIME command missing
-* [#3575](https://github.com/Icinga/icinga2/issues/3575) (DB IDO): MySQL 5.7.9, Incorrect datetime value Error
-* [#3565](https://github.com/Icinga/icinga2/issues/3565) (Plugins): Windows Agent: performance data of check\_perfmon
-* [#3564](https://github.com/Icinga/icinga2/issues/3564) (Plugins): Windows Agent: Performance data values for check\_perfmon.exe are invalid sometimes
-* [#3220](https://github.com/Icinga/icinga2/issues/3220) (Plugins): Implement support for resolving DNS hostnames in check\_ping.exe
-* [#2847](https://github.com/Icinga/icinga2/issues/2847): File descriptors are leaked to child processes which makes SELinux unhappy
+* [#4831](https://github.com/icinga/icinga2/issues/4831) (CLI): Wrong help string for node setup cli command argument --master\_host
+* [#4828](https://github.com/icinga/icinga2/issues/4828) (API): Crash in CreateObjectHandler \(regression from \#11684
+* [#4802](https://github.com/icinga/icinga2/issues/4802): Icinga tries to delete Downtime objects that were statically configured
+* [#4801](https://github.com/icinga/icinga2/issues/4801): Sending a HUP signal to the child process for execution actually kills it
+* [#4791](https://github.com/icinga/icinga2/issues/4791) (DB IDO): PostgreSQL: Don't use timestamp with timezone for UNIX timestamp columns
+* [#4789](https://github.com/icinga/icinga2/issues/4789) (Notifications): Recovery notifications sent for Not-Problem notification type if notified before
+* [#4775](https://github.com/icinga/icinga2/issues/4775) (Cluster): Crash w/ SendNotifications cluster handler and check result with empty perfdata
+* [#4771](https://github.com/icinga/icinga2/issues/4771): Config validation crashes when using command\_endpoint without also having an ApiListener object
+* [#4752](https://github.com/icinga/icinga2/issues/4752) (Graphite): Performance data writer for Graphite : Values without fraction limited to 2147483647 \(7FFFFFFF\)
+* [#4740](https://github.com/icinga/icinga2/issues/4740): SIGALRM handling may be affected by recent commit
+* [#4726](https://github.com/icinga/icinga2/issues/4726) (Notifications): Flapping notifications sent for soft state changes
+* [#4717](https://github.com/icinga/icinga2/issues/4717) (API): Icinga crashes while deleting a config file which doesn't exist anymore
+* [#4678](https://github.com/icinga/icinga2/issues/4678) (Configuration): Configuration validation fails when setting tls\_protocolmin to TLSv1.2
+* [#4674](https://github.com/icinga/icinga2/issues/4674) (CLI): Parse error: "premature EOF" when running "icinga2 node update-config"
+* [#4665](https://github.com/icinga/icinga2/issues/4665): Crash in ClusterEvents::SendNotificationsAPIHandler
+* [#4646](https://github.com/icinga/icinga2/issues/4646) (Notifications): Forced custom notification is setting "force\_next\_notification": true permanently
+* [#4644](https://github.com/icinga/icinga2/issues/4644) (API): Crash in HttpRequest::Parse while processing HTTP request
+* [#4630](https://github.com/icinga/icinga2/issues/4630) (Configuration): Validation does not highlight the correct attribute
+* [#4629](https://github.com/icinga/icinga2/issues/4629) (CLI): broken: icinga2 --version
+* [#4620](https://github.com/icinga/icinga2/issues/4620) (API): Invalid API filter error messages
+* [#4619](https://github.com/icinga/icinga2/issues/4619) (CLI): Cli: boost::bad\_get on icinga::String::String\(icinga::Value&&\) 
+* [#4616](https://github.com/icinga/icinga2/issues/4616): Build fails with Visual Studio 2015
+* [#4606](https://github.com/icinga/icinga2/issues/4606): Remove unused last\_in\_downtime field
+* [#4602](https://github.com/icinga/icinga2/issues/4602) (CLI): Last option highlighted as the wrong one, even when it is not the culprit
+* [#4599](https://github.com/icinga/icinga2/issues/4599): Unexpected state changes with max\_check\_attempts = 2
+* [#4583](https://github.com/icinga/icinga2/issues/4583) (Configuration): Debug hints for dictionary expressions are nested incorrectly
+* [#4574](https://github.com/icinga/icinga2/issues/4574) (Notifications): Don't send Flapping\* notifications when downtime is active
+* [#4573](https://github.com/icinga/icinga2/issues/4573) (DB IDO): Getting error during schema update 
+* [#4572](https://github.com/icinga/icinga2/issues/4572) (Configuration): Config validation shouldnt allow 'endpoints = \[ "" \]'
+* [#4566](https://github.com/icinga/icinga2/issues/4566) (Notifications): Fixed downtimes scheduled for a future date trigger DOWNTIMESTART notifications
+* [#4564](https://github.com/icinga/icinga2/issues/4564): Add missing initializer for WorkQueue::m\_NextTaskID
+* [#4555](https://github.com/icinga/icinga2/issues/4555): Fix compiler warnings
+* [#4541](https://github.com/icinga/icinga2/issues/4541) (DB IDO): Don't link against libmysqlclient\_r
+* [#4538](https://github.com/icinga/icinga2/issues/4538): Don't update TimePeriod ranges for inactive objects
+* [#4423](https://github.com/icinga/icinga2/issues/4423) (Metrics): InfluxdbWriter does not write state other than 0
+* [#4369](https://github.com/icinga/icinga2/issues/4369) (Plugins): check\_network performance data in invalid format - ingraph
+* [#4169](https://github.com/icinga/icinga2/issues/4169) (Cluster): Cluster resync problem with API created objects
+* [#4098](https://github.com/icinga/icinga2/issues/4098) (API): Objects created in a global zone are not synced to child endpoints
+* [#4010](https://github.com/icinga/icinga2/issues/4010) (API): API requests from execute-script action are too verbose
+* [#3802](https://github.com/icinga/icinga2/issues/3802) (Compat): SCHEDULE\_AND\_PROPAGATE\_HOST\_DOWNTIME command missing
+* [#3801](https://github.com/icinga/icinga2/issues/3801) (Compat): SCHEDULE\_AND\_PROPAGATE\_TRIGGERED\_HOST\_DOWNTIME command missing
+* [#3575](https://github.com/icinga/icinga2/issues/3575) (DB IDO): MySQL 5.7.9, Incorrect datetime value Error
+* [#3565](https://github.com/icinga/icinga2/issues/3565) (Plugins): Windows Agent: performance data of check\_perfmon
+* [#3564](https://github.com/icinga/icinga2/issues/3564) (Plugins): Windows Agent: Performance data values for check\_perfmon.exe are invalid sometimes
+* [#3220](https://github.com/icinga/icinga2/issues/3220) (Plugins): Implement support for resolving DNS hostnames in check\_ping.exe
+* [#2847](https://github.com/icinga/icinga2/issues/2847): File descriptors are leaked to child processes which makes SELinux unhappy
 
 ### ITL
 
-* [#4842](https://github.com/Icinga/icinga2/issues/4842) (ITL): Add tempdir attribute to postgres CheckCommand
-* [#4837](https://github.com/Icinga/icinga2/issues/4837) (ITL): Add sudo option to mailq CheckCommand
-* [#4836](https://github.com/Icinga/icinga2/issues/4836) (ITL): Add verbose parameter to http CheckCommand
-* [#4835](https://github.com/Icinga/icinga2/issues/4835) (ITL): Add timeout option to mysql\_health CheckCommand
-* [#4714](https://github.com/Icinga/icinga2/issues/4714) (ITL): Default values for check\_swap are incorrect
-* [#4710](https://github.com/Icinga/icinga2/issues/4710) (ITL): snmp\_miblist variable to feed the -m option of check\_snmp is missing in the snmpv3 CheckCommand object
-* [#4684](https://github.com/Icinga/icinga2/issues/4684) (ITL): Add a radius CheckCommand for the radius check provide by nagios-plugins
-* [#4681](https://github.com/Icinga/icinga2/issues/4681) (ITL): Add CheckCommand definition for check\_logstash
-* [#4677](https://github.com/Icinga/icinga2/issues/4677) (ITL): Problem passing arguments to nscp-local CheckCommand objects
-* [#4672](https://github.com/Icinga/icinga2/issues/4672) (ITL): Add timeout option to oracle\_health CheckCommand
-* [#4618](https://github.com/Icinga/icinga2/issues/4618) (ITL): Hangman easter egg is broken
-* [#4608](https://github.com/Icinga/icinga2/issues/4608) (ITL): Add CheckCommand definition for check\_iostats
-* [#4597](https://github.com/Icinga/icinga2/issues/4597) (ITL): Default disk plugin check should not check inodes
-* [#4595](https://github.com/Icinga/icinga2/issues/4595) (ITL): Manubulon: Add missing procurve memory flag
-* [#4585](https://github.com/Icinga/icinga2/issues/4585) (ITL): Fix code style violations in the ITL
-* [#4582](https://github.com/Icinga/icinga2/issues/4582) (ITL): Incorrect help text for check\_swap
-* [#4543](https://github.com/Icinga/icinga2/issues/4543) (ITL): ITL - check\_vmware\_esx - specify a datacenter/vsphere server for esx/host checks
-* [#4324](https://github.com/Icinga/icinga2/issues/4324) (ITL): Add CheckCommand definition for check\_glusterfs
+* [#4842](https://github.com/icinga/icinga2/issues/4842) (ITL): Add tempdir attribute to postgres CheckCommand
+* [#4837](https://github.com/icinga/icinga2/issues/4837) (ITL): Add sudo option to mailq CheckCommand
+* [#4836](https://github.com/icinga/icinga2/issues/4836) (ITL): Add verbose parameter to http CheckCommand
+* [#4835](https://github.com/icinga/icinga2/issues/4835) (ITL): Add timeout option to mysql\_health CheckCommand
+* [#4714](https://github.com/icinga/icinga2/issues/4714) (ITL): Default values for check\_swap are incorrect
+* [#4710](https://github.com/icinga/icinga2/issues/4710) (ITL): snmp\_miblist variable to feed the -m option of check\_snmp is missing in the snmpv3 CheckCommand object
+* [#4684](https://github.com/icinga/icinga2/issues/4684) (ITL): Add a radius CheckCommand for the radius check provide by nagios-plugins
+* [#4681](https://github.com/icinga/icinga2/issues/4681) (ITL): Add CheckCommand definition for check\_logstash
+* [#4677](https://github.com/icinga/icinga2/issues/4677) (ITL): Problem passing arguments to nscp-local CheckCommand objects
+* [#4672](https://github.com/icinga/icinga2/issues/4672) (ITL): Add timeout option to oracle\_health CheckCommand
+* [#4618](https://github.com/icinga/icinga2/issues/4618) (ITL): Hangman easter egg is broken
+* [#4608](https://github.com/icinga/icinga2/issues/4608) (ITL): Add CheckCommand definition for check\_iostats
+* [#4597](https://github.com/icinga/icinga2/issues/4597) (ITL): Default disk plugin check should not check inodes
+* [#4595](https://github.com/icinga/icinga2/issues/4595) (ITL): Manubulon: Add missing procurve memory flag
+* [#4585](https://github.com/icinga/icinga2/issues/4585) (ITL): Fix code style violations in the ITL
+* [#4582](https://github.com/icinga/icinga2/issues/4582) (ITL): Incorrect help text for check\_swap
+* [#4543](https://github.com/icinga/icinga2/issues/4543) (ITL): ITL - check\_vmware\_esx - specify a datacenter/vsphere server for esx/host checks
+* [#4324](https://github.com/icinga/icinga2/issues/4324) (ITL): Add CheckCommand definition for check\_glusterfs
 
 ### Documentation
 
-* [#4862](https://github.com/Icinga/icinga2/issues/4862) (Documentation): "2.1.4. Installation Paths" should contain systemd paths
-* [#4861](https://github.com/Icinga/icinga2/issues/4861) (Documentation): Update "2.1.3. Enabled Features during Installation" - outdated "feature list"
-* [#4859](https://github.com/Icinga/icinga2/issues/4859) (Documentation): Update package instructions for Fedora
-* [#4851](https://github.com/Icinga/icinga2/issues/4851) (Documentation): Update README.md and correct project URLs
-* [#4846](https://github.com/Icinga/icinga2/issues/4846) (Documentation): Add a note for boolean values in the disk CheckCommand section
-* [#4845](https://github.com/Icinga/icinga2/issues/4845) (Documentation): Troubleshooting: Add examples for fetching the executed command line
-* [#4840](https://github.com/Icinga/icinga2/issues/4840) (Documentation): Update Windows screenshots in the client documentation
-* [#4838](https://github.com/Icinga/icinga2/issues/4838) (Documentation): Add example for concurrent\_checks in CheckerComponent object type
-* [#4829](https://github.com/Icinga/icinga2/issues/4829) (Documentation): Missing API headers for X-HTTP-Method-Override
-* [#4827](https://github.com/Icinga/icinga2/issues/4827) (Documentation): Fix example in PNP template docs
-* [#4821](https://github.com/Icinga/icinga2/issues/4821) (Documentation): Add a note about removing "conf.d" on the client for "top down command endpoint" setups
-* [#4809](https://github.com/Icinga/icinga2/issues/4809) (Documentation): Update API and Library Reference chapters
-* [#4804](https://github.com/Icinga/icinga2/issues/4804) (Documentation): Add a note about default template import to the CheckCommand object
-* [#4800](https://github.com/Icinga/icinga2/issues/4800) (Documentation): Docs: Typo in "CLI commands" chapter
-* [#4793](https://github.com/Icinga/icinga2/issues/4793) (Documentation): Docs: ITL plugins contrib order
-* [#4787](https://github.com/Icinga/icinga2/issues/4787) (Documentation): Doc: Swap packages.icinga.org w/ DebMon
-* [#4780](https://github.com/Icinga/icinga2/issues/4780) (Documentation): Add a note about pinning checks w/ command\_endpoint
-* [#4736](https://github.com/Icinga/icinga2/issues/4736) (Documentation): Docs: wrong heading level for commands.conf and groups.conf
-* [#4708](https://github.com/Icinga/icinga2/issues/4708) (Documentation): Add more Timeperiod examples in the documentation
-* [#4706](https://github.com/Icinga/icinga2/issues/4706) (Documentation): Add an example of multi-parents configuration for the Migration chapter
-* [#4705](https://github.com/Icinga/icinga2/issues/4705) (Documentation): Typo in the documentation
-* [#4699](https://github.com/Icinga/icinga2/issues/4699) (Documentation): Fix some spelling mistakes
-* [#4667](https://github.com/Icinga/icinga2/issues/4667) (Documentation): Add documentation for logrotation for the mainlog feature
-* [#4653](https://github.com/Icinga/icinga2/issues/4653) (Documentation): Corrections for distributed monitoring chapter
-* [#4641](https://github.com/Icinga/icinga2/issues/4641) (Documentation): Docs: Migrating Notification example tells about filters instead of types
-* [#4639](https://github.com/Icinga/icinga2/issues/4639) (Documentation): GDB example in the documentation isn't working
-* [#4636](https://github.com/Icinga/icinga2/issues/4636) (Documentation): Add development docs for writing a core dump file
-* [#4601](https://github.com/Icinga/icinga2/issues/4601) (Documentation): Typo in distributed monitoring docs
-* [#4596](https://github.com/Icinga/icinga2/issues/4596) (Documentation): Update service monitoring and distributed docs
-* [#4589](https://github.com/Icinga/icinga2/issues/4589) (Documentation): Fix help output for update-links.py
-* [#4584](https://github.com/Icinga/icinga2/issues/4584) (Documentation): Add missing reference to libmethods for the default ITL command templates
-* [#4492](https://github.com/Icinga/icinga2/issues/4492) (Documentation): Add information about function 'range'
+* [#4862](https://github.com/icinga/icinga2/issues/4862) (Documentation): "2.1.4. Installation Paths" should contain systemd paths
+* [#4861](https://github.com/icinga/icinga2/issues/4861) (Documentation): Update "2.1.3. Enabled Features during Installation" - outdated "feature list"
+* [#4859](https://github.com/icinga/icinga2/issues/4859) (Documentation): Update package instructions for Fedora
+* [#4851](https://github.com/icinga/icinga2/issues/4851) (Documentation): Update README.md and correct project URLs
+* [#4846](https://github.com/icinga/icinga2/issues/4846) (Documentation): Add a note for boolean values in the disk CheckCommand section
+* [#4845](https://github.com/icinga/icinga2/issues/4845) (Documentation): Troubleshooting: Add examples for fetching the executed command line
+* [#4840](https://github.com/icinga/icinga2/issues/4840) (Documentation): Update Windows screenshots in the client documentation
+* [#4838](https://github.com/icinga/icinga2/issues/4838) (Documentation): Add example for concurrent\_checks in CheckerComponent object type
+* [#4829](https://github.com/icinga/icinga2/issues/4829) (Documentation): Missing API headers for X-HTTP-Method-Override
+* [#4827](https://github.com/icinga/icinga2/issues/4827) (Documentation): Fix example in PNP template docs
+* [#4821](https://github.com/icinga/icinga2/issues/4821) (Documentation): Add a note about removing "conf.d" on the client for "top down command endpoint" setups
+* [#4809](https://github.com/icinga/icinga2/issues/4809) (Documentation): Update API and Library Reference chapters
+* [#4804](https://github.com/icinga/icinga2/issues/4804) (Documentation): Add a note about default template import to the CheckCommand object
+* [#4800](https://github.com/icinga/icinga2/issues/4800) (Documentation): Docs: Typo in "CLI commands" chapter
+* [#4793](https://github.com/icinga/icinga2/issues/4793) (Documentation): Docs: ITL plugins contrib order
+* [#4787](https://github.com/icinga/icinga2/issues/4787) (Documentation): Doc: Swap packages.icinga.org w/ DebMon
+* [#4780](https://github.com/icinga/icinga2/issues/4780) (Documentation): Add a note about pinning checks w/ command\_endpoint
+* [#4736](https://github.com/icinga/icinga2/issues/4736) (Documentation): Docs: wrong heading level for commands.conf and groups.conf
+* [#4708](https://github.com/icinga/icinga2/issues/4708) (Documentation): Add more Timeperiod examples in the documentation
+* [#4706](https://github.com/icinga/icinga2/issues/4706) (Documentation): Add an example of multi-parents configuration for the Migration chapter
+* [#4705](https://github.com/icinga/icinga2/issues/4705) (Documentation): Typo in the documentation
+* [#4699](https://github.com/icinga/icinga2/issues/4699) (Documentation): Fix some spelling mistakes
+* [#4667](https://github.com/icinga/icinga2/issues/4667) (Documentation): Add documentation for logrotation for the mainlog feature
+* [#4653](https://github.com/icinga/icinga2/issues/4653) (Documentation): Corrections for distributed monitoring chapter
+* [#4641](https://github.com/icinga/icinga2/issues/4641) (Documentation): Docs: Migrating Notification example tells about filters instead of types
+* [#4639](https://github.com/icinga/icinga2/issues/4639) (Documentation): GDB example in the documentation isn't working
+* [#4636](https://github.com/icinga/icinga2/issues/4636) (Documentation): Add development docs for writing a core dump file
+* [#4601](https://github.com/icinga/icinga2/issues/4601) (Documentation): Typo in distributed monitoring docs
+* [#4596](https://github.com/icinga/icinga2/issues/4596) (Documentation): Update service monitoring and distributed docs
+* [#4589](https://github.com/icinga/icinga2/issues/4589) (Documentation): Fix help output for update-links.py
+* [#4584](https://github.com/icinga/icinga2/issues/4584) (Documentation): Add missing reference to libmethods for the default ITL command templates
+* [#4492](https://github.com/icinga/icinga2/issues/4492) (Documentation): Add information about function 'range'
 
 ### Support
 
-* [#4796](https://github.com/Icinga/icinga2/issues/4796) (Installation): Sort Changelog by category
-* [#4792](https://github.com/Icinga/icinga2/issues/4792) (Tests): Add unit test for notification state/type filter checks
-* [#4724](https://github.com/Icinga/icinga2/issues/4724) (Packages): Update .mailmap for icinga.com
-* [#4671](https://github.com/Icinga/icinga2/issues/4671) (Packages): Windows Installer should include NSClient++ 0.5.0
-* [#4612](https://github.com/Icinga/icinga2/issues/4612) (Tests): Unit tests randomly crash after the tests have completed
-* [#4607](https://github.com/Icinga/icinga2/issues/4607) (Packages): Improve support for building the chocolatey package
-* [#4588](https://github.com/Icinga/icinga2/issues/4588) (Installation): Use raw string literals in mkembedconfig
-* [#4578](https://github.com/Icinga/icinga2/issues/4578) (Installation): Improve detection for the -flto compiler flag
-* [#4569](https://github.com/Icinga/icinga2/issues/4569) (Installation): Set versions for all internal libraries
-* [#4558](https://github.com/Icinga/icinga2/issues/4558) (Installation): Update cmake config to require a compiler that supports C++11
-* [#4556](https://github.com/Icinga/icinga2/issues/4556) (Installation): logrotate file is not properly generated when the logrotate binary resides in /usr/bin
-* [#4551](https://github.com/Icinga/icinga2/issues/4551) (Tests): Implement unit tests for state changes
-* [#2943](https://github.com/Icinga/icinga2/issues/2943) (Installation): Make the user account configurable for the Windows service
-* [#2792](https://github.com/Icinga/icinga2/issues/2792) (Tests): Livestatus tests don't work on OS X
+* [#4796](https://github.com/icinga/icinga2/issues/4796) (Installation): Sort Changelog by category
+* [#4792](https://github.com/icinga/icinga2/issues/4792) (Tests): Add unit test for notification state/type filter checks
+* [#4724](https://github.com/icinga/icinga2/issues/4724) (Packages): Update .mailmap for icinga.com
+* [#4671](https://github.com/icinga/icinga2/issues/4671) (Packages): Windows Installer should include NSClient++ 0.5.0
+* [#4612](https://github.com/icinga/icinga2/issues/4612) (Tests): Unit tests randomly crash after the tests have completed
+* [#4607](https://github.com/icinga/icinga2/issues/4607) (Packages): Improve support for building the chocolatey package
+* [#4588](https://github.com/icinga/icinga2/issues/4588) (Installation): Use raw string literals in mkembedconfig
+* [#4578](https://github.com/icinga/icinga2/issues/4578) (Installation): Improve detection for the -flto compiler flag
+* [#4569](https://github.com/icinga/icinga2/issues/4569) (Installation): Set versions for all internal libraries
+* [#4558](https://github.com/icinga/icinga2/issues/4558) (Installation): Update cmake config to require a compiler that supports C++11
+* [#4556](https://github.com/icinga/icinga2/issues/4556) (Installation): logrotate file is not properly generated when the logrotate binary resides in /usr/bin
+* [#4551](https://github.com/icinga/icinga2/issues/4551) (Tests): Implement unit tests for state changes
+* [#2943](https://github.com/icinga/icinga2/issues/2943) (Installation): Make the user account configurable for the Windows service
+* [#2792](https://github.com/icinga/icinga2/issues/2792) (Tests): Livestatus tests don't work on OS X
 
 ## 2.5.4 (2016-08-30)
 
@@ -772,7 +824,7 @@ The documentation changes reflect our recent move to GitHub.
 
 ### Bug
 
-* [#4277](https://github.com/Icinga/icinga2/issues/4277): many check commands executed at same time when master reload
+* [#4277](https://github.com/icinga/icinga2/issues/4277): many check commands executed at same time when master reload
 
 ## 2.5.3 (2016-08-25)
 
@@ -782,7 +834,7 @@ This release addresses an issue with PostgreSQL support for the IDO database mod
 
 ### Bug
 
-* [#4554](https://github.com/Icinga/icinga2/issues/4554) (DB IDO): ido pgsql migration from 2.4.0 to 2.5.0 : wrong size for config\_hash
+* [#4554](https://github.com/icinga/icinga2/issues/4554) (DB IDO): ido pgsql migration from 2.4.0 to 2.5.0 : wrong size for config\_hash
 
 ## 2.5.2 (2016-08-24)
 
@@ -792,12 +844,12 @@ This release addresses an issue with PostgreSQL support for the IDO database mod
 
 ### Bug
 
-* [#4550](https://github.com/Icinga/icinga2/issues/4550): Icinga 2 sends SOFT recovery notifications
-* [#4549](https://github.com/Icinga/icinga2/issues/4549) (DB IDO): Newly added group member tables in the IDO database are not updated
+* [#4550](https://github.com/icinga/icinga2/issues/4550): Icinga 2 sends SOFT recovery notifications
+* [#4549](https://github.com/icinga/icinga2/issues/4549) (DB IDO): Newly added group member tables in the IDO database are not updated
 
 ### Documentation
 
-* [#4548](https://github.com/Icinga/icinga2/issues/4548) (Documentation): Wrong formatting in client docs
+* [#4548](https://github.com/icinga/icinga2/issues/4548) (Documentation): Wrong formatting in client docs
 
 ## 2.5.1 (2016-08-23)
 
@@ -807,7 +859,7 @@ This release addresses an issue with PostgreSQL support for the IDO database mod
 
 ### Bug
 
-* [#4544](https://github.com/Icinga/icinga2/issues/4544) (Notifications): Icinga 2 sends recovery notifications for SOFT NOT-OK states
+* [#4544](https://github.com/icinga/icinga2/issues/4544) (Notifications): Icinga 2 sends recovery notifications for SOFT NOT-OK states
 
 ## 2.5.0 (2016-08-23)
 
@@ -843,242 +895,242 @@ This release addresses an issue with PostgreSQL support for the IDO database mod
 
 ### Enhancement
 
-* [#4516](https://github.com/Icinga/icinga2/issues/4516): Remove some unused \#includes
-* [#4498](https://github.com/Icinga/icinga2/issues/4498): Remove unnecessary Dictionary::Contains calls
-* [#4493](https://github.com/Icinga/icinga2/issues/4493) (Cluster): Improve performance for Endpoint config validation
-* [#4491](https://github.com/Icinga/icinga2/issues/4491): Improve performance for type lookups
-* [#4487](https://github.com/Icinga/icinga2/issues/4487) (DB IDO): Incremental updates for the IDO database
-* [#4486](https://github.com/Icinga/icinga2/issues/4486) (DB IDO): Remove unused code from the IDO classes
-* [#4485](https://github.com/Icinga/icinga2/issues/4485) (API): Add API action for generating a PKI ticket
-* [#4479](https://github.com/Icinga/icinga2/issues/4479) (Configuration): Implement comparison operators for the Array class
-* [#4467](https://github.com/Icinga/icinga2/issues/4467): Implement the System\#sleep function
-* [#4465](https://github.com/Icinga/icinga2/issues/4465) (Configuration): Implement support for namespaces
-* [#4464](https://github.com/Icinga/icinga2/issues/4464) (CLI): Implement support for inspecting variables with LLDB/GDB
-* [#4457](https://github.com/Icinga/icinga2/issues/4457): Implement support for marking functions as deprecated
-* [#4454](https://github.com/Icinga/icinga2/issues/4454): Include compiler name/version and build host name in --version
-* [#4451](https://github.com/Icinga/icinga2/issues/4451) (Configuration): Move internal script functions into the 'Internal' namespace
-* [#4449](https://github.com/Icinga/icinga2/issues/4449): Improve logging for the WorkQueue class
-* [#4445](https://github.com/Icinga/icinga2/issues/4445): Rename/Remove experimental script functions
-* [#4443](https://github.com/Icinga/icinga2/issues/4443): Implement process\_check\_result script method for the Checkable class
-* [#4442](https://github.com/Icinga/icinga2/issues/4442) (API): Support for determining the Icinga 2 version via the API
-* [#4431](https://github.com/Icinga/icinga2/issues/4431) (Notifications): Add the notification type into the log message
-* [#4424](https://github.com/Icinga/icinga2/issues/4424) (Cluster): Enhance TLS handshake error messages with connection information
-* [#4415](https://github.com/Icinga/icinga2/issues/4415) (API): Remove obsolete debug log message
-* [#4410](https://github.com/Icinga/icinga2/issues/4410) (Configuration): Add map/reduce and filter functionality for the Array class
-* [#4403](https://github.com/Icinga/icinga2/issues/4403) (CLI): Add history for icinga2 console
-* [#4398](https://github.com/Icinga/icinga2/issues/4398) (Cluster): Log a warning if there are more than 2 zone endpoint members
-* [#4393](https://github.com/Icinga/icinga2/issues/4393) (Cluster): Include IP address and port in the "New connection" log message
-* [#4388](https://github.com/Icinga/icinga2/issues/4388) (Configuration): Implement the \_\_ptr script function
-* [#4386](https://github.com/Icinga/icinga2/issues/4386) (Cluster): Improve error messages for failed certificate validation
-* [#4381](https://github.com/Icinga/icinga2/issues/4381) (Cluster): Improve log message for connecting nodes without configured Endpoint object
-* [#4352](https://github.com/Icinga/icinga2/issues/4352) (Cluster): Enhance client disconnect message for "No data received on new API connection."
-* [#4348](https://github.com/Icinga/icinga2/issues/4348) (DB IDO): Do not populate logentries table by default
-* [#4325](https://github.com/Icinga/icinga2/issues/4325) (API): API: Add missing downtime\_depth attribute
-* [#4314](https://github.com/Icinga/icinga2/issues/4314) (DB IDO): Change Ido\*Connection 'categories' attribute to an array
-* [#4295](https://github.com/Icinga/icinga2/issues/4295) (DB IDO): Enhance IDO check with schema version info
-* [#4294](https://github.com/Icinga/icinga2/issues/4294) (DB IDO): Update DB IDO schema version to 1.14.1
-* [#4290](https://github.com/Icinga/icinga2/issues/4290) (API): Implement support for getting a list of global variables from the API
-* [#4281](https://github.com/Icinga/icinga2/issues/4281) (API): Support for enumerating available templates via the API
-* [#4268](https://github.com/Icinga/icinga2/issues/4268) (Performance Data): InfluxDB Metadata
-* [#4206](https://github.com/Icinga/icinga2/issues/4206) (Cluster): Add lag threshold for cluster-zone check
-* [#4178](https://github.com/Icinga/icinga2/issues/4178) (API): Improve logging for HTTP API requests
-* [#4154](https://github.com/Icinga/icinga2/issues/4154) (Configuration): Remove the \(unused\) 'inherits' keyword
-* [#4129](https://github.com/Icinga/icinga2/issues/4129) (Configuration): Improve performance for field accesses
-* [#4061](https://github.com/Icinga/icinga2/issues/4061) (Configuration): Allow strings in state/type filters
-* [#4048](https://github.com/Icinga/icinga2/issues/4048): Cleanup downtimes created by ScheduleDowntime
-* [#4046](https://github.com/Icinga/icinga2/issues/4046) (Configuration): Config parser should not log names of included files by default
-* [#3999](https://github.com/Icinga/icinga2/issues/3999) (API): ApiListener: Make minimum TLS version configurable
-* [#3997](https://github.com/Icinga/icinga2/issues/3997) (API): ApiListener: Force server's preferred cipher
-* [#3911](https://github.com/Icinga/icinga2/issues/3911) (Graphite): Add acknowledgement type to Graphite, InfluxDB, OpenTSDB metadata
-* [#3888](https://github.com/Icinga/icinga2/issues/3888) (API): Implement SSL cipher configuration support for the API feature
-* [#3763](https://github.com/Icinga/icinga2/issues/3763): Add name attribute for WorkQueue class
-* [#3562](https://github.com/Icinga/icinga2/issues/3562) (Performance Data): Add InfluxDbWriter feature
-* [#3400](https://github.com/Icinga/icinga2/issues/3400): Remove the deprecated IcingaStatusWriter feature
-* [#3237](https://github.com/Icinga/icinga2/issues/3237) (Performance Data): Gelf module: expose 'perfdata' fields for 'CHECK\_RESULT' events
-* [#3224](https://github.com/Icinga/icinga2/issues/3224) (Configuration): Implement support for formatting date/time
-* [#3178](https://github.com/Icinga/icinga2/issues/3178) (DB IDO): Add SSL support for the IdoMysqlConnection feature
-* [#2970](https://github.com/Icinga/icinga2/issues/2970) (Performance Data): Add timestamp support for GelfWriter
-* [#2040](https://github.com/Icinga/icinga2/issues/2040): Exclude option for TimePeriod definitions
+* [#4516](https://github.com/icinga/icinga2/issues/4516): Remove some unused \#includes
+* [#4498](https://github.com/icinga/icinga2/issues/4498): Remove unnecessary Dictionary::Contains calls
+* [#4493](https://github.com/icinga/icinga2/issues/4493) (Cluster): Improve performance for Endpoint config validation
+* [#4491](https://github.com/icinga/icinga2/issues/4491): Improve performance for type lookups
+* [#4487](https://github.com/icinga/icinga2/issues/4487) (DB IDO): Incremental updates for the IDO database
+* [#4486](https://github.com/icinga/icinga2/issues/4486) (DB IDO): Remove unused code from the IDO classes
+* [#4485](https://github.com/icinga/icinga2/issues/4485) (API): Add API action for generating a PKI ticket
+* [#4479](https://github.com/icinga/icinga2/issues/4479) (Configuration): Implement comparison operators for the Array class
+* [#4467](https://github.com/icinga/icinga2/issues/4467): Implement the System\#sleep function
+* [#4465](https://github.com/icinga/icinga2/issues/4465) (Configuration): Implement support for namespaces
+* [#4464](https://github.com/icinga/icinga2/issues/4464) (CLI): Implement support for inspecting variables with LLDB/GDB
+* [#4457](https://github.com/icinga/icinga2/issues/4457): Implement support for marking functions as deprecated
+* [#4454](https://github.com/icinga/icinga2/issues/4454): Include compiler name/version and build host name in --version
+* [#4451](https://github.com/icinga/icinga2/issues/4451) (Configuration): Move internal script functions into the 'Internal' namespace
+* [#4449](https://github.com/icinga/icinga2/issues/4449): Improve logging for the WorkQueue class
+* [#4445](https://github.com/icinga/icinga2/issues/4445): Rename/Remove experimental script functions
+* [#4443](https://github.com/icinga/icinga2/issues/4443): Implement process\_check\_result script method for the Checkable class
+* [#4442](https://github.com/icinga/icinga2/issues/4442) (API): Support for determining the Icinga 2 version via the API
+* [#4431](https://github.com/icinga/icinga2/issues/4431) (Notifications): Add the notification type into the log message
+* [#4424](https://github.com/icinga/icinga2/issues/4424) (Cluster): Enhance TLS handshake error messages with connection information
+* [#4415](https://github.com/icinga/icinga2/issues/4415) (API): Remove obsolete debug log message
+* [#4410](https://github.com/icinga/icinga2/issues/4410) (Configuration): Add map/reduce and filter functionality for the Array class
+* [#4403](https://github.com/icinga/icinga2/issues/4403) (CLI): Add history for icinga2 console
+* [#4398](https://github.com/icinga/icinga2/issues/4398) (Cluster): Log a warning if there are more than 2 zone endpoint members
+* [#4393](https://github.com/icinga/icinga2/issues/4393) (Cluster): Include IP address and port in the "New connection" log message
+* [#4388](https://github.com/icinga/icinga2/issues/4388) (Configuration): Implement the \_\_ptr script function
+* [#4386](https://github.com/icinga/icinga2/issues/4386) (Cluster): Improve error messages for failed certificate validation
+* [#4381](https://github.com/icinga/icinga2/issues/4381) (Cluster): Improve log message for connecting nodes without configured Endpoint object
+* [#4352](https://github.com/icinga/icinga2/issues/4352) (Cluster): Enhance client disconnect message for "No data received on new API connection."
+* [#4348](https://github.com/icinga/icinga2/issues/4348) (DB IDO): Do not populate logentries table by default
+* [#4325](https://github.com/icinga/icinga2/issues/4325) (API): API: Add missing downtime\_depth attribute
+* [#4314](https://github.com/icinga/icinga2/issues/4314) (DB IDO): Change Ido\*Connection 'categories' attribute to an array
+* [#4295](https://github.com/icinga/icinga2/issues/4295) (DB IDO): Enhance IDO check with schema version info
+* [#4294](https://github.com/icinga/icinga2/issues/4294) (DB IDO): Update DB IDO schema version to 1.14.1
+* [#4290](https://github.com/icinga/icinga2/issues/4290) (API): Implement support for getting a list of global variables from the API
+* [#4281](https://github.com/icinga/icinga2/issues/4281) (API): Support for enumerating available templates via the API
+* [#4268](https://github.com/icinga/icinga2/issues/4268) (Metrics): InfluxDB Metadata
+* [#4206](https://github.com/icinga/icinga2/issues/4206) (Cluster): Add lag threshold for cluster-zone check
+* [#4178](https://github.com/icinga/icinga2/issues/4178) (API): Improve logging for HTTP API requests
+* [#4154](https://github.com/icinga/icinga2/issues/4154) (Configuration): Remove the \(unused\) 'inherits' keyword
+* [#4129](https://github.com/icinga/icinga2/issues/4129) (Configuration): Improve performance for field accesses
+* [#4061](https://github.com/icinga/icinga2/issues/4061) (Configuration): Allow strings in state/type filters
+* [#4048](https://github.com/icinga/icinga2/issues/4048): Cleanup downtimes created by ScheduleDowntime
+* [#4046](https://github.com/icinga/icinga2/issues/4046) (Configuration): Config parser should not log names of included files by default
+* [#3999](https://github.com/icinga/icinga2/issues/3999) (API): ApiListener: Make minimum TLS version configurable
+* [#3997](https://github.com/icinga/icinga2/issues/3997) (API): ApiListener: Force server's preferred cipher
+* [#3911](https://github.com/icinga/icinga2/issues/3911) (Graphite): Add acknowledgement type to Graphite, InfluxDB, OpenTSDB metadata
+* [#3888](https://github.com/icinga/icinga2/issues/3888) (API): Implement SSL cipher configuration support for the API feature
+* [#3763](https://github.com/icinga/icinga2/issues/3763): Add name attribute for WorkQueue class
+* [#3562](https://github.com/icinga/icinga2/issues/3562) (Metrics): Add InfluxDbWriter feature
+* [#3400](https://github.com/icinga/icinga2/issues/3400): Remove the deprecated IcingaStatusWriter feature
+* [#3237](https://github.com/icinga/icinga2/issues/3237) (Metrics): Gelf module: expose 'perfdata' fields for 'CHECK\_RESULT' events
+* [#3224](https://github.com/icinga/icinga2/issues/3224) (Configuration): Implement support for formatting date/time
+* [#3178](https://github.com/icinga/icinga2/issues/3178) (DB IDO): Add SSL support for the IdoMysqlConnection feature
+* [#2970](https://github.com/icinga/icinga2/issues/2970) (Metrics): Add timestamp support for GelfWriter
+* [#2040](https://github.com/icinga/icinga2/issues/2040): Exclude option for TimePeriod definitions
 
 ### Bug
 
-* [#4534](https://github.com/Icinga/icinga2/issues/4534) (CLI): Icinga2 segault on startup
-* [#4524](https://github.com/Icinga/icinga2/issues/4524) (API): API Remote crash via Google Chrome
-* [#4520](https://github.com/Icinga/icinga2/issues/4520) (Configuration): Memory leak when using closures
-* [#4512](https://github.com/Icinga/icinga2/issues/4512) (Cluster): Incorrect certificate validation error message
-* [#4511](https://github.com/Icinga/icinga2/issues/4511): ClrCheck is null on \*nix
-* [#4505](https://github.com/Icinga/icinga2/issues/4505) (CLI): Cannot set ownership for user 'icinga' group 'icinga' on file '/var/lib/icinga2/ca/serial.txt'.
-* [#4504](https://github.com/Icinga/icinga2/issues/4504) (API): API: events for DowntimeTriggered does not provide needed information
-* [#4502](https://github.com/Icinga/icinga2/issues/4502) (DB IDO): IDO query fails due to key contraint violation for the icinga\_customvariablestatus table
-* [#4501](https://github.com/Icinga/icinga2/issues/4501) (Cluster): DB IDO started before daemonizing \(no systemd\)
-* [#4500](https://github.com/Icinga/icinga2/issues/4500) (DB IDO): Query for customvariablestatus incorrectly updates the host's/service's insert ID
-* [#4499](https://github.com/Icinga/icinga2/issues/4499) (DB IDO): Insert fails for the icinga\_scheduleddowntime table due to duplicate key
-* [#4497](https://github.com/Icinga/icinga2/issues/4497): Fix incorrect detection of the 'Concurrency' variable
-* [#4496](https://github.com/Icinga/icinga2/issues/4496) (API): API: action schedule-downtime requires a duration also when fixed is true
-* [#4495](https://github.com/Icinga/icinga2/issues/4495): Use hash-based serial numbers for new certificates
-* [#4490](https://github.com/Icinga/icinga2/issues/4490) (Cluster): ClusterEvents::NotificationSentAllUsersAPIHandler\(\) does not set notified\_users
-* [#4488](https://github.com/Icinga/icinga2/issues/4488): Replace GetType\(\)-\>GetName\(\) calls with GetReflectionType\(\)-\>GetName\(\)
-* [#4484](https://github.com/Icinga/icinga2/issues/4484) (Cluster): Only allow sending command\_endpoint checks to directly connected child zones
-* [#4483](https://github.com/Icinga/icinga2/issues/4483) (DB IDO): ido CheckCommand returns returns "Could not connect to database server" when HA enabled
-* [#4481](https://github.com/Icinga/icinga2/issues/4481) (DB IDO): Fix the "ido" check command for use with command\_endpoint
-* [#4478](https://github.com/Icinga/icinga2/issues/4478): CompatUtility::GetCheckableNotificationStateFilter is returning an incorrect value
-* [#4476](https://github.com/Icinga/icinga2/issues/4476) (DB IDO): Importing mysql schema fails
-* [#4475](https://github.com/Icinga/icinga2/issues/4475) (CLI): pki sign-csr does not log where it is writing the certificate file
-* [#4472](https://github.com/Icinga/icinga2/issues/4472) (DB IDO): IDO marks objects as inactive on shutdown
-* [#4471](https://github.com/Icinga/icinga2/issues/4471) (DB IDO): IDO does duplicate config updates
-* [#4466](https://github.com/Icinga/icinga2/issues/4466) (Configuration): 'use' keyword cannot be used with templates
-* [#4462](https://github.com/Icinga/icinga2/issues/4462) (Notifications): Add log message if notifications are forced \(i.e. filters are not checked\)
-* [#4461](https://github.com/Icinga/icinga2/issues/4461) (Notifications): Notification resent, even if interval = 0
-* [#4460](https://github.com/Icinga/icinga2/issues/4460) (DB IDO): Fixed downtime start does not update actual\_start\_time
-* [#4458](https://github.com/Icinga/icinga2/issues/4458): Flexible downtimes should be removed after trigger\_time+duration
-* [#4455](https://github.com/Icinga/icinga2/issues/4455): Disallow casting "" to an Object
-* [#4447](https://github.com/Icinga/icinga2/issues/4447): Handle I/O errors while writing the Icinga state file more gracefully
-* [#4446](https://github.com/Icinga/icinga2/issues/4446) (Notifications): Incorrect downtime notification events
-* [#4444](https://github.com/Icinga/icinga2/issues/4444): Fix building Icinga with -fvisibility=hidden
-* [#4439](https://github.com/Icinga/icinga2/issues/4439) (Configuration): Icinga doesn't delete temporary icinga2.debug file when config validation fails
-* [#4434](https://github.com/Icinga/icinga2/issues/4434) (Notifications): Notification sent too fast when one master fails
-* [#4430](https://github.com/Icinga/icinga2/issues/4430) (Cluster): Remove obsolete README files in tools/syntax
-* [#4427](https://github.com/Icinga/icinga2/issues/4427) (Notifications): Missing notification for recovery during downtime
-* [#4425](https://github.com/Icinga/icinga2/issues/4425) (DB IDO): Change the way outdated comments/downtimes are deleted on restart
-* [#4420](https://github.com/Icinga/icinga2/issues/4420) (Notifications): Multiple notifications when master fails
-* [#4418](https://github.com/Icinga/icinga2/issues/4418) (DB IDO): icinga2 IDO reload performance significant slower with latest snapshot release
-* [#4417](https://github.com/Icinga/icinga2/issues/4417) (Notifications): Notification interval mistimed
-* [#4413](https://github.com/Icinga/icinga2/issues/4413) (DB IDO): icinga2 empties custom variables, host-, servcie- and contactgroup members at the end of IDO database reconnection
-* [#4412](https://github.com/Icinga/icinga2/issues/4412) (Notifications): Reminder notifications ignore HA mode
-* [#4405](https://github.com/Icinga/icinga2/issues/4405) (DB IDO): Deprecation warning should include object type and name
-* [#4401](https://github.com/Icinga/icinga2/issues/4401) (Performance Data): Incorrect escaping / formatting of perfdata to InfluxDB
-* [#4399](https://github.com/Icinga/icinga2/issues/4399): Icinga stats min\_execution\_time and max\_execution\_time are invalid
-* [#4394](https://github.com/Icinga/icinga2/issues/4394): icinga check reports "-1" for minimum latency and execution time and only uptime has a number but 0
-* [#4391](https://github.com/Icinga/icinga2/issues/4391) (DB IDO): Do not clear {host,service,contact}group\_members tables on restart
-* [#4384](https://github.com/Icinga/icinga2/issues/4384) (API): Fix URL encoding for '&'
-* [#4380](https://github.com/Icinga/icinga2/issues/4380) (Cluster): Increase cluster reconnect interval
-* [#4378](https://github.com/Icinga/icinga2/issues/4378) (Notifications): Optimize two ObjectLocks into one in Notification::BeginExecuteNotification method
-* [#4376](https://github.com/Icinga/icinga2/issues/4376) (Cluster): CheckerComponent sometimes fails to schedule checks in time
-* [#4375](https://github.com/Icinga/icinga2/issues/4375) (Cluster): Duplicate messages for command\_endpoint w/ master and satellite
-* [#4372](https://github.com/Icinga/icinga2/issues/4372) (API): state\_filters\_real shouldn't be visible in the API
-* [#4371](https://github.com/Icinga/icinga2/issues/4371) (Notifications): notification.notification\_number runtime attribute returning 0 \(instead of 1\) in first notification e-mail
-* [#4370](https://github.com/Icinga/icinga2/issues/4370): Test the change with HARD OK transitions
-* [#4363](https://github.com/Icinga/icinga2/issues/4363) (DB IDO): IDO module starts threads before daemonize
-* [#4356](https://github.com/Icinga/icinga2/issues/4356) (DB IDO): DB IDO query queue does not clean up with v2.4.10-520-g124c80b
-* [#4349](https://github.com/Icinga/icinga2/issues/4349) (DB IDO): Add missing index on state history for DB IDO cleanup
-* [#4345](https://github.com/Icinga/icinga2/issues/4345): Ensure to clear the SSL error queue before calling SSL\_{read,write,do\_handshake}
-* [#4343](https://github.com/Icinga/icinga2/issues/4343) (Configuration): include\_recursive should gracefully handle inaccessible files
-* [#4341](https://github.com/Icinga/icinga2/issues/4341) (API): Icinga incorrectly disconnects all endpoints if one has a wrong certificate
-* [#4340](https://github.com/Icinga/icinga2/issues/4340) (DB IDO): deadlock in ido reconnect
-* [#4329](https://github.com/Icinga/icinga2/issues/4329) (Performance Data): Key Escapes in InfluxDB Writer Don't Work
-* [#4313](https://github.com/Icinga/icinga2/issues/4313) (Configuration): Icinga crashes when using include\_recursive in an object definition
-* [#4309](https://github.com/Icinga/icinga2/issues/4309) (Configuration): ConfigWriter::EmitScope incorrectly quotes dictionary keys
-* [#4300](https://github.com/Icinga/icinga2/issues/4300) (DB IDO): Comment/Downtime delete queries are slow
-* [#4293](https://github.com/Icinga/icinga2/issues/4293) (DB IDO): Overflow in current\_notification\_number column in DB IDO MySQL
-* [#4287](https://github.com/Icinga/icinga2/issues/4287) (DB IDO): Program status table is not updated in IDO after starting icinga
-* [#4283](https://github.com/Icinga/icinga2/issues/4283) (Cluster): Icinga 2 satellite crashes
-* [#4278](https://github.com/Icinga/icinga2/issues/4278) (DB IDO): SOFT state changes with the same state are not logged
-* [#4275](https://github.com/Icinga/icinga2/issues/4275) (API): Trying to delete an object protected by a permissions filter, ends up deleting all objects that match the filter instead
-* [#4274](https://github.com/Icinga/icinga2/issues/4274) (Notifications): Duplicate notifications
-* [#4264](https://github.com/Icinga/icinga2/issues/4264) (Performance Data): InfluxWriter doesnt sanitize the data before sending
-* [#4259](https://github.com/Icinga/icinga2/issues/4259): Flapping Notifications dependent on state change
-* [#4258](https://github.com/Icinga/icinga2/issues/4258): last SOFT state should be hard \(max\_check\_attempts\)
-* [#4257](https://github.com/Icinga/icinga2/issues/4257) (Configuration): Incorrect custom variable name in the hosts.conf example config
-* [#4255](https://github.com/Icinga/icinga2/issues/4255) (Configuration): Config validation should not delete comments/downtimes w/o reference
-* [#4244](https://github.com/Icinga/icinga2/issues/4244): SOFT OK-state after returning from a soft state
-* [#4239](https://github.com/Icinga/icinga2/issues/4239) (Notifications): Downtime notifications do not pass author and comment
-* [#4232](https://github.com/Icinga/icinga2/issues/4232): Problems with check scheduling for HARD state changes \(standalone/command\_endpoint\)
-* [#4231](https://github.com/Icinga/icinga2/issues/4231) (DB IDO): Volatile check results for OK-\>OK transitions are logged into DB IDO statehistory
-* [#4187](https://github.com/Icinga/icinga2/issues/4187): Icinga 2 client gets killed during network scans
-* [#4171](https://github.com/Icinga/icinga2/issues/4171) (DB IDO): Outdated downtime/comments not removed from IDO database \(restart\)
-* [#4134](https://github.com/Icinga/icinga2/issues/4134) (Configuration): Don't allow flow control keywords outside of other flow control constructs
-* [#4121](https://github.com/Icinga/icinga2/issues/4121) (Notifications): notification interval = 0 not honoured in HA clusters
-* [#4106](https://github.com/Icinga/icinga2/issues/4106) (Notifications): last\_problem\_notification should be synced in HA cluster
-* [#4077](https://github.com/Icinga/icinga2/issues/4077): Numbers are not properly formatted in runtime macro strings
-* [#4002](https://github.com/Icinga/icinga2/issues/4002): Don't violate POSIX by ensuring that the argument to usleep\(3\) is less than 1000000 
-* [#3954](https://github.com/Icinga/icinga2/issues/3954) (Cluster): High load when pinning command endpoint on HA cluster
-* [#3949](https://github.com/Icinga/icinga2/issues/3949) (DB IDO): IDO: entry\_time of all comments is set to the date and time when Icinga 2 was restarted
-* [#3902](https://github.com/Icinga/icinga2/issues/3902): Hang in TlsStream::Handshake
-* [#3820](https://github.com/Icinga/icinga2/issues/3820) (Configuration): High CPU usage with self-referenced parent zone config
-* [#3805](https://github.com/Icinga/icinga2/issues/3805) (Performance Data): GELF multi-line output
-* [#3627](https://github.com/Icinga/icinga2/issues/3627) (API): /v1 returns HTML even if JSON is requested
-* [#3486](https://github.com/Icinga/icinga2/issues/3486) (Notifications): Notification times w/ empty begin/end specifications prevent sending notifications
-* [#3370](https://github.com/Icinga/icinga2/issues/3370): Race condition in CreatePipeOverlapped
-* [#3365](https://github.com/Icinga/icinga2/issues/3365) (DB IDO): IDO: there is no usable object index on icinga\_{scheduleddowntime,comments}
-* [#3364](https://github.com/Icinga/icinga2/issues/3364) (DB IDO): IDO: check\_source should not be a TEXT field
-* [#3361](https://github.com/Icinga/icinga2/issues/3361) (DB IDO): Missing indexes for icinga\_endpoints\* and icinga\_zones\* tables in DB IDO schema
-* [#3355](https://github.com/Icinga/icinga2/issues/3355) (DB IDO): IDO: icinga\_host/service\_groups alias columns are TEXT columns
-* [#3229](https://github.com/Icinga/icinga2/issues/3229): Function::Invoke should optionally register ScriptFrame
-* [#2996](https://github.com/Icinga/icinga2/issues/2996) (Cluster): Custom notification external commands do not work in a master-master setup
-* [#2039](https://github.com/Icinga/icinga2/issues/2039): Disable immediate hard state after first checkresult
+* [#4534](https://github.com/icinga/icinga2/issues/4534) (CLI): Icinga2 segault on startup
+* [#4524](https://github.com/icinga/icinga2/issues/4524) (API): API Remote crash via Google Chrome
+* [#4520](https://github.com/icinga/icinga2/issues/4520) (Configuration): Memory leak when using closures
+* [#4512](https://github.com/icinga/icinga2/issues/4512) (Cluster): Incorrect certificate validation error message
+* [#4511](https://github.com/icinga/icinga2/issues/4511): ClrCheck is null on \*nix
+* [#4505](https://github.com/icinga/icinga2/issues/4505) (CLI): Cannot set ownership for user 'icinga' group 'icinga' on file '/var/lib/icinga2/ca/serial.txt'.
+* [#4504](https://github.com/icinga/icinga2/issues/4504) (API): API: events for DowntimeTriggered does not provide needed information
+* [#4502](https://github.com/icinga/icinga2/issues/4502) (DB IDO): IDO query fails due to key contraint violation for the icinga\_customvariablestatus table
+* [#4501](https://github.com/icinga/icinga2/issues/4501) (Cluster): DB IDO started before daemonizing \(no systemd\)
+* [#4500](https://github.com/icinga/icinga2/issues/4500) (DB IDO): Query for customvariablestatus incorrectly updates the host's/service's insert ID
+* [#4499](https://github.com/icinga/icinga2/issues/4499) (DB IDO): Insert fails for the icinga\_scheduleddowntime table due to duplicate key
+* [#4497](https://github.com/icinga/icinga2/issues/4497): Fix incorrect detection of the 'Concurrency' variable
+* [#4496](https://github.com/icinga/icinga2/issues/4496) (API): API: action schedule-downtime requires a duration also when fixed is true
+* [#4495](https://github.com/icinga/icinga2/issues/4495): Use hash-based serial numbers for new certificates
+* [#4490](https://github.com/icinga/icinga2/issues/4490) (Cluster): ClusterEvents::NotificationSentAllUsersAPIHandler\(\) does not set notified\_users
+* [#4488](https://github.com/icinga/icinga2/issues/4488): Replace GetType\(\)-\>GetName\(\) calls with GetReflectionType\(\)-\>GetName\(\)
+* [#4484](https://github.com/icinga/icinga2/issues/4484) (Cluster): Only allow sending command\_endpoint checks to directly connected child zones
+* [#4483](https://github.com/icinga/icinga2/issues/4483) (DB IDO): ido CheckCommand returns returns "Could not connect to database server" when HA enabled
+* [#4481](https://github.com/icinga/icinga2/issues/4481) (DB IDO): Fix the "ido" check command for use with command\_endpoint
+* [#4478](https://github.com/icinga/icinga2/issues/4478): CompatUtility::GetCheckableNotificationStateFilter is returning an incorrect value
+* [#4476](https://github.com/icinga/icinga2/issues/4476) (DB IDO): Importing mysql schema fails
+* [#4475](https://github.com/icinga/icinga2/issues/4475) (CLI): pki sign-csr does not log where it is writing the certificate file
+* [#4472](https://github.com/icinga/icinga2/issues/4472) (DB IDO): IDO marks objects as inactive on shutdown
+* [#4471](https://github.com/icinga/icinga2/issues/4471) (DB IDO): IDO does duplicate config updates
+* [#4466](https://github.com/icinga/icinga2/issues/4466) (Configuration): 'use' keyword cannot be used with templates
+* [#4462](https://github.com/icinga/icinga2/issues/4462) (Notifications): Add log message if notifications are forced \(i.e. filters are not checked\)
+* [#4461](https://github.com/icinga/icinga2/issues/4461) (Notifications): Notification resent, even if interval = 0
+* [#4460](https://github.com/icinga/icinga2/issues/4460) (DB IDO): Fixed downtime start does not update actual\_start\_time
+* [#4458](https://github.com/icinga/icinga2/issues/4458): Flexible downtimes should be removed after trigger\_time+duration
+* [#4455](https://github.com/icinga/icinga2/issues/4455): Disallow casting "" to an Object
+* [#4447](https://github.com/icinga/icinga2/issues/4447): Handle I/O errors while writing the Icinga state file more gracefully
+* [#4446](https://github.com/icinga/icinga2/issues/4446) (Notifications): Incorrect downtime notification events
+* [#4444](https://github.com/icinga/icinga2/issues/4444): Fix building Icinga with -fvisibility=hidden
+* [#4439](https://github.com/icinga/icinga2/issues/4439) (Configuration): Icinga doesn't delete temporary icinga2.debug file when config validation fails
+* [#4434](https://github.com/icinga/icinga2/issues/4434) (Notifications): Notification sent too fast when one master fails
+* [#4430](https://github.com/icinga/icinga2/issues/4430) (Cluster): Remove obsolete README files in tools/syntax
+* [#4427](https://github.com/icinga/icinga2/issues/4427) (Notifications): Missing notification for recovery during downtime
+* [#4425](https://github.com/icinga/icinga2/issues/4425) (DB IDO): Change the way outdated comments/downtimes are deleted on restart
+* [#4420](https://github.com/icinga/icinga2/issues/4420) (Notifications): Multiple notifications when master fails
+* [#4418](https://github.com/icinga/icinga2/issues/4418) (DB IDO): icinga2 IDO reload performance significant slower with latest snapshot release
+* [#4417](https://github.com/icinga/icinga2/issues/4417) (Notifications): Notification interval mistimed
+* [#4413](https://github.com/icinga/icinga2/issues/4413) (DB IDO): icinga2 empties custom variables, host-, servcie- and contactgroup members at the end of IDO database reconnection
+* [#4412](https://github.com/icinga/icinga2/issues/4412) (Notifications): Reminder notifications ignore HA mode
+* [#4405](https://github.com/icinga/icinga2/issues/4405) (DB IDO): Deprecation warning should include object type and name
+* [#4401](https://github.com/icinga/icinga2/issues/4401) (Metrics): Incorrect escaping / formatting of perfdata to InfluxDB
+* [#4399](https://github.com/icinga/icinga2/issues/4399): Icinga stats min\_execution\_time and max\_execution\_time are invalid
+* [#4394](https://github.com/icinga/icinga2/issues/4394): icinga check reports "-1" for minimum latency and execution time and only uptime has a number but 0
+* [#4391](https://github.com/icinga/icinga2/issues/4391) (DB IDO): Do not clear {host,service,contact}group\_members tables on restart
+* [#4384](https://github.com/icinga/icinga2/issues/4384) (API): Fix URL encoding for '&'
+* [#4380](https://github.com/icinga/icinga2/issues/4380) (Cluster): Increase cluster reconnect interval
+* [#4378](https://github.com/icinga/icinga2/issues/4378) (Notifications): Optimize two ObjectLocks into one in Notification::BeginExecuteNotification method
+* [#4376](https://github.com/icinga/icinga2/issues/4376) (Cluster): CheckerComponent sometimes fails to schedule checks in time
+* [#4375](https://github.com/icinga/icinga2/issues/4375) (Cluster): Duplicate messages for command\_endpoint w/ master and satellite
+* [#4372](https://github.com/icinga/icinga2/issues/4372) (API): state\_filters\_real shouldn't be visible in the API
+* [#4371](https://github.com/icinga/icinga2/issues/4371) (Notifications): notification.notification\_number runtime attribute returning 0 \(instead of 1\) in first notification e-mail
+* [#4370](https://github.com/icinga/icinga2/issues/4370): Test the change with HARD OK transitions
+* [#4363](https://github.com/icinga/icinga2/issues/4363) (DB IDO): IDO module starts threads before daemonize
+* [#4356](https://github.com/icinga/icinga2/issues/4356) (DB IDO): DB IDO query queue does not clean up with v2.4.10-520-g124c80b
+* [#4349](https://github.com/icinga/icinga2/issues/4349) (DB IDO): Add missing index on state history for DB IDO cleanup
+* [#4345](https://github.com/icinga/icinga2/issues/4345): Ensure to clear the SSL error queue before calling SSL\_{read,write,do\_handshake}
+* [#4343](https://github.com/icinga/icinga2/issues/4343) (Configuration): include\_recursive should gracefully handle inaccessible files
+* [#4341](https://github.com/icinga/icinga2/issues/4341) (API): Icinga incorrectly disconnects all endpoints if one has a wrong certificate
+* [#4340](https://github.com/icinga/icinga2/issues/4340) (DB IDO): deadlock in ido reconnect
+* [#4329](https://github.com/icinga/icinga2/issues/4329) (Metrics): Key Escapes in InfluxDB Writer Don't Work
+* [#4313](https://github.com/icinga/icinga2/issues/4313) (Configuration): Icinga crashes when using include\_recursive in an object definition
+* [#4309](https://github.com/icinga/icinga2/issues/4309) (Configuration): ConfigWriter::EmitScope incorrectly quotes dictionary keys
+* [#4300](https://github.com/icinga/icinga2/issues/4300) (DB IDO): Comment/Downtime delete queries are slow
+* [#4293](https://github.com/icinga/icinga2/issues/4293) (DB IDO): Overflow in current\_notification\_number column in DB IDO MySQL
+* [#4287](https://github.com/icinga/icinga2/issues/4287) (DB IDO): Program status table is not updated in IDO after starting icinga
+* [#4283](https://github.com/icinga/icinga2/issues/4283) (Cluster): Icinga 2 satellite crashes
+* [#4278](https://github.com/icinga/icinga2/issues/4278) (DB IDO): SOFT state changes with the same state are not logged
+* [#4275](https://github.com/icinga/icinga2/issues/4275) (API): Trying to delete an object protected by a permissions filter, ends up deleting all objects that match the filter instead
+* [#4274](https://github.com/icinga/icinga2/issues/4274) (Notifications): Duplicate notifications
+* [#4264](https://github.com/icinga/icinga2/issues/4264) (Metrics): InfluxWriter doesnt sanitize the data before sending
+* [#4259](https://github.com/icinga/icinga2/issues/4259): Flapping Notifications dependent on state change
+* [#4258](https://github.com/icinga/icinga2/issues/4258): last SOFT state should be hard \(max\_check\_attempts\)
+* [#4257](https://github.com/icinga/icinga2/issues/4257) (Configuration): Incorrect custom variable name in the hosts.conf example config
+* [#4255](https://github.com/icinga/icinga2/issues/4255) (Configuration): Config validation should not delete comments/downtimes w/o reference
+* [#4244](https://github.com/icinga/icinga2/issues/4244): SOFT OK-state after returning from a soft state
+* [#4239](https://github.com/icinga/icinga2/issues/4239) (Notifications): Downtime notifications do not pass author and comment
+* [#4232](https://github.com/icinga/icinga2/issues/4232): Problems with check scheduling for HARD state changes \(standalone/command\_endpoint\)
+* [#4231](https://github.com/icinga/icinga2/issues/4231) (DB IDO): Volatile check results for OK-\>OK transitions are logged into DB IDO statehistory
+* [#4187](https://github.com/icinga/icinga2/issues/4187): Icinga 2 client gets killed during network scans
+* [#4171](https://github.com/icinga/icinga2/issues/4171) (DB IDO): Outdated downtime/comments not removed from IDO database \(restart\)
+* [#4134](https://github.com/icinga/icinga2/issues/4134) (Configuration): Don't allow flow control keywords outside of other flow control constructs
+* [#4121](https://github.com/icinga/icinga2/issues/4121) (Notifications): notification interval = 0 not honoured in HA clusters
+* [#4106](https://github.com/icinga/icinga2/issues/4106) (Notifications): last\_problem\_notification should be synced in HA cluster
+* [#4077](https://github.com/icinga/icinga2/issues/4077): Numbers are not properly formatted in runtime macro strings
+* [#4002](https://github.com/icinga/icinga2/issues/4002): Don't violate POSIX by ensuring that the argument to usleep\(3\) is less than 1000000 
+* [#3954](https://github.com/icinga/icinga2/issues/3954) (Cluster): High load when pinning command endpoint on HA cluster
+* [#3949](https://github.com/icinga/icinga2/issues/3949) (DB IDO): IDO: entry\_time of all comments is set to the date and time when Icinga 2 was restarted
+* [#3902](https://github.com/icinga/icinga2/issues/3902): Hang in TlsStream::Handshake
+* [#3820](https://github.com/icinga/icinga2/issues/3820) (Configuration): High CPU usage with self-referenced parent zone config
+* [#3805](https://github.com/icinga/icinga2/issues/3805) (Metrics): GELF multi-line output
+* [#3627](https://github.com/icinga/icinga2/issues/3627) (API): /v1 returns HTML even if JSON is requested
+* [#3486](https://github.com/icinga/icinga2/issues/3486) (Notifications): Notification times w/ empty begin/end specifications prevent sending notifications
+* [#3370](https://github.com/icinga/icinga2/issues/3370): Race condition in CreatePipeOverlapped
+* [#3365](https://github.com/icinga/icinga2/issues/3365) (DB IDO): IDO: there is no usable object index on icinga\_{scheduleddowntime,comments}
+* [#3364](https://github.com/icinga/icinga2/issues/3364) (DB IDO): IDO: check\_source should not be a TEXT field
+* [#3361](https://github.com/icinga/icinga2/issues/3361) (DB IDO): Missing indexes for icinga\_endpoints\* and icinga\_zones\* tables in DB IDO schema
+* [#3355](https://github.com/icinga/icinga2/issues/3355) (DB IDO): IDO: icinga\_host/service\_groups alias columns are TEXT columns
+* [#3229](https://github.com/icinga/icinga2/issues/3229): Function::Invoke should optionally register ScriptFrame
+* [#2996](https://github.com/icinga/icinga2/issues/2996) (Cluster): Custom notification external commands do not work in a master-master setup
+* [#2039](https://github.com/icinga/icinga2/issues/2039): Disable immediate hard state after first checkresult
 
 ### ITL
 
-* [#4518](https://github.com/Icinga/icinga2/issues/4518) (ITL): ITL uses unsupported arguments for check\_swap on Debian wheezy/Ubuntu trusty
-* [#4506](https://github.com/Icinga/icinga2/issues/4506) (ITL): Add interfacetable CheckCommand options --trafficwithpkt and --snmp-maxmsgsize
-* [#4477](https://github.com/Icinga/icinga2/issues/4477) (ITL): Add perfsyntax parameter to nscp-local-counter CheckCommand
-* [#4456](https://github.com/Icinga/icinga2/issues/4456) (ITL): Add custom variables for all check\_swap arguments
-* [#4437](https://github.com/Icinga/icinga2/issues/4437) (ITL): Add command definition for check\_mysql\_query
-* [#4421](https://github.com/Icinga/icinga2/issues/4421) (ITL): -q option for check\_ntp\_time is wrong
-* [#4416](https://github.com/Icinga/icinga2/issues/4416) (ITL): Add check command definition for check\_graphite
-* [#4397](https://github.com/Icinga/icinga2/issues/4397) (ITL): A lot of missing parameters for \(latest\) mysql\_health
-* [#4379](https://github.com/Icinga/icinga2/issues/4379) (ITL): Add support for "-A" command line switch to CheckCommand "snmp-process" 
-* [#4359](https://github.com/Icinga/icinga2/issues/4359) (ITL): ITL: check\_iftraffic64.pl default values, wrong postfix value in CheckCommand
-* [#4332](https://github.com/Icinga/icinga2/issues/4332) (ITL): Add check command definition for db2\_health
-* [#4305](https://github.com/Icinga/icinga2/issues/4305) (ITL): Add check command definitions for kdc and rbl
-* [#4297](https://github.com/Icinga/icinga2/issues/4297) (ITL): add check command for plugin check\_apache\_status
-* [#4276](https://github.com/Icinga/icinga2/issues/4276) (ITL): Adding option to access ifName for manubulon snmp-interface check command
-* [#4254](https://github.com/Icinga/icinga2/issues/4254) (ITL): Add "fuse.gvfsd-fuse" to the list of excluded file systems for check\_disk
-* [#4250](https://github.com/Icinga/icinga2/issues/4250) (ITL): Add CIM port parameter for esxi\_hardware CheckCommand
-* [#4023](https://github.com/Icinga/icinga2/issues/4023) (ITL): Add "retries" option to check\_snmp command
-* [#3711](https://github.com/Icinga/icinga2/issues/3711) (ITL): icinga2.conf: Include plugins-contrib, manubulon, windows-plugins, nscp by default
-* [#3683](https://github.com/Icinga/icinga2/issues/3683) (ITL): Add IPv4/IPv6 support to the rest of the monitoring-plugins
-* [#3012](https://github.com/Icinga/icinga2/issues/3012) (ITL): Extend CheckCommand definitions for nscp-local
+* [#4518](https://github.com/icinga/icinga2/issues/4518) (ITL): ITL uses unsupported arguments for check\_swap on Debian wheezy/Ubuntu trusty
+* [#4506](https://github.com/icinga/icinga2/issues/4506) (ITL): Add interfacetable CheckCommand options --trafficwithpkt and --snmp-maxmsgsize
+* [#4477](https://github.com/icinga/icinga2/issues/4477) (ITL): Add perfsyntax parameter to nscp-local-counter CheckCommand
+* [#4456](https://github.com/icinga/icinga2/issues/4456) (ITL): Add custom variables for all check\_swap arguments
+* [#4437](https://github.com/icinga/icinga2/issues/4437) (ITL): Add command definition for check\_mysql\_query
+* [#4421](https://github.com/icinga/icinga2/issues/4421) (ITL): -q option for check\_ntp\_time is wrong
+* [#4416](https://github.com/icinga/icinga2/issues/4416) (ITL): Add check command definition for check\_graphite
+* [#4397](https://github.com/icinga/icinga2/issues/4397) (ITL): A lot of missing parameters for \(latest\) mysql\_health
+* [#4379](https://github.com/icinga/icinga2/issues/4379) (ITL): Add support for "-A" command line switch to CheckCommand "snmp-process" 
+* [#4359](https://github.com/icinga/icinga2/issues/4359) (ITL): ITL: check\_iftraffic64.pl default values, wrong postfix value in CheckCommand
+* [#4332](https://github.com/icinga/icinga2/issues/4332) (ITL): Add check command definition for db2\_health
+* [#4305](https://github.com/icinga/icinga2/issues/4305) (ITL): Add check command definitions for kdc and rbl
+* [#4297](https://github.com/icinga/icinga2/issues/4297) (ITL): add check command for plugin check\_apache\_status
+* [#4276](https://github.com/icinga/icinga2/issues/4276) (ITL): Adding option to access ifName for manubulon snmp-interface check command
+* [#4254](https://github.com/icinga/icinga2/issues/4254) (ITL): Add "fuse.gvfsd-fuse" to the list of excluded file systems for check\_disk
+* [#4250](https://github.com/icinga/icinga2/issues/4250) (ITL): Add CIM port parameter for esxi\_hardware CheckCommand
+* [#4023](https://github.com/icinga/icinga2/issues/4023) (ITL): Add "retries" option to check\_snmp command
+* [#3711](https://github.com/icinga/icinga2/issues/3711) (ITL): icinga2.conf: Include plugins-contrib, manubulon, windows-plugins, nscp by default
+* [#3683](https://github.com/icinga/icinga2/issues/3683) (ITL): Add IPv4/IPv6 support to the rest of the monitoring-plugins
+* [#3012](https://github.com/icinga/icinga2/issues/3012) (ITL): Extend CheckCommand definitions for nscp-local
 
 ### Documentation
 
-* [#4521](https://github.com/Icinga/icinga2/issues/4521) (Documentation): Typo in Notification object documentation
-* [#4517](https://github.com/Icinga/icinga2/issues/4517) (Documentation): Documentation is missing for the API permissions that are new in 2.5.0
-* [#4513](https://github.com/Icinga/icinga2/issues/4513) (Documentation): Development docs: Add own section for gdb backtrace from a running process
-* [#4510](https://github.com/Icinga/icinga2/issues/4510) (Documentation): Docs: API example uses wrong attribute name
-* [#4489](https://github.com/Icinga/icinga2/issues/4489) (Documentation): Missing documentation for "legacy-timeperiod" template
-* [#4470](https://github.com/Icinga/icinga2/issues/4470) (Documentation): The description for the http\_certificate attribute doesn't have the right default value
-* [#4468](https://github.com/Icinga/icinga2/issues/4468) (Documentation): Add URL and short description for Monitoring Plugins inside the ITL documentation
-* [#4453](https://github.com/Icinga/icinga2/issues/4453) (Documentation): Rewrite Client and Cluster chapter and; add service monitoring chapter
-* [#4419](https://github.com/Icinga/icinga2/issues/4419) (Documentation): Incorrect API permission name for /v1/status in the documentation
-* [#4396](https://github.com/Icinga/icinga2/issues/4396) (Documentation): Missing explanation for three level clusters with CSR auto-signing
-* [#4395](https://github.com/Icinga/icinga2/issues/4395) (Documentation): Incorrect documentation about apply rules in zones.d directories
-* [#4387](https://github.com/Icinga/icinga2/issues/4387) (Documentation): Improve author information about check\_yum
-* [#4361](https://github.com/Icinga/icinga2/issues/4361) (Documentation): pkg-config is not listed as a build requirement in INSTALL.md
-* [#4337](https://github.com/Icinga/icinga2/issues/4337) (Documentation): Add a note to the docs that API POST updates to custom attributes/groups won't trigger re-evaluation
-* [#4333](https://github.com/Icinga/icinga2/issues/4333) (Documentation): Documentation: Setting up Plugins section is broken
-* [#4328](https://github.com/Icinga/icinga2/issues/4328) (Documentation): Typo in Manubulon CheckCommand documentation
-* [#4318](https://github.com/Icinga/icinga2/issues/4318) (Documentation): Migration docs still show unsupported CHANGE\_\*MODATTR external commands
-* [#4306](https://github.com/Icinga/icinga2/issues/4306) (Documentation): Add a note about creating Zone/Endpoint objects with the API
-* [#4299](https://github.com/Icinga/icinga2/issues/4299) (Documentation): Incorrect URL for API examples in the documentation
-* [#4265](https://github.com/Icinga/icinga2/issues/4265) (Documentation): Improve "Endpoint" documentation
-* [#4263](https://github.com/Icinga/icinga2/issues/4263) (Documentation): Fix systemd client command formatting
-* [#4238](https://github.com/Icinga/icinga2/issues/4238) (Documentation): Missing quotes for API action URL
-* [#4236](https://github.com/Icinga/icinga2/issues/4236) (Documentation): Use HTTPS for debmon.org links in the documentation
-* [#4217](https://github.com/Icinga/icinga2/issues/4217) (Documentation): node setup: Add a note for --endpoint syntax for client-master connection
-* [#4124](https://github.com/Icinga/icinga2/issues/4124) (Documentation): Documentation review
-* [#3612](https://github.com/Icinga/icinga2/issues/3612) (Documentation): Update SELinux documentation
+* [#4521](https://github.com/icinga/icinga2/issues/4521) (Documentation): Typo in Notification object documentation
+* [#4517](https://github.com/icinga/icinga2/issues/4517) (Documentation): Documentation is missing for the API permissions that are new in 2.5.0
+* [#4513](https://github.com/icinga/icinga2/issues/4513) (Documentation): Development docs: Add own section for gdb backtrace from a running process
+* [#4510](https://github.com/icinga/icinga2/issues/4510) (Documentation): Docs: API example uses wrong attribute name
+* [#4489](https://github.com/icinga/icinga2/issues/4489) (Documentation): Missing documentation for "legacy-timeperiod" template
+* [#4470](https://github.com/icinga/icinga2/issues/4470) (Documentation): The description for the http\_certificate attribute doesn't have the right default value
+* [#4468](https://github.com/icinga/icinga2/issues/4468) (Documentation): Add URL and short description for Monitoring Plugins inside the ITL documentation
+* [#4453](https://github.com/icinga/icinga2/issues/4453) (Documentation): Rewrite Client and Cluster chapter and; add service monitoring chapter
+* [#4419](https://github.com/icinga/icinga2/issues/4419) (Documentation): Incorrect API permission name for /v1/status in the documentation
+* [#4396](https://github.com/icinga/icinga2/issues/4396) (Documentation): Missing explanation for three level clusters with CSR auto-signing
+* [#4395](https://github.com/icinga/icinga2/issues/4395) (Documentation): Incorrect documentation about apply rules in zones.d directories
+* [#4387](https://github.com/icinga/icinga2/issues/4387) (Documentation): Improve author information about check\_yum
+* [#4361](https://github.com/icinga/icinga2/issues/4361) (Documentation): pkg-config is not listed as a build requirement in INSTALL.md
+* [#4337](https://github.com/icinga/icinga2/issues/4337) (Documentation): Add a note to the docs that API POST updates to custom attributes/groups won't trigger re-evaluation
+* [#4333](https://github.com/icinga/icinga2/issues/4333) (Documentation): Documentation: Setting up Plugins section is broken
+* [#4328](https://github.com/icinga/icinga2/issues/4328) (Documentation): Typo in Manubulon CheckCommand documentation
+* [#4318](https://github.com/icinga/icinga2/issues/4318) (Documentation): Migration docs still show unsupported CHANGE\_\*MODATTR external commands
+* [#4306](https://github.com/icinga/icinga2/issues/4306) (Documentation): Add a note about creating Zone/Endpoint objects with the API
+* [#4299](https://github.com/icinga/icinga2/issues/4299) (Documentation): Incorrect URL for API examples in the documentation
+* [#4265](https://github.com/icinga/icinga2/issues/4265) (Documentation): Improve "Endpoint" documentation
+* [#4263](https://github.com/icinga/icinga2/issues/4263) (Documentation): Fix systemd client command formatting
+* [#4238](https://github.com/icinga/icinga2/issues/4238) (Documentation): Missing quotes for API action URL
+* [#4236](https://github.com/icinga/icinga2/issues/4236) (Documentation): Use HTTPS for debmon.org links in the documentation
+* [#4217](https://github.com/icinga/icinga2/issues/4217) (Documentation): node setup: Add a note for --endpoint syntax for client-master connection
+* [#4124](https://github.com/icinga/icinga2/issues/4124) (Documentation): Documentation review
+* [#3612](https://github.com/icinga/icinga2/issues/3612) (Documentation): Update SELinux documentation
 
 ### Support
 
-* [#4526](https://github.com/Icinga/icinga2/issues/4526) (Packages): Revert dependency on firewalld on RHEL
-* [#4494](https://github.com/Icinga/icinga2/issues/4494) (Installation): Remove unused functions from icinga-installer
-* [#4452](https://github.com/Icinga/icinga2/issues/4452) (Packages): Error compiling on windows due to changes in apilistener around minimum tls version
-* [#4432](https://github.com/Icinga/icinga2/issues/4432) (Packages): Windows build broken since ref 11292
-* [#4404](https://github.com/Icinga/icinga2/issues/4404) (Installation): Increase default systemd timeout
-* [#4344](https://github.com/Icinga/icinga2/issues/4344) (Packages): Build fails with Visual Studio 2013
-* [#4327](https://github.com/Icinga/icinga2/issues/4327) (Packages): Icinga fails to build with OpenSSL 1.1.0
-* [#4251](https://github.com/Icinga/icinga2/issues/4251) (Tests): Add debugging mode for Utility::GetTime
-* [#4234](https://github.com/Icinga/icinga2/issues/4234) (Tests): Boost tests are missing a dependency on libmethods
-* [#4230](https://github.com/Icinga/icinga2/issues/4230) (Installation): Windows: Error with repository handler \(missing /var/lib/icinga2/api/repository path\)
-* [#4211](https://github.com/Icinga/icinga2/issues/4211) (Packages): Incorrect filter in pick.py
-* [#4190](https://github.com/Icinga/icinga2/issues/4190) (Packages): Windows Installer: Remove dependency on KB2999226 package
-* [#4148](https://github.com/Icinga/icinga2/issues/4148) (Packages): RPM update starts disabled icinga2 service
-* [#4147](https://github.com/Icinga/icinga2/issues/4147) (Packages): Reload permission error with SELinux
-* [#4135](https://github.com/Icinga/icinga2/issues/4135) (Installation): Add script for automatically cherry-picking commits for minor versions
-* [#3829](https://github.com/Icinga/icinga2/issues/3829) (Packages): Provide packages for icinga-studio on Fedora
-* [#3708](https://github.com/Icinga/icinga2/issues/3708) (Packages): Firewalld Service definition for Icinga
-* [#2606](https://github.com/Icinga/icinga2/issues/2606) (Packages): Package for syntax highlighting
+* [#4526](https://github.com/icinga/icinga2/issues/4526) (Packages): Revert dependency on firewalld on RHEL
+* [#4494](https://github.com/icinga/icinga2/issues/4494) (Installation): Remove unused functions from icinga-installer
+* [#4452](https://github.com/icinga/icinga2/issues/4452) (Packages): Error compiling on windows due to changes in apilistener around minimum tls version
+* [#4432](https://github.com/icinga/icinga2/issues/4432) (Packages): Windows build broken since ref 11292
+* [#4404](https://github.com/icinga/icinga2/issues/4404) (Installation): Increase default systemd timeout
+* [#4344](https://github.com/icinga/icinga2/issues/4344) (Packages): Build fails with Visual Studio 2013
+* [#4327](https://github.com/icinga/icinga2/issues/4327) (Packages): Icinga fails to build with OpenSSL 1.1.0
+* [#4251](https://github.com/icinga/icinga2/issues/4251) (Tests): Add debugging mode for Utility::GetTime
+* [#4234](https://github.com/icinga/icinga2/issues/4234) (Tests): Boost tests are missing a dependency on libmethods
+* [#4230](https://github.com/icinga/icinga2/issues/4230) (Installation): Windows: Error with repository handler \(missing /var/lib/icinga2/api/repository path\)
+* [#4211](https://github.com/icinga/icinga2/issues/4211) (Packages): Incorrect filter in pick.py
+* [#4190](https://github.com/icinga/icinga2/issues/4190) (Packages): Windows Installer: Remove dependency on KB2999226 package
+* [#4148](https://github.com/icinga/icinga2/issues/4148) (Packages): RPM update starts disabled icinga2 service
+* [#4147](https://github.com/icinga/icinga2/issues/4147) (Packages): Reload permission error with SELinux
+* [#4135](https://github.com/icinga/icinga2/issues/4135) (Installation): Add script for automatically cherry-picking commits for minor versions
+* [#3829](https://github.com/icinga/icinga2/issues/3829) (Packages): Provide packages for icinga-studio on Fedora
+* [#3708](https://github.com/icinga/icinga2/issues/3708) (Packages): Firewalld Service definition for Icinga
+* [#2606](https://github.com/icinga/icinga2/issues/2606) (Packages): Package for syntax highlighting
 
 ## 2.4.9 (2016-05-19)
 
@@ -1088,10 +1140,10 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#4225](https://github.com/Icinga/icinga2/issues/4225) (Compat): Command Pipe thread 100% CPU Usage
-* [#4224](https://github.com/Icinga/icinga2/issues/4224): Checks are not executed anymore on command
-* [#4222](https://github.com/Icinga/icinga2/issues/4222) (Configuration): Segfault when trying to start 2.4.8
-* [#4221](https://github.com/Icinga/icinga2/issues/4221) (Performance Data): Error: Function call 'rename' for file '/var/spool/icinga2/tmp/service-perfdata' failed with error code 2, 'No such file or directory'
+* [#4225](https://github.com/icinga/icinga2/issues/4225) (Compat): Command Pipe thread 100% CPU Usage
+* [#4224](https://github.com/icinga/icinga2/issues/4224): Checks are not executed anymore on command
+* [#4222](https://github.com/icinga/icinga2/issues/4222) (Configuration): Segfault when trying to start 2.4.8
+* [#4221](https://github.com/icinga/icinga2/issues/4221) (Metrics): Error: Function call 'rename' for file '/var/spool/icinga2/tmp/service-perfdata' failed with error code 2, 'No such file or directory'
 
 ## 2.4.10 (2016-05-19)
 
@@ -1101,7 +1153,7 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#4227](https://github.com/Icinga/icinga2/issues/4227): Checker component doesn't execute any checks for command\_endpoint
+* [#4227](https://github.com/icinga/icinga2/issues/4227): Checker component doesn't execute any checks for command\_endpoint
 
 ## 2.4.8 (2016-05-17)
 
@@ -1114,54 +1166,54 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#4203](https://github.com/Icinga/icinga2/issues/4203) (Cluster): Only activate HARunOnce objects once there's a cluster connection
-* [#4198](https://github.com/Icinga/icinga2/issues/4198): Move CalculateExecutionTime and CalculateLatency into the CheckResult class
-* [#4196](https://github.com/Icinga/icinga2/issues/4196) (Cluster): Remove unused cluster commands
-* [#4149](https://github.com/Icinga/icinga2/issues/4149) (CLI): Implement SNI support for the CLI commands
-* [#4103](https://github.com/Icinga/icinga2/issues/4103): Add support for subjectAltName in SSL certificates
-* [#3919](https://github.com/Icinga/icinga2/issues/3919) (Configuration): Internal check for config problems
-* [#3321](https://github.com/Icinga/icinga2/issues/3321): "icinga" check should have state WARNING when the last reload failed
-* [#2993](https://github.com/Icinga/icinga2/issues/2993) (Performance Data): PerfdataWriter: Better failure handling for file renames across file systems
-* [#2896](https://github.com/Icinga/icinga2/issues/2896) (Cluster): Alert config reload failures with the icinga check 
-* [#2468](https://github.com/Icinga/icinga2/issues/2468): Maximum concurrent service checks
+* [#4203](https://github.com/icinga/icinga2/issues/4203) (Cluster): Only activate HARunOnce objects once there's a cluster connection
+* [#4198](https://github.com/icinga/icinga2/issues/4198): Move CalculateExecutionTime and CalculateLatency into the CheckResult class
+* [#4196](https://github.com/icinga/icinga2/issues/4196) (Cluster): Remove unused cluster commands
+* [#4149](https://github.com/icinga/icinga2/issues/4149) (CLI): Implement SNI support for the CLI commands
+* [#4103](https://github.com/icinga/icinga2/issues/4103): Add support for subjectAltName in SSL certificates
+* [#3919](https://github.com/icinga/icinga2/issues/3919) (Configuration): Internal check for config problems
+* [#3321](https://github.com/icinga/icinga2/issues/3321): "icinga" check should have state WARNING when the last reload failed
+* [#2993](https://github.com/icinga/icinga2/issues/2993) (Metrics): PerfdataWriter: Better failure handling for file renames across file systems
+* [#2896](https://github.com/icinga/icinga2/issues/2896) (Cluster): Alert config reload failures with the icinga check 
+* [#2468](https://github.com/icinga/icinga2/issues/2468): Maximum concurrent service checks
 
 ### Bug
 
-* [#4219](https://github.com/Icinga/icinga2/issues/4219) (DB IDO): Postgresql warnings on startup
-* [#4212](https://github.com/Icinga/icinga2/issues/4212): assertion failed: GetResumeCalled\(\)
-* [#4210](https://github.com/Icinga/icinga2/issues/4210) (API): Incorrect variable names for joined fields in filters
-* [#4204](https://github.com/Icinga/icinga2/issues/4204) (DB IDO): Ensure that program status updates are immediately updated in DB IDO
-* [#4202](https://github.com/Icinga/icinga2/issues/4202) (API): API: Missing error handling for invalid JSON request body
-* [#4182](https://github.com/Icinga/icinga2/issues/4182): Crash in UnameHelper
-* [#4180](https://github.com/Icinga/icinga2/issues/4180): Expired downtimes are not removed
-* [#4170](https://github.com/Icinga/icinga2/issues/4170) (API): Icinga Crash with the workflow Create\_Host-\> Downtime for the Host -\>  Delete Downtime -\> Remove Host
-* [#4145](https://github.com/Icinga/icinga2/issues/4145) (Configuration): Wrong log severity causes segfault
-* [#4120](https://github.com/Icinga/icinga2/issues/4120): notification sent out during flexible downtime
-* [#4038](https://github.com/Icinga/icinga2/issues/4038) (API): inconsistent API /v1/objects/\* response for PUT requests
-* [#4037](https://github.com/Icinga/icinga2/issues/4037) (Compat): Command pipe overloaded: Can't send external Icinga command to the local command file
-* [#4029](https://github.com/Icinga/icinga2/issues/4029) (API): Icinga2 API: deleting service with cascade=1 does not delete dependant notification
-* [#3938](https://github.com/Icinga/icinga2/issues/3938): Crash with empty ScheduledDowntime 'ranges' attribute
-* [#3932](https://github.com/Icinga/icinga2/issues/3932): "day -X" time specifications are parsed incorrectly
-* [#3912](https://github.com/Icinga/icinga2/issues/3912) (Compat): Empty author/text attribute for comment/downtimes external commands causing crash
-* [#3881](https://github.com/Icinga/icinga2/issues/3881) (Cluster): Icinga2 agent gets stuck after disconnect and won't relay messages
-* [#3707](https://github.com/Icinga/icinga2/issues/3707) (Configuration): Comments and downtimes of deleted checkable objects are not deleted
-* [#3526](https://github.com/Icinga/icinga2/issues/3526): Icinga crashes with a segfault on receiving a lot of check results for nonexisting hosts/services
-* [#3316](https://github.com/Icinga/icinga2/issues/3316) (Configuration): Service apply without name possible
+* [#4219](https://github.com/icinga/icinga2/issues/4219) (DB IDO): Postgresql warnings on startup
+* [#4212](https://github.com/icinga/icinga2/issues/4212): assertion failed: GetResumeCalled\(\)
+* [#4210](https://github.com/icinga/icinga2/issues/4210) (API): Incorrect variable names for joined fields in filters
+* [#4204](https://github.com/icinga/icinga2/issues/4204) (DB IDO): Ensure that program status updates are immediately updated in DB IDO
+* [#4202](https://github.com/icinga/icinga2/issues/4202) (API): API: Missing error handling for invalid JSON request body
+* [#4182](https://github.com/icinga/icinga2/issues/4182): Crash in UnameHelper
+* [#4180](https://github.com/icinga/icinga2/issues/4180): Expired downtimes are not removed
+* [#4170](https://github.com/icinga/icinga2/issues/4170) (API): Icinga Crash with the workflow Create\_Host-\> Downtime for the Host -\>  Delete Downtime -\> Remove Host
+* [#4145](https://github.com/icinga/icinga2/issues/4145) (Configuration): Wrong log severity causes segfault
+* [#4120](https://github.com/icinga/icinga2/issues/4120): notification sent out during flexible downtime
+* [#4038](https://github.com/icinga/icinga2/issues/4038) (API): inconsistent API /v1/objects/\* response for PUT requests
+* [#4037](https://github.com/icinga/icinga2/issues/4037) (Compat): Command pipe overloaded: Can't send external Icinga command to the local command file
+* [#4029](https://github.com/icinga/icinga2/issues/4029) (API): Icinga2 API: deleting service with cascade=1 does not delete dependant notification
+* [#3938](https://github.com/icinga/icinga2/issues/3938): Crash with empty ScheduledDowntime 'ranges' attribute
+* [#3932](https://github.com/icinga/icinga2/issues/3932): "day -X" time specifications are parsed incorrectly
+* [#3912](https://github.com/icinga/icinga2/issues/3912) (Compat): Empty author/text attribute for comment/downtimes external commands causing crash
+* [#3881](https://github.com/icinga/icinga2/issues/3881) (Cluster): Icinga2 agent gets stuck after disconnect and won't relay messages
+* [#3707](https://github.com/icinga/icinga2/issues/3707) (Configuration): Comments and downtimes of deleted checkable objects are not deleted
+* [#3526](https://github.com/icinga/icinga2/issues/3526): Icinga crashes with a segfault on receiving a lot of check results for nonexisting hosts/services
+* [#3316](https://github.com/icinga/icinga2/issues/3316) (Configuration): Service apply without name possible
 
 ### ITL
 
-* [#4184](https://github.com/Icinga/icinga2/issues/4184) (ITL): 'disk' CheckCommand: Exclude 'cgroup' and 'tracefs' by default
-* [#3634](https://github.com/Icinga/icinga2/issues/3634) (ITL): Provide icingacli in the ITL
+* [#4184](https://github.com/icinga/icinga2/issues/4184) (ITL): 'disk' CheckCommand: Exclude 'cgroup' and 'tracefs' by default
+* [#3634](https://github.com/icinga/icinga2/issues/3634) (ITL): Provide icingacli in the ITL
 
 ### Documentation
 
-* [#4205](https://github.com/Icinga/icinga2/issues/4205) (Documentation): Add the category to the generated changelog
-* [#4193](https://github.com/Icinga/icinga2/issues/4193) (Documentation): Missing documentation for event commands w/ execution bridge
-* [#4144](https://github.com/Icinga/icinga2/issues/4144) (Documentation): Incorrect chapter headings for Object\#to\_string and Object\#type
+* [#4205](https://github.com/icinga/icinga2/issues/4205) (Documentation): Add the category to the generated changelog
+* [#4193](https://github.com/icinga/icinga2/issues/4193) (Documentation): Missing documentation for event commands w/ execution bridge
+* [#4144](https://github.com/icinga/icinga2/issues/4144) (Documentation): Incorrect chapter headings for Object\#to\_string and Object\#type
 
 ### Support
 
-* [#4146](https://github.com/Icinga/icinga2/issues/4146) (Packages): Update chocolatey packages and RELEASE.md
+* [#4146](https://github.com/icinga/icinga2/issues/4146) (Packages): Update chocolatey packages and RELEASE.md
 
 ## 2.4.7 (2016-04-21)
 
@@ -1171,7 +1223,7 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#4142](https://github.com/Icinga/icinga2/issues/4142) (DB IDO): Crash in IdoMysqlConnection::ExecuteMultipleQueries
+* [#4142](https://github.com/icinga/icinga2/issues/4142) (DB IDO): Crash in IdoMysqlConnection::ExecuteMultipleQueries
 
 ## 2.4.6 (2016-04-20)
 
@@ -1181,16 +1233,16 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#4140](https://github.com/Icinga/icinga2/issues/4140) (DB IDO): Failed assertion in IdoPgsqlConnection::FieldToEscapedString
+* [#4140](https://github.com/icinga/icinga2/issues/4140) (DB IDO): Failed assertion in IdoPgsqlConnection::FieldToEscapedString
 
 ### Documentation
 
-* [#4141](https://github.com/Icinga/icinga2/issues/4141) (Documentation): Update RELEASE.md
-* [#4136](https://github.com/Icinga/icinga2/issues/4136) (Documentation): Docs: Zone attribute 'endpoints' is an array
+* [#4141](https://github.com/icinga/icinga2/issues/4141) (Documentation): Update RELEASE.md
+* [#4136](https://github.com/icinga/icinga2/issues/4136) (Documentation): Docs: Zone attribute 'endpoints' is an array
 
 ### Support
 
-* [#4139](https://github.com/Icinga/icinga2/issues/4139) (Packages): Icinga 2 fails to build on Ubuntu Xenial
+* [#4139](https://github.com/icinga/icinga2/issues/4139) (Packages): Icinga 2 fails to build on Ubuntu Xenial
 
 ## 2.4.5 (2016-04-20)
 
@@ -1203,67 +1255,67 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3023](https://github.com/Icinga/icinga2/issues/3023) (Configuration): Implement support for overriding check command timeout
+* [#3023](https://github.com/icinga/icinga2/issues/3023) (Configuration): Implement support for overriding check command timeout
 
 ### Bug
 
-* [#4131](https://github.com/Icinga/icinga2/issues/4131) (Configuration): Vim Syntax Highlighting does not work with assign where
-* [#4116](https://github.com/Icinga/icinga2/issues/4116) (API): icinga2 crashes when a command\_endpoint is set, but the api feature is not active
-* [#4114](https://github.com/Icinga/icinga2/issues/4114): Compiler warning in NotifyActive
-* [#4109](https://github.com/Icinga/icinga2/issues/4109) (API): Navigation attributes are missing in /v1/objects/\<type\>
-* [#4104](https://github.com/Icinga/icinga2/issues/4104) (Configuration): Segfault during config validation if host exists, service does not exist any longer and downtime expires
-* [#4095](https://github.com/Icinga/icinga2/issues/4095): DowntimesExpireTimerHandler crashes Icinga2 with \<unknown function\>
-* [#4089](https://github.com/Icinga/icinga2/issues/4089): Make the socket event engine configurable
-* [#4078](https://github.com/Icinga/icinga2/issues/4078) (Configuration): Overwriting global type variables causes crash in ConfigItem::Commit\(\)
-* [#4076](https://github.com/Icinga/icinga2/issues/4076) (API): API User gets wrongly authenticated \(client\_cn and no password\)
-* [#4066](https://github.com/Icinga/icinga2/issues/4066): ConfigSync broken from 2.4.3. to 2.4.4 under Windows
-* [#4056](https://github.com/Icinga/icinga2/issues/4056) (CLI): Remove semi-colons in the auto-generated configs
-* [#4052](https://github.com/Icinga/icinga2/issues/4052) (API): Config validation for Notification objects should check whether the state filters are valid
-* [#4035](https://github.com/Icinga/icinga2/issues/4035) (DB IDO): IDO: historical contact notifications table column notification\_id is off-by-one
-* [#4031](https://github.com/Icinga/icinga2/issues/4031): Downtimes are not always activated/expired on restart
-* [#4016](https://github.com/Icinga/icinga2/issues/4016): Symlink subfolders not followed/considered for config files
-* [#4014](https://github.com/Icinga/icinga2/issues/4014): Use retry\_interval instead of check\_interval for first OK -\> NOT-OK state change
-* [#3973](https://github.com/Icinga/icinga2/issues/3973) (Cluster): Downtimes and Comments are not synced to child zones
-* [#3970](https://github.com/Icinga/icinga2/issues/3970) (API): Socket Exceptions \(Operation not permitted\) while reading from API
-* [#3907](https://github.com/Icinga/icinga2/issues/3907) (Configuration): Too many assign where filters cause stack overflow
-* [#3780](https://github.com/Icinga/icinga2/issues/3780) (DB IDO): DB IDO: downtime is not in effect after restart
+* [#4131](https://github.com/icinga/icinga2/issues/4131) (Configuration): Vim Syntax Highlighting does not work with assign where
+* [#4116](https://github.com/icinga/icinga2/issues/4116) (API): icinga2 crashes when a command\_endpoint is set, but the api feature is not active
+* [#4114](https://github.com/icinga/icinga2/issues/4114): Compiler warning in NotifyActive
+* [#4109](https://github.com/icinga/icinga2/issues/4109) (API): Navigation attributes are missing in /v1/objects/\<type\>
+* [#4104](https://github.com/icinga/icinga2/issues/4104) (Configuration): Segfault during config validation if host exists, service does not exist any longer and downtime expires
+* [#4095](https://github.com/icinga/icinga2/issues/4095): DowntimesExpireTimerHandler crashes Icinga2 with \<unknown function\>
+* [#4089](https://github.com/icinga/icinga2/issues/4089): Make the socket event engine configurable
+* [#4078](https://github.com/icinga/icinga2/issues/4078) (Configuration): Overwriting global type variables causes crash in ConfigItem::Commit\(\)
+* [#4076](https://github.com/icinga/icinga2/issues/4076) (API): API User gets wrongly authenticated \(client\_cn and no password\)
+* [#4066](https://github.com/icinga/icinga2/issues/4066): ConfigSync broken from 2.4.3. to 2.4.4 under Windows
+* [#4056](https://github.com/icinga/icinga2/issues/4056) (CLI): Remove semi-colons in the auto-generated configs
+* [#4052](https://github.com/icinga/icinga2/issues/4052) (API): Config validation for Notification objects should check whether the state filters are valid
+* [#4035](https://github.com/icinga/icinga2/issues/4035) (DB IDO): IDO: historical contact notifications table column notification\_id is off-by-one
+* [#4031](https://github.com/icinga/icinga2/issues/4031): Downtimes are not always activated/expired on restart
+* [#4016](https://github.com/icinga/icinga2/issues/4016): Symlink subfolders not followed/considered for config files
+* [#4014](https://github.com/icinga/icinga2/issues/4014): Use retry\_interval instead of check\_interval for first OK -\> NOT-OK state change
+* [#3973](https://github.com/icinga/icinga2/issues/3973) (Cluster): Downtimes and Comments are not synced to child zones
+* [#3970](https://github.com/icinga/icinga2/issues/3970) (API): Socket Exceptions \(Operation not permitted\) while reading from API
+* [#3907](https://github.com/icinga/icinga2/issues/3907) (Configuration): Too many assign where filters cause stack overflow
+* [#3780](https://github.com/icinga/icinga2/issues/3780) (DB IDO): DB IDO: downtime is not in effect after restart
 
 ### ITL
 
-* [#3953](https://github.com/Icinga/icinga2/issues/3953) (ITL): Add --units, --rate and --rate-multiplier support for the snmpv3 check command
-* [#3903](https://github.com/Icinga/icinga2/issues/3903) (ITL): Add --method parameter for check\_{oracle,mysql,mssql}\_health CheckCommands
+* [#3953](https://github.com/icinga/icinga2/issues/3953) (ITL): Add --units, --rate and --rate-multiplier support for the snmpv3 check command
+* [#3903](https://github.com/icinga/icinga2/issues/3903) (ITL): Add --method parameter for check\_{oracle,mysql,mssql}\_health CheckCommands
 
 ### Documentation
 
-* [#4122](https://github.com/Icinga/icinga2/issues/4122) (Documentation): Remove instance\_name from Ido\*Connection example
-* [#4108](https://github.com/Icinga/icinga2/issues/4108) (Documentation): Incorrect link in the documentation
-* [#4080](https://github.com/Icinga/icinga2/issues/4080) (Documentation): Update documentation URL for Icinga Web 2
-* [#4058](https://github.com/Icinga/icinga2/issues/4058) (Documentation): Docs: Cluster manual SSL generation formatting is broken
-* [#4057](https://github.com/Icinga/icinga2/issues/4057) (Documentation): Update the CentOS installation documentation
-* [#4055](https://github.com/Icinga/icinga2/issues/4055) (Documentation): Add silent install / reference to NSClient++ to documentation
-* [#4043](https://github.com/Icinga/icinga2/issues/4043) (Documentation): Docs: Remove the migration script chapter
-* [#4041](https://github.com/Icinga/icinga2/issues/4041) (Documentation): Explain how to use functions for wildcard matches for arrays and/or dictionaries in assign where expressions
-* [#4039](https://github.com/Icinga/icinga2/issues/4039) (Documentation): Update .mailmap for Markus Frosch
-* [#3145](https://github.com/Icinga/icinga2/issues/3145) (Documentation): Add Windows setup wizard screenshots
+* [#4122](https://github.com/icinga/icinga2/issues/4122) (Documentation): Remove instance\_name from Ido\*Connection example
+* [#4108](https://github.com/icinga/icinga2/issues/4108) (Documentation): Incorrect link in the documentation
+* [#4080](https://github.com/icinga/icinga2/issues/4080) (Documentation): Update documentation URL for Icinga Web 2
+* [#4058](https://github.com/icinga/icinga2/issues/4058) (Documentation): Docs: Cluster manual SSL generation formatting is broken
+* [#4057](https://github.com/icinga/icinga2/issues/4057) (Documentation): Update the CentOS installation documentation
+* [#4055](https://github.com/icinga/icinga2/issues/4055) (Documentation): Add silent install / reference to NSClient++ to documentation
+* [#4043](https://github.com/icinga/icinga2/issues/4043) (Documentation): Docs: Remove the migration script chapter
+* [#4041](https://github.com/icinga/icinga2/issues/4041) (Documentation): Explain how to use functions for wildcard matches for arrays and/or dictionaries in assign where expressions
+* [#4039](https://github.com/icinga/icinga2/issues/4039) (Documentation): Update .mailmap for Markus Frosch
+* [#3145](https://github.com/icinga/icinga2/issues/3145) (Documentation): Add Windows setup wizard screenshots
 
 ### Support
 
-* [#4127](https://github.com/Icinga/icinga2/issues/4127) (Installation): Windows installer does not copy "features-enabled" on upgrade
-* [#4119](https://github.com/Icinga/icinga2/issues/4119) (Installation): Update chocolatey uninstall script for the MSI package
-* [#4118](https://github.com/Icinga/icinga2/issues/4118) (Installation): icinga2-installer.exe doesn't wait until NSIS uninstall.exe exits
-* [#4117](https://github.com/Icinga/icinga2/issues/4117) (Installation): Make sure to update the agent wizard banner
-* [#4113](https://github.com/Icinga/icinga2/issues/4113) (Installation): Package fails to build on \*NIX
-* [#4099](https://github.com/Icinga/icinga2/issues/4099) (Installation): make install overwrites configuration files
-* [#4074](https://github.com/Icinga/icinga2/issues/4074) (Installation): FatalError\(\) returns when called before Application.Run
-* [#4073](https://github.com/Icinga/icinga2/issues/4073) (Installation): Install 64-bit version of NSClient++ on 64-bit versions of Windows
-* [#4072](https://github.com/Icinga/icinga2/issues/4072) (Installation): Update NSClient++ to version 0.4.4.19
-* [#4069](https://github.com/Icinga/icinga2/issues/4069) (Installation): Error compiling icinga2 targeted for x64 on Windows
-* [#4064](https://github.com/Icinga/icinga2/issues/4064) (Packages): Build 64-bit packages for Windows
-* [#4053](https://github.com/Icinga/icinga2/issues/4053) (Installation): Icinga 2 Windows Agent does not honor install path during upgrade
-* [#4032](https://github.com/Icinga/icinga2/issues/4032) (Packages): Remove dependency for .NET 3.5 from the chocolatey package
-* [#3988](https://github.com/Icinga/icinga2/issues/3988) (Packages): Incorrect base URL in the icinga-rpm-release packages for Fedora
-* [#3658](https://github.com/Icinga/icinga2/issues/3658) (Packages): Add application manifest for the Windows agent wizard
-* [#2998](https://github.com/Icinga/icinga2/issues/2998) (Installation): logrotate fails since the "su" directive was removed
+* [#4127](https://github.com/icinga/icinga2/issues/4127) (Installation): Windows installer does not copy "features-enabled" on upgrade
+* [#4119](https://github.com/icinga/icinga2/issues/4119) (Installation): Update chocolatey uninstall script for the MSI package
+* [#4118](https://github.com/icinga/icinga2/issues/4118) (Installation): icinga2-installer.exe doesn't wait until NSIS uninstall.exe exits
+* [#4117](https://github.com/icinga/icinga2/issues/4117) (Installation): Make sure to update the agent wizard banner
+* [#4113](https://github.com/icinga/icinga2/issues/4113) (Installation): Package fails to build on \*NIX
+* [#4099](https://github.com/icinga/icinga2/issues/4099) (Installation): make install overwrites configuration files
+* [#4074](https://github.com/icinga/icinga2/issues/4074) (Installation): FatalError\(\) returns when called before Application.Run
+* [#4073](https://github.com/icinga/icinga2/issues/4073) (Installation): Install 64-bit version of NSClient++ on 64-bit versions of Windows
+* [#4072](https://github.com/icinga/icinga2/issues/4072) (Installation): Update NSClient++ to version 0.4.4.19
+* [#4069](https://github.com/icinga/icinga2/issues/4069) (Installation): Error compiling icinga2 targeted for x64 on Windows
+* [#4064](https://github.com/icinga/icinga2/issues/4064) (Packages): Build 64-bit packages for Windows
+* [#4053](https://github.com/icinga/icinga2/issues/4053) (Installation): Icinga 2 Windows Agent does not honor install path during upgrade
+* [#4032](https://github.com/icinga/icinga2/issues/4032) (Packages): Remove dependency for .NET 3.5 from the chocolatey package
+* [#3988](https://github.com/icinga/icinga2/issues/3988) (Packages): Incorrect base URL in the icinga-rpm-release packages for Fedora
+* [#3658](https://github.com/icinga/icinga2/issues/3658) (Packages): Add application manifest for the Windows agent wizard
+* [#2998](https://github.com/icinga/icinga2/issues/2998) (Installation): logrotate fails since the "su" directive was removed
 
 ## 2.4.4 (2016-03-16)
 
@@ -1273,44 +1325,44 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#4036](https://github.com/Icinga/icinga2/issues/4036) (CLI): Add the executed cli command to the Windows wizard error messages
-* [#4019](https://github.com/Icinga/icinga2/issues/4019) (Configuration): Segmentation fault during 'icinga2 daemon -C'
-* [#4017](https://github.com/Icinga/icinga2/issues/4017) (CLI): 'icinga2 feature list' fails when all features are disabled
-* [#4008](https://github.com/Icinga/icinga2/issues/4008) (Configuration): Windows wizard error "too many arguments"
-* [#4006](https://github.com/Icinga/icinga2/issues/4006): Volatile transitions from HARD NOT-OK-\>NOT-OK do not trigger notifications
-* [#3996](https://github.com/Icinga/icinga2/issues/3996): epoll\_ctl might cause oops on Ubuntu trusty
-* [#3990](https://github.com/Icinga/icinga2/issues/3990): Services status updated multiple times within check\_interval even though no retry was triggered
-* [#3987](https://github.com/Icinga/icinga2/issues/3987): Incorrect check interval when passive check results are used
-* [#3985](https://github.com/Icinga/icinga2/issues/3985): Active checks are executed even though passive results are submitted
-* [#3981](https://github.com/Icinga/icinga2/issues/3981): DEL\_DOWNTIME\_BY\_HOST\_NAME does not accept optional arguments
-* [#3961](https://github.com/Icinga/icinga2/issues/3961) (CLI): Wrong log message for trusted cert in node setup command
-* [#3939](https://github.com/Icinga/icinga2/issues/3939) (CLI): Common name in node wizard isn't case sensitive
-* [#3745](https://github.com/Icinga/icinga2/issues/3745) (API): Status code 200 even if an object could not be deleted.
-* [#3742](https://github.com/Icinga/icinga2/issues/3742) (DB IDO): DB IDO: User notification type filters are incorrect
-* [#3442](https://github.com/Icinga/icinga2/issues/3442) (API): MkDirP not working on Windows
-* [#3439](https://github.com/Icinga/icinga2/issues/3439) (Notifications): Host notification type is PROBLEM but should be RECOVERY
-* [#3303](https://github.com/Icinga/icinga2/issues/3303) (Notifications): Problem notifications while Flapping is active
-* [#3153](https://github.com/Icinga/icinga2/issues/3153) (Notifications): Flapping notifications are sent for hosts/services which are in a downtime
+* [#4036](https://github.com/icinga/icinga2/issues/4036) (CLI): Add the executed cli command to the Windows wizard error messages
+* [#4019](https://github.com/icinga/icinga2/issues/4019) (Configuration): Segmentation fault during 'icinga2 daemon -C'
+* [#4017](https://github.com/icinga/icinga2/issues/4017) (CLI): 'icinga2 feature list' fails when all features are disabled
+* [#4008](https://github.com/icinga/icinga2/issues/4008) (Configuration): Windows wizard error "too many arguments"
+* [#4006](https://github.com/icinga/icinga2/issues/4006): Volatile transitions from HARD NOT-OK-\>NOT-OK do not trigger notifications
+* [#3996](https://github.com/icinga/icinga2/issues/3996): epoll\_ctl might cause oops on Ubuntu trusty
+* [#3990](https://github.com/icinga/icinga2/issues/3990): Services status updated multiple times within check\_interval even though no retry was triggered
+* [#3987](https://github.com/icinga/icinga2/issues/3987): Incorrect check interval when passive check results are used
+* [#3985](https://github.com/icinga/icinga2/issues/3985): Active checks are executed even though passive results are submitted
+* [#3981](https://github.com/icinga/icinga2/issues/3981): DEL\_DOWNTIME\_BY\_HOST\_NAME does not accept optional arguments
+* [#3961](https://github.com/icinga/icinga2/issues/3961) (CLI): Wrong log message for trusted cert in node setup command
+* [#3939](https://github.com/icinga/icinga2/issues/3939) (CLI): Common name in node wizard isn't case sensitive
+* [#3745](https://github.com/icinga/icinga2/issues/3745) (API): Status code 200 even if an object could not be deleted.
+* [#3742](https://github.com/icinga/icinga2/issues/3742) (DB IDO): DB IDO: User notification type filters are incorrect
+* [#3442](https://github.com/icinga/icinga2/issues/3442) (API): MkDirP not working on Windows
+* [#3439](https://github.com/icinga/icinga2/issues/3439) (Notifications): Host notification type is PROBLEM but should be RECOVERY
+* [#3303](https://github.com/icinga/icinga2/issues/3303) (Notifications): Problem notifications while Flapping is active
+* [#3153](https://github.com/icinga/icinga2/issues/3153) (Notifications): Flapping notifications are sent for hosts/services which are in a downtime
 
 ### ITL
 
-* [#3958](https://github.com/Icinga/icinga2/issues/3958) (ITL): Add "query" option to check\_postgres command.
-* [#3908](https://github.com/Icinga/icinga2/issues/3908) (ITL): ITL: Missing documentation for nwc\_health "mode" parameter
-* [#3484](https://github.com/Icinga/icinga2/issues/3484) (ITL): ITL: Allow to enforce specific SSL versions using the http check command
+* [#3958](https://github.com/icinga/icinga2/issues/3958) (ITL): Add "query" option to check\_postgres command.
+* [#3908](https://github.com/icinga/icinga2/issues/3908) (ITL): ITL: Missing documentation for nwc\_health "mode" parameter
+* [#3484](https://github.com/icinga/icinga2/issues/3484) (ITL): ITL: Allow to enforce specific SSL versions using the http check command
 
 ### Documentation
 
-* [#4033](https://github.com/Icinga/icinga2/issues/4033) (Documentation): Update development docs to use 'thread apply all bt full'
-* [#4018](https://github.com/Icinga/icinga2/issues/4018) (Documentation): Docs: Add API examples for creating services and check commands
-* [#4009](https://github.com/Icinga/icinga2/issues/4009) (Documentation): Typo in API docs
-* [#3845](https://github.com/Icinga/icinga2/issues/3845) (Documentation): Explain how to join hosts/services for /v1/objects/comments
-* [#3755](https://github.com/Icinga/icinga2/issues/3755) (Documentation): http check's URI is really just Path
+* [#4033](https://github.com/icinga/icinga2/issues/4033) (Documentation): Update development docs to use 'thread apply all bt full'
+* [#4018](https://github.com/icinga/icinga2/issues/4018) (Documentation): Docs: Add API examples for creating services and check commands
+* [#4009](https://github.com/icinga/icinga2/issues/4009) (Documentation): Typo in API docs
+* [#3845](https://github.com/icinga/icinga2/issues/3845) (Documentation): Explain how to join hosts/services for /v1/objects/comments
+* [#3755](https://github.com/icinga/icinga2/issues/3755) (Documentation): http check's URI is really just Path
 
 ### Support
 
-* [#4027](https://github.com/Icinga/icinga2/issues/4027) (Packages): Chocolatey package is missing uninstall function
-* [#4011](https://github.com/Icinga/icinga2/issues/4011) (Packages): Update build requirements for SLES 11 SP4
-* [#3960](https://github.com/Icinga/icinga2/issues/3960) (Installation): CMake does not find MySQL libraries on Windows
+* [#4027](https://github.com/icinga/icinga2/issues/4027) (Packages): Chocolatey package is missing uninstall function
+* [#4011](https://github.com/icinga/icinga2/issues/4011) (Packages): Update build requirements for SLES 11 SP4
+* [#3960](https://github.com/icinga/icinga2/issues/3960) (Installation): CMake does not find MySQL libraries on Windows
 
 ## 2.4.3 (2016-02-24)
 
@@ -1320,8 +1372,8 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#3963](https://github.com/Icinga/icinga2/issues/3963): Wrong permissions for files in /var/cache/icinga2/\* 
-* [#3962](https://github.com/Icinga/icinga2/issues/3962) (Configuration): Permission problem after running icinga2 node wizard
+* [#3963](https://github.com/icinga/icinga2/issues/3963): Wrong permissions for files in /var/cache/icinga2/\* 
+* [#3962](https://github.com/icinga/icinga2/issues/3962) (Configuration): Permission problem after running icinga2 node wizard
 
 ## 2.4.2 (2016-02-23)
 
@@ -1341,111 +1393,111 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3878](https://github.com/Icinga/icinga2/issues/3878) (Configuration): Add String\#trim
-* [#3857](https://github.com/Icinga/icinga2/issues/3857) (Cluster): Support TLSv1.1 and TLSv1.2 for the cluster transport encryption
-* [#3810](https://github.com/Icinga/icinga2/issues/3810) (Plugins): Add Timeout parameter to snmpv3 check
-* [#3785](https://github.com/Icinga/icinga2/issues/3785) (DB IDO): Log DB IDO query queue stats
-* [#3784](https://github.com/Icinga/icinga2/issues/3784) (DB IDO): DB IDO: Add a log message when the connection handling is completed
-* [#3760](https://github.com/Icinga/icinga2/issues/3760) (Configuration): Raise a config error for "Checkable" objects in global zones
-* [#3754](https://github.com/Icinga/icinga2/issues/3754) (Plugins): Add "-x" parameter in command definition for disk-windows CheckCommand
+* [#3878](https://github.com/icinga/icinga2/issues/3878) (Configuration): Add String\#trim
+* [#3857](https://github.com/icinga/icinga2/issues/3857) (Cluster): Support TLSv1.1 and TLSv1.2 for the cluster transport encryption
+* [#3810](https://github.com/icinga/icinga2/issues/3810) (Plugins): Add Timeout parameter to snmpv3 check
+* [#3785](https://github.com/icinga/icinga2/issues/3785) (DB IDO): Log DB IDO query queue stats
+* [#3784](https://github.com/icinga/icinga2/issues/3784) (DB IDO): DB IDO: Add a log message when the connection handling is completed
+* [#3760](https://github.com/icinga/icinga2/issues/3760) (Configuration): Raise a config error for "Checkable" objects in global zones
+* [#3754](https://github.com/icinga/icinga2/issues/3754) (Plugins): Add "-x" parameter in command definition for disk-windows CheckCommand
 
 ### Bug
 
-* [#3957](https://github.com/Icinga/icinga2/issues/3957) (CLI): "node setup" tries to chown\(\) files before they're created
-* [#3947](https://github.com/Icinga/icinga2/issues/3947): CentOS 5 doesn't support epoll\_create1
-* [#3922](https://github.com/Icinga/icinga2/issues/3922) (Configuration): YYYY-MM-DD time specs are parsed incorrectly
-* [#3915](https://github.com/Icinga/icinga2/issues/3915) (API): Connections are not cleaned up properly
-* [#3913](https://github.com/Icinga/icinga2/issues/3913) (Cluster): Cluster WQ thread dies after fork\(\)
-* [#3910](https://github.com/Icinga/icinga2/issues/3910): Clean up unused variables a bit
-* [#3905](https://github.com/Icinga/icinga2/issues/3905) (DB IDO): Problem with hostgroup\_members table cleanup
-* [#3898](https://github.com/Icinga/icinga2/issues/3898) (API): API queries on non-existant objects cause exception
-* [#3897](https://github.com/Icinga/icinga2/issues/3897) (Configuration): Crash in ConfigItem::RunWithActivationContext
-* [#3896](https://github.com/Icinga/icinga2/issues/3896) (Cluster): Ensure that config sync updates are always sent on reconnect
-* [#3889](https://github.com/Icinga/icinga2/issues/3889) (DB IDO): Deleting an object via API does not disable it in DB IDO
-* [#3871](https://github.com/Icinga/icinga2/issues/3871) (Cluster): Master reloads with agents generate false alarms
-* [#3870](https://github.com/Icinga/icinga2/issues/3870) (DB IDO): next\_check noise in the IDO
-* [#3866](https://github.com/Icinga/icinga2/issues/3866) (Cluster): Check event duplication with parallel connections involved
-* [#3863](https://github.com/Icinga/icinga2/issues/3863) (Cluster): Segfault in ApiListener::ConfigUpdateObjectAPIHandler
-* [#3859](https://github.com/Icinga/icinga2/issues/3859): Stream buffer size is 512 bytes, could be raised
-* [#3858](https://github.com/Icinga/icinga2/issues/3858) (CLI): Escaped sequences not properly generated with 'node update-config'
-* [#3848](https://github.com/Icinga/icinga2/issues/3848) (Configuration): Mistake in mongodb command definition \(mongodb\_replicaset\)
-* [#3843](https://github.com/Icinga/icinga2/issues/3843): Modified attributes do not work for the IcingaApplication object w/ external commands
-* [#3835](https://github.com/Icinga/icinga2/issues/3835) (Cluster): high load and memory consumption on icinga2 agent v2.4.1
-* [#3827](https://github.com/Icinga/icinga2/issues/3827) (Configuration): Icinga state file corruption with temporary file creation
-* [#3817](https://github.com/Icinga/icinga2/issues/3817) (Cluster): Cluster config sync: Ensure that /var/lib/icinga2/api/zones/\* exists
-* [#3816](https://github.com/Icinga/icinga2/issues/3816) (Cluster): Exception stack trace on icinga2 client when the master reloads the configuration
-* [#3812](https://github.com/Icinga/icinga2/issues/3812) (API): API actions: Decide whether fixed: false is the right default
-* [#3798](https://github.com/Icinga/icinga2/issues/3798) (DB IDO): is\_active in IDO is only re-enabled on "every second" restart
-* [#3797](https://github.com/Icinga/icinga2/issues/3797): Remove superfluous \#ifdef
-* [#3794](https://github.com/Icinga/icinga2/issues/3794) (DB IDO): Icinga2 crashes in IDO when removing a comment
-* [#3787](https://github.com/Icinga/icinga2/issues/3787) (CLI): "repository add" cli command writes invalid "type" attribute
-* [#3786](https://github.com/Icinga/icinga2/issues/3786) (DB IDO): Evaluate if CanExecuteQuery/FieldToEscapedString lead to exceptions on !m\_Connected
-* [#3783](https://github.com/Icinga/icinga2/issues/3783) (DB IDO): Implement support for re-ordering groups of IDO queries
-* [#3775](https://github.com/Icinga/icinga2/issues/3775) (Configuration): Config validation doesn't fail when templates are used as object names
-* [#3774](https://github.com/Icinga/icinga2/issues/3774) (DB IDO): IDO breaks when writing to icinga\_programstatus with latest snapshots
-* [#3773](https://github.com/Icinga/icinga2/issues/3773) (Configuration): Relative path in include\_zones does not work
-* [#3766](https://github.com/Icinga/icinga2/issues/3766) (API): Cluster config sync ignores zones.d from API packages
-* [#3765](https://github.com/Icinga/icinga2/issues/3765): Use NodeName in null and random checks
-* [#3764](https://github.com/Icinga/icinga2/issues/3764) (DB IDO): Failed IDO query for icinga\_downtimehistory
-* [#3752](https://github.com/Icinga/icinga2/issues/3752): Incorrect information in --version on Linux
-* [#3741](https://github.com/Icinga/icinga2/issues/3741) (DB IDO): Avoid duplicate config and status updates on startup
-* [#3735](https://github.com/Icinga/icinga2/issues/3735) (Configuration): Disallow lambda expressions where side-effect-free expressions are not allowed
-* [#3730](https://github.com/Icinga/icinga2/issues/3730): Missing path in mkdir\(\) exceptions
-* [#3728](https://github.com/Icinga/icinga2/issues/3728) (DB IDO): build of icinga2 with gcc 4.4.7 segfaulting with ido
-* [#3722](https://github.com/Icinga/icinga2/issues/3722) (API): Missing num\_hosts\_pending in /v1/status/CIB
-* [#3715](https://github.com/Icinga/icinga2/issues/3715) (CLI): node wizard does not remember user defined port
-* [#3712](https://github.com/Icinga/icinga2/issues/3712) (CLI): Remove the local zone name question in node wizard
-* [#3705](https://github.com/Icinga/icinga2/issues/3705) (API): API is not working on wheezy
-* [#3704](https://github.com/Icinga/icinga2/issues/3704) (Cluster): ApiListener::ReplayLog can block with a lot of clients
-* [#3702](https://github.com/Icinga/icinga2/issues/3702) (Cluster): Zone::CanAccessObject is very expensive
-* [#3697](https://github.com/Icinga/icinga2/issues/3697) (Compat): Crash in ExternalCommandListener
-* [#3677](https://github.com/Icinga/icinga2/issues/3677) (API): API queries cause memory leaks 
-* [#3613](https://github.com/Icinga/icinga2/issues/3613) (DB IDO): Non-UTF8 characters from plugins causes IDO to fail
-* [#3606](https://github.com/Icinga/icinga2/issues/3606) (Plugins): check\_network performance data in invalid format
-* [#3571](https://github.com/Icinga/icinga2/issues/3571) (Plugins): check\_memory and check\_swap plugins do unit conversion and rounding before percentage calculations resulting in imprecise percentages
-* [#3540](https://github.com/Icinga/icinga2/issues/3540) (Livestatus): Livestatus log query - filter "class" yields empty results
-* [#3440](https://github.com/Icinga/icinga2/issues/3440): Icinga2 reload timeout results in killing old and new process because of systemd
-* [#2866](https://github.com/Icinga/icinga2/issues/2866) (DB IDO): DB IDO: notification\_id for contact notifications is out of range
-* [#2746](https://github.com/Icinga/icinga2/issues/2746) (DB IDO): Add priority queue for disconnect/programstatus update events 
-* [#2009](https://github.com/Icinga/icinga2/issues/2009): Re-checks scheduling w/ retry\_interval
+* [#3957](https://github.com/icinga/icinga2/issues/3957) (CLI): "node setup" tries to chown\(\) files before they're created
+* [#3947](https://github.com/icinga/icinga2/issues/3947): CentOS 5 doesn't support epoll\_create1
+* [#3922](https://github.com/icinga/icinga2/issues/3922) (Configuration): YYYY-MM-DD time specs are parsed incorrectly
+* [#3915](https://github.com/icinga/icinga2/issues/3915) (API): Connections are not cleaned up properly
+* [#3913](https://github.com/icinga/icinga2/issues/3913) (Cluster): Cluster WQ thread dies after fork\(\)
+* [#3910](https://github.com/icinga/icinga2/issues/3910): Clean up unused variables a bit
+* [#3905](https://github.com/icinga/icinga2/issues/3905) (DB IDO): Problem with hostgroup\_members table cleanup
+* [#3898](https://github.com/icinga/icinga2/issues/3898) (API): API queries on non-existant objects cause exception
+* [#3897](https://github.com/icinga/icinga2/issues/3897) (Configuration): Crash in ConfigItem::RunWithActivationContext
+* [#3896](https://github.com/icinga/icinga2/issues/3896) (Cluster): Ensure that config sync updates are always sent on reconnect
+* [#3889](https://github.com/icinga/icinga2/issues/3889) (DB IDO): Deleting an object via API does not disable it in DB IDO
+* [#3871](https://github.com/icinga/icinga2/issues/3871) (Cluster): Master reloads with agents generate false alarms
+* [#3870](https://github.com/icinga/icinga2/issues/3870) (DB IDO): next\_check noise in the IDO
+* [#3866](https://github.com/icinga/icinga2/issues/3866) (Cluster): Check event duplication with parallel connections involved
+* [#3863](https://github.com/icinga/icinga2/issues/3863) (Cluster): Segfault in ApiListener::ConfigUpdateObjectAPIHandler
+* [#3859](https://github.com/icinga/icinga2/issues/3859): Stream buffer size is 512 bytes, could be raised
+* [#3858](https://github.com/icinga/icinga2/issues/3858) (CLI): Escaped sequences not properly generated with 'node update-config'
+* [#3848](https://github.com/icinga/icinga2/issues/3848) (Configuration): Mistake in mongodb command definition \(mongodb\_replicaset\)
+* [#3843](https://github.com/icinga/icinga2/issues/3843): Modified attributes do not work for the IcingaApplication object w/ external commands
+* [#3835](https://github.com/icinga/icinga2/issues/3835) (Cluster): high load and memory consumption on icinga2 agent v2.4.1
+* [#3827](https://github.com/icinga/icinga2/issues/3827) (Configuration): Icinga state file corruption with temporary file creation
+* [#3817](https://github.com/icinga/icinga2/issues/3817) (Cluster): Cluster config sync: Ensure that /var/lib/icinga2/api/zones/\* exists
+* [#3816](https://github.com/icinga/icinga2/issues/3816) (Cluster): Exception stack trace on icinga2 client when the master reloads the configuration
+* [#3812](https://github.com/icinga/icinga2/issues/3812) (API): API actions: Decide whether fixed: false is the right default
+* [#3798](https://github.com/icinga/icinga2/issues/3798) (DB IDO): is\_active in IDO is only re-enabled on "every second" restart
+* [#3797](https://github.com/icinga/icinga2/issues/3797): Remove superfluous \#ifdef
+* [#3794](https://github.com/icinga/icinga2/issues/3794) (DB IDO): Icinga2 crashes in IDO when removing a comment
+* [#3787](https://github.com/icinga/icinga2/issues/3787) (CLI): "repository add" cli command writes invalid "type" attribute
+* [#3786](https://github.com/icinga/icinga2/issues/3786) (DB IDO): Evaluate if CanExecuteQuery/FieldToEscapedString lead to exceptions on !m\_Connected
+* [#3783](https://github.com/icinga/icinga2/issues/3783) (DB IDO): Implement support for re-ordering groups of IDO queries
+* [#3775](https://github.com/icinga/icinga2/issues/3775) (Configuration): Config validation doesn't fail when templates are used as object names
+* [#3774](https://github.com/icinga/icinga2/issues/3774) (DB IDO): IDO breaks when writing to icinga\_programstatus with latest snapshots
+* [#3773](https://github.com/icinga/icinga2/issues/3773) (Configuration): Relative path in include\_zones does not work
+* [#3766](https://github.com/icinga/icinga2/issues/3766) (API): Cluster config sync ignores zones.d from API packages
+* [#3765](https://github.com/icinga/icinga2/issues/3765): Use NodeName in null and random checks
+* [#3764](https://github.com/icinga/icinga2/issues/3764) (DB IDO): Failed IDO query for icinga\_downtimehistory
+* [#3752](https://github.com/icinga/icinga2/issues/3752): Incorrect information in --version on Linux
+* [#3741](https://github.com/icinga/icinga2/issues/3741) (DB IDO): Avoid duplicate config and status updates on startup
+* [#3735](https://github.com/icinga/icinga2/issues/3735) (Configuration): Disallow lambda expressions where side-effect-free expressions are not allowed
+* [#3730](https://github.com/icinga/icinga2/issues/3730): Missing path in mkdir\(\) exceptions
+* [#3728](https://github.com/icinga/icinga2/issues/3728) (DB IDO): build of icinga2 with gcc 4.4.7 segfaulting with ido
+* [#3722](https://github.com/icinga/icinga2/issues/3722) (API): Missing num\_hosts\_pending in /v1/status/CIB
+* [#3715](https://github.com/icinga/icinga2/issues/3715) (CLI): node wizard does not remember user defined port
+* [#3712](https://github.com/icinga/icinga2/issues/3712) (CLI): Remove the local zone name question in node wizard
+* [#3705](https://github.com/icinga/icinga2/issues/3705) (API): API is not working on wheezy
+* [#3704](https://github.com/icinga/icinga2/issues/3704) (Cluster): ApiListener::ReplayLog can block with a lot of clients
+* [#3702](https://github.com/icinga/icinga2/issues/3702) (Cluster): Zone::CanAccessObject is very expensive
+* [#3697](https://github.com/icinga/icinga2/issues/3697) (Compat): Crash in ExternalCommandListener
+* [#3677](https://github.com/icinga/icinga2/issues/3677) (API): API queries cause memory leaks 
+* [#3613](https://github.com/icinga/icinga2/issues/3613) (DB IDO): Non-UTF8 characters from plugins causes IDO to fail
+* [#3606](https://github.com/icinga/icinga2/issues/3606) (Plugins): check\_network performance data in invalid format
+* [#3571](https://github.com/icinga/icinga2/issues/3571) (Plugins): check\_memory and check\_swap plugins do unit conversion and rounding before percentage calculations resulting in imprecise percentages
+* [#3540](https://github.com/icinga/icinga2/issues/3540) (Livestatus): Livestatus log query - filter "class" yields empty results
+* [#3440](https://github.com/icinga/icinga2/issues/3440): Icinga2 reload timeout results in killing old and new process because of systemd
+* [#2866](https://github.com/icinga/icinga2/issues/2866) (DB IDO): DB IDO: notification\_id for contact notifications is out of range
+* [#2746](https://github.com/icinga/icinga2/issues/2746) (DB IDO): Add priority queue for disconnect/programstatus update events 
+* [#2009](https://github.com/icinga/icinga2/issues/2009): Re-checks scheduling w/ retry\_interval
 
 ### ITL
 
-* [#3927](https://github.com/Icinga/icinga2/issues/3927) (ITL): Checkcommand Disk : Option Freespace-ignore-reserved
-* [#3749](https://github.com/Icinga/icinga2/issues/3749) (ITL): The hpasm check command is using the PluginDir constant
-* [#3747](https://github.com/Icinga/icinga2/issues/3747) (ITL): Add check\_iostat to ITL
-* [#3729](https://github.com/Icinga/icinga2/issues/3729) (ITL): ITL check command possibly mistyped variable names
+* [#3927](https://github.com/icinga/icinga2/issues/3927) (ITL): Checkcommand Disk : Option Freespace-ignore-reserved
+* [#3749](https://github.com/icinga/icinga2/issues/3749) (ITL): The hpasm check command is using the PluginDir constant
+* [#3747](https://github.com/icinga/icinga2/issues/3747) (ITL): Add check\_iostat to ITL
+* [#3729](https://github.com/icinga/icinga2/issues/3729) (ITL): ITL check command possibly mistyped variable names
 
 ### Documentation
 
-* [#3946](https://github.com/Icinga/icinga2/issues/3946) (Documentation): Documentation: Unescaped pipe character in tables
-* [#3893](https://github.com/Icinga/icinga2/issues/3893) (Documentation): Outdated link to icingaweb2-module-nagvis
-* [#3892](https://github.com/Icinga/icinga2/issues/3892) (Documentation): Partially missing escaping in doc/7-icinga-template-library.md
-* [#3861](https://github.com/Icinga/icinga2/issues/3861) (Documentation): Incorrect IdoPgSqlConnection Example in Documentation
-* [#3850](https://github.com/Icinga/icinga2/issues/3850) (Documentation): Incorrect name in AUTHORS
-* [#3836](https://github.com/Icinga/icinga2/issues/3836) (Documentation): Troubleshooting: Explain how to fetch the executed command 
-* [#3833](https://github.com/Icinga/icinga2/issues/3833) (Documentation): Better explaination for array values in "disk" CheckCommand docs
-* [#3826](https://github.com/Icinga/icinga2/issues/3826) (Documentation): Add example how to use custom functions in attributes
-* [#3808](https://github.com/Icinga/icinga2/issues/3808) (Documentation): Typos in the "troubleshooting" section of the documentation
-* [#3793](https://github.com/Icinga/icinga2/issues/3793) (Documentation): "setting up check plugins" section should be enhanced with package manager examples
-* [#3781](https://github.com/Icinga/icinga2/issues/3781) (Documentation): Formatting problem in "Advanced Filter" chapter
-* [#3770](https://github.com/Icinga/icinga2/issues/3770) (Documentation): Missing documentation for API packages zones.d config sync 
-* [#3759](https://github.com/Icinga/icinga2/issues/3759) (Documentation): Missing SUSE repository for monitoring plugins documentation
-* [#3748](https://github.com/Icinga/icinga2/issues/3748) (Documentation): Wrong postgresql-setup initdb command for RHEL7
-* [#3550](https://github.com/Icinga/icinga2/issues/3550) (Documentation): A PgSQL DB for the IDO can't be created w/ UTF8
-* [#3549](https://github.com/Icinga/icinga2/issues/3549) (Documentation): Incorrect SQL command for creating the user of the PostgreSQL DB for the IDO
+* [#3946](https://github.com/icinga/icinga2/issues/3946) (Documentation): Documentation: Unescaped pipe character in tables
+* [#3893](https://github.com/icinga/icinga2/issues/3893) (Documentation): Outdated link to icingaweb2-module-nagvis
+* [#3892](https://github.com/icinga/icinga2/issues/3892) (Documentation): Partially missing escaping in doc/7-icinga-template-library.md
+* [#3861](https://github.com/icinga/icinga2/issues/3861) (Documentation): Incorrect IdoPgSqlConnection Example in Documentation
+* [#3850](https://github.com/icinga/icinga2/issues/3850) (Documentation): Incorrect name in AUTHORS
+* [#3836](https://github.com/icinga/icinga2/issues/3836) (Documentation): Troubleshooting: Explain how to fetch the executed command 
+* [#3833](https://github.com/icinga/icinga2/issues/3833) (Documentation): Better explaination for array values in "disk" CheckCommand docs
+* [#3826](https://github.com/icinga/icinga2/issues/3826) (Documentation): Add example how to use custom functions in attributes
+* [#3808](https://github.com/icinga/icinga2/issues/3808) (Documentation): Typos in the "troubleshooting" section of the documentation
+* [#3793](https://github.com/icinga/icinga2/issues/3793) (Documentation): "setting up check plugins" section should be enhanced with package manager examples
+* [#3781](https://github.com/icinga/icinga2/issues/3781) (Documentation): Formatting problem in "Advanced Filter" chapter
+* [#3770](https://github.com/icinga/icinga2/issues/3770) (Documentation): Missing documentation for API packages zones.d config sync 
+* [#3759](https://github.com/icinga/icinga2/issues/3759) (Documentation): Missing SUSE repository for monitoring plugins documentation
+* [#3748](https://github.com/icinga/icinga2/issues/3748) (Documentation): Wrong postgresql-setup initdb command for RHEL7
+* [#3550](https://github.com/icinga/icinga2/issues/3550) (Documentation): A PgSQL DB for the IDO can't be created w/ UTF8
+* [#3549](https://github.com/icinga/icinga2/issues/3549) (Documentation): Incorrect SQL command for creating the user of the PostgreSQL DB for the IDO
 
 ### Support
 
-* [#3900](https://github.com/Icinga/icinga2/issues/3900) (Packages): Windows build fails on InterlockedIncrement type
-* [#3838](https://github.com/Icinga/icinga2/issues/3838) (Installation): Race condition when using systemd unit file
-* [#3832](https://github.com/Icinga/icinga2/issues/3832) (Installation): Compiler warnings in lib/remote/base64.cpp
-* [#3818](https://github.com/Icinga/icinga2/issues/3818) (Installation): Logrotate on systemd distros should use systemctl not service
-* [#3771](https://github.com/Icinga/icinga2/issues/3771) (Installation): Build error with older CMake versions on VERSION\_LESS compare
-* [#3769](https://github.com/Icinga/icinga2/issues/3769) (Packages): Windows build fails with latest git master
-* [#3746](https://github.com/Icinga/icinga2/issues/3746) (Packages): chcon partial context error in safe-reload prevents reload 
-* [#3723](https://github.com/Icinga/icinga2/issues/3723) (Installation): Crash on startup with incorrect directory permissions
-* [#3679](https://github.com/Icinga/icinga2/issues/3679) (Installation): Add CMake flag for disabling the unit tests
+* [#3900](https://github.com/icinga/icinga2/issues/3900) (Packages): Windows build fails on InterlockedIncrement type
+* [#3838](https://github.com/icinga/icinga2/issues/3838) (Installation): Race condition when using systemd unit file
+* [#3832](https://github.com/icinga/icinga2/issues/3832) (Installation): Compiler warnings in lib/remote/base64.cpp
+* [#3818](https://github.com/icinga/icinga2/issues/3818) (Installation): Logrotate on systemd distros should use systemctl not service
+* [#3771](https://github.com/icinga/icinga2/issues/3771) (Installation): Build error with older CMake versions on VERSION\_LESS compare
+* [#3769](https://github.com/icinga/icinga2/issues/3769) (Packages): Windows build fails with latest git master
+* [#3746](https://github.com/icinga/icinga2/issues/3746) (Packages): chcon partial context error in safe-reload prevents reload 
+* [#3723](https://github.com/icinga/icinga2/issues/3723) (Installation): Crash on startup with incorrect directory permissions
+* [#3679](https://github.com/icinga/icinga2/issues/3679) (Installation): Add CMake flag for disabling the unit tests
 
 ## 2.4.1 (2015-11-26)
 
@@ -1460,37 +1512,37 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3706](https://github.com/Icinga/icinga2/issues/3706) (CLI): Use NodeName and ZoneName constants for 'node setup' and 'node wizard'
+* [#3706](https://github.com/icinga/icinga2/issues/3706) (CLI): Use NodeName and ZoneName constants for 'node setup' and 'node wizard'
 
 ### Bug
 
-* [#3710](https://github.com/Icinga/icinga2/issues/3710) (CLI): Remove --master\_zone from --help because it is currently not implemented
-* [#3689](https://github.com/Icinga/icinga2/issues/3689) (CLI): CLI command 'repository add' doesn't work
-* [#3685](https://github.com/Icinga/icinga2/issues/3685) (CLI): node wizard checks for /var/lib/icinga2/ca directory but not the files
-* [#3674](https://github.com/Icinga/icinga2/issues/3674): lib/base/process.cpp SIGSEGV on Debian squeeze / RHEL 6
-* [#3671](https://github.com/Icinga/icinga2/issues/3671) (API): Icinga 2 crashes when ScheduledDowntime objects are used
-* [#3670](https://github.com/Icinga/icinga2/issues/3670) (CLI): API setup command incorrectly overwrites existing certificates
-* [#3665](https://github.com/Icinga/icinga2/issues/3665) (CLI): "node wizard" does not ask user to verify SSL certificate
+* [#3710](https://github.com/icinga/icinga2/issues/3710) (CLI): Remove --master\_zone from --help because it is currently not implemented
+* [#3689](https://github.com/icinga/icinga2/issues/3689) (CLI): CLI command 'repository add' doesn't work
+* [#3685](https://github.com/icinga/icinga2/issues/3685) (CLI): node wizard checks for /var/lib/icinga2/ca directory but not the files
+* [#3674](https://github.com/icinga/icinga2/issues/3674): lib/base/process.cpp SIGSEGV on Debian squeeze / RHEL 6
+* [#3671](https://github.com/icinga/icinga2/issues/3671) (API): Icinga 2 crashes when ScheduledDowntime objects are used
+* [#3670](https://github.com/icinga/icinga2/issues/3670) (CLI): API setup command incorrectly overwrites existing certificates
+* [#3665](https://github.com/icinga/icinga2/issues/3665) (CLI): "node wizard" does not ask user to verify SSL certificate
 
 ### ITL
 
-* [#3691](https://github.com/Icinga/icinga2/issues/3691) (ITL): Add running\_kernel\_use\_sudo option for the running\_kernel check
-* [#3682](https://github.com/Icinga/icinga2/issues/3682) (ITL): Indentation in command-plugins.conf
-* [#3657](https://github.com/Icinga/icinga2/issues/3657) (ITL): Add by\_ssh\_options argument for the check\_by\_ssh plugin
+* [#3691](https://github.com/icinga/icinga2/issues/3691) (ITL): Add running\_kernel\_use\_sudo option for the running\_kernel check
+* [#3682](https://github.com/icinga/icinga2/issues/3682) (ITL): Indentation in command-plugins.conf
+* [#3657](https://github.com/icinga/icinga2/issues/3657) (ITL): Add by\_ssh\_options argument for the check\_by\_ssh plugin
 
 ### Documentation
 
-* [#3701](https://github.com/Icinga/icinga2/issues/3701) (Documentation): Incorrect path for icinga2 binary in development documentation
-* [#3690](https://github.com/Icinga/icinga2/issues/3690) (Documentation): Fix typos in the documentation
-* [#3673](https://github.com/Icinga/icinga2/issues/3673) (Documentation): Documentation for schedule-downtime is missing required paremeters
-* [#3594](https://github.com/Icinga/icinga2/issues/3594) (Documentation): Documentation example in "Access Object Attributes at Runtime" doesn't work correctly
-* [#3391](https://github.com/Icinga/icinga2/issues/3391) (Documentation): Incorrect web inject URL in documentation
+* [#3701](https://github.com/icinga/icinga2/issues/3701) (Documentation): Incorrect path for icinga2 binary in development documentation
+* [#3690](https://github.com/icinga/icinga2/issues/3690) (Documentation): Fix typos in the documentation
+* [#3673](https://github.com/icinga/icinga2/issues/3673) (Documentation): Documentation for schedule-downtime is missing required paremeters
+* [#3594](https://github.com/icinga/icinga2/issues/3594) (Documentation): Documentation example in "Access Object Attributes at Runtime" doesn't work correctly
+* [#3391](https://github.com/icinga/icinga2/issues/3391) (Documentation): Incorrect web inject URL in documentation
 
 ### Support
 
-* [#3699](https://github.com/Icinga/icinga2/issues/3699) (Installation): Windows setup wizard crashes when InstallDir registry key is not set
-* [#3680](https://github.com/Icinga/icinga2/issues/3680) (Installation): Incorrect redirect for stderr in /usr/lib/icinga2/prepare-dirs
-* [#3656](https://github.com/Icinga/icinga2/issues/3656) (Packages): Build fails on SLES 11 SP3 with GCC 4.8
+* [#3699](https://github.com/icinga/icinga2/issues/3699) (Installation): Windows setup wizard crashes when InstallDir registry key is not set
+* [#3680](https://github.com/icinga/icinga2/issues/3680) (Installation): Incorrect redirect for stderr in /usr/lib/icinga2/prepare-dirs
+* [#3656](https://github.com/icinga/icinga2/issues/3656) (Packages): Build fails on SLES 11 SP3 with GCC 4.8
 
 ## 2.4.0 (2015-11-16)
 
@@ -1515,263 +1567,263 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3642](https://github.com/Icinga/icinga2/issues/3642): Release 2.4.0
-* [#3624](https://github.com/Icinga/icinga2/issues/3624) (API): Enhance programmatic examples for the API docs
-* [#3611](https://github.com/Icinga/icinga2/issues/3611) (API): Change object query result set
-* [#3609](https://github.com/Icinga/icinga2/issues/3609) (API): Change 'api setup' into a manual step while configuring the API
-* [#3608](https://github.com/Icinga/icinga2/issues/3608) (CLI): Icinga 2 script debugger
-* [#3591](https://github.com/Icinga/icinga2/issues/3591) (CLI): Change output format for 'icinga2 console'
-* [#3580](https://github.com/Icinga/icinga2/issues/3580): Change GetLastStateUp/Down to host attributes
-* [#3576](https://github.com/Icinga/icinga2/issues/3576) (Plugins): Missing parameters for check jmx4perl
-* [#3561](https://github.com/Icinga/icinga2/issues/3561) (CLI): Use ZoneName variable for parent\_zone in node update-config
-* [#3537](https://github.com/Icinga/icinga2/issues/3537) (CLI): Rewrite man page
-* [#3531](https://github.com/Icinga/icinga2/issues/3531) (DB IDO): Add the name for comments/downtimes next to legacy\_id to DB IDO
-* [#3515](https://github.com/Icinga/icinga2/issues/3515): Remove api.cpp, api.hpp 
-* [#3508](https://github.com/Icinga/icinga2/issues/3508) (Cluster): Add getter for endpoint 'connected' attribute
-* [#3507](https://github.com/Icinga/icinga2/issues/3507) (API): Hide internal attributes
-* [#3506](https://github.com/Icinga/icinga2/issues/3506) (API): Original attributes list in IDO
-* [#3503](https://github.com/Icinga/icinga2/issues/3503) (API): Log a warning message on unauthorized http request
-* [#3502](https://github.com/Icinga/icinga2/issues/3502) (API): Use the API for "icinga2 console"
-* [#3498](https://github.com/Icinga/icinga2/issues/3498) (DB IDO): DB IDO should provide its connected state via /v1/status
-* [#3488](https://github.com/Icinga/icinga2/issues/3488) (API): Document that modified attributes require accept\_config for cluster/clients
-* [#3469](https://github.com/Icinga/icinga2/issues/3469) (Configuration): Pretty-print arrays and dictionaries when converting them to strings
-* [#3463](https://github.com/Icinga/icinga2/issues/3463) (API): Change object version to timestamps for diff updates on config sync
-* [#3452](https://github.com/Icinga/icinga2/issues/3452) (Configuration): Provide keywords to retrieve the current file name at parse time
-* [#3435](https://github.com/Icinga/icinga2/issues/3435) (API): Move /v1/\<type\> to /v1/objects/\<type\>
-* [#3432](https://github.com/Icinga/icinga2/issues/3432) (API): Rename statusqueryhandler to objectqueryhandler
-* [#3419](https://github.com/Icinga/icinga2/issues/3419) (API): Sanitize error status codes and messages
-* [#3414](https://github.com/Icinga/icinga2/issues/3414): Make ConfigObject::{G,S}etField\(\) method public
-* [#3386](https://github.com/Icinga/icinga2/issues/3386) (API): Add global status handler for the API
-* [#3357](https://github.com/Icinga/icinga2/issues/3357) (API): Implement CSRF protection for the API
-* [#3354](https://github.com/Icinga/icinga2/issues/3354) (API): Implement joins for status queries
-* [#3343](https://github.com/Icinga/icinga2/issues/3343) (API): Implement a demo API client: Icinga Studio
-* [#3341](https://github.com/Icinga/icinga2/issues/3341) (API): URL class improvements
-* [#3340](https://github.com/Icinga/icinga2/issues/3340) (API): Add plural\_name field to /v1/types
-* [#3332](https://github.com/Icinga/icinga2/issues/3332) (Configuration): Use an AST node for the 'library' keyword
-* [#3297](https://github.com/Icinga/icinga2/issues/3297) (Configuration): Implement ignore\_on\_error keyword
-* [#3296](https://github.com/Icinga/icinga2/issues/3296) (API): Rename config/modules to config/packages
-* [#3291](https://github.com/Icinga/icinga2/issues/3291) (API): Remove debug messages in HttpRequest class
-* [#3290](https://github.com/Icinga/icinga2/issues/3290): Add String::ToLower/ToUpper
-* [#3287](https://github.com/Icinga/icinga2/issues/3287) (API): Add package attribute for ConfigObject and set its origin
-* [#3285](https://github.com/Icinga/icinga2/issues/3285) (API): Implement support for restoring modified attributes
-* [#3283](https://github.com/Icinga/icinga2/issues/3283) (API): Implement support for indexers in ConfigObject::RestoreAttribute
-* [#3282](https://github.com/Icinga/icinga2/issues/3282): Implement Object\#clone and rename Array/Dictionary\#clone to shallow\_clone
-* [#3280](https://github.com/Icinga/icinga2/issues/3280): Add override keyword for all relevant methods
-* [#3278](https://github.com/Icinga/icinga2/issues/3278) (API): Figure out how to sync dynamically created objects inside the cluster
-* [#3277](https://github.com/Icinga/icinga2/issues/3277) (API): Ensure that runtime config objects are persisted on disk
-* [#3272](https://github.com/Icinga/icinga2/issues/3272): Implement the 'base' field for the Type class
-* [#3267](https://github.com/Icinga/icinga2/issues/3267): Rename DynamicObject/DynamicType to ConfigObject/ConfigType
-* [#3240](https://github.com/Icinga/icinga2/issues/3240): Implement support for attaching GDB to the Icinga process on crash
-* [#3238](https://github.com/Icinga/icinga2/issues/3238) (API): Implement global modified attributes
-* [#3233](https://github.com/Icinga/icinga2/issues/3233) (API): Implement support for . in modify\_attribute
-* [#3232](https://github.com/Icinga/icinga2/issues/3232) (API): Remove GetModifiedAttributes/SetModifiedAttributes
-* [#3231](https://github.com/Icinga/icinga2/issues/3231) (API): Re-implement events for attribute changes
-* [#3230](https://github.com/Icinga/icinga2/issues/3230) (API): Validation for modified attributes
-* [#3203](https://github.com/Icinga/icinga2/issues/3203) (Configuration): Setting global variables with i2tcl doesn't work
-* [#3197](https://github.com/Icinga/icinga2/issues/3197) (API): Make Comments and Downtime types available as ConfigObject type in the API
-* [#3193](https://github.com/Icinga/icinga2/issues/3193) (API): Update the url parsers behaviour
-* [#3177](https://github.com/Icinga/icinga2/issues/3177) (API): Documentation for config management API
-* [#3173](https://github.com/Icinga/icinga2/issues/3173) (API): Add real path sanity checks to provided file paths
-* [#3172](https://github.com/Icinga/icinga2/issues/3172): String::Trim\(\) should return a new string rather than modifying the current string
-* [#3169](https://github.com/Icinga/icinga2/issues/3169) (API): Implement support for X-HTTP-Method-Override
-* [#3168](https://github.com/Icinga/icinga2/issues/3168): Add Array::FromVector\(\) method
-* [#3167](https://github.com/Icinga/icinga2/issues/3167): Add exceptions for Utility::MkDir{,P}
-* [#3154](https://github.com/Icinga/icinga2/issues/3154): Move url to /lib/remote from /lib/base
-* [#3144](https://github.com/Icinga/icinga2/issues/3144): Register ServiceOK, ServiceWarning, HostUp, etc. as constants
-* [#3140](https://github.com/Icinga/icinga2/issues/3140) (API): Implement base64 de- and encoder
-* [#3094](https://github.com/Icinga/icinga2/issues/3094) (API): Implement ApiUser type
-* [#3093](https://github.com/Icinga/icinga2/issues/3093) (API): Implement URL parser
-* [#3090](https://github.com/Icinga/icinga2/issues/3090) (Graphite): New Graphite schema
-* [#3089](https://github.com/Icinga/icinga2/issues/3089) (API): Implement support for filter\_vars
-* [#3083](https://github.com/Icinga/icinga2/issues/3083) (API): Define RESTful url schema
-* [#3082](https://github.com/Icinga/icinga2/issues/3082) (API): Implement support for HTTP
-* [#3065](https://github.com/Icinga/icinga2/issues/3065): Allow comments when parsing JSON
-* [#3025](https://github.com/Icinga/icinga2/issues/3025) (DB IDO): DB IDO/Livestatus: Add zone object table w/ endpoint members
-* [#2934](https://github.com/Icinga/icinga2/issues/2934) (API): API Documentation
-* [#2933](https://github.com/Icinga/icinga2/issues/2933) (API): Implement config file management commands
-* [#2932](https://github.com/Icinga/icinga2/issues/2932) (API): Staging for configuration validation
-* [#2931](https://github.com/Icinga/icinga2/issues/2931) (API): Support validating configuration changes
-* [#2930](https://github.com/Icinga/icinga2/issues/2930) (API): Commands for adding and removing objects
-* [#2929](https://github.com/Icinga/icinga2/issues/2929) (API): Multiple sources for zone configuration tree
-* [#2928](https://github.com/Icinga/icinga2/issues/2928) (API): Implement support for writing configuration files 
-* [#2927](https://github.com/Icinga/icinga2/issues/2927) (API): Update modules to support adding and removing objects at runtime
-* [#2926](https://github.com/Icinga/icinga2/issues/2926) (API): Dependency tracking for objects
-* [#2925](https://github.com/Icinga/icinga2/issues/2925) (API): Disallow changes for certain config attributes at runtime
-* [#2923](https://github.com/Icinga/icinga2/issues/2923) (API): Changelog for modified attributes
-* [#2921](https://github.com/Icinga/icinga2/issues/2921) (API): API status queries
-* [#2918](https://github.com/Icinga/icinga2/issues/2918) (API): API permissions
-* [#2917](https://github.com/Icinga/icinga2/issues/2917) (API): Create default administrative user
-* [#2916](https://github.com/Icinga/icinga2/issues/2916) (API): Password-based authentication for the API
-* [#2915](https://github.com/Icinga/icinga2/issues/2915) (API): Certificate-based authentication for the API
-* [#2914](https://github.com/Icinga/icinga2/issues/2914) (API): Enable the ApiListener by default
-* [#2913](https://github.com/Icinga/icinga2/issues/2913) (API): Configuration file management for the API
-* [#2912](https://github.com/Icinga/icinga2/issues/2912) (API): Runtime configuration for the API
-* [#2911](https://github.com/Icinga/icinga2/issues/2911) (API): Add modified attribute support for the API
-* [#2910](https://github.com/Icinga/icinga2/issues/2910) (API): Add commands \(actions\) for the API
-* [#2909](https://github.com/Icinga/icinga2/issues/2909) (API): Implement status queries for the API
-* [#2908](https://github.com/Icinga/icinga2/issues/2908) (API): Event stream support for the API
-* [#2907](https://github.com/Icinga/icinga2/issues/2907) (API): Implement filters for the API
-* [#2906](https://github.com/Icinga/icinga2/issues/2906) (API): Reflection support for the API
-* [#2904](https://github.com/Icinga/icinga2/issues/2904) (API): Basic API framework
-* [#2901](https://github.com/Icinga/icinga2/issues/2901) (Configuration): Implement sandbox mode for the config parser
-* [#2887](https://github.com/Icinga/icinga2/issues/2887) (Configuration): Remove the ScopeCurrent constant
-* [#2857](https://github.com/Icinga/icinga2/issues/2857): Avoid unnecessary dictionary lookups
-* [#2838](https://github.com/Icinga/icinga2/issues/2838): Move implementation code from thpp files into separate files
-* [#2826](https://github.com/Icinga/icinga2/issues/2826) (Configuration): Use DebugHint information when reporting validation errors
-* [#2814](https://github.com/Icinga/icinga2/issues/2814): Add support for the C++11 keyword 'override'
-* [#2809](https://github.com/Icinga/icinga2/issues/2809) (Configuration): Implement constructor-style casts
-* [#2788](https://github.com/Icinga/icinga2/issues/2788) (Configuration): Refactor the startup process
-* [#2785](https://github.com/Icinga/icinga2/issues/2785) (CLI): Implement support for libedit
-* [#2757](https://github.com/Icinga/icinga2/issues/2757): Deprecate IcingaStatusWriter feature
-* [#2755](https://github.com/Icinga/icinga2/issues/2755) (DB IDO): Implement support for CLIENT\_MULTI\_STATEMENTS
-* [#2741](https://github.com/Icinga/icinga2/issues/2741) (DB IDO): Add support for current and current-1 db ido schema version
-* [#2740](https://github.com/Icinga/icinga2/issues/2740) (DB IDO): Add embedded DB IDO version health check
-* [#2722](https://github.com/Icinga/icinga2/issues/2722): Allow some of the Array and Dictionary methods to be inlined by the compiler
-* [#2514](https://github.com/Icinga/icinga2/issues/2514): 'icinga2 console' should serialize temporary attributes \(rather than just config + state\)
-* [#2474](https://github.com/Icinga/icinga2/issues/2474) (Graphite): graphite writer should pass "-" in host names and "." in perf data 
-* [#2438](https://github.com/Icinga/icinga2/issues/2438) (API): Add icinga, cluster, cluster-zone check information to the ApiListener status handler
-* [#2268](https://github.com/Icinga/icinga2/issues/2268) (Configuration): Validators should be implemented in \(auto-generated\) native code
+* [#3642](https://github.com/icinga/icinga2/issues/3642): Release 2.4.0
+* [#3624](https://github.com/icinga/icinga2/issues/3624) (API): Enhance programmatic examples for the API docs
+* [#3611](https://github.com/icinga/icinga2/issues/3611) (API): Change object query result set
+* [#3609](https://github.com/icinga/icinga2/issues/3609) (API): Change 'api setup' into a manual step while configuring the API
+* [#3608](https://github.com/icinga/icinga2/issues/3608) (CLI): Icinga 2 script debugger
+* [#3591](https://github.com/icinga/icinga2/issues/3591) (CLI): Change output format for 'icinga2 console'
+* [#3580](https://github.com/icinga/icinga2/issues/3580): Change GetLastStateUp/Down to host attributes
+* [#3576](https://github.com/icinga/icinga2/issues/3576) (Plugins): Missing parameters for check jmx4perl
+* [#3561](https://github.com/icinga/icinga2/issues/3561) (CLI): Use ZoneName variable for parent\_zone in node update-config
+* [#3537](https://github.com/icinga/icinga2/issues/3537) (CLI): Rewrite man page
+* [#3531](https://github.com/icinga/icinga2/issues/3531) (DB IDO): Add the name for comments/downtimes next to legacy\_id to DB IDO
+* [#3515](https://github.com/icinga/icinga2/issues/3515): Remove api.cpp, api.hpp 
+* [#3508](https://github.com/icinga/icinga2/issues/3508) (Cluster): Add getter for endpoint 'connected' attribute
+* [#3507](https://github.com/icinga/icinga2/issues/3507) (API): Hide internal attributes
+* [#3506](https://github.com/icinga/icinga2/issues/3506) (API): Original attributes list in IDO
+* [#3503](https://github.com/icinga/icinga2/issues/3503) (API): Log a warning message on unauthorized http request
+* [#3502](https://github.com/icinga/icinga2/issues/3502) (API): Use the API for "icinga2 console"
+* [#3498](https://github.com/icinga/icinga2/issues/3498) (DB IDO): DB IDO should provide its connected state via /v1/status
+* [#3488](https://github.com/icinga/icinga2/issues/3488) (API): Document that modified attributes require accept\_config for cluster/clients
+* [#3469](https://github.com/icinga/icinga2/issues/3469) (Configuration): Pretty-print arrays and dictionaries when converting them to strings
+* [#3463](https://github.com/icinga/icinga2/issues/3463) (API): Change object version to timestamps for diff updates on config sync
+* [#3452](https://github.com/icinga/icinga2/issues/3452) (Configuration): Provide keywords to retrieve the current file name at parse time
+* [#3435](https://github.com/icinga/icinga2/issues/3435) (API): Move /v1/\<type\> to /v1/objects/\<type\>
+* [#3432](https://github.com/icinga/icinga2/issues/3432) (API): Rename statusqueryhandler to objectqueryhandler
+* [#3419](https://github.com/icinga/icinga2/issues/3419) (API): Sanitize error status codes and messages
+* [#3414](https://github.com/icinga/icinga2/issues/3414): Make ConfigObject::{G,S}etField\(\) method public
+* [#3386](https://github.com/icinga/icinga2/issues/3386) (API): Add global status handler for the API
+* [#3357](https://github.com/icinga/icinga2/issues/3357) (API): Implement CSRF protection for the API
+* [#3354](https://github.com/icinga/icinga2/issues/3354) (API): Implement joins for status queries
+* [#3343](https://github.com/icinga/icinga2/issues/3343) (API): Implement a demo API client: Icinga Studio
+* [#3341](https://github.com/icinga/icinga2/issues/3341) (API): URL class improvements
+* [#3340](https://github.com/icinga/icinga2/issues/3340) (API): Add plural\_name field to /v1/types
+* [#3332](https://github.com/icinga/icinga2/issues/3332) (Configuration): Use an AST node for the 'library' keyword
+* [#3297](https://github.com/icinga/icinga2/issues/3297) (Configuration): Implement ignore\_on\_error keyword
+* [#3296](https://github.com/icinga/icinga2/issues/3296) (API): Rename config/modules to config/packages
+* [#3291](https://github.com/icinga/icinga2/issues/3291) (API): Remove debug messages in HttpRequest class
+* [#3290](https://github.com/icinga/icinga2/issues/3290): Add String::ToLower/ToUpper
+* [#3287](https://github.com/icinga/icinga2/issues/3287) (API): Add package attribute for ConfigObject and set its origin
+* [#3285](https://github.com/icinga/icinga2/issues/3285) (API): Implement support for restoring modified attributes
+* [#3283](https://github.com/icinga/icinga2/issues/3283) (API): Implement support for indexers in ConfigObject::RestoreAttribute
+* [#3282](https://github.com/icinga/icinga2/issues/3282): Implement Object\#clone and rename Array/Dictionary\#clone to shallow\_clone
+* [#3280](https://github.com/icinga/icinga2/issues/3280): Add override keyword for all relevant methods
+* [#3278](https://github.com/icinga/icinga2/issues/3278) (API): Figure out how to sync dynamically created objects inside the cluster
+* [#3277](https://github.com/icinga/icinga2/issues/3277) (API): Ensure that runtime config objects are persisted on disk
+* [#3272](https://github.com/icinga/icinga2/issues/3272): Implement the 'base' field for the Type class
+* [#3267](https://github.com/icinga/icinga2/issues/3267): Rename DynamicObject/DynamicType to ConfigObject/ConfigType
+* [#3240](https://github.com/icinga/icinga2/issues/3240): Implement support for attaching GDB to the Icinga process on crash
+* [#3238](https://github.com/icinga/icinga2/issues/3238) (API): Implement global modified attributes
+* [#3233](https://github.com/icinga/icinga2/issues/3233) (API): Implement support for . in modify\_attribute
+* [#3232](https://github.com/icinga/icinga2/issues/3232) (API): Remove GetModifiedAttributes/SetModifiedAttributes
+* [#3231](https://github.com/icinga/icinga2/issues/3231) (API): Re-implement events for attribute changes
+* [#3230](https://github.com/icinga/icinga2/issues/3230) (API): Validation for modified attributes
+* [#3203](https://github.com/icinga/icinga2/issues/3203) (Configuration): Setting global variables with i2tcl doesn't work
+* [#3197](https://github.com/icinga/icinga2/issues/3197) (API): Make Comments and Downtime types available as ConfigObject type in the API
+* [#3193](https://github.com/icinga/icinga2/issues/3193) (API): Update the url parsers behaviour
+* [#3177](https://github.com/icinga/icinga2/issues/3177) (API): Documentation for config management API
+* [#3173](https://github.com/icinga/icinga2/issues/3173) (API): Add real path sanity checks to provided file paths
+* [#3172](https://github.com/icinga/icinga2/issues/3172): String::Trim\(\) should return a new string rather than modifying the current string
+* [#3169](https://github.com/icinga/icinga2/issues/3169) (API): Implement support for X-HTTP-Method-Override
+* [#3168](https://github.com/icinga/icinga2/issues/3168): Add Array::FromVector\(\) method
+* [#3167](https://github.com/icinga/icinga2/issues/3167): Add exceptions for Utility::MkDir{,P}
+* [#3154](https://github.com/icinga/icinga2/issues/3154): Move url to /lib/remote from /lib/base
+* [#3144](https://github.com/icinga/icinga2/issues/3144): Register ServiceOK, ServiceWarning, HostUp, etc. as constants
+* [#3140](https://github.com/icinga/icinga2/issues/3140) (API): Implement base64 de- and encoder
+* [#3094](https://github.com/icinga/icinga2/issues/3094) (API): Implement ApiUser type
+* [#3093](https://github.com/icinga/icinga2/issues/3093) (API): Implement URL parser
+* [#3090](https://github.com/icinga/icinga2/issues/3090) (Graphite): New Graphite schema
+* [#3089](https://github.com/icinga/icinga2/issues/3089) (API): Implement support for filter\_vars
+* [#3083](https://github.com/icinga/icinga2/issues/3083) (API): Define RESTful url schema
+* [#3082](https://github.com/icinga/icinga2/issues/3082) (API): Implement support for HTTP
+* [#3065](https://github.com/icinga/icinga2/issues/3065): Allow comments when parsing JSON
+* [#3025](https://github.com/icinga/icinga2/issues/3025) (DB IDO): DB IDO/Livestatus: Add zone object table w/ endpoint members
+* [#2934](https://github.com/icinga/icinga2/issues/2934) (API): API Documentation
+* [#2933](https://github.com/icinga/icinga2/issues/2933) (API): Implement config file management commands
+* [#2932](https://github.com/icinga/icinga2/issues/2932) (API): Staging for configuration validation
+* [#2931](https://github.com/icinga/icinga2/issues/2931) (API): Support validating configuration changes
+* [#2930](https://github.com/icinga/icinga2/issues/2930) (API): Commands for adding and removing objects
+* [#2929](https://github.com/icinga/icinga2/issues/2929) (API): Multiple sources for zone configuration tree
+* [#2928](https://github.com/icinga/icinga2/issues/2928) (API): Implement support for writing configuration files 
+* [#2927](https://github.com/icinga/icinga2/issues/2927) (API): Update modules to support adding and removing objects at runtime
+* [#2926](https://github.com/icinga/icinga2/issues/2926) (API): Dependency tracking for objects
+* [#2925](https://github.com/icinga/icinga2/issues/2925) (API): Disallow changes for certain config attributes at runtime
+* [#2923](https://github.com/icinga/icinga2/issues/2923) (API): Changelog for modified attributes
+* [#2921](https://github.com/icinga/icinga2/issues/2921) (API): API status queries
+* [#2918](https://github.com/icinga/icinga2/issues/2918) (API): API permissions
+* [#2917](https://github.com/icinga/icinga2/issues/2917) (API): Create default administrative user
+* [#2916](https://github.com/icinga/icinga2/issues/2916) (API): Password-based authentication for the API
+* [#2915](https://github.com/icinga/icinga2/issues/2915) (API): Certificate-based authentication for the API
+* [#2914](https://github.com/icinga/icinga2/issues/2914) (API): Enable the ApiListener by default
+* [#2913](https://github.com/icinga/icinga2/issues/2913) (API): Configuration file management for the API
+* [#2912](https://github.com/icinga/icinga2/issues/2912) (API): Runtime configuration for the API
+* [#2911](https://github.com/icinga/icinga2/issues/2911) (API): Add modified attribute support for the API
+* [#2910](https://github.com/icinga/icinga2/issues/2910) (API): Add commands \(actions\) for the API
+* [#2909](https://github.com/icinga/icinga2/issues/2909) (API): Implement status queries for the API
+* [#2908](https://github.com/icinga/icinga2/issues/2908) (API): Event stream support for the API
+* [#2907](https://github.com/icinga/icinga2/issues/2907) (API): Implement filters for the API
+* [#2906](https://github.com/icinga/icinga2/issues/2906) (API): Reflection support for the API
+* [#2904](https://github.com/icinga/icinga2/issues/2904) (API): Basic API framework
+* [#2901](https://github.com/icinga/icinga2/issues/2901) (Configuration): Implement sandbox mode for the config parser
+* [#2887](https://github.com/icinga/icinga2/issues/2887) (Configuration): Remove the ScopeCurrent constant
+* [#2857](https://github.com/icinga/icinga2/issues/2857): Avoid unnecessary dictionary lookups
+* [#2838](https://github.com/icinga/icinga2/issues/2838): Move implementation code from thpp files into separate files
+* [#2826](https://github.com/icinga/icinga2/issues/2826) (Configuration): Use DebugHint information when reporting validation errors
+* [#2814](https://github.com/icinga/icinga2/issues/2814): Add support for the C++11 keyword 'override'
+* [#2809](https://github.com/icinga/icinga2/issues/2809) (Configuration): Implement constructor-style casts
+* [#2788](https://github.com/icinga/icinga2/issues/2788) (Configuration): Refactor the startup process
+* [#2785](https://github.com/icinga/icinga2/issues/2785) (CLI): Implement support for libedit
+* [#2757](https://github.com/icinga/icinga2/issues/2757): Deprecate IcingaStatusWriter feature
+* [#2755](https://github.com/icinga/icinga2/issues/2755) (DB IDO): Implement support for CLIENT\_MULTI\_STATEMENTS
+* [#2741](https://github.com/icinga/icinga2/issues/2741) (DB IDO): Add support for current and current-1 db ido schema version
+* [#2740](https://github.com/icinga/icinga2/issues/2740) (DB IDO): Add embedded DB IDO version health check
+* [#2722](https://github.com/icinga/icinga2/issues/2722): Allow some of the Array and Dictionary methods to be inlined by the compiler
+* [#2514](https://github.com/icinga/icinga2/issues/2514): 'icinga2 console' should serialize temporary attributes \(rather than just config + state\)
+* [#2474](https://github.com/icinga/icinga2/issues/2474) (Graphite): graphite writer should pass "-" in host names and "." in perf data 
+* [#2438](https://github.com/icinga/icinga2/issues/2438) (API): Add icinga, cluster, cluster-zone check information to the ApiListener status handler
+* [#2268](https://github.com/icinga/icinga2/issues/2268) (Configuration): Validators should be implemented in \(auto-generated\) native code
 
 ### Bug
 
-* [#3669](https://github.com/Icinga/icinga2/issues/3669): Use notify\_one in WorkQueue::Enqueue
-* [#3667](https://github.com/Icinga/icinga2/issues/3667): Utility::FormatErrorNumber fails when error message uses arguments
-* [#3649](https://github.com/Icinga/icinga2/issues/3649) (DB IDO): Group memberships are not updated for runtime created objects
-* [#3648](https://github.com/Icinga/icinga2/issues/3648) (API): API overwrites \(and then deletes\) config file when trying to create an object that already exists
-* [#3647](https://github.com/Icinga/icinga2/issues/3647) (API): Don't allow users to set state attributes via PUT
-* [#3645](https://github.com/Icinga/icinga2/issues/3645): Deadlock in MacroProcessor::EvaluateFunction
-* [#3635](https://github.com/Icinga/icinga2/issues/3635): modify\_attribute: object cannot be cloned
-* [#3633](https://github.com/Icinga/icinga2/issues/3633) (API): Detailed error message is missing when object creation via API fails
-* [#3632](https://github.com/Icinga/icinga2/issues/3632) (API): API call doesn't fail when trying to use a template that doesn't exist
-* [#3625](https://github.com/Icinga/icinga2/issues/3625): Improve location information for errors in API filters
-* [#3622](https://github.com/Icinga/icinga2/issues/3622) (API): /v1/console should only use a single permission
-* [#3620](https://github.com/Icinga/icinga2/issues/3620) (API): 'remove-comment' action does not support filters
-* [#3619](https://github.com/Icinga/icinga2/issues/3619) (CLI): 'api setup' should create a user even when api feature is already enabled
-* [#3618](https://github.com/Icinga/icinga2/issues/3618) (CLI): Autocompletion doesn't work in the debugger
-* [#3617](https://github.com/Icinga/icinga2/issues/3617) (API): There's a variable called 'string' in filter expressions
-* [#3607](https://github.com/Icinga/icinga2/issues/3607) (CLI): Broken build - unresolved external symbol "public: void \_\_thiscall icinga::ApiClient::ExecuteScript...
-* [#3602](https://github.com/Icinga/icinga2/issues/3602) (DB IDO): Async mysql queries aren't logged in the debug log
-* [#3601](https://github.com/Icinga/icinga2/issues/3601): Don't validate custom attributes that aren't strings
-* [#3600](https://github.com/Icinga/icinga2/issues/3600): Crash in ConfigWriter::EmitIdentifier
-* [#3598](https://github.com/Icinga/icinga2/issues/3598) (CLI): Spaces do not work in command arguments
-* [#3595](https://github.com/Icinga/icinga2/issues/3595) (DB IDO): Change session\_token to integer timestamp
-* [#3593](https://github.com/Icinga/icinga2/issues/3593): Fix indentation for Dictionary::ToString
-* [#3587](https://github.com/Icinga/icinga2/issues/3587): Crash in ConfigWriter::GetKeywords
-* [#3586](https://github.com/Icinga/icinga2/issues/3586) (Cluster): Circular reference between \*Connection and TlsStream objects
-* [#3583](https://github.com/Icinga/icinga2/issues/3583) (API): Mismatch on {comment,downtime}\_id vs internal name in the API
-* [#3581](https://github.com/Icinga/icinga2/issues/3581): CreatePipeOverlapped is not thread-safe
-* [#3579](https://github.com/Icinga/icinga2/issues/3579): Figure out whether we need the Checkable attributes state\_raw, last\_state\_raw, hard\_state\_raw
-* [#3577](https://github.com/Icinga/icinga2/issues/3577) (Plugins): Increase the default timeout for OS checks
-* [#3574](https://github.com/Icinga/icinga2/issues/3574) (API): Plural name rule not treating edge case correcly
-* [#3572](https://github.com/Icinga/icinga2/issues/3572) (API): IcingaStudio: Accessing non-ConfigObjects causes ugly exception
-* [#3569](https://github.com/Icinga/icinga2/issues/3569) (API): Incorrect JSON-RPC message causes Icinga 2 to crash
-* [#3566](https://github.com/Icinga/icinga2/issues/3566) (DB IDO): Unique constraint violation with multiple comment inserts in DB IDO
-* [#3558](https://github.com/Icinga/icinga2/issues/3558) (DB IDO): IDO tries to execute empty UPDATE queries
-* [#3554](https://github.com/Icinga/icinga2/issues/3554) (Configuration): Crash in IndexerExpression::GetReference when attempting to set an attribute on an object other than the current one
-* [#3551](https://github.com/Icinga/icinga2/issues/3551) (Configuration): Line continuation is broken in 'icinga2 console'
-* [#3548](https://github.com/Icinga/icinga2/issues/3548) (Configuration): Don't allow scripts to access FANoUserView attributes in sandbox mode
-* [#3546](https://github.com/Icinga/icinga2/issues/3546) (Cluster): Improve error handling during log replay
-* [#3536](https://github.com/Icinga/icinga2/issues/3536) (CLI): Improve --help output for the --log-level option
-* [#3535](https://github.com/Icinga/icinga2/issues/3535) (CLI): "Command options" is empty when executing icinga2 without any argument.
-* [#3534](https://github.com/Icinga/icinga2/issues/3534) (DB IDO): Custom variables aren't removed from the IDO database
-* [#3524](https://github.com/Icinga/icinga2/issues/3524) (DB IDO): Changing a group's attributes causes duplicate rows in the icinga\_\*group\_members table
-* [#3517](https://github.com/Icinga/icinga2/issues/3517): OpenBSD: hang during ConfigItem::ActivateItems\(\) in daemon startup
-* [#3514](https://github.com/Icinga/icinga2/issues/3514) (CLI): Misleading wording in generated zones.conf
-* [#3501](https://github.com/Icinga/icinga2/issues/3501) (API): restore\_attribute does not work in clusters
-* [#3489](https://github.com/Icinga/icinga2/issues/3489) (API): Ensure that modified attributes work with clients with local config and no zone attribute
-* [#3485](https://github.com/Icinga/icinga2/issues/3485) (API): Icinga2 API performance regression
-* [#3482](https://github.com/Icinga/icinga2/issues/3482) (API): Version updates are not working properly
-* [#3468](https://github.com/Icinga/icinga2/issues/3468) (CLI): icinga2 repository host add does not work
-* [#3462](https://github.com/Icinga/icinga2/issues/3462): ConfigWriter::EmitValue should format floating point values properly
-* [#3461](https://github.com/Icinga/icinga2/issues/3461) (API): Config sync does not set endpoint syncing and plays disconnect-sync ping-pong
-* [#3459](https://github.com/Icinga/icinga2/issues/3459) (API): /v1/objects/\<type\> returns an HTTP error when there are no objects of that type
-* [#3457](https://github.com/Icinga/icinga2/issues/3457) (API): Config Sync shouldn't send updates for objects the client doesn't have access to
-* [#3451](https://github.com/Icinga/icinga2/issues/3451) (API): Properly encode URLs in Icinga Studio
-* [#3448](https://github.com/Icinga/icinga2/issues/3448) (API): Use a temporary file for modified-attributes.conf updates
-* [#3445](https://github.com/Icinga/icinga2/issues/3445) (Configuration): ASCII NULs don't work in string values
-* [#3438](https://github.com/Icinga/icinga2/issues/3438) (API): URL parser is cutting off last character
-* [#3434](https://github.com/Icinga/icinga2/issues/3434) (API): PerfdataValue is not properly serialised in status queries
-* [#3433](https://github.com/Icinga/icinga2/issues/3433) (API): Move the Collection status handler to /v1/status
-* [#3422](https://github.com/Icinga/icinga2/issues/3422) (Configuration): Detect infinite recursion in user scripts
-* [#3411](https://github.com/Icinga/icinga2/issues/3411) (API): API actions do not follow REST guidelines
-* [#3383](https://github.com/Icinga/icinga2/issues/3383) (DB IDO): Add object\_id where clause for icinga\_downtimehistory
-* [#3345](https://github.com/Icinga/icinga2/issues/3345) (API): Error handling in HttpClient/icinga-studio
-* [#3338](https://github.com/Icinga/icinga2/issues/3338) (CLI): Unused variable console\_type in consolecommand.cpp
-* [#3336](https://github.com/Icinga/icinga2/issues/3336) (API): Filtering by name doesn't work
-* [#3335](https://github.com/Icinga/icinga2/issues/3335) (API): HTTP keep-alive does not work with .NET WebClient
-* [#3330](https://github.com/Icinga/icinga2/issues/3330): Unused variable 'dobj' in configobject.tcpp
-* [#3328](https://github.com/Icinga/icinga2/issues/3328) (Configuration): Don't parse config files for branches not taken
-* [#3315](https://github.com/Icinga/icinga2/issues/3315) (Configuration): Crash in ConfigCompiler::RegisterZoneDir
-* [#3302](https://github.com/Icinga/icinga2/issues/3302) (API): Implement support for '.' when persisting modified attributes
-* [#3301](https://github.com/Icinga/icinga2/issues/3301): Fix formatting in mkclass
-* [#3264](https://github.com/Icinga/icinga2/issues/3264) (API): Do not let API users create objects with invalid names
-* [#3250](https://github.com/Icinga/icinga2/issues/3250) (API): Missing conf.d or zones.d cause parse failure
-* [#3248](https://github.com/Icinga/icinga2/issues/3248): Crash during cluster log replay
-* [#3244](https://github.com/Icinga/icinga2/issues/3244) (CLI): Color codes in console prompt break line editing
-* [#3242](https://github.com/Icinga/icinga2/issues/3242) (CLI): Crash in ScriptFrame::~ScriptFrame
-* [#3227](https://github.com/Icinga/icinga2/issues/3227) (CLI): console autocompletion should take into account parent classes' prototypes
-* [#3215](https://github.com/Icinga/icinga2/issues/3215) (API): win32 build: S\_ISDIR is undefined
-* [#3205](https://github.com/Icinga/icinga2/issues/3205) (Configuration): ScriptFrame's 'Self' attribute gets corrupted when an expression throws an exception
-* [#3202](https://github.com/Icinga/icinga2/issues/3202) (Configuration): Operator - should not work with "" and numbers
-* [#3198](https://github.com/Icinga/icinga2/issues/3198): Accessing field ID 0 \("prototype"\) fails
-* [#3182](https://github.com/Icinga/icinga2/issues/3182) (API): Broken cluster config sync w/o include\_zones
-* [#3171](https://github.com/Icinga/icinga2/issues/3171) (API): Problem with child nodes in http url registry
-* [#3138](https://github.com/Icinga/icinga2/issues/3138) (CLI): 'node wizard/setup' should always generate new CN certificates
-* [#3131](https://github.com/Icinga/icinga2/issues/3131) (DB IDO): Overflow in freshness\_threshold column \(smallint\) w/ DB IDO MySQL
-* [#3109](https://github.com/Icinga/icinga2/issues/3109) (API): build failure: demo module
-* [#3087](https://github.com/Icinga/icinga2/issues/3087) (DB IDO): Fix incorrect datatype for the check\_source column in icinga\_statehistory table
-* [#2974](https://github.com/Icinga/icinga2/issues/2974) (Configuration): Remove incorrect 'ignore where' expression from 'ssh' apply example
-* [#2939](https://github.com/Icinga/icinga2/issues/2939) (Cluster): Wrong vars changed handler in api events
-* [#2884](https://github.com/Icinga/icinga2/issues/2884) (DB IDO): PostgreSQL schema sets default timestamps w/o time zone
-* [#2879](https://github.com/Icinga/icinga2/issues/2879): Compiler warnings with latest HEAD 5ac5f98
-* [#2870](https://github.com/Icinga/icinga2/issues/2870) (DB IDO): pgsql driver does not have latest mysql changes synced
-* [#2863](https://github.com/Icinga/icinga2/issues/2863) (Configuration): Crash in VMOps::FunctionCall
-* [#2850](https://github.com/Icinga/icinga2/issues/2850) (Configuration): Validation fails even though field is not required 
-* [#2824](https://github.com/Icinga/icinga2/issues/2824) (DB IDO): Failed assertion in IdoMysqlConnection::FieldToEscapedString  
-* [#2808](https://github.com/Icinga/icinga2/issues/2808) (Configuration): Make default notifications include users from host.vars.notification.mail.users
-* [#2803](https://github.com/Icinga/icinga2/issues/2803): Don't allow users to instantiate the StreamLogger class
+* [#3669](https://github.com/icinga/icinga2/issues/3669): Use notify\_one in WorkQueue::Enqueue
+* [#3667](https://github.com/icinga/icinga2/issues/3667): Utility::FormatErrorNumber fails when error message uses arguments
+* [#3649](https://github.com/icinga/icinga2/issues/3649) (DB IDO): Group memberships are not updated for runtime created objects
+* [#3648](https://github.com/icinga/icinga2/issues/3648) (API): API overwrites \(and then deletes\) config file when trying to create an object that already exists
+* [#3647](https://github.com/icinga/icinga2/issues/3647) (API): Don't allow users to set state attributes via PUT
+* [#3645](https://github.com/icinga/icinga2/issues/3645): Deadlock in MacroProcessor::EvaluateFunction
+* [#3635](https://github.com/icinga/icinga2/issues/3635): modify\_attribute: object cannot be cloned
+* [#3633](https://github.com/icinga/icinga2/issues/3633) (API): Detailed error message is missing when object creation via API fails
+* [#3632](https://github.com/icinga/icinga2/issues/3632) (API): API call doesn't fail when trying to use a template that doesn't exist
+* [#3625](https://github.com/icinga/icinga2/issues/3625): Improve location information for errors in API filters
+* [#3622](https://github.com/icinga/icinga2/issues/3622) (API): /v1/console should only use a single permission
+* [#3620](https://github.com/icinga/icinga2/issues/3620) (API): 'remove-comment' action does not support filters
+* [#3619](https://github.com/icinga/icinga2/issues/3619) (CLI): 'api setup' should create a user even when api feature is already enabled
+* [#3618](https://github.com/icinga/icinga2/issues/3618) (CLI): Autocompletion doesn't work in the debugger
+* [#3617](https://github.com/icinga/icinga2/issues/3617) (API): There's a variable called 'string' in filter expressions
+* [#3607](https://github.com/icinga/icinga2/issues/3607) (CLI): Broken build - unresolved external symbol "public: void \_\_thiscall icinga::ApiClient::ExecuteScript...
+* [#3602](https://github.com/icinga/icinga2/issues/3602) (DB IDO): Async mysql queries aren't logged in the debug log
+* [#3601](https://github.com/icinga/icinga2/issues/3601): Don't validate custom attributes that aren't strings
+* [#3600](https://github.com/icinga/icinga2/issues/3600): Crash in ConfigWriter::EmitIdentifier
+* [#3598](https://github.com/icinga/icinga2/issues/3598) (CLI): Spaces do not work in command arguments
+* [#3595](https://github.com/icinga/icinga2/issues/3595) (DB IDO): Change session\_token to integer timestamp
+* [#3593](https://github.com/icinga/icinga2/issues/3593): Fix indentation for Dictionary::ToString
+* [#3587](https://github.com/icinga/icinga2/issues/3587): Crash in ConfigWriter::GetKeywords
+* [#3586](https://github.com/icinga/icinga2/issues/3586) (Cluster): Circular reference between \*Connection and TlsStream objects
+* [#3583](https://github.com/icinga/icinga2/issues/3583) (API): Mismatch on {comment,downtime}\_id vs internal name in the API
+* [#3581](https://github.com/icinga/icinga2/issues/3581): CreatePipeOverlapped is not thread-safe
+* [#3579](https://github.com/icinga/icinga2/issues/3579): Figure out whether we need the Checkable attributes state\_raw, last\_state\_raw, hard\_state\_raw
+* [#3577](https://github.com/icinga/icinga2/issues/3577) (Plugins): Increase the default timeout for OS checks
+* [#3574](https://github.com/icinga/icinga2/issues/3574) (API): Plural name rule not treating edge case correcly
+* [#3572](https://github.com/icinga/icinga2/issues/3572) (API): IcingaStudio: Accessing non-ConfigObjects causes ugly exception
+* [#3569](https://github.com/icinga/icinga2/issues/3569) (API): Incorrect JSON-RPC message causes Icinga 2 to crash
+* [#3566](https://github.com/icinga/icinga2/issues/3566) (DB IDO): Unique constraint violation with multiple comment inserts in DB IDO
+* [#3558](https://github.com/icinga/icinga2/issues/3558) (DB IDO): IDO tries to execute empty UPDATE queries
+* [#3554](https://github.com/icinga/icinga2/issues/3554) (Configuration): Crash in IndexerExpression::GetReference when attempting to set an attribute on an object other than the current one
+* [#3551](https://github.com/icinga/icinga2/issues/3551) (Configuration): Line continuation is broken in 'icinga2 console'
+* [#3548](https://github.com/icinga/icinga2/issues/3548) (Configuration): Don't allow scripts to access FANoUserView attributes in sandbox mode
+* [#3546](https://github.com/icinga/icinga2/issues/3546) (Cluster): Improve error handling during log replay
+* [#3536](https://github.com/icinga/icinga2/issues/3536) (CLI): Improve --help output for the --log-level option
+* [#3535](https://github.com/icinga/icinga2/issues/3535) (CLI): "Command options" is empty when executing icinga2 without any argument.
+* [#3534](https://github.com/icinga/icinga2/issues/3534) (DB IDO): Custom variables aren't removed from the IDO database
+* [#3524](https://github.com/icinga/icinga2/issues/3524) (DB IDO): Changing a group's attributes causes duplicate rows in the icinga\_\*group\_members table
+* [#3517](https://github.com/icinga/icinga2/issues/3517): OpenBSD: hang during ConfigItem::ActivateItems\(\) in daemon startup
+* [#3514](https://github.com/icinga/icinga2/issues/3514) (CLI): Misleading wording in generated zones.conf
+* [#3501](https://github.com/icinga/icinga2/issues/3501) (API): restore\_attribute does not work in clusters
+* [#3489](https://github.com/icinga/icinga2/issues/3489) (API): Ensure that modified attributes work with clients with local config and no zone attribute
+* [#3485](https://github.com/icinga/icinga2/issues/3485) (API): Icinga2 API performance regression
+* [#3482](https://github.com/icinga/icinga2/issues/3482) (API): Version updates are not working properly
+* [#3468](https://github.com/icinga/icinga2/issues/3468) (CLI): icinga2 repository host add does not work
+* [#3462](https://github.com/icinga/icinga2/issues/3462): ConfigWriter::EmitValue should format floating point values properly
+* [#3461](https://github.com/icinga/icinga2/issues/3461) (API): Config sync does not set endpoint syncing and plays disconnect-sync ping-pong
+* [#3459](https://github.com/icinga/icinga2/issues/3459) (API): /v1/objects/\<type\> returns an HTTP error when there are no objects of that type
+* [#3457](https://github.com/icinga/icinga2/issues/3457) (API): Config Sync shouldn't send updates for objects the client doesn't have access to
+* [#3451](https://github.com/icinga/icinga2/issues/3451) (API): Properly encode URLs in Icinga Studio
+* [#3448](https://github.com/icinga/icinga2/issues/3448) (API): Use a temporary file for modified-attributes.conf updates
+* [#3445](https://github.com/icinga/icinga2/issues/3445) (Configuration): ASCII NULs don't work in string values
+* [#3438](https://github.com/icinga/icinga2/issues/3438) (API): URL parser is cutting off last character
+* [#3434](https://github.com/icinga/icinga2/issues/3434) (API): PerfdataValue is not properly serialised in status queries
+* [#3433](https://github.com/icinga/icinga2/issues/3433) (API): Move the Collection status handler to /v1/status
+* [#3422](https://github.com/icinga/icinga2/issues/3422) (Configuration): Detect infinite recursion in user scripts
+* [#3411](https://github.com/icinga/icinga2/issues/3411) (API): API actions do not follow REST guidelines
+* [#3383](https://github.com/icinga/icinga2/issues/3383) (DB IDO): Add object\_id where clause for icinga\_downtimehistory
+* [#3345](https://github.com/icinga/icinga2/issues/3345) (API): Error handling in HttpClient/icinga-studio
+* [#3338](https://github.com/icinga/icinga2/issues/3338) (CLI): Unused variable console\_type in consolecommand.cpp
+* [#3336](https://github.com/icinga/icinga2/issues/3336) (API): Filtering by name doesn't work
+* [#3335](https://github.com/icinga/icinga2/issues/3335) (API): HTTP keep-alive does not work with .NET WebClient
+* [#3330](https://github.com/icinga/icinga2/issues/3330): Unused variable 'dobj' in configobject.tcpp
+* [#3328](https://github.com/icinga/icinga2/issues/3328) (Configuration): Don't parse config files for branches not taken
+* [#3315](https://github.com/icinga/icinga2/issues/3315) (Configuration): Crash in ConfigCompiler::RegisterZoneDir
+* [#3302](https://github.com/icinga/icinga2/issues/3302) (API): Implement support for '.' when persisting modified attributes
+* [#3301](https://github.com/icinga/icinga2/issues/3301): Fix formatting in mkclass
+* [#3264](https://github.com/icinga/icinga2/issues/3264) (API): Do not let API users create objects with invalid names
+* [#3250](https://github.com/icinga/icinga2/issues/3250) (API): Missing conf.d or zones.d cause parse failure
+* [#3248](https://github.com/icinga/icinga2/issues/3248): Crash during cluster log replay
+* [#3244](https://github.com/icinga/icinga2/issues/3244) (CLI): Color codes in console prompt break line editing
+* [#3242](https://github.com/icinga/icinga2/issues/3242) (CLI): Crash in ScriptFrame::~ScriptFrame
+* [#3227](https://github.com/icinga/icinga2/issues/3227) (CLI): console autocompletion should take into account parent classes' prototypes
+* [#3215](https://github.com/icinga/icinga2/issues/3215) (API): win32 build: S\_ISDIR is undefined
+* [#3205](https://github.com/icinga/icinga2/issues/3205) (Configuration): ScriptFrame's 'Self' attribute gets corrupted when an expression throws an exception
+* [#3202](https://github.com/icinga/icinga2/issues/3202) (Configuration): Operator - should not work with "" and numbers
+* [#3198](https://github.com/icinga/icinga2/issues/3198): Accessing field ID 0 \("prototype"\) fails
+* [#3182](https://github.com/icinga/icinga2/issues/3182) (API): Broken cluster config sync w/o include\_zones
+* [#3171](https://github.com/icinga/icinga2/issues/3171) (API): Problem with child nodes in http url registry
+* [#3138](https://github.com/icinga/icinga2/issues/3138) (CLI): 'node wizard/setup' should always generate new CN certificates
+* [#3131](https://github.com/icinga/icinga2/issues/3131) (DB IDO): Overflow in freshness\_threshold column \(smallint\) w/ DB IDO MySQL
+* [#3109](https://github.com/icinga/icinga2/issues/3109) (API): build failure: demo module
+* [#3087](https://github.com/icinga/icinga2/issues/3087) (DB IDO): Fix incorrect datatype for the check\_source column in icinga\_statehistory table
+* [#2974](https://github.com/icinga/icinga2/issues/2974) (Configuration): Remove incorrect 'ignore where' expression from 'ssh' apply example
+* [#2939](https://github.com/icinga/icinga2/issues/2939) (Cluster): Wrong vars changed handler in api events
+* [#2884](https://github.com/icinga/icinga2/issues/2884) (DB IDO): PostgreSQL schema sets default timestamps w/o time zone
+* [#2879](https://github.com/icinga/icinga2/issues/2879): Compiler warnings with latest HEAD 5ac5f98
+* [#2870](https://github.com/icinga/icinga2/issues/2870) (DB IDO): pgsql driver does not have latest mysql changes synced
+* [#2863](https://github.com/icinga/icinga2/issues/2863) (Configuration): Crash in VMOps::FunctionCall
+* [#2850](https://github.com/icinga/icinga2/issues/2850) (Configuration): Validation fails even though field is not required 
+* [#2824](https://github.com/icinga/icinga2/issues/2824) (DB IDO): Failed assertion in IdoMysqlConnection::FieldToEscapedString  
+* [#2808](https://github.com/icinga/icinga2/issues/2808) (Configuration): Make default notifications include users from host.vars.notification.mail.users
+* [#2803](https://github.com/icinga/icinga2/issues/2803): Don't allow users to instantiate the StreamLogger class
 
 ### ITL
 
-* [#3584](https://github.com/Icinga/icinga2/issues/3584) (ITL): Add ipv4/ipv6 only to tcp and http CheckCommand
-* [#3582](https://github.com/Icinga/icinga2/issues/3582) (ITL): Add check command mysql
-* [#3578](https://github.com/Icinga/icinga2/issues/3578) (ITL): Add check command negate
-* [#3532](https://github.com/Icinga/icinga2/issues/3532) (ITL): 'dig\_lookup' custom attribute for the 'dig' check command isn't optional
-* [#3525](https://github.com/Icinga/icinga2/issues/3525) (ITL): Ability to set port on SNMP Checks
-* [#3490](https://github.com/Icinga/icinga2/issues/3490) (ITL): Add check command nginx\_status
-* [#2964](https://github.com/Icinga/icinga2/issues/2964) (ITL): Move 'running\_kernel' check command to plugins-contrib 'operating system' section
-* [#2784](https://github.com/Icinga/icinga2/issues/2784) (ITL): Move the base command templates into libmethods
+* [#3584](https://github.com/icinga/icinga2/issues/3584) (ITL): Add ipv4/ipv6 only to tcp and http CheckCommand
+* [#3582](https://github.com/icinga/icinga2/issues/3582) (ITL): Add check command mysql
+* [#3578](https://github.com/icinga/icinga2/issues/3578) (ITL): Add check command negate
+* [#3532](https://github.com/icinga/icinga2/issues/3532) (ITL): 'dig\_lookup' custom attribute for the 'dig' check command isn't optional
+* [#3525](https://github.com/icinga/icinga2/issues/3525) (ITL): Ability to set port on SNMP Checks
+* [#3490](https://github.com/icinga/icinga2/issues/3490) (ITL): Add check command nginx\_status
+* [#2964](https://github.com/icinga/icinga2/issues/2964) (ITL): Move 'running\_kernel' check command to plugins-contrib 'operating system' section
+* [#2784](https://github.com/icinga/icinga2/issues/2784) (ITL): Move the base command templates into libmethods
 
 ### Documentation
 
-* [#3663](https://github.com/Icinga/icinga2/issues/3663) (Documentation): Update wxWidgets documentation for Icinga Studio
-* [#3640](https://github.com/Icinga/icinga2/issues/3640) (Documentation): Explain DELETE for config stages/packages
-* [#3638](https://github.com/Icinga/icinga2/issues/3638) (Documentation): Documentation for /v1/types
-* [#3631](https://github.com/Icinga/icinga2/issues/3631) (Documentation): Documentation for the script debugger
-* [#3630](https://github.com/Icinga/icinga2/issues/3630) (Documentation): Explain variable names for joined objects in filter expressions
-* [#3629](https://github.com/Icinga/icinga2/issues/3629) (Documentation): Documentation for /v1/console
-* [#3628](https://github.com/Icinga/icinga2/issues/3628) (Documentation): Mention wxWidget \(optional\) requirement in INSTALL.md
-* [#3626](https://github.com/Icinga/icinga2/issues/3626) (Documentation): Icinga 2 API Docs
-* [#3621](https://github.com/Icinga/icinga2/issues/3621) (Documentation): Documentation should not reference real host names
-* [#3563](https://github.com/Icinga/icinga2/issues/3563) (Documentation): Documentation: Reorganize Livestatus and alternative frontends
-* [#3547](https://github.com/Icinga/icinga2/issues/3547) (Documentation): Incorrect attribute name in the documentation
-* [#3516](https://github.com/Icinga/icinga2/issues/3516) (Documentation): Add documentation for apply+for in the language reference chapter
-* [#3511](https://github.com/Icinga/icinga2/issues/3511) (Documentation): Escaping $ not documented
-* [#3500](https://github.com/Icinga/icinga2/issues/3500) (Documentation): Add 'support' tracker to changelog.py
-* [#3477](https://github.com/Icinga/icinga2/issues/3477) (Documentation): Remove duplicated text in section "Apply Notifications to Hosts and Services"
-* [#3426](https://github.com/Icinga/icinga2/issues/3426) (Documentation): Add documentation for api-users.conf and app.conf
-* [#3281](https://github.com/Icinga/icinga2/issues/3281) (Documentation): Document Object\#clone
+* [#3663](https://github.com/icinga/icinga2/issues/3663) (Documentation): Update wxWidgets documentation for Icinga Studio
+* [#3640](https://github.com/icinga/icinga2/issues/3640) (Documentation): Explain DELETE for config stages/packages
+* [#3638](https://github.com/icinga/icinga2/issues/3638) (Documentation): Documentation for /v1/types
+* [#3631](https://github.com/icinga/icinga2/issues/3631) (Documentation): Documentation for the script debugger
+* [#3630](https://github.com/icinga/icinga2/issues/3630) (Documentation): Explain variable names for joined objects in filter expressions
+* [#3629](https://github.com/icinga/icinga2/issues/3629) (Documentation): Documentation for /v1/console
+* [#3628](https://github.com/icinga/icinga2/issues/3628) (Documentation): Mention wxWidget \(optional\) requirement in INSTALL.md
+* [#3626](https://github.com/icinga/icinga2/issues/3626) (Documentation): Icinga 2 API Docs
+* [#3621](https://github.com/icinga/icinga2/issues/3621) (Documentation): Documentation should not reference real host names
+* [#3563](https://github.com/icinga/icinga2/issues/3563) (Documentation): Documentation: Reorganize Livestatus and alternative frontends
+* [#3547](https://github.com/icinga/icinga2/issues/3547) (Documentation): Incorrect attribute name in the documentation
+* [#3516](https://github.com/icinga/icinga2/issues/3516) (Documentation): Add documentation for apply+for in the language reference chapter
+* [#3511](https://github.com/icinga/icinga2/issues/3511) (Documentation): Escaping $ not documented
+* [#3500](https://github.com/icinga/icinga2/issues/3500) (Documentation): Add 'support' tracker to changelog.py
+* [#3477](https://github.com/icinga/icinga2/issues/3477) (Documentation): Remove duplicated text in section "Apply Notifications to Hosts and Services"
+* [#3426](https://github.com/icinga/icinga2/issues/3426) (Documentation): Add documentation for api-users.conf and app.conf
+* [#3281](https://github.com/icinga/icinga2/issues/3281) (Documentation): Document Object\#clone
 
 ### Support
 
-* [#3662](https://github.com/Icinga/icinga2/issues/3662) (Packages): Download URL for NSClient++ is incorrect
-* [#3615](https://github.com/Icinga/icinga2/issues/3615) (Packages): Update OpenSSL for the Windows builds
-* [#3614](https://github.com/Icinga/icinga2/issues/3614) (Installation): Don't try to use --gc-sections on Solaris
-* [#3522](https://github.com/Icinga/icinga2/issues/3522) (Packages): 'which' isn't available in a minimal CentOS container
-* [#3063](https://github.com/Icinga/icinga2/issues/3063) (Installation): "-Wno-deprecated-register" compiler option breaks builds on SLES 11
-* [#2893](https://github.com/Icinga/icinga2/issues/2893) (Installation): icinga demo module can not be built
-* [#2858](https://github.com/Icinga/icinga2/issues/2858) (Packages): Specify pidfile for status\_of\_proc in the init script
-* [#2802](https://github.com/Icinga/icinga2/issues/2802) (Packages): Update OpenSSL for the Windows builds
+* [#3662](https://github.com/icinga/icinga2/issues/3662) (Packages): Download URL for NSClient++ is incorrect
+* [#3615](https://github.com/icinga/icinga2/issues/3615) (Packages): Update OpenSSL for the Windows builds
+* [#3614](https://github.com/icinga/icinga2/issues/3614) (Installation): Don't try to use --gc-sections on Solaris
+* [#3522](https://github.com/icinga/icinga2/issues/3522) (Packages): 'which' isn't available in a minimal CentOS container
+* [#3063](https://github.com/icinga/icinga2/issues/3063) (Installation): "-Wno-deprecated-register" compiler option breaks builds on SLES 11
+* [#2893](https://github.com/icinga/icinga2/issues/2893) (Installation): icinga demo module can not be built
+* [#2858](https://github.com/icinga/icinga2/issues/2858) (Packages): Specify pidfile for status\_of\_proc in the init script
+* [#2802](https://github.com/icinga/icinga2/issues/2802) (Packages): Update OpenSSL for the Windows builds
 
 ## 2.3.11 (2015-10-20)
 
@@ -1786,65 +1838,65 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3494](https://github.com/Icinga/icinga2/issues/3494) (DB IDO): Add a debug log message for updating the program status table in DB IDO
-* [#3481](https://github.com/Icinga/icinga2/issues/3481): New method: cidr\_match\(\)
-* [#3421](https://github.com/Icinga/icinga2/issues/3421): Implement the Array\#reverse and String\#reverse methods
-* [#3327](https://github.com/Icinga/icinga2/issues/3327): Implement a way for users to resolve commands+arguments in the same way Icinga does
-* [#3326](https://github.com/Icinga/icinga2/issues/3326): escape\_shell\_arg\(\) method
-* [#2969](https://github.com/Icinga/icinga2/issues/2969) (Performance Data): Add timestamp support for OpenTsdbWriter
+* [#3494](https://github.com/icinga/icinga2/issues/3494) (DB IDO): Add a debug log message for updating the program status table in DB IDO
+* [#3481](https://github.com/icinga/icinga2/issues/3481): New method: cidr\_match\(\)
+* [#3421](https://github.com/icinga/icinga2/issues/3421): Implement the Array\#reverse and String\#reverse methods
+* [#3327](https://github.com/icinga/icinga2/issues/3327): Implement a way for users to resolve commands+arguments in the same way Icinga does
+* [#3326](https://github.com/icinga/icinga2/issues/3326): escape\_shell\_arg\(\) method
+* [#2969](https://github.com/icinga/icinga2/issues/2969) (Metrics): Add timestamp support for OpenTsdbWriter
 
 ### Bug
 
-* [#3492](https://github.com/Icinga/icinga2/issues/3492) (Cluster): Wrong connection log message for global zones
-* [#3491](https://github.com/Icinga/icinga2/issues/3491): cidr\_match\(\) doesn't properly validate IP addresses
-* [#3487](https://github.com/Icinga/icinga2/issues/3487) (Cluster): ApiListener::SyncRelayMessage doesn't send message to all zone members
-* [#3476](https://github.com/Icinga/icinga2/issues/3476) (Compat): Missing Start call for base class in CheckResultReader
-* [#3475](https://github.com/Icinga/icinga2/issues/3475) (Compat): Checkresultreader is unable to process host checks
-* [#3466](https://github.com/Icinga/icinga2/issues/3466): "Not after" value overflows in X509 certificates on RHEL5
-* [#3464](https://github.com/Icinga/icinga2/issues/3464) (Cluster): Don't log messages we've already relayed to all relevant zones
-* [#3460](https://github.com/Icinga/icinga2/issues/3460) (Performance Data): Performance Data Labels including '=' will not be displayed correct
-* [#3454](https://github.com/Icinga/icinga2/issues/3454): Percent character whitespace on Windows
-* [#3449](https://github.com/Icinga/icinga2/issues/3449) (Cluster): Don't throw an exception when replaying the current replay log file
-* [#3446](https://github.com/Icinga/icinga2/issues/3446): Deadlock in TlsStream::Close
-* [#3428](https://github.com/Icinga/icinga2/issues/3428) (Configuration): config checker reports wrong error on apply for rules
-* [#3427](https://github.com/Icinga/icinga2/issues/3427) (Configuration): Config parser problem with parenthesis and newlines 
-* [#3423](https://github.com/Icinga/icinga2/issues/3423) (Configuration): Remove unnecessary MakeLiteral calls in SetExpression::DoEvaluate
-* [#3417](https://github.com/Icinga/icinga2/issues/3417) (Configuration): null + null should not be ""
-* [#3416](https://github.com/Icinga/icinga2/issues/3416) (API): Problem with customvariable table update/insert queries
-* [#3373](https://github.com/Icinga/icinga2/issues/3373) (Livestatus): Improve error message for socket errors in Livestatus
-* [#3324](https://github.com/Icinga/icinga2/issues/3324) (Cluster): Deadlock in WorkQueue::Enqueue
-* [#3204](https://github.com/Icinga/icinga2/issues/3204) (Configuration): String methods cannot be invoked on an empty string
-* [#3038](https://github.com/Icinga/icinga2/issues/3038) (Livestatus): sending multiple Livestatus commands rejects all except the first
-* [#2568](https://github.com/Icinga/icinga2/issues/2568) (Cluster): check cluster-zone returns wrong log lag
+* [#3492](https://github.com/icinga/icinga2/issues/3492) (Cluster): Wrong connection log message for global zones
+* [#3491](https://github.com/icinga/icinga2/issues/3491): cidr\_match\(\) doesn't properly validate IP addresses
+* [#3487](https://github.com/icinga/icinga2/issues/3487) (Cluster): ApiListener::SyncRelayMessage doesn't send message to all zone members
+* [#3476](https://github.com/icinga/icinga2/issues/3476) (Compat): Missing Start call for base class in CheckResultReader
+* [#3475](https://github.com/icinga/icinga2/issues/3475) (Compat): Checkresultreader is unable to process host checks
+* [#3466](https://github.com/icinga/icinga2/issues/3466): "Not after" value overflows in X509 certificates on RHEL5
+* [#3464](https://github.com/icinga/icinga2/issues/3464) (Cluster): Don't log messages we've already relayed to all relevant zones
+* [#3460](https://github.com/icinga/icinga2/issues/3460) (Metrics): Performance Data Labels including '=' will not be displayed correct
+* [#3454](https://github.com/icinga/icinga2/issues/3454): Percent character whitespace on Windows
+* [#3449](https://github.com/icinga/icinga2/issues/3449) (Cluster): Don't throw an exception when replaying the current replay log file
+* [#3446](https://github.com/icinga/icinga2/issues/3446): Deadlock in TlsStream::Close
+* [#3428](https://github.com/icinga/icinga2/issues/3428) (Configuration): config checker reports wrong error on apply for rules
+* [#3427](https://github.com/icinga/icinga2/issues/3427) (Configuration): Config parser problem with parenthesis and newlines 
+* [#3423](https://github.com/icinga/icinga2/issues/3423) (Configuration): Remove unnecessary MakeLiteral calls in SetExpression::DoEvaluate
+* [#3417](https://github.com/icinga/icinga2/issues/3417) (Configuration): null + null should not be ""
+* [#3416](https://github.com/icinga/icinga2/issues/3416) (API): Problem with customvariable table update/insert queries
+* [#3373](https://github.com/icinga/icinga2/issues/3373) (Livestatus): Improve error message for socket errors in Livestatus
+* [#3324](https://github.com/icinga/icinga2/issues/3324) (Cluster): Deadlock in WorkQueue::Enqueue
+* [#3204](https://github.com/icinga/icinga2/issues/3204) (Configuration): String methods cannot be invoked on an empty string
+* [#3038](https://github.com/icinga/icinga2/issues/3038) (Livestatus): sending multiple Livestatus commands rejects all except the first
+* [#2568](https://github.com/icinga/icinga2/issues/2568) (Cluster): check cluster-zone returns wrong log lag
 
 ### ITL
 
-* [#3437](https://github.com/Icinga/icinga2/issues/3437) (ITL): Add timeout argument for pop, spop, imap, simap commands
-* [#3407](https://github.com/Icinga/icinga2/issues/3407) (ITL): Make check\_disk.exe CheckCommand Config more verbose
-* [#3399](https://github.com/Icinga/icinga2/issues/3399) (ITL): expand check command dig
-* [#3394](https://github.com/Icinga/icinga2/issues/3394) (ITL): Add ipv4/ipv6 only to nrpe CheckCommand
-* [#3385](https://github.com/Icinga/icinga2/issues/3385) (ITL): Add check command pgsql
-* [#3382](https://github.com/Icinga/icinga2/issues/3382) (ITL): Add check command squid
-* [#3235](https://github.com/Icinga/icinga2/issues/3235) (ITL): check\_command for plugin check\_hpasm
-* [#3214](https://github.com/Icinga/icinga2/issues/3214) (ITL): add check command for check\_nwc\_health
+* [#3437](https://github.com/icinga/icinga2/issues/3437) (ITL): Add timeout argument for pop, spop, imap, simap commands
+* [#3407](https://github.com/icinga/icinga2/issues/3407) (ITL): Make check\_disk.exe CheckCommand Config more verbose
+* [#3399](https://github.com/icinga/icinga2/issues/3399) (ITL): expand check command dig
+* [#3394](https://github.com/icinga/icinga2/issues/3394) (ITL): Add ipv4/ipv6 only to nrpe CheckCommand
+* [#3385](https://github.com/icinga/icinga2/issues/3385) (ITL): Add check command pgsql
+* [#3382](https://github.com/icinga/icinga2/issues/3382) (ITL): Add check command squid
+* [#3235](https://github.com/icinga/icinga2/issues/3235) (ITL): check\_command for plugin check\_hpasm
+* [#3214](https://github.com/icinga/icinga2/issues/3214) (ITL): add check command for check\_nwc\_health
 
 ### Documentation
 
-* [#3479](https://github.com/Icinga/icinga2/issues/3479) (Documentation): Improve timeperiod documentation
-* [#3478](https://github.com/Icinga/icinga2/issues/3478) (Documentation): Broken table layout in chapter 20
-* [#3436](https://github.com/Icinga/icinga2/issues/3436) (Documentation): Clarify on cluster/client naming convention and add troubleshooting section
-* [#3430](https://github.com/Icinga/icinga2/issues/3430) (Documentation): Find a better description for cluster communication requirements
-* [#3409](https://github.com/Icinga/icinga2/issues/3409) (Documentation): Windows Check Update -\> Access denied
-* [#3408](https://github.com/Icinga/icinga2/issues/3408) (Documentation): Improve documentation for check\_memory
-* [#3406](https://github.com/Icinga/icinga2/issues/3406) (Documentation): Update graphing section in the docs
-* [#3402](https://github.com/Icinga/icinga2/issues/3402) (Documentation): Update debug docs for core dumps and full backtraces
-* [#3351](https://github.com/Icinga/icinga2/issues/3351) (Documentation): Command Execution Bridge: Use of same endpoint names in examples for a better understanding
-* [#3092](https://github.com/Icinga/icinga2/issues/3092) (Documentation): Add FreeBSD setup to getting started
+* [#3479](https://github.com/icinga/icinga2/issues/3479) (Documentation): Improve timeperiod documentation
+* [#3478](https://github.com/icinga/icinga2/issues/3478) (Documentation): Broken table layout in chapter 20
+* [#3436](https://github.com/icinga/icinga2/issues/3436) (Documentation): Clarify on cluster/client naming convention and add troubleshooting section
+* [#3430](https://github.com/icinga/icinga2/issues/3430) (Documentation): Find a better description for cluster communication requirements
+* [#3409](https://github.com/icinga/icinga2/issues/3409) (Documentation): Windows Check Update -\> Access denied
+* [#3408](https://github.com/icinga/icinga2/issues/3408) (Documentation): Improve documentation for check\_memory
+* [#3406](https://github.com/icinga/icinga2/issues/3406) (Documentation): Update graphing section in the docs
+* [#3402](https://github.com/icinga/icinga2/issues/3402) (Documentation): Update debug docs for core dumps and full backtraces
+* [#3351](https://github.com/icinga/icinga2/issues/3351) (Documentation): Command Execution Bridge: Use of same endpoint names in examples for a better understanding
+* [#3092](https://github.com/icinga/icinga2/issues/3092) (Documentation): Add FreeBSD setup to getting started
 
 ### Support
 
-* [#3379](https://github.com/Icinga/icinga2/issues/3379) (Installation): Rather use unique SID when granting rights for folders in NSIS on Windows Client
-* [#3045](https://github.com/Icinga/icinga2/issues/3045) (Packages): icinga2 ido mysql misspelled database username
+* [#3379](https://github.com/icinga/icinga2/issues/3379) (Installation): Rather use unique SID when granting rights for folders in NSIS on Windows Client
+* [#3045](https://github.com/icinga/icinga2/issues/3045) (Packages): icinga2 ido mysql misspelled database username
 
 ## 2.3.10 (2015-09-05)
 
@@ -1854,15 +1906,15 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#2985](https://github.com/Icinga/icinga2/issues/2985): Use the command\_endpoint name as check\_source value if defined
+* [#2985](https://github.com/icinga/icinga2/issues/2985): Use the command\_endpoint name as check\_source value if defined
 
 ### Bug
 
-* [#3369](https://github.com/Icinga/icinga2/issues/3369): Missing zero padding for generated CA serial.txt
-* [#3352](https://github.com/Icinga/icinga2/issues/3352): Wrong calculation for host compat state "UNREACHABLE" in DB IDO
-* [#3348](https://github.com/Icinga/icinga2/issues/3348) (Cluster): Missing fix for reload on Windows in 2.3.9
-* [#3325](https://github.com/Icinga/icinga2/issues/3325): Nested "outer" macro calls fails on \(handled\) missing "inner" values
-* [#2811](https://github.com/Icinga/icinga2/issues/2811) (DB IDO): String escape problem with PostgreSQL \>= 9.1 and standard\_conforming\_strings=on
+* [#3369](https://github.com/icinga/icinga2/issues/3369): Missing zero padding for generated CA serial.txt
+* [#3352](https://github.com/icinga/icinga2/issues/3352): Wrong calculation for host compat state "UNREACHABLE" in DB IDO
+* [#3348](https://github.com/icinga/icinga2/issues/3348) (Cluster): Missing fix for reload on Windows in 2.3.9
+* [#3325](https://github.com/icinga/icinga2/issues/3325): Nested "outer" macro calls fails on \(handled\) missing "inner" values
+* [#2811](https://github.com/icinga/icinga2/issues/2811) (DB IDO): String escape problem with PostgreSQL \>= 9.1 and standard\_conforming\_strings=on
 
 ## 2.3.9 (2015-08-26)
 
@@ -1876,58 +1928,58 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3254](https://github.com/Icinga/icinga2/issues/3254) (Livestatus): Use an empty dictionary for the 'this' scope when executing commands with Livestatus
-* [#3253](https://github.com/Icinga/icinga2/issues/3253): Implement the Dictionary\#keys method
-* [#3206](https://github.com/Icinga/icinga2/issues/3206): Implement Dictionary\#get and Array\#get
-* [#3170](https://github.com/Icinga/icinga2/issues/3170) (Configuration): Adding "-r" parameter to the check\_load command for dividing the load averages by the number of CPUs.
+* [#3254](https://github.com/icinga/icinga2/issues/3254) (Livestatus): Use an empty dictionary for the 'this' scope when executing commands with Livestatus
+* [#3253](https://github.com/icinga/icinga2/issues/3253): Implement the Dictionary\#keys method
+* [#3206](https://github.com/icinga/icinga2/issues/3206): Implement Dictionary\#get and Array\#get
+* [#3170](https://github.com/icinga/icinga2/issues/3170) (Configuration): Adding "-r" parameter to the check\_load command for dividing the load averages by the number of CPUs.
 
 ### Bug
 
-* [#3305](https://github.com/Icinga/icinga2/issues/3305) (Configuration): Icinga2 - too many open files - Exception
-* [#3299](https://github.com/Icinga/icinga2/issues/3299): Utility::Glob on Windows doesn't support wildcards in all but the last path component
-* [#3292](https://github.com/Icinga/icinga2/issues/3292): Serial number field is not properly initialized for CA certificates
-* [#3279](https://github.com/Icinga/icinga2/issues/3279) (DB IDO): Add missing category for IDO query
-* [#3266](https://github.com/Icinga/icinga2/issues/3266) (Plugins): Default disk checks on Windows fail because check\_disk doesn't support -K
-* [#3260](https://github.com/Icinga/icinga2/issues/3260): First SOFT state is recognized as second SOFT state
-* [#3255](https://github.com/Icinga/icinga2/issues/3255) (Cluster): Warning about invalid API function icinga::Hello
-* [#3241](https://github.com/Icinga/icinga2/issues/3241): Agent freezes when the check returns massive output
-* [#3222](https://github.com/Icinga/icinga2/issues/3222) (Configuration): Dict initializer incorrectly re-initializes field that is set to an empty string
-* [#3211](https://github.com/Icinga/icinga2/issues/3211) (Configuration): Operator + is inconsistent when used with empty and non-empty strings
-* [#3200](https://github.com/Icinga/icinga2/issues/3200) (CLI): icinga2 node wizard don't take zone\_name input
-* [#3199](https://github.com/Icinga/icinga2/issues/3199): Trying to set a field for a non-object instance fails
-* [#3196](https://github.com/Icinga/icinga2/issues/3196) (Cluster): Add log for missing EventCommand for command\_endpoints
-* [#3194](https://github.com/Icinga/icinga2/issues/3194): Set correct X509 version for certificates
-* [#3149](https://github.com/Icinga/icinga2/issues/3149) (CLI): missing config warning on empty port in endpoints
-* [#3010](https://github.com/Icinga/icinga2/issues/3010) (Cluster): cluster check w/ immediate parent and child zone endpoints
-* [#2867](https://github.com/Icinga/icinga2/issues/2867): Missing DEL\_DOWNTIME\_BY\_HOST\_NAME command required by Classic UI 1.x
-* [#2352](https://github.com/Icinga/icinga2/issues/2352) (Cluster): Reload does not work on Windows
+* [#3305](https://github.com/icinga/icinga2/issues/3305) (Configuration): Icinga2 - too many open files - Exception
+* [#3299](https://github.com/icinga/icinga2/issues/3299): Utility::Glob on Windows doesn't support wildcards in all but the last path component
+* [#3292](https://github.com/icinga/icinga2/issues/3292): Serial number field is not properly initialized for CA certificates
+* [#3279](https://github.com/icinga/icinga2/issues/3279) (DB IDO): Add missing category for IDO query
+* [#3266](https://github.com/icinga/icinga2/issues/3266) (Plugins): Default disk checks on Windows fail because check\_disk doesn't support -K
+* [#3260](https://github.com/icinga/icinga2/issues/3260): First SOFT state is recognized as second SOFT state
+* [#3255](https://github.com/icinga/icinga2/issues/3255) (Cluster): Warning about invalid API function icinga::Hello
+* [#3241](https://github.com/icinga/icinga2/issues/3241): Agent freezes when the check returns massive output
+* [#3222](https://github.com/icinga/icinga2/issues/3222) (Configuration): Dict initializer incorrectly re-initializes field that is set to an empty string
+* [#3211](https://github.com/icinga/icinga2/issues/3211) (Configuration): Operator + is inconsistent when used with empty and non-empty strings
+* [#3200](https://github.com/icinga/icinga2/issues/3200) (CLI): icinga2 node wizard don't take zone\_name input
+* [#3199](https://github.com/icinga/icinga2/issues/3199): Trying to set a field for a non-object instance fails
+* [#3196](https://github.com/icinga/icinga2/issues/3196) (Cluster): Add log for missing EventCommand for command\_endpoints
+* [#3194](https://github.com/icinga/icinga2/issues/3194): Set correct X509 version for certificates
+* [#3149](https://github.com/icinga/icinga2/issues/3149) (CLI): missing config warning on empty port in endpoints
+* [#3010](https://github.com/icinga/icinga2/issues/3010) (Cluster): cluster check w/ immediate parent and child zone endpoints
+* [#2867](https://github.com/icinga/icinga2/issues/2867): Missing DEL\_DOWNTIME\_BY\_HOST\_NAME command required by Classic UI 1.x
+* [#2352](https://github.com/icinga/icinga2/issues/2352) (Cluster): Reload does not work on Windows
 
 ### ITL
 
-* [#3320](https://github.com/Icinga/icinga2/issues/3320) (ITL): Add new arguments openvmtools for Open VM Tools
-* [#3313](https://github.com/Icinga/icinga2/issues/3313) (ITL): add check command nscp-local-counter
-* [#3312](https://github.com/Icinga/icinga2/issues/3312) (ITL): fix check command nscp-local
-* [#3265](https://github.com/Icinga/icinga2/issues/3265) (ITL): check\_command interfaces option match\_aliases has to be boolean
-* [#3219](https://github.com/Icinga/icinga2/issues/3219) (ITL): snmpv3 CheckCommand section improved
-* [#3213](https://github.com/Icinga/icinga2/issues/3213) (ITL): add check command for check\_mailq
-* [#3208](https://github.com/Icinga/icinga2/issues/3208) (ITL): Add check\_jmx4perl to ITL
-* [#3186](https://github.com/Icinga/icinga2/issues/3186) (ITL): check\_command for plugin check\_clamd
-* [#3164](https://github.com/Icinga/icinga2/issues/3164) (ITL): Add check\_redis to ITL
-* [#3162](https://github.com/Icinga/icinga2/issues/3162) (ITL): Add check\_yum to ITL
-* [#3111](https://github.com/Icinga/icinga2/issues/3111) (ITL): CheckCommand for check\_interfaces
+* [#3320](https://github.com/icinga/icinga2/issues/3320) (ITL): Add new arguments openvmtools for Open VM Tools
+* [#3313](https://github.com/icinga/icinga2/issues/3313) (ITL): add check command nscp-local-counter
+* [#3312](https://github.com/icinga/icinga2/issues/3312) (ITL): fix check command nscp-local
+* [#3265](https://github.com/icinga/icinga2/issues/3265) (ITL): check\_command interfaces option match\_aliases has to be boolean
+* [#3219](https://github.com/icinga/icinga2/issues/3219) (ITL): snmpv3 CheckCommand section improved
+* [#3213](https://github.com/icinga/icinga2/issues/3213) (ITL): add check command for check\_mailq
+* [#3208](https://github.com/icinga/icinga2/issues/3208) (ITL): Add check\_jmx4perl to ITL
+* [#3186](https://github.com/icinga/icinga2/issues/3186) (ITL): check\_command for plugin check\_clamd
+* [#3164](https://github.com/icinga/icinga2/issues/3164) (ITL): Add check\_redis to ITL
+* [#3162](https://github.com/icinga/icinga2/issues/3162) (ITL): Add check\_yum to ITL
+* [#3111](https://github.com/icinga/icinga2/issues/3111) (ITL): CheckCommand for check\_interfaces
 
 ### Documentation
 
-* [#3319](https://github.com/Icinga/icinga2/issues/3319) (Documentation): Duplicate severity type in the documentation for SyslogLogger
-* [#3308](https://github.com/Icinga/icinga2/issues/3308) (Documentation): Fix global Zone example to  "Global Configuration Zone for Templates"
-* [#3262](https://github.com/Icinga/icinga2/issues/3262) (Documentation): typo in docs
-* [#3166](https://github.com/Icinga/icinga2/issues/3166) (Documentation): Update gdb pretty printer docs w/ Python 3
+* [#3319](https://github.com/icinga/icinga2/issues/3319) (Documentation): Duplicate severity type in the documentation for SyslogLogger
+* [#3308](https://github.com/icinga/icinga2/issues/3308) (Documentation): Fix global Zone example to  "Global Configuration Zone for Templates"
+* [#3262](https://github.com/icinga/icinga2/issues/3262) (Documentation): typo in docs
+* [#3166](https://github.com/icinga/icinga2/issues/3166) (Documentation): Update gdb pretty printer docs w/ Python 3
 
 ### Support
 
-* [#3298](https://github.com/Icinga/icinga2/issues/3298) (Packages): Don't re-download NSCP for every build
-* [#3239](https://github.com/Icinga/icinga2/issues/3239) (Packages): missing check\_perfmon.exe 
-* [#3216](https://github.com/Icinga/icinga2/issues/3216) (Tests): Build fix for Boost 1.59
+* [#3298](https://github.com/icinga/icinga2/issues/3298) (Packages): Don't re-download NSCP for every build
+* [#3239](https://github.com/icinga/icinga2/issues/3239) (Packages): missing check\_perfmon.exe 
+* [#3216](https://github.com/icinga/icinga2/issues/3216) (Tests): Build fix for Boost 1.59
 
 ## 2.3.8 (2015-07-21)
 
@@ -1937,14 +1989,14 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#3160](https://github.com/Icinga/icinga2/issues/3160) (Performance Data): Escaping does not work for OpenTSDB perfdata plugin
-* [#3151](https://github.com/Icinga/icinga2/issues/3151) (DB IDO): DB IDO: Do not update endpointstatus table on config updates
-* [#3120](https://github.com/Icinga/icinga2/issues/3120) (Configuration): Don't allow "ignore where" for groups when there's no "assign where"
+* [#3160](https://github.com/icinga/icinga2/issues/3160) (Metrics): Escaping does not work for OpenTSDB perfdata plugin
+* [#3151](https://github.com/icinga/icinga2/issues/3151) (DB IDO): DB IDO: Do not update endpointstatus table on config updates
+* [#3120](https://github.com/icinga/icinga2/issues/3120) (Configuration): Don't allow "ignore where" for groups when there's no "assign where"
 
 ### ITL
 
-* [#3161](https://github.com/Icinga/icinga2/issues/3161) (ITL): checkcommand disk does not check free inode - check\_disk
-* [#3152](https://github.com/Icinga/icinga2/issues/3152) (ITL): Wrong parameter for CheckCommand "ping-common-windows"
+* [#3161](https://github.com/icinga/icinga2/issues/3161) (ITL): checkcommand disk does not check free inode - check\_disk
+* [#3152](https://github.com/icinga/icinga2/issues/3152) (ITL): Wrong parameter for CheckCommand "ping-common-windows"
 
 ## 2.3.7 (2015-07-15)
 
@@ -1954,17 +2006,17 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#3148](https://github.com/Icinga/icinga2/issues/3148): Missing lock in ScriptUtils::Union
-* [#3147](https://github.com/Icinga/icinga2/issues/3147): Assertion failed in icinga::ScriptUtils::Intersection
-* [#3136](https://github.com/Icinga/icinga2/issues/3136) (DB IDO): DB IDO: endpoint\* tables are cleared on reload causing constraint violations
-* [#3134](https://github.com/Icinga/icinga2/issues/3134): Incorrect return value for the macro\(\) function
-* [#3114](https://github.com/Icinga/icinga2/issues/3114) (Configuration): Config parser ignores "ignore" in template definition
-* [#3061](https://github.com/Icinga/icinga2/issues/3061) (Cluster): Selective cluster reconnecting breaks client communication
+* [#3148](https://github.com/icinga/icinga2/issues/3148): Missing lock in ScriptUtils::Union
+* [#3147](https://github.com/icinga/icinga2/issues/3147): Assertion failed in icinga::ScriptUtils::Intersection
+* [#3136](https://github.com/icinga/icinga2/issues/3136) (DB IDO): DB IDO: endpoint\* tables are cleared on reload causing constraint violations
+* [#3134](https://github.com/icinga/icinga2/issues/3134): Incorrect return value for the macro\(\) function
+* [#3114](https://github.com/icinga/icinga2/issues/3114) (Configuration): Config parser ignores "ignore" in template definition
+* [#3061](https://github.com/icinga/icinga2/issues/3061) (Cluster): Selective cluster reconnecting breaks client communication
 
 ### Documentation
 
-* [#3142](https://github.com/Icinga/icinga2/issues/3142) (Documentation): Enhance troubleshooting ssl errors & cluster replay log
-* [#3135](https://github.com/Icinga/icinga2/issues/3135) (Documentation): Wrong formatting in DB IDO extensions docs
+* [#3142](https://github.com/icinga/icinga2/issues/3142) (Documentation): Enhance troubleshooting ssl errors & cluster replay log
+* [#3135](https://github.com/icinga/icinga2/issues/3135) (Documentation): Wrong formatting in DB IDO extensions docs
 
 ## 2.3.6 (2015-07-08)
 
@@ -1978,45 +2030,45 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#3118](https://github.com/Icinga/icinga2/issues/3118) (Cluster): Generated certificates cannot be verified w/ openssl 0.9.8j on SLES 11
-* [#3098](https://github.com/Icinga/icinga2/issues/3098) (Cluster): Add log message for discarded cluster events \(e.g. from unauthenticated clients\)
-* [#3097](https://github.com/Icinga/icinga2/issues/3097): Fix stability issues in the TlsStream/Stream classes
-* [#3088](https://github.com/Icinga/icinga2/issues/3088) (Cluster): Windows client w/ command\_endpoint broken with $nscp\_path$ and NscpPath detection
-* [#3084](https://github.com/Icinga/icinga2/issues/3084) (CLI): node setup: indent accept\_config and accept\_commands
-* [#3074](https://github.com/Icinga/icinga2/issues/3074) (Notifications): Functions can't be specified as command arguments
-* [#2979](https://github.com/Icinga/icinga2/issues/2979) (CLI): port empty when using icinga2 node wizard
+* [#3118](https://github.com/icinga/icinga2/issues/3118) (Cluster): Generated certificates cannot be verified w/ openssl 0.9.8j on SLES 11
+* [#3098](https://github.com/icinga/icinga2/issues/3098) (Cluster): Add log message for discarded cluster events \(e.g. from unauthenticated clients\)
+* [#3097](https://github.com/icinga/icinga2/issues/3097): Fix stability issues in the TlsStream/Stream classes
+* [#3088](https://github.com/icinga/icinga2/issues/3088) (Cluster): Windows client w/ command\_endpoint broken with $nscp\_path$ and NscpPath detection
+* [#3084](https://github.com/icinga/icinga2/issues/3084) (CLI): node setup: indent accept\_config and accept\_commands
+* [#3074](https://github.com/icinga/icinga2/issues/3074) (Notifications): Functions can't be specified as command arguments
+* [#2979](https://github.com/icinga/icinga2/issues/2979) (CLI): port empty when using icinga2 node wizard
 
 ### ITL
 
-* [#3132](https://github.com/Icinga/icinga2/issues/3132) (ITL): new options for smtp CheckCommand
-* [#3125](https://github.com/Icinga/icinga2/issues/3125) (ITL): Add new options for ntp\_time CheckCommand
-* [#3110](https://github.com/Icinga/icinga2/issues/3110) (ITL): Add ntp\_peer CheckCommand
-* [#3103](https://github.com/Icinga/icinga2/issues/3103) (ITL): itl/plugins-contrib.d/\*.conf should point to PluginContribDir
-* [#3091](https://github.com/Icinga/icinga2/issues/3091) (ITL): Incorrect check\_ping.exe parameter in the ITL
-* [#3066](https://github.com/Icinga/icinga2/issues/3066) (ITL): snmpv3 CheckCommand: Add possibility to set securityLevel
-* [#3064](https://github.com/Icinga/icinga2/issues/3064) (ITL): Add elasticsearch checkcommand to itl
-* [#3031](https://github.com/Icinga/icinga2/issues/3031) (ITL): Missing 'snmp\_is\_cisco' in Manubulon snmp-memory command definition
-* [#3002](https://github.com/Icinga/icinga2/issues/3002) (ITL): Incorrect variable name in the ITL
-* [#2975](https://github.com/Icinga/icinga2/issues/2975) (ITL): Add "mongodb" CheckCommand definition
-* [#2963](https://github.com/Icinga/icinga2/issues/2963) (ITL): Add "ldap" CheckCommand for "check\_ldap" plugin
+* [#3132](https://github.com/icinga/icinga2/issues/3132) (ITL): new options for smtp CheckCommand
+* [#3125](https://github.com/icinga/icinga2/issues/3125) (ITL): Add new options for ntp\_time CheckCommand
+* [#3110](https://github.com/icinga/icinga2/issues/3110) (ITL): Add ntp\_peer CheckCommand
+* [#3103](https://github.com/icinga/icinga2/issues/3103) (ITL): itl/plugins-contrib.d/\*.conf should point to PluginContribDir
+* [#3091](https://github.com/icinga/icinga2/issues/3091) (ITL): Incorrect check\_ping.exe parameter in the ITL
+* [#3066](https://github.com/icinga/icinga2/issues/3066) (ITL): snmpv3 CheckCommand: Add possibility to set securityLevel
+* [#3064](https://github.com/icinga/icinga2/issues/3064) (ITL): Add elasticsearch checkcommand to itl
+* [#3031](https://github.com/icinga/icinga2/issues/3031) (ITL): Missing 'snmp\_is\_cisco' in Manubulon snmp-memory command definition
+* [#3002](https://github.com/icinga/icinga2/issues/3002) (ITL): Incorrect variable name in the ITL
+* [#2975](https://github.com/icinga/icinga2/issues/2975) (ITL): Add "mongodb" CheckCommand definition
+* [#2963](https://github.com/icinga/icinga2/issues/2963) (ITL): Add "ldap" CheckCommand for "check\_ldap" plugin
 
 ### Documentation
 
-* [#3126](https://github.com/Icinga/icinga2/issues/3126) (Documentation): Update getting started for Debian Jessie
-* [#3108](https://github.com/Icinga/icinga2/issues/3108) (Documentation): wrong default port documentated for nrpe
-* [#3099](https://github.com/Icinga/icinga2/issues/3099) (Documentation): Missing openssl verify in cluster troubleshooting docs
-* [#3096](https://github.com/Icinga/icinga2/issues/3096) (Documentation): Documentation for checks in an HA zone is wrong
-* [#3086](https://github.com/Icinga/icinga2/issues/3086) (Documentation): Wrong file reference in README.md
-* [#3085](https://github.com/Icinga/icinga2/issues/3085) (Documentation): Merge documentation fixes from GitHub
-* [#1793](https://github.com/Icinga/icinga2/issues/1793) (Documentation): add pagerduty notification documentation
+* [#3126](https://github.com/icinga/icinga2/issues/3126) (Documentation): Update getting started for Debian Jessie
+* [#3108](https://github.com/icinga/icinga2/issues/3108) (Documentation): wrong default port documentated for nrpe
+* [#3099](https://github.com/icinga/icinga2/issues/3099) (Documentation): Missing openssl verify in cluster troubleshooting docs
+* [#3096](https://github.com/icinga/icinga2/issues/3096) (Documentation): Documentation for checks in an HA zone is wrong
+* [#3086](https://github.com/icinga/icinga2/issues/3086) (Documentation): Wrong file reference in README.md
+* [#3085](https://github.com/icinga/icinga2/issues/3085) (Documentation): Merge documentation fixes from GitHub
+* [#1793](https://github.com/icinga/icinga2/issues/1793) (Documentation): add pagerduty notification documentation
 
 ### Support
 
-* [#3123](https://github.com/Icinga/icinga2/issues/3123) (Packages): Require gcc47-c++ on sles11 from SLES software development kit repository
-* [#3122](https://github.com/Icinga/icinga2/issues/3122) (Packages): mysql-devel is not available in sles11sp3
-* [#3081](https://github.com/Icinga/icinga2/issues/3081) (Installation): changelog.py: Allow to define project, make custom\_fields and changes optional
-* [#3073](https://github.com/Icinga/icinga2/issues/3073) (Installation): Enhance changelog.py with wordpress blogpost output
-* [#2651](https://github.com/Icinga/icinga2/issues/2651) (Packages): Add Icinga 2 to Chocolatey Windows Repository
+* [#3123](https://github.com/icinga/icinga2/issues/3123) (Packages): Require gcc47-c++ on sles11 from SLES software development kit repository
+* [#3122](https://github.com/icinga/icinga2/issues/3122) (Packages): mysql-devel is not available in sles11sp3
+* [#3081](https://github.com/icinga/icinga2/issues/3081) (Installation): changelog.py: Allow to define project, make custom\_fields and changes optional
+* [#3073](https://github.com/icinga/icinga2/issues/3073) (Installation): Enhance changelog.py with wordpress blogpost output
+* [#2651](https://github.com/icinga/icinga2/issues/2651) (Packages): Add Icinga 2 to Chocolatey Windows Repository
 
 ## 2.3.5 (2015-06-17)
 
@@ -2032,75 +2084,75 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#3009](https://github.com/Icinga/icinga2/issues/3009) (Configuration): Add the --load-all and --log options for nscp-local
-* [#3008](https://github.com/Icinga/icinga2/issues/3008) (Configuration): Include \<nscp\> by default on Windows
-* [#2971](https://github.com/Icinga/icinga2/issues/2971) (Performance Data): Add timestamp support for PerfdataWriter
-* [#2817](https://github.com/Icinga/icinga2/issues/2817) (Configuration): Add CheckCommand objects for Windows plugins
-* [#2794](https://github.com/Icinga/icinga2/issues/2794) (Plugins): Add check\_perfmon plugin for Windows
+* [#3009](https://github.com/icinga/icinga2/issues/3009) (Configuration): Add the --load-all and --log options for nscp-local
+* [#3008](https://github.com/icinga/icinga2/issues/3008) (Configuration): Include \<nscp\> by default on Windows
+* [#2971](https://github.com/icinga/icinga2/issues/2971) (Metrics): Add timestamp support for PerfdataWriter
+* [#2817](https://github.com/icinga/icinga2/issues/2817) (Configuration): Add CheckCommand objects for Windows plugins
+* [#2794](https://github.com/icinga/icinga2/issues/2794) (Plugins): Add check\_perfmon plugin for Windows
 
 ### Bug
 
-* [#3051](https://github.com/Icinga/icinga2/issues/3051) (Plugins): plugins-contrib.d/databases.conf: wrong argument for mssql\_health
-* [#3043](https://github.com/Icinga/icinga2/issues/3043) (Compat): Multiline vars are broken in objects.cache output
-* [#3039](https://github.com/Icinga/icinga2/issues/3039) (Compat): Multi line output not correctly handled from compat channels
-* [#3007](https://github.com/Icinga/icinga2/issues/3007) (Configuration): Disk and 'icinga' services are missing in the default Windows config
-* [#3006](https://github.com/Icinga/icinga2/issues/3006) (Configuration): Some checks in the default Windows configuration fail
-* [#2986](https://github.com/Icinga/icinga2/issues/2986) (DB IDO): Missing custom attributes in backends if name is equal to object attribute
-* [#2952](https://github.com/Icinga/icinga2/issues/2952) (DB IDO): Incorrect type and state filter mapping for User objects in DB IDO
-* [#2951](https://github.com/Icinga/icinga2/issues/2951) (DB IDO): Downtimes are always "fixed"
-* [#2945](https://github.com/Icinga/icinga2/issues/2945) (DB IDO): Possible DB deadlock
-* [#2940](https://github.com/Icinga/icinga2/issues/2940) (Configuration): node update-config reports critical and warning
-* [#2935](https://github.com/Icinga/icinga2/issues/2935) (Configuration): WIN: syslog is not an enable-able feature in windows
-* [#2894](https://github.com/Icinga/icinga2/issues/2894) (DB IDO): Wrong timestamps w/ historical data replay in DB IDO
-* [#2839](https://github.com/Icinga/icinga2/issues/2839) (CLI): Node wont connect properly to master if host is is not set for Endpoint on new installs
-* [#2836](https://github.com/Icinga/icinga2/issues/2836): Icinga2 --version: Error showing Distribution
-* [#2819](https://github.com/Icinga/icinga2/issues/2819) (Configuration): Syntax Highlighting: host.address vs host.add 
+* [#3051](https://github.com/icinga/icinga2/issues/3051) (Plugins): plugins-contrib.d/databases.conf: wrong argument for mssql\_health
+* [#3043](https://github.com/icinga/icinga2/issues/3043) (Compat): Multiline vars are broken in objects.cache output
+* [#3039](https://github.com/icinga/icinga2/issues/3039) (Compat): Multi line output not correctly handled from compat channels
+* [#3007](https://github.com/icinga/icinga2/issues/3007) (Configuration): Disk and 'icinga' services are missing in the default Windows config
+* [#3006](https://github.com/icinga/icinga2/issues/3006) (Configuration): Some checks in the default Windows configuration fail
+* [#2986](https://github.com/icinga/icinga2/issues/2986) (DB IDO): Missing custom attributes in backends if name is equal to object attribute
+* [#2952](https://github.com/icinga/icinga2/issues/2952) (DB IDO): Incorrect type and state filter mapping for User objects in DB IDO
+* [#2951](https://github.com/icinga/icinga2/issues/2951) (DB IDO): Downtimes are always "fixed"
+* [#2945](https://github.com/icinga/icinga2/issues/2945) (DB IDO): Possible DB deadlock
+* [#2940](https://github.com/icinga/icinga2/issues/2940) (Configuration): node update-config reports critical and warning
+* [#2935](https://github.com/icinga/icinga2/issues/2935) (Configuration): WIN: syslog is not an enable-able feature in windows
+* [#2894](https://github.com/icinga/icinga2/issues/2894) (DB IDO): Wrong timestamps w/ historical data replay in DB IDO
+* [#2839](https://github.com/icinga/icinga2/issues/2839) (CLI): Node wont connect properly to master if host is is not set for Endpoint on new installs
+* [#2836](https://github.com/icinga/icinga2/issues/2836): Icinga2 --version: Error showing Distribution
+* [#2819](https://github.com/icinga/icinga2/issues/2819) (Configuration): Syntax Highlighting: host.address vs host.add 
 
 ### ITL
 
-* [#3019](https://github.com/Icinga/icinga2/issues/3019) (ITL): Add 'iftraffic' to plugins-contrib check command definitions
-* [#3003](https://github.com/Icinga/icinga2/issues/3003) (ITL): Add 'disk\_smb' Plugin CheckCommand definition
-* [#2959](https://github.com/Icinga/icinga2/issues/2959) (ITL): 'disk': wrong order of threshold command arguments
-* [#2956](https://github.com/Icinga/icinga2/issues/2956) (ITL): Add arguments to "tcp" CheckCommand
-* [#2955](https://github.com/Icinga/icinga2/issues/2955) (ITL): Add arguments to "ftp" CheckCommand
-* [#2954](https://github.com/Icinga/icinga2/issues/2954) (ITL): Add arguments to "dns" CheckCommand
-* [#2949](https://github.com/Icinga/icinga2/issues/2949) (ITL): Add 'check\_drivesize' as nscp-local check command
-* [#2938](https://github.com/Icinga/icinga2/issues/2938) (ITL): Add SHOWALL to NSCP Checkcommand
-* [#2880](https://github.com/Icinga/icinga2/issues/2880) (ITL): Including \<nscp\> on Linux fails with unregistered function
+* [#3019](https://github.com/icinga/icinga2/issues/3019) (ITL): Add 'iftraffic' to plugins-contrib check command definitions
+* [#3003](https://github.com/icinga/icinga2/issues/3003) (ITL): Add 'disk\_smb' Plugin CheckCommand definition
+* [#2959](https://github.com/icinga/icinga2/issues/2959) (ITL): 'disk': wrong order of threshold command arguments
+* [#2956](https://github.com/icinga/icinga2/issues/2956) (ITL): Add arguments to "tcp" CheckCommand
+* [#2955](https://github.com/icinga/icinga2/issues/2955) (ITL): Add arguments to "ftp" CheckCommand
+* [#2954](https://github.com/icinga/icinga2/issues/2954) (ITL): Add arguments to "dns" CheckCommand
+* [#2949](https://github.com/icinga/icinga2/issues/2949) (ITL): Add 'check\_drivesize' as nscp-local check command
+* [#2938](https://github.com/icinga/icinga2/issues/2938) (ITL): Add SHOWALL to NSCP Checkcommand
+* [#2880](https://github.com/icinga/icinga2/issues/2880) (ITL): Including \<nscp\> on Linux fails with unregistered function
 
 ### Documentation
 
-* [#3072](https://github.com/Icinga/icinga2/issues/3072) (Documentation): Documentation: Move configuration before advanced topics
-* [#3069](https://github.com/Icinga/icinga2/issues/3069) (Documentation): Enhance cluster docs with HA command\_endpoints
-* [#3068](https://github.com/Icinga/icinga2/issues/3068) (Documentation): Enhance cluster/client troubleshooting
-* [#3062](https://github.com/Icinga/icinga2/issues/3062) (Documentation): Documentation: Update the link to register a new Icinga account
-* [#3059](https://github.com/Icinga/icinga2/issues/3059) (Documentation): Documentation: Typo
-* [#3057](https://github.com/Icinga/icinga2/issues/3057) (Documentation): Documentation: Extend Custom Attributes with the boolean type
-* [#3056](https://github.com/Icinga/icinga2/issues/3056) (Documentation): Wrong service table attributes in Livestatus documentation
-* [#3055](https://github.com/Icinga/icinga2/issues/3055) (Documentation): Documentation: Typo
-* [#3049](https://github.com/Icinga/icinga2/issues/3049) (Documentation): Update documentation for escape sequences
-* [#3036](https://github.com/Icinga/icinga2/issues/3036) (Documentation): Explain string concatenation in objects by real-world example
-* [#3035](https://github.com/Icinga/icinga2/issues/3035) (Documentation): Use a more simple example for passing command parameters
-* [#3033](https://github.com/Icinga/icinga2/issues/3033) (Documentation): Add local variable scope for \*Command to documentation \(host, service, etc\)
-* [#3032](https://github.com/Icinga/icinga2/issues/3032) (Documentation): Add typeof in 'assign/ignore where' expression as example
-* [#3030](https://github.com/Icinga/icinga2/issues/3030) (Documentation): Add examples for function usage in "set\_if" and "command" attributes
-* [#3024](https://github.com/Icinga/icinga2/issues/3024) (Documentation): Best practices: cluster config sync
-* [#3017](https://github.com/Icinga/icinga2/issues/3017) (Documentation): Update service apply for documentation
-* [#3015](https://github.com/Icinga/icinga2/issues/3015) (Documentation): Typo in Configuration Best Practice
-* [#2966](https://github.com/Icinga/icinga2/issues/2966) (Documentation): Include Windows support details in the documentation
-* [#2965](https://github.com/Icinga/icinga2/issues/2965) (Documentation): ITL Documentation: Add a link for passing custom attributes as command parameters
-* [#2950](https://github.com/Icinga/icinga2/issues/2950) (Documentation): Missing "\)" in last Apply Rules example
-* [#2279](https://github.com/Icinga/icinga2/issues/2279) (Documentation): Add documentation and CheckCommands for the windows plugins
+* [#3072](https://github.com/icinga/icinga2/issues/3072) (Documentation): Documentation: Move configuration before advanced topics
+* [#3069](https://github.com/icinga/icinga2/issues/3069) (Documentation): Enhance cluster docs with HA command\_endpoints
+* [#3068](https://github.com/icinga/icinga2/issues/3068) (Documentation): Enhance cluster/client troubleshooting
+* [#3062](https://github.com/icinga/icinga2/issues/3062) (Documentation): Documentation: Update the link to register a new Icinga account
+* [#3059](https://github.com/icinga/icinga2/issues/3059) (Documentation): Documentation: Typo
+* [#3057](https://github.com/icinga/icinga2/issues/3057) (Documentation): Documentation: Extend Custom Attributes with the boolean type
+* [#3056](https://github.com/icinga/icinga2/issues/3056) (Documentation): Wrong service table attributes in Livestatus documentation
+* [#3055](https://github.com/icinga/icinga2/issues/3055) (Documentation): Documentation: Typo
+* [#3049](https://github.com/icinga/icinga2/issues/3049) (Documentation): Update documentation for escape sequences
+* [#3036](https://github.com/icinga/icinga2/issues/3036) (Documentation): Explain string concatenation in objects by real-world example
+* [#3035](https://github.com/icinga/icinga2/issues/3035) (Documentation): Use a more simple example for passing command parameters
+* [#3033](https://github.com/icinga/icinga2/issues/3033) (Documentation): Add local variable scope for \*Command to documentation \(host, service, etc\)
+* [#3032](https://github.com/icinga/icinga2/issues/3032) (Documentation): Add typeof in 'assign/ignore where' expression as example
+* [#3030](https://github.com/icinga/icinga2/issues/3030) (Documentation): Add examples for function usage in "set\_if" and "command" attributes
+* [#3024](https://github.com/icinga/icinga2/issues/3024) (Documentation): Best practices: cluster config sync
+* [#3017](https://github.com/icinga/icinga2/issues/3017) (Documentation): Update service apply for documentation
+* [#3015](https://github.com/icinga/icinga2/issues/3015) (Documentation): Typo in Configuration Best Practice
+* [#2966](https://github.com/icinga/icinga2/issues/2966) (Documentation): Include Windows support details in the documentation
+* [#2965](https://github.com/icinga/icinga2/issues/2965) (Documentation): ITL Documentation: Add a link for passing custom attributes as command parameters
+* [#2950](https://github.com/icinga/icinga2/issues/2950) (Documentation): Missing "\)" in last Apply Rules example
+* [#2279](https://github.com/icinga/icinga2/issues/2279) (Documentation): Add documentation and CheckCommands for the windows plugins
 
 ### Support
 
-* [#3016](https://github.com/Icinga/icinga2/issues/3016) (Installation): Wrong permission etc on windows
-* [#3011](https://github.com/Icinga/icinga2/issues/3011) (Installation): Add support for installing NSClient++ in the Icinga 2 Windows wizard
-* [#3005](https://github.com/Icinga/icinga2/issues/3005) (Installation): Determine NSClient++ installation path using MsiGetComponentPath
-* [#3004](https://github.com/Icinga/icinga2/issues/3004) (Installation): --scm-installs fails when the service is already installed
-* [#2994](https://github.com/Icinga/icinga2/issues/2994) (Installation): Bundle NSClient++ in Windows Installer
-* [#2973](https://github.com/Icinga/icinga2/issues/2973) (Packages): SPEC: Give group write permissions for perfdata dir
-* [#2451](https://github.com/Icinga/icinga2/issues/2451) (Installation): Extend Windows installer with an update mode
+* [#3016](https://github.com/icinga/icinga2/issues/3016) (Installation): Wrong permission etc on windows
+* [#3011](https://github.com/icinga/icinga2/issues/3011) (Installation): Add support for installing NSClient++ in the Icinga 2 Windows wizard
+* [#3005](https://github.com/icinga/icinga2/issues/3005) (Installation): Determine NSClient++ installation path using MsiGetComponentPath
+* [#3004](https://github.com/icinga/icinga2/issues/3004) (Installation): --scm-installs fails when the service is already installed
+* [#2994](https://github.com/icinga/icinga2/issues/2994) (Installation): Bundle NSClient++ in Windows Installer
+* [#2973](https://github.com/icinga/icinga2/issues/2973) (Packages): SPEC: Give group write permissions for perfdata dir
+* [#2451](https://github.com/icinga/icinga2/issues/2451) (Installation): Extend Windows installer with an update mode
 
 ## 2.3.4 (2015-04-20)
 
@@ -2114,46 +2166,46 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#2841](https://github.com/Icinga/icinga2/issues/2841): Improve timeperiod validation error messages
-* [#2791](https://github.com/Icinga/icinga2/issues/2791) (Cluster): Agent Wizard: add options for API defaults
+* [#2841](https://github.com/icinga/icinga2/issues/2841): Improve timeperiod validation error messages
+* [#2791](https://github.com/icinga/icinga2/issues/2791) (Cluster): Agent Wizard: add options for API defaults
 
 ### Bug
 
-* [#2903](https://github.com/Icinga/icinga2/issues/2903) (Configuration): custom attributes with recursive macro function calls causing sigabrt
-* [#2898](https://github.com/Icinga/icinga2/issues/2898) (CLI): troubleshoot truncates crash reports
-* [#2886](https://github.com/Icinga/icinga2/issues/2886): Acknowledging problems w/ expire time does not add the expiry information to the related comment for IDO and compat
-* [#2883](https://github.com/Icinga/icinga2/issues/2883) (Notifications): Multiple log messages w/ "Attempting to send notifications for notification object"
-* [#2882](https://github.com/Icinga/icinga2/issues/2882) (DB IDO): scheduled\_downtime\_depth column is not reset when a downtime ends or when a downtime is being removed
-* [#2881](https://github.com/Icinga/icinga2/issues/2881) (DB IDO): Downtimes which have been triggered are not properly recorded in the database
-* [#2878](https://github.com/Icinga/icinga2/issues/2878) (DB IDO): Don't update scheduleddowntime table w/ trigger\_time column when only adding a downtime
-* [#2855](https://github.com/Icinga/icinga2/issues/2855): Fix complexity class for Dictionary::Get
-* [#2853](https://github.com/Icinga/icinga2/issues/2853) (CLI): Node wizard should only accept 'y', 'n', 'Y' and 'N' as answers for boolean questions  
-* [#2842](https://github.com/Icinga/icinga2/issues/2842) (Configuration): Default max\_check\_attempts should be lower for hosts than for services
-* [#2840](https://github.com/Icinga/icinga2/issues/2840) (Configuration): Validation errors for time ranges which span the DST transition
-* [#2827](https://github.com/Icinga/icinga2/issues/2827) (Configuration): logrotate does not work
-* [#2801](https://github.com/Icinga/icinga2/issues/2801) (Cluster): command\_endpoint check\_results are not replicated to other endpoints in the same zone
+* [#2903](https://github.com/icinga/icinga2/issues/2903) (Configuration): custom attributes with recursive macro function calls causing sigabrt
+* [#2898](https://github.com/icinga/icinga2/issues/2898) (CLI): troubleshoot truncates crash reports
+* [#2886](https://github.com/icinga/icinga2/issues/2886): Acknowledging problems w/ expire time does not add the expiry information to the related comment for IDO and compat
+* [#2883](https://github.com/icinga/icinga2/issues/2883) (Notifications): Multiple log messages w/ "Attempting to send notifications for notification object"
+* [#2882](https://github.com/icinga/icinga2/issues/2882) (DB IDO): scheduled\_downtime\_depth column is not reset when a downtime ends or when a downtime is being removed
+* [#2881](https://github.com/icinga/icinga2/issues/2881) (DB IDO): Downtimes which have been triggered are not properly recorded in the database
+* [#2878](https://github.com/icinga/icinga2/issues/2878) (DB IDO): Don't update scheduleddowntime table w/ trigger\_time column when only adding a downtime
+* [#2855](https://github.com/icinga/icinga2/issues/2855): Fix complexity class for Dictionary::Get
+* [#2853](https://github.com/icinga/icinga2/issues/2853) (CLI): Node wizard should only accept 'y', 'n', 'Y' and 'N' as answers for boolean questions  
+* [#2842](https://github.com/icinga/icinga2/issues/2842) (Configuration): Default max\_check\_attempts should be lower for hosts than for services
+* [#2840](https://github.com/icinga/icinga2/issues/2840) (Configuration): Validation errors for time ranges which span the DST transition
+* [#2827](https://github.com/icinga/icinga2/issues/2827) (Configuration): logrotate does not work
+* [#2801](https://github.com/icinga/icinga2/issues/2801) (Cluster): command\_endpoint check\_results are not replicated to other endpoints in the same zone
 
 ### ITL
 
-* [#2891](https://github.com/Icinga/icinga2/issues/2891) (ITL): web.conf is not in the RPM package
-* [#2890](https://github.com/Icinga/icinga2/issues/2890) (ITL): check\_disk order of command arguments 
-* [#2834](https://github.com/Icinga/icinga2/issues/2834) (ITL): Add arguments to the UPS check
-* [#2770](https://github.com/Icinga/icinga2/issues/2770) (ITL): Add database plugins to ITL
+* [#2891](https://github.com/icinga/icinga2/issues/2891) (ITL): web.conf is not in the RPM package
+* [#2890](https://github.com/icinga/icinga2/issues/2890) (ITL): check\_disk order of command arguments 
+* [#2834](https://github.com/icinga/icinga2/issues/2834) (ITL): Add arguments to the UPS check
+* [#2770](https://github.com/icinga/icinga2/issues/2770) (ITL): Add database plugins to ITL
 
 ### Documentation
 
-* [#2902](https://github.com/Icinga/icinga2/issues/2902) (Documentation): Documentation: set\_if usage with boolean values and functions
-* [#2876](https://github.com/Icinga/icinga2/issues/2876) (Documentation): Typo in graphite feature enable documentation
-* [#2868](https://github.com/Icinga/icinga2/issues/2868) (Documentation): Fix a typo
-* [#2843](https://github.com/Icinga/icinga2/issues/2843) (Documentation): Add explanatory note for Icinga2 client documentation
-* [#2837](https://github.com/Icinga/icinga2/issues/2837) (Documentation): Fix a minor markdown error
-* [#2832](https://github.com/Icinga/icinga2/issues/2832) (Documentation): Reword documentation of check\_address
+* [#2902](https://github.com/icinga/icinga2/issues/2902) (Documentation): Documentation: set\_if usage with boolean values and functions
+* [#2876](https://github.com/icinga/icinga2/issues/2876) (Documentation): Typo in graphite feature enable documentation
+* [#2868](https://github.com/icinga/icinga2/issues/2868) (Documentation): Fix a typo
+* [#2843](https://github.com/icinga/icinga2/issues/2843) (Documentation): Add explanatory note for Icinga2 client documentation
+* [#2837](https://github.com/icinga/icinga2/issues/2837) (Documentation): Fix a minor markdown error
+* [#2832](https://github.com/icinga/icinga2/issues/2832) (Documentation): Reword documentation of check\_address
 
 ### Support
 
-* [#2888](https://github.com/Icinga/icinga2/issues/2888) (Installation): Vim syntax: Match groups before host/service/user objects
-* [#2852](https://github.com/Icinga/icinga2/issues/2852) (Installation): Windows Build: Flex detection
-* [#2793](https://github.com/Icinga/icinga2/issues/2793) (Packages): logrotate doesn't work on Ubuntu
+* [#2888](https://github.com/icinga/icinga2/issues/2888) (Installation): Vim syntax: Match groups before host/service/user objects
+* [#2852](https://github.com/icinga/icinga2/issues/2852) (Installation): Windows Build: Flex detection
+* [#2793](https://github.com/icinga/icinga2/issues/2793) (Packages): logrotate doesn't work on Ubuntu
 
 ## 2.3.3 (2015-03-26)
 
@@ -2166,52 +2218,52 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Enhancement
 
-* [#2771](https://github.com/Icinga/icinga2/issues/2771): Include more details in --version
-* [#2743](https://github.com/Icinga/icinga2/issues/2743): New function: parse\_performance\_data
-* [#2737](https://github.com/Icinga/icinga2/issues/2737) (Notifications): Show state/type filter names in notice/debug log
+* [#2771](https://github.com/icinga/icinga2/issues/2771): Include more details in --version
+* [#2743](https://github.com/icinga/icinga2/issues/2743): New function: parse\_performance\_data
+* [#2737](https://github.com/icinga/icinga2/issues/2737) (Notifications): Show state/type filter names in notice/debug log
 
 ### Bug
 
-* [#2828](https://github.com/Icinga/icinga2/issues/2828): Array in command arguments doesn't work
-* [#2818](https://github.com/Icinga/icinga2/issues/2818) (Configuration): Local variables in "apply for" are overridden
-* [#2816](https://github.com/Icinga/icinga2/issues/2816) (CLI): Segmentation fault when executing "icinga2 pki new-cert"
-* [#2812](https://github.com/Icinga/icinga2/issues/2812) (Configuration): Return doesn't work inside loops
-* [#2807](https://github.com/Icinga/icinga2/issues/2807) (Configuration): Figure out why command validators are not triggered 
-* [#2778](https://github.com/Icinga/icinga2/issues/2778) (Configuration): object Notification + apply Service fails with error "...refers to service which doesn't exist"
-* [#2772](https://github.com/Icinga/icinga2/issues/2772) (Plugins): Plugin "check\_http" is missing in Windows environments
-* [#2768](https://github.com/Icinga/icinga2/issues/2768) (Configuration): Add missing keywords in the syntax highlighting files
-* [#2760](https://github.com/Icinga/icinga2/issues/2760): Don't ignore extraneous arguments for functions
-* [#2753](https://github.com/Icinga/icinga2/issues/2753) (DB IDO): Don't update custom vars for each status update
-* [#2752](https://github.com/Icinga/icinga2/issues/2752): startup.log broken when the DB schema needs an update
-* [#2749](https://github.com/Icinga/icinga2/issues/2749) (Configuration): Missing config validator for command arguments 'set\_if'
-* [#2718](https://github.com/Icinga/icinga2/issues/2718) (Configuration): Update syntax highlighting for 2.3 features
-* [#2557](https://github.com/Icinga/icinga2/issues/2557) (Configuration): Improve error message for invalid field access
-* [#2548](https://github.com/Icinga/icinga2/issues/2548) (Configuration): Fix VIM syntax highlighting for comments
+* [#2828](https://github.com/icinga/icinga2/issues/2828): Array in command arguments doesn't work
+* [#2818](https://github.com/icinga/icinga2/issues/2818) (Configuration): Local variables in "apply for" are overridden
+* [#2816](https://github.com/icinga/icinga2/issues/2816) (CLI): Segmentation fault when executing "icinga2 pki new-cert"
+* [#2812](https://github.com/icinga/icinga2/issues/2812) (Configuration): Return doesn't work inside loops
+* [#2807](https://github.com/icinga/icinga2/issues/2807) (Configuration): Figure out why command validators are not triggered 
+* [#2778](https://github.com/icinga/icinga2/issues/2778) (Configuration): object Notification + apply Service fails with error "...refers to service which doesn't exist"
+* [#2772](https://github.com/icinga/icinga2/issues/2772) (Plugins): Plugin "check\_http" is missing in Windows environments
+* [#2768](https://github.com/icinga/icinga2/issues/2768) (Configuration): Add missing keywords in the syntax highlighting files
+* [#2760](https://github.com/icinga/icinga2/issues/2760): Don't ignore extraneous arguments for functions
+* [#2753](https://github.com/icinga/icinga2/issues/2753) (DB IDO): Don't update custom vars for each status update
+* [#2752](https://github.com/icinga/icinga2/issues/2752): startup.log broken when the DB schema needs an update
+* [#2749](https://github.com/icinga/icinga2/issues/2749) (Configuration): Missing config validator for command arguments 'set\_if'
+* [#2718](https://github.com/icinga/icinga2/issues/2718) (Configuration): Update syntax highlighting for 2.3 features
+* [#2557](https://github.com/icinga/icinga2/issues/2557) (Configuration): Improve error message for invalid field access
+* [#2548](https://github.com/icinga/icinga2/issues/2548) (Configuration): Fix VIM syntax highlighting for comments
 
 ### ITL
 
-* [#2823](https://github.com/Icinga/icinga2/issues/2823) (ITL): wrong 'dns\_lookup' custom attribute default in command-plugins.conf 
-* [#2799](https://github.com/Icinga/icinga2/issues/2799) (ITL): Add "random" CheckCommand for test and demo purposes
+* [#2823](https://github.com/icinga/icinga2/issues/2823) (ITL): wrong 'dns\_lookup' custom attribute default in command-plugins.conf 
+* [#2799](https://github.com/icinga/icinga2/issues/2799) (ITL): Add "random" CheckCommand for test and demo purposes
 
 ### Documentation
 
-* [#2825](https://github.com/Icinga/icinga2/issues/2825) (Documentation): Fix incorrect perfdata templates in the documentation 
-* [#2806](https://github.com/Icinga/icinga2/issues/2806) (Documentation): Move release info in INSTALL.md into a separate file
-* [#2779](https://github.com/Icinga/icinga2/issues/2779) (Documentation): Correct HA documentation
-* [#2777](https://github.com/Icinga/icinga2/issues/2777) (Documentation): Typo and invalid example in the runtime macro documentation
-* [#2776](https://github.com/Icinga/icinga2/issues/2776) (Documentation): Remove prompt to create a TicketSalt from the wizard
-* [#2775](https://github.com/Icinga/icinga2/issues/2775) (Documentation): Explain processing logic/order of apply rules with for loops
-* [#2774](https://github.com/Icinga/icinga2/issues/2774) (Documentation): Revamp migration documentation
-* [#2773](https://github.com/Icinga/icinga2/issues/2773) (Documentation): Typo in doc library-reference
-* [#2765](https://github.com/Icinga/icinga2/issues/2765) (Documentation): Fix a typo in the documentation of ICINGA2\_WITH\_MYSQL and ICINGA2\_WITH\_PGSQL
-* [#2756](https://github.com/Icinga/icinga2/issues/2756) (Documentation): Add "access objects at runtime" examples to advanced section
-* [#2738](https://github.com/Icinga/icinga2/issues/2738) (Documentation): Update documentation for "apply for" rules
-* [#2501](https://github.com/Icinga/icinga2/issues/2501) (Documentation): Re-order the object types in alphabetical order
+* [#2825](https://github.com/icinga/icinga2/issues/2825) (Documentation): Fix incorrect perfdata templates in the documentation 
+* [#2806](https://github.com/icinga/icinga2/issues/2806) (Documentation): Move release info in INSTALL.md into a separate file
+* [#2779](https://github.com/icinga/icinga2/issues/2779) (Documentation): Correct HA documentation
+* [#2777](https://github.com/icinga/icinga2/issues/2777) (Documentation): Typo and invalid example in the runtime macro documentation
+* [#2776](https://github.com/icinga/icinga2/issues/2776) (Documentation): Remove prompt to create a TicketSalt from the wizard
+* [#2775](https://github.com/icinga/icinga2/issues/2775) (Documentation): Explain processing logic/order of apply rules with for loops
+* [#2774](https://github.com/icinga/icinga2/issues/2774) (Documentation): Revamp migration documentation
+* [#2773](https://github.com/icinga/icinga2/issues/2773) (Documentation): Typo in doc library-reference
+* [#2765](https://github.com/icinga/icinga2/issues/2765) (Documentation): Fix a typo in the documentation of ICINGA2\_WITH\_MYSQL and ICINGA2\_WITH\_PGSQL
+* [#2756](https://github.com/icinga/icinga2/issues/2756) (Documentation): Add "access objects at runtime" examples to advanced section
+* [#2738](https://github.com/icinga/icinga2/issues/2738) (Documentation): Update documentation for "apply for" rules
+* [#2501](https://github.com/icinga/icinga2/issues/2501) (Documentation): Re-order the object types in alphabetical order
 
 ### Support
 
-* [#2762](https://github.com/Icinga/icinga2/issues/2762) (Installation): Flex version check does not reject unsupported versions
-* [#2761](https://github.com/Icinga/icinga2/issues/2761) (Installation): Build warnings with CMake 3.1.3
+* [#2762](https://github.com/icinga/icinga2/issues/2762) (Installation): Flex version check does not reject unsupported versions
+* [#2761](https://github.com/icinga/icinga2/issues/2761) (Installation): Build warnings with CMake 3.1.3
 
 ## 2.3.2 (2015-03-12)
 
@@ -2221,7 +2273,7 @@ This release fixes a number of issues introduced in 2.4.8.
 
 ### Bug
 
-* [#2747](https://github.com/Icinga/icinga2/issues/2747): Log message for cli commands breaks the init script
+* [#2747](https://github.com/icinga/icinga2/issues/2747): Log message for cli commands breaks the init script
 
 ## 2.3.1 (2015-03-12)
 
@@ -2233,30 +2285,30 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Enhancement
 
-* [#2717](https://github.com/Icinga/icinga2/issues/2717) (Configuration): Implement String\#contains
+* [#2717](https://github.com/icinga/icinga2/issues/2717) (Configuration): Implement String\#contains
 
 ### Bug
 
-* [#2739](https://github.com/Icinga/icinga2/issues/2739): Crash in Dependency::Stop
-* [#2736](https://github.com/Icinga/icinga2/issues/2736): Fix formatting for the GDB stacktrace
-* [#2735](https://github.com/Icinga/icinga2/issues/2735): Make sure that the /var/log/icinga2/crash directory exists
-* [#2731](https://github.com/Icinga/icinga2/issues/2731) (Configuration): Config validation fail because of unexpected new-line
-* [#2727](https://github.com/Icinga/icinga2/issues/2727) (Cluster): Api heartbeat message response time problem
-* [#2716](https://github.com/Icinga/icinga2/issues/2716) (CLI): Missing program name in 'icinga2 --version'
-* [#2672](https://github.com/Icinga/icinga2/issues/2672): Kill signal sent only to check process, not whole process group
+* [#2739](https://github.com/icinga/icinga2/issues/2739): Crash in Dependency::Stop
+* [#2736](https://github.com/icinga/icinga2/issues/2736): Fix formatting for the GDB stacktrace
+* [#2735](https://github.com/icinga/icinga2/issues/2735): Make sure that the /var/log/icinga2/crash directory exists
+* [#2731](https://github.com/icinga/icinga2/issues/2731) (Configuration): Config validation fail because of unexpected new-line
+* [#2727](https://github.com/icinga/icinga2/issues/2727) (Cluster): Api heartbeat message response time problem
+* [#2716](https://github.com/icinga/icinga2/issues/2716) (CLI): Missing program name in 'icinga2 --version'
+* [#2672](https://github.com/icinga/icinga2/issues/2672): Kill signal sent only to check process, not whole process group
 
 ### ITL
 
-* [#2483](https://github.com/Icinga/icinga2/issues/2483) (ITL): Fix check\_disk thresholds: make sure partitions are the last arguments
+* [#2483](https://github.com/icinga/icinga2/issues/2483) (ITL): Fix check\_disk thresholds: make sure partitions are the last arguments
 
 ### Documentation
 
-* [#2732](https://github.com/Icinga/icinga2/issues/2732) (Documentation): Update documentation for DB IDO HA Run-Once
-* [#2728](https://github.com/Icinga/icinga2/issues/2728) (Documentation): Fix check\_disk default thresholds and document the change of unit
+* [#2732](https://github.com/icinga/icinga2/issues/2732) (Documentation): Update documentation for DB IDO HA Run-Once
+* [#2728](https://github.com/icinga/icinga2/issues/2728) (Documentation): Fix check\_disk default thresholds and document the change of unit
 
 ### Support
 
-* [#2742](https://github.com/Icinga/icinga2/issues/2742) (Packages): Debian packages do not create /var/log/icinga2/crash
+* [#2742](https://github.com/icinga/icinga2/issues/2742) (Packages): Debian packages do not create /var/log/icinga2/crash
 
 ## 2.3.0 (2015-03-10)
 
@@ -2304,250 +2356,250 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Enhancement
 
-* [#2704](https://github.com/Icinga/icinga2/issues/2704): Support the SNI TLS extension
-* [#2702](https://github.com/Icinga/icinga2/issues/2702): Add validator for time ranges in ScheduledDowntime objects
-* [#2701](https://github.com/Icinga/icinga2/issues/2701): Remove macro argument for IMPL\_TYPE\_LOOKUP
-* [#2696](https://github.com/Icinga/icinga2/issues/2696): Include GDB backtrace in crash reports
-* [#2678](https://github.com/Icinga/icinga2/issues/2678) (Configuration): Add support for else-if
-* [#2663](https://github.com/Icinga/icinga2/issues/2663) (Livestatus): Change Livestatus query log level to 'notice'
-* [#2657](https://github.com/Icinga/icinga2/issues/2657) (Cluster): Show slave lag for the cluster-zone check
-* [#2635](https://github.com/Icinga/icinga2/issues/2635) (Configuration): introduce time dependent variable values
-* [#2634](https://github.com/Icinga/icinga2/issues/2634) (Cluster): Add the ability to use a CA certificate as a way of verifying hosts for CSR autosigning
-* [#2609](https://github.com/Icinga/icinga2/issues/2609): udp check command is missing arguments.
-* [#2604](https://github.com/Icinga/icinga2/issues/2604) (CLI): Backup certificate files in 'node setup'
-* [#2601](https://github.com/Icinga/icinga2/issues/2601) (Configuration): Implement continue/break keywords
-* [#2600](https://github.com/Icinga/icinga2/issues/2600) (Configuration): Implement support for Json.encode and Json.decode
-* [#2591](https://github.com/Icinga/icinga2/issues/2591) (Performance Data): Add timestamp support for Graphite
-* [#2588](https://github.com/Icinga/icinga2/issues/2588) (Configuration): Add path information for objects in object list
-* [#2578](https://github.com/Icinga/icinga2/issues/2578) (Configuration): Implement Array\#join
-* [#2553](https://github.com/Icinga/icinga2/issues/2553) (Configuration): Implement validator support for function objects
-* [#2552](https://github.com/Icinga/icinga2/issues/2552) (Configuration): Make operators &&, || behave like in JavaScript
-* [#2546](https://github.com/Icinga/icinga2/issues/2546): Add macros $host.check\_source$ and $service.check\_source$
-* [#2544](https://github.com/Icinga/icinga2/issues/2544) (Configuration): Implement the while keyword
-* [#2531](https://github.com/Icinga/icinga2/issues/2531) (Configuration): Implement keywords to explicitly access globals/locals
-* [#2522](https://github.com/Icinga/icinga2/issues/2522) (CLI): Make invalid log-severity option output an error instead of a warning
-* [#2509](https://github.com/Icinga/icinga2/issues/2509): Host/Service runtime macro downtime\_depth
-* [#2491](https://github.com/Icinga/icinga2/issues/2491) (Configuration): Assignments shouldn't have a "return" value
-* [#2488](https://github.com/Icinga/icinga2/issues/2488): Implement additional methods for strings
-* [#2487](https://github.com/Icinga/icinga2/issues/2487) (CLI): Figure out what to do about libreadline \(license\)
-* [#2486](https://github.com/Icinga/icinga2/issues/2486) (CLI): Figure out a better name for the repl command
-* [#2466](https://github.com/Icinga/icinga2/issues/2466) (Configuration): Implement line-continuation for the "console" command
-* [#2456](https://github.com/Icinga/icinga2/issues/2456) (CLI): feature enable should use relative symlinks
-* [#2439](https://github.com/Icinga/icinga2/issues/2439) (Configuration): Document the new language features in 2.3
-* [#2437](https://github.com/Icinga/icinga2/issues/2437) (CLI): Implement readline support for the "console" CLI command
-* [#2432](https://github.com/Icinga/icinga2/issues/2432) (CLI): Backport i2tcl's error reporting functionality into "icinga2 console"
-* [#2429](https://github.com/Icinga/icinga2/issues/2429) (Configuration): Figure out how variable scopes should work
-* [#2426](https://github.com/Icinga/icinga2/issues/2426) (Configuration): Implement a way to call methods on objects
-* [#2421](https://github.com/Icinga/icinga2/issues/2421) (Configuration): Implement a way to remove dictionary keys
-* [#2418](https://github.com/Icinga/icinga2/issues/2418) (Plugins): Windows plugins should behave like their Linux cousins
-* [#2408](https://github.com/Icinga/icinga2/issues/2408) (Configuration): ConfigCompiler::HandleInclude should return an inline dictionary
-* [#2407](https://github.com/Icinga/icinga2/issues/2407) (Configuration): Implement a boolean sub-type for the Value class
-* [#2405](https://github.com/Icinga/icinga2/issues/2405): Disallow calling strings as functions
-* [#2396](https://github.com/Icinga/icinga2/issues/2396) (Configuration): Evaluate usage of function\(\)
-* [#2391](https://github.com/Icinga/icinga2/issues/2391): Improve output of ToString for type objects
-* [#2390](https://github.com/Icinga/icinga2/issues/2390): Register type objects as global variables
-* [#2367](https://github.com/Icinga/icinga2/issues/2367) (Configuration): The lexer shouldn't accept escapes for characters which don't have to be escaped
-* [#2365](https://github.com/Icinga/icinga2/issues/2365) (DB IDO): Implement socket\_path attribute for the IdoMysqlConnection class
-* [#2355](https://github.com/Icinga/icinga2/issues/2355) (Configuration): Implement official support for user-defined functions and the "for" keyword
-* [#2351](https://github.com/Icinga/icinga2/issues/2351) (Plugins): Windows agent is missing the standard plugin check\_ping
-* [#2348](https://github.com/Icinga/icinga2/issues/2348) (Plugins): Plugin Check Commands: Add icmp
-* [#2324](https://github.com/Icinga/icinga2/issues/2324) (Configuration): Implement the "if" and "else" keywords
-* [#2323](https://github.com/Icinga/icinga2/issues/2323) (Configuration): Figure out whether Number + String should implicitly convert the Number argument to a string
-* [#2322](https://github.com/Icinga/icinga2/issues/2322) (Configuration): Make the config parser thread-safe
-* [#2318](https://github.com/Icinga/icinga2/issues/2318) (Configuration): Implement the % operator
-* [#2312](https://github.com/Icinga/icinga2/issues/2312): Move the cast functions into libbase
-* [#2310](https://github.com/Icinga/icinga2/issues/2310) (Configuration): Implement unit tests for the config parser
-* [#2304](https://github.com/Icinga/icinga2/issues/2304): Implement an option to disable building the Demo component
-* [#2303](https://github.com/Icinga/icinga2/issues/2303): Implement an option to disable building the Livestatus module
-* [#2300](https://github.com/Icinga/icinga2/issues/2300) (Notifications): Implement the DISABLE\_HOST\_SVC\_NOTIFICATIONS and ENABLE\_HOST\_SVC\_NOTIFICATIONS commands
-* [#2298](https://github.com/Icinga/icinga2/issues/2298) (Plugins): Missing check\_disk output on Windows
-* [#2294](https://github.com/Icinga/icinga2/issues/2294) (Configuration): Implement an AST Expression for T\_CONST
-* [#2290](https://github.com/Icinga/icinga2/issues/2290): Rename \_DEBUG to I2\_DEBUG
-* [#2286](https://github.com/Icinga/icinga2/issues/2286) (Configuration): Redesign how stack frames work for scripts
-* [#2265](https://github.com/Icinga/icinga2/issues/2265): ConfigCompiler::Compile\* should return an AST node
-* [#2264](https://github.com/Icinga/icinga2/issues/2264) (Configuration): ConfigCompiler::HandleInclude\* should return an AST node
-* [#2262](https://github.com/Icinga/icinga2/issues/2262) (CLI): Add an option that hides CLI commands
-* [#2260](https://github.com/Icinga/icinga2/issues/2260) (Configuration): Evaluate apply/object rules when the parent objects are created
-* [#2211](https://github.com/Icinga/icinga2/issues/2211) (Configuration): Variable from for loop not usable in assign statement
-* [#2186](https://github.com/Icinga/icinga2/issues/2186) (Configuration): Access object runtime attributes in custom vars & command arguments
-* [#2176](https://github.com/Icinga/icinga2/issues/2176) (Configuration): Please add labels in SNMP checks
-* [#2043](https://github.com/Icinga/icinga2/issues/2043) (Livestatus): Livestatus: Add GroupBy tables: hostsbygroup, servicesbygroup, servicesbyhostgroup
-* [#2027](https://github.com/Icinga/icinga2/issues/2027) (Configuration): Add parent soft states option to Dependency object configuration
-* [#2000](https://github.com/Icinga/icinga2/issues/2000) (Performance Data): Add OpenTSDB Writer
-* [#1959](https://github.com/Icinga/icinga2/issues/1959) (Configuration): extended Manubulon SNMP Check Plugin Command 
-* [#1890](https://github.com/Icinga/icinga2/issues/1890) (DB IDO): IDO should fill program\_end\_time on a clean shutdown
-* [#1866](https://github.com/Icinga/icinga2/issues/1866) (Notifications): Disable flapping detection by default
-* [#1859](https://github.com/Icinga/icinga2/issues/1859): Run CheckCommands with C locale \(workaround for comma vs dot and plugin api bug\)
-* [#1783](https://github.com/Icinga/icinga2/issues/1783) (Plugins): Plugin Check Commands: add check\_vmware\_esx
-* [#1733](https://github.com/Icinga/icinga2/issues/1733) (Configuration): Disallow side-effect-free r-value expressions in expression lists
-* [#1507](https://github.com/Icinga/icinga2/issues/1507): Don't spawn threads for network connections
-* [#404](https://github.com/Icinga/icinga2/issues/404) (CLI): Add troubleshooting collect cli command
+* [#2704](https://github.com/icinga/icinga2/issues/2704): Support the SNI TLS extension
+* [#2702](https://github.com/icinga/icinga2/issues/2702): Add validator for time ranges in ScheduledDowntime objects
+* [#2701](https://github.com/icinga/icinga2/issues/2701): Remove macro argument for IMPL\_TYPE\_LOOKUP
+* [#2696](https://github.com/icinga/icinga2/issues/2696): Include GDB backtrace in crash reports
+* [#2678](https://github.com/icinga/icinga2/issues/2678) (Configuration): Add support for else-if
+* [#2663](https://github.com/icinga/icinga2/issues/2663) (Livestatus): Change Livestatus query log level to 'notice'
+* [#2657](https://github.com/icinga/icinga2/issues/2657) (Cluster): Show slave lag for the cluster-zone check
+* [#2635](https://github.com/icinga/icinga2/issues/2635) (Configuration): introduce time dependent variable values
+* [#2634](https://github.com/icinga/icinga2/issues/2634) (Cluster): Add the ability to use a CA certificate as a way of verifying hosts for CSR autosigning
+* [#2609](https://github.com/icinga/icinga2/issues/2609): udp check command is missing arguments.
+* [#2604](https://github.com/icinga/icinga2/issues/2604) (CLI): Backup certificate files in 'node setup'
+* [#2601](https://github.com/icinga/icinga2/issues/2601) (Configuration): Implement continue/break keywords
+* [#2600](https://github.com/icinga/icinga2/issues/2600) (Configuration): Implement support for Json.encode and Json.decode
+* [#2591](https://github.com/icinga/icinga2/issues/2591) (Metrics): Add timestamp support for Graphite
+* [#2588](https://github.com/icinga/icinga2/issues/2588) (Configuration): Add path information for objects in object list
+* [#2578](https://github.com/icinga/icinga2/issues/2578) (Configuration): Implement Array\#join
+* [#2553](https://github.com/icinga/icinga2/issues/2553) (Configuration): Implement validator support for function objects
+* [#2552](https://github.com/icinga/icinga2/issues/2552) (Configuration): Make operators &&, || behave like in JavaScript
+* [#2546](https://github.com/icinga/icinga2/issues/2546): Add macros $host.check\_source$ and $service.check\_source$
+* [#2544](https://github.com/icinga/icinga2/issues/2544) (Configuration): Implement the while keyword
+* [#2531](https://github.com/icinga/icinga2/issues/2531) (Configuration): Implement keywords to explicitly access globals/locals
+* [#2522](https://github.com/icinga/icinga2/issues/2522) (CLI): Make invalid log-severity option output an error instead of a warning
+* [#2509](https://github.com/icinga/icinga2/issues/2509): Host/Service runtime macro downtime\_depth
+* [#2491](https://github.com/icinga/icinga2/issues/2491) (Configuration): Assignments shouldn't have a "return" value
+* [#2488](https://github.com/icinga/icinga2/issues/2488): Implement additional methods for strings
+* [#2487](https://github.com/icinga/icinga2/issues/2487) (CLI): Figure out what to do about libreadline \(license\)
+* [#2486](https://github.com/icinga/icinga2/issues/2486) (CLI): Figure out a better name for the repl command
+* [#2466](https://github.com/icinga/icinga2/issues/2466) (Configuration): Implement line-continuation for the "console" command
+* [#2456](https://github.com/icinga/icinga2/issues/2456) (CLI): feature enable should use relative symlinks
+* [#2439](https://github.com/icinga/icinga2/issues/2439) (Configuration): Document the new language features in 2.3
+* [#2437](https://github.com/icinga/icinga2/issues/2437) (CLI): Implement readline support for the "console" CLI command
+* [#2432](https://github.com/icinga/icinga2/issues/2432) (CLI): Backport i2tcl's error reporting functionality into "icinga2 console"
+* [#2429](https://github.com/icinga/icinga2/issues/2429) (Configuration): Figure out how variable scopes should work
+* [#2426](https://github.com/icinga/icinga2/issues/2426) (Configuration): Implement a way to call methods on objects
+* [#2421](https://github.com/icinga/icinga2/issues/2421) (Configuration): Implement a way to remove dictionary keys
+* [#2418](https://github.com/icinga/icinga2/issues/2418) (Plugins): Windows plugins should behave like their Linux cousins
+* [#2408](https://github.com/icinga/icinga2/issues/2408) (Configuration): ConfigCompiler::HandleInclude should return an inline dictionary
+* [#2407](https://github.com/icinga/icinga2/issues/2407) (Configuration): Implement a boolean sub-type for the Value class
+* [#2405](https://github.com/icinga/icinga2/issues/2405): Disallow calling strings as functions
+* [#2396](https://github.com/icinga/icinga2/issues/2396) (Configuration): Evaluate usage of function\(\)
+* [#2391](https://github.com/icinga/icinga2/issues/2391): Improve output of ToString for type objects
+* [#2390](https://github.com/icinga/icinga2/issues/2390): Register type objects as global variables
+* [#2367](https://github.com/icinga/icinga2/issues/2367) (Configuration): The lexer shouldn't accept escapes for characters which don't have to be escaped
+* [#2365](https://github.com/icinga/icinga2/issues/2365) (DB IDO): Implement socket\_path attribute for the IdoMysqlConnection class
+* [#2355](https://github.com/icinga/icinga2/issues/2355) (Configuration): Implement official support for user-defined functions and the "for" keyword
+* [#2351](https://github.com/icinga/icinga2/issues/2351) (Plugins): Windows agent is missing the standard plugin check\_ping
+* [#2348](https://github.com/icinga/icinga2/issues/2348) (Plugins): Plugin Check Commands: Add icmp
+* [#2324](https://github.com/icinga/icinga2/issues/2324) (Configuration): Implement the "if" and "else" keywords
+* [#2323](https://github.com/icinga/icinga2/issues/2323) (Configuration): Figure out whether Number + String should implicitly convert the Number argument to a string
+* [#2322](https://github.com/icinga/icinga2/issues/2322) (Configuration): Make the config parser thread-safe
+* [#2318](https://github.com/icinga/icinga2/issues/2318) (Configuration): Implement the % operator
+* [#2312](https://github.com/icinga/icinga2/issues/2312): Move the cast functions into libbase
+* [#2310](https://github.com/icinga/icinga2/issues/2310) (Configuration): Implement unit tests for the config parser
+* [#2304](https://github.com/icinga/icinga2/issues/2304): Implement an option to disable building the Demo component
+* [#2303](https://github.com/icinga/icinga2/issues/2303): Implement an option to disable building the Livestatus module
+* [#2300](https://github.com/icinga/icinga2/issues/2300) (Notifications): Implement the DISABLE\_HOST\_SVC\_NOTIFICATIONS and ENABLE\_HOST\_SVC\_NOTIFICATIONS commands
+* [#2298](https://github.com/icinga/icinga2/issues/2298) (Plugins): Missing check\_disk output on Windows
+* [#2294](https://github.com/icinga/icinga2/issues/2294) (Configuration): Implement an AST Expression for T\_CONST
+* [#2290](https://github.com/icinga/icinga2/issues/2290): Rename \_DEBUG to I2\_DEBUG
+* [#2286](https://github.com/icinga/icinga2/issues/2286) (Configuration): Redesign how stack frames work for scripts
+* [#2265](https://github.com/icinga/icinga2/issues/2265): ConfigCompiler::Compile\* should return an AST node
+* [#2264](https://github.com/icinga/icinga2/issues/2264) (Configuration): ConfigCompiler::HandleInclude\* should return an AST node
+* [#2262](https://github.com/icinga/icinga2/issues/2262) (CLI): Add an option that hides CLI commands
+* [#2260](https://github.com/icinga/icinga2/issues/2260) (Configuration): Evaluate apply/object rules when the parent objects are created
+* [#2211](https://github.com/icinga/icinga2/issues/2211) (Configuration): Variable from for loop not usable in assign statement
+* [#2186](https://github.com/icinga/icinga2/issues/2186) (Configuration): Access object runtime attributes in custom vars & command arguments
+* [#2176](https://github.com/icinga/icinga2/issues/2176) (Configuration): Please add labels in SNMP checks
+* [#2043](https://github.com/icinga/icinga2/issues/2043) (Livestatus): Livestatus: Add GroupBy tables: hostsbygroup, servicesbygroup, servicesbyhostgroup
+* [#2027](https://github.com/icinga/icinga2/issues/2027) (Configuration): Add parent soft states option to Dependency object configuration
+* [#2000](https://github.com/icinga/icinga2/issues/2000) (Metrics): Add OpenTSDB Writer
+* [#1959](https://github.com/icinga/icinga2/issues/1959) (Configuration): extended Manubulon SNMP Check Plugin Command 
+* [#1890](https://github.com/icinga/icinga2/issues/1890) (DB IDO): IDO should fill program\_end\_time on a clean shutdown
+* [#1866](https://github.com/icinga/icinga2/issues/1866) (Notifications): Disable flapping detection by default
+* [#1859](https://github.com/icinga/icinga2/issues/1859): Run CheckCommands with C locale \(workaround for comma vs dot and plugin api bug\)
+* [#1783](https://github.com/icinga/icinga2/issues/1783) (Plugins): Plugin Check Commands: add check\_vmware\_esx
+* [#1733](https://github.com/icinga/icinga2/issues/1733) (Configuration): Disallow side-effect-free r-value expressions in expression lists
+* [#1507](https://github.com/icinga/icinga2/issues/1507): Don't spawn threads for network connections
+* [#404](https://github.com/icinga/icinga2/issues/404) (CLI): Add troubleshooting collect cli command
 
 ### Bug
 
-* [#2707](https://github.com/Icinga/icinga2/issues/2707) (DB IDO): Crash when using ido-pgsql
-* [#2706](https://github.com/Icinga/icinga2/issues/2706): Icinga2 shuts down when service is reloaded
-* [#2703](https://github.com/Icinga/icinga2/issues/2703) (Configuration): Attribute hints don't work for nested attributes
-* [#2699](https://github.com/Icinga/icinga2/issues/2699) (Configuration): Dependency: Validate \*\_{host,service}\_name objects on their existance
-* [#2698](https://github.com/Icinga/icinga2/issues/2698) (Livestatus): Improve Livestatus query performance
-* [#2697](https://github.com/Icinga/icinga2/issues/2697) (Configuration): Memory leak in Expression::GetReference
-* [#2695](https://github.com/Icinga/icinga2/issues/2695) (Configuration): else if doesn't work without an else branch
-* [#2693](https://github.com/Icinga/icinga2/issues/2693): Check whether the new TimePeriod validator is working as expected
-* [#2692](https://github.com/Icinga/icinga2/issues/2692) (CLI): Resource leak in TroubleshootCommand::ObjectInfo
-* [#2691](https://github.com/Icinga/icinga2/issues/2691) (CLI): Resource leak in TroubleshootCommand::Run
-* [#2689](https://github.com/Icinga/icinga2/issues/2689): Check if scheduled downtimes work properly
-* [#2688](https://github.com/Icinga/icinga2/issues/2688) (Plugins): check\_memory tool shows incorrect memory size on windows
-* [#2685](https://github.com/Icinga/icinga2/issues/2685) (Cluster): Don't accept config updates for zones for which we have an authoritative copy of the config
-* [#2684](https://github.com/Icinga/icinga2/issues/2684) (Cluster): Icinga crashed on SocketEvent
-* [#2683](https://github.com/Icinga/icinga2/issues/2683) (Cluster): Crash in ApiClient::TimeoutTimerHandler
-* [#2680](https://github.com/Icinga/icinga2/issues/2680): Deadlock in TlsStream::Handshake
-* [#2679](https://github.com/Icinga/icinga2/issues/2679) (Cluster): Deadlock in ApiClient::Disconnect
-* [#2677](https://github.com/Icinga/icinga2/issues/2677): Crash in SocketEvents::Register
-* [#2676](https://github.com/Icinga/icinga2/issues/2676) (Livestatus): Windows build fails
-* [#2674](https://github.com/Icinga/icinga2/issues/2674) (DB IDO): Hosts: process\_performance\_data = 0 in database even though enable\_perfdata = 1 in config
-* [#2671](https://github.com/Icinga/icinga2/issues/2671) (DB IDO): Crash in DbObject::SendStatusUpdate
-* [#2670](https://github.com/Icinga/icinga2/issues/2670) (Compat): Valgrind warning for ExternalCommandListener::CommandPipeThread
-* [#2669](https://github.com/Icinga/icinga2/issues/2669): Crash in ApiEvents::RepositoryTimerHandler
-* [#2665](https://github.com/Icinga/icinga2/issues/2665) (Livestatus): livestatus limit header not working
-* [#2660](https://github.com/Icinga/icinga2/issues/2660) (Configuration): apply-for incorrectly converts loop var to string
-* [#2659](https://github.com/Icinga/icinga2/issues/2659) (Configuration): Config parser fails non-deterministic on Notification missing Checkable
-* [#2658](https://github.com/Icinga/icinga2/issues/2658) (CLI): Crash in icinga2 console
-* [#2654](https://github.com/Icinga/icinga2/issues/2654) (DB IDO): Deadlock with DB IDO dump and forcing a scheduled check
-* [#2650](https://github.com/Icinga/icinga2/issues/2650) (CLI): SIGSEGV in CLI
-* [#2647](https://github.com/Icinga/icinga2/issues/2647) (DB IDO): Icinga doesn't update long\_output in DB
-* [#2646](https://github.com/Icinga/icinga2/issues/2646) (Cluster): Misleading ApiListener connection log messages on a master \(Endpoint vs Zone\)
-* [#2644](https://github.com/Icinga/icinga2/issues/2644) (CLI): Figure out why 'node update-config' becomes slow over time
-* [#2642](https://github.com/Icinga/icinga2/issues/2642): Icinga 2 sometimes doesn't reconnect to the master
-* [#2641](https://github.com/Icinga/icinga2/issues/2641) (Cluster): ICINGA process crashes every night
-* [#2639](https://github.com/Icinga/icinga2/issues/2639) (CLI): Build fails on Debian squeeze
-* [#2636](https://github.com/Icinga/icinga2/issues/2636): Exception in WorkQueue::StatusTimerHandler
-* [#2631](https://github.com/Icinga/icinga2/issues/2631) (Cluster): deadlock in client connection
-* [#2630](https://github.com/Icinga/icinga2/issues/2630) (Cluster): Don't request heartbeat messages until after we've synced the log
-* [#2627](https://github.com/Icinga/icinga2/issues/2627) (Livestatus): Livestatus query on commands table with custom vars fails
-* [#2626](https://github.com/Icinga/icinga2/issues/2626) (DB IDO): Icinga2 segfaults when issuing postgresql queries
-* [#2622](https://github.com/Icinga/icinga2/issues/2622): "node wizard" crashes
-* [#2621](https://github.com/Icinga/icinga2/issues/2621): Don't attempt to restore program state from non-existing state file
-* [#2618](https://github.com/Icinga/icinga2/issues/2618) (DB IDO): DB IDO {host,service}checks command\_line value is "Object of type 'icinga::Array'"
-* [#2617](https://github.com/Icinga/icinga2/issues/2617) (DB IDO): Indicate that Icinga2 is shutting down in case of a fatal error
-* [#2615](https://github.com/Icinga/icinga2/issues/2615): Make the arguments for the stats functions const-ref
-* [#2613](https://github.com/Icinga/icinga2/issues/2613) (DB IDO): DB IDO: Duplicate entry icinga\_scheduleddowntime
-* [#2608](https://github.com/Icinga/icinga2/issues/2608) (Plugins): Ignore the -X option for check\_disk on Windows
-* [#2605](https://github.com/Icinga/icinga2/issues/2605): Compiler warnings
-* [#2599](https://github.com/Icinga/icinga2/issues/2599) (Cluster): Agent writes CR CR LF in synchronized config files
-* [#2598](https://github.com/Icinga/icinga2/issues/2598): Added downtimes must be triggered immediately if checkable is Not-OK
-* [#2597](https://github.com/Icinga/icinga2/issues/2597) (Cluster): Config sync authoritative file never created
-* [#2596](https://github.com/Icinga/icinga2/issues/2596) (Compat): StatusDataWriter: Wrong host notification filters \(broken fix in \#8192\)
-* [#2593](https://github.com/Icinga/icinga2/issues/2593) (Compat): last\_hard\_state missing in StatusDataWriter
-* [#2589](https://github.com/Icinga/icinga2/issues/2589) (Configuration): Stacktrace on Endpoint not belonging to a zone or multiple zones
-* [#2586](https://github.com/Icinga/icinga2/issues/2586): Icinga2 master doesn't change check-status when "accept\_commands = true" is not set at client node
-* [#2579](https://github.com/Icinga/icinga2/issues/2579) (Configuration): Apply rule '' for host does not match anywhere!
-* [#2572](https://github.com/Icinga/icinga2/issues/2572) (Cluster): Incorrectly formatted timestamp in .timestamp file
-* [#2570](https://github.com/Icinga/icinga2/issues/2570): Crash in ScheduledDowntime::CreateNextDowntime
-* [#2569](https://github.com/Icinga/icinga2/issues/2569): PidPath, VarsPath, ObjectsPath and StatePath no longer read from init.conf
-* [#2566](https://github.com/Icinga/icinga2/issues/2566) (Configuration): Don't allow comparison of strings and numbers
-* [#2562](https://github.com/Icinga/icinga2/issues/2562) (Cluster): ApiListener::ReplayLog shouldn't hold mutex lock during call to Socket::Poll
-* [#2560](https://github.com/Icinga/icinga2/issues/2560): notify flag is ignored in ACKNOWLEDGE\_\*\_PROBLEM commands
-* [#2559](https://github.com/Icinga/icinga2/issues/2559) (DB IDO): Duplicate entry on icinga\_hoststatus
-* [#2556](https://github.com/Icinga/icinga2/issues/2556) (CLI): Running icinga2 command as non privilged user raises error
-* [#2551](https://github.com/Icinga/icinga2/issues/2551) (Livestatus): Livestatus operator =~ is not case-insensitive
-* [#2542](https://github.com/Icinga/icinga2/issues/2542) (CLI): icinga2 node wizard: Create backups of certificates
-* [#2539](https://github.com/Icinga/icinga2/issues/2539) (Cluster): Report missing command objects on remote agent
-* [#2533](https://github.com/Icinga/icinga2/issues/2533) (Cluster): Problems using command\_endpoint inside HA zone
-* [#2529](https://github.com/Icinga/icinga2/issues/2529) (CLI): CLI console fails to report errors in included files
-* [#2526](https://github.com/Icinga/icinga2/issues/2526) (Configuration): Deadlock when accessing loop variable inside of the loop
-* [#2525](https://github.com/Icinga/icinga2/issues/2525) (Configuration): Lexer term for T\_ANGLE\_STRING is too aggressive
-* [#2513](https://github.com/Icinga/icinga2/issues/2513) (CLI): icinga2 node update should not write config for blacklisted zones/host
-* [#2503](https://github.com/Icinga/icinga2/issues/2503) (CLI): Argument auto-completion doesn't work for short options
-* [#2502](https://github.com/Icinga/icinga2/issues/2502): group assign fails with bad lexical cast when evaluating rules
-* [#2497](https://github.com/Icinga/icinga2/issues/2497): Exception on missing config files
-* [#2494](https://github.com/Icinga/icinga2/issues/2494) (Livestatus): Error messages when stopping Icinga
-* [#2493](https://github.com/Icinga/icinga2/issues/2493): Compiler warnings
-* [#2492](https://github.com/Icinga/icinga2/issues/2492): Segfault on icinga::String::operator= when compiling configuration
-* [#2485](https://github.com/Icinga/icinga2/issues/2485) (Configuration): parsing include\_recursive
-* [#2482](https://github.com/Icinga/icinga2/issues/2482) (Configuration): escaped backslash in string literals
-* [#2467](https://github.com/Icinga/icinga2/issues/2467) (CLI): Icinga crashes when config file name is invalid
-* [#2465](https://github.com/Icinga/icinga2/issues/2465) (Configuration): Debug info for indexer is incorrect
-* [#2457](https://github.com/Icinga/icinga2/issues/2457): Config file passing validation causes segfault
-* [#2452](https://github.com/Icinga/icinga2/issues/2452) (Cluster): Agent checks fail when there's already a host with the same name
-* [#2448](https://github.com/Icinga/icinga2/issues/2448) (Configuration): User::ValidateFilters isn't being used
-* [#2447](https://github.com/Icinga/icinga2/issues/2447) (Configuration): ConfigCompilerContext::WriteObject crashes after ConfigCompilerContext::FinishObjectsFile was called
-* [#2445](https://github.com/Icinga/icinga2/issues/2445) (Configuration): segfault on startup
-* [#2442](https://github.com/Icinga/icinga2/issues/2442) (DB IDO): POSTGRES IDO: invalid syntax for integer: "true" while trying to update table icinga\_hoststatus
-* [#2441](https://github.com/Icinga/icinga2/issues/2441) (CLI): console: Don't repeat line when we're reporting an error for the last line
-* [#2436](https://github.com/Icinga/icinga2/issues/2436) (Configuration): Modulo 0 crashes Icinga
-* [#2435](https://github.com/Icinga/icinga2/issues/2435) (Configuration): Location info for strings is incorrect
-* [#2434](https://github.com/Icinga/icinga2/issues/2434) (Configuration): Setting an attribute on an r-value fails
-* [#2433](https://github.com/Icinga/icinga2/issues/2433) (Configuration): Confusing error message when trying to set a field on a string
-* [#2431](https://github.com/Icinga/icinga2/issues/2431) (Configuration): icinga 2 Config Error needs to be more verbose
-* [#2428](https://github.com/Icinga/icinga2/issues/2428) (Configuration): Debug visualizer for the Value class is broken
-* [#2427](https://github.com/Icinga/icinga2/issues/2427) (Configuration): if doesn't work for non-boolean arguments
-* [#2423](https://github.com/Icinga/icinga2/issues/2423) (Configuration): Require at least one user for notification objects \(user or as member of user\_groups\)
-* [#2419](https://github.com/Icinga/icinga2/issues/2419) (Configuration): Confusing error message for import
-* [#2410](https://github.com/Icinga/icinga2/issues/2410): The Boolean type change broke set\_if
-* [#2406](https://github.com/Icinga/icinga2/issues/2406) (Configuration): len\(\) overflows
-* [#2395](https://github.com/Icinga/icinga2/issues/2395) (Configuration): operator precedence for % and \> is incorrect
-* [#2388](https://github.com/Icinga/icinga2/issues/2388): Value\(""\).IsEmpty\(\) should return true
-* [#2379](https://github.com/Icinga/icinga2/issues/2379) (Cluster): Windows Agent: Missing directory "zones" in setup
-* [#2375](https://github.com/Icinga/icinga2/issues/2375) (Configuration): Config validator doesn't show in which file the error was found
-* [#2362](https://github.com/Icinga/icinga2/issues/2362): Serialize\(\) fails to serialize objects which don't have a registered type
-* [#2361](https://github.com/Icinga/icinga2/issues/2361): Fix warnings when using CMake 3.1.0
-* [#2346](https://github.com/Icinga/icinga2/issues/2346) (DB IDO): Missing persistent\_comment, notify\_contact columns for acknowledgement table
-* [#2329](https://github.com/Icinga/icinga2/issues/2329) (Configuration): - shouldn't be allowed in identifiers
-* [#2326](https://github.com/Icinga/icinga2/issues/2326): Compiler warnings
-* [#2320](https://github.com/Icinga/icinga2/issues/2320) (Configuration): - operator doesn't work in expressions
-* [#2319](https://github.com/Icinga/icinga2/issues/2319) (Configuration): Set expression should check whether LHS is a null pointer
-* [#2317](https://github.com/Icinga/icinga2/issues/2317) (Configuration): Validate array subscripts
-* [#2316](https://github.com/Icinga/icinga2/issues/2316) (Configuration): The \_\_return keyword is broken
-* [#2315](https://github.com/Icinga/icinga2/issues/2315) (Configuration): Return values for functions are broken
-* [#2314](https://github.com/Icinga/icinga2/issues/2314): Scoping rules for "for" are broken
-* [#2313](https://github.com/Icinga/icinga2/issues/2313) (Configuration): Unterminated string literals should cause parser to return an error
-* [#2308](https://github.com/Icinga/icinga2/issues/2308) (Configuration): Change parameter type for include and include\_recursive to T\_STRING
-* [#2307](https://github.com/Icinga/icinga2/issues/2307) (Configuration): Fix the shift/reduce conflicts in the parser
-* [#2289](https://github.com/Icinga/icinga2/issues/2289) (DB IDO): DB IDO: Duplicate entry icinga\_{host,service}dependencies
-* [#2274](https://github.com/Icinga/icinga2/issues/2274) (Notifications): Reminder notifications not being sent but logged every 5 secs
-* [#2234](https://github.com/Icinga/icinga2/issues/2234): Avoid rebuilding libbase when the version number changes
-* [#2232](https://github.com/Icinga/icinga2/issues/2232): Unity build doesn't work with MSVC
-* [#2194](https://github.com/Icinga/icinga2/issues/2194) (Configuration): validate configured legacy timeperiod ranges
-* [#2174](https://github.com/Icinga/icinga2/issues/2174) (Configuration): Update validators for CustomVarObject
-* [#2020](https://github.com/Icinga/icinga2/issues/2020) (Configuration): Invalid macro results in exception
-* [#1899](https://github.com/Icinga/icinga2/issues/1899): Scheduled start time will be ignored if the host or service is already in a problem state
-* [#1530](https://github.com/Icinga/icinga2/issues/1530): Remove name and return value for stats functions
+* [#2707](https://github.com/icinga/icinga2/issues/2707) (DB IDO): Crash when using ido-pgsql
+* [#2706](https://github.com/icinga/icinga2/issues/2706): Icinga2 shuts down when service is reloaded
+* [#2703](https://github.com/icinga/icinga2/issues/2703) (Configuration): Attribute hints don't work for nested attributes
+* [#2699](https://github.com/icinga/icinga2/issues/2699) (Configuration): Dependency: Validate \*\_{host,service}\_name objects on their existance
+* [#2698](https://github.com/icinga/icinga2/issues/2698) (Livestatus): Improve Livestatus query performance
+* [#2697](https://github.com/icinga/icinga2/issues/2697) (Configuration): Memory leak in Expression::GetReference
+* [#2695](https://github.com/icinga/icinga2/issues/2695) (Configuration): else if doesn't work without an else branch
+* [#2693](https://github.com/icinga/icinga2/issues/2693): Check whether the new TimePeriod validator is working as expected
+* [#2692](https://github.com/icinga/icinga2/issues/2692) (CLI): Resource leak in TroubleshootCommand::ObjectInfo
+* [#2691](https://github.com/icinga/icinga2/issues/2691) (CLI): Resource leak in TroubleshootCommand::Run
+* [#2689](https://github.com/icinga/icinga2/issues/2689): Check if scheduled downtimes work properly
+* [#2688](https://github.com/icinga/icinga2/issues/2688) (Plugins): check\_memory tool shows incorrect memory size on windows
+* [#2685](https://github.com/icinga/icinga2/issues/2685) (Cluster): Don't accept config updates for zones for which we have an authoritative copy of the config
+* [#2684](https://github.com/icinga/icinga2/issues/2684) (Cluster): Icinga crashed on SocketEvent
+* [#2683](https://github.com/icinga/icinga2/issues/2683) (Cluster): Crash in ApiClient::TimeoutTimerHandler
+* [#2680](https://github.com/icinga/icinga2/issues/2680): Deadlock in TlsStream::Handshake
+* [#2679](https://github.com/icinga/icinga2/issues/2679) (Cluster): Deadlock in ApiClient::Disconnect
+* [#2677](https://github.com/icinga/icinga2/issues/2677): Crash in SocketEvents::Register
+* [#2676](https://github.com/icinga/icinga2/issues/2676) (Livestatus): Windows build fails
+* [#2674](https://github.com/icinga/icinga2/issues/2674) (DB IDO): Hosts: process\_performance\_data = 0 in database even though enable\_perfdata = 1 in config
+* [#2671](https://github.com/icinga/icinga2/issues/2671) (DB IDO): Crash in DbObject::SendStatusUpdate
+* [#2670](https://github.com/icinga/icinga2/issues/2670) (Compat): Valgrind warning for ExternalCommandListener::CommandPipeThread
+* [#2669](https://github.com/icinga/icinga2/issues/2669): Crash in ApiEvents::RepositoryTimerHandler
+* [#2665](https://github.com/icinga/icinga2/issues/2665) (Livestatus): livestatus limit header not working
+* [#2660](https://github.com/icinga/icinga2/issues/2660) (Configuration): apply-for incorrectly converts loop var to string
+* [#2659](https://github.com/icinga/icinga2/issues/2659) (Configuration): Config parser fails non-deterministic on Notification missing Checkable
+* [#2658](https://github.com/icinga/icinga2/issues/2658) (CLI): Crash in icinga2 console
+* [#2654](https://github.com/icinga/icinga2/issues/2654) (DB IDO): Deadlock with DB IDO dump and forcing a scheduled check
+* [#2650](https://github.com/icinga/icinga2/issues/2650) (CLI): SIGSEGV in CLI
+* [#2647](https://github.com/icinga/icinga2/issues/2647) (DB IDO): Icinga doesn't update long\_output in DB
+* [#2646](https://github.com/icinga/icinga2/issues/2646) (Cluster): Misleading ApiListener connection log messages on a master \(Endpoint vs Zone\)
+* [#2644](https://github.com/icinga/icinga2/issues/2644) (CLI): Figure out why 'node update-config' becomes slow over time
+* [#2642](https://github.com/icinga/icinga2/issues/2642): Icinga 2 sometimes doesn't reconnect to the master
+* [#2641](https://github.com/icinga/icinga2/issues/2641) (Cluster): ICINGA process crashes every night
+* [#2639](https://github.com/icinga/icinga2/issues/2639) (CLI): Build fails on Debian squeeze
+* [#2636](https://github.com/icinga/icinga2/issues/2636): Exception in WorkQueue::StatusTimerHandler
+* [#2631](https://github.com/icinga/icinga2/issues/2631) (Cluster): deadlock in client connection
+* [#2630](https://github.com/icinga/icinga2/issues/2630) (Cluster): Don't request heartbeat messages until after we've synced the log
+* [#2627](https://github.com/icinga/icinga2/issues/2627) (Livestatus): Livestatus query on commands table with custom vars fails
+* [#2626](https://github.com/icinga/icinga2/issues/2626) (DB IDO): Icinga2 segfaults when issuing postgresql queries
+* [#2622](https://github.com/icinga/icinga2/issues/2622): "node wizard" crashes
+* [#2621](https://github.com/icinga/icinga2/issues/2621): Don't attempt to restore program state from non-existing state file
+* [#2618](https://github.com/icinga/icinga2/issues/2618) (DB IDO): DB IDO {host,service}checks command\_line value is "Object of type 'icinga::Array'"
+* [#2617](https://github.com/icinga/icinga2/issues/2617) (DB IDO): Indicate that Icinga2 is shutting down in case of a fatal error
+* [#2615](https://github.com/icinga/icinga2/issues/2615): Make the arguments for the stats functions const-ref
+* [#2613](https://github.com/icinga/icinga2/issues/2613) (DB IDO): DB IDO: Duplicate entry icinga\_scheduleddowntime
+* [#2608](https://github.com/icinga/icinga2/issues/2608) (Plugins): Ignore the -X option for check\_disk on Windows
+* [#2605](https://github.com/icinga/icinga2/issues/2605): Compiler warnings
+* [#2599](https://github.com/icinga/icinga2/issues/2599) (Cluster): Agent writes CR CR LF in synchronized config files
+* [#2598](https://github.com/icinga/icinga2/issues/2598): Added downtimes must be triggered immediately if checkable is Not-OK
+* [#2597](https://github.com/icinga/icinga2/issues/2597) (Cluster): Config sync authoritative file never created
+* [#2596](https://github.com/icinga/icinga2/issues/2596) (Compat): StatusDataWriter: Wrong host notification filters \(broken fix in \#8192\)
+* [#2593](https://github.com/icinga/icinga2/issues/2593) (Compat): last\_hard\_state missing in StatusDataWriter
+* [#2589](https://github.com/icinga/icinga2/issues/2589) (Configuration): Stacktrace on Endpoint not belonging to a zone or multiple zones
+* [#2586](https://github.com/icinga/icinga2/issues/2586): Icinga2 master doesn't change check-status when "accept\_commands = true" is not set at client node
+* [#2579](https://github.com/icinga/icinga2/issues/2579) (Configuration): Apply rule '' for host does not match anywhere!
+* [#2572](https://github.com/icinga/icinga2/issues/2572) (Cluster): Incorrectly formatted timestamp in .timestamp file
+* [#2570](https://github.com/icinga/icinga2/issues/2570): Crash in ScheduledDowntime::CreateNextDowntime
+* [#2569](https://github.com/icinga/icinga2/issues/2569): PidPath, VarsPath, ObjectsPath and StatePath no longer read from init.conf
+* [#2566](https://github.com/icinga/icinga2/issues/2566) (Configuration): Don't allow comparison of strings and numbers
+* [#2562](https://github.com/icinga/icinga2/issues/2562) (Cluster): ApiListener::ReplayLog shouldn't hold mutex lock during call to Socket::Poll
+* [#2560](https://github.com/icinga/icinga2/issues/2560): notify flag is ignored in ACKNOWLEDGE\_\*\_PROBLEM commands
+* [#2559](https://github.com/icinga/icinga2/issues/2559) (DB IDO): Duplicate entry on icinga\_hoststatus
+* [#2556](https://github.com/icinga/icinga2/issues/2556) (CLI): Running icinga2 command as non privilged user raises error
+* [#2551](https://github.com/icinga/icinga2/issues/2551) (Livestatus): Livestatus operator =~ is not case-insensitive
+* [#2542](https://github.com/icinga/icinga2/issues/2542) (CLI): icinga2 node wizard: Create backups of certificates
+* [#2539](https://github.com/icinga/icinga2/issues/2539) (Cluster): Report missing command objects on remote agent
+* [#2533](https://github.com/icinga/icinga2/issues/2533) (Cluster): Problems using command\_endpoint inside HA zone
+* [#2529](https://github.com/icinga/icinga2/issues/2529) (CLI): CLI console fails to report errors in included files
+* [#2526](https://github.com/icinga/icinga2/issues/2526) (Configuration): Deadlock when accessing loop variable inside of the loop
+* [#2525](https://github.com/icinga/icinga2/issues/2525) (Configuration): Lexer term for T\_ANGLE\_STRING is too aggressive
+* [#2513](https://github.com/icinga/icinga2/issues/2513) (CLI): icinga2 node update should not write config for blacklisted zones/host
+* [#2503](https://github.com/icinga/icinga2/issues/2503) (CLI): Argument auto-completion doesn't work for short options
+* [#2502](https://github.com/icinga/icinga2/issues/2502): group assign fails with bad lexical cast when evaluating rules
+* [#2497](https://github.com/icinga/icinga2/issues/2497): Exception on missing config files
+* [#2494](https://github.com/icinga/icinga2/issues/2494) (Livestatus): Error messages when stopping Icinga
+* [#2493](https://github.com/icinga/icinga2/issues/2493): Compiler warnings
+* [#2492](https://github.com/icinga/icinga2/issues/2492): Segfault on icinga::String::operator= when compiling configuration
+* [#2485](https://github.com/icinga/icinga2/issues/2485) (Configuration): parsing include\_recursive
+* [#2482](https://github.com/icinga/icinga2/issues/2482) (Configuration): escaped backslash in string literals
+* [#2467](https://github.com/icinga/icinga2/issues/2467) (CLI): Icinga crashes when config file name is invalid
+* [#2465](https://github.com/icinga/icinga2/issues/2465) (Configuration): Debug info for indexer is incorrect
+* [#2457](https://github.com/icinga/icinga2/issues/2457): Config file passing validation causes segfault
+* [#2452](https://github.com/icinga/icinga2/issues/2452) (Cluster): Agent checks fail when there's already a host with the same name
+* [#2448](https://github.com/icinga/icinga2/issues/2448) (Configuration): User::ValidateFilters isn't being used
+* [#2447](https://github.com/icinga/icinga2/issues/2447) (Configuration): ConfigCompilerContext::WriteObject crashes after ConfigCompilerContext::FinishObjectsFile was called
+* [#2445](https://github.com/icinga/icinga2/issues/2445) (Configuration): segfault on startup
+* [#2442](https://github.com/icinga/icinga2/issues/2442) (DB IDO): POSTGRES IDO: invalid syntax for integer: "true" while trying to update table icinga\_hoststatus
+* [#2441](https://github.com/icinga/icinga2/issues/2441) (CLI): console: Don't repeat line when we're reporting an error for the last line
+* [#2436](https://github.com/icinga/icinga2/issues/2436) (Configuration): Modulo 0 crashes Icinga
+* [#2435](https://github.com/icinga/icinga2/issues/2435) (Configuration): Location info for strings is incorrect
+* [#2434](https://github.com/icinga/icinga2/issues/2434) (Configuration): Setting an attribute on an r-value fails
+* [#2433](https://github.com/icinga/icinga2/issues/2433) (Configuration): Confusing error message when trying to set a field on a string
+* [#2431](https://github.com/icinga/icinga2/issues/2431) (Configuration): icinga 2 Config Error needs to be more verbose
+* [#2428](https://github.com/icinga/icinga2/issues/2428) (Configuration): Debug visualizer for the Value class is broken
+* [#2427](https://github.com/icinga/icinga2/issues/2427) (Configuration): if doesn't work for non-boolean arguments
+* [#2423](https://github.com/icinga/icinga2/issues/2423) (Configuration): Require at least one user for notification objects \(user or as member of user\_groups\)
+* [#2419](https://github.com/icinga/icinga2/issues/2419) (Configuration): Confusing error message for import
+* [#2410](https://github.com/icinga/icinga2/issues/2410): The Boolean type change broke set\_if
+* [#2406](https://github.com/icinga/icinga2/issues/2406) (Configuration): len\(\) overflows
+* [#2395](https://github.com/icinga/icinga2/issues/2395) (Configuration): operator precedence for % and \> is incorrect
+* [#2388](https://github.com/icinga/icinga2/issues/2388): Value\(""\).IsEmpty\(\) should return true
+* [#2379](https://github.com/icinga/icinga2/issues/2379) (Cluster): Windows Agent: Missing directory "zones" in setup
+* [#2375](https://github.com/icinga/icinga2/issues/2375) (Configuration): Config validator doesn't show in which file the error was found
+* [#2362](https://github.com/icinga/icinga2/issues/2362): Serialize\(\) fails to serialize objects which don't have a registered type
+* [#2361](https://github.com/icinga/icinga2/issues/2361): Fix warnings when using CMake 3.1.0
+* [#2346](https://github.com/icinga/icinga2/issues/2346) (DB IDO): Missing persistent\_comment, notify\_contact columns for acknowledgement table
+* [#2329](https://github.com/icinga/icinga2/issues/2329) (Configuration): - shouldn't be allowed in identifiers
+* [#2326](https://github.com/icinga/icinga2/issues/2326): Compiler warnings
+* [#2320](https://github.com/icinga/icinga2/issues/2320) (Configuration): - operator doesn't work in expressions
+* [#2319](https://github.com/icinga/icinga2/issues/2319) (Configuration): Set expression should check whether LHS is a null pointer
+* [#2317](https://github.com/icinga/icinga2/issues/2317) (Configuration): Validate array subscripts
+* [#2316](https://github.com/icinga/icinga2/issues/2316) (Configuration): The \_\_return keyword is broken
+* [#2315](https://github.com/icinga/icinga2/issues/2315) (Configuration): Return values for functions are broken
+* [#2314](https://github.com/icinga/icinga2/issues/2314): Scoping rules for "for" are broken
+* [#2313](https://github.com/icinga/icinga2/issues/2313) (Configuration): Unterminated string literals should cause parser to return an error
+* [#2308](https://github.com/icinga/icinga2/issues/2308) (Configuration): Change parameter type for include and include\_recursive to T\_STRING
+* [#2307](https://github.com/icinga/icinga2/issues/2307) (Configuration): Fix the shift/reduce conflicts in the parser
+* [#2289](https://github.com/icinga/icinga2/issues/2289) (DB IDO): DB IDO: Duplicate entry icinga\_{host,service}dependencies
+* [#2274](https://github.com/icinga/icinga2/issues/2274) (Notifications): Reminder notifications not being sent but logged every 5 secs
+* [#2234](https://github.com/icinga/icinga2/issues/2234): Avoid rebuilding libbase when the version number changes
+* [#2232](https://github.com/icinga/icinga2/issues/2232): Unity build doesn't work with MSVC
+* [#2194](https://github.com/icinga/icinga2/issues/2194) (Configuration): validate configured legacy timeperiod ranges
+* [#2174](https://github.com/icinga/icinga2/issues/2174) (Configuration): Update validators for CustomVarObject
+* [#2020](https://github.com/icinga/icinga2/issues/2020) (Configuration): Invalid macro results in exception
+* [#1899](https://github.com/icinga/icinga2/issues/1899): Scheduled start time will be ignored if the host or service is already in a problem state
+* [#1530](https://github.com/icinga/icinga2/issues/1530): Remove name and return value for stats functions
 
 ### ITL
 
-* [#2705](https://github.com/Icinga/icinga2/issues/2705) (ITL): Add check commands for NSClient++
-* [#2661](https://github.com/Icinga/icinga2/issues/2661) (ITL): ITL: The procs check command uses spaces instead of tabs
-* [#2652](https://github.com/Icinga/icinga2/issues/2652) (ITL): Rename PluginsContribDir to PluginContribDir
-* [#2649](https://github.com/Icinga/icinga2/issues/2649) (ITL): Snmp CheckCommand misses various options
-* [#2614](https://github.com/Icinga/icinga2/issues/2614) (ITL): add webinject checkcommand
-* [#2610](https://github.com/Icinga/icinga2/issues/2610) (ITL): Add ITL check command for check\_ipmi\_sensor
-* [#2573](https://github.com/Icinga/icinga2/issues/2573) (ITL): Extend disk checkcommand
-* [#2541](https://github.com/Icinga/icinga2/issues/2541) (ITL): The check "hostalive" is not working with ipv6
-* [#2012](https://github.com/Icinga/icinga2/issues/2012) (ITL): ITL: ESXi-Hardware
-* [#2011](https://github.com/Icinga/icinga2/issues/2011) (ITL): ITL: Check\_Mem.pl
-* [#1984](https://github.com/Icinga/icinga2/issues/1984) (ITL): ITL: Interfacetable
+* [#2705](https://github.com/icinga/icinga2/issues/2705) (ITL): Add check commands for NSClient++
+* [#2661](https://github.com/icinga/icinga2/issues/2661) (ITL): ITL: The procs check command uses spaces instead of tabs
+* [#2652](https://github.com/icinga/icinga2/issues/2652) (ITL): Rename PluginsContribDir to PluginContribDir
+* [#2649](https://github.com/icinga/icinga2/issues/2649) (ITL): Snmp CheckCommand misses various options
+* [#2614](https://github.com/icinga/icinga2/issues/2614) (ITL): add webinject checkcommand
+* [#2610](https://github.com/icinga/icinga2/issues/2610) (ITL): Add ITL check command for check\_ipmi\_sensor
+* [#2573](https://github.com/icinga/icinga2/issues/2573) (ITL): Extend disk checkcommand
+* [#2541](https://github.com/icinga/icinga2/issues/2541) (ITL): The check "hostalive" is not working with ipv6
+* [#2012](https://github.com/icinga/icinga2/issues/2012) (ITL): ITL: ESXi-Hardware
+* [#2011](https://github.com/icinga/icinga2/issues/2011) (ITL): ITL: Check\_Mem.pl
+* [#1984](https://github.com/icinga/icinga2/issues/1984) (ITL): ITL: Interfacetable
 
 ### Documentation
 
-* [#2711](https://github.com/Icinga/icinga2/issues/2711) (Documentation): Document closures \('use'\)
-* [#2709](https://github.com/Icinga/icinga2/issues/2709) (Documentation): Fix a typo in documentation
-* [#2662](https://github.com/Icinga/icinga2/issues/2662) (Documentation): Update Remote Client/Distributed Monitoring Documentation
-* [#2595](https://github.com/Icinga/icinga2/issues/2595) (Documentation): Add documentation for cli command 'console'
-* [#2575](https://github.com/Icinga/icinga2/issues/2575) (Documentation): Remote Clients: Add manual setup cli commands
-* [#2555](https://github.com/Icinga/icinga2/issues/2555) (Documentation): The Zone::global attribute is not documented
-* [#2399](https://github.com/Icinga/icinga2/issues/2399) (Documentation): Allow name changed from inside the object
-* [#2387](https://github.com/Icinga/icinga2/issues/2387) (Documentation): Documentation enhancement for snmp traps and passive checks.
-* [#2321](https://github.com/Icinga/icinga2/issues/2321) (Documentation): Document operator precedence
-* [#2198](https://github.com/Icinga/icinga2/issues/2198) (Documentation): Variable expansion is single quoted.
-* [#1860](https://github.com/Icinga/icinga2/issues/1860) (Documentation): Add some more PNP details
+* [#2711](https://github.com/icinga/icinga2/issues/2711) (Documentation): Document closures \('use'\)
+* [#2709](https://github.com/icinga/icinga2/issues/2709) (Documentation): Fix a typo in documentation
+* [#2662](https://github.com/icinga/icinga2/issues/2662) (Documentation): Update Remote Client/Distributed Monitoring Documentation
+* [#2595](https://github.com/icinga/icinga2/issues/2595) (Documentation): Add documentation for cli command 'console'
+* [#2575](https://github.com/icinga/icinga2/issues/2575) (Documentation): Remote Clients: Add manual setup cli commands
+* [#2555](https://github.com/icinga/icinga2/issues/2555) (Documentation): The Zone::global attribute is not documented
+* [#2399](https://github.com/icinga/icinga2/issues/2399) (Documentation): Allow name changed from inside the object
+* [#2387](https://github.com/icinga/icinga2/issues/2387) (Documentation): Documentation enhancement for snmp traps and passive checks.
+* [#2321](https://github.com/icinga/icinga2/issues/2321) (Documentation): Document operator precedence
+* [#2198](https://github.com/icinga/icinga2/issues/2198) (Documentation): Variable expansion is single quoted.
+* [#1860](https://github.com/icinga/icinga2/issues/1860) (Documentation): Add some more PNP details
 
 ### Support
 
-* [#2616](https://github.com/Icinga/icinga2/issues/2616) (Installation): Build fails on OpenBSD
-* [#2602](https://github.com/Icinga/icinga2/issues/2602) (Packages): Icinga2 config reset after package update \(centos6.6\)
-* [#2511](https://github.com/Icinga/icinga2/issues/2511) (Packages): '../features-available/checker.conf' does not exist \[Windows\]
-* [#2374](https://github.com/Icinga/icinga2/issues/2374) (Packages): Move the config file for the ido-\*sql features into the icinga2-ido-\* packages
-* [#2302](https://github.com/Icinga/icinga2/issues/2302) (Installation): Don't build db\_ido when both MySQL and PostgreSQL aren't enabled
+* [#2616](https://github.com/icinga/icinga2/issues/2616) (Installation): Build fails on OpenBSD
+* [#2602](https://github.com/icinga/icinga2/issues/2602) (Packages): Icinga2 config reset after package update \(centos6.6\)
+* [#2511](https://github.com/icinga/icinga2/issues/2511) (Packages): '../features-available/checker.conf' does not exist \[Windows\]
+* [#2374](https://github.com/icinga/icinga2/issues/2374) (Packages): Move the config file for the ido-\*sql features into the icinga2-ido-\* packages
+* [#2302](https://github.com/icinga/icinga2/issues/2302) (Installation): Don't build db\_ido when both MySQL and PostgreSQL aren't enabled
 
 ## 2.2.4 (2015-02-05)
 
@@ -2557,34 +2609,34 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Bug
 
-* [#2587](https://github.com/Icinga/icinga2/issues/2587) (CLI): Output in "node wizard" is confusing
-* [#2577](https://github.com/Icinga/icinga2/issues/2577) (Compat): enable\_event\_handlers attribute is missing in status.dat
-* [#2571](https://github.com/Icinga/icinga2/issues/2571): Segfault in Checkable::AddNotification
-* [#2561](https://github.com/Icinga/icinga2/issues/2561): Scheduling downtime for host and all services only schedules services
-* [#2558](https://github.com/Icinga/icinga2/issues/2558) (CLI): Restart of Icinga hangs
-* [#2550](https://github.com/Icinga/icinga2/issues/2550) (DB IDO): Crash in DbConnection::ProgramStatusHandler
-* [#2538](https://github.com/Icinga/icinga2/issues/2538) (CLI): Restart fails after deleting a Host
-* [#2508](https://github.com/Icinga/icinga2/issues/2508) (Compat): Feature statusdata shows wrong host notification options
-* [#2481](https://github.com/Icinga/icinga2/issues/2481) (CLI): Satellite doesn't use manually supplied 'local zone name'
-* [#2464](https://github.com/Icinga/icinga2/issues/2464): vfork\(\) hangs on OS X
-* [#2256](https://github.com/Icinga/icinga2/issues/2256) (Notifications): kUn-Bashify mail-{host,service}-notification.sh
-* [#2242](https://github.com/Icinga/icinga2/issues/2242): livestatus / nsca / etc submits are ignored during reload
-* [#1893](https://github.com/Icinga/icinga2/issues/1893): Configured recurring downtimes not applied on saturdays
+* [#2587](https://github.com/icinga/icinga2/issues/2587) (CLI): Output in "node wizard" is confusing
+* [#2577](https://github.com/icinga/icinga2/issues/2577) (Compat): enable\_event\_handlers attribute is missing in status.dat
+* [#2571](https://github.com/icinga/icinga2/issues/2571): Segfault in Checkable::AddNotification
+* [#2561](https://github.com/icinga/icinga2/issues/2561): Scheduling downtime for host and all services only schedules services
+* [#2558](https://github.com/icinga/icinga2/issues/2558) (CLI): Restart of Icinga hangs
+* [#2550](https://github.com/icinga/icinga2/issues/2550) (DB IDO): Crash in DbConnection::ProgramStatusHandler
+* [#2538](https://github.com/icinga/icinga2/issues/2538) (CLI): Restart fails after deleting a Host
+* [#2508](https://github.com/icinga/icinga2/issues/2508) (Compat): Feature statusdata shows wrong host notification options
+* [#2481](https://github.com/icinga/icinga2/issues/2481) (CLI): Satellite doesn't use manually supplied 'local zone name'
+* [#2464](https://github.com/icinga/icinga2/issues/2464): vfork\(\) hangs on OS X
+* [#2256](https://github.com/icinga/icinga2/issues/2256) (Notifications): kUn-Bashify mail-{host,service}-notification.sh
+* [#2242](https://github.com/icinga/icinga2/issues/2242): livestatus / nsca / etc submits are ignored during reload
+* [#1893](https://github.com/icinga/icinga2/issues/1893): Configured recurring downtimes not applied on saturdays
 
 ### ITL
 
-* [#2532](https://github.com/Icinga/icinga2/issues/2532) (ITL): check\_ssmtp command does NOT support mail\_from
+* [#2532](https://github.com/icinga/icinga2/issues/2532) (ITL): check\_ssmtp command does NOT support mail\_from
 
 ### Documentation
 
-* [#2521](https://github.com/Icinga/icinga2/issues/2521) (Documentation): Typos in readme file for windows plugins
-* [#2520](https://github.com/Icinga/icinga2/issues/2520) (Documentation): inconsistent URL http\(s\)://www.icinga.org
-* [#2512](https://github.com/Icinga/icinga2/issues/2512) (Documentation): Update Icinga Web 2 uri to /icingaweb2
+* [#2521](https://github.com/icinga/icinga2/issues/2521) (Documentation): Typos in readme file for windows plugins
+* [#2520](https://github.com/icinga/icinga2/issues/2520) (Documentation): inconsistent URL http\(s\)://www.icinga.org
+* [#2512](https://github.com/icinga/icinga2/issues/2512) (Documentation): Update Icinga Web 2 uri to /icingaweb2
 
 ### Support
 
-* [#2517](https://github.com/Icinga/icinga2/issues/2517) (Packages): Fix YAJL detection on Debian squeeze
-* [#2462](https://github.com/Icinga/icinga2/issues/2462) (Packages): Icinga 2.2.2 build fails on SLES11SP3 because of changed boost dependency
+* [#2517](https://github.com/icinga/icinga2/issues/2517) (Packages): Fix YAJL detection on Debian squeeze
+* [#2462](https://github.com/icinga/icinga2/issues/2462) (Packages): Icinga 2.2.2 build fails on SLES11SP3 because of changed boost dependency
 
 ## 2.2.3 (2015-01-12)
 
@@ -2594,23 +2646,23 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Bug
 
-* [#2499](https://github.com/Icinga/icinga2/issues/2499) (CLI): Segfault on update-config old empty config
-* [#2498](https://github.com/Icinga/icinga2/issues/2498) (CLI): icinga2 node update config shows hex instead of human readable names
-* [#2496](https://github.com/Icinga/icinga2/issues/2496): Icinga 2.2.2 segfaults on FreeBSD
-* [#2477](https://github.com/Icinga/icinga2/issues/2477): DB IDO query queue limit reached on reload
-* [#2473](https://github.com/Icinga/icinga2/issues/2473) (CLI): check\_interval must be greater than 0 error on update-config
-* [#2471](https://github.com/Icinga/icinga2/issues/2471) (Cluster): Arguments without values are not used on plugin exec
-* [#2470](https://github.com/Icinga/icinga2/issues/2470) (Plugins): Windows plugin check\_service.exe can't find service NTDS
-* [#2459](https://github.com/Icinga/icinga2/issues/2459) (CLI): Incorrect ticket shouldn't cause "node wizard" to terminate
-* [#2420](https://github.com/Icinga/icinga2/issues/2420) (Notifications): Volatile checks trigger invalid notifications on OK-\>OK state changes
+* [#2499](https://github.com/icinga/icinga2/issues/2499) (CLI): Segfault on update-config old empty config
+* [#2498](https://github.com/icinga/icinga2/issues/2498) (CLI): icinga2 node update config shows hex instead of human readable names
+* [#2496](https://github.com/icinga/icinga2/issues/2496): Icinga 2.2.2 segfaults on FreeBSD
+* [#2477](https://github.com/icinga/icinga2/issues/2477): DB IDO query queue limit reached on reload
+* [#2473](https://github.com/icinga/icinga2/issues/2473) (CLI): check\_interval must be greater than 0 error on update-config
+* [#2471](https://github.com/icinga/icinga2/issues/2471) (Cluster): Arguments without values are not used on plugin exec
+* [#2470](https://github.com/icinga/icinga2/issues/2470) (Plugins): Windows plugin check\_service.exe can't find service NTDS
+* [#2459](https://github.com/icinga/icinga2/issues/2459) (CLI): Incorrect ticket shouldn't cause "node wizard" to terminate
+* [#2420](https://github.com/icinga/icinga2/issues/2420) (Notifications): Volatile checks trigger invalid notifications on OK-\>OK state changes
 
 ### Documentation
 
-* [#2490](https://github.com/Icinga/icinga2/issues/2490) (Documentation): Typo in example of StatusDataWriter
+* [#2490](https://github.com/icinga/icinga2/issues/2490) (Documentation): Typo in example of StatusDataWriter
 
 ### Support
 
-* [#2460](https://github.com/Icinga/icinga2/issues/2460) (Packages): Icinga 2.2.2 doesn't build on i586 SUSE distributions
+* [#2460](https://github.com/icinga/icinga2/issues/2460) (Packages): Icinga 2.2.2 doesn't build on i586 SUSE distributions
 
 ## 2.2.2 (2014-12-18)
 
@@ -2620,50 +2672,50 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Bug
 
-* [#2446](https://github.com/Icinga/icinga2/issues/2446) (Compat): StatusDataWriter: Wrong export of event\_handler\_enabled
-* [#2444](https://github.com/Icinga/icinga2/issues/2444) (CLI): Remove usage info from --version
-* [#2416](https://github.com/Icinga/icinga2/issues/2416) (DB IDO): DB IDO: Missing last\_hard\_state column update in {host,service}status tables
-* [#2411](https://github.com/Icinga/icinga2/issues/2411): exception during config check
-* [#2394](https://github.com/Icinga/icinga2/issues/2394): typeof does not work for numbers
-* [#2381](https://github.com/Icinga/icinga2/issues/2381): SIGABRT while evaluating apply rules
-* [#2380](https://github.com/Icinga/icinga2/issues/2380) (Configuration): typeof\(\) seems to return null for arrays and dictionaries
-* [#2376](https://github.com/Icinga/icinga2/issues/2376) (Configuration): Apache 2.2 fails with new apache conf
-* [#2371](https://github.com/Icinga/icinga2/issues/2371) (Configuration): Test Classic UI config file with Apache 2.4
-* [#2370](https://github.com/Icinga/icinga2/issues/2370) (Cluster): update\_config not updating configuration
-* [#2360](https://github.com/Icinga/icinga2/issues/2360): CLI `icinga2 node update-config` doesn't sync configs from remote clients as expected
-* [#2354](https://github.com/Icinga/icinga2/issues/2354) (DB IDO): Improve error reporting when libmysqlclient or libpq are missing
-* [#2350](https://github.com/Icinga/icinga2/issues/2350) (Cluster): Segfault on issuing node update-config
-* [#2341](https://github.com/Icinga/icinga2/issues/2341) (Cluster): execute checks locally if command\_endpoint == local endpoint
-* [#2283](https://github.com/Icinga/icinga2/issues/2283) (Cluster): Cluster heartbeats need to be more aggressive
-* [#2266](https://github.com/Icinga/icinga2/issues/2266) (CLI): "node wizard" shouldn't crash when SaveCert fails
-* [#2255](https://github.com/Icinga/icinga2/issues/2255) (DB IDO): If a parent host goes down, the child host isn't marked as unrechable in the db ido
-* [#2216](https://github.com/Icinga/icinga2/issues/2216) (Cluster): Repository does not support services which have a slash in their name
-* [#2202](https://github.com/Icinga/icinga2/issues/2202) (Configuration): CPU usage at 100% when check\_interval = 0 in host object definition 
-* [#2154](https://github.com/Icinga/icinga2/issues/2154) (Cluster): update-config fails to create hosts
-* [#2148](https://github.com/Icinga/icinga2/issues/2148) (Compat): Feature `compatlog' should flush output buffer on every new line
-* [#2021](https://github.com/Icinga/icinga2/issues/2021): double macros in command arguments seems to lead to exception
-* [#2016](https://github.com/Icinga/icinga2/issues/2016) (Notifications): Docs: Better explaination of dependency state filters
-* [#1947](https://github.com/Icinga/icinga2/issues/1947) (Livestatus): Missing host downtimes/comments in Livestatus
+* [#2446](https://github.com/icinga/icinga2/issues/2446) (Compat): StatusDataWriter: Wrong export of event\_handler\_enabled
+* [#2444](https://github.com/icinga/icinga2/issues/2444) (CLI): Remove usage info from --version
+* [#2416](https://github.com/icinga/icinga2/issues/2416) (DB IDO): DB IDO: Missing last\_hard\_state column update in {host,service}status tables
+* [#2411](https://github.com/icinga/icinga2/issues/2411): exception during config check
+* [#2394](https://github.com/icinga/icinga2/issues/2394): typeof does not work for numbers
+* [#2381](https://github.com/icinga/icinga2/issues/2381): SIGABRT while evaluating apply rules
+* [#2380](https://github.com/icinga/icinga2/issues/2380) (Configuration): typeof\(\) seems to return null for arrays and dictionaries
+* [#2376](https://github.com/icinga/icinga2/issues/2376) (Configuration): Apache 2.2 fails with new apache conf
+* [#2371](https://github.com/icinga/icinga2/issues/2371) (Configuration): Test Classic UI config file with Apache 2.4
+* [#2370](https://github.com/icinga/icinga2/issues/2370) (Cluster): update\_config not updating configuration
+* [#2360](https://github.com/icinga/icinga2/issues/2360): CLI `icinga2 node update-config` doesn't sync configs from remote clients as expected
+* [#2354](https://github.com/icinga/icinga2/issues/2354) (DB IDO): Improve error reporting when libmysqlclient or libpq are missing
+* [#2350](https://github.com/icinga/icinga2/issues/2350) (Cluster): Segfault on issuing node update-config
+* [#2341](https://github.com/icinga/icinga2/issues/2341) (Cluster): execute checks locally if command\_endpoint == local endpoint
+* [#2283](https://github.com/icinga/icinga2/issues/2283) (Cluster): Cluster heartbeats need to be more aggressive
+* [#2266](https://github.com/icinga/icinga2/issues/2266) (CLI): "node wizard" shouldn't crash when SaveCert fails
+* [#2255](https://github.com/icinga/icinga2/issues/2255) (DB IDO): If a parent host goes down, the child host isn't marked as unrechable in the db ido
+* [#2216](https://github.com/icinga/icinga2/issues/2216) (Cluster): Repository does not support services which have a slash in their name
+* [#2202](https://github.com/icinga/icinga2/issues/2202) (Configuration): CPU usage at 100% when check\_interval = 0 in host object definition 
+* [#2154](https://github.com/icinga/icinga2/issues/2154) (Cluster): update-config fails to create hosts
+* [#2148](https://github.com/icinga/icinga2/issues/2148) (Compat): Feature `compatlog' should flush output buffer on every new line
+* [#2021](https://github.com/icinga/icinga2/issues/2021): double macros in command arguments seems to lead to exception
+* [#2016](https://github.com/icinga/icinga2/issues/2016) (Notifications): Docs: Better explaination of dependency state filters
+* [#1947](https://github.com/icinga/icinga2/issues/1947) (Livestatus): Missing host downtimes/comments in Livestatus
 
 ### ITL
 
-* [#2430](https://github.com/Icinga/icinga2/issues/2430) (ITL): No option to specify timeout to check\_snmp and snmp manubulon commands
+* [#2430](https://github.com/icinga/icinga2/issues/2430) (ITL): No option to specify timeout to check\_snmp and snmp manubulon commands
 
 ### Documentation
 
-* [#2422](https://github.com/Icinga/icinga2/issues/2422) (Documentation): Setting a dictionary key to null does not cause the key/value to be removed
-* [#2412](https://github.com/Icinga/icinga2/issues/2412) (Documentation): Update host examples in Dependencies for Network Reachability documentation
-* [#2409](https://github.com/Icinga/icinga2/issues/2409) (Documentation): Wrong command in documentation for installing Icinga 2 pretty printers.
-* [#2404](https://github.com/Icinga/icinga2/issues/2404) (Documentation): Livestatus: Replace unixcat with nc -U 
-* [#2180](https://github.com/Icinga/icinga2/issues/2180) (Documentation): Documentation: Add note on default notification interval in getting started notifications.conf
+* [#2422](https://github.com/icinga/icinga2/issues/2422) (Documentation): Setting a dictionary key to null does not cause the key/value to be removed
+* [#2412](https://github.com/icinga/icinga2/issues/2412) (Documentation): Update host examples in Dependencies for Network Reachability documentation
+* [#2409](https://github.com/icinga/icinga2/issues/2409) (Documentation): Wrong command in documentation for installing Icinga 2 pretty printers.
+* [#2404](https://github.com/icinga/icinga2/issues/2404) (Documentation): Livestatus: Replace unixcat with nc -U 
+* [#2180](https://github.com/icinga/icinga2/issues/2180) (Documentation): Documentation: Add note on default notification interval in getting started notifications.conf
 
 ### Support
 
-* [#2417](https://github.com/Icinga/icinga2/issues/2417) (Tests): Unit tests fail on FreeBSD
-* [#2369](https://github.com/Icinga/icinga2/issues/2369) (Packages): SUSE packages %set\_permissions post statement wasn't moved to common
-* [#2368](https://github.com/Icinga/icinga2/issues/2368) (Packages): /usr/lib/icinga2 is not owned by a package
-* [#2292](https://github.com/Icinga/icinga2/issues/2292) (Tests): The unit tests still crash sometimes
-* [#1942](https://github.com/Icinga/icinga2/issues/1942) (Packages): icinga2 init-script doesn't validate configuration on reload action
+* [#2417](https://github.com/icinga/icinga2/issues/2417) (Tests): Unit tests fail on FreeBSD
+* [#2369](https://github.com/icinga/icinga2/issues/2369) (Packages): SUSE packages %set\_permissions post statement wasn't moved to common
+* [#2368](https://github.com/icinga/icinga2/issues/2368) (Packages): /usr/lib/icinga2 is not owned by a package
+* [#2292](https://github.com/icinga/icinga2/issues/2292) (Tests): The unit tests still crash sometimes
+* [#1942](https://github.com/icinga/icinga2/issues/1942) (Packages): icinga2 init-script doesn't validate configuration on reload action
 
 ## 2.2.1 (2014-12-01)
 
@@ -2675,47 +2727,47 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Enhancement
 
-* [#2366](https://github.com/Icinga/icinga2/issues/2366): Release 2.2.1
-* [#2277](https://github.com/Icinga/icinga2/issues/2277) (Configuration): The classicui Apache conf doesn't support Apache 2.4
-* [#1790](https://github.com/Icinga/icinga2/issues/1790): Support for arrays in macros
+* [#2366](https://github.com/icinga/icinga2/issues/2366): Release 2.2.1
+* [#2277](https://github.com/icinga/icinga2/issues/2277) (Configuration): The classicui Apache conf doesn't support Apache 2.4
+* [#1790](https://github.com/icinga/icinga2/issues/1790): Support for arrays in macros
 
 ### Bug
 
-* [#2340](https://github.com/Icinga/icinga2/issues/2340) (CLI): Segfault in CA handling
-* [#2328](https://github.com/Icinga/icinga2/issues/2328) (Cluster): Verify if master radio box is disabled in the Windows wizard
-* [#2311](https://github.com/Icinga/icinga2/issues/2311) (Configuration): !in operator returns incorrect result
-* [#2293](https://github.com/Icinga/icinga2/issues/2293) (Configuration): Objects created with node update-config can't be seen in Classic UI
-* [#2288](https://github.com/Icinga/icinga2/issues/2288) (Cluster): Incorrect error message for localhost
-* [#2282](https://github.com/Icinga/icinga2/issues/2282) (Cluster): Icinga2 node add failed with unhandled exception
-* [#2273](https://github.com/Icinga/icinga2/issues/2273): Restart Icinga - Error Restoring program state from file '/var/lib/icinga2/icinga2.state'
-* [#2272](https://github.com/Icinga/icinga2/issues/2272) (Cluster): Windows wizard is missing --zone argument
-* [#2271](https://github.com/Icinga/icinga2/issues/2271) (Cluster): Windows wizard uses incorrect CLI command
-* [#2267](https://github.com/Icinga/icinga2/issues/2267) (Cluster): Built-in commands shouldn't be run on the master instance in remote command execution mode
-* [#2207](https://github.com/Icinga/icinga2/issues/2207) (Livestatus): livestatus large amount of submitting unix socket command results in broken pipes
+* [#2340](https://github.com/icinga/icinga2/issues/2340) (CLI): Segfault in CA handling
+* [#2328](https://github.com/icinga/icinga2/issues/2328) (Cluster): Verify if master radio box is disabled in the Windows wizard
+* [#2311](https://github.com/icinga/icinga2/issues/2311) (Configuration): !in operator returns incorrect result
+* [#2293](https://github.com/icinga/icinga2/issues/2293) (Configuration): Objects created with node update-config can't be seen in Classic UI
+* [#2288](https://github.com/icinga/icinga2/issues/2288) (Cluster): Incorrect error message for localhost
+* [#2282](https://github.com/icinga/icinga2/issues/2282) (Cluster): Icinga2 node add failed with unhandled exception
+* [#2273](https://github.com/icinga/icinga2/issues/2273): Restart Icinga - Error Restoring program state from file '/var/lib/icinga2/icinga2.state'
+* [#2272](https://github.com/icinga/icinga2/issues/2272) (Cluster): Windows wizard is missing --zone argument
+* [#2271](https://github.com/icinga/icinga2/issues/2271) (Cluster): Windows wizard uses incorrect CLI command
+* [#2267](https://github.com/icinga/icinga2/issues/2267) (Cluster): Built-in commands shouldn't be run on the master instance in remote command execution mode
+* [#2207](https://github.com/icinga/icinga2/issues/2207) (Livestatus): livestatus large amount of submitting unix socket command results in broken pipes
 
 ### ITL
 
-* [#2285](https://github.com/Icinga/icinga2/issues/2285) (ITL): Increase default timeout for NRPE checks
+* [#2285](https://github.com/icinga/icinga2/issues/2285) (ITL): Increase default timeout for NRPE checks
 
 ### Documentation
 
-* [#2344](https://github.com/Icinga/icinga2/issues/2344) (Documentation): Documentation: Explain how unresolved macros are handled
-* [#2343](https://github.com/Icinga/icinga2/issues/2343) (Documentation): Document how arrays in macros work
-* [#2336](https://github.com/Icinga/icinga2/issues/2336) (Documentation): Wrong information in section "Linux Client Setup Wizard for Remote Monitoring"
-* [#2275](https://github.com/Icinga/icinga2/issues/2275) (Documentation): 2.2.0 has out-of-date icinga2 man page
-* [#2251](https://github.com/Icinga/icinga2/issues/2251) (Documentation): object and template with the same name generate duplicate object error
+* [#2344](https://github.com/icinga/icinga2/issues/2344) (Documentation): Documentation: Explain how unresolved macros are handled
+* [#2343](https://github.com/icinga/icinga2/issues/2343) (Documentation): Document how arrays in macros work
+* [#2336](https://github.com/icinga/icinga2/issues/2336) (Documentation): Wrong information in section "Linux Client Setup Wizard for Remote Monitoring"
+* [#2275](https://github.com/icinga/icinga2/issues/2275) (Documentation): 2.2.0 has out-of-date icinga2 man page
+* [#2251](https://github.com/icinga/icinga2/issues/2251) (Documentation): object and template with the same name generate duplicate object error
 
 ### Support
 
-* [#2363](https://github.com/Icinga/icinga2/issues/2363) (Packages): Fix Apache config in the Debian package
-* [#2359](https://github.com/Icinga/icinga2/issues/2359) (Packages): Wrong permission in run directory after restart
-* [#2301](https://github.com/Icinga/icinga2/issues/2301) (Packages): Move the icinga2-prepare-dirs script elsewhere
-* [#2280](https://github.com/Icinga/icinga2/issues/2280) (Packages): Icinga 2.2 misses the build requirement libyajl-devel for SUSE distributions
-* [#2278](https://github.com/Icinga/icinga2/issues/2278) (Packages): /usr/sbin/icinga-prepare-dirs conflicts in the bin and common package
-* [#2276](https://github.com/Icinga/icinga2/issues/2276) (Packages): Systemd rpm scripts are run in wrong package
-* [#2212](https://github.com/Icinga/icinga2/issues/2212) (Packages): icinga2 checkconfig should fail if group given for command files does not exist
-* [#2117](https://github.com/Icinga/icinga2/issues/2117) (Packages): Update spec file to use yajl-devel
-* [#1968](https://github.com/Icinga/icinga2/issues/1968) (Packages): service icinga2 status gives wrong information when run as unprivileged user
+* [#2363](https://github.com/icinga/icinga2/issues/2363) (Packages): Fix Apache config in the Debian package
+* [#2359](https://github.com/icinga/icinga2/issues/2359) (Packages): Wrong permission in run directory after restart
+* [#2301](https://github.com/icinga/icinga2/issues/2301) (Packages): Move the icinga2-prepare-dirs script elsewhere
+* [#2280](https://github.com/icinga/icinga2/issues/2280) (Packages): Icinga 2.2 misses the build requirement libyajl-devel for SUSE distributions
+* [#2278](https://github.com/icinga/icinga2/issues/2278) (Packages): /usr/sbin/icinga-prepare-dirs conflicts in the bin and common package
+* [#2276](https://github.com/icinga/icinga2/issues/2276) (Packages): Systemd rpm scripts are run in wrong package
+* [#2212](https://github.com/icinga/icinga2/issues/2212) (Packages): icinga2 checkconfig should fail if group given for command files does not exist
+* [#2117](https://github.com/icinga/icinga2/issues/2117) (Packages): Update spec file to use yajl-devel
+* [#1968](https://github.com/icinga/icinga2/issues/1968) (Packages): service icinga2 status gives wrong information when run as unprivileged user
 
 ## 2.2.0 (2014-11-17)
 
@@ -2764,230 +2816,230 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Enhancement
 
-* [#2219](https://github.com/Icinga/icinga2/issues/2219): Icinga 2 should use less RAM
-* [#2217](https://github.com/Icinga/icinga2/issues/2217) (Performance Data): Add GelfWriter for writing log events to graylog2/logstash
-* [#2213](https://github.com/Icinga/icinga2/issues/2213): Optimize class layout
-* [#2203](https://github.com/Icinga/icinga2/issues/2203) (Configuration): Revamp sample configuration: add NodeName host, move services into apply rules schema
-* [#2189](https://github.com/Icinga/icinga2/issues/2189) (Configuration): Refactor AST into multiple classes
-* [#2187](https://github.com/Icinga/icinga2/issues/2187) (Configuration): Implement support for arbitrarily complex indexers
-* [#2184](https://github.com/Icinga/icinga2/issues/2184) (Configuration): Generate objects using apply with foreach in arrays or dictionaries \(key =\> value\)
-* [#2183](https://github.com/Icinga/icinga2/issues/2183) (Configuration): Support dictionaries in custom attributes
-* [#2182](https://github.com/Icinga/icinga2/issues/2182) (Cluster): Execute remote commands on the agent w/o local objects by passing custom attributes
-* [#2179](https://github.com/Icinga/icinga2/issues/2179): Implement keys\(\)
-* [#2178](https://github.com/Icinga/icinga2/issues/2178) (CLI): Cli command Node: Disable notifications feature on client nodes
-* [#2161](https://github.com/Icinga/icinga2/issues/2161) (CLI): Cli Command: Rename 'agent' to 'node'
-* [#2158](https://github.com/Icinga/icinga2/issues/2158) (Cluster): Require --zone to be specified for "node setup"
-* [#2152](https://github.com/Icinga/icinga2/issues/2152) (Cluster): Rename --agent to --zone \(for blacklist/whitelist\)
-* [#2140](https://github.com/Icinga/icinga2/issues/2140) (CLI): Cli: Use Node Blacklist functionality in 'node update-config'
-* [#2138](https://github.com/Icinga/icinga2/issues/2138) (CLI): Find a better name for 'repository commit --clear'
-* [#2131](https://github.com/Icinga/icinga2/issues/2131) (Configuration): Set host/service variable in apply rules
-* [#2124](https://github.com/Icinga/icinga2/issues/2124) (Configuration): Update downtimes.conf example config
-* [#2119](https://github.com/Icinga/icinga2/issues/2119) (Cluster): Remove virtual agent name feature for localhost
-* [#2118](https://github.com/Icinga/icinga2/issues/2118) (CLI): Cli command: Node Setup Wizard \(for Satellites and Agents\)
-* [#2115](https://github.com/Icinga/icinga2/issues/2115) (CLI): Cli command: Repository remove host should remove host.conf host/ dir with services
-* [#2113](https://github.com/Icinga/icinga2/issues/2113) (CLI): validate repository config updates
-* [#2108](https://github.com/Icinga/icinga2/issues/2108): Only build YAJL when there's no system-provided version available
-* [#2107](https://github.com/Icinga/icinga2/issues/2107): Replace cJSON with a better JSON parser
-* [#2104](https://github.com/Icinga/icinga2/issues/2104) (CLI): Use "variable get" for "pki ticket"
-* [#2103](https://github.com/Icinga/icinga2/issues/2103) (CLI): Validate number of arguments
-* [#2098](https://github.com/Icinga/icinga2/issues/2098) (CLI): Support for writing api.conf
-* [#2096](https://github.com/Icinga/icinga2/issues/2096) (CLI): Cli command: pki needs option to define the algorithm
-* [#2092](https://github.com/Icinga/icinga2/issues/2092) (CLI): Rename PKI arguments
-* [#2088](https://github.com/Icinga/icinga2/issues/2088) (CLI): Cli command: Node Setup
-* [#2087](https://github.com/Icinga/icinga2/issues/2087) (CLI): "pki request" should ask user to verify the peer's certificate
-* [#2086](https://github.com/Icinga/icinga2/issues/2086) (CLI): Add -h next to --help
-* [#2085](https://github.com/Icinga/icinga2/issues/2085) (CLI): Remove "available features" list from "feature list"
-* [#2084](https://github.com/Icinga/icinga2/issues/2084) (CLI): Implement "feature disable" for Windows
-* [#2081](https://github.com/Icinga/icinga2/issues/2081) (CLI): CLI: List disabled features in feature list too
-* [#2079](https://github.com/Icinga/icinga2/issues/2079): Move WSAStartup call to INITIALIZE\_ONCE
-* [#2076](https://github.com/Icinga/icinga2/issues/2076) (CLI): Implement field attribute to hide fields in command auto-completion
-* [#2074](https://github.com/Icinga/icinga2/issues/2074) (CLI): Add autocomplete to 'host/service add' for object attributes \(e.g. --check\_interval\)
-* [#2073](https://github.com/Icinga/icinga2/issues/2073) (Configuration): Remove zone keyword and allow to use object attribute 'zone'
-* [#2071](https://github.com/Icinga/icinga2/issues/2071) (Configuration): Move localhost config into repository
-* [#2069](https://github.com/Icinga/icinga2/issues/2069) (CLI): Implement generic color support for terminals
-* [#2066](https://github.com/Icinga/icinga2/issues/2066) (CLI): Implement support for serial files
-* [#2064](https://github.com/Icinga/icinga2/issues/2064) (DB IDO): Add program\_version column to programstatus table
-* [#2062](https://github.com/Icinga/icinga2/issues/2062): Release 2.2
-* [#2059](https://github.com/Icinga/icinga2/issues/2059) (CLI): Auto-completion for feature enable/disable
-* [#2055](https://github.com/Icinga/icinga2/issues/2055) (CLI): Windows support for cli command feature
-* [#2054](https://github.com/Icinga/icinga2/issues/2054) (CLI): CLI Commands: Remove timestamp prefix when logging output
-* [#2053](https://github.com/Icinga/icinga2/issues/2053) (CLI): autocomplete should support '--key value'
-* [#2050](https://github.com/Icinga/icinga2/issues/2050) (CLI): Cli command parser must support unregistered boost::program\_options
-* [#2049](https://github.com/Icinga/icinga2/issues/2049) (CLI): CLI command: variable
-* [#2046](https://github.com/Icinga/icinga2/issues/2046) (Graphite): GraphiteWriter: Add warn/crit/min/max perfdata values if existing
-* [#2031](https://github.com/Icinga/icinga2/issues/2031) (Graphite): GraphiteWriter: Add support for customized metric prefix names
-* [#2003](https://github.com/Icinga/icinga2/issues/2003): macro processor needs an array printer
-* [#1999](https://github.com/Icinga/icinga2/issues/1999) (CLI): Cli command: Repository
-* [#1997](https://github.com/Icinga/icinga2/issues/1997) (CLI): Cli Commands: Node Repository Blacklist & Whitelist
-* [#1996](https://github.com/Icinga/icinga2/issues/1996) (CLI): Cli command: SCM
-* [#1995](https://github.com/Icinga/icinga2/issues/1995) (CLI): Cli command: Object
-* [#1994](https://github.com/Icinga/icinga2/issues/1994) (CLI): Cli command: Feature
-* [#1993](https://github.com/Icinga/icinga2/issues/1993) (CLI): Node Repository
-* [#1992](https://github.com/Icinga/icinga2/issues/1992) (CLI): Cli command: Node
-* [#1991](https://github.com/Icinga/icinga2/issues/1991) (CLI): Cli command: pki
-* [#1990](https://github.com/Icinga/icinga2/issues/1990) (CLI): Cli command framework
-* [#1989](https://github.com/Icinga/icinga2/issues/1989) (CLI): Cli commands
-* [#1988](https://github.com/Icinga/icinga2/issues/1988) (Cluster): CSR auto-signing
-* [#1987](https://github.com/Icinga/icinga2/issues/1987) (Plugins): Windows plugins
-* [#1986](https://github.com/Icinga/icinga2/issues/1986) (Cluster): Windows Wizard
-* [#1977](https://github.com/Icinga/icinga2/issues/1977) (CLI): Cli commands: add filter capability to 'object list'
-* [#1901](https://github.com/Icinga/icinga2/issues/1901) (Cluster): Windows installer
-* [#1895](https://github.com/Icinga/icinga2/issues/1895) (Graphite): Add downtime depth as statistic metric for GraphiteWriter
-* [#1717](https://github.com/Icinga/icinga2/issues/1717) (Configuration): Support for array in custom variable.
-* [#894](https://github.com/Icinga/icinga2/issues/894): Add copyright header to .ti files and add support for comments in mkclass
+* [#2219](https://github.com/icinga/icinga2/issues/2219): Icinga 2 should use less RAM
+* [#2217](https://github.com/icinga/icinga2/issues/2217) (Metrics): Add GelfWriter for writing log events to graylog2/logstash
+* [#2213](https://github.com/icinga/icinga2/issues/2213): Optimize class layout
+* [#2203](https://github.com/icinga/icinga2/issues/2203) (Configuration): Revamp sample configuration: add NodeName host, move services into apply rules schema
+* [#2189](https://github.com/icinga/icinga2/issues/2189) (Configuration): Refactor AST into multiple classes
+* [#2187](https://github.com/icinga/icinga2/issues/2187) (Configuration): Implement support for arbitrarily complex indexers
+* [#2184](https://github.com/icinga/icinga2/issues/2184) (Configuration): Generate objects using apply with foreach in arrays or dictionaries \(key =\> value\)
+* [#2183](https://github.com/icinga/icinga2/issues/2183) (Configuration): Support dictionaries in custom attributes
+* [#2182](https://github.com/icinga/icinga2/issues/2182) (Cluster): Execute remote commands on the agent w/o local objects by passing custom attributes
+* [#2179](https://github.com/icinga/icinga2/issues/2179): Implement keys\(\)
+* [#2178](https://github.com/icinga/icinga2/issues/2178) (CLI): Cli command Node: Disable notifications feature on client nodes
+* [#2161](https://github.com/icinga/icinga2/issues/2161) (CLI): Cli Command: Rename 'agent' to 'node'
+* [#2158](https://github.com/icinga/icinga2/issues/2158) (Cluster): Require --zone to be specified for "node setup"
+* [#2152](https://github.com/icinga/icinga2/issues/2152) (Cluster): Rename --agent to --zone \(for blacklist/whitelist\)
+* [#2140](https://github.com/icinga/icinga2/issues/2140) (CLI): Cli: Use Node Blacklist functionality in 'node update-config'
+* [#2138](https://github.com/icinga/icinga2/issues/2138) (CLI): Find a better name for 'repository commit --clear'
+* [#2131](https://github.com/icinga/icinga2/issues/2131) (Configuration): Set host/service variable in apply rules
+* [#2124](https://github.com/icinga/icinga2/issues/2124) (Configuration): Update downtimes.conf example config
+* [#2119](https://github.com/icinga/icinga2/issues/2119) (Cluster): Remove virtual agent name feature for localhost
+* [#2118](https://github.com/icinga/icinga2/issues/2118) (CLI): Cli command: Node Setup Wizard \(for Satellites and Agents\)
+* [#2115](https://github.com/icinga/icinga2/issues/2115) (CLI): Cli command: Repository remove host should remove host.conf host/ dir with services
+* [#2113](https://github.com/icinga/icinga2/issues/2113) (CLI): validate repository config updates
+* [#2108](https://github.com/icinga/icinga2/issues/2108): Only build YAJL when there's no system-provided version available
+* [#2107](https://github.com/icinga/icinga2/issues/2107): Replace cJSON with a better JSON parser
+* [#2104](https://github.com/icinga/icinga2/issues/2104) (CLI): Use "variable get" for "pki ticket"
+* [#2103](https://github.com/icinga/icinga2/issues/2103) (CLI): Validate number of arguments
+* [#2098](https://github.com/icinga/icinga2/issues/2098) (CLI): Support for writing api.conf
+* [#2096](https://github.com/icinga/icinga2/issues/2096) (CLI): Cli command: pki needs option to define the algorithm
+* [#2092](https://github.com/icinga/icinga2/issues/2092) (CLI): Rename PKI arguments
+* [#2088](https://github.com/icinga/icinga2/issues/2088) (CLI): Cli command: Node Setup
+* [#2087](https://github.com/icinga/icinga2/issues/2087) (CLI): "pki request" should ask user to verify the peer's certificate
+* [#2086](https://github.com/icinga/icinga2/issues/2086) (CLI): Add -h next to --help
+* [#2085](https://github.com/icinga/icinga2/issues/2085) (CLI): Remove "available features" list from "feature list"
+* [#2084](https://github.com/icinga/icinga2/issues/2084) (CLI): Implement "feature disable" for Windows
+* [#2081](https://github.com/icinga/icinga2/issues/2081) (CLI): CLI: List disabled features in feature list too
+* [#2079](https://github.com/icinga/icinga2/issues/2079): Move WSAStartup call to INITIALIZE\_ONCE
+* [#2076](https://github.com/icinga/icinga2/issues/2076) (CLI): Implement field attribute to hide fields in command auto-completion
+* [#2074](https://github.com/icinga/icinga2/issues/2074) (CLI): Add autocomplete to 'host/service add' for object attributes \(e.g. --check\_interval\)
+* [#2073](https://github.com/icinga/icinga2/issues/2073) (Configuration): Remove zone keyword and allow to use object attribute 'zone'
+* [#2071](https://github.com/icinga/icinga2/issues/2071) (Configuration): Move localhost config into repository
+* [#2069](https://github.com/icinga/icinga2/issues/2069) (CLI): Implement generic color support for terminals
+* [#2066](https://github.com/icinga/icinga2/issues/2066) (CLI): Implement support for serial files
+* [#2064](https://github.com/icinga/icinga2/issues/2064) (DB IDO): Add program\_version column to programstatus table
+* [#2062](https://github.com/icinga/icinga2/issues/2062): Release 2.2
+* [#2059](https://github.com/icinga/icinga2/issues/2059) (CLI): Auto-completion for feature enable/disable
+* [#2055](https://github.com/icinga/icinga2/issues/2055) (CLI): Windows support for cli command feature
+* [#2054](https://github.com/icinga/icinga2/issues/2054) (CLI): CLI Commands: Remove timestamp prefix when logging output
+* [#2053](https://github.com/icinga/icinga2/issues/2053) (CLI): autocomplete should support '--key value'
+* [#2050](https://github.com/icinga/icinga2/issues/2050) (CLI): Cli command parser must support unregistered boost::program\_options
+* [#2049](https://github.com/icinga/icinga2/issues/2049) (CLI): CLI command: variable
+* [#2046](https://github.com/icinga/icinga2/issues/2046) (Graphite): GraphiteWriter: Add warn/crit/min/max perfdata values if existing
+* [#2031](https://github.com/icinga/icinga2/issues/2031) (Graphite): GraphiteWriter: Add support for customized metric prefix names
+* [#2003](https://github.com/icinga/icinga2/issues/2003): macro processor needs an array printer
+* [#1999](https://github.com/icinga/icinga2/issues/1999) (CLI): Cli command: Repository
+* [#1997](https://github.com/icinga/icinga2/issues/1997) (CLI): Cli Commands: Node Repository Blacklist & Whitelist
+* [#1996](https://github.com/icinga/icinga2/issues/1996) (CLI): Cli command: SCM
+* [#1995](https://github.com/icinga/icinga2/issues/1995) (CLI): Cli command: Object
+* [#1994](https://github.com/icinga/icinga2/issues/1994) (CLI): Cli command: Feature
+* [#1993](https://github.com/icinga/icinga2/issues/1993) (CLI): Node Repository
+* [#1992](https://github.com/icinga/icinga2/issues/1992) (CLI): Cli command: Node
+* [#1991](https://github.com/icinga/icinga2/issues/1991) (CLI): Cli command: pki
+* [#1990](https://github.com/icinga/icinga2/issues/1990) (CLI): Cli command framework
+* [#1989](https://github.com/icinga/icinga2/issues/1989) (CLI): Cli commands
+* [#1988](https://github.com/icinga/icinga2/issues/1988) (Cluster): CSR auto-signing
+* [#1987](https://github.com/icinga/icinga2/issues/1987) (Plugins): Windows plugins
+* [#1986](https://github.com/icinga/icinga2/issues/1986) (Cluster): Windows Wizard
+* [#1977](https://github.com/icinga/icinga2/issues/1977) (CLI): Cli commands: add filter capability to 'object list'
+* [#1901](https://github.com/icinga/icinga2/issues/1901) (Cluster): Windows installer
+* [#1895](https://github.com/icinga/icinga2/issues/1895) (Graphite): Add downtime depth as statistic metric for GraphiteWriter
+* [#1717](https://github.com/icinga/icinga2/issues/1717) (Configuration): Support for array in custom variable.
+* [#894](https://github.com/icinga/icinga2/issues/894): Add copyright header to .ti files and add support for comments in mkclass
 
 ### Bug
 
-* [#2258](https://github.com/Icinga/icinga2/issues/2258) (Configuration): Names for nested objects are evaluated at the wrong time
-* [#2257](https://github.com/Icinga/icinga2/issues/2257) (Configuration): DebugInfo is missing for nested dictionaries
-* [#2254](https://github.com/Icinga/icinga2/issues/2254): CreateProcess fails on Windows 7
-* [#2241](https://github.com/Icinga/icinga2/issues/2241) (Cluster): node wizard uses incorrect path for the CA certificate
-* [#2237](https://github.com/Icinga/icinga2/issues/2237) (Configuration): Wrong set of dependency state when a host depends on a service
-* [#2235](https://github.com/Icinga/icinga2/issues/2235): Unit tests fail to run
-* [#2233](https://github.com/Icinga/icinga2/issues/2233): Get rid of static boost::mutex variables
-* [#2222](https://github.com/Icinga/icinga2/issues/2222) (DB IDO): IDO module crashes on Windows
-* [#2221](https://github.com/Icinga/icinga2/issues/2221): Installation on Windows fails
-* [#2220](https://github.com/Icinga/icinga2/issues/2220) (Notifications): Missing state filter 'OK' must not prevent recovery notifications being sent
-* [#2215](https://github.com/Icinga/icinga2/issues/2215): mkclass crashes when called without arguments
-* [#2214](https://github.com/Icinga/icinga2/issues/2214) (Cluster): Removing multiple services fails
-* [#2206](https://github.com/Icinga/icinga2/issues/2206): Plugin execution on Windows does not work
-* [#2205](https://github.com/Icinga/icinga2/issues/2205): Compilation Error with boost 1.56 under Windows
-* [#2201](https://github.com/Icinga/icinga2/issues/2201): Exception when executing check
-* [#2200](https://github.com/Icinga/icinga2/issues/2200) (Configuration): Nested templates do not work \(anymore\)
-* [#2199](https://github.com/Icinga/icinga2/issues/2199) (CLI): Typo in output of 'icinga2 object list'
-* [#2197](https://github.com/Icinga/icinga2/issues/2197) (Notifications): only notify users on recovery which have been notified before \(not-ok state\)
-* [#2195](https://github.com/Icinga/icinga2/issues/2195) (Cluster): Invalid checkresult object causes Icinga 2 to crash
-* [#2177](https://github.com/Icinga/icinga2/issues/2177) (CLI): 'pki request' fails with serial permission error
-* [#2172](https://github.com/Icinga/icinga2/issues/2172) (Configuration): There is no \_\_name available to nested objects
-* [#2171](https://github.com/Icinga/icinga2/issues/2171) (Configuration): Nesting an object in a template causes the template to become non-abstract
-* [#2170](https://github.com/Icinga/icinga2/issues/2170) (Configuration): Object list dump erraneously evaluates template definitions
-* [#2166](https://github.com/Icinga/icinga2/issues/2166) (Cluster): Error message is always shown even when the host exists
-* [#2165](https://github.com/Icinga/icinga2/issues/2165) (Cluster): Incorrect warning message for "node update-config"
-* [#2164](https://github.com/Icinga/icinga2/issues/2164) (Cluster): Error in migrate-hosts
-* [#2162](https://github.com/Icinga/icinga2/issues/2162) (CLI): Change blacklist/whitelist storage
-* [#2156](https://github.com/Icinga/icinga2/issues/2156) (Cluster): Use ScriptVariable::Get for RunAsUser/RunAsGroup
-* [#2155](https://github.com/Icinga/icinga2/issues/2155) (Cluster): Agent health check must not have zone attribute
-* [#2153](https://github.com/Icinga/icinga2/issues/2153) (Cluster): Misleading error messages for blacklist/whitelist remove
-* [#2142](https://github.com/Icinga/icinga2/issues/2142) (Configuration): Icinga2 fails to start due to configuration errors
-* [#2141](https://github.com/Icinga/icinga2/issues/2141): Build fails
-* [#2137](https://github.com/Icinga/icinga2/issues/2137): Utility::GetFQDN doesn't work on OS X
-* [#2134](https://github.com/Icinga/icinga2/issues/2134): Hosts/services should not have themselves as parents
-* [#2133](https://github.com/Icinga/icinga2/issues/2133): OnStateLoaded isn't called for objects which don't have any state
-* [#2132](https://github.com/Icinga/icinga2/issues/2132) (CLI): cli command 'node setup update-config' overwrites existing constants.conf
-* [#2128](https://github.com/Icinga/icinga2/issues/2128) (CLI): Cli: Node Setup/Wizard running as root must chown\(\) generated files to icinga daemon user
-* [#2127](https://github.com/Icinga/icinga2/issues/2127) (Configuration): can't assign Service to Host in nested HostGroup
-* [#2125](https://github.com/Icinga/icinga2/issues/2125) (Performance Data): Performance data via API is broken
-* [#2116](https://github.com/Icinga/icinga2/issues/2116) (CLI): Cli command: Repository should validate if object exists before add/remove
-* [#2106](https://github.com/Icinga/icinga2/issues/2106) (Cluster): When replaying logs the secobj attribute is ignored
-* [#2091](https://github.com/Icinga/icinga2/issues/2091) (CLI): Cli command: pki request throws exception on connection failure
-* [#2083](https://github.com/Icinga/icinga2/issues/2083): CMake warnings on OS X
-* [#2077](https://github.com/Icinga/icinga2/issues/2077) (CLI): CLI: Auto-completion with colliding arguments
-* [#2070](https://github.com/Icinga/icinga2/issues/2070) (DB IDO): CLI / MySQL error during vagrant provisioning
-* [#2068](https://github.com/Icinga/icinga2/issues/2068) (CLI): pki new-cert doesn't check whether the files were successfully written
-* [#2065](https://github.com/Icinga/icinga2/issues/2065) (DB IDO): Schema upgrade files are missing in /usr/share/icinga2-ido-{mysql,pgsql} 
-* [#2063](https://github.com/Icinga/icinga2/issues/2063) (CLI): Cli commands: Integers in arrays are printed incorrectly
-* [#2057](https://github.com/Icinga/icinga2/issues/2057) (CLI): failed en/disable feature should return error
-* [#2056](https://github.com/Icinga/icinga2/issues/2056) (CLI): Commands are auto-completed when they shouldn't be
-* [#2051](https://github.com/Icinga/icinga2/issues/2051) (Configuration): custom attribute name 'type' causes empty vars dictionary
-* [#2048](https://github.com/Icinga/icinga2/issues/2048) (Compat): Fix reading perfdata in compat/checkresultreader
-* [#2042](https://github.com/Icinga/icinga2/issues/2042) (Plugins): Setting snmp\_v2 can cause snmp-manubulon-command derived checks to fail
-* [#2038](https://github.com/Icinga/icinga2/issues/2038) (Configuration): snmp-load checkcommand has a wrong "-T" param value
-* [#2034](https://github.com/Icinga/icinga2/issues/2034) (Configuration): Importing a CheckCommand in a NotificationCommand results in an exception without stacktrace.
-* [#2029](https://github.com/Icinga/icinga2/issues/2029) (Configuration): Error messages for invalid imports missing
-* [#2026](https://github.com/Icinga/icinga2/issues/2026) (Configuration): config parser crashes on unknown attribute in assign
-* [#2006](https://github.com/Icinga/icinga2/issues/2006) (Configuration): snmp-load checkcommand has wrong threshold syntax
-* [#2005](https://github.com/Icinga/icinga2/issues/2005) (Performance Data): icinga2 returns exponentail perfdata format with check\_nt
-* [#2004](https://github.com/Icinga/icinga2/issues/2004) (Performance Data): Icinga2 changes perfdata order and removes maximum
-* [#2001](https://github.com/Icinga/icinga2/issues/2001) (Notifications): default value for "disable\_notifications" in service dependencies is set to "false"
-* [#1950](https://github.com/Icinga/icinga2/issues/1950) (Configuration): Typo for "HTTP Checks" match in groups.conf
-* [#1720](https://github.com/Icinga/icinga2/issues/1720) (Notifications): delaying notifications with times.begin should postpone first notification into that window
+* [#2258](https://github.com/icinga/icinga2/issues/2258) (Configuration): Names for nested objects are evaluated at the wrong time
+* [#2257](https://github.com/icinga/icinga2/issues/2257) (Configuration): DebugInfo is missing for nested dictionaries
+* [#2254](https://github.com/icinga/icinga2/issues/2254): CreateProcess fails on Windows 7
+* [#2241](https://github.com/icinga/icinga2/issues/2241) (Cluster): node wizard uses incorrect path for the CA certificate
+* [#2237](https://github.com/icinga/icinga2/issues/2237) (Configuration): Wrong set of dependency state when a host depends on a service
+* [#2235](https://github.com/icinga/icinga2/issues/2235): Unit tests fail to run
+* [#2233](https://github.com/icinga/icinga2/issues/2233): Get rid of static boost::mutex variables
+* [#2222](https://github.com/icinga/icinga2/issues/2222) (DB IDO): IDO module crashes on Windows
+* [#2221](https://github.com/icinga/icinga2/issues/2221): Installation on Windows fails
+* [#2220](https://github.com/icinga/icinga2/issues/2220) (Notifications): Missing state filter 'OK' must not prevent recovery notifications being sent
+* [#2215](https://github.com/icinga/icinga2/issues/2215): mkclass crashes when called without arguments
+* [#2214](https://github.com/icinga/icinga2/issues/2214) (Cluster): Removing multiple services fails
+* [#2206](https://github.com/icinga/icinga2/issues/2206): Plugin execution on Windows does not work
+* [#2205](https://github.com/icinga/icinga2/issues/2205): Compilation Error with boost 1.56 under Windows
+* [#2201](https://github.com/icinga/icinga2/issues/2201): Exception when executing check
+* [#2200](https://github.com/icinga/icinga2/issues/2200) (Configuration): Nested templates do not work \(anymore\)
+* [#2199](https://github.com/icinga/icinga2/issues/2199) (CLI): Typo in output of 'icinga2 object list'
+* [#2197](https://github.com/icinga/icinga2/issues/2197) (Notifications): only notify users on recovery which have been notified before \(not-ok state\)
+* [#2195](https://github.com/icinga/icinga2/issues/2195) (Cluster): Invalid checkresult object causes Icinga 2 to crash
+* [#2177](https://github.com/icinga/icinga2/issues/2177) (CLI): 'pki request' fails with serial permission error
+* [#2172](https://github.com/icinga/icinga2/issues/2172) (Configuration): There is no \_\_name available to nested objects
+* [#2171](https://github.com/icinga/icinga2/issues/2171) (Configuration): Nesting an object in a template causes the template to become non-abstract
+* [#2170](https://github.com/icinga/icinga2/issues/2170) (Configuration): Object list dump erraneously evaluates template definitions
+* [#2166](https://github.com/icinga/icinga2/issues/2166) (Cluster): Error message is always shown even when the host exists
+* [#2165](https://github.com/icinga/icinga2/issues/2165) (Cluster): Incorrect warning message for "node update-config"
+* [#2164](https://github.com/icinga/icinga2/issues/2164) (Cluster): Error in migrate-hosts
+* [#2162](https://github.com/icinga/icinga2/issues/2162) (CLI): Change blacklist/whitelist storage
+* [#2156](https://github.com/icinga/icinga2/issues/2156) (Cluster): Use ScriptVariable::Get for RunAsUser/RunAsGroup
+* [#2155](https://github.com/icinga/icinga2/issues/2155) (Cluster): Agent health check must not have zone attribute
+* [#2153](https://github.com/icinga/icinga2/issues/2153) (Cluster): Misleading error messages for blacklist/whitelist remove
+* [#2142](https://github.com/icinga/icinga2/issues/2142) (Configuration): Icinga2 fails to start due to configuration errors
+* [#2141](https://github.com/icinga/icinga2/issues/2141): Build fails
+* [#2137](https://github.com/icinga/icinga2/issues/2137): Utility::GetFQDN doesn't work on OS X
+* [#2134](https://github.com/icinga/icinga2/issues/2134): Hosts/services should not have themselves as parents
+* [#2133](https://github.com/icinga/icinga2/issues/2133): OnStateLoaded isn't called for objects which don't have any state
+* [#2132](https://github.com/icinga/icinga2/issues/2132) (CLI): cli command 'node setup update-config' overwrites existing constants.conf
+* [#2128](https://github.com/icinga/icinga2/issues/2128) (CLI): Cli: Node Setup/Wizard running as root must chown\(\) generated files to icinga daemon user
+* [#2127](https://github.com/icinga/icinga2/issues/2127) (Configuration): can't assign Service to Host in nested HostGroup
+* [#2125](https://github.com/icinga/icinga2/issues/2125) (Metrics): Performance data via API is broken
+* [#2116](https://github.com/icinga/icinga2/issues/2116) (CLI): Cli command: Repository should validate if object exists before add/remove
+* [#2106](https://github.com/icinga/icinga2/issues/2106) (Cluster): When replaying logs the secobj attribute is ignored
+* [#2091](https://github.com/icinga/icinga2/issues/2091) (CLI): Cli command: pki request throws exception on connection failure
+* [#2083](https://github.com/icinga/icinga2/issues/2083): CMake warnings on OS X
+* [#2077](https://github.com/icinga/icinga2/issues/2077) (CLI): CLI: Auto-completion with colliding arguments
+* [#2070](https://github.com/icinga/icinga2/issues/2070) (DB IDO): CLI / MySQL error during vagrant provisioning
+* [#2068](https://github.com/icinga/icinga2/issues/2068) (CLI): pki new-cert doesn't check whether the files were successfully written
+* [#2065](https://github.com/icinga/icinga2/issues/2065) (DB IDO): Schema upgrade files are missing in /usr/share/icinga2-ido-{mysql,pgsql} 
+* [#2063](https://github.com/icinga/icinga2/issues/2063) (CLI): Cli commands: Integers in arrays are printed incorrectly
+* [#2057](https://github.com/icinga/icinga2/issues/2057) (CLI): failed en/disable feature should return error
+* [#2056](https://github.com/icinga/icinga2/issues/2056) (CLI): Commands are auto-completed when they shouldn't be
+* [#2051](https://github.com/icinga/icinga2/issues/2051) (Configuration): custom attribute name 'type' causes empty vars dictionary
+* [#2048](https://github.com/icinga/icinga2/issues/2048) (Compat): Fix reading perfdata in compat/checkresultreader
+* [#2042](https://github.com/icinga/icinga2/issues/2042) (Plugins): Setting snmp\_v2 can cause snmp-manubulon-command derived checks to fail
+* [#2038](https://github.com/icinga/icinga2/issues/2038) (Configuration): snmp-load checkcommand has a wrong "-T" param value
+* [#2034](https://github.com/icinga/icinga2/issues/2034) (Configuration): Importing a CheckCommand in a NotificationCommand results in an exception without stacktrace.
+* [#2029](https://github.com/icinga/icinga2/issues/2029) (Configuration): Error messages for invalid imports missing
+* [#2026](https://github.com/icinga/icinga2/issues/2026) (Configuration): config parser crashes on unknown attribute in assign
+* [#2006](https://github.com/icinga/icinga2/issues/2006) (Configuration): snmp-load checkcommand has wrong threshold syntax
+* [#2005](https://github.com/icinga/icinga2/issues/2005) (Metrics): icinga2 returns exponentail perfdata format with check\_nt
+* [#2004](https://github.com/icinga/icinga2/issues/2004) (Metrics): Icinga2 changes perfdata order and removes maximum
+* [#2001](https://github.com/icinga/icinga2/issues/2001) (Notifications): default value for "disable\_notifications" in service dependencies is set to "false"
+* [#1950](https://github.com/icinga/icinga2/issues/1950) (Configuration): Typo for "HTTP Checks" match in groups.conf
+* [#1720](https://github.com/icinga/icinga2/issues/1720) (Notifications): delaying notifications with times.begin should postpone first notification into that window
 
 ### ITL
 
-* [#2204](https://github.com/Icinga/icinga2/issues/2204) (ITL): Plugin Check Commands: disk is missing '-p', 'x' parameter
-* [#2017](https://github.com/Icinga/icinga2/issues/2017) (ITL): ITL: check\_procs and check\_http are missing arguments
+* [#2204](https://github.com/icinga/icinga2/issues/2204) (ITL): Plugin Check Commands: disk is missing '-p', 'x' parameter
+* [#2017](https://github.com/icinga/icinga2/issues/2017) (ITL): ITL: check\_procs and check\_http are missing arguments
 
 ### Documentation
 
-* [#2218](https://github.com/Icinga/icinga2/issues/2218) (Documentation): Documentation: Update Icinga Web 2 installation
-* [#2191](https://github.com/Icinga/icinga2/issues/2191) (Documentation): link missing in documentation about livestatus
-* [#2175](https://github.com/Icinga/icinga2/issues/2175) (Documentation): Documentation for arrays & dictionaries in custom attributes and their usage in apply rules for
-* [#2160](https://github.com/Icinga/icinga2/issues/2160) (Documentation): Documentation: Explain how to manage agent config in central repository
-* [#2150](https://github.com/Icinga/icinga2/issues/2150) (Documentation): Documentation: Move troubleshooting after the getting started chapter
-* [#2143](https://github.com/Icinga/icinga2/issues/2143) (Documentation): Documentation: Revamp getting started with 1 host and multiple \(service\) applies
-* [#2130](https://github.com/Icinga/icinga2/issues/2130) (Documentation): Documentation: Mention 'icinga2 object list' in config validation
-* [#2129](https://github.com/Icinga/icinga2/issues/2129) (Documentation): Fix typos and other small corrections in documentation
-* [#2093](https://github.com/Icinga/icinga2/issues/2093) (Documentation): Documentation: 1-about contribute links to non-existing report a bug howto
-* [#2052](https://github.com/Icinga/icinga2/issues/2052) (Documentation): Wrong usermod command for external command pipe setup
-* [#2041](https://github.com/Icinga/icinga2/issues/2041) (Documentation): Documentation: Cli Commands
-* [#2037](https://github.com/Icinga/icinga2/issues/2037) (Documentation): Documentation: Wrong check command for snmp-int\(erface\)
-* [#2033](https://github.com/Icinga/icinga2/issues/2033) (Documentation): Docs: Default command timeout is 60s not 5m
-* [#2028](https://github.com/Icinga/icinga2/issues/2028) (Documentation): Icinga2 docs: link supported operators from sections about apply rules
-* [#2024](https://github.com/Icinga/icinga2/issues/2024) (Documentation): Documentation: Add support for locally-scoped variables for host/service in applied Dependency
-* [#2013](https://github.com/Icinga/icinga2/issues/2013) (Documentation): Documentation: Add host/services variables in apply rules 
-* [#1998](https://github.com/Icinga/icinga2/issues/1998) (Documentation): Documentation: Agent/Satellite Setup
-* [#1972](https://github.com/Icinga/icinga2/issues/1972) (Documentation): Document how to use multiple assign/ignore statements with logical "and" & "or"
+* [#2218](https://github.com/icinga/icinga2/issues/2218) (Documentation): Documentation: Update Icinga Web 2 installation
+* [#2191](https://github.com/icinga/icinga2/issues/2191) (Documentation): link missing in documentation about livestatus
+* [#2175](https://github.com/icinga/icinga2/issues/2175) (Documentation): Documentation for arrays & dictionaries in custom attributes and their usage in apply rules for
+* [#2160](https://github.com/icinga/icinga2/issues/2160) (Documentation): Documentation: Explain how to manage agent config in central repository
+* [#2150](https://github.com/icinga/icinga2/issues/2150) (Documentation): Documentation: Move troubleshooting after the getting started chapter
+* [#2143](https://github.com/icinga/icinga2/issues/2143) (Documentation): Documentation: Revamp getting started with 1 host and multiple \(service\) applies
+* [#2130](https://github.com/icinga/icinga2/issues/2130) (Documentation): Documentation: Mention 'icinga2 object list' in config validation
+* [#2129](https://github.com/icinga/icinga2/issues/2129) (Documentation): Fix typos and other small corrections in documentation
+* [#2093](https://github.com/icinga/icinga2/issues/2093) (Documentation): Documentation: 1-about contribute links to non-existing report a bug howto
+* [#2052](https://github.com/icinga/icinga2/issues/2052) (Documentation): Wrong usermod command for external command pipe setup
+* [#2041](https://github.com/icinga/icinga2/issues/2041) (Documentation): Documentation: Cli Commands
+* [#2037](https://github.com/icinga/icinga2/issues/2037) (Documentation): Documentation: Wrong check command for snmp-int\(erface\)
+* [#2033](https://github.com/icinga/icinga2/issues/2033) (Documentation): Docs: Default command timeout is 60s not 5m
+* [#2028](https://github.com/icinga/icinga2/issues/2028) (Documentation): Icinga2 docs: link supported operators from sections about apply rules
+* [#2024](https://github.com/icinga/icinga2/issues/2024) (Documentation): Documentation: Add support for locally-scoped variables for host/service in applied Dependency
+* [#2013](https://github.com/icinga/icinga2/issues/2013) (Documentation): Documentation: Add host/services variables in apply rules 
+* [#1998](https://github.com/icinga/icinga2/issues/1998) (Documentation): Documentation: Agent/Satellite Setup
+* [#1972](https://github.com/icinga/icinga2/issues/1972) (Documentation): Document how to use multiple assign/ignore statements with logical "and" & "or"
 
 ### Support
 
-* [#2253](https://github.com/Icinga/icinga2/issues/2253) (Packages): Conditionally enable MySQL and PostgresSQL, add support for FreeBSD and DragonFlyBSD
-* [#2236](https://github.com/Icinga/icinga2/issues/2236) (Packages): Enable parallel builds for the Debian package
-* [#2147](https://github.com/Icinga/icinga2/issues/2147) (Packages): Feature `checker' is not enabled when installing Icinga 2 using our lates RPM snapshot packages
-* [#2136](https://github.com/Icinga/icinga2/issues/2136) (Packages): Build fails on RHEL 6.6
-* [#2123](https://github.com/Icinga/icinga2/issues/2123) (Packages): Post-update script \(migrate-hosts\) isn't run on RPM-based distributions
-* [#2095](https://github.com/Icinga/icinga2/issues/2095) (Packages): Unity build fails on RHEL 5
-* [#2058](https://github.com/Icinga/icinga2/issues/2058) (Packages): Debian package root permissions interfere with icinga2 cli commands as icinga user
-* [#2007](https://github.com/Icinga/icinga2/issues/2007) (Packages): SLES \(Suse Linux Enterprise Server\) 11 SP3 package dependency failure
+* [#2253](https://github.com/icinga/icinga2/issues/2253) (Packages): Conditionally enable MySQL and PostgresSQL, add support for FreeBSD and DragonFlyBSD
+* [#2236](https://github.com/icinga/icinga2/issues/2236) (Packages): Enable parallel builds for the Debian package
+* [#2147](https://github.com/icinga/icinga2/issues/2147) (Packages): Feature `checker' is not enabled when installing Icinga 2 using our lates RPM snapshot packages
+* [#2136](https://github.com/icinga/icinga2/issues/2136) (Packages): Build fails on RHEL 6.6
+* [#2123](https://github.com/icinga/icinga2/issues/2123) (Packages): Post-update script \(migrate-hosts\) isn't run on RPM-based distributions
+* [#2095](https://github.com/icinga/icinga2/issues/2095) (Packages): Unity build fails on RHEL 5
+* [#2058](https://github.com/icinga/icinga2/issues/2058) (Packages): Debian package root permissions interfere with icinga2 cli commands as icinga user
+* [#2007](https://github.com/icinga/icinga2/issues/2007) (Packages): SLES \(Suse Linux Enterprise Server\) 11 SP3 package dependency failure
 
 ## 2.1.1 (2014-09-16)
 
 ### Enhancement
 
-* [#1938](https://github.com/Icinga/icinga2/issues/1938): Unity builds: Detect whether \_\_COUNTER\_\_ is available
-* [#1933](https://github.com/Icinga/icinga2/issues/1933): Implement support for unity builds
-* [#1932](https://github.com/Icinga/icinga2/issues/1932): Ensure that namespaces for INITIALIZE\_ONCE and REGISTER\_TYPE are truly unique
-* [#1931](https://github.com/Icinga/icinga2/issues/1931): Add include guards for mkclass files
-* [#1797](https://github.com/Icinga/icinga2/issues/1797): Change log message for checking/sending notifications
+* [#1938](https://github.com/icinga/icinga2/issues/1938): Unity builds: Detect whether \_\_COUNTER\_\_ is available
+* [#1933](https://github.com/icinga/icinga2/issues/1933): Implement support for unity builds
+* [#1932](https://github.com/icinga/icinga2/issues/1932): Ensure that namespaces for INITIALIZE\_ONCE and REGISTER\_TYPE are truly unique
+* [#1931](https://github.com/icinga/icinga2/issues/1931): Add include guards for mkclass files
+* [#1797](https://github.com/icinga/icinga2/issues/1797): Change log message for checking/sending notifications
 
 ### Bug
 
-* [#1975](https://github.com/Icinga/icinga2/issues/1975): fix memory leak ido\_pgsql
-* [#1971](https://github.com/Icinga/icinga2/issues/1971) (Livestatus): Livestatus hangs from time to time
-* [#1967](https://github.com/Icinga/icinga2/issues/1967) (Plugins): fping4 doesn't work correctly with the shipped command-plugins.conf
-* [#1966](https://github.com/Icinga/icinga2/issues/1966) (Cluster): Segfault using cluster in TlsStream::IsEof
-* [#1958](https://github.com/Icinga/icinga2/issues/1958) (Configuration): Manubulon-Plugin conf Filename wrong
-* [#1957](https://github.com/Icinga/icinga2/issues/1957): Build fails on Haiku
-* [#1955](https://github.com/Icinga/icinga2/issues/1955) (Cluster): new SSL Errors with too many queued messages
-* [#1954](https://github.com/Icinga/icinga2/issues/1954): Missing differentiation between service and systemctl
-* [#1952](https://github.com/Icinga/icinga2/issues/1952) (Performance Data): GraphiteWriter should ignore empty perfdata value
-* [#1948](https://github.com/Icinga/icinga2/issues/1948): pipe2 returns ENOSYS on GNU Hurd and Debian kfreebsd
-* [#1946](https://github.com/Icinga/icinga2/issues/1946): Exit code is not initialized for some failed checks
-* [#1940](https://github.com/Icinga/icinga2/issues/1940): icinga2-list-objects complains about Umlauts and stops output
-* [#1935](https://github.com/Icinga/icinga2/issues/1935): icinga2-list-objects doesn't work with Python 3
-* [#1934](https://github.com/Icinga/icinga2/issues/1934) (Configuration): Remove validator for the Script type
-* [#1930](https://github.com/Icinga/icinga2/issues/1930): "Error parsing performance data" in spite of "enable\_perfdata = false"
-* [#1910](https://github.com/Icinga/icinga2/issues/1910) (Cluster): SSL errors with interleaved SSL\_read/write
-* [#1862](https://github.com/Icinga/icinga2/issues/1862) (Cluster): SSL\_read errors during restart
-* [#1849](https://github.com/Icinga/icinga2/issues/1849) (Cluster): Too many queued messages
-* [#1782](https://github.com/Icinga/icinga2/issues/1782): make test fails on openbsd
-* [#1522](https://github.com/Icinga/icinga2/issues/1522): Link libcJSON against libm
+* [#1975](https://github.com/icinga/icinga2/issues/1975): fix memory leak ido\_pgsql
+* [#1971](https://github.com/icinga/icinga2/issues/1971) (Livestatus): Livestatus hangs from time to time
+* [#1967](https://github.com/icinga/icinga2/issues/1967) (Plugins): fping4 doesn't work correctly with the shipped command-plugins.conf
+* [#1966](https://github.com/icinga/icinga2/issues/1966) (Cluster): Segfault using cluster in TlsStream::IsEof
+* [#1958](https://github.com/icinga/icinga2/issues/1958) (Configuration): Manubulon-Plugin conf Filename wrong
+* [#1957](https://github.com/icinga/icinga2/issues/1957): Build fails on Haiku
+* [#1955](https://github.com/icinga/icinga2/issues/1955) (Cluster): new SSL Errors with too many queued messages
+* [#1954](https://github.com/icinga/icinga2/issues/1954): Missing differentiation between service and systemctl
+* [#1952](https://github.com/icinga/icinga2/issues/1952) (Metrics): GraphiteWriter should ignore empty perfdata value
+* [#1948](https://github.com/icinga/icinga2/issues/1948): pipe2 returns ENOSYS on GNU Hurd and Debian kfreebsd
+* [#1946](https://github.com/icinga/icinga2/issues/1946): Exit code is not initialized for some failed checks
+* [#1940](https://github.com/icinga/icinga2/issues/1940): icinga2-list-objects complains about Umlauts and stops output
+* [#1935](https://github.com/icinga/icinga2/issues/1935): icinga2-list-objects doesn't work with Python 3
+* [#1934](https://github.com/icinga/icinga2/issues/1934) (Configuration): Remove validator for the Script type
+* [#1930](https://github.com/icinga/icinga2/issues/1930): "Error parsing performance data" in spite of "enable\_perfdata = false"
+* [#1910](https://github.com/icinga/icinga2/issues/1910) (Cluster): SSL errors with interleaved SSL\_read/write
+* [#1862](https://github.com/icinga/icinga2/issues/1862) (Cluster): SSL\_read errors during restart
+* [#1849](https://github.com/icinga/icinga2/issues/1849) (Cluster): Too many queued messages
+* [#1782](https://github.com/icinga/icinga2/issues/1782): make test fails on openbsd
+* [#1522](https://github.com/icinga/icinga2/issues/1522): Link libcJSON against libm
 
 ### Documentation
 
-* [#1985](https://github.com/Icinga/icinga2/issues/1985) (Documentation): clarify on db ido upgrades
-* [#1962](https://github.com/Icinga/icinga2/issues/1962) (Documentation): Extend documentation for icinga-web on Debian systems
-* [#1949](https://github.com/Icinga/icinga2/issues/1949) (Documentation): Explain event commands and their integration by a real life example \(httpd restart via ssh\)
-* [#1927](https://github.com/Icinga/icinga2/issues/1927) (Documentation): Document how to use @ to escape keywords
+* [#1985](https://github.com/icinga/icinga2/issues/1985) (Documentation): clarify on db ido upgrades
+* [#1962](https://github.com/icinga/icinga2/issues/1962) (Documentation): Extend documentation for icinga-web on Debian systems
+* [#1949](https://github.com/icinga/icinga2/issues/1949) (Documentation): Explain event commands and their integration by a real life example \(httpd restart via ssh\)
+* [#1927](https://github.com/icinga/icinga2/issues/1927) (Documentation): Document how to use @ to escape keywords
 
 ### Support
 
-* [#1960](https://github.com/Icinga/icinga2/issues/1960) (Packages): GNUInstallDirs.cmake outdated
-* [#1944](https://github.com/Icinga/icinga2/issues/1944) (Packages): service icinga2 status - prints cat error if the service is stopped
-* [#1941](https://github.com/Icinga/icinga2/issues/1941) (Packages): icinga2 init-script terminates with exit code 0 if $DAEMON is not in place or not executable
-* [#1939](https://github.com/Icinga/icinga2/issues/1939) (Packages): Enable unity build for RPM/Debian packages
-* [#1937](https://github.com/Icinga/icinga2/issues/1937) (Packages): Figure out a better way to set the version for snapshot builds
-* [#1936](https://github.com/Icinga/icinga2/issues/1936) (Packages): Fix rpmlint errors
-* [#1928](https://github.com/Icinga/icinga2/issues/1928) (Packages): icinga2.spec: files-attr-not-set for python-icinga2 package
+* [#1960](https://github.com/icinga/icinga2/issues/1960) (Packages): GNUInstallDirs.cmake outdated
+* [#1944](https://github.com/icinga/icinga2/issues/1944) (Packages): service icinga2 status - prints cat error if the service is stopped
+* [#1941](https://github.com/icinga/icinga2/issues/1941) (Packages): icinga2 init-script terminates with exit code 0 if $DAEMON is not in place or not executable
+* [#1939](https://github.com/icinga/icinga2/issues/1939) (Packages): Enable unity build for RPM/Debian packages
+* [#1937](https://github.com/icinga/icinga2/issues/1937) (Packages): Figure out a better way to set the version for snapshot builds
+* [#1936](https://github.com/icinga/icinga2/issues/1936) (Packages): Fix rpmlint errors
+* [#1928](https://github.com/icinga/icinga2/issues/1928) (Packages): icinga2.spec: files-attr-not-set for python-icinga2 package
 
 ## 2.1.0 (2014-08-29)
 
@@ -3008,54 +3060,54 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Enhancement
 
-* [#1879](https://github.com/Icinga/icinga2/issues/1879): Enhance logging for perfdata/graphitewriter
-* [#1871](https://github.com/Icinga/icinga2/issues/1871) (Configuration): add search path for icinga2.conf
-* [#1843](https://github.com/Icinga/icinga2/issues/1843) (DB IDO): delay ido connect in ha cluster
-* [#1810](https://github.com/Icinga/icinga2/issues/1810): Change log level for failed commands
-* [#1788](https://github.com/Icinga/icinga2/issues/1788): Release 2.1
-* [#1786](https://github.com/Icinga/icinga2/issues/1786) (Configuration): Information for config objects
-* [#1760](https://github.com/Icinga/icinga2/issues/1760) (Plugins): Plugin Check Commands: add manubulon snmp plugins
-* [#1548](https://github.com/Icinga/icinga2/issues/1548) (Cluster): Log replay sends messages to instances which shouldn't get those messages
-* [#1546](https://github.com/Icinga/icinga2/issues/1546) (Cluster): Better cluster support for notifications / IDO
-* [#1491](https://github.com/Icinga/icinga2/issues/1491) (Cluster): Better log messages for cluster changes
-* [#977](https://github.com/Icinga/icinga2/issues/977) (Cluster): Cluster support for modified attributes
+* [#1879](https://github.com/icinga/icinga2/issues/1879): Enhance logging for perfdata/graphitewriter
+* [#1871](https://github.com/icinga/icinga2/issues/1871) (Configuration): add search path for icinga2.conf
+* [#1843](https://github.com/icinga/icinga2/issues/1843) (DB IDO): delay ido connect in ha cluster
+* [#1810](https://github.com/icinga/icinga2/issues/1810): Change log level for failed commands
+* [#1788](https://github.com/icinga/icinga2/issues/1788): Release 2.1
+* [#1786](https://github.com/icinga/icinga2/issues/1786) (Configuration): Information for config objects
+* [#1760](https://github.com/icinga/icinga2/issues/1760) (Plugins): Plugin Check Commands: add manubulon snmp plugins
+* [#1548](https://github.com/icinga/icinga2/issues/1548) (Cluster): Log replay sends messages to instances which shouldn't get those messages
+* [#1546](https://github.com/icinga/icinga2/issues/1546) (Cluster): Better cluster support for notifications / IDO
+* [#1491](https://github.com/icinga/icinga2/issues/1491) (Cluster): Better log messages for cluster changes
+* [#977](https://github.com/icinga/icinga2/issues/977) (Cluster): Cluster support for modified attributes
 
 ### Bug
 
-* [#1916](https://github.com/Icinga/icinga2/issues/1916): Build fails with Boost 1.56
-* [#1903](https://github.com/Icinga/icinga2/issues/1903) (Cluster): Host and service checks stuck in "pending" when hostname = localhost a parent/satellite setup
-* [#1902](https://github.com/Icinga/icinga2/issues/1902): Commands are processed multiple times
-* [#1896](https://github.com/Icinga/icinga2/issues/1896): check file permissions in /var/cache/icinga2
-* [#1884](https://github.com/Icinga/icinga2/issues/1884): External command pipe: Too many open files
-* [#1819](https://github.com/Icinga/icinga2/issues/1819): ExternalCommandListener fails open pipe: Too many open files
+* [#1916](https://github.com/icinga/icinga2/issues/1916): Build fails with Boost 1.56
+* [#1903](https://github.com/icinga/icinga2/issues/1903) (Cluster): Host and service checks stuck in "pending" when hostname = localhost a parent/satellite setup
+* [#1902](https://github.com/icinga/icinga2/issues/1902): Commands are processed multiple times
+* [#1896](https://github.com/icinga/icinga2/issues/1896): check file permissions in /var/cache/icinga2
+* [#1884](https://github.com/icinga/icinga2/issues/1884): External command pipe: Too many open files
+* [#1819](https://github.com/icinga/icinga2/issues/1819): ExternalCommandListener fails open pipe: Too many open files
 
 ### Documentation
 
-* [#1924](https://github.com/Icinga/icinga2/issues/1924) (Documentation): add example selinux policy for external command pipe
-* [#1915](https://github.com/Icinga/icinga2/issues/1915) (Documentation): how to add a new cluster node
-* [#1913](https://github.com/Icinga/icinga2/issues/1913) (Documentation): Keyword "required" used inconsistently for host and service "icon\_image\*" attributes
-* [#1905](https://github.com/Icinga/icinga2/issues/1905) (Documentation): Update command arguments 'set\_if' and beautify error message
-* [#1897](https://github.com/Icinga/icinga2/issues/1897) (Documentation): Add documentation for icinga2-list-objects
-* [#1889](https://github.com/Icinga/icinga2/issues/1889) (Documentation): Enhance Graphite Writer description
-* [#1881](https://github.com/Icinga/icinga2/issues/1881) (Documentation): clarify on which config tools are available
-* [#1872](https://github.com/Icinga/icinga2/issues/1872) (Documentation): Wrong parent in Load Distribution
-* [#1868](https://github.com/Icinga/icinga2/issues/1868) (Documentation): Wrong object attribute 'enable\_flap\_detection'
-* [#1867](https://github.com/Icinga/icinga2/issues/1867) (Documentation): Add systemd options: enable, journal
-* [#1865](https://github.com/Icinga/icinga2/issues/1865) (Documentation): add section about disabling re-notifications
-* [#1864](https://github.com/Icinga/icinga2/issues/1864) (Documentation): Add section for reserved keywords
-* [#1847](https://github.com/Icinga/icinga2/issues/1847) (Documentation): Explain how the order attribute works in commands
-* [#1807](https://github.com/Icinga/icinga2/issues/1807) (Documentation): Better explanation for HA config cluster
-* [#1787](https://github.com/Icinga/icinga2/issues/1787) (Documentation): Documentation for zones and cluster permissions
-* [#1761](https://github.com/Icinga/icinga2/issues/1761) (Documentation): Migration: note on check command timeouts
+* [#1924](https://github.com/icinga/icinga2/issues/1924) (Documentation): add example selinux policy for external command pipe
+* [#1915](https://github.com/icinga/icinga2/issues/1915) (Documentation): how to add a new cluster node
+* [#1913](https://github.com/icinga/icinga2/issues/1913) (Documentation): Keyword "required" used inconsistently for host and service "icon\_image\*" attributes
+* [#1905](https://github.com/icinga/icinga2/issues/1905) (Documentation): Update command arguments 'set\_if' and beautify error message
+* [#1897](https://github.com/icinga/icinga2/issues/1897) (Documentation): Add documentation for icinga2-list-objects
+* [#1889](https://github.com/icinga/icinga2/issues/1889) (Documentation): Enhance Graphite Writer description
+* [#1881](https://github.com/icinga/icinga2/issues/1881) (Documentation): clarify on which config tools are available
+* [#1872](https://github.com/icinga/icinga2/issues/1872) (Documentation): Wrong parent in Load Distribution
+* [#1868](https://github.com/icinga/icinga2/issues/1868) (Documentation): Wrong object attribute 'enable\_flap\_detection'
+* [#1867](https://github.com/icinga/icinga2/issues/1867) (Documentation): Add systemd options: enable, journal
+* [#1865](https://github.com/icinga/icinga2/issues/1865) (Documentation): add section about disabling re-notifications
+* [#1864](https://github.com/icinga/icinga2/issues/1864) (Documentation): Add section for reserved keywords
+* [#1847](https://github.com/icinga/icinga2/issues/1847) (Documentation): Explain how the order attribute works in commands
+* [#1807](https://github.com/icinga/icinga2/issues/1807) (Documentation): Better explanation for HA config cluster
+* [#1787](https://github.com/icinga/icinga2/issues/1787) (Documentation): Documentation for zones and cluster permissions
+* [#1761](https://github.com/icinga/icinga2/issues/1761) (Documentation): Migration: note on check command timeouts
 
 ### Support
 
-* [#1923](https://github.com/Icinga/icinga2/issues/1923) (Packages): 64-bit RPMs are not installable
-* [#1888](https://github.com/Icinga/icinga2/issues/1888) (Packages): Recommend related packages on SUSE distributions
-* [#1887](https://github.com/Icinga/icinga2/issues/1887) (Installation): Clean up spec file
-* [#1885](https://github.com/Icinga/icinga2/issues/1885) (Packages): enforce /usr/lib as base for the cgi path on SUSE distributions
-* [#1883](https://github.com/Icinga/icinga2/issues/1883) (Installation): use \_rundir macro for configuring the run directory
-* [#1873](https://github.com/Icinga/icinga2/issues/1873) (Packages): make install does not install the db-schema
+* [#1923](https://github.com/icinga/icinga2/issues/1923) (Packages): 64-bit RPMs are not installable
+* [#1888](https://github.com/icinga/icinga2/issues/1888) (Packages): Recommend related packages on SUSE distributions
+* [#1887](https://github.com/icinga/icinga2/issues/1887) (Installation): Clean up spec file
+* [#1885](https://github.com/icinga/icinga2/issues/1885) (Packages): enforce /usr/lib as base for the cgi path on SUSE distributions
+* [#1883](https://github.com/icinga/icinga2/issues/1883) (Installation): use \_rundir macro for configuring the run directory
+* [#1873](https://github.com/icinga/icinga2/issues/1873) (Packages): make install does not install the db-schema
 
 ## 2.0.2 (2014-08-07)
 
@@ -3065,73 +3117,73 @@ Please note that this version fixes the default thresholds for the disk check wh
 
 ### Enhancement
 
-* [#1830](https://github.com/Icinga/icinga2/issues/1830) (Plugins): Plugin Check Commands: Add timeout option to check\_ssh
-* [#1826](https://github.com/Icinga/icinga2/issues/1826): Print application paths for --version
-* [#1785](https://github.com/Icinga/icinga2/issues/1785): Release 2.0.2
-* [#1784](https://github.com/Icinga/icinga2/issues/1784) (Configuration): Require command to be an array when the arguments attribute is used
-* [#1781](https://github.com/Icinga/icinga2/issues/1781) (Plugins): Plugin Check Commands: Add expect option to check\_http
+* [#1830](https://github.com/icinga/icinga2/issues/1830) (Plugins): Plugin Check Commands: Add timeout option to check\_ssh
+* [#1826](https://github.com/icinga/icinga2/issues/1826): Print application paths for --version
+* [#1785](https://github.com/icinga/icinga2/issues/1785): Release 2.0.2
+* [#1784](https://github.com/icinga/icinga2/issues/1784) (Configuration): Require command to be an array when the arguments attribute is used
+* [#1781](https://github.com/icinga/icinga2/issues/1781) (Plugins): Plugin Check Commands: Add expect option to check\_http
 
 ### Bug
 
-* [#1861](https://github.com/Icinga/icinga2/issues/1861): write startup error messages to error.log
-* [#1858](https://github.com/Icinga/icinga2/issues/1858): event command execution does not call finish handler
-* [#1855](https://github.com/Icinga/icinga2/issues/1855): Startup logfile is not flushed to disk
-* [#1853](https://github.com/Icinga/icinga2/issues/1853) (DB IDO): exit application if ido schema version does not match
-* [#1852](https://github.com/Icinga/icinga2/issues/1852): Error handler for getaddrinfo must use gai\_strerror
-* [#1848](https://github.com/Icinga/icinga2/issues/1848): Missing space in error message
-* [#1840](https://github.com/Icinga/icinga2/issues/1840): \[Patch\] Fix build issue and crash found on Solaris, potentially other Unix OSes
-* [#1839](https://github.com/Icinga/icinga2/issues/1839): Icinga 2 crashes during startup
-* [#1834](https://github.com/Icinga/icinga2/issues/1834) (Cluster): High Availablity does not synchronise the data like expected
-* [#1829](https://github.com/Icinga/icinga2/issues/1829): Service icinga2 reload command does not cause effect
-* [#1828](https://github.com/Icinga/icinga2/issues/1828): Fix notification definition if no host\_name / service\_description given
-* [#1816](https://github.com/Icinga/icinga2/issues/1816): Config validation without filename argument fails with unhandled exception
-* [#1813](https://github.com/Icinga/icinga2/issues/1813) (Performance Data): GraphiteWriter: Malformatted integer values
-* [#1800](https://github.com/Icinga/icinga2/issues/1800) (Cluster): TLS Connections still unstable in 2.0.1
-* [#1796](https://github.com/Icinga/icinga2/issues/1796): "order" attribute doesn't seem to work as expected
-* [#1792](https://github.com/Icinga/icinga2/issues/1792) (Configuration): sample config: add check commands location hint \(itl/plugin check commands\)
-* [#1779](https://github.com/Icinga/icinga2/issues/1779) (Configuration): Remove superfluous quotes and commas in dictionaries
-* [#1778](https://github.com/Icinga/icinga2/issues/1778): Event Commands are triggered in OK HARD state everytime
-* [#1775](https://github.com/Icinga/icinga2/issues/1775): additional group rights missing when Icinga started with -u and -g
-* [#1774](https://github.com/Icinga/icinga2/issues/1774) (Cluster): Missing detailed error messages on ApiListener SSL Errors
-* [#1766](https://github.com/Icinga/icinga2/issues/1766): RPMLint security warning - missing-call-to-setgroups-before-setuid /usr/sbin/icinga2
-* [#1757](https://github.com/Icinga/icinga2/issues/1757) (DB IDO): NULL vs empty string
-* [#1752](https://github.com/Icinga/icinga2/issues/1752) (Cluster): Infinite loop in TlsStream::Close
-* [#1744](https://github.com/Icinga/icinga2/issues/1744) (DB IDO): Two Custom Variables with same name, but Upper/Lowercase creating IDO duplicate entry
-* [#1741](https://github.com/Icinga/icinga2/issues/1741): Command pipe blocks when trying to open it more than once in parallel
-* [#1730](https://github.com/Icinga/icinga2/issues/1730): Check and retry intervals are incorrect
-* [#1729](https://github.com/Icinga/icinga2/issues/1729): $TOTALHOSTSERVICESWARNING$ and $TOTALHOSTSERVICESCRITICAL$ aren't getting converted
-* [#1728](https://github.com/Icinga/icinga2/issues/1728): Service dependencies aren't getting converted properly
-* [#1726](https://github.com/Icinga/icinga2/issues/1726): group names quoted twice in arrays
-* [#1723](https://github.com/Icinga/icinga2/issues/1723): add log message for invalid performance data
-* [#1722](https://github.com/Icinga/icinga2/issues/1722): GraphiteWriter regularly sends empty lines
-* [#1721](https://github.com/Icinga/icinga2/issues/1721) (Configuration): Add cmake constant for PluginDir
-* [#1684](https://github.com/Icinga/icinga2/issues/1684) (Notifications): Notifications not always triggered
-* [#1674](https://github.com/Icinga/icinga2/issues/1674): ipmi-sensors segfault due to stack size
-* [#1666](https://github.com/Icinga/icinga2/issues/1666) (DB IDO): objects and their ids are inserted twice
+* [#1861](https://github.com/icinga/icinga2/issues/1861): write startup error messages to error.log
+* [#1858](https://github.com/icinga/icinga2/issues/1858): event command execution does not call finish handler
+* [#1855](https://github.com/icinga/icinga2/issues/1855): Startup logfile is not flushed to disk
+* [#1853](https://github.com/icinga/icinga2/issues/1853) (DB IDO): exit application if ido schema version does not match
+* [#1852](https://github.com/icinga/icinga2/issues/1852): Error handler for getaddrinfo must use gai\_strerror
+* [#1848](https://github.com/icinga/icinga2/issues/1848): Missing space in error message
+* [#1840](https://github.com/icinga/icinga2/issues/1840): \[Patch\] Fix build issue and crash found on Solaris, potentially other Unix OSes
+* [#1839](https://github.com/icinga/icinga2/issues/1839): Icinga 2 crashes during startup
+* [#1834](https://github.com/icinga/icinga2/issues/1834) (Cluster): High Availablity does not synchronise the data like expected
+* [#1829](https://github.com/icinga/icinga2/issues/1829): Service icinga2 reload command does not cause effect
+* [#1828](https://github.com/icinga/icinga2/issues/1828): Fix notification definition if no host\_name / service\_description given
+* [#1816](https://github.com/icinga/icinga2/issues/1816): Config validation without filename argument fails with unhandled exception
+* [#1813](https://github.com/icinga/icinga2/issues/1813) (Metrics): GraphiteWriter: Malformatted integer values
+* [#1800](https://github.com/icinga/icinga2/issues/1800) (Cluster): TLS Connections still unstable in 2.0.1
+* [#1796](https://github.com/icinga/icinga2/issues/1796): "order" attribute doesn't seem to work as expected
+* [#1792](https://github.com/icinga/icinga2/issues/1792) (Configuration): sample config: add check commands location hint \(itl/plugin check commands\)
+* [#1779](https://github.com/icinga/icinga2/issues/1779) (Configuration): Remove superfluous quotes and commas in dictionaries
+* [#1778](https://github.com/icinga/icinga2/issues/1778): Event Commands are triggered in OK HARD state everytime
+* [#1775](https://github.com/icinga/icinga2/issues/1775): additional group rights missing when Icinga started with -u and -g
+* [#1774](https://github.com/icinga/icinga2/issues/1774) (Cluster): Missing detailed error messages on ApiListener SSL Errors
+* [#1766](https://github.com/icinga/icinga2/issues/1766): RPMLint security warning - missing-call-to-setgroups-before-setuid /usr/sbin/icinga2
+* [#1757](https://github.com/icinga/icinga2/issues/1757) (DB IDO): NULL vs empty string
+* [#1752](https://github.com/icinga/icinga2/issues/1752) (Cluster): Infinite loop in TlsStream::Close
+* [#1744](https://github.com/icinga/icinga2/issues/1744) (DB IDO): Two Custom Variables with same name, but Upper/Lowercase creating IDO duplicate entry
+* [#1741](https://github.com/icinga/icinga2/issues/1741): Command pipe blocks when trying to open it more than once in parallel
+* [#1730](https://github.com/icinga/icinga2/issues/1730): Check and retry intervals are incorrect
+* [#1729](https://github.com/icinga/icinga2/issues/1729): $TOTALHOSTSERVICESWARNING$ and $TOTALHOSTSERVICESCRITICAL$ aren't getting converted
+* [#1728](https://github.com/icinga/icinga2/issues/1728): Service dependencies aren't getting converted properly
+* [#1726](https://github.com/icinga/icinga2/issues/1726): group names quoted twice in arrays
+* [#1723](https://github.com/icinga/icinga2/issues/1723): add log message for invalid performance data
+* [#1722](https://github.com/icinga/icinga2/issues/1722): GraphiteWriter regularly sends empty lines
+* [#1721](https://github.com/icinga/icinga2/issues/1721) (Configuration): Add cmake constant for PluginDir
+* [#1684](https://github.com/icinga/icinga2/issues/1684) (Notifications): Notifications not always triggered
+* [#1674](https://github.com/icinga/icinga2/issues/1674): ipmi-sensors segfault due to stack size
+* [#1666](https://github.com/icinga/icinga2/issues/1666) (DB IDO): objects and their ids are inserted twice
 
 ### ITL
 
-* [#1825](https://github.com/Icinga/icinga2/issues/1825) (ITL): The "ssl" check command always sets -D
-* [#1821](https://github.com/Icinga/icinga2/issues/1821) (ITL): Order doesn't work in check ssh command
+* [#1825](https://github.com/icinga/icinga2/issues/1825) (ITL): The "ssl" check command always sets -D
+* [#1821](https://github.com/icinga/icinga2/issues/1821) (ITL): Order doesn't work in check ssh command
 
 ### Documentation
 
-* [#1802](https://github.com/Icinga/icinga2/issues/1802) (Documentation): wrong path for the file 'localhost.conf'
-* [#1801](https://github.com/Icinga/icinga2/issues/1801) (Documentation): Missing documentation about implicit dependency
-* [#1791](https://github.com/Icinga/icinga2/issues/1791) (Documentation): icinga Web: wrong path to command pipe
-* [#1789](https://github.com/Icinga/icinga2/issues/1789) (Documentation): update installation with systemd usage
-* [#1762](https://github.com/Icinga/icinga2/issues/1762) (Documentation): clarify on which features are required for classic ui/web/web2
+* [#1802](https://github.com/icinga/icinga2/issues/1802) (Documentation): wrong path for the file 'localhost.conf'
+* [#1801](https://github.com/icinga/icinga2/issues/1801) (Documentation): Missing documentation about implicit dependency
+* [#1791](https://github.com/icinga/icinga2/issues/1791) (Documentation): icinga Web: wrong path to command pipe
+* [#1789](https://github.com/icinga/icinga2/issues/1789) (Documentation): update installation with systemd usage
+* [#1762](https://github.com/icinga/icinga2/issues/1762) (Documentation): clarify on which features are required for classic ui/web/web2
 
 ### Support
 
-* [#1845](https://github.com/Icinga/icinga2/issues/1845) (Packages): Remove if\(NOT DEFINED ICINGA2\_SYSCONFIGFILE\) in etc/initsystem/CMakeLists.txt
-* [#1842](https://github.com/Icinga/icinga2/issues/1842) (Packages): incorrect sysconfig path on sles11
-* [#1820](https://github.com/Icinga/icinga2/issues/1820) (Installation): Repo Error on RHEL 6.5
-* [#1780](https://github.com/Icinga/icinga2/issues/1780) (Packages): Rename README to README.md
-* [#1763](https://github.com/Icinga/icinga2/issues/1763) (Packages): Build packages for el7
-* [#1754](https://github.com/Icinga/icinga2/issues/1754) (Installation): Location of the run directory is hard coded and bound to "local\_state\_dir"
-* [#1699](https://github.com/Icinga/icinga2/issues/1699) (Packages): Classic UI Debian/Ubuntu: apache 2.4 requires 'a2enmod cgi' & apacheutils installed
-* [#1338](https://github.com/Icinga/icinga2/issues/1338) (Packages): SUSE packages
+* [#1845](https://github.com/icinga/icinga2/issues/1845) (Packages): Remove if\(NOT DEFINED ICINGA2\_SYSCONFIGFILE\) in etc/initsystem/CMakeLists.txt
+* [#1842](https://github.com/icinga/icinga2/issues/1842) (Packages): incorrect sysconfig path on sles11
+* [#1820](https://github.com/icinga/icinga2/issues/1820) (Installation): Repo Error on RHEL 6.5
+* [#1780](https://github.com/icinga/icinga2/issues/1780) (Packages): Rename README to README.md
+* [#1763](https://github.com/icinga/icinga2/issues/1763) (Packages): Build packages for el7
+* [#1754](https://github.com/icinga/icinga2/issues/1754) (Installation): Location of the run directory is hard coded and bound to "local\_state\_dir"
+* [#1699](https://github.com/icinga/icinga2/issues/1699) (Packages): Classic UI Debian/Ubuntu: apache 2.4 requires 'a2enmod cgi' & apacheutils installed
+* [#1338](https://github.com/icinga/icinga2/issues/1338) (Packages): SUSE packages
 
 ## 2.0.1 (2014-07-10)
 
@@ -3141,57 +3193,57 @@ Bugfix release
 
 ### Enhancement
 
-* [#1713](https://github.com/Icinga/icinga2/issues/1713) (Configuration): Add port option to check imap/pop/smtp and a new dig
-* [#1049](https://github.com/Icinga/icinga2/issues/1049) (Livestatus): OutputFormat python
+* [#1713](https://github.com/icinga/icinga2/issues/1713) (Configuration): Add port option to check imap/pop/smtp and a new dig
+* [#1049](https://github.com/icinga/icinga2/issues/1049) (Livestatus): OutputFormat python
 
 ### Bug
 
-* [#1773](https://github.com/Icinga/icinga2/issues/1773) (Notifications): Problem with enable\_notifications and retained state
-* [#1772](https://github.com/Icinga/icinga2/issues/1772) (Notifications): enable\_notifications = false for users has no effect
-* [#1771](https://github.com/Icinga/icinga2/issues/1771) (Cluster): Icinga crashes after "Too many queued messages"
-* [#1769](https://github.com/Icinga/icinga2/issues/1769): Build fails when MySQL is not installed
-* [#1767](https://github.com/Icinga/icinga2/issues/1767): Increase icinga.cmd Limit
-* [#1753](https://github.com/Icinga/icinga2/issues/1753) (Configuration): icinga2-sign-key creates ".crt" and ".key" files when the CA passphrase is invalid
-* [#1751](https://github.com/Icinga/icinga2/issues/1751) (Configuration): icinga2-build-ca shouldn't prompt for DN
-* [#1749](https://github.com/Icinga/icinga2/issues/1749): TLS connections are still unstable
-* [#1745](https://github.com/Icinga/icinga2/issues/1745): Icinga stops updating IDO after a while
-* [#1743](https://github.com/Icinga/icinga2/issues/1743) (Configuration): Please add --sni option to http check command
-* [#1740](https://github.com/Icinga/icinga2/issues/1740) (Notifications): Notifications causing segfault from exim
-* [#1737](https://github.com/Icinga/icinga2/issues/1737) (DB IDO): icinga2-ido-pgsql snapshot package missing dependecy dbconfig-common
-* [#1736](https://github.com/Icinga/icinga2/issues/1736): Remove line number information from stack traces
-* [#1734](https://github.com/Icinga/icinga2/issues/1734): Check command result doesn't match
-* [#1731](https://github.com/Icinga/icinga2/issues/1731): Dependencies should cache their parent and child object
-* [#1727](https://github.com/Icinga/icinga2/issues/1727): $SERVICEDESC$ isn't getting converted correctly
-* [#1724](https://github.com/Icinga/icinga2/issues/1724): Improve systemd service definition
-* [#1716](https://github.com/Icinga/icinga2/issues/1716) (Cluster): Icinga doesn't send SetLogPosition messages when one of the endpoints fails to connect
-* [#1712](https://github.com/Icinga/icinga2/issues/1712): parsing of double defined command can generate unexpected errors
-* [#1704](https://github.com/Icinga/icinga2/issues/1704): Reminder notifications are sent on disabled services 
-* [#1698](https://github.com/Icinga/icinga2/issues/1698): icinga2 cannot be built with both systemd and init.d files
-* [#1697](https://github.com/Icinga/icinga2/issues/1697) (Livestatus): Thruk Panorama View cannot query Host Status
-* [#1695](https://github.com/Icinga/icinga2/issues/1695): icinga2.state could not be opened
-* [#1691](https://github.com/Icinga/icinga2/issues/1691): build warnings
-* [#1644](https://github.com/Icinga/icinga2/issues/1644) (Cluster): base64 on CentOS 5 fails to read certificate bundles
-* [#1639](https://github.com/Icinga/icinga2/issues/1639) (Cluster): Deadlock in ApiListener::RelayMessage
-* [#1609](https://github.com/Icinga/icinga2/issues/1609): application fails to start on wrong log file permissions but does not tell about it
-* [#1206](https://github.com/Icinga/icinga2/issues/1206) (DB IDO): PostgreSQL string escaping
+* [#1773](https://github.com/icinga/icinga2/issues/1773) (Notifications): Problem with enable\_notifications and retained state
+* [#1772](https://github.com/icinga/icinga2/issues/1772) (Notifications): enable\_notifications = false for users has no effect
+* [#1771](https://github.com/icinga/icinga2/issues/1771) (Cluster): Icinga crashes after "Too many queued messages"
+* [#1769](https://github.com/icinga/icinga2/issues/1769): Build fails when MySQL is not installed
+* [#1767](https://github.com/icinga/icinga2/issues/1767): Increase icinga.cmd Limit
+* [#1753](https://github.com/icinga/icinga2/issues/1753) (Configuration): icinga2-sign-key creates ".crt" and ".key" files when the CA passphrase is invalid
+* [#1751](https://github.com/icinga/icinga2/issues/1751) (Configuration): icinga2-build-ca shouldn't prompt for DN
+* [#1749](https://github.com/icinga/icinga2/issues/1749): TLS connections are still unstable
+* [#1745](https://github.com/icinga/icinga2/issues/1745): Icinga stops updating IDO after a while
+* [#1743](https://github.com/icinga/icinga2/issues/1743) (Configuration): Please add --sni option to http check command
+* [#1740](https://github.com/icinga/icinga2/issues/1740) (Notifications): Notifications causing segfault from exim
+* [#1737](https://github.com/icinga/icinga2/issues/1737) (DB IDO): icinga2-ido-pgsql snapshot package missing dependecy dbconfig-common
+* [#1736](https://github.com/icinga/icinga2/issues/1736): Remove line number information from stack traces
+* [#1734](https://github.com/icinga/icinga2/issues/1734): Check command result doesn't match
+* [#1731](https://github.com/icinga/icinga2/issues/1731): Dependencies should cache their parent and child object
+* [#1727](https://github.com/icinga/icinga2/issues/1727): $SERVICEDESC$ isn't getting converted correctly
+* [#1724](https://github.com/icinga/icinga2/issues/1724): Improve systemd service definition
+* [#1716](https://github.com/icinga/icinga2/issues/1716) (Cluster): Icinga doesn't send SetLogPosition messages when one of the endpoints fails to connect
+* [#1712](https://github.com/icinga/icinga2/issues/1712): parsing of double defined command can generate unexpected errors
+* [#1704](https://github.com/icinga/icinga2/issues/1704): Reminder notifications are sent on disabled services 
+* [#1698](https://github.com/icinga/icinga2/issues/1698): icinga2 cannot be built with both systemd and init.d files
+* [#1697](https://github.com/icinga/icinga2/issues/1697) (Livestatus): Thruk Panorama View cannot query Host Status
+* [#1695](https://github.com/icinga/icinga2/issues/1695): icinga2.state could not be opened
+* [#1691](https://github.com/icinga/icinga2/issues/1691): build warnings
+* [#1644](https://github.com/icinga/icinga2/issues/1644) (Cluster): base64 on CentOS 5 fails to read certificate bundles
+* [#1639](https://github.com/icinga/icinga2/issues/1639) (Cluster): Deadlock in ApiListener::RelayMessage
+* [#1609](https://github.com/icinga/icinga2/issues/1609): application fails to start on wrong log file permissions but does not tell about it
+* [#1206](https://github.com/icinga/icinga2/issues/1206) (DB IDO): PostgreSQL string escaping
 
 ### ITL
 
-* [#1739](https://github.com/Icinga/icinga2/issues/1739) (ITL): Add more options to snmp check
+* [#1739](https://github.com/icinga/icinga2/issues/1739) (ITL): Add more options to snmp check
 
 ### Documentation
 
-* [#1777](https://github.com/Icinga/icinga2/issues/1777) (Documentation): event command execution cases are missing
-* [#1765](https://github.com/Icinga/icinga2/issues/1765) (Documentation): change docs.icinga.org/icinga2/latest to git master
-* [#1742](https://github.com/Icinga/icinga2/issues/1742) (Documentation): Documentation for || and && is missing
-* [#1702](https://github.com/Icinga/icinga2/issues/1702) (Documentation): Array section confusing
+* [#1777](https://github.com/icinga/icinga2/issues/1777) (Documentation): event command execution cases are missing
+* [#1765](https://github.com/icinga/icinga2/issues/1765) (Documentation): change docs.icinga.org/icinga2/latest to git master
+* [#1742](https://github.com/icinga/icinga2/issues/1742) (Documentation): Documentation for || and && is missing
+* [#1702](https://github.com/icinga/icinga2/issues/1702) (Documentation): Array section confusing
 
 ### Support
 
-* [#1764](https://github.com/Icinga/icinga2/issues/1764) (Installation): ICINGA2\_SYSCONFIGFILE should use full path using CMAKE\_INSTALL\_FULL\_SYSCONFDIR
-* [#1709](https://github.com/Icinga/icinga2/issues/1709) (Packages): htpasswd should be installed with icinga2-classicui on Ubuntu
-* [#1696](https://github.com/Icinga/icinga2/issues/1696) (Packages): Copyright problems
-* [#1655](https://github.com/Icinga/icinga2/issues/1655) (Packages): Debian package icinga2-classicui needs versioned dependency of icinga-cgi\*
+* [#1764](https://github.com/icinga/icinga2/issues/1764) (Installation): ICINGA2\_SYSCONFIGFILE should use full path using CMAKE\_INSTALL\_FULL\_SYSCONFDIR
+* [#1709](https://github.com/icinga/icinga2/issues/1709) (Packages): htpasswd should be installed with icinga2-classicui on Ubuntu
+* [#1696](https://github.com/icinga/icinga2/issues/1696) (Packages): Copyright problems
+* [#1655](https://github.com/icinga/icinga2/issues/1655) (Packages): Debian package icinga2-classicui needs versioned dependency of icinga-cgi\*
 
 ## 2.0.0 (2014-06-16)
 
@@ -3201,48 +3253,48 @@ First official release
 
 ### Enhancement
 
-* [#1600](https://github.com/Icinga/icinga2/issues/1600): Prepare 2.0.0 release
-* [#1575](https://github.com/Icinga/icinga2/issues/1575) (Cluster): Cluster: global zone for all nodes
-* [#1348](https://github.com/Icinga/icinga2/issues/1348): move vagrant box into dedicated demo project
-* [#1341](https://github.com/Icinga/icinga2/issues/1341): Revamp migration script
-* [#1322](https://github.com/Icinga/icinga2/issues/1322): Update website for release
-* [#1320](https://github.com/Icinga/icinga2/issues/1320): Update documentation for 2.0
+* [#1600](https://github.com/icinga/icinga2/issues/1600): Prepare 2.0.0 release
+* [#1575](https://github.com/icinga/icinga2/issues/1575) (Cluster): Cluster: global zone for all nodes
+* [#1348](https://github.com/icinga/icinga2/issues/1348): move vagrant box into dedicated demo project
+* [#1341](https://github.com/icinga/icinga2/issues/1341): Revamp migration script
+* [#1322](https://github.com/icinga/icinga2/issues/1322): Update website for release
+* [#1320](https://github.com/icinga/icinga2/issues/1320): Update documentation for 2.0
 
 ### Bug
 
-* [#1694](https://github.com/Icinga/icinga2/issues/1694): Separate CMakeLists.txt for etc/initsystem
-* [#1682](https://github.com/Icinga/icinga2/issues/1682) (Configuration): logrotate.conf file should rotate log files as icinga user
-* [#1680](https://github.com/Icinga/icinga2/issues/1680) (Livestatus): Column 'host\_name' does not exist in table 'hosts'
-* [#1678](https://github.com/Icinga/icinga2/issues/1678) (Livestatus): Nagvis does not work with livestatus \(invalid format\)
-* [#1673](https://github.com/Icinga/icinga2/issues/1673): OpenSUSE Packages do not enable basic features
-* [#1669](https://github.com/Icinga/icinga2/issues/1669) (Cluster): Segfault with zones without endpoints on config compile
-* [#1642](https://github.com/Icinga/icinga2/issues/1642): Check if host recovery notifications work
-* [#1615](https://github.com/Icinga/icinga2/issues/1615) (Cluster): Subdirectories in the zone config are not synced
-* [#1427](https://github.com/Icinga/icinga2/issues/1427): fd-handling in Daemonize incorrect
-* [#1312](https://github.com/Icinga/icinga2/issues/1312): Permissions error on startup is only logged but not on stderr
+* [#1694](https://github.com/icinga/icinga2/issues/1694): Separate CMakeLists.txt for etc/initsystem
+* [#1682](https://github.com/icinga/icinga2/issues/1682) (Configuration): logrotate.conf file should rotate log files as icinga user
+* [#1680](https://github.com/icinga/icinga2/issues/1680) (Livestatus): Column 'host\_name' does not exist in table 'hosts'
+* [#1678](https://github.com/icinga/icinga2/issues/1678) (Livestatus): Nagvis does not work with livestatus \(invalid format\)
+* [#1673](https://github.com/icinga/icinga2/issues/1673): OpenSUSE Packages do not enable basic features
+* [#1669](https://github.com/icinga/icinga2/issues/1669) (Cluster): Segfault with zones without endpoints on config compile
+* [#1642](https://github.com/icinga/icinga2/issues/1642): Check if host recovery notifications work
+* [#1615](https://github.com/icinga/icinga2/issues/1615) (Cluster): Subdirectories in the zone config are not synced
+* [#1427](https://github.com/icinga/icinga2/issues/1427): fd-handling in Daemonize incorrect
+* [#1312](https://github.com/icinga/icinga2/issues/1312): Permissions error on startup is only logged but not on stderr
 
 ### ITL
 
-* [#1690](https://github.com/Icinga/icinga2/issues/1690) (ITL): improve predefined command-plugins
+* [#1690](https://github.com/icinga/icinga2/issues/1690) (ITL): improve predefined command-plugins
 
 ### Documentation
 
-* [#1689](https://github.com/Icinga/icinga2/issues/1689) (Documentation): explain the icinga 2 reload
-* [#1681](https://github.com/Icinga/icinga2/issues/1681) (Documentation): Add instructions to install debug symbols on debian systems
-* [#1675](https://github.com/Icinga/icinga2/issues/1675) (Documentation): add a note on no length restrictions for plugin output / perfdata
-* [#1636](https://github.com/Icinga/icinga2/issues/1636) (Documentation): Update command definitions to use argument conditions
-* [#1572](https://github.com/Icinga/icinga2/issues/1572) (Documentation): change docs.icinga.org/icinga2/snapshot to 'latest'
-* [#1302](https://github.com/Icinga/icinga2/issues/1302) (Documentation): Replace Sphinx with Icinga Web 2 Doc Module
+* [#1689](https://github.com/icinga/icinga2/issues/1689) (Documentation): explain the icinga 2 reload
+* [#1681](https://github.com/icinga/icinga2/issues/1681) (Documentation): Add instructions to install debug symbols on debian systems
+* [#1675](https://github.com/icinga/icinga2/issues/1675) (Documentation): add a note on no length restrictions for plugin output / perfdata
+* [#1636](https://github.com/icinga/icinga2/issues/1636) (Documentation): Update command definitions to use argument conditions
+* [#1572](https://github.com/icinga/icinga2/issues/1572) (Documentation): change docs.icinga.org/icinga2/snapshot to 'latest'
+* [#1302](https://github.com/icinga/icinga2/issues/1302) (Documentation): Replace Sphinx with Icinga Web 2 Doc Module
 
 ### Support
 
-* [#1686](https://github.com/Icinga/icinga2/issues/1686) (Installation): man pages for scripts
-* [#1685](https://github.com/Icinga/icinga2/issues/1685) (Installation): Cleanup installer for 2.0 supported features
-* [#1683](https://github.com/Icinga/icinga2/issues/1683) (Installation): remove 0.0.x schema upgrade files
-* [#1670](https://github.com/Icinga/icinga2/issues/1670) (Packages): Ubuntu package Release file lacks 'Suite' line
-* [#1645](https://github.com/Icinga/icinga2/issues/1645) (Packages): Packages are not installable on CentOS 5
-* [#1342](https://github.com/Icinga/icinga2/issues/1342) (Installation): Less verbose start output using the initscript
-* [#1319](https://github.com/Icinga/icinga2/issues/1319) (Tests): Release tests
-* [#907](https://github.com/Icinga/icinga2/issues/907) (Packages): icinga2-classicui is not installable on Debian
-* [#788](https://github.com/Icinga/icinga2/issues/788) (Packages): add systemd support
+* [#1686](https://github.com/icinga/icinga2/issues/1686) (Installation): man pages for scripts
+* [#1685](https://github.com/icinga/icinga2/issues/1685) (Installation): Cleanup installer for 2.0 supported features
+* [#1683](https://github.com/icinga/icinga2/issues/1683) (Installation): remove 0.0.x schema upgrade files
+* [#1670](https://github.com/icinga/icinga2/issues/1670) (Packages): Ubuntu package Release file lacks 'Suite' line
+* [#1645](https://github.com/icinga/icinga2/issues/1645) (Packages): Packages are not installable on CentOS 5
+* [#1342](https://github.com/icinga/icinga2/issues/1342) (Installation): Less verbose start output using the initscript
+* [#1319](https://github.com/icinga/icinga2/issues/1319) (Tests): Release tests
+* [#907](https://github.com/icinga/icinga2/issues/907) (Packages): icinga2-classicui is not installable on Debian
+* [#788](https://github.com/icinga/icinga2/issues/788) (Packages): add systemd support
 
diff --git a/icinga2.spec b/icinga2.spec
index 92abe079e..e81227b2a 100644
--- a/icinga2.spec
+++ b/icinga2.spec
@@ -20,4 +20,4 @@
 # The spec file was moved to https://github.com/Icinga/icinga-packaging
 
 %define revision 1
-Version: 2.8.1
+Version: 2.8.2