tyler.durden/icinga2
1
0
Fork 0
mirror of https://github.com/Icinga/icinga2.git synced 2025-08-21 01:28:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,310 Commits 277 Branches 124 Tags
Commit Graph

5542 Commits

Author SHA1 Message Date
Julian Brost
9b2c05d0cc VerifyCertificate: Work around issue in OpenSSL < 1.1.0 causing invalid certifcates being treated as valid 
Old versions of OpenSSL stored a valid flag in the certificate (see inline code
comment for details) that if already set, causes parts of the verification to
be skipped and return that the certificate is valid, even if it's not actually
signed by the CA in the trust store.

This issue was assigned CVE-2025-48057.
 2025-05-22 12:17:38 +02:00
Julian Brost
8cc83c0d6e VerifyCertificate: fix use after free 
`X509_STORE_CTX_get_error(csc)` was called after `X509_STORE_CTX_free(csc)`.
This is fixed by automatically freeing variables at the end of the function
using `std::unique_ptr`.
 2025-05-22 12:17:38 +02:00
Alexander A. Klimov
34c93a2542 CertificateToString(): allow raw pointer input 2025-05-22 12:17:38 +02:00
Julian Brost
0419a2c36d Security: fix TLS certificate validation bypass 
The previous validation in set_verify_callback() could be bypassed, tricking
Icinga 2 into treating invalid certificates as valid. To fix this, the
validation checks were moved into the IsVerifyOK() function.

This is tracked as CVE-2024-49369, more details will be published at a later time.
 2024-10-22 10:42:57 +02:00
Alexander A. Klimov
75375e2edf Handle boost::beast::http::basic_fields#operator[]() signature change (v1.81) 
Use always working std::string(x), not broken x.to_string().
(x is a return value.)
 2023-02-15 13:36:58 +01:00
Alexander A. Klimov
21bc188f59 Handle boost::beast::http::basic_fields#set() signature change (v1.81) 
Make String convertible to boost::beast::string_view (always working),
not boost::string_view (broken).
 2023-02-15 13:36:58 +01:00
Alexander Aleksandrovič Klimov
0b66a3578d
Merge pull request #9394 from Icinga/bugfix/atomic-members-2.12 
Synchronize all access to auto-generated class members (from .ti files)
 2022-06-23 11:32:33 +02:00
Julian Brost
71fc301702 Remove redundant call to Serialize() in ConfigItem::Commit() 
The very same object is already serialized a few lines above, the result is
even stored in a variable, but that variable was not used before. Simply using
this variable results in a noticeable improvement of config validation times.
 2022-06-15 11:04:37 +02:00
Julian Brost
33a52d8655 Replace EventuallyAtomic with AtomicOrLocked which falls back to a mutex 
Apparently there was a reason for making the members of generated classes
atomic. However, this was only done for some types, others were still accessed
using non-atomic operations. For members of type T::Ptr (i.e.  intrusive_ptr<T>),
this can result in a double free when multiple threads access the same variable
and at least one of them writes to the variable.

This commit makes use of std::atomic<T> for more T (it removes the additional
constraint sizeof(T) <= sizeof(void*)) and uses a type including a mutex for
load and store operations as a fallback.
 2022-06-14 12:23:04 +02:00
Alexander A. Klimov
dba78f73da mkclass: make .ti class members atomic if possible 
... not to have to lock the objects while setting attributes.
 2022-06-14 12:23:04 +02:00
Julian Brost
d281107f33 Fix mixed up arguments for Downtime::RemoveDowntime() 
PR #8879 backported a call to that function as is without considering the
different signature of that function between 2.12 and 2.13+.

master:
  static void RemoveDowntime(
    const String& id,      // downtime->GetName()
    bool includeChildren,  // false
    bool cancelled,        // true
    bool expired = false,
    const String& removedBy = "",
    const MessageOrigin::Ptr& origin = nullptr
  );

support/2.12 without this commit:
  static void RemoveDowntime(
    const String& id,      // downtime->GetName()
    bool cancelled,        // false
    bool expired = false,  // true
    const MessageOrigin::Ptr& origin = nullptr
  );

support/2.12 with this commit:
  static void RemoveDowntime(
    const String& id,  // downtime->GetName()
    bool cancelled,    // true
    bool expired = false,
    const MessageOrigin::Ptr& origin = nullptr
  );
 2022-04-19 17:32:56 +02:00
Julian Brost
15f71f434a Fix mixed up arguments for Downtime::AddDowntime() 
PR #9184 backported a call to that function as is without considering the
different signature of that function between 2.12 and 2.13+.

master:
  static Ptr AddDowntime(
    const intrusive_ptr<Checkable>& checkable,   // childService
    const String& author,                        // author
    const String& comment,                       // comment
    double startTime,                            // startTime
    double endTime,                              // endTime
    bool fixed,                                  // fixed
    const String& triggeredBy,                   // triggerName
    double duration,                             // duration
    const String& scheduledDowntime = String(),  // String()
    const String& scheduledBy = String(),        // String()
    const String& parent = String(),             // childDowntimeName
    const String& id = String(),
    const MessageOrigin::Ptr& origin = nullptr
  );

support/2.12 without this commit:
  static Ptr AddDowntime(
    const intrusive_ptr<Checkable>& checkable,   // childService
    const String& author,                        // author
    const String& comment,                       // comment
    double startTime,                            // startTime
    double endTime,                              // endTime
    bool fixed,                                  // fixed
    const String& triggeredBy,                   // triggerName
    double duration,                             // duration
    const String& scheduledDowntime = String(),  // String()
    const String& scheduledBy = String(),        // String()
    const String& id = String(),                 // childService
    const MessageOrigin::Ptr& origin = nullptr
  );

support/2.12 with this commit:
  static Ptr AddDowntime(
    const intrusive_ptr<Checkable>& checkable,   // childService
    const String& author,                        // author
    const String& comment,                       // comment
    double startTime,                            // startTime
    double endTime,                              // endTime
    bool fixed,                                  // fixed
    const String& triggeredBy,                   // triggerName
    double duration,                             // duration
    const String& scheduledDowntime = String(),
    const String& scheduledBy = String(),
    const String& id = String(),
    const MessageOrigin::Ptr& origin = nullptr
  );
 2022-04-19 17:18:06 +02:00
Julian Brost
372f8f3599
Merge pull request #9338 from Icinga/Al2Klimov-patch-3-212 
Let new cluster certificates expire after 397 days, not 15 years
 2022-04-12 09:50:37 +02:00
Julian Brost
c19a9192a1
Merge pull request #9334 from Icinga/bugfix/compare-cluster-tickets-in-constant-time-212 
Compare cluster tickets in constant time
 2022-04-11 20:28:51 +02:00
Julian Brost
3cd3766672
Merge pull request #9336 from Icinga/bugfix/startup-log-212 
Place startup.log and status in /var/lib/icinga2/api, not /var/lib/icinga2/api/zones-stage
 2022-04-11 18:05:53 +02:00
Alexander A. Klimov
a2817aefc7 Protect ApiListener#m_SSLContext with a mutex 2022-04-11 12:51:45 +02:00
Alexander A. Klimov
97dce39699 Renew certificates also periodically 2022-04-11 12:45:58 +02:00
Alexander A. Klimov
ff6219597a ApiListener#Start(): auto-renew own cert if CA owner 
otherwise that particular cert would expire.
 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
1492bffccc Introduce ApiListener#RenewCert() 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
913373fc38 Introduce IsCertUptodate() 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
01422dfdf7 Request certificate renewal also master2->master1 
not only sat->master to prevent master2's certificate from expiring.
 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
19ecb241f5 Let new cluster certificates expire after 397 days, not 15 years 
https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf, section 6.3.2:

"Subscriber Certificates issued on or after 1 September 2020 SHOULD NOT have a Validity Period greater than 397 days and MUST NOT have a Validity Period greater than 398 days."
 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
da70fea20e Write also /var/lib/icinga2/api/zones-stage-startup-last-failed.log 
in addition to /var/lib/icinga2/api/zones-stage-startup.log
to prevent the next success to overwrite the last failure.
 2022-04-11 12:30:05 +02:00
Alexander A. Klimov
e9c3e3718d Place startup.log and status in /var/lib/icinga2/api, not /var/lib/icinga2/api/zones-stage 
not to loose them.
 2022-04-11 12:30:05 +02:00
Alexander A. Klimov
dc2a3841ce Compare cluster tickets in constant time 
Just to be sure.
 2022-04-11 11:43:35 +02:00
Julian Brost
c402baf088
Merge pull request #9326 from Icinga/bugfix/parallel-api-package-calls-do-not-finish-while-reload 
Worker process doesn't let parallel API package stage updates to complete when terminated
 2022-04-08 12:28:11 +02:00
Yonas Habteab
0d4a68adc3 ConfigStagesHandler: Don't allow concurrent package updates anymore 
To prevent Icinga2 from being restarted while
one or more requests are still in progress and end up
as corrupted stages without status file and startup logs.
 2022-04-07 18:35:47 +02:00
Yonas Habteab
bda2849412 ConfigPackageUtility: Don't reset ongoing package updates on config validation success and process is going to be reloaded 2022-04-07 18:35:47 +02:00
Alexander A. Klimov
1eb274b550 Perfdata writers: disconnect handlers from signals in Pause() 
as they would be re-connected in Resume() (HA).

Before they were still connected during pause and connected X+1 times
after X split-brains (the same data was written X+1 times).
 2022-04-07 13:00:27 +02:00
Yonas Habteab
e3f14883e9 Defer: Allow to cancel the callback before going out of scope 2022-04-07 11:30:50 +02:00
Alexander Aleksandrovič Klimov
92e688b94a
Merge pull request #9320 from Icinga/boost1.78 
Make compatible with Boost 1.78 (for Windows)
 2022-04-06 16:38:33 +02:00
Alexander Aleksandrovič Klimov
eebfd0284c
Merge pull request #9317 from Icinga/revert-9245-bugfix/adjust-behavior-of-service-get-severity-212 
Revert "Service#GetSeverity(): behave as the respective IDO query of Icinga Web"
 2022-04-06 13:39:41 +02:00
Alexander A. Klimov
1e0a0f7f9d Fix missing include 2022-04-06 12:44:49 +02:00
Julian Brost
f60a0111b7
Merge pull request #9313 from Icinga/9308 
IDO MySQL: explicitly use latin1
 2022-04-06 09:50:15 +02:00
Julian Brost
77aec49667
Revert "Service#GetSeverity(): behave as the respective IDO query of Icinga Web" 2022-04-01 15:06:47 +02:00
Alexander A. Klimov
11b8d0f058 IDO MySQL: reason latin1 charset for actually UTF-8 bytes 2022-03-31 18:10:21 +02:00
Alexander A. Klimov
245fbad1e5 IDO MySQL: explicitly use latin1 
for the case the MySQL client lib is compiled with another default
not to turn Unicode chars into ??.
 2022-03-31 15:04:45 +02:00
Yonas Habteab
7f9cbc8707 ConfigObject: Initialize local static var at declaration to ensure thread safety 2022-03-29 16:36:50 +02:00
Yonas Habteab
6ecf4fe4b5 ConfigItem: Use atomic variables for notified and commited items count 2022-03-29 16:36:50 +02:00
Julian Brost
5d2625c711
Merge pull request #9294 from Icinga/bugfix/override-default-template-apply-rules-7914 
Apply rules: import default templates first
 2022-03-29 16:03:46 +02:00
Alexander A. Klimov
07cd15f48f Apply rules: import default templates first 
... to allow to override the attributes they set.

refs #7914
 2022-03-24 14:04:58 +01:00
Julian Brost
77eed19482
Merge pull request #9246 from Icinga/bugfix/timeperiod-dst-2.0-212 
LegacyTimePeriod::ScriptFunc: fix DST edge-cases
 2022-03-08 15:28:20 +01:00
Julian Brost
9dcd2da9b3
Merge pull request #9229 from Icinga/bugfix/processcheckresult-dependency-deadlock-2.12 
Prevent deadlock in ProcessCheckResult
 2022-03-07 11:15:11 +01:00
Julian Brost
93217de515 LegacyTimePeriod::ScriptFunc: fix DST edge-cases 
This change fixes two problems:
* The internal functions used by ScriptFunc more or less expect to operate on
  full days, but ScriptFunc may have called them with some random timestamp
  during the day. This is fixed by always using midnight of the day as
  reference time.
* Previously, the code advanced a timestamp to the next day by adding 24 hours.
  On days with DST changes, this could either still be on the same day (a day
  may have 25 hours) or skip an entire day (a day may have 23 hours). This is
  fixed by using a struct tm to advance the time to the next day.
 2022-03-07 09:42:21 +01:00
Julian Brost
9e0459e5e1
Merge pull request #9245 from Icinga/bugfix/adjust-behavior-of-service-get-severity-212 
Service#GetSeverity(): behave as the respective IDO query of Icinga Web
 2022-03-07 09:24:13 +01:00
Julian Brost
4bdde970df
Merge pull request #9243 from Icinga/bugfix/multi-ido-notification-id-212 
IDO: fix incorrect contacts in notification history with multiple IDO instances on a single node
 2022-03-07 09:22:17 +01:00
Julian Brost
0ccd7b799c
Merge pull request #9247 from Icinga/bugfix/influxdb-writer-synchronization-212 
Fix unsafe concurrent access to m_DataBuffer in InfluxdbWriter
 2022-03-01 15:07:48 +01:00
Julian Brost
4d28a01b84 InfluxdbWriter: use atomic_size_t to data buffer size from stats function 
m_DataBuffer may be modified concurrently while StatsFunc() is called, thus
it's unsafe to call size() on it. As write access to m_DataBuffer is already
synchronized by only modifying it from the single work queue thread, instead of
adding a mutex, this commit adds a new std::atomic_size_t which is additionally
updated when modifying m_DataBuffer and can safely be accessed in StatsFunc().
 2022-02-28 17:39:18 +01:00
Julian Brost
489660fb27
Merge pull request #9261 from Icinga/bugfix/event-handler-spamming-8704-212 
Checkable#ExecuteEventHandler(): don't outsource event command run twice
 2022-02-25 16:52:50 +01:00
Alexander A. Klimov
74935dad7b Checkable#ExecuteEventHandler(): don't outsource event command run twice 
refs #8704
 2022-02-24 14:03:57 +01:00