5517 Commits

Author SHA1 Message Date
Alexander A. Klimov
ff6219597a ApiListener#Start(): auto-renew own cert if CA owner
otherwise that particular cert would expire.
2022-04-11 12:44:52 +02:00
Alexander A. Klimov
1492bffccc Introduce ApiListener#RenewCert() 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
913373fc38 Introduce IsCertUptodate() 2022-04-11 12:44:52 +02:00
Alexander A. Klimov
01422dfdf7 Request certificate renewal also master2->master1
not only sat->master to prevent master2's certificate from expiring.
2022-04-11 12:44:52 +02:00
Alexander A. Klimov
19ecb241f5 Let new cluster certificates expire after 397 days, not 15 years
https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf, section 6.3.2:

"Subscriber Certificates issued on or after 1 September 2020 SHOULD NOT have a Validity Period greater than 397 days and MUST NOT have a Validity Period greater than 398 days."
2022-04-11 12:44:52 +02:00
Alexander Aleksandrovič Klimov
92e688b94a
Merge pull request #9320 from Icinga/boost1.78
Make compatible with Boost 1.78 (for Windows)
2022-04-06 16:38:33 +02:00
Alexander Aleksandrovič Klimov
eebfd0284c
Merge pull request #9317 from Icinga/revert-9245-bugfix/adjust-behavior-of-service-get-severity-212
Revert "Service#GetSeverity(): behave as the respective IDO query of Icinga Web"
2022-04-06 13:39:41 +02:00
Alexander A. Klimov
1e0a0f7f9d Fix missing include 2022-04-06 12:44:49 +02:00
Julian Brost
f60a0111b7
Merge pull request #9313 from Icinga/9308
IDO MySQL: explicitly use latin1
2022-04-06 09:50:15 +02:00
Julian Brost
77aec49667
Revert "Service#GetSeverity(): behave as the respective IDO query of Icinga Web" 2022-04-01 15:06:47 +02:00
Alexander A. Klimov
11b8d0f058 IDO MySQL: reason latin1 charset for actually UTF-8 bytes 2022-03-31 18:10:21 +02:00
Alexander A. Klimov
245fbad1e5 IDO MySQL: explicitly use latin1
for the case the MySQL client lib is compiled with another default
not to turn Unicode chars into ??.
2022-03-31 15:04:45 +02:00
Yonas Habteab
7f9cbc8707 ConfigObject: Initialize local static var at declaration to ensure thread safety 2022-03-29 16:36:50 +02:00
Yonas Habteab
6ecf4fe4b5 ConfigItem: Use atomic variables for notified and commited items count 2022-03-29 16:36:50 +02:00
Julian Brost
5d2625c711
Merge pull request #9294 from Icinga/bugfix/override-default-template-apply-rules-7914
Apply rules: import default templates first
2022-03-29 16:03:46 +02:00
Alexander A. Klimov
07cd15f48f Apply rules: import default templates first
... to allow to override the attributes they set.

refs #7914
2022-03-24 14:04:58 +01:00
Julian Brost
77eed19482
Merge pull request #9246 from Icinga/bugfix/timeperiod-dst-2.0-212
LegacyTimePeriod::ScriptFunc: fix DST edge-cases
2022-03-08 15:28:20 +01:00
Julian Brost
9dcd2da9b3
Merge pull request #9229 from Icinga/bugfix/processcheckresult-dependency-deadlock-2.12
Prevent deadlock in ProcessCheckResult
2022-03-07 11:15:11 +01:00
Julian Brost
93217de515 LegacyTimePeriod::ScriptFunc: fix DST edge-cases
This change fixes two problems:
* The internal functions used by ScriptFunc more or less expect to operate on
  full days, but ScriptFunc may have called them with some random timestamp
  during the day. This is fixed by always using midnight of the day as
  reference time.
* Previously, the code advanced a timestamp to the next day by adding 24 hours.
  On days with DST changes, this could either still be on the same day (a day
  may have 25 hours) or skip an entire day (a day may have 23 hours). This is
  fixed by using a struct tm to advance the time to the next day.
2022-03-07 09:42:21 +01:00
Julian Brost
9e0459e5e1
Merge pull request #9245 from Icinga/bugfix/adjust-behavior-of-service-get-severity-212
Service#GetSeverity(): behave as the respective IDO query of Icinga Web
2022-03-07 09:24:13 +01:00
Julian Brost
4bdde970df
Merge pull request #9243 from Icinga/bugfix/multi-ido-notification-id-212
IDO: fix incorrect contacts in notification history with multiple IDO instances on a single node
2022-03-07 09:22:17 +01:00
Julian Brost
0ccd7b799c
Merge pull request #9247 from Icinga/bugfix/influxdb-writer-synchronization-212
Fix unsafe concurrent access to m_DataBuffer in InfluxdbWriter
2022-03-01 15:07:48 +01:00
Julian Brost
4d28a01b84 InfluxdbWriter: use atomic_size_t to data buffer size from stats function
m_DataBuffer may be modified concurrently while StatsFunc() is called, thus
it's unsafe to call size() on it. As write access to m_DataBuffer is already
synchronized by only modifying it from the single work queue thread, instead of
adding a mutex, this commit adds a new std::atomic_size_t which is additionally
updated when modifying m_DataBuffer and can safely be accessed in StatsFunc().
2022-02-28 17:39:18 +01:00
Julian Brost
489660fb27
Merge pull request #9261 from Icinga/bugfix/event-handler-spamming-8704-212
Checkable#ExecuteEventHandler(): don't outsource event command run twice
2022-02-25 16:52:50 +01:00
Alexander A. Klimov
74935dad7b Checkable#ExecuteEventHandler(): don't outsource event command run twice
refs #8704
2022-02-24 14:03:57 +01:00
Julian Brost
a2a5c3f28d InfluxdbWriter: only flush from work queue
There is no explicit synchronization of access to m_DataBuffer which is fine if
it is only accessed from the single-threaded work queue. However, Stop() also
called Flush() in another thread, leading to concurrent write access to
m_DataBuffer which can result in a crash due to use after free/double free.

Changes in this commit:
* Flush() is renamed to FlushWQ() to show that it should only be called from
  the work queue. Additionally, it now asserts that it is running on the work
  queue.
* Visibility of some data members is changed from protected to private. No
  other classes have to access these at the moment. By this change, accidental
  concurrent access from derived classes in the future is prevented.
* Stop() now flushes by posting FlushWQ() to the work queue and joining it.
2022-02-23 15:08:57 +01:00
Julian Brost
899e020fde LegacyTimePeriod: Prevent modification of input parameters
Many functions of LegacyTimePeriod take a tm pointer as an input parameter and
then pass it to mktime() which actually modifies it. This causes problems if
tm_isdst was intentionally set to -1 (to automatically detect whether DST is
active at some time) and then a function is called that implicitly sets
tm_isdst and then the values of tm are modified in a way that crosses a DST
change. This resulted in 1 hour offsets with ScheduledDowntimes on days with
DST changes.
2022-02-22 11:48:44 +01:00
Alexander Aleksandrovič Klimov
627fd91ac6 Service#GetSeverity(): behave as the respective IDO query of Icinga Web
which doesn't include host reachability.
2022-02-21 16:11:48 +01:00
Julian Brost
69f181f98e IDO: use per-instance notification_id in history
When there are multiple active IDO instances on the same node, before this
commit, all of them would share a single DbValue object for the notification_id
column of the icinga_contactnotifications table. This resulted in the issue
that one database references the notification_id in another database.

This commit fixes this by using a separate DbValue value for each IDO instance.
This needs a new signal as the existing OnQuery and OnMultipleQueries signals
perform the same queries on all IDO instances, but different queries are needed
here per instance (they only differ in the referenced DbValue). Therefore, a
new signal OnMakeQueries is added that takes a std::function which is called
once per IDO instance and can access callbacks to perform one or multiple
queries only on this specific IDO instance.
2022-02-21 16:03:14 +01:00
Julian Brost
485e287d28 Prevent deadlock in ProcessCheckResult
Without this commit, children and parents of a checkable were rescheduled on a
state change while holding the lock for the current checkable. If both ends of
a dependency are checked at the same time and both change state, they could end
up in a deadlock waiting for each other.

This commit fixes this problem by changing the code so that other checkables
are rescheduled only after releasing the lock for the current checkable.
2022-02-18 14:39:48 +01:00
Julian Brost
93461e9397
Merge pull request #9184 from Icinga/bugfix/downtime-all-services-on-child-hosts-212
Fix scheduling of downtimes for all services on child hosts
2022-01-21 18:03:32 +01:00
Julian Brost
9fc426e20e Don't trigger a fixed downtime like a flexible one
When creating a fixed downtime that starts immediately while the checkable is
in a non-OK state, previously the code path for flexible downtimes was used to
trigger this downtime. This is fixed by this commit which resolves two issued:

1. Missing downtime start notification: notifications work differently for
   fixed and flexible downtimes. This resulted in missing downtime start
   notifications under the conditions described above.
2. Incorrect downtime trigger time: this code path would incorrectly assume the
   timestamp of the last checkable as the trigger time which is incorrect for
   fixed downtimes.
2022-01-20 11:45:38 +01:00
Julian Brost
b9e2499148 Prevent duplicate donwtimes when combining child_options and all_services 2022-01-20 11:40:21 +01:00
Julian Brost
f298314216 Fix scheduling of downtimes for all services on child hosts
The loop iterated over the services of the wrong host resulting in duplicate
downtimes scheduled for services of the parent host instead of downtimes for
services of the child host.
2022-01-20 11:40:21 +01:00
Julian Brost
49cef4e907
Merge pull request #9125 from Icinga/bugfix/icinga2-crashes-when-sending-notifications-8186
Avoid "type" key in dicts being part of object state attrs
2022-01-19 15:49:02 +01:00
Alexander A. Klimov
e9e555468d Handle "type" key in dicts being part of object state attrs
i.e. the confusion of the state file deserializator with e.g. `"type":32` on startup.
That would unexpectedly restore (the now ignored) null (not `{"type":32}`) as there's no type "32".

refs #8186
2022-01-04 17:17:20 +01:00
Julian Brost
a379f6e08c Make MySQL schema version in full schema file and upgrade files consistent
In the 2.12.6 release, the full schema file sets the version to 1.14.3, whereas
the latest available upgrade file 2.11.0.sql sets it to 1.15.0. Therefore, ship
a new upgrade file 2.12.7.sql for all users who imported their schema with
version 2.11.0 or later and never performed an upgrade since then. Their
databases incorrectly state schema version 1.14.3 and is bumped to the correct
version 1.15.0 by the upgrade. Additionally, the version number in the full
schema is also bumped to the correct version 1.15.0.
2021-12-16 16:04:54 +01:00
Alexander A. Klimov
eb71fb7529 Avoid "type" key in dicts being part of object state attrs
not to confuse the state file deserializator with e.g. `"type":32` on startup.
That would unexpectedly restore null (not `{"type":32}`) as there's no type "32".

refs #8186
2021-12-13 17:56:12 +01:00
Julian Brost
b7dd909a30 GelfWriter: show error message of exceptions 2021-08-17 16:38:54 +02:00
Julian Brost
6db8795ca4 InfluxdbWriter: actually verify TLS server certificates
And add a new option ssl_insecure_noverify to explicitly disable it if desired.
2021-08-17 16:38:39 +02:00
Julian Brost
d7133ae429 GelfWriter: actually verify TLS server certificates
And add a new option insecure_noverify to explicitly disable it if desired.
2021-08-17 16:33:18 +02:00
Julian Brost
bf535969ac ElasticsearchWriter: actually verify TLS server certificates
And add a new option insecure_noverify to explicitly disable it if desired.
2021-08-17 16:33:18 +02:00
Julian Brost
8910abc588 Enable hostname verification in UnbufferedAsioTlsStream 2021-08-17 16:33:18 +02:00
Alexander A. Klimov
b5b83fa515 API: hide ApiListener#ticket_salt 2021-07-09 09:30:45 +02:00
Julian Brost
843353ab69 Remove passwords from API
IdoMysqlConnection, IdoPgsqlConnection, IcingaDB, and ElasticsearchWriter
require passwords in their configuration to authenticate against external
services. This commit ensures that these can no longer be accessed using the
API.
2021-07-09 09:05:05 +02:00
Julian Brost
289a872eaf
Merge pull request #8865 from Icinga/feature/improve-crashlog-212
Improve crashlog
2021-07-09 08:21:44 +02:00
Julian Brost
4a1e6528ea
Merge pull request #8889 from Icinga/bugfix/trigger-fixed-downtimes-immediately-212
Downtime#Start(): trigger fixed downtimes immediately instead of waiting for the timer
2021-07-08 15:33:11 +02:00
Julian Brost
d8ab328c33 Add comments to stack trace formatter and test case 2021-07-08 14:53:15 +02:00
Julian Brost
f5873a8e75 Use backtrace_symbols() when printing stack traces on FreeBSD
Unfortunately, the symbol resolution of boost::stacktrace is broken on
FreeBSD, therefore fall back to using backtrace_symbols() to print the
stack trace saved by Boost.

Additionally, -D_GNU_SOURCE is required on FreeBSD for the
_Unwind_Backtrace function used by boost::stacktrace.
2021-07-08 14:53:15 +02:00
Julian Brost
a2e5cfd34f Crash handlers: use more compact string representation 2021-07-08 14:53:15 +02:00