14835 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Johannes Schmidt	c707b416cb	Get version string from git-describe, git-archive or CMake config	2026-07-02 10:17:14 +02:00
Johannes Schmidt	a3936c9e01	Generate version information file during git-archive	2026-07-02 10:17:03 +02:00
Johannes Schmidt	589a633254	Use Application::GetAppVersion() consistently	2026-07-02 09:48:28 +02:00
Johannes Schmidt	239db33f59	Rename GetAppSpecVersion() to GetAppPackageVersion()	2026-07-02 09:47:29 +02:00
Alexander Aleksandrovič Klimov	8a366bc140	Merge pull request #10841 from Icinga/binarytohex-length ... Minor fixes and tests for BinaryToHex()	2026-07-01 10:35:11 +02:00
Alexander Aleksandrovič Klimov	4fef250ea8	Merge pull request #10826 from Icinga/global-custom-vars-doc ... Fix documentation on global custom variables	2026-07-01 10:34:40 +02:00
Alexander Aleksandrovič Klimov	be9397609a	Merge pull request #10297 from Icinga/intrusive_ptr_refcnt ... intrusive_ptr_*(): specify memory_order explicitly	2026-07-01 10:19:14 +02:00
Julian Brost	27528c65c4	Merge pull request #10914 from eimann/bugfix/json-decode-single-argument-10913 ... Restore single-argument Json.decode() in the DSL	2026-06-30 14:45:44 +02:00
Dominik Bay	326cbde447	Add Dominik Bay to AUTHORS ... refs #10913	2026-06-30 10:42:40 +02:00
Dominik Bay	d29ac491f2	Restore single-argument Json.decode() in the DSL ... The recursion depth limit added to JsonDecode() in 2.16.2 gave the C++ function a second parameter with a default value. Function pointers do not carry default arguments, so the DSL function binding deduced an arity of 2 via boost::function_types::function_arity and required two arguments. As a result `Json.decode("...")` failed with "Too few arguments for function", an undocumented breaking change in a patch release. Wrap JsonDecode() in a single-argument shim (mirroring the existing JsonEncodeShim) so the registered function keeps its one-parameter contract while still applying the default depth limit internally. refs #10913	2026-06-30 10:42:40 +02:00
Julian Brost	b16c7a9518	Merge pull request #10912 from Icinga/forward-port-missing-v2.15.1-upgrading-docs ... Forward-port missing v2.15.1 upgrading docs to master branch	2026-06-30 09:42:01 +02:00
Johannes Schmidt	26fa08de16	Merge pull request #10911 from Icinga/forward-port-changelog-v2.16.2-et-al ... Forward port the change logs for v2.16.2, v2.15.4, and v2.14.9 to master branch	2026-06-29 21:05:50 +02:00
Julian Brost	53aff59cd3	Merge pull request #10910 from Icinga/configwriter-import-validation ... ConfigWriter::EmitScope: Escape import	2026-06-29 20:35:37 +02:00
Julian Brost	165378adae	Merge pull request #10909 from Icinga/filter-expression-permission ... Add filter-expression permission	2026-06-29 20:33:12 +02:00
Julian Brost	fb42312e6c	Merge pull request #10908 from Icinga/json-parsing-recursion-limit ... [GHSA-wh38-wg57-5w7g] Fix stack overflow due to deeply nested data structures	2026-06-29 20:15:53 +02:00
Julian Brost	2c14db1c26	Merge pull request #10907 from Icinga/fix-ca-replacement-vuln ... [GHSA-vj39-ww8j-vvx5] Checking if certificate update request comes from a valid endpoint	2026-06-29 20:13:49 +02:00
Julian Brost	d656f03862	Add upgrading docs explaining the config file change for logrotate ... (cherry picked from commit ead09722a9)	2026-06-29 16:53:17 +02:00
Julian Brost	0378334526	Changelog for v2.14.9 ... Co-authored-by: Johannes Schmidt <johannes.schmidt@icinga.com> (cherry picked from commit 4f172a5a14) (cherry picked from commit 5c60ff65cb)	2026-06-29 16:34:33 +02:00
Julian Brost	d3f9894fd6	Changelog for v2.15.4 ... Co-authored-by: Johannes Schmidt <johannes.schmidt@icinga.com> (cherry picked from commit 4f172a5a14) (cherry picked from commit 088f3409c3)	2026-06-29 16:33:34 +02:00
Julian Brost	784ce99849	Changelog for v2.16.2 ... Co-authored-by: Johannes Schmidt <johannes.schmidt@icinga.com> (cherry picked from commit 4f172a5a14)	2026-06-29 16:32:24 +02:00
Alexander Aleksandrovič Klimov	ecb8ef8d7b	Merge pull request #10866 from Icinga/Al2Klimov-patch-3 ... ifw-api: omit password from curl command in check result	2026-06-29 12:20:25 +02:00
Alexander A. Klimov	590ad7a740	intrusive_ptr_*(): specify memory_order explicitly ... More relaxed memory_order = less safety guarantees = faster execution. This is safe because std::shared_ptr does the same. See also: https://en.cppreference.com/w/cpp/atomic/memory_order "Typical use for relaxed memory ordering is incrementing counters, such as the reference counters of std::shared_ptr, since this only requires atomicity, but not ordering or synchronization (note that decrementing the std::shared_ptr counters requires acquire-release synchronization with the destructor)."	2026-06-26 14:45:42 +02:00
Alexander Aleksandrovič Klimov	abb5a851bd	Merge pull request #10895 from Icinga/Al2Klimov-patch-9 ... win-dev.ps1: prevent merge conflicts during backports	2026-06-26 10:29:21 +02:00
Julian Brost	a155da01b2	Also execute JsonDecode stack size test in pthread if available ... Depending on the Boost version, the existing test case based on Boost.Asio coroutines might use a stack allocated without a guard page and might not reliably detect an overflow. This commit additionally runs the same test function within a pthread thread started with the same stack size as used by our coroutines.	2026-06-23 15:38:19 +02:00
Julian Brost	28711824cc	Use protected stack for new-style Boost.Asio coroutines ... In the `boost::asio::spawn()` call for newer Boost versions with `std::allocator_arg`, switch from `fixedsize_stack` to `protected_fixedsize_stack` in order to allocate the stacks with guard pages. This is done as an additional safeguard in case there was still some way to overflow, this at least reliably crashes the process instead of going into undefined behavior, which could even result in code execution. Unfortunately, the old-style `spawn()` function with `boost::coroutines::attributes` does not - at least to my knowledge - provide a way to request a stack allocated with guard pages, hence this is only enabled for Boost 1.87 and later with this commit.	2026-06-23 15:38:19 +02:00
Julian Brost	0481a66b01	Add tests for JsonDecode depth limit in combination with coroutine stacks	2026-06-23 15:38:19 +02:00
Julian Brost	ed202ed745	tests: move SpawnSynchronizedCoroutine() to utils.cpp ... This allows reusing the helper also from other test files.	2026-06-23 15:38:19 +02:00
Julian Brost	4b7ef02bd2	Prevent HTTP requests from creating deeply nested data structures ... Add validation checks to code paths reachable from the HTTP API (except full config file deployments via /v1/config) that prevent creating deeply nested data structures that could later cause a stack overflow.	2026-06-23 15:38:19 +02:00
Julian Brost	e7d656cf37	Don't shut down JSON-RPC connection if a message fails to parse ... With the limit from the previous commit, if a JSON-RPC now message fails to parse due to being nested to deep, it would have torn down the whole connection. It is still possible to trigger that scenario from DSL config (for example by returning nested structures from a lambda that is used in a check with command_endpoint). In order to fail more gracefully, only discard the single message and don't kill the whole connection.	2026-06-23 15:38:19 +02:00
Julian Brost	14d6ee9cdf	JsonDecode: include path in JSON depth error ... If parsing JSON is rejected due to the depth limit introduced in the last commit, also include the path (like root["object"]["children"]...) that exceeds the allowed nesting depth.	2026-06-23 15:38:19 +02:00
Julian Brost	4964d2444c	JsonDecode: add depth limit ... Data structures parsed from JSON may be accessed recursively, so deeply nested structures may wreak havoc by overflowing the stack. Thus, enforce a general nesting depth limit of 24 by default (which should be more than enough for reasonable use), with the ability to pass a different limit to JsonDecode() if needed.	2026-06-23 15:38:19 +02:00
Julian Brost	324d5bb815	Add filter-expression permission ... This allows preventing ApiUsers from evaluating their own DSL expressions for improved security.	2026-06-23 10:55:45 +02:00
Alexander Aleksandrovič Klimov	1aa1d8f9af	win-dev.ps1: prevent merge conflicts during backports ... by adding empty lines between variables for the Boost/OpenSSL/... versions. This way, individual versions are separated from each other and don't produce conflicts if e.g. only the OpenSSL version is backported.	2026-06-23 10:20:21 +02:00
Julian Brost	7eedf73c3d	Merge pull request #10874 from Icinga/openssl-3.5.7 ... Bump OpenSSL shipped for Windows to v3.5.7	2026-06-23 09:02:35 +02:00
Johannes Schmidt	b35ecb6796	Merge pull request #10857 from Icinga/freeze-perfdata-arrays ... Freeze perfdata arrays and remove locks in code using them	2026-06-17 19:06:36 +02:00
Johannes Schmidt	4b7ec7228d	Merge pull request #10844 from Icinga/perfdata-writer-fix-stats-func ... Fix potential nullptr-dereference in perfdata writer stats functions	2026-06-17 18:54:35 +02:00
Johannes Schmidt	9b93c08d27	Fix potential nullptr-dereference in perfdata writer stats functions	2026-06-17 15:16:37 +02:00
Johannes Schmidt	503e23e723	Freeze perfdata arrays and remove locks in code using them ... Since perfdata is set once when a check result is created and never changed again, locking this is unnecessary. This avoids components unnecessarily waiting on each other when processing perfdata. This fixes the locking cascade observed sometimes when the perfdata writer work queue blocks, where it extends to a lock on the entire check result eventually, affecting even more components.	2026-06-17 15:15:46 +02:00
Johannes Schmidt	75c2eeaaaa	Merge pull request #10884 from Icinga/Al2Klimov-patch-9 ... GHA: Windows: run on Windows Server 2022	2026-06-17 15:10:43 +02:00
Alexander Aleksandrovič Klimov	6dc479741c	GHA: Windows: run on Windows Server 2022 ... Recently, the Windows Server 2025 image upgraded Visual Studio from v2022 to v2026. Our build setup is not prepared for this, so we must pin the OS image.	2026-06-17 11:45:20 +02:00
Julian Brost	22b6188e24	Bump OpenSSL shipped for Windows to v3.5.7	2026-06-11 10:54:53 +02:00
Julian Brost	91eeb41ff1	Merge pull request #10864 from Icinga/fix-http-message-sendfile-failbit-handling ... Fix handling the `std::ifstream::failbit` in `OutgoingHttpMessage`	2026-06-10 17:17:46 +02:00
Johannes Schmidt	fe469a5455	Guard against assert() failures in SendJsonError() ... Co-authored-by: Julian Brost <julian.brost@icinga.com>	2026-06-03 12:36:24 +02:00
Julian Brost	5d563cb8ca	Merge pull request #10785 from Icinga/url-validate-password ... Url::ParseUserinfo: Actually verify Password	2026-06-02 10:51:18 +02:00
Julian Brost	98493f6abd	Merge pull request #10809 from Icinga/release-issue-template-docker-icinga2 ... Release issue template: docker-icinga2 is only required for pre-2.16	2026-06-02 10:51:03 +02:00
Johannes Schmidt	6a3979fd1f	Fix handling std::ifstream exceptions in ConfigFilesHandler	2026-06-02 08:54:50 +02:00
Alexander Aleksandrovič Klimov	70f724abde	ifw-api: omit password from curl command in check result ... Icinga (DB) Web has a special permission to show the check command line. Well-written plugins receive passwords via env vars which don't appear even there. Now ifw-api also hides the password using curl -u USER, not USER:PASS. The new command is still working, it just prompts for the password.	2026-06-01 10:51:39 +02:00
Johannes Schmidt	281dd133c7	Fix handling the std::ifstream::failbit in OutgoingHttpMessage	2026-05-29 16:05:14 +02:00
Johannes Schmidt	e8a4336ab8	Add test-case for SendFile() with non-existant paths	2026-05-29 16:05:14 +02:00
Julian Brost	f63bbec4ab	Merge pull request #10856 from Icinga/changelog-2.16.1 ... Forward-port changelog for v2.16.1 to master branch	2026-05-21 17:31:13 +02:00