14869 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Julian Brost	0332ead94b	Update original_attributes only after validation of the new value ... Otherwise, the value may be rejected, leaving original_attributes in the already changed but now inconsistent state.	2026-07-09 16:52:54 +02:00
Alexander Aleksandrovič Klimov	8ff3d586f9	Merge pull request #10868 from Icinga/fix/openssl4-compat ... Support OpenSSL 4.0, add Fedora 45 to GHA	2026-07-08 12:18:57 +02:00
Johannes Schmidt	78ce827376	Merge pull request #10830 from Icinga/remember-deleted-api-objects ... Track deleted runtime objects to avoid erroneous recreation	2026-07-08 08:39:38 +02:00
Johannes Schmidt	bd7a783c60	Prune runtime-deleted object dictionary every 15 Minutes	2026-07-07 15:48:20 +02:00
Alexander A. Klimov	c2da81d309	GitHub actions: add Fedora 45 which provides OpenSSL 4 ... The release of Fedora 45 will take months, but a distro shipping OpenSSL 4 is necessary to ensure persistent OpenSSL 4 compatibility.	2026-07-07 15:36:53 +02:00
Alexander A. Klimov	ee648b3f41	Use i2a_ASN1_INTEGER(), don't access ASN1_INTEGER data directly ... to fix a build error against OpenSSL 4.0. OpenSSL 4.0 made `ASN1_INTEGER` an opaque type. Also, `X509_get0_serialNumber()` must be used now, which returns `const ASN1_INTEGER*`.	2026-07-07 15:36:53 +02:00
Alexander A. Klimov	c02434e284	Use const X509_NAME*, not X509_NAME*, on newer OpenSSL ... to fix a build error against OpenSSL 4.0. OpenSSL 4.0 made `X509_NAME*` pointers returned by `X509_get_subject_name()`, `X509_REQ_get_subject_name()` and related getters const. In contrast, under OpenSSL 1.x, setters expect non-const pointers, hence our new typedef `X509NameConstPtr`. - Use `X509NameConstPtr` parameters in `GetX509NameCN()`, `CreateCert()` and, `CreateCertIcingaCA()` to match the const expectations per OpenSSL version - Replace `X509_REQ_get_subject_name()` with `X509_NAME_new()` + `X509_REQ_set_subject_name()` for CSR subject modification, since the returned data can't be directly modified now	2026-07-07 15:36:04 +02:00
Johannes Schmidt	0ccec92c73	Track deleted runtime objects to avoid erroneous recreation	2026-07-06 16:09:16 +02:00
Alexander Aleksandrovič Klimov	98a71edf9a	Merge pull request #10728 from Icinga/fix-adjust-rlimits-warnings ... Apply RLIMIT adjustments conditionally based on the target command	2026-07-03 20:28:48 +02:00
Alexander Aleksandrovič Klimov	badab2ea5a	Merge pull request #10931 from Icinga/amazonlinux2 ... GitHub actions, doc/: drop EOL Amazon Linux 2	2026-07-03 18:18:44 +02:00
Alexander A. Klimov	2408c60b47	doc/: don't mention Amazon Linux 2	2026-07-03 14:53:50 +02:00
Alexander A. Klimov	09dd2ccadf	GitHub actions: drop EOL Amazon Linux 2	2026-07-03 13:23:18 +02:00
Johannes Schmidt	36d41ac865	Merge pull request #10833 from Icinga/connection-hang ... Fix that NewClientHandler() could hang indefinitely, preventing new connection attempts	2026-07-03 08:51:48 +02:00
Johannes Schmidt	a098800f77	Merge pull request #10862 from Icinga/fix-api-authentication ... Fix API authentication being broken with clients that send an unauthenticated request first	2026-07-03 08:36:43 +02:00
Johannes Schmidt	e0a138ac30	Merge pull request #10883 from Icinga/better-json-error-diagnostic-information ... Fix high response latency with multiple API-requests targeting non-existent hosts or services	2026-07-02 17:41:04 +02:00
Johannes Schmidt	171e9ee37a	Pass std::exception_ptr to SendJsonError ... The `diagnostic_information` string will now generated if and when it is required (i.e. the "verbose" parameter is true).	2026-07-02 14:04:15 +02:00
Johannes Schmidt	393724bb2a	Consistently use std::exception_ptr ... `DiagnosticInformation()` wasn't able to take a `std::exception_ptr` due to the missing conversion on older boost versions, so now everything uses the std::exception_ptr instead. There are still a few reasons to use `boost::exception` in some places, but for exception pointers, the standard one should be better in most cases and almost never requires to include an extra header.	2026-07-02 13:59:48 +02:00
Johannes Schmidt	a9783fdde4	Replace explicit rethrow(current) pattern with just throw;	2026-07-02 13:59:48 +02:00
Johannes Schmidt	aa6c63b52e	Fix unreachable fallback in DiagnosticInformation(<eptr>) ... This was likely meant as a fallback for non-`std::exception` exception pointers, but it would never have been reached, because `(std|boost)::rethrow_exception()` would have thrown those out of the function scope. This fixes the fallback by making it a catch handler and also using the more direct way of getting this fallback diagnostic info inside a catch handler.	2026-07-02 13:59:48 +02:00
Julian Brost	78a281d918	Fix that NewClientHandler() could hang indefinitely, preventing new connection attempts ... There is some race condition when the `async_write()`/`async_flush()` operation for the `icinga::Hello` message fails (connection reset by peer for example) around the same time the connect timeout fires and calls `cancel()` on the stream, the following call to `async_shutdown()` may block indefinitely. If that happens, the endpoint remains in the connecting state and no new connection attemps are initiated. This commit fixes the issue by removing the `Defer` containing the `async_shutdown()`. The purpose of `async_shutdown()` is to signal a clean termination of the connection to the peer, which really isn't something that makes sense to to in a `Defer` block that is also executed in case of errors. For the one situation where doing a clean TLS shutdown makes some sense (closing anonymous client connections), a call to GracefulShutdown() is added to that specific code path. A large part of the change is just changing the indentation of the code, given that a now unnecessary `try`/`catch` block is removed. The following Go code creates a TLS server that can be used to demonstrate the issue. Note that given that a race condition is involved, this is not reliable and the sleep duration may need some fine-tuning. For this to work, `ApiListener.tls_handshake_timeout` needs to be set to a large-enough value like 60s to disable the timeout for `async_handshake()` itself so that the overall connect timeout is the one that fires. However, changing the timeout is not a prerequisite for the problem, it just makes it easier to reproduce. The error can also happen with the default timeouts if the TCP connect takes long enough so that the handshake is started late enough that its timeout expires after the connect timeout. package main import ( "crypto/tls" "log" "net" "time" ) func main() { cert, err := tls.LoadX509KeyPair("bad-agent.crt", "bad-agent.key") if err != nil { panic(err) } listener, err := tls.Listen("tcp", ":1337", &tls.Config{ Certificates: []tls.Certificate{cert}, }) if err != nil { panic(err) } log.Println("Listening on", listener.Addr()) for { conn, err := listener.Accept() if err != nil { panic(err) } go handle(conn.(*tls.Conn)) } } func handle(conn *tls.Conn) { addr := conn.RemoteAddr().String() log.Println(addr, "new connection") time.Sleep(15*time.Second - 10*time.Millisecond) log.Println(addr, "SetLinger(0)", conn.NetConn().(*net.TCPConn).SetLinger(0)) log.Println(addr, "Handshake()", conn.Handshake()) log.Println(addr, "conn.NetConn().Close()", conn.NetConn().Close()) } With additional logging in the `catch` block for `boost::system::system_error` and `Defer shutdownSslConn` (both removed by this commit), this showed the following. Note that in particular, `async_shutdown()` never returned, indicating that it hangs in there. [2026-04-24 17:32:56 +0200] information/ApiListener: Reconnecting to endpoint 'bad-agent' via host 'host.docker.internal' and port '1337' [2026-04-24 17:33:11 +0200] critical/ApiListener: Timeout while reconnecting to endpoint 'bad-agent' via host 'host.docker.internal' and port '1337', cancelling attempt [2026-04-24 17:33:11 +0200] information/ApiListener: New client connection for identity 'bad-agent' to [172.17.0.1]:1337 [2026-04-24 17:33:12 +0200] information/ApiListener: rethrowing for bad-agent: Error: Connection reset by peer [system:104 at /usr/include/boost/asio/detail/reactive_socket_send_op.hpp:137 in function 'do_complete'] [2026-04-24 17:33:12 +0200] information/ApiListener: doing async_shutdown for bad-agent	2026-07-02 13:46:12 +02:00
Alexander Aleksandrovič Klimov	2a88509e34	Merge pull request #10925 from Icinga/forward-port-changelog-v2.16.3-et-al ... Forward-port the change logs for v2.16.3, v2.15.5, and v2.14.10 to master branch	2026-07-01 15:01:13 +02:00
Johannes Schmidt	8c59fba97f	Merge pull request #10723 from Icinga/more-compiler-warnings-silenced ... More compiler warnings silenced	2026-07-01 13:58:00 +02:00
Johannes Schmidt	591f968d1c	Check object version on deletion	2026-07-01 13:45:45 +02:00
Johannes Schmidt	3cb6e5a152	Make Dictionary::Remove(Iterator) return the next iterator	2026-07-01 13:45:45 +02:00
Julian Brost	a45830fc2f	Merge pull request #10784 from Icinga/docs-for-parent-host-param-10782 ... Fix Docs: Explain --parent_host parameter	2026-07-01 12:20:20 +02:00
Alexander Aleksandrovič Klimov	8a366bc140	Merge pull request #10841 from Icinga/binarytohex-length ... Minor fixes and tests for BinaryToHex()	2026-07-01 10:35:11 +02:00
Alexander Aleksandrovič Klimov	4fef250ea8	Merge pull request #10826 from Icinga/global-custom-vars-doc ... Fix documentation on global custom variables	2026-07-01 10:34:40 +02:00
Alexander Aleksandrovič Klimov	be9397609a	Merge pull request #10297 from Icinga/intrusive_ptr_refcnt ... intrusive_ptr_*(): specify memory_order explicitly	2026-07-01 10:19:14 +02:00
Julian Brost	5d89c391e8	Release v2.14.10 ... (cherry picked from commit 60559004e4)	2026-07-01 10:11:08 +02:00
Julian Brost	2aa9243731	Release v2.15.5 ... (cherry picked from commit 16f3f6e53f)	2026-07-01 10:10:38 +02:00
Julian Brost	61e6bff3f3	Release v2.16.3 ... (cherry picked from commit 9d61b4f7be)	2026-07-01 10:09:28 +02:00
Julian Brost	27528c65c4	Merge pull request #10914 from eimann/bugfix/json-decode-single-argument-10913 ... Restore single-argument Json.decode() in the DSL	2026-06-30 14:45:44 +02:00
Dominik Bay	326cbde447	Add Dominik Bay to AUTHORS ... refs #10913	2026-06-30 10:42:40 +02:00
Dominik Bay	d29ac491f2	Restore single-argument Json.decode() in the DSL ... The recursion depth limit added to JsonDecode() in 2.16.2 gave the C++ function a second parameter with a default value. Function pointers do not carry default arguments, so the DSL function binding deduced an arity of 2 via boost::function_types::function_arity and required two arguments. As a result `Json.decode("...")` failed with "Too few arguments for function", an undocumented breaking change in a patch release. Wrap JsonDecode() in a single-argument shim (mirroring the existing JsonEncodeShim) so the registered function keeps its one-parameter contract while still applying the default depth limit internally. refs #10913	2026-06-30 10:42:40 +02:00
Julian Brost	b16c7a9518	Merge pull request #10912 from Icinga/forward-port-missing-v2.15.1-upgrading-docs ... Forward-port missing v2.15.1 upgrading docs to master branch	2026-06-30 09:42:01 +02:00
Johannes Schmidt	26fa08de16	Merge pull request #10911 from Icinga/forward-port-changelog-v2.16.2-et-al ... Forward port the change logs for v2.16.2, v2.15.4, and v2.14.9 to master branch	2026-06-29 21:05:50 +02:00
Julian Brost	53aff59cd3	Merge pull request #10910 from Icinga/configwriter-import-validation ... ConfigWriter::EmitScope: Escape import	2026-06-29 20:35:37 +02:00
Julian Brost	165378adae	Merge pull request #10909 from Icinga/filter-expression-permission ... Add filter-expression permission	2026-06-29 20:33:12 +02:00
Julian Brost	fb42312e6c	Merge pull request #10908 from Icinga/json-parsing-recursion-limit ... [GHSA-wh38-wg57-5w7g] Fix stack overflow due to deeply nested data structures	2026-06-29 20:15:53 +02:00
Julian Brost	2c14db1c26	Merge pull request #10907 from Icinga/fix-ca-replacement-vuln ... [GHSA-vj39-ww8j-vvx5] Checking if certificate update request comes from a valid endpoint	2026-06-29 20:13:49 +02:00
Julian Brost	d656f03862	Add upgrading docs explaining the config file change for logrotate ... (cherry picked from commit ead09722a9)	2026-06-29 16:53:17 +02:00
Julian Brost	0378334526	Changelog for v2.14.9 ... Co-authored-by: Johannes Schmidt <johannes.schmidt@icinga.com> (cherry picked from commit 4f172a5a14) (cherry picked from commit 5c60ff65cb)	2026-06-29 16:34:33 +02:00
Julian Brost	d3f9894fd6	Changelog for v2.15.4 ... Co-authored-by: Johannes Schmidt <johannes.schmidt@icinga.com> (cherry picked from commit 4f172a5a14) (cherry picked from commit 088f3409c3)	2026-06-29 16:33:34 +02:00
Julian Brost	784ce99849	Changelog for v2.16.2 ... Co-authored-by: Johannes Schmidt <johannes.schmidt@icinga.com> (cherry picked from commit 4f172a5a14)	2026-06-29 16:32:24 +02:00
Alexander Aleksandrovič Klimov	ecb8ef8d7b	Merge pull request #10866 from Icinga/Al2Klimov-patch-3 ... ifw-api: omit password from curl command in check result	2026-06-29 12:20:25 +02:00
Alexander A. Klimov	590ad7a740	intrusive_ptr_*(): specify memory_order explicitly ... More relaxed memory_order = less safety guarantees = faster execution. This is safe because std::shared_ptr does the same. See also: https://en.cppreference.com/w/cpp/atomic/memory_order "Typical use for relaxed memory ordering is incrementing counters, such as the reference counters of std::shared_ptr, since this only requires atomicity, but not ordering or synchronization (note that decrementing the std::shared_ptr counters requires acquire-release synchronization with the destructor)."	2026-06-26 14:45:42 +02:00
Johannes Schmidt	093856f068	Silence -Wdeprecated-declarations for OpenSSL functions	2026-06-26 10:30:12 +02:00
Johannes Schmidt	7e52fda342	Disable -Wregister for amazonlinux:2 in CI ... amazonlinux:2 has a really old GNU bison version (3.0.4), which emits `register` storage specifiers in its generated C code, which any standard starting with C99 doesn't allow anymore.	2026-06-26 10:30:12 +02:00
Johannes Schmidt	e6f94496e7	Disable warnings about unknown attributes in CI ... Specifically this is needed to make old GCCs not whine about having to ingore `[[gnu::no_dangling]]`.	2026-06-26 10:30:09 +02:00
Alexander Aleksandrovič Klimov	abb5a851bd	Merge pull request #10895 from Icinga/Al2Klimov-patch-9 ... win-dev.ps1: prevent merge conflicts during backports	2026-06-26 10:29:21 +02:00