Changes committed to git://git.pcp.io/nathans/pcp.git master
Nathan Scott (8):
qa: webapi _store support and dynamic container switching
pmdaroot: optimise name lookup for direct match on container ID
qa: prep for pmdapipe - general pmda-related qa filter updates
qa: deprecate local context and unix: access via pmwebd
qa: missed spot in prior commit specifying web port#
libpcp: allow exclusive socket flag to be passed via hostspec too
qa: update filter in test 999 to handle pmdapipe
docs: update pmwebd to-do file, pmstore support is complete
man/man1/pmwebd.1 | 19 ++++++++
man/man3/pmwebapi.3 | 10 ----
qa/.gitignore | 2
qa/1032 | 78 ++++++++++++++++++++++++++++++++++++
qa/1032.out | 13 ++++++
qa/1042 | 67 +++++++++++++++++++++++++++++++
qa/1042.out | 20 +++++++++
qa/359 | 1
qa/660 | 4 -
qa/661 | 4 -
qa/662 | 20 ++-------
qa/662.out.4 | 38 +++++++++++++++++
qa/662.out.46 | 70 ++++++++++++++++++++++++++++++++
qa/720 | 2
qa/720.out | 7 +--
qa/727 | 2
qa/780 | 2
qa/782 | 3 -
qa/875 | 2
qa/875.out | 7 +--
qa/999 | 1
qa/common.filter | 2
qa/common.webapi | 33 ++++++++++++++-
qa/group | 4 +
qa/src/GNUlocaldefs | 3 -
qa/src/test_webapi.python | 50 ++++++++++++++++++++++-
qa/src/test_webcontainers.python | 66 +++++++++++++++++++++++++++++++
qa/src/test_webprocesses.python | 83 +++++++++++++++++++++++++++++++++++++++
src/include/pcp/impl.h | 1
src/libpcp/src/context.c | 3 +
src/libpcp/src/spec.c | 6 ++
src/pmdas/root/root.c | 11 ++++-
src/pmwebapi/TODO | 1
src/pmwebapi/main.cxx | 22 +++++++++-
src/pmwebapi/pmwebapi.cxx | 67 ++++++++++++++++++++++++-------
src/pmwebapi/pmwebapi.h | 1
36 files changed, 660 insertions(+), 65 deletions(-)
commit e04a7fb1545412cc47c8538e175076b221123ac1
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Wed Nov 11 08:30:43 2015 +1100
docs: update pmwebd to-do file, pmstore support is complete
commit b84b5ae3d4e2bc63cc6e037c738ebc82608140bb
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Wed Nov 11 08:29:40 2015 +1100
qa: update filter in test 999 to handle pmdapipe
commit 18b9df038854a2f0b10753b18585e55946f2bebe
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Tue Nov 10 22:26:43 2015 +1100
libpcp: allow exclusive socket flag to be passed via hostspec too
commit e1884e2050fe83c19cc0b3e13b6b454c8068488a
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Tue Nov 10 17:41:38 2015 +1100
qa: missed spot in prior commit specifying web port#
commit e324618dadf8a4283339b8a8324e416f48fa8337
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Tue Nov 10 17:20:23 2015 +1100
qa: deprecate local context and unix: access via pmwebd
Local context styles automatically authenticate with an implicit
requirement that they are only ever run by local users who have
already been authenticted in some way (local login). pmwebd was
found to be (accidentally?) circumventing that and inadvertently
exposing sensitive information to unauthenticated, remote webapi
clients.
This includes things like process command lines and memory maps -
historically the subject of CVE-2012-3419 for pmcd/pmdaproc.
Audit suggests none of the main webapps actually use these modes
of access, by default, so this is not expected to be a big issue
for anyone. However, just in case, a back-compat preserving "-P"
option ("permissive" mode) is provided for pmwebd, allowing one
to opt-in to the suspect behavior if confident that it is safe to
do so in a specific environment. Default is secure mode though.
Test qa/1042 and test_webprocesses.python exercise both modes.
commit 6225474e75597bf922a9435955b0f8d3470f69d4
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Tue Nov 10 17:12:56 2015 +1100
qa: prep for pmdapipe - general pmda-related qa filter updates
commit 633a9f6982c12b31f51f05baa569ca31dae4c545
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Tue Nov 10 17:12:21 2015 +1100
pmdaroot: optimise name lookup for direct match on container ID
commit a3bb1aca76048b11f161b0cd4d3c3d988b599218
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date: Tue Nov 10 17:12:02 2015 +1100
qa: webapi _store support and dynamic container switching
Regression testing for the _store PMWEBAPI interface. There
is some small refactoring of common.webapi here also, to aid
code sharing in followup QA commits.
Test qa/662, qa/1032 and the test_webapi, test_webcontainers
python scripts exercise many aspects of store functionality.
In testing _store, uncovered a bug in the _indom interface,
fixed here as well - it was misinterpreting pmLookupInDom's
return value and hence was unable to handle instance ID 0 -
trivial fix to mirror the equivalent _store code.
|