Skip to content

Commit c023c03

Browse files
zerweszerwes
committed
Merge remote-tracking branch 'origin/master' into fix-missing-previousXhardstate
2 parents 38edd82 + a3e0b06 commit c023c03

4,338 files changed

Lines changed: 133052 additions & 66594 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.envrc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,9 @@ layout_cmk_uv() {
1111
}
1212

1313
layout cmk_uv
14+
15+
watch_file bazel-out/bazel_env-opt/bin/bazel/tools/bazel_env/bin
16+
PATH_add bazel-out/bazel_env-opt/bin/bazel/tools/bazel_env/bin
17+
if [[ ! -d bazel-out/bazel_env-opt/bin/bazel/tools/bazel_env/bin ]]; then
18+
log_error "ERROR[bazel_env.bzl]: Run 'bazel run //bazel/tools:bazel_env' to regenerate bazel-out/bazel_env-opt/bin/bazel/tools/bazel_env/bin"
19+
fi

‎.github/workflows/pr.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on: [push, pull_request]
1212

1313
jobs:
1414
testing:
15-
runs-on: ubuntu-22.04
15+
runs-on: ubuntu-24.04
1616
env:
1717
PYTHONWARNINGS: ignore:DeprecationWarning
1818
# Avoid falling back to our internal bazel remote cache on github actions
@@ -22,8 +22,8 @@ jobs:
2222
include:
2323
- name: Bandit tests
2424
target: test-bandit
25-
- name: Python formatting
26-
target: test-format-python
25+
- name: Formatting
26+
target: test-format
2727
- name: Ruff lint tests
2828
target: test-ruff
2929
- name: Python unit tests
@@ -60,9 +60,10 @@ jobs:
6060
# libkrb5-dev: Needed for building pykerberos.
6161
# libglib2.0-dev: required by packages/glib and therfore transitive by python unit tests
6262
# gettext: Needed for some "unit tests" (test_i18n.py)
63+
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/ppa
6364
sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
6465
sudo apt-get update
65-
sudo apt-get install ksh libpango1.0-dev librrd-dev libldap2-dev libsasl2-dev libkrb5-dev libglib2.0-dev gettext g++-13 g++14
66+
sudo apt-get install ksh libpango1.0-dev librrd-dev libldap2-dev libsasl2-dev libkrb5-dev libglib2.0-dev gettext "^g\+\+-14$"
6667
make .venv
6768
- name: Run ${{ matrix.name }}
6869
env:

‎.werks/17105.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
[//]: # (werk v2)
2+
# Fix secrets added to URL query params
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-08-07T13:29:59+00:00
7+
version | 2.5.0b1
8+
class | security
9+
edition | cre
10+
component | wato
11+
level | 1
12+
compatible | yes
13+
14+
Previously, under specific conditions (toggling page navigation after receiving validation errors when submitting a form), passwords and other secrets entered in the form could be exposed in URL query parameters.
15+
Importantly, this did not affect any stored secrets; only the data just entered by the user was at risk.
16+
This could result in sensitive data being leaked, for example, to server logs.
17+
18+
Such sensitive information is now excluded from the URL query parameters.
19+
20+
This issue was reported to us by an external party.
21+
22+
*Affected Versions*:
23+
24+
* 2.4.0
25+
* 2.3.0
26+
* 2.2.0
27+
* 2.1.0 (EOL)
28+
29+
*Vulnerability Management*:
30+
31+
We have rated the issue with a CVSS Score of 1.0 Low (`CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N`) and assigned `CVE-2025-32916`.

‎.werks/17434.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[//]: # (werk v2)
2+
# Add support for Almalinux 10
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-08-01T07:20:54+00:00
7+
version | 2.5.0b1
8+
class | feature
9+
edition | cre
10+
component | omd
11+
level | 1
12+
compatible | yes
13+
14+
With this werk, Checkmk is built for Almalinux 10

‎.werks/17668.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[//]: # (werk v2)
2+
# check_cert: Consider more error types if self signed certificates are allowed
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-10-08T18:50:07+00:00
7+
version | 2.5.0b1
8+
class | feature
9+
edition | cre
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
The option Allow self-signed certificates now ignores three certificate errors:
15+
X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT, X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN, and
16+
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. These errors typically occur with
17+
self-signed certificates.
18+
19+
As a result, when this option is enabled, Checkmk will no longer report validation
20+
errors for these specific cases, allowing users to connect to services using self-signed
21+
certificates without issues. No user action is required to benefit from this improvement.

‎.werks/18098.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[//]: # (werk v2)
2+
# Agent baking is now triggered when upgrading from Raw to Enterprise Edition
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-09-23T09:07:04+00:00
7+
version | 2.5.0b1
8+
class | fix
9+
edition | cee
10+
component | agents
11+
level | 1
12+
compatible | yes
13+
14+
During `omd update`, the initial baking step was previously skipped when
15+
upgrading from an edition without the agent bakery to CEE and above, requiring
16+
manual baking via the bakery UI. This is now handled automatically, and agent
17+
baking runs as expected on edition upgrades.

‎.werks/18099.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[//]: # (werk v2)
2+
# ALLNET IP Sensoric: Display errors when special agent failed executing
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-10-02T10:13:49+00:00
7+
version | 2.5.0b1
8+
class | fix
9+
edition | cre
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
The special agent for the ALLNET IP Sensoric XML API previously swallowed
15+
errors silently when fetching data, causing failures to go unnoticed. With this
16+
change, the special agent now exits with an error code and displays the
17+
corresponding error message as part of the Check_MK service. As a result,
18+
operators will be promptly alerted to connectivity or API issues and can take
19+
corrective action. No configuration changes are required, but users should
20+
monitor the Check_MK service status for such errors.

‎.werks/18136.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
[//]: # (werk v2)
2+
# Show disabled active and custom services in service discovery
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-10-09T09:57:02+00:00
7+
version | 2.5.0b1
8+
class | fix
9+
edition | cre
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
Disabled services from active or custom checks that were disabled via
15+
the "Disabled services" or "Disabled checks" rules would not appear in
16+
the service discovery.
17+
18+
This werk fixes a bug that previously hid the categories "Disabled
19+
active checks" and "Disabled custom checks - defined via rule", causing
20+
these disabled services to be missing from the page.
21+
22+
The disabled services will now show in their respective categories.
23+
24+
No further action is required for this fix.

‎.werks/18157.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
[//]: # (werk v2)
2+
# Redfish: FIX "[special_redfish] KeyError: '@odata.id'"
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-10-07T09:14:54+00:00
7+
version | 2.5.0b1
8+
class | fix
9+
edition | cre
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
The special agent `special_redfish` queries storage-related endpoints to collect data on volumes and drives.
15+
16+
Some devices return empty id references in the `VolumeCollection` and `DriveCollection`.
17+
When this occurs, the agent encounters a `KeyError: '@odata.id'`.
18+
As a result, monitoring data from the agent is missing.
19+
20+
This update fixes the issue by ignoring id references that lack an id, preventing the `KeyError` and ensuring the agent continues to collect data as expected.
21+
22+
Thanks to Andreas Döhler for the contribution.

‎.werks/18158.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[//]: # (werk v2)
2+
# cmk-migrate-http: Handle virtual host without host correctly
3+
4+
key | value
5+
---------- | ---
6+
date | 2025-10-09T08:30:25+00:00
7+
version | 2.5.0b1
8+
class | fix
9+
edition | cre
10+
component | omd
11+
level | 1
12+
compatible | yes
13+
14+
The script `cmk-migrate-http` can be used to migrate `check_http` rules to `check_httpv2` rules in an automated fashion.
15+
16+
The old plug-in `check_http` supported HTTP/1.0, which is no longer supported by the new plug-in.
17+
Because of this, `cmk-migrate-http` uses the `Virtual host` field to obtain a host name to construct a url.
18+
However, this did not take into account that in some configurations the `Virtual host` field may contain invalid values (with respect to RFC7230).
19+
For example, the value `/web` would result in the url `http:///web`.
20+
21+
With this Werk, the invalid `Virtual host` field will be ignored.
22+
The migration will fallback to the `Address` field.
23+
The `Virtual host` field is still used for the Host header.
24+
In effect, this means that `check_httpv2` will send the same request as `check_http` did.
25+
26+
Note, that a RFC7230 compliant server should reject these types of requests with a 404.

0 commit comments

Comments
 (0)