forked from cfengine/cf22cf3
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ChangeLog
2314 lines (1535 loc) · 77 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2.2.10
Protocol fix, potential integer error in server decoding.
2.2.9
2.2.8
Patch for cfservd serving wrong data when link->copy
Checksum changes now trigger persistent class "checksum_alerts"
and log to WORKDIR/state/file_hash_event_history
Threading error fix for cfexecd
Windows compilation fixes. Note that windows users might have to move keys and files
from /home/user/.cfagent to /var/cfengine after the standardization of administrator
paths for windows where getuid != 0.
2.2.7
Memory leak in database access, affecting cfenvd
2.2.6
Xen detection
Bug in popen - incorrect placement of conditional in setting groups added in 2.2.4.
Sensor code added for linux cfenvd. Ready for patches for other systems.
Cpu utilization and temperature measurement added for linux where available
Bug reported in installable-negated classes. Patch by jack/SiliconSlick
Bugfix for class defined by directories
2.2.5
No content changes since 2.2.4, just fixes a packaging error.
(Mark's Easter turkey)
2.2.4p
Blunder in makefile change. Compilation error fixed.
2.2.4
Build changes. libpub is now an installed library libcfpub.so/a
so that cfengine 3 can find it.
Documentation is no longer distributed in the tarball, since most
people will use the online version. Also, enhanced documentation is
now available for any user who registers (free) at cfengine.com.
compress=true option in tidy was missing from documentation, and
left uninitialized during purging leading to attempts to compress
files instead of deleting.
Bugfix for empty strings in editfiles.
Links did not get removed with nolink=kill. Code changes apparently broken earlier.
Fixed.
rxdirs= added to files. Default is false. If set to true, cfengine will not
assume that x-bits should be set when r is set on directory permissions.
Group initialization to popen, so shellcommands groups are consistent with uid login id
Rpm fix for package removal.
2.2.3
Feedback release after 2.2.2 and LISA 07, minor tweaks and bug fixes
"Harmless features"
IgnoreInterfaceRegex( "vm.*" ) added to control
function added for removing data from special interfaces from class data
Option checkroot=true/false added to copy directive. This switches
on/off the change in 2.2.2 about setting permissions on the
destination root when recursively copying files. Default is now
false.
Can escape colons in the strings now to avoid confusion with
expansion separator.
cfenvgraph --erasehistory users,www_in etc will now set the
average and variance of learned cfenvd data to zero. The current
week's trace is not affected.
audit=true/false flag added to most actions
2.2.2
The build procedure for cfengine changes in this version to
incorporate an intermediate library. The default behaviour is now
to build a static library which will be used by cfengine 3 and
other application interfaces. To build a shared library, use
--enable-shared=yes
NOTE to developers: if running from the compiled code you now need
to delete the files cfagent cfservd etc and recompile to see changes
appear in the code. This is due to the libtool build process.
libtoolizing compilation process for migration to cfengine shared library
(this is to support mulitple interfaces in future, and cf 3)
--
XML and HTML output options added to equip the internal instrumentation
with readable output in cfshow e.g.
cfshow --performance --html > output.html
firefox output.html
provides an easier summary and searchability in browser function
Instrumentation changed to use realtime functions where possible. Standard
unix timer is too insensitive to measure performance.
The beginning of an integrated auditing system has been added. See references
to AuditLog() in the code. This logs to a compressed database and can be extracted
in ascii, html, xml using cfshow, e.g. cfshow --audit --html > output.html
Auditing is switched on by
control:
cfinputs_version = ( 1.2.1 ) # record this version in log, e.g. cvs revision
Auditing = true
--
cfshow --classes
also shows the relative frequencies of classes
that have occurred on the system and the last time these were
observed.
cfshow -f cfagent.conf --regex "lin.*"
displays all rules in the named file whose classes match the named
regular expression. Note that the class "any" is not automatically matched
and the search is based on the class text from the file. The output is not
related to which classes are currently defined, and it will not recognise
the history of classes implicit through class-restricted imported files.
--
SCLI interface modifications.
--
Intermittency entropy code added to the copy instrumentation for
automatic host reliability measurements.
Special variable
IgnoreFriendRegex = ( regex )
prevents last-seen warnings about hosts matching the named regex
--
UserExists("name") and GroupExists("name") functions added to builtin functions.
ClassMatch function added in classes/groups to match regular expressions of other classes
--
Additional octet variables added on default IPv4 address, for convenience:
e.g.
590 : ipv4_2[eth1]=192.168
1895 : ipv4[eth1]=192.168.1.101
2100 : ipv4_1[eth1]=192
4049 : ipv4_3[eth1]=192.168.1
Methods can now expand some list variables, one list only per argument set.
This is a limited compromise pending cfengine 3. A patch for expansion of
variables in the control part of a program in methods has also been added.
Bug fix and code simplication of variable expansion.
-----
tied variable expansion added. Allows method workaround for file dissemination
by name, e.g. copy from
host1.conf -> /dir/host1/file.conf
host2.conf -> /dir/host2/file.conf e.g. for virtual or diskless machines
-----
Major changes to package manager code by Jo Rhett. Variable expansion
fixed by Mark.
-----
Option "best" added to checksum= in files action, this allows cross checking
of the two best known hash algorithms for each file. Currently this is md5 and sha
due to limitations in OpenSSL libcrypto.
UnCommentToLineMatching regex added
2.2.1
scli: type section added. This is a special case of shellcommands, which
send commands to the special shell scli by Juergen Schoenwaelder for
communicating with snmp devices.
Code refactoring for package management.
Bug fixes for problems introduced in 2.2.0.
Copy directory would not set owner correctly on root
2.2.0
Apart from minor changes, this version is about structural internal
changes that ease the eventual confluence with cfengine 3 and the work
going on behind the scenes there. Every effort is being made to
make this change easy for users and existing installations. New features
will be introduced into 2.2.x gradually, and the new front-end will
eventually merge into this.
This version accompanies a new introduction to cfengine published as
a SAGE Short Topics book.
* Some changes
EMANICS extensions and reference testing for context sensitive
network navigation patterns using voluntary cooperation contracts.
PrintFile("name") function added to alerts
!! List expansion in editfiles actions. This is an important change
because it can potentially affect existing configurations that contain
variables with a list separator in them. EditSplit is used for this.
elsdefine fixed in tidy
processes with action=warn only install fix
ifelapsed/expireafter fixed in editfiles
Instrumentation of copy/shellcommands measuring time/averages
use cfshow --performance
background=true in shellcommands was not implemented! (Fixed)
SLES10 recognition
RedHat/Fedora further classes
SELinux support begun by Jeff Sheltren UCSB, who notes.
> Currently, I have editfiles and copy working with selinux security
> contexts, although so far copy only has support for regular files; I
> haven't worked on links, etc. yet.
> Use --enable-selinux during compilation
Bug / misleading error message in ReadArray fixed
HostRange bug for numericals in hostname fixed by Steve Radar.
2.1.22
IMPORTANT: cfshow output formatting changes
database internal format changes
Rewritten the checksum subsystem to allow for future development
and improvements and tidied the fragile Berkeley DB code. Cfservd
no longer caches checksums, as this causes update issues. This could
lead to additional load.
The checksum code has been rewritten with a new database model, so all
old data will be rebuilt. The checksum database has been renamed.
ChecksumDatabase variable is not longer used.
Package manager debian patch added to iterate over packages
under installation.
Package manager for AIX code added, courtesy of Anthony Rassin
Package manager for Gentoo added, courtesy of Eric Searcy
ShowState(rootprocs), ShowState(otherprocs) added for
better process reporting
General code reorganization for better separation of concerns, looking
towards cfengine 3.
cfconvert removed. Change of future strategy for cfengine 3 migration.
Rationalization of internal instrumentation and better integration
with cfenvd.
Bug fixes to miscmounts. Editing was broken with respect to editfilesize variable.
Option processing for miscmounts was also broken.
Support for old Berkeley DB APIs abandoned.
Encryption level added for full encryption of opendir traffic.
Must set FullEncryption = ( true ) in control for compatability
server=none now signals noop in method execution and copy.
Varstring expansion bug for nested variables.
2.1.21
copy action now supports this $(this) variable which is made equal to the
current server. This allows separating files from multiple hosts when downloading.
cfenvd LDT fixes
Bugs in PeerLeader/Group functions fixed.
Some buffer limits too small and hardcoded in item.c - fix
PH support removed from cfenvd during code rationalization - never used
Cfenvd code rationalization and channge in database format.
THe first time cfenvd runs, it will convert the database into the new format,
be aware that this could take some time as it is disk intensive.
Matt Shibla (ARM) ReturnsZeroShell function added.
Cfrun ignored port number, fix
2.1.20
ipv6 structure compilation error for Tru64
Tested for compilation with latest Berkeley4.4-NC
New option in cfservd.conf "LogEncryptedTransfers" (true/false).
If true, any file that is granted access and is marked "encrypt=true"
will be logged in syslog. i.e. one can keep a record of sensitive
transfers.
Linkcopy fix in 2.1.19 broke copying of links that point
nowhere. Fixed.
Copy was missing from the multi-pass detection. Fixed
Patch to debian package management. (bastiaans@sara.nl) fixed -
debian package always returned eq/true without cmp/version
statement" (checking if a package is installed, regardless of
version, now works
However the "Comparison result" is always "eq" (equal) somehow for
me... "
If you are experiencing problems with 2.1.19 please get 2.1.19a.
One of the changes in 2.1.19 has had bizarre side effects in links
and disks.
2.1.19
cfagent will now exit and cease processing if any class in the defined
control list
AbortClasses = ( class_name_1 class_name_2 ... )
The singlecopy feature has been rewritten after reports of it not
working, besides, the code was bizarre and the documentation was
even worse.
The autodefine code also patched and tested. In both these cases,
there are lists of *patterns* or wildcards. The code and docs now
agree
ExecResult now runs its command in -n mode
Error parsing strings (esp shellcommands) that contain the $
symbol due to a bug in 2D-lists.
VMWare ESX recognition.
Bug in cfservd stat-mode on symbolic links not correctly
evaluated. Bug in linktype=copy for copy fixed.
Bug in array expansion fixed - would truncate string after expansion
Constant-cosmetics and length alterations. CF_SMALLBUF introduced,
and MAXHOSTNAMELEN used
PID file added for each daemin in WORKDIR == /var/cfengine
Patch for function argument parsing
Typo in docs. SelectPartitionGroup -> SelectPartitionNeighbours
Inform=true support for packages
HostRange bug - recoding not implemented properly from
2.1.16. Caused seg fault.
Joe Buehler's harmless patch to cfexecd to flag daemon and batch mode.
Serious bug in binserver handling fixed. (Rarely used feature)
home tidying did not set the "done flag" for multiple pass avoidance.
Patches to setting unqualified and qualified names
SuSE 10 detection patch
Minor error fixes discovered by Joe Buehler and his wonderful
software.
Files is the "suspicious" list were marked "not sensible" so that
follow-up rules e.g. to delete them would not be triggered This is
now considered a confusion of roles. Suspicious files are no
longer skipped.
More memory leaks in cfservd
Compilation fix for non-IPv6 savvy machines
2.1.18
Error in FileExists() left over from 2.1.16 changes. Fixed
elsedefine was not defined if a copy was requested of a non-existent file. Fixed.
HostnameKeys (dynamic keys for dhcp clients) fix for cfservd.
Error in stat'ing links that point to non-existent files in
cfservd. Missing "else" caused this to be reported as an error in
remote file copy.
5 second timeout reduced to 10 in cfservd file change check.
Error message returned by cfservd is non-specific and previously
said authentication denied, regardless of failure. The daemon now replies
"Unspecified refusal". Users should use -v or -d2 on both sides of a connection
to diagnose the true cause of failure,
Segmentation fault when in verbose mode fixed - editfiles pointer.
Error in parsing quotes and escaped quotes in functions.
Bug in implementation of tidy scheduling during dependent classes fixed.
BeginGroupIfLineMatch
BeginGroupIfMatch
BeginGroupIfLineContaining operations added
Function ExecShellResult similar to ExecResult, but a shell is used,
cfservd some additional memory reclamation during file updates, could cause memory leaks..
2.1.17
This is a minor bugfix release
WARNING - the handling of function arguments has been changed. You are recommended to
use normal C/Perl quoting of argument strings., e.g.
result = ( ExecResult("/bin/sh -c \"${pf_cc} -V | head -1 | cut -d\ -f3\"") )
not
result = ( ExecResult(/bin/sh -c "${pf_cc} -V | head -1 | cut -d\ -f3") )
IsWildItemIn now has reflexive check - some confusion in the code about whether
the needle or the haystack is the wildcard.
Templating in editfiles. A new editfiles directive "ExpandVariables"
adds an "m4" like function to cfengine -- allowing predefined variable strings
to be expanded into text.
Patch contributed to expansvariables: Davor Ocelic <docelic@mail.inet.hr>
Alerts patch - some alerts not installed, if classes not defined.
Patch for missing variable expansion after function
parameter rewrite in 2.1.16. Some functions were not fully ported.
vicf eliminated from distribution
PrepModule environment fix
Compilation error C++ mixed into cfetool fix
Chdir to / when ascting as a daemon for cfservd, cfexecd etc
2.1.16
Bugfix release
Moved method parameter setting to fix a bug where parameters would
be set too late to be used in the parser
action=warn in copy required inform=true to work, fixed.
Function arg expansion bug and improvement fix
Include directive added to cfrun.hosts (Olivier Fauchon)
MOUNT_RO name collision fix
SEG fault fixed when signalling cfenvd
SkipIdentify partial fix
Alf Wachsmann and Elizabeth Cassel's cfetool added, based on cfenvd.
"cfetool makes a standalone tool out of cfenvd that accepts arbitrary
periodic data. In addition, it has support for yearly periodic data.
It's function and the user interface is in many aspects like rrdtool's.
cfetoolgraph was added to work with the new features of cfetool.
It works basically like cfenvgraph."
Bug fix for multipass evaluation when resolving dependencies.
Cfservd reread patch. Timeout on polling for linux,
Default route code now uses "route" command exclusively for portability.
EmailFrom patch to cfexecd / redundant code was paste error
Increase pass depth in evaluation of action sequence.
Skipident patch
Size increase for interface buffer list
HPUX,AIX ifconfig location fix
Methods documentation improved.
New control function for testing tcp services
var = ReadTCP(host,port,"send string",maxbytes)
2.1.15
-f removal in cfservd patch
Segmentation fault in cfservd with RSA key exchange fixed.
Disk freespace alerting bug - did not agree with manual specification. Message
appears only in verbose. Fixed.
Autodefine install patch.
Abspath in shellcommands was not parsed and acted on...
Warnall action was not respected in copy. Permissions were altered on destination file anyway.
cfcolon added to special symbols.
2.1.14
Alerts processed now in update context.
More locking canonification fixes
Exception for ReplaceALL convergence warning. Warning is not fatal
if the operation is inside an editgroup.
md5/sha1 message incorrect on new file found.
Fixup Makefile.am and doc/Makefile.am. Docs are now installed
in the CFEngine "share" directory where they belong.
Directory iteration fixed. New: owner=LastNode sets the owner of
the directory to the name of the last node in the dir name. This allows
the creation of homedirs.
CentOS support added.
Extra encryption stage added in C5 protocol. NOTE: This makes 2.1.14
cfagent clients unable to talk to older servers. (Upgrade servers
first, or at the same time.)
Class "no_default_route" is now defined if a default route is not previously
set, and a default route is defined for the current host.
Added class functions IsGreaterThan, IsLessThan for numerical or string comparisons
control:
actionsequence = ( files )
a = ( 2.12 )
b = ( 2.11 )
classes:
lt = ( LessThan(${a},${b}) )
gt = ( GreaterThan(${a},${b}) )
alerts:
lt:: "$(a) LESS THAN $(b)"
gt:: "$(a) GREATER THAN $(b)"
Bugfix for cfshow -c options (Nathan Hruby)
2.1.13
Mistake in placement of update.conf runs fixed.
Alteration to lock hashing to avoid conflicts
Mandrake version type patch/repatched
Error message in disable now
underlines move to respository where defined.
Locking patch to tidy. Did not release lock when tidying
recursively with subdirectory deletions. (Eric Sorensen).
Host range patched (again) (Bas VdV)
2.1.12
cf.preconf can now cause an abort if the script prints out a string
containing the substring "cfengine-preconf-abort".
An exit code of 2 signals this failure
Cfrun bug in placement of workdir initialization. Would try to open
/inputs/cfrun.hosts instead of /var/cfengine/inputs/cfrun.hosts
Moved mutex locks in address purging, to see if it prevents some
segmentation faults.
In image.c:
/* if (TRAVLINKS || ip->linktype == 'n') */
Took out linktype reference. This appears to be erroneous.
Patch to tidy: "Guolin Cheng" <guolin@alexa.com>
Patch to -Q to prevent update.conf from being executed.
Patch to rationalize choice of port number for new getaddrinfo
interfaces. (ip.c)
small patch to allow the use of PCRE if it is compiled with
--with-pcre. This is using the POSIX compatible API that PCRE provides,
so the change necessary is to use pcreposix.h instead of regex.h and to
link in pcreposix.so. cindy.marasco@pnl.gov)
2.1.11
SUPPORT FOR POSIX ACLS IN LINUX IS NOT AS STRAIGHTFORWARD AS
ORIGINALLY THOUGHT. THE API DOES NOT MATCH EXISTING
IMPLEMENTATIONS AND SEEMS SIGNIFICANTLY MORE COMPLEX. IN THE
INTERESTS OF STABILITY THIS WILL HAVE TO BE DEFERRED TO A LATER
RELEASE.
Comma in function argument bug in FileExists etc, fixed
Option -z (--schedule) now prints only the run schedule. Option
-Q (--query) added to print values of variables defined in
configuration
cfagent -Q sysadm,domain,site,ipaddress
in format varname=value
New variables can be used in cfagent.conf for cfexecd control:
EmailFrom = ( )
EmailTo = ( ) - overrides sysadm if set
White Box linux class recognition added
When setting classes or variables by function call, the function
evaluation is no longer performed if it is not in an active class.
Cfexecd now calls cfagent with -D from_cfexecd to define the class
"from_cfexecd::" when run from the executor
WarnIfFileMissing added to editfiles and default is not to warn
of non-existent files, except in inform/verbose modes.
Check added for DefineInGroup, signals error if not in group
Added copy type "any" for any matching criteria, date/sum etc.
Respository variable was not expanded like a normal variable
cfshow tool added for consulting the databases
Better autodetection of Berkeley DB in some distros of Linux (SuSE) - has anyone heard of "standards"?
Date format changed in cfexecd output files
Errors if remote copy is not encrypted when server demands encryption. (patch)
Renaming of directories is now allowed if dest= is set specifically.
Check added for variables defined in terms of undefined variables.
Patch for solaris package manager added (Louis Erickson - wwonko@rdwarf.com)
file added as synonym til reg in filter
Patch to HostRange (item.c) (rader@ginseng.hep.wisc.edu)
Internal variable determining WORKDIR for non-privileged users.
Various minor changes and cosmetics.
Lock string must include server name in copy - added
Method reply bundles fixed to work correctly with ipv6 addresses
SIGPIPE and SIGCHLD added to signal handler (SIGCHILD ignored against posix, but
how the hell do you sort this out?)
srand -> srand48 typo in cfenvd
Multiple method reply variables were incorrectly separated.
Added options to disable LastSeen data recording feature.
fclose used instead of pclose when calling ifconfig - resulted in zombies
2.1.10
Persistent class protection added to returned remote vrpc calls to prevent
meaningless multiple replies.
Change added to IPRange to avoid possible bootstrap problem with unconfigured resolver.
IP address setting was contingent on having DNS. Misplaced } fixed in nameinfo
EmptyResolvConf removed only nameserver entries. Now removes everything.
Due to an error in constructing 2.1.9 some of the advertised
changes below were not included. They are included in this version.
Workaround error message for parser bug with nested variables.
2.1.9
WORKDIR/state/allclasses file caches all class date during cfagent execution, just
like the $(allclasses) variable, but the file can grow much larger without
overflow.
.cfengine -> .cfagent in non-root public keys (some missing conversions)
Expand buffer incorrectly zeroed out public name key causing empty keyname in RSA dialogue
Old style bind reverse lookup added to Hostname2IPAddress
2.1.8
Additional checks added to bolster server transaction security.
Fix of bug in copy server variable list expansion (unexpanded variables) introduced in 2.1.7
Typo in locks fixed
Mutex deadlock fix in cfservd for systems with up to date POSIX implementations.
QNX class data added
Syslog facility patches to cfservd. (Leonardo Helman)
Fix to avoid recursive imports
Variables were not expanded in PrepModule
Symbolic links were not tidied
Missing initializations in links could dump core
Logging route switching bug in disk/required fixed
Bugs in implementation of remote method protocol. Classes were not
transferred properly.
Bug in HostnameKeys for cfrun fixed.
2.1.7p1
Bug in resolv node introduced in 2.1.7. Ordering of
nameservers was reverse.
2.1.7
Mandrake Linux detect patch
Unbelievably no documentation about strategies ever found its way
into the manual!! Fixed.
Sorting of anomaly histogram data
Date patch for SMTP in cfexecd
Bugfix for TTime filters in ParseTTime() - submitted Bob B. Crosbie.
Trinity Centre for High Performance Computing,
ReplaceFirst function to replace first occurrence of a string in line.
Umask saving patch in editfiles (Sergio Gelato)
Patch for variable socket length structs (BSD)
Apparent bug in local methods from recent change. Name localhost
would be converted into an address which would then fail to match hail.
Iteration over server= variable in copy added
Iteration over resolver variables added
Bug in class evaluation was introduced in 2.1.6 by a sorting
algorithm. Some classes would evaluate to false even though true.
Default route setting has been broken in linux for a long time.
A workaround has been added using the shellcommand /sbin/route
Bug in rmdirs in tidy - old type mismatch corrected. Might cause
cfengine to delete an empty root-search directory undesirably.
Some bizarre coding in the resolver section replaced. Could lead
to incomplete class data.
Added option SkipIdentify = ( true ) for avoiding DNS lookup in
client side authentication.
Bug in method evaluation if peers have inconsistent resolvers and
cannot agree on whether to use IPv6/v4.
ReadList() function added to control for reading an iterator
from a file
2.1.6
Patch for incorrect symbolic link resolution with ".." internals.
Would chop off a leading slash.
Patches for alerts appearing twice. InitAction added in install.c
--with-docs option added and default is to not build the docs
Change to df.c to avoid rounding errors in small blocks for linux
wait status patch for returnszero()
dpkg debian package management support (Morten Werner)
tidy rmdirs=all did not remove top directory since v2.0.0. Fixed.
Problem was new method to aviod races can never reach this location,
so have to use absolute path for top dir.
DARWIN patches to cfservd.c/ip.c to fix definitions
Separate ExpandVarstring buffer-size with new expandsize value
This removes some spurious use of VBUFF scratch space. One bug
in tidy path expansion found here. Variables were not expanded.
2.1.5
KNOWN BUG in persistent state memory for tcpdump data - long ipv6
addresses can make a byte count > old for fewer incoming so it remembers
wrong snapshot
Double DeleteParser() fixed.
Code cosmetics:
Annoying tabs removed from sources
bzero -> memset explicitly
bcopy -> memcpy
Segmentation fault in list handling fixed (seldom occurrence)
2.1.4
"Bug" found in method recognition - only constant parameters allowed.
Time of day or relative hostames as parameters will not work
Mutexes around locking now.
Variable expansion of server deferred in copy to allow dynamic server choice
Removed old dns lookup caching for ipv4 - means no prior check for existing hostnames,
but allows running with dynamical variables
-q option added to cfexecd. If set it invokes cfagent with -q flag (--no-splay)
Rewritten function analysis for multiple arguments in assignments
ReadTable() and ReadArray() functions to read associative arrays from files
hpux class changed from 9000* to * in class matching. Assume old versions now dead
tcpdump interface for cfenvd
Attempt to detect ipv6 address from ifconfig on unix and add classes. Cannot yet bind to interface.
Make internal list representation of IP addresses.
Error in -f evaluation introduced in recent version fixed.
Bind to outgoing interface implemented for new getaddrinfo libs functions.
Same of fior cfservd
BindToInterface = ( )
editfiles additions:
DeleteLinesContainingFileItems @var{filename}
DeleteLinesMatchingFileItems @var{filename}
DeleteLinesStartingFileItems @var{filename}
DeleteLinesNotContainingFileItems @var{filename}
DeleteLinesNotMatchingFileItems @var{filename}
DeleteLinesNotStartingFileItems @var{filename}
AppendIfNoSuchLinesFromFile @var{filename}
Special function added to alerts:
FriendStatus(hours)
shows hosts that have not reported in for hours.
2.1.3
Voluntary RPC remote methods implemented.
Bug in ignore when doing file recursion fixed.
Wildcard match did not include plain files when expanding wildcards
Internal array representation added to expression evaluation
$(array[key]) $(array[$(key)])
Arrays may be defined using the association function:
assoc_array = ( A(B,"is for bird") A(C,"is for cat") )
2.1.2
Various minor patches
singlecopy locking patch (Eric Sorenson)
Patches Iain Morgen (NASA)
cfexecd add From line to mail
RegCmp(regex,$listvar) function added to match classes
Documentation of iteration added to reference manual - was missing.
Domain variable was overwritten in 2.1.0 when methods were initialized. Corrected.
Cfexecd #ifdefs not compatible with cygwin - rewritten workaround
Entropy measure anomaly classes
Comparator uninitialized in process matches, creating bogus outout with -d3
Chop function removes all trailing spaces.
interfaces now records ip addreses
Variables can override context using a dot notation:
${context.variable} ${global.env_time}
Interface addresses on multiple interfaces:
${global.ipv4[hme0]}
${global.ipv4[eth1]}
cfservd list handling bugs after user patch, plus enchanced iteration:
e.g. now make multiple rules in a sinlgle stanza
control:
Split = ( " " )
hostlist = ( "10.10.10.1 10.10.10.2 10.10.10.3" )
dirs = ( "bin etc lib" )
base = ( /usr )
#########################################################
admit:
$(base)/$(dirs) $(hostlist)
results in:
Path: /usr/bin (encrypt=0)
Admit: 10.10.10.1 10.10.10.2 10.10.10.3 root=
Path: /usr/etc (encrypt=0)
Admit: 10.10.10.1 10.10.10.2 10.10.10.3 root=
Path: /usr/lib (encrypt=0)
Admit: 10.10.10.1 10.10.10.2 10.10.10.3 root=
Allow modules during parsing to initialize classes etc.
control:
gotinit = ( PrepModule(startup1,"arg1 arg2...") )
classes:
gotinit = ( PrepModule(startup2,"arg1 arg2"}) )
2.1.1
Permissions on explicitly mentioned links to files could result in file permission
being changed instead.
Error in permission evaluation for copied files fixed.
Mac OSX finder patches added
ID classes rationalized into nameinfo.c
scanarrivals option to disks/required - for research.
Improved anomaly analysis.
setting repository in cfservd.conf caused crash - fixed.
& is now a synonym for "." - the AND operator in class evaluation
! negation of functions in class assignments is now handled
New option noabspath=true for copy allows one to override the need for
a full path in certain situations, e.g. "export A=x; /dothis""
Redhat 9 class names patch JY.