xcat-ws.conf sends /xcatws and /xcatwsv2 to https only when mod_rewrite is
loaded. Without that module the aliases run the REST CGI on any port.
An IfModule !mod_rewrite.c block now answers 403 for both aliases.
RedirectMatch comes from mod_alias, which the ScriptAlias lines of the
same file already require. Other paths, such as /install, are not changed.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
`rpm -V xCAT-server` reports /etc/httpd/conf.d/xcat-ws.conf and
/etc/apache2/conf.d/xcat-ws.conf changed on every EL, openEuler and SUSE
management node, for the life of the install. %install shipped the Apache 2.2
fragment as the payload, and %post replaced it with the Apache 2.4 fragment
whenever httpd, apachectl or apache2ctl reported 2.4. Every supported
distribution runs Apache 2.4, so the file on disk never matched the package
digest. The drift is a permanent false positive for anyone who verifies an
installed xCAT before trusting it.
Both fragments also began with
`LoadModule rewrite_module /usr/lib64/apache2-prefork/mod_rewrite.so`. That
file exists only on SUSE under the prefork MPM. Apache tolerates it on EL and
openEuler because conf.modules.d loaded mod_rewrite first, and logs AH01574;
where the module is not loaded first, the missing file stops Apache from
starting.
xcat-ws.conf.apache22 and xcat-ws.conf.apache24 are replaced by one
xcat-ws.conf that serves both generations: the redirect sits behind
<IfModule mod_rewrite.c>, and the authorization directives behind
<IfModule mod_authz_core.c> and its negation. %install copies that one file to
both conf.d paths and %post no longer names them, so the payload is the final
file. %post runs a2enmod rewrite where a2enmod manages modules, which is how
SUSE gets the module the removed LoadModule used to pull in.
xCAT-test/unit/wsapi_apache_conf_portable.t fails 22 of its 30 assertions
without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
- content is "Content of the response, in bytes."
- python is smart enough to print this
- might be clearer to use "text" for someone new looking at this example.
Split attribute with comma is not a standard way, this commit
bumped REST version to 1.0 to deal with these attributes in
array type.
```
curl -X GET -k 'http://10.5.101.10/xcatws/nodes/restnode1?userName=root&userPW=cluster'
{"restnode1":{"serialspeed":"115200","nicips.ib1":"10.0.0.100|fd55::214:5eff:fe15:849b","nicnetworks.ib0":"IB00","nicnetworks.ib1":"IB01","cons":"ipmi","postscripts":"syslog,remoteshell,syncfiles,hello,world2","nicips.ib0":"10.10.100.9","groups":"conpute,staticconsolegroup","postbootscripts":"otherpkgs","nictypes.ib0":"Infiniband","nicips.ib2":"10.0.0.103|10.0.0.104"}}
curl -X GET -k 'http://10.5.101.10/xcatws/nodes/restnode1?userName=root&userPW=cluster&ver=1.0'
{"restnode1":{"nicnetworks.ib0":"IB00","nicnetworks.ib1":"IB01","cons":"ipmi","postscripts":["syslog","remoteshell","syncfiles","hello","world2"],"nicips.ib0":["10.10.100.9"],"nicips.ib2":["10.0.0.103","10.0.0.104"],"groups":["conpute","staticconsolegroup"],"postbootscripts":["otherpkgs"],"serialspeed":"115200","nicips.ib1":["10.0.0.100","fd55::214:5eff:fe15:849b"],"nictypes.ib0":"Infiniband"}}
```
- Enhance global subroutine to support loading json via GET method
- Add --template option for mkdef
- Add GET interface to list/show the /templates/node resource
Currently xcat rest service is running with apache user who do
not have the privilege to manage some local resource like credential
files needed by xcat web ui to get the conserver access.
This patch add scripts in xcatconfig to generate credential files
for conserver user. This patch also add a work around framework for
xcat restapi to provide the interface to get or set the system resource
so that restapi with apache privilege can retrieve the credential files.
Daniel Hilst
Vinícius Ferrão
Markus Hilger
Mark Gurevich
Nick Buonarota
GONG Jie
Yuan Bai
Weihua Hu
ertaozh
chenglch
yangsong
Chuck Brazie
Chuck Brazie
wangxiaopeng
Victor Hu