Method ExecuteCommandAPIHandler

lib/icinga/clusterevents.cpp:914–1069

}

Value ClusterEvents::ExecuteCommandAPIHandler(const MessageOrigin::Ptr& origin, const Dictionary::Ptr& params)
{
	ApiListener::Ptr listener = ApiListener::GetInstance();

	if (!listener)
		return Empty;

	if (!origin->IsLocal()) {
		Endpoint::Ptr endpoint = origin->FromClient->GetEndpoint();

		/* Discard messages from anonymous clients */
		if (!endpoint) {
			Log(LogNotice, "ClusterEvents") << "Discarding 'execute command' message from '"
				<< origin->FromClient->GetIdentity() << "': Invalid endpoint origin (client not allowed).";
			return Empty;
		}

		Zone::Ptr originZone = endpoint->GetZone();

		Zone::Ptr localZone = Zone::GetLocalZone();
		bool fromLocalZone = originZone == localZone;

		Zone::Ptr parentZone = localZone->GetParent();
		bool fromParentZone = parentZone && originZone == parentZone;

		if (!fromLocalZone && !fromParentZone) {
			Log(LogNotice, "ClusterEvents") << "Discarding 'execute command' message from '"
				<< origin->FromClient->GetIdentity() << "': Unauthorized access.";
			return Empty;
		}
	}

	String executionUuid = params->Get("source");

	if (params->Contains("endpoint")) {
		Endpoint::Ptr execEndpoint = Endpoint::GetByName(params->Get("endpoint"));

		if (!execEndpoint) {
			Log(LogWarning, "ClusterEvents")
				<< "Discarding 'execute command' message " << executionUuid
				<< ": Endpoint " << params->Get("endpoint") << " does not exist";
			return Empty;
		}

		if (execEndpoint != Endpoint::GetLocalEndpoint()) {
			Zone::Ptr endpointZone = execEndpoint->GetZone();
			Zone::Ptr localZone = Zone::GetLocalZone();

			if (!endpointZone->IsChildOf(localZone)) {
				return Empty;
			}

			/* Check if the child endpoints have Icinga version >= 2.13 */
			for (const Zone::Ptr &zone : ConfigType::GetObjectsByType<Zone>()) {
				/* Fetch immediate child zone members */
				if (zone->GetParent() == localZone && zone->CanAccessObject(endpointZone)) {
					auto endpoints (zone->GetEndpoints());