Merge master to feature/ldaps (#6944)

liulinC · web-flow · commit 63addaf4f73c · 2026-03-12T10:25:36.000+08:00
diff --git a/.github/workflows/1.249-lcm.yml b/.github/workflows/1.249-lcm.yml
@@ -22,6 +22,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: '1.249-lcm'
+          persist-credentials: false
 
       - name: Run python tests
         run: bash .github/python-nosetests${{ matrix.test }}.sh
@@ -35,6 +36,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: '1.249-lcm'
+          persist-credentials: false
 
       - name: Free space
         shell: bash
diff --git a/.github/workflows/codechecker.yml b/.github/workflows/codechecker.yml
@@ -26,6 +26,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup XenAPI environment
         uses: ./.github/workflows/setup-xapi-environment
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Pull configuration from xs-opam
         run: |
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Pull configuration from xs-opam
         run: |
diff --git a/.github/workflows/generate-and-build-sdks.yml b/.github/workflows/generate-and-build-sdks.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup XenAPI environment
         uses: ./.github/workflows/setup-xapi-environment
@@ -142,9 +144,11 @@ jobs:
       - name: Build Java SDK
         shell: bash
         run: |
-          xapi_version="${{ inputs.xapi_version }}"
+          xapi_version="${INPUTS_XAPI_VERSION}"
           xapi_version="${xapi_version//v/}"
           mkdir -p target && mvn -f source/xen-api/pom.xml -B -Drevision=$xapi_version-prerelease clean package && mv source/xen-api/target/*.jar target/
+        env:
+          INPUTS_XAPI_VERSION: ${{ inputs.xapi_version }}
 
       - name: Store Java SDK
         uses: actions/upload-artifact@v4
@@ -162,7 +166,9 @@ jobs:
     steps:
       - name: Strip 'v' prefix from xapi version
         shell: pwsh
-        run: echo "XAPI_VERSION_NUMBER=$("${{ inputs.xapi_version }}".TrimStart('v'))" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        run: echo "XAPI_VERSION_NUMBER=$("$env:INPUTS_XAPI_VERSION".TrimStart('v'))" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        env:
+          INPUTS_XAPI_VERSION: ${{ inputs.xapi_version }}
 
       - name: Retrieve C# SDK source
         uses: actions/download-artifact@v4
@@ -192,7 +198,7 @@ jobs:
           dotnet build source/src/XenServer.csproj `
           --disable-build-servers `
           --configuration Release `
-          -p:Version=${{ env.XAPI_VERSION_NUMBER }}-prerelease-unsigned `
+          -p:Version=$env:XAPI_VERSION_NUMBER-prerelease-unsigned `
           --verbosity=normal
 
       - name: Store C# SDK
@@ -215,7 +221,9 @@ jobs:
     steps:
       - name: Strip 'v' prefix from xapi version
         shell: pwsh
-        run: echo "XAPI_VERSION_NUMBER=$("${{ inputs.xapi_version }}".TrimStart('v'))" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        run: echo "XAPI_VERSION_NUMBER=$("$env:INPUTS_XAPI_VERSION".TrimStart('v'))" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        env:
+          INPUTS_XAPI_VERSION: ${{ inputs.xapi_version }}
 
       - name: Retrieve PowerShell SDK source
         uses: actions/download-artifact@v4
@@ -238,22 +246,22 @@ jobs:
         shell: pwsh
         run: |
           dotnet nuget add source --name local ${{ github.workspace }}\csharp
-          dotnet add source/src package XenServer.NET --version ${{ env.XAPI_VERSION_NUMBER }}-prerelease-unsigned
+          dotnet add source/src package XenServer.NET --version $env:XAPI_VERSION_NUMBER-prerelease-unsigned
 
       - name: Build PowerShell SDK (.NET ${{ matrix.dotnet }})
         shell: pwsh
         run: |
           dotnet build source/src/XenServerPowerShell.csproj `
              --disable-build-servers `
              --configuration Release `
-             -p:Version=${{ env.XAPI_VERSION_NUMBER }}-prerelease-unsigned `
+             -p:Version=$env:XAPI_VERSION_NUMBER-prerelease-unsigned `
              -p:TargetFramework=net${{ matrix.dotnet }}.0 `
              --verbosity=normal`
 
       - name: Update SDK and PS versions in "XenServerPSModule.psd1"
         shell: pwsh
         run: |
-          (Get-Content "source\XenServerPSModule.psd1") -replace "@SDK_VERSION@","${{ env.XAPI_VERSION_NUMBER }}" | Set-Content -Path "source\XenServerPSModule.psd1"
+          (Get-Content "source\XenServerPSModule.psd1") -replace "@SDK_VERSION@","$env:XAPI_VERSION_NUMBER" | Set-Content -Path "source\XenServerPSModule.psd1"
           (Get-Content "source\XenServerPSModule.psd1") -replace "@PS_VERSION@","7.0" | Set-Content -Path "source\XenServerPSModule.psd1"
 
       - name: Move binaries to destination folder
diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@v3
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -48,6 +48,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup XenAPI environment
         uses: ./.github/workflows/setup-xapi-environment
diff --git a/.github/workflows/other.yml b/.github/workflows/other.yml
@@ -35,6 +35,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # To check which files changed: origin/master..HEAD
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{matrix.python-version}}
@@ -108,6 +109,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Generate empty configuration for make to be happy
         run: touch config.mk
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Use python
         uses: actions/setup-python@v5
@@ -28,7 +30,7 @@ jobs:
 
       - name: Generate python package for XenAPI
         run: |
-          echo "export XAPI_VERSION=${{ github.ref_name }}" > config.mk
+          echo "export XAPI_VERSION=${GITHUB_REF_NAME}" > config.mk
           make python
 
       - name: Store python distribution artifacts
@@ -109,7 +111,7 @@ jobs:
       - name: Create release ${{ github.ref_name }}
         shell: bash
         run: |
-          gh release create ${{ github.ref_name }} --repo ${{ github.repository }} --generate-notes dist/* \
+          gh release create "${GITHUB_REF_NAME}" --repo ${{ github.repository }} --generate-notes dist/* \
           PowerShell-SDK-7.x-prerelease-unsigned.zip \
           Go-SDK-prerelease-unsigned.zip \
           libxenserver-prerelease.tar.gz libxenserver-prerelease.src.tar.gz
diff --git a/.github/workflows/setup-xapi-environment/action.yml b/.github/workflows/setup-xapi-environment/action.yml
@@ -70,4 +70,6 @@ runs:
 
     - name: Configure
       shell: bash
-      run: opam exec -- ./configure --xapi_version="${{ inputs.xapi_version }}"
+      run: opam exec -- ./configure --xapi_version="${INPUTS_XAPI_VERSION}"
+      env:
+        INPUTS_XAPI_VERSION: ${{ inputs.xapi_version }}
diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
@@ -28,6 +28,7 @@ jobs:
         uses: actions/checkout@v4
         with:
             fetch-depth: 0
+            persist-credentials: false
 
 # If needed severity levels can be controlled here
 #            severity: warning
diff --git a/doc/content/design/external-auth-ldaps.md b/doc/content/design/external-auth-ldaps.md
@@ -120,8 +120,9 @@ This API performs following sanity check and rejects update if check fails:
 - This API allow re-entry with `force` to perform an extra `ldaps ping` for debug purpose
 - This API will not do the LDAPS query on the trusted domains, as xapi does not have trusted domain details
 - The joined domain likely has multiple DCs. LDAPS query tries every DC of the domain. Check pass if LDAPS query succeeds on any DC of the domain. This implies iterate and locate a DC supporting LDAPS (with proper certificate trust setup) before LDAPS query. However, this does not introduce performance problems as the LDAPS query happens in backend and refreshes result into XAPI DB
-- Pool coordinator dispatches this API request to every host, and only succeeds if all hosts pass the check
+- Pool coordinator dispatches this API request to every host, and only succeeds if all hosts pass the check. All succeed host will revert to the original status if this API failed
 - This API needs to be synced with other APIs. For example, `authenticate_username_password` should fail if this API is performing checking and configuration
+- This API only impact whether ldap traffic use TLS, it does not impact existing machine account and credentials
 
 This API will refresh `winbind` configuration (Refer to 4.1).
 
@@ -185,7 +186,7 @@ tls priority = NONE:+VERS-TLS1.2:+AES-256-GCM:+AES-128-GCM:+AEAD:+ECDHE-RSA:+SIG
 
 - Switch between `ldap` and `ldaps` will flip `client ldap sasl wrapping` between `seal` and `ldaps`
 - `tls cafile` points to a CA bundle used to verify DC certs. Details refer to 4.1.2
-- `tls priority` is following stunnel TLS configuration, this result to TLS 1.2 with cipher suite TLS_ECDHE_RSA_AES_128_GCM_SHA256, TLS_ECDHE_RSA_AES_256_GCM_SHA384, Windows Server 2008R2 and later as DC support it
+- `tls priority` is following stunnel TLS configuration, this result to TLS 1.2 with cipher suite TLS_ECDHE_RSA_AES_128_GCM_SHA256, TLS_ECDHE_RSA_AES_256_GCM_SHA384, Windows Server 2012 and later as DC support it
   - NONE: starts with empty set
   - +VERS-TLS1.2: Enbale TLS 1.2
   - +AES-256-GCM:+AES-128-GCM: Enable AES-256-GCM and AES-128-GCM cipher
diff --git a/doc/content/xen-api/topics/metrics.md b/doc/content/xen-api/topics/metrics.md
@@ -249,3 +249,29 @@ To request a different update interval, add the parameter `interval=seconds` e.g
 ```sh
 wget "http://hostname/rrd_updates?session_id=<token>&start=0&interval=5"
 ```
+
+Filtering by UUID
+-----------------
+
+By default the `rrd_updates` endpoint returns statistics for all VMs
+resident on the host being queried.
+
+It is possible to restrict the response to specific VMs or storage
+repositories by using the `vm_uuid` or `sr_uuid` query parameters.
+
+Multiple UUIDs may be provided by repeating the parameter. In this
+case the result will contain statistics for all the specified objects.
+
+For example, to retrieve statistics for two VMs:
+
+```sh
+wget "http://hostname/rrd_updates?session_id=<token>&start=<secondsinceepoch>&vm_uuid=<uuid1>&vm_uuid=<uuid2>"
+```
+
+Similarly, to retrieve statistics for multiple storage repositories:
+
+```sh
+wget "http://hostname/rrd_updates?session_id=<token>&start=<secondsinceepoch>&sr_uuid=<uuid1>&sr_uuid=<uuid2>"
+```
+
+If `sr_uuid` is omitted, no SR statistics are included in the response.
diff --git a/ocaml/vhd-tool/.github/workflows/main.yml b/ocaml/vhd-tool/.github/workflows/main.yml
@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Pull configuration from xs-opam
         run: |
diff --git a/ocaml/xapi/import.ml b/ocaml/xapi/import.ml
@@ -2141,12 +2141,16 @@ let check_references ~__context (table : table) =
         (Diagnostic.show_path path)
         (Ref.string_of r)
   in
-  let rec go (clazz, _, r) =
-    match get_snapshot ~clazz ~r with
-    | Some record ->
-        Diagnostic.visit_references check_reference clazz record
-    | _ ->
-        debug "Could not find imported object %s" r
+  let go (clazz, _, r) =
+    (* Ref.null will lead to a get_record failure *)
+    if Ref.of_string r = Ref.null then
+      ()
+    else
+      match get_snapshot ~clazz ~r with
+      | Some record ->
+          Diagnostic.visit_references check_reference clazz record
+      | _ ->
+          debug "Could not find imported object %s" r
   in
   List.iter go table
 
diff --git a/ocaml/xcp-rrdd/bin/rrdd/rrdd_http_handler.ml b/ocaml/xcp-rrdd/bin/rrdd/rrdd_http_handler.ml
@@ -3,6 +3,8 @@ module D = Debug.Make (struct let name = "rrdd_http_handler" end)
 open D
 open Rrdd_shared
 
+type uuids_filter = All | Zero | Only of string list
+
 let with_lock = Xapi_stdext_threads.Threadext.Mutex.execute
 
 let content_hdr_of_mime mime =
@@ -113,9 +115,18 @@ let get_sr_rrd_handler (req : Http.Request.t) (s : Unix.file_descr) _ =
 (* Get an XML/JSON document (as a string) representing the updates since the
    specified start time. *)
 let get_host_stats ?(json = false) ~(start : int64) ~(interval : int64)
-    ~(cfopt : Rrd.cf_type option) ~(is_host : string) ~(vm_uuid : string)
-    ~(sr_uuid : string) () =
+    ~(cfopt : Rrd.cf_type option) ~(is_host : string) ~(vm_uuids : uuids_filter)
+    ~(sr_uuids : uuids_filter) () =
   with_lock mutex (fun () ->
+      let apply_uuids_filter filter seq =
+        match filter with
+        | All ->
+            seq
+        | Zero ->
+            Seq.empty
+        | Only uuids ->
+            Seq.filter (fun (k, _) -> List.mem k uuids) seq
+      in
       let prefixandrrds =
         let vm_rrds = Hashtbl.to_seq vm_rrds in
         let sr_rrds = Hashtbl.to_seq sr_rrds in
@@ -133,25 +144,11 @@ let get_host_stats ?(json = false) ~(start : int64) ~(interval : int64)
           else
             []
         in
-        let vmsandrrds =
-          if vm_uuid = "all" then
-            vm_rrds
-          else if vm_uuid = "none" then
-            Seq.empty
-          else
-            Seq.filter (fun (k, _) -> k = vm_uuid) vm_rrds
-        in
+        let vmsandrrds = apply_uuids_filter vm_uuids vm_rrds in
         let vm_rrds_altered =
           Seq.map (fun (k, v) -> ("vm:" ^ k ^ ":", v.rrd)) vmsandrrds
         in
-        let srsandrrds =
-          if sr_uuid = "all" then
-            sr_rrds
-          else if sr_uuid = "none" then
-            Seq.empty
-          else
-            Seq.filter (fun (k, _) -> k = sr_uuid) sr_rrds
-        in
+        let srsandrrds = apply_uuids_filter sr_uuids sr_rrds in
         let sr_rrds_altered =
           Seq.map (fun (k, v) -> ("sr:" ^ k ^ ":", v.rrd)) srsandrrds
         in
@@ -160,6 +157,8 @@ let get_host_stats ?(json = false) ~(start : int64) ~(interval : int64)
       Rrd_updates.export ~json prefixandrrds start interval cfopt
   )
 
+(* Filter UUID of XAPI objet. If no object is passed in the query it returns EMPTY,
+*)
 (* Writes XML/JSON representing the updates since the specified start time to
    the file descriptor that corresponds to the client HTTP connection. *)
 let get_rrd_updates_handler (req : Http.Request.t) (s : Unix.file_descr) _ =
@@ -171,30 +170,28 @@ let get_rrd_updates_handler (req : Http.Request.t) (s : Unix.file_descr) _ =
   let interval =
     try Int64.of_string (List.assoc "interval" query) with _ -> 0L
   in
-  let query_associated_value key lst =
-    try List.assoc key lst with _ -> "none"
-  in
-  let is_host =
-    if List.mem_assoc "host" query then
-      query_associated_value "host" query
-    else
-      "none"
-  in
-  let vm_uuid =
-    if List.mem_assoc "vm_uuid" query then
-      query_associated_value "vm_uuid" query
-    else
-      "all"
-  in
-  let sr_uuid =
-    if List.mem_assoc "sr_uuid" query then
-      query_associated_value "sr_uuid" query
-    else
-      "none"
+  let uuids_filter_of key query ~default =
+    match
+      List.filter_map
+        (fun (k, v) ->
+          if k = key then
+            Some v
+          else
+            None
+        )
+        query
+    with
+    | [] ->
+        default
+    | uuids ->
+        Only uuids
   in
+  let is_host = Option.value (List.assoc_opt "host" query) ~default:"none" in
+  let vm_uuids = uuids_filter_of "vm_uuid" query ~default:All in
+  let sr_uuids = uuids_filter_of "sr_uuid" query ~default:Zero in
   let json = client_prefers_json req in
   let reply =
-    get_host_stats ~json ~start ~interval ~cfopt ~is_host ~vm_uuid ~sr_uuid ()
+    get_host_stats ~json ~start ~interval ~cfopt ~is_host ~vm_uuids ~sr_uuids ()
   in
   let headers =
     List.concat
