GitLab

  register_globals=1 to turn POST/GET/COOKIES arguments in local variables.
  This is known to be a terrible security risk, and we keep saying we are
  going to fix it, and now I am. In order to accomplish this on a
  transitional basis (since I don't want the entire web interface to stop
  working while I debug it), and because the code just needs the cleanup, I
  am doing it like this: Each page will sport new declarations at the top:

	RequiredPageArguments("experiment", PAGEARG_EXPERIMENT,
                              "template",   PAGEARG_TEMPLATE,
                              "instance",   PAGEARG_INSTANCE,
                              "metadata",   PAGEARG_METADATA,
                              "osinfo",     PAGEARG_OSINFO,
                              "image",      PAGEARG_IMAGE,
                              "project",    PAGEARG_PROJECT,
                              "group",      PAGEARG_GROUP,
                              "user",       PAGEARG_USER,
			      "node",       PAGEARG_NODE,
			      "yesno",      PAGEARG_BOOLEAN,
			      "message",    PAGEARG_STRING,
			      "age",        PAGEARG_INTEGER,
                              "cost",       PAGEARG_NUMERIC,
                              "formfields", PAGEARG_ARRAY,
                              "unknown",    PAGEARG_ANYTHING);

	OptionalPageArguments("canceled", PAGEARG_BOOLEAN);

  The first token in each pair is the name of the global variable to
  set, and the second token is the type. So, for "experiment" we look at
  the URL for a pid/eid or exptidx, etc, sanity check them (safe for a
  DB query), and then try to find that experiment in the DB. If it maps
  to an experiment, set global variable $experiment to the object. Since
  its a required argument, produce an error if not supplied. Similar
  treatment for optional arguments, with the obvious difference.

  The goal is to have ALL argument processing in one place, consistent,
  and correct. I've found numerous places where we leak unchecked
  arguments into queries. It also cuts out a lot of duplicated code.

* To make the above easier to deal with, I've been replacing lots of
  hardcoded URLS in the code of the form:

	foo.php3?pid=$pid&eid=$eid ...

  with

        CreateURL("foo", $experiment)

  which creates and returns the neccessary url string, by looking at
  the type of its arguments (experiment, template, instance, etc.)

  Eventually plan to replace them all so that URL handling throughout
  the code is all defined in one place (all the new URL code is in
  url_defs.php).

* I have cranked up error reporting to tell me anytime a variable is
  used before it is initialized, plus a bunch of other stuff that PHP
  deems improper. Think of it like -Wall ... and boy we get a lot of
  warnings.  A very large percentage of the diffs are to fix all these
  warnings.

  The warnings are currently going to /usr/testbed/log/php-errors.log,
  and I'll be adding a script to capture them each night and mail them
  to tbops. This file also gets errors (this will be a change for
  developers; rather then seeing errors and warnings dumped in the
  middle of web pages, they will go to this file instead).

* Major refactoring of the code. More objects (nodes, images, osids).
  Moving tons of queries into the objects in the hopes of someday
  getting to a point where we can split the web interface onto a
  different server.  Lots of general cleanup.

converting to locally unique ids and later globally unique ids.

allows takes you to new (admin only) page to select a project that
node will be reserved for.

* The node is not actually *reserved*, it is *pre* reserved! The node
  stays in the free pool, and is available only for use in the project
  to which it is reserved.

* The node can already be reserved to some other project when you
  pre-reserve it. It is not until the current owner releases the node
  that the pre-reservation takes effect.

* The node free counts (on the web pages) count a free a node with a
  pre-reservation, as allocated. This way people do not see a free
  count that includes a node they will never be able to get.

Capitalize menu item...

Link in the modnodeattributes form.

* utils/spewconlog.in: New script to ssh to the host tipserver and cat
  the console log for a node. In admin mode cats the .log file, while
  in mere user mode, cats the .run file.

* www/shownode.php3: Added a "Show Console Log" function.

* www/showconlog.php3: New script to invoke spewconlog backend script
  and dump the console log to the user.

Okay, I implemented a primitive Knowledge Base! The current contents are
*all* the existing FAQ entries, which I entered manually. Here are the
details.

* My reason for doing this is that we need something very simple. The wiki
  is too much of a barrier, and its search capabilities are pathetic.

* The search page for the Knowledge Base is:

	https://www.emulab.net/kb-search.php3

  Fairly primitive keyword search. Turns out that mysql 4.0 has a bunch for
  really good text searching functions built in, but we run 3.23 ... so I
  had to roll it myself. So, its a simple keyword (space or comma
  separated) search, no regular expressions.

* Each DB record has a "faq_entry" flag, so creating the current FAQ on the
  fly from the DB is easy. See:

	https://www.emulab.net/kb-faq.php3

* In reddot mode, you can add new KB entries:

	https://www.emulab.net/kb-manage.php3

  The form is fairly obvious but here are details anyway:

    Section Name: Choose an existing title, or make up a new one.
    Title:        The title of the KB (or FAQ) entry.
    Faq Entry:    Check this box if the new entry should show up in the FAQ.
    X Ref Tag:    A token so you can refer to other KB entries by name,
                  instead of by its index. Within the KB entry you would
                  write: <a href=kb-show.php3?xref_tag=sometag>
    Body:         Whatever you like. I took the existing FAQ entries and
                  stuck them with no changes except for the xref_tag
                  mentioned about (since some entries referenced other
                  entries).

* Once you click on sumbit, you will see the entry as it will appear to
  users, along with a submenu to Modify/Delete/Add entries. You can modify
  the current entry from that menu. Mere users do not see this menu, only
  when in reddot mode.

* The intent here is that we can generate new entries really easy, right
  from email if you like (with appropriate <pre> or <xmp> tags around it).

* I have added sql/knowlbase-create.sql and a makefile target to
  generate that file when creating a distribution. I also added a section
  to install/boss-install to insert the entries into the new DB.

* I hooked the search function into the existing Search Documentation link.
  We know search both the Knowledge Base *and* the Documentation on doc
  searches. This probably needs a little more work to get right.

* I changed a lot of faq links to be more consistent and to reference
  the proper xref_tags (#swapping instead of #UTT-34).

some additional privs; allowed to view/edit node logs and histories of
all nodes, plus some others.

Robot-related improvements based on feedback from Sid:

	* event/sched/event-sched.h, event/sched/event-sched.c,
	event/sched/rpc.h, event/sched/rpc.cc: Send a notification of the
	start of event time and timelines.  Add a '-r' option that forces
	it to use the default rpc path (so dan can use a custom
	scheduler/rmcd/etc on ops).

	* robots/GNUmakefile.in, robots/emc/GNUmakefile.in,
	robots/mtp/GNUmakefile.in, robots/primotion/GNUmakefile.in,
	robots/rmcd/GNUmakefile.in, robots/vmcd/GNUmakefile.in,
	robots/tbsetdest/tbsetdest.cc: Add a control-install target.

	* robots/primotion/garcia-pilot.cc: Take out some experimental
	code.

	* robots/primotion/dashboard.hh, robots/primotion/dashboard.cc,
	robots/primotion/pilotClient.cc, robots/primotion/wheelManager.hh,
	robots/primotion/wheelManager.cc: When doing a COMMAND_STOP, make
	sure we only send one update packet, an idle or an abort.  Also
	send back the actual distance travelled/pivoted.

	* robots/tbsetdest/tbsetdest.cc: Don't output setdest event's with
	a speed of zero.

	* tbsetup/eventsys_control.in: When replaying/stopping, clear the
	start of event time for the experiment.

	* tbsetup/power_mail.pm.in: Decrease the threshold used to tell if
	a node has been power cycled "recently".

	* tbsetup/ns2ir/node.tcl, tbsetup/ns2ir/sim.tcl.in: Bah, backout
	last change, orientation is supposed to be in degrees at these
	points.  Also, when automatically picking the sync server, don't
	use nodes that are subnodes.

	* tmcd/common/bootsubnodes: Send an ISUP for motes.

	* www/moteleds.php3: Show the mote node names instead of the
	robots.

	* www/powertime.php3: Add option to mark nodes as powered off.

	* www/robotmap.php3: Display the elapsed time for the overall
	event time and for each active timeline.

	* www/showexp.php3: Only display the blinky lights menu item when
	there are motes.

	* www/shownode.php3: Change "Update Power Time" -> "Update Power
	State".

	* www/tutorial/mobilewireless.php3: Fix some nits.

	* xmlrpc/emulabserver.py.in: Add event_time_start method for
	storing/getting/clearing the start of event time for an
	experiment/timeline.

Robot related stuff: power via e-mail, client-install fixups, checking
coords against camera boundaries.

	* configure, configure.in: Add tbsetup/power_mail.pm to the list
	of template files.

	* doc/cross-compiling.txt: More stargate notes.

	* event/sched/rpc.cc: Updates for the addition of the cameras
	table.

	* robots/GNUmakefile.in, robots/emc/GNUmakefile.in,
	robots/mtp/GNUmakefile.in, robots/rmcd/GNUmakefile.in,
	robots/tbsetdest/GNUmakefile.in, robots/vmcd/GNUmakefile.in:
	client-install fixups.

	* tbsetup/GNUmakefile.in: Add power_mail.pm.

	* tbsetup/os_setup.in: Don't skip reboot of robots anymore.

	* tbsetup/power.in: Add special case for a power_id of "mail",
	which calls into the power_mail.pm backend.

	* tbsetup/power_mail.pm.in: E-mail backend for power, it sends an
	e-mail to tbops and waits for the outlets.last_power value to be
	updated from the power.php3 web page.

	* tbsetup/ns2ir/parse-ns.in: Add the contents of the cameras table
	to the TBCOMPAT namespace.

	* tbsetup/ns2ir/sim.tcl.in: More checking of "setdest" inputs.

	* tbsetup/ns2ir/topography.tcl: Update the checkdest method to
	check destination points against the camera list.

	* www/powertime.php3: Webpage used to update the last power time
	for nodes.

	* www/shownode.php3: Add "Update Power Time" menu button.

The web interface could use some work...

A bunch of engineering on the robot code.  I'm sure I've broken something,
but the majority of it is done and I wanted to get a checkpoint in.

	* GNUmakerules: Add rpcgen rules.

	* Makeconf.in: Add PATH and host_cpu variables so
	cross-compilation works properly.  Add JAVAC and JAR for java
	compilation.  Add BRAINSTEM_DIR that refers to a brainstem build
	directory to be used for the robot build.

	* configure, configure.in: Prepend the arm cross-compile dir to
	PATH.  Detect java for building applets.  Add --with-brainstem to
	specify the brainstem build dir.  Add --enable-mezzanine to turn
	on the mezzanine build.

	* robots/GNUmakefile.in: Add client target that builds the
	subdirs.

	* robots/emc/GNUmakefile.in, robots/emc/emcd.h, robots/emc/emcd.c,
	test_emcd.sh.in, robots/rmcd/GNUmakefile.in, robots/rmcd/rmcd.c,
	robots/rmcd/test_rmcd.sh.in, robots/vmcd/test_vmc-client.sh.in,
	robots/vmcd/test_vmcd.sh.in, robots/vmcd/test_vmcd2.sh,
	robots/vmcd/test_vmcd3.sh, robots/vmcd/test_vmcd4.sh,
	robots/vmcd/vmc-client.c, robots/vmcd/vmcd.c: Updates for the mtp
	switch to using rpcgen.

	* robots/emc/test_emcd.config: Restore missing config line.

	* robots/mtp/GNUmakefile.in, robots/mtp/global_bound.java,
	robots/mtp/mtp.h, robots/mtp/mtp.c, robots/mtp/mtp.java,
	robots/mtp/mtp.x, robots/mtp/mtp_command_goto.java,
	robots/mtp/mtp_command_stop.java, robots/mtp/mtp_config_rmc.java,
	robots/mtp/mtp_config_vmc.java, robots/mtp/mtp_control.java,
	robots/mtp/mtp_dump.c, robots/mtp/mtp_garcia_telemetry.java,
	robots/mtp/mtp_opcode_t.java, robots/mtp/mtp_packet.java,
	robots/mtp/mtp_payload.java, robots/mtp/mtp_recv.c,
	robots/mtp/mtp_request_id.java,
	robots/mtp/mtp_request_position.java,
	robots/mtp/mtp_robot_type_t.java, robots/mtp/mtp_role_t.java,
	robots/mtp/mtp_send.c, robots/mtp/mtp_status_t.java,
	robots/mtp/mtp_telemetry.java, robots/mtp/mtp_update_id.java,
	robots/mtp/mtp_update_position.java, robots/mtp/robot_config.java,
	robots/mtp/robot_position.java, robots/mtp/test_mtp.sh: Replace
	hand-generated stubs with xdr stubs for C and java.  Java stubs
	were generated by "remotetea's" jrpcgen.

	* robots/primotion/GNUmakefile.in,
	robots/primotion/buttonManager.hh,
	robots/primotion/buttonManager.cc, robots/primotion/dashboard.hh,
	robots/primotion/dashboard.cc, robots/primotion/flash-user-led.cc,
	robots/primotion/garcia-pilot.cc, robots/primotion/garciaUtil.hh,
	robots/primotion/garciaUtil.cc, robots/primotion/ledManager.hh,
	robots/primotion/ledManager.cc,
	robots/primotion/pilotButtonCallback.hh,
	robots/primotion/pilotButtonCallback.cc,
	robots/primotion/pilotClient.hh, robots/primotion/pilotClient.cc,
	robots/primotion/watch-user-button.cc,
	robots/primotion/wheelManager.hh,
	robots/primotion/wheelManager.cc: Replace gorobot with
	garcia-pilot, a beefed up daemon for controlling the robots.
	Improvements include: making use of the user LED and button to
	give some feedback and let the wrangler run a test sequence,
	reboot, and shutdown the robot; Logging of the battery level, how
	often the robot has moved and for how long, and the distance
	traveled; telemetry is sent back to emulab clients; movements are
	now just pivot-move instead of pivot-move-pivot, since the second
	pivot ends up being extra work most of the time; the robot will
	move backwards to cut down on the amount of rotation; and just
	generic cleanups to the code.

	* robots/primotion/garcia.config: The configuration file currently
	used on the garcias.

	* www/GNUmakefile.in: Add garcia-telemetry subdir to the build.

	* www/dbdefs.php3.in: Add TBNodeClass and TBNodeStatus functions.

	* www/garcia-telemetry/Base64.java,
	www/garcia-telemetry/GNUmakefile.in,
	www/garcia-telemetry/GarciaTelemetry.java,
	www/garcia-telemetry/UpdateThread.java,
	www/garcia-telemetry/main.xml: A telemetry applet for the garcia,
	it displays readouts for the various sensors and other bits of data
	gathered by the garcia-pilot daemon.  Hopefully, it will make a
	handy debugging tool.

	* www/garcia-telemetry.jar, www/mtp.jar, www/oncrpc.jar,
	www/thinlet.jar: Java jars used by the robot telemetry applet.

	* www/servicepipe.php3: A slightly enhanced version of
	ledpipe.php3 that can be used for other services, like robot
	telemetry.

	* www/shownode.php3: Add "Show Telemetry" menu item to robot
	nodes.

	* www/telemetry.php3: Telemetry page for the garcia-telemetry
	applet.

* Add boot_errno to the nodes table so that nodes can report in a
  subcode to indicate what went wrong. At present, we do not report any
  real error codes; that is going to take some time to work out since it
  will reqiure a bunch of changes to the boot scripts.

* Add new table node_bootlogs to store logs provided by the nodes. Not
  a full console log, but a log of the tmcd client side part. We can
  make it a full log if we want though; just means mucking about with
  the boot phase a bit.

* Add new state transition to NORMALv2 and PCVM state machines. "TBFAILED"
  is a new state that is sent (after TBSETUP) if a node fails somewhere in
  the tmcd client side.

* Change TBNodeStateWait() to take a list of states (instead of single
  state) and an optional pass by reference parameter to return the actual
  state that the node landed in. Change all calls to TBNodeStateWait() of
  course.

* Change os_setup (and libreboot in wait mode) to look for both TBFAILED
  and ISUP. If a TBFAILED event is seen, we can terminate the wait early
  and not retry os_setup on physical nodes (although still retry virtual
  nodes). The nice thing about this is that the wait should terminate much
  earlier (rather then waiting for timeout), especially for virtual nodes
  which can take a really long time when there are a couple of hundred.

* Add new routines dobooterrno() and dobootlog() to tmcd. Bump version
  number and increase the buffer size to allow for the larger packets that
  a console log wikk generate (added MAXTMCDPACKET variable, set to 0x4000).

* Add new -f option to tmcc to specify a datafile to send along as the last
  argument to tmcd. This is more pleasing then trying to send a console log
  in on the command line. For example: "tmcc -f /tmp/log BOOTLOG" will send
  a BOOTLOG command along with the contents of /tmp/log.

  Also close the write side of the pipe so that server sees EOF on
  read. See aside comment below.

* Changes to rc.bootsetup:
     1. Use perl tricks to capture all output, duping to the console and to
        a log file in /var/emulab/logs.
     2. On any error, send a status code (boot_errno) and the bootlog to
        tmcd.
     3. Generate a TBFAILED state transition.

* Changes to rc.injail:
     1. Same as rc.bootsetup, but do not send log files; that would pummel
        boss. Leave them on the physical node.

* Change vnodesetup (which calls mkjail) to watch for any error and send a
  TBFAILED state transition. This should catch almost all errors, and
  dramatically reduce waiting when something fails.

* Changes to rc.cdboot are essentially the same as rc.bootsetup, although a
  bootlog is sent all the time (success or failure), and I do not generate
  a boot_errno yet. Also, instead of TBFAILED, generate a PXEFAILED state
  since the CDROM is actually operating within the PXEFBSD opmode. I have
  yet to work this into the rest of the system though; waiting to get a new
  CD built and actually experiment with it.

* Add new menu option and web page to display the node bootlog. We store
  only the lastest bootlog, but maybe someday store more then one. Display
  boot_errno on node page.

Aside: I made a big mistake in the tmcd protocol; I did not envision
passing more then a small amount of data (one fragment) and so I do not
include a record terminator (ie: close of the write side on the client
sends EOF) or a size field at the beginning. No big deal since small
requests are sent in one fragment and the server sees the entire
thing. Well, with a large console log, that will end up as multiple
fragments, and the server will often not get the entire thing on the first
read, and there are no subsequent reads (with no EOF or known size, it
would block forever). Well, fixing this in a backwards compatable manner
(for old images) was way too much pain. Instead, tmcc now closes the write
side, and the server does subsequent reads *only* in the new dobbootlog()
routine. Note that it *is* possible to fix this in a backwards compatable
manner, but I did not want to go down that path just yet.

places. Change $short optional argument to a flags argument, and add a
NOPERM flag, which allows display of a node to people without
permission to view that node. The display is cut back to node type,
and a couple of other things that are not private. I also added a
section on the Interfaces of a node, using the interfaces table for
the node, joined with the interface_types and interface_capabilities
tables. This gives more specific information about a node then is
possible using the generic node_types table.

'node' field already filled out.

* install-rpm, install-tarfile, spewrpmtar.php3, spewrpmtar.in: Pumped
  up even more! The db file we store in /var/db now records both the
  timestamp (of the file, or if remote the install time) and the MD5
  of the file that was installed. Locally, we can get this info when
  accessing the file via NFS (copymode on or off). Remote, we use wget
  to get the file, and so pass the timestamp along in the URL request,
  and let spewrpmtar.in determine if the file has changed. If the
  timestamp it gets is >= to the timestamp of the file, an error code
  of 304 (Not Modifed) is returned. Otherwise the file is returned.

  If the timestamps are different (remote, server sends back an actual
  file), the MD5 of the file is compared against the value stored. If
  they are equal, update the timestamp in the db file to avoid
  repeated MD5s (or server downloads) in the future. If the MD5 is
  different, then reinstall the tarball or rpm, and update the db file
  with the new timestamp and MD5. Presto, we have auto update capability!

  Caveat: I pass along the old MD5 in the URL, but it is currently
  ignored. I do not know if doing the MD5 on the server is a good
  idea, but obviously it is easy to add later. At the moment it
  happens on the node, which means wasted bandwidth when the timestamp
  has changed, but the file has not (probably not something that will
  happen in typical usage).

  Caveat: The timestamp used on remote nodes is the time the tarfile
  is installed (GM time of course). We could arrange to return the
  timestamp of the local file back to the node, but that would mean
  complicating the protocol (or using an http header) and I was not in
  the mood for that. In typical usage, I do not think that people will
  be changing tarfiles and rpms so rapidly that this will make a
  difference, but if it does, we can change it.

* node_update.in, client side watchdog, and various web pages:
  Deflated node_update, removing all of the older ssh code. We now
  assume that all nodes will auto update on a periodic basis, via the
  watchdog that runs on all client nodes, including plab nodes.

  Changed the permission check to look for new UPDATE permission (used
  to be UPDATEACCOUNT). As before, it requires local_root or better.
  The reason for this is that node_update now implies more than just
  updating the accounts/mounts. The web pages have been changed to
  explain that in addition to mounts/accounts, rpms and tarfiles will
  also be updated. At the moment, this is still tied to a single
  variable (update_accounts) in the nodes table, but as Kirk requested
  at the meeting, it will probably be nice to split these out in the
  future.

  Added the ability to node_update a single node in an experiment (in
  addition to all nodes option on the showexp page). This has been
  added to the shownode webpage menu options.

  Changed locking code to use the newer wrapper states, and to move
  the experiment to RUNNING_LOCKED until the update completes. This is
  to prevent mayhem in the rest of the system (which could be dealt
  with, but is not worth the trouble; people have to wait until their
  initiated update is complete, before they can swap out the
  experiment).

  Added "short" mode to shownode routine, equiv to the recently added
  short mode for showexp. I use this on the confirmation page for
  updating a single node, giving the user a couple of pertinent (feel
  good) facts before they comfirm.

Chad's tiptunnel stuff. Requires ssh-mime.pl in the current directory,
to be installed as a browser helper application on the users machine.
Copied Chad's instructions for the tiptunnel from the FAQ, and stuck
it into ssh-mime.html as a help file (not really FAQ material). The
intent of this of course is to make ssh into jailed nodes easier, but
not having to know port numbers, or directly log into ops first, when
the jails are using control network IPs in our private IP space (not
routable from outside).

Better headers on shownode page,
also added "Project" prefix to header on showproject and
"Experiment" prefix to header on showexp.

Serial Line' option.

Added faq entry, added script to generate acl files, and added
menu option (With "howto" link to FAQ") to shownode.

information page. Got tired of having to past the them all by hand
between windows. Only admins can do this.

Also, add subpage menu stuff to make the page look nicer.

supporting autocreating and autoloading images. The imageid form now
sports a field to specify a nodeid to create the image from; If set,
the backend create_image script is invoked. Thats the easy part.
Slightly harder is autoloading images based on the osid specified in
the NS file. To support this, I have added a new DB table called
osidtoimageid, which holds the mapping from osid/pctype to imageid.
When users create images, they must specify what node types that image
is good for. Obviously, the mappings have to be unique or it would be
impossible to figure it out! Anyway, once that image mapping is
in place and the image created, the user can specify that ID in the NS
file. I've changed os_setup to to look for IDs that are not loaded,
and to try and find one in the osidtoimageid. If found, it invokes
os_load. To keep things running in parallel as much as possible,
os_setup issues all the loads/reboots (could be more than a single set
of loads is multiple IDs are in the NS file) at once, and waits for
all the children to exit. I've hacked up os_load a bit to try and be
more robust in the face of PXE failures, which still happen and are
rather troublsesome. Need an event system!

Contained in this revision are unrelated changed to make the OS and
Image IDs per-project unique instead of globally unique, since thats a
pain for the users. This turns out to be very messy, since underneath
we do not want to pass around pid/ID in all the various places its
used. Rather, I create a globally unique name and extened the OS and
Image tables to include pid/name/ID. The user selects pid/name, and I
create the globally unique ID. For the most part this is invisible
throughout the system, except where we interface with the user, say in
the web pages; the user should see his chosen name where possible, and
the should invoke scripts (os_load, create_image, etc) using his/her
name not the internal ID. Also, in the front end the NS file should
use the user name not the ID. All in all, this accounted for a number
of annoying changes and some special cases that are unavoidable.

viewing the log.