The status counting loop iterated over every key of the processcount dict, so
'pid_max' was assigned the number of processes whose status is 'pid_max', ie 0.
It was set to the system value on the line above, and 'total' and 'thread' are
recomputed after the loop, so pid_max was the only casualty: /api/4/processcount
reported 0 while /proc/sys/kernel/pid_max was 4194304.
The status was also matched with 'is', which compares identity. It only worked
by accident, because CPython interns identifier-like literals such as 'running'
and 'sleeping'. Any status that is not interned, or not an identifier such as
'disk-sleep', would never match its key.
Count the two status keys only, and compare with '=='. pid_max now keeps the
value read from the system, and stays None when it can not be read (non Linux),
as documented by the property and as initialised by reset_processcount().
get_default_ret_value() collapsed every matching condition into a single
'ret' key, so the level that won was whichever condition was evaluated
last rather than the most severe one. A URL that was both failing and
slow was reported as WARNING instead of CRITICAL, and a URL whose first
scan had not completed matched both CAREFUL and CRITICAL and was shown
as CRITICAL (which could also fire ports_critical_action).
Resolve by severity (CRITICAL > WARNING > CAREFUL > OK) and stop a None
status from matching the CRITICAL condition for web checks.
Adds tests/test_plugin_ports.py covering the severity ordering and the
four web scan outcomes.
Closes#3632
The dispatch selecting the thresholds only probed the critical level, so a
configuration defining careful and/or warning without critical was silently
discarded and the system thresholds were used instead. This affected both the
per sensor (#2058) and the per type (#3049) forms.
AMD k10temp reports no high/critical for Tctl on many boards, so the fallback
returned DEFAULT and the temperature was never highlighted, whatever the user
configured.
Check every criticality level instead, so the documented precedence (specific
sensor, then sensor type, then system) applies as soon as one threshold is set.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The list-plugin branch of the TimescaleDB exporter counted the 'key' field
once as a column but twice in the values: it was appended manually as key_id
and again through the plugin item values(). The item_list[:-1] slice tried to
compensate but dropped the last stat field instead of 'key', and still left
the count off by one, so an N-field plugin produced 3 + N columns for 2 + N
values.
Exporting the network plugin therefore failed with "the query has 25
placeholders but 24 parameters were passed" and no data was inserted.
The 'key' field is now excluded from both the column generation and the value
extend (it is already stored as key_id) and the slice is removed, so column
and value counts match and no stat field is lost.
Adds tests/test_export_timescaledb_list.py covering the column/value count,
the single key_id column, and the previously dropped trailing field.
Closes#3592
The outer loop over network interfaces had no break, so ip_address was
overwritten by every subsequent up/non-loopback interface with a
matching address family. On hosts with Docker, this meant the bridge
IP (e.g. 172.18.0.1) was returned instead of the actual LAN address,
because virtual interfaces can sort after the real one in dict order.
Add a break once a match is found so the function returns the first
qualifying interface, plus regression tests covering the Docker case,
loopback/down-interface skipping, and the no-match case.
Fixes#3617
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015NJfi2d6yvmmDzvPmm4eof
On Jetson (Tegra) the integrated GPU is enumerated by NVML
(nvidia-l4t-nvml) and reports its name (e.g. "Orin (nvgpu)"), but the
per-metric NVML queries return NVML_ERROR_NOT_SUPPORTED, so the GPU
plugin only ever showed N/A for proc/mem/temperature.
Add a Tegra sysfs backend (glances/plugins/gpu/cards/tegra.py) and wire
it into the NVIDIA card as a per-metric fallback: when NVML returns None
for a device detected as Tegra (name contains "nvgpu", or the Tegra GPU
sysfs node exists), read:
- proc: /sys/devices/platform/gpu.0/load (per-mille -> percent)
- temperature: the gpu-thermal /sys/class/thermal zone (milli-C -> C)
Memory stays N/A by design: the Tegra GPU shares system RAM, already
reported by the MEM plugin. Scales verified against tegrastats
(GR3D_FREQ and gpu@).
Adds unit tests with committed sysfs fixtures, a NEWS.rst entry and a
docs note.
Verified on JetPack 6.2.1 (L4T R36.4.7) and JetPack 7.2 (L4T R39.2):
identical sysfs node layout and gpu-thermal zone selection on both, with
temperature cross-checked against tegrastats on each.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cover the non-RCE behaviour of the new JSON cache:
- round-trip: written file is valid JSON, re-read produces equivalent dict
- legacy pickle: a pre-fix pickle cache is treated as a cache miss, not
a crash (upgrade path)
- expiry: caches older than 7 days are invalidated
- version skew: caches written by a different installed version are
invalidated
- first run: a missing file is not an error
Regression test for GHSA-9837-48hr-q32j: glances/outdated.py reads its
version-check cache file via pickle.load(), a deserialization format
that executes arbitrary callables embedded via __reduce__.
The test plants a poisoned pickle at the cache path and asserts that
_load_cache() does NOT trigger the embedded callable. Against the
current (vulnerable) code this fails because the payload fires before
the TypeError is raised on the unrelated dict subscript.
The fix in the next commit replaces pickle with json, which is a passive
data format.
Adds a second test server bound to a config that enables xmlrpc_allowed_hosts,
plus the failing assertion that a spoofed Host header returns 400. The fix in
glances/server.py follows in the next commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This test passes on the unpatched server and proves the CVE-2026-46611
vulnerability exists today: a spoofed Host header is accepted.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Re-creates tests/test_xmlrpc.py (deleted symlink) with a pytest module
modelled on test_restful.py: subprocess-launched server and a helper
to POST XML-RPC calls with a controllable Host header. Restores the
existing 'make test-xmlrpc' Makefile target.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Occasionally, columns got misaligned, because auto_unit returned too
many decimals when the number was slightly below 10 or 100.
Actually, when (9.995 <= n < 10) and (99.95 < n < 100).
For example,
10*2**20-1 returned 10.00M instead of 10.0M and
100*2**20-1 returned 100.0M instead of 100M.
Tests added to verify correctness.
Nicolas Hennion