Files
cacti/scripts/ss_net_snmp_disk_bytes.php
TheWitnessandTheWitness 3ab4c69fb7 PHPStan Level 8 - Phase 1 Conversion (#8135)
* PHPStan Level 8 - Phase 1 Conversion

Reduces the real (no-baseline) PHPStan level 8 error count from ~2,724 to 425
and regenerates phpstan-baseline.neon accordingly (8,941 -> 1,921 lines).

Core type-safety changes
- lib/database.php: narrow db_fetch_row()/db_fetch_row_prepared() to return
  array (was bool|array) and db_fetch_assoc()/db_fetch_assoc_prepared() to
  return array (was mixed); the _prepared workers coerce the connection-failure
  path to an empty array so the declared type is honest. empty()/cacti_sizeof()
  checks are unaffected.
- lib/database.php: narrow $db_conn guards from is_object() to instanceof PDO in
  the transaction/quote/insert-id helpers so the PDO calls resolve.
- lib/mib_cache.php: the fluent MibCache methods mib()/object()/table()/row()
  now return self instead of a bare object so chained calls type-check.

Type-safety casts and guards (mechanical, behaviour-preserving)
- Cast string|false/|null builtin results feeding string parameters
  (json_decode, base64_encode, trim, htmle, preg_replace, explode, etc.).
- Cast int|string / int|false values feeding int id/pid parameters.
- Guard resource|false fopen()/popen() handles before fwrite/fclose/fread, and
  wrap foreach over array|false/list|false results with `?: []`.

Genuine bugs found and fixed
- cli/add_tree.php / lib/api_tree.php: site tree nodes could not be created via
  the CLI - the --site-id option was never parsed, $nodeTypes had no 'site'
  entry (passing null to api_tree_item_save(int $type) -> TypeError), and
  api_tree_item_save() never persisted site_id. All three fixed.
- tree.php: leaves_exist() is typed : int but returned db_fetch_assoc_prepared()
  (an array of rows) for a SELECT COUNT(*); now uses db_fetch_cell_prepared()
  and returns the scalar count.
- lib/mib_cache.php: $entries_per_object was a float (division / ceil) used as
  an array key (PHP 8.1 implicit float-to-int key deprecation); now cast to int.

Config
- .phpstan.neon: add notIdentical.alwaysTrue and booleanAnd.alwaysFalse to the
  existing always-true/false ignore family (same "PHPStan gets confused"
  dynamic-constant cause already covered by identical.alwaysTrue,
  notEqual.alwaysTrue, booleanAnd.leftAlwaysTrue, etc.).
- phpstan-baseline.neon: regenerated; the remaining 425 entries are the
  untouched long tail for Phase 2.

* Remove redundant @phpstan-ignore comments

Follow-up cleanup for the level 8 Phase 1 work. Removes 14 inline
@phpstan-ignore comments that no longer suppress any reported error:

- cli/repair_database.php: `@phpstan-ignore booleanAnd.alwaysFalse` is now
  covered by the global booleanAnd.alwaysFalse ignore added to .phpstan.neon.
- 13 others (host.php, include/global.php, include/session.php,
  lib/api_automation.php x2, lib/functions.php x2, lib/html_utility.php x2,
  lib/installer.php, lib/package.php, lib/reports.php, lib/rrd.php) no longer
  match any reported error after the type-safety fixes (e.g. the
  db_fetch_row_prepared() return-type narrowing removed the offset-assign
  errors the api_automation ignores were suppressing).

Verified with reportUnmatchedIgnoredErrors enabled: 0 unmatched ignores
remain and the full level 8 run still reports 0 errors.

* ci: satisfy validator ratchet and refresh security sink baselines

- lib/api_tree.php: give the new tree-item site_id a real numeric
  constraint ('^[-0-9]+$', matching html_reports.php) instead of an
  empty regex, so the validator constraint ratchet passes without
  bumping its baseline.
- tests/security/baselines: refresh the three sink/hotspot signatures
  whose code text changed from the (string) casts added in this branch
  (lib/poller.php setsid, cli/rrdresize.php json_encode, lib/import.php
  simplexml_load_string).

* ci(js): allow DOMPurify 3.4.16 and update sync_js pin test

The dependabot bump (#8134) moved package.json/package-lock.json to
DOMPurify 3.4.16 on develop but left tests/js/sync_js.test.mjs pinned to
3.4.15, so the PR merge commit fails the 'DOMPurify is pinned' contract.
Bring package.json/package-lock.json to 3.4.16 (matching develop) and
update the pin test to expect 3.4.16.

* test: update sql.php null-handling assertion for the (string) cast

This branch changed scripts/sql.php from trim(\ ?? '') to
trim((string) \) (the phpstan-safe form that coerces both null and
false from shell_exec()). Update SqlScriptsTest's null-return assertion
to match the new cast instead of the removed '?? ''.

* fix: address Copilot review - ownership IDs, fopen guards, mib_cache bound

- chown()/chgrp(): pass integer UID/GID from fileowner()/filegroup()
  (guarding the false lookup) instead of string-casting them, which made
  them resolve account/group names like '1001' and fail. Covers
  lib/api_device.php, lib/boost.php and poller_maintenance.php (x2).
- fopen() failure now short-circuits instead of reporting success:
  lib/package.php returns false, lib/clog_webapi.php and utilities.php
  render an error, and snmpagent_mibcachechild.php skips the cache write
  and sentinel unlink so a concurrent writer's lock is preserved.
- lib/mib_cache.php: keep the float quotient as the loop bound and cast
  only the array offset, so a non-even entries/columns split no longer
  truncates the loop and drops a cached row.

* revert: keep db_fetch_* returning false on error; baseline Level 8 instead

Per review, restoring the intentional fail-safe: db_fetch_row[_prepared]()
return bool|array and db_fetch_assoc[_prepared]() return mixed again, so a
genuine SQL error (not just a missing connection) is signalled as false and
the === false checks in cdef_is_in_use(), boost_process_* and aggregate.php
work as before. Dropped the is_array() ? : [] coercion.

Level 8 stays green by regenerating phpstan-baseline.neon to capture the
re-introduced bool|array/mixed call-site errors (the ~1,850 the narrowing
had eliminated). Tightening those callers to drop them from the baseline is
Phase 2 work.

---------

Co-authored-by: TheWitness <copilot@users.noreply.github.com>
2026-10-02 10:08:56 -04:00

304 lines
8.8 KiB
PHP

#!/usr/bin/env php
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/
global $config;
if (!isset($called_by_script_server)) {
include_once(__DIR__ . '/../include/cli_check.php');
include_once(__DIR__ . '/../lib/snmp.php');
array_shift($_SERVER['argv']);
print call_user_func_array('ss_net_snmp_disk_bytes', $_SERVER['argv']);
} else {
include_once(__DIR__ . '/../lib/snmp.php');
}
if (!function_exists('ss_counter_step')) {
/**
* Apply a Counter32/Counter64 wrap-corrected delta to a running total.
*
* The Counter64 modulus (2^64) exceeds PHP_INT_MAX on every supported
* runtime, so a plain `$current + $modulus - $previous` is silently
* promoted to float and loses ~3 decimal digits per wrap. ext-gmp is a
* Cacti dependency, so prefer arbitrary-precision arithmetic and fall
* back to float (with documented precision loss) only when gmp is
* unavailable.
*
* Returns a numeric string ('U' is sticky once set).
* @param mixed $running
*/
function ss_counter_step($running, string $current, string $previous, string $modulus) : string {
if (!function_exists('gmp_init')) {
$cur = (float) $current;
$prev = (float) $previous;
$delta = ($cur >= $prev) ? ($cur - $prev) : ($cur + (float) $modulus - $prev);
if ($running === 'U' || !is_numeric($running)) {
return (string) $delta;
}
return (string) ((float) $running + $delta);
}
$cur = gmp_init($current);
$prev = gmp_init($previous);
if (gmp_cmp($cur, $prev) >= 0) {
$delta = gmp_sub($cur, $prev);
} else {
$delta = gmp_sub(gmp_add($cur, gmp_init($modulus)), $prev);
}
if ($running === 'U' || !is_numeric((string) $running)) {
return gmp_strval($delta);
}
return gmp_strval(gmp_add(gmp_init((string) $running), $delta));
}
}
function ss_net_snmp_disk_bytes(mixed $host_id_or_hostname = '') : string {
global $environ, $poller_id, $config;
if (empty($host_id_or_hostname) || $host_id_or_hostname === null) {
return 'reads:0 writes:0';
}
if (!is_numeric($host_id_or_hostname)) {
$host_id = db_fetch_cell_prepared('SELECT id
FROM host
WHERE hostname = ?',
[$host_id_or_hostname]);
} else {
$host_id = $host_id_or_hostname;
}
$tmpdir = sys_get_temp_dir();
if (!db_table_exists('host_value_cache')) {
if ($environ != 'realtime') {
$tmpdir .= '/cacti/net-snmp-devio';
$tmpfile = $host_id . '_bytes';
} else {
$tmpdir .= '/cacti-rt/net-snmp-devio';
$tmpfile = $host_id . '_' . $poller_id . '_bytes_rt';
}
if (!is_dir($tmpdir)) {
mkdir($tmpdir, 0755, true);
}
} else {
if ($environ != 'realtime') {
$dimension = $host_id . '_bytes';
$ttl = -1;
} else {
$dimension = $host_id . '_' . $poller_id . '_bytes_rt';
$ttl = 300;
}
}
$found = false;
$previous = [];
if (!db_table_exists('host_value_cache')) {
if (is_file("$tmpdir/$tmpfile")) {
$previous = json_decode((string) file_get_contents("$tmpdir/$tmpfile"), true);
$found = true;
}
} else {
$previous = json_decode(
db_fetch_cell_prepared('SELECT value
FROM host_value_cache
WHERE host_id = ?
AND dimension = ?
LIMIT 1',
[$host_id, $dimension]), true
);
// remove the old entry or entries
db_execute_prepared('DELETE FROM host_value_cache
WHERE host_id = ?
AND dimension = ?
AND time_to_live = ?',
[$host_id, $dimension, $ttl]);
if (!empty($previous)) {
$found = true;
} else {
$found = false;
}
}
$indexes = [];
$host = db_fetch_row_prepared('SELECT *
FROM host
WHERE id = ?',
[$host_id]);
if (!cacti_sizeof($host)) {
return 'reads:0 writes:0';
}
$uptime = cacti_snmp_get($host['hostname'],
$host['snmp_community'],
'.1.3.6.1.2.1.1.3.0',
$host['snmp_version'],
$host['snmp_username'],
$host['snmp_password'],
$host['snmp_auth_protocol'],
$host['snmp_priv_passphrase'],
$host['snmp_priv_protocol'],
$host['snmp_context'],
$host['snmp_port'],
$host['snmp_timeout'],
$host['snmp_retries'],
SNMP_POLLER,
$host['snmp_engine_id']);
$current['uptime'] = $uptime;
$names = cacti_snmp_walk($host['hostname'],
$host['snmp_community'],
'.1.3.6.1.4.1.2021.13.15.1.1.2',
$host['snmp_version'],
$host['snmp_username'],
$host['snmp_password'],
$host['snmp_auth_protocol'],
$host['snmp_priv_passphrase'],
$host['snmp_priv_protocol'],
$host['snmp_context'],
$host['snmp_port'],
$host['snmp_timeout'],
$host['snmp_retries'],
SNMP_POLLER,
$host['snmp_engine_id']);
foreach ($names as $measure) {
if (preg_match('/^(?:sd|nvme|xvd|vd|vm|hd|md|dm-)/', $measure['value'])) {
if (preg_match('/(?:p\d+|\d+)$/', $measure['value']) && !preg_match('/^nvme\d+n\d+$/', $measure['value'])) {
continue;
}
$parts = explode('.', $measure['oid']);
$indexes[$parts[cacti_sizeof($parts) - 1]] = $parts[cacti_sizeof($parts) - 1];
}
}
$bytesread = $byteswritten = 0;
if (cacti_sizeof($indexes)) {
$bytes = cacti_snmp_walk($host['hostname'],
$host['snmp_community'],
'.1.3.6.1.4.1.2021.13.15.1.1.12',
$host['snmp_version'],
$host['snmp_username'],
$host['snmp_password'],
$host['snmp_auth_protocol'],
$host['snmp_priv_passphrase'],
$host['snmp_priv_protocol'],
$host['snmp_context'],
$host['snmp_port'],
$host['snmp_timeout'],
$host['max_oids'],
SNMP_POLLER,
$host['snmp_engine_id']);
foreach ($bytes as $measure) {
$parts = explode('.', $measure['oid']);
$index = $parts[cacti_sizeof($parts) - 1];
if (array_key_exists($index, $indexes)) {
if (!isset($previous['uptime'])) {
$bytesread = 'U';
} elseif ($current['uptime'] < $previous['uptime']) {
$bytesread = 'U';
} elseif (!isset($previous["br$index"])) {
$bytesread = 'U';
} else {
$bytesread = ss_counter_step($bytesread, (string) $measure['value'], (string) $previous["br$index"], '18446744073709551616');
}
$current["br$index"] = $measure['value'];
}
}
$bytes = cacti_snmp_walk($host['hostname'],
$host['snmp_community'],
'.1.3.6.1.4.1.2021.13.15.1.1.13',
$host['snmp_version'],
$host['snmp_username'],
$host['snmp_password'],
$host['snmp_auth_protocol'],
$host['snmp_priv_passphrase'],
$host['snmp_priv_protocol'],
$host['snmp_context'],
$host['snmp_port'],
$host['snmp_timeout'],
$host['snmp_retries'],
$host['max_oids'],
SNMP_POLLER,
$host['snmp_engine_id']);
foreach ($bytes as $measure) {
$parts = explode('.', $measure['oid']);
$index = $parts[cacti_sizeof($parts) - 1];
if (array_key_exists($index, $indexes)) {
if (!isset($previous['uptime'])) {
$byteswritten = 'U';
} elseif ($current['uptime'] < $previous['uptime']) {
$byteswritten = 'U';
} elseif (!isset($previous["bw$index"])) {
$byteswritten = 'U';
} else {
$byteswritten = ss_counter_step($byteswritten, (string) $measure['value'], (string) $previous["bw$index"], '18446744073709551616');
}
$current["bw$index"] = $measure['value'];
}
}
if (!db_table_exists('host_value_cache')) {
$data = json_encode($current);
file_put_contents("$tmpdir/$tmpfile", $data);
} else {
$data = json_encode($current);
db_execute_prepared('REPLACE INTO host_value_cache (host_id, dimension, value, time_to_live)
VALUES (?, ?, ?, ?)',
[$host_id, $dimension, $data, $ttl]);
}
}
if ($found) {
return "bytesread:$bytesread byteswritten:$byteswritten";
} else {
return 'bytesread:0 byteswritten:0';
}
}