upstream/monitoring-plugins
1
0
Fork 0
mirror of https://github.com/monitoring-plugins/monitoring-plugins.git synced 2026-06-08 16:26:23 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Fix Debian bug #482947: No --nas-ip-address option

Browse source 
| check_radius doesn't seem to provide any way to modify the
| NAS-IP-Address attribute that it uses in the packets it sends, but it
| does so for NAS-Identifier.
|
| Instead, it hardcodes the IP address that it gets from the
| rc_own_ipaddress() library call, and that in turn translates into
| calling gethostbyname() on the result of uname(). This call can easily
| fail, and its result can easily be unsuitable - for example when the
| Nagios instance uses its own virtual host, and you don't want the
| original system hostname leaked to the RADIUS servers you monitor with
| this.
|
| Furthermore, this behaviour is inconsistent with RFC 2865, which
| defines the two attributes as analogous and never suggests hardcoding
| the value of either of them in client software.

Therefore, this commit adds the "-N, --nas-ip-address" option which
allows for specifying the value of the NAS-IP-Address attribute.

| I've also noticed that the original code for NAS-IP-Address hardcoding
| is broken in its error handling - it does "return (ERROR_PC)", which
| is meaningless in the context of check_radius.c. That actually seems
| to be copy&waste from radiusclient-0.3.2/src/radexample.c. :) I fixed
| that.
|
| While debugging, I also took the opportunity to decouple the
| nas-identifier rc_avpair_add() instance from the initial three,
| because this is just bad practice to lump a fourth optional attribute
| into the same block with the required attributes, the error handling
| for which is throwing the same daft message "Out of Memory?"...

[ http://bugs.debian.org/482947 ]

(Contributed by Josip Rodin, forwarded by Jan Wagner.)
This commit is contained in:
Holger Weiss 2010-04-11 16:33:44 +02:00
parent ce3de90c9e
commit 08f8307204
2 changed files with 29 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -4,6 +4,7 @@ This file documents the major additions and syntax changes between releases.
ENHANCEMENTS
New check_ntp_peer -m and -n options to check the number of usable time sources ("truechimers")
New check_disk_smb -a option which allows for specifying the IP address of the remote server
New check_radius -N option which allows for specifying the value of the NAS-IP-Address attribute
FIXES
Fix check_ircd binding to wrong interface (#668778)
Add proxy-authorization option to check_http (Marcel Kuiper - #1323230, Bryan Irvine - #2863925)

41
plugins/check_radius.c
View file

@ -69,6 +69,7 @@ char *server = NULL;
char *username = NULL;
char *password = NULL;
char *nasid = NULL;
char *nasipaddress = NULL;
char *expect = NULL;
char *config_file = NULL;
unsigned short port = PW_AUTH_UDP_PORT;
@ -161,19 +162,26 @@ main (int argc, char **argv)
memset (&data, 0, sizeof(data));
if (!(my_rc_avpair_add (&data.send_pairs, PW_SERVICE_TYPE, &service, 0) &&
my_rc_avpair_add (&data.send_pairs, PW_USER_NAME, username, 0) &&
my_rc_avpair_add (&data.send_pairs, PW_USER_PASSWORD, password, 0) &&
(nasid==NULL || my_rc_avpair_add (&data.send_pairs, PW_NAS_IDENTIFIER, nasid, 0))))
my_rc_avpair_add (&data.send_pairs, PW_USER_PASSWORD, password, 0)
))
die (STATE_UNKNOWN, _("Out of Memory?"));
/*
* Fill in NAS-IP-Address
*/
if (nasid != NULL) {
if (!(my_rc_avpair_add (&data.send_pairs, PW_NAS_IDENTIFIER, nasid, 0)))
die (STATE_UNKNOWN, _("Invalid NAS-Identifier"));
}
if ((client_id = my_rc_own_ipaddress ()) == 0)
return (ERROR_RC);
if (my_rc_avpair_add (&(data.send_pairs), PW_NAS_IP_ADDRESS, &client_id, 0) ==
NULL) return (ERROR_RC);
if (nasipaddress != NULL) {
if (rc_good_ipaddr (nasipaddress))
die (STATE_UNKNOWN, _("Invalid NAS-IP-Address"));
if ((client_id = rc_get_ipaddr(nasipaddress)) == 0)
die (STATE_UNKNOWN, _("Invalid NAS-IP-Address"));
} else {
if ((client_id = my_rc_own_ipaddress ()) == 0)
die (STATE_UNKNOWN, _("Can't find local IP for NAS-IP-Address"));
}
if (my_rc_avpair_add (&(data.send_pairs), PW_NAS_IP_ADDRESS, &client_id, 0) == NULL)
die (STATE_UNKNOWN, _("Invalid NAS-IP-Address"));
my_rc_buildreq (&data, PW_ACCESS_REQUEST, server, port, (int)timeout_interval,
retries);
@ -211,6 +219,7 @@ process_arguments (int argc, char **argv)
{"username", required_argument, 0, 'u'},
{"password", required_argument, 0, 'p'},
{"nas-id", required_argument, 0, 'n'},
{"nas-ip-address", required_argument, 0, 'N'},
{"filename", required_argument, 0, 'F'},
{"expect", required_argument, 0, 'e'},
{"retries", required_argument, 0, 'r'},
@ -222,7 +231,7 @@ process_arguments (int argc, char **argv)
};
while (1) {
c = getopt_long (argc, argv, "+hVvH:P:F:u:p:n:t:r:e:", longopts,
c = getopt_long (argc, argv, "+hVvH:P:F:u:p:n:N:t:r:e:", longopts,
&option);
if (c == -1 || c == EOF || c == 1)
@ -267,6 +276,9 @@ process_arguments (int argc, char **argv)
case 'n': /* nas id */
nasid = optarg;
break;
case 'N': /* nas ip address */
nasipaddress = optarg;
break;
case 'F': /* configuration file */
config_file = optarg;
break;
@ -330,6 +342,8 @@ print_help (void)
printf (" %s\n", _("Password for autentication (SECURITY RISK)"));
printf (" %s\n", "-n, --nas-id=STRING");
printf (" %s\n", _("NAS identifier"));
printf (" %s\n", "-N, --nas-ip-address=STRING");
printf (" %s\n", _("NAS IP Address"));
printf (" %s\n", "-F, --filename=STRING");
printf (" %s\n", _("Configuration file"));
printf (" %s\n", "-e, --expect=STRING");
@ -365,8 +379,9 @@ void
print_usage (void)
{
printf (_("Usage:"));
printf ("%s -H host -F config_file -u username -p password [-n nas-id] [-P port]\n\
[-t timeout] [-r retries] [-e expect]\n", progname);
printf ("%s -H host -F config_file -u username -p password\n\
[-P port] [-t timeout] [-r retries] [-e expect]\n\
[-n nas-id] [-N nas-ip-addr]\n", progname);
}