The -b/--size handler checks the lower bound after casting the value to
unsigned long while checking the upper bound as a signed comparison. A
negative argument such as "-b -65536" therefore satisfies both checks.
The value is then truncated to an undersized icmp_data_size, which later
serves as the size of the ICMP send buffer, so building the packet
overflows that buffer.
Compare the size as a signed long against both bounds so negative values
are rejected.
Reported-by: Christopher Kreft <Email@ChristopherKreft.de>
The threshold parser starts a pointer at the last character of the
string and walks it backwards until it reaches the second character.
This assumes the string is at least two characters long. For a
single-character threshold such as "-w 1" or "-c 1", the pointer
underflows past the start of the string and keeps dereferencing memory
out of bounds.
Beyond the out-of-bounds reads, an out-of-bounds write can occur if a
stray '%' or ',' byte happens to turn up while scanning backwards. In
that case, the parser writes a NUL byte at that out-of-bounds address
(the ',' case additionally re-reads forward from there via strtoul(3)).
Only run the descending scan when the string has at least two
characters, leaving the behaviour for all valid thresholds unchanged.
Reported-by: Christopher Kreft <Email@ChristopherKreft.de>
The number of -H hosts is counted into an unsigned short, so supplying
more than 65535 hosts wraps the counter. The subsequent calloc(3) then
allocates an undersized hosts array while the later parsing loop still
writes one entry per host, overflowing the heap buffer. As
process_arguments() runs before we drop privileges via setuid(getuid()),
this happens while still running as root on setuid-root installs.
Guard both places where the counter is incremented and bail out with a
usage error once 65535 hosts are reached, rather than wrapping silently.
Reported-by: Christopher Kreft <Email@ChristopherKreft.de>
this will fix the build error on check_snmp when net-snmp-config is not available.
```
CC check_snmp-check_snmp.o
/bin/bash: line 1: net-snmp-config: command not found
In file included from check_snmp.d/check_snmp_helpers.h:3,
from check_snmp.c:42:
check_snmp.d/./config.h:16:10: fatal error: net-snmp/net-snmp-config.h: No such file or directory
16 | #include <net-snmp/net-snmp-config.h>
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
make[3]: *** [Makefile:3353: check_snmp-check_snmp.o] Error 1
make[3]: Leaving directory '/opt/projects/git/monitoring-plugins/plugins'
```
Signed-off-by: Sven Nierlein <sven@consol.de>
* check_curl fix: populate the dns cache when hostname gets resolved locally
due to a previous refactor, it would populate it when hostname wasnt getting resolved locally
hostname_gets_resolved locally now assumes that resolving is local if proxy was unknown. previously was returning 0 instead of true, contradicting what it says
fix a memory leak. server_address_clean was being assigned to another strndup result before being freed
fix another memory leak, one path to return in hostname_gets_resolved_locally was not freeing up two variables
improve logs and comments around hostname_gets_resolved_locally
clang-format is applied
* check_curl: fix typo in comment
---------
Co-authored-by: Ahmet Oeztuerk <Ahmet.Oeztuerk@consol.de>
* check_ntp_time: add polling delay
NTP server can have rate limiting which might be triggered by
check_ntp_time due to many requests in a short time span.
This patch adds a default delay (of 0.5s) between requests to each server
and a command line option (--poll-delay) to make this delay
configurable.
Co-authored-by: Lorenz Kästle <lorenz@vulgrim.de>
* check_ntp_time: verify whether socket path fits into address struct
check_ntp_time could be give a too long (>108 bytes) socket path
to work with, which would potentially crash the program.
This patch validates to length beforehand and stops execution
in that case.
Co-authored-by: Lorenz Kästle <lorenz@vulgrim.de>
---------
Co-authored-by: Paul Crawford <paul@crawford-space.co.uk>
Co-authored-by: Lorenz Kästle <lorenz@vulgrim.de>
* lib: implement functionality to set ok summary
* check_load: implement setting ok summary
* OK summary for ntp_peer, ntp_time and users
* check_apt: implement ok summary
* check_curl: implement ok summary
* check_disk: implement ok summary
* check_dbi: implement ok summary
* check_ldap: auto formatting
* check_ldap: implement ok summary
* check_ssh: implement ok summary
* check_tcp: implement ok summary
* fixup! check_curl: implement ok summary
* fixup! check_dbi: implement ok summary
* fixup! check_ldap: implement ok summary
* fixup! check_ssh: implement ok summary
* fixup! check_tcp: implement ok summary
* check_apt: remove illegal free
* check_mrtg: fix link
* check_mrtg: implement ok summary
* check_mrtgtraf: fix link
* check_mrtgtraf: implement ok summary
* check_mysql: implement ok summary
* check_mysql_query: implement ok summary
* check_pgsql: implement ok summary
* check_radius: implement ok summary
* check_real: implement ok summary
* check_smtp: implement ok summary
* check_snmp: implement ok summary
* check_swap: implement ok summary
* check_ups: add OK summary
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
* lib: properly name function to set summary
* lib: set first non-ok subcheck as the summary for the overall check
* Fetch summarily recursively from failed subchecks
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
* Remove redundant new line in multi-line outputs
* check_load: Fix missing brace in output
* check_load: rename function to properly indicate purpose
* check_load: show the correct amount of procs
* check_load: allow execution without parameters
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
* Remove redundant new line in multi-line outputs
* check_load: Fix missing brace in output
* check_load: rename function to properly indicate purpose
* check_load: show the correct amount of procs
* check_load: allow execution without parameters
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
net-snmp uses the same pre processor name "USE_OPENSSL" as we do.
To avoid the conflict, this commit renames it on our side to
"MOPL_USE_OPENSSL".
"MOPL" (better "MoPl"?) stands for Monitoring Plugins.
* check_curl: remove unused variables
* check_curl: run formatter on related files
* check_curl_helpers: make code a bit more understandable
* check_curl helpers: general api cleanup and code style
The new output functionality was discussed in the context of
check_by_ssh, where it mostly adds more stuff which was seen as
not inherently usefull as a succesful check_by_ssh check
might as well be transparent.
* Implement simple output shortcut for ranges
If ranges start with zero (e.g. 0:10), the zero and the colon
can be left out.
This patch implements this by default, since some systems (icinga2)
do not fully implement the whole range format and this reduces errors
in the common case of just an upper border.
* switch check_disk perfdata back to used space
