monitoring-plugins/plugins-root, branch 3.0.0-rc3

OpenBSD: pledge(2) some network-facing checks (#2225)

2026-02-06T11:58:38Z

OpenBSD's pledge(2) system call allows the current process to self-restrict itself, being reduced to promised pledges. For example, unless a process says it wants to write to files, it is not allowed to do so any longer. This change starts by calling pledge(2) in some network-facing checks, removing the more dangerous privileges, such as executing other files. My initial motivation came from check_icmp, being installed as a setuid binary and (temporarily) running with root privileges. There, the pledge(2) calls result in check_icmp to only being allowed to interact with the network and to setuid(2) to the calling user later on. Afterwards, I went through my most commonly used monitoring plugins directly interacting with the network. Thus, I continued with pledge(2)-ing check_curl - having a huge codebase and all -, check_ntp_time, check_smtp, check_ssh, and check_tcp. For most of those, the changes were quite similar: start with network-friendly promises, parse the configuration, give up file access, and proceed with the actual check.

check_icmp: Populate progname before np_extra_opts call (#2226)

2026-01-19T00:00:00Z

Within np_extra_opts, the ini parser expects a valid progname as the default section to select a configuration section in the ini file. However, within the check_icmp codebase, the progname is being populated directly after the np_extra_opts call, being a null pointer before. $ ./check_icmp --extra-opts=@foo.ini Segmentation fault (core dumped) > #0 strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:125 > #1 0x000003989615d032 in _libc_strdup (str=Variable "str" is not available.) at /usr/src/lib/libc/string/strdup.c:44 > #2 0x000003966f751b74 in np_get_defaults (locator=0x73ede1e538ea "@foo.ini", default_section=0x0) at parse_ini.c:91 > #3 0x000003966f7518ce in np_extra_opts (argc=0x73ede1e5369c, argv=0x73ede1e53728, plugin_name=0x0) at extra_opts.c:98 > #4 0x000003966f74165a in main (argc=1, argv=0x0) at check_icmp.c:832 The progname variable is set within the process_arguments function, requiring the already enriched arguments from np_extra_opts. Thus, I moved the progname detection out of this function, directly before the np_extra_opts call. This pattern does already exists in check_tcp. I briefly looked for similar issues in other plugins, but found none.

check_icmp: prevent segfault on OpenBSD (#2224)

2026-01-16T01:42:01Z

* check_icmp: prevent segfault on OpenBSD This commit adds a sanity check for sockets in check_icmp. Previously FD_ISSET segfaulted when a socket value was -1 (on OpenBSD). The changes here add an explicit check whether the socket is -1 (and therefore not set). --------- Co-authored-by: Lorenz Kästle

check_icmp: fix some compiler warnings (and maybe bugs)

2026-01-09T12:41:28Z

plugins-root/check_icmp: Fix build for SIOCGIFADDR

2025-12-11T20:05:49Z

The refactoring in eafee9c3f91879afa82749fa1d8cd2b0b53a5d5c missed the part within "#if defined(SIOCGIFADDR)" in get_ip_address.

plugins-root/check_icmp: Import sys/ioctl.h

2025-12-11T20:05:49Z

The ioctl(2) call within "#if defined(SIOCGIFADDR)" requires the include.

More refactoring

2025-09-15T13:49:26Z

Run clang-format again

2025-09-15T10:59:37Z

Reapply "check_dhcp: reduce number of tests for weird reasons"

2025-06-23T11:21:25Z

This reverts commit 612d261cbf467c82f0dcc0ed63e7584d91f194c4.

Revert "check_dhcp: reduce number of tests for weird reasons"

2025-06-23T11:02:52Z

This reverts commit 52338c3423d4b10d2bbeec7a120c7dd2a98fa092.