summaryrefslogtreecommitdiffstats
path: root/plugins/check_radius.c
diff options
context:
space:
mode:
authorHolger Weiss <holger@zedat.fu-berlin.de>2010-04-11 14:33:44 (GMT)
committerHolger Weiss <holger@zedat.fu-berlin.de>2010-04-11 14:33:44 (GMT)
commit08f83072048f2c4c783c3216f5933f04b191847f (patch)
treecbdddc52c164cc8fc10719cfae706b672047d073 /plugins/check_radius.c
parentce3de90c9ec8589b66412a7070d3bf15abc41b01 (diff)
downloadmonitoring-plugins-08f83072048f2c4c783c3216f5933f04b191847f.tar.gz
Fix Debian bug #482947: No --nas-ip-address option
| check_radius doesn't seem to provide any way to modify the | NAS-IP-Address attribute that it uses in the packets it sends, but it | does so for NAS-Identifier. | | Instead, it hardcodes the IP address that it gets from the | rc_own_ipaddress() library call, and that in turn translates into | calling gethostbyname() on the result of uname(). This call can easily | fail, and its result can easily be unsuitable - for example when the | Nagios instance uses its own virtual host, and you don't want the | original system hostname leaked to the RADIUS servers you monitor with | this. | | Furthermore, this behaviour is inconsistent with RFC 2865, which | defines the two attributes as analogous and never suggests hardcoding | the value of either of them in client software. Therefore, this commit adds the "-N, --nas-ip-address" option which allows for specifying the value of the NAS-IP-Address attribute. | I've also noticed that the original code for NAS-IP-Address hardcoding | is broken in its error handling - it does "return (ERROR_PC)", which | is meaningless in the context of check_radius.c. That actually seems | to be copy&waste from radiusclient-0.3.2/src/radexample.c. :) I fixed | that. | | While debugging, I also took the opportunity to decouple the | nas-identifier rc_avpair_add() instance from the initial three, | because this is just bad practice to lump a fourth optional attribute | into the same block with the required attributes, the error handling | for which is throwing the same daft message "Out of Memory?"... [ http://bugs.debian.org/482947 ] (Contributed by Josip Rodin, forwarded by Jan Wagner.)
Diffstat (limited to 'plugins/check_radius.c')
-rw-r--r--plugins/check_radius.c41
1 files changed, 28 insertions, 13 deletions
diff --git a/plugins/check_radius.c b/plugins/check_radius.c
index 57b7090..3717625 100644
--- a/plugins/check_radius.c
+++ b/plugins/check_radius.c
@@ -69,6 +69,7 @@ char *server = NULL;
69char *username = NULL; 69char *username = NULL;
70char *password = NULL; 70char *password = NULL;
71char *nasid = NULL; 71char *nasid = NULL;
72char *nasipaddress = NULL;
72char *expect = NULL; 73char *expect = NULL;
73char *config_file = NULL; 74char *config_file = NULL;
74unsigned short port = PW_AUTH_UDP_PORT; 75unsigned short port = PW_AUTH_UDP_PORT;
@@ -161,19 +162,26 @@ main (int argc, char **argv)
161 memset (&data, 0, sizeof(data)); 162 memset (&data, 0, sizeof(data));
162 if (!(my_rc_avpair_add (&data.send_pairs, PW_SERVICE_TYPE, &service, 0) && 163 if (!(my_rc_avpair_add (&data.send_pairs, PW_SERVICE_TYPE, &service, 0) &&
163 my_rc_avpair_add (&data.send_pairs, PW_USER_NAME, username, 0) && 164 my_rc_avpair_add (&data.send_pairs, PW_USER_NAME, username, 0) &&
164 my_rc_avpair_add (&data.send_pairs, PW_USER_PASSWORD, password, 0) && 165 my_rc_avpair_add (&data.send_pairs, PW_USER_PASSWORD, password, 0)
165 (nasid==NULL || my_rc_avpair_add (&data.send_pairs, PW_NAS_IDENTIFIER, nasid, 0)))) 166 ))
166 die (STATE_UNKNOWN, _("Out of Memory?")); 167 die (STATE_UNKNOWN, _("Out of Memory?"));
167 168
168 /* 169 if (nasid != NULL) {
169 * Fill in NAS-IP-Address 170 if (!(my_rc_avpair_add (&data.send_pairs, PW_NAS_IDENTIFIER, nasid, 0)))
170 */ 171 die (STATE_UNKNOWN, _("Invalid NAS-Identifier"));
171 172 }
172 if ((client_id = my_rc_own_ipaddress ()) == 0)
173 return (ERROR_RC);
174 173
175 if (my_rc_avpair_add (&(data.send_pairs), PW_NAS_IP_ADDRESS, &client_id, 0) == 174 if (nasipaddress != NULL) {
176 NULL) return (ERROR_RC); 175 if (rc_good_ipaddr (nasipaddress))
176 die (STATE_UNKNOWN, _("Invalid NAS-IP-Address"));
177 if ((client_id = rc_get_ipaddr(nasipaddress)) == 0)
178 die (STATE_UNKNOWN, _("Invalid NAS-IP-Address"));
179 } else {
180 if ((client_id = my_rc_own_ipaddress ()) == 0)
181 die (STATE_UNKNOWN, _("Can't find local IP for NAS-IP-Address"));
182 }
183 if (my_rc_avpair_add (&(data.send_pairs), PW_NAS_IP_ADDRESS, &client_id, 0) == NULL)
184 die (STATE_UNKNOWN, _("Invalid NAS-IP-Address"));
177 185
178 my_rc_buildreq (&data, PW_ACCESS_REQUEST, server, port, (int)timeout_interval, 186 my_rc_buildreq (&data, PW_ACCESS_REQUEST, server, port, (int)timeout_interval,
179 retries); 187 retries);
@@ -211,6 +219,7 @@ process_arguments (int argc, char **argv)
211 {"username", required_argument, 0, 'u'}, 219 {"username", required_argument, 0, 'u'},
212 {"password", required_argument, 0, 'p'}, 220 {"password", required_argument, 0, 'p'},
213 {"nas-id", required_argument, 0, 'n'}, 221 {"nas-id", required_argument, 0, 'n'},
222 {"nas-ip-address", required_argument, 0, 'N'},
214 {"filename", required_argument, 0, 'F'}, 223 {"filename", required_argument, 0, 'F'},
215 {"expect", required_argument, 0, 'e'}, 224 {"expect", required_argument, 0, 'e'},
216 {"retries", required_argument, 0, 'r'}, 225 {"retries", required_argument, 0, 'r'},
@@ -222,7 +231,7 @@ process_arguments (int argc, char **argv)
222 }; 231 };
223 232
224 while (1) { 233 while (1) {
225 c = getopt_long (argc, argv, "+hVvH:P:F:u:p:n:t:r:e:", longopts, 234 c = getopt_long (argc, argv, "+hVvH:P:F:u:p:n:N:t:r:e:", longopts,
226 &option); 235 &option);
227 236
228 if (c == -1 || c == EOF || c == 1) 237 if (c == -1 || c == EOF || c == 1)
@@ -267,6 +276,9 @@ process_arguments (int argc, char **argv)
267 case 'n': /* nas id */ 276 case 'n': /* nas id */
268 nasid = optarg; 277 nasid = optarg;
269 break; 278 break;
279 case 'N': /* nas ip address */
280 nasipaddress = optarg;
281 break;
270 case 'F': /* configuration file */ 282 case 'F': /* configuration file */
271 config_file = optarg; 283 config_file = optarg;
272 break; 284 break;
@@ -330,6 +342,8 @@ print_help (void)
330 printf (" %s\n", _("Password for autentication (SECURITY RISK)")); 342 printf (" %s\n", _("Password for autentication (SECURITY RISK)"));
331 printf (" %s\n", "-n, --nas-id=STRING"); 343 printf (" %s\n", "-n, --nas-id=STRING");
332 printf (" %s\n", _("NAS identifier")); 344 printf (" %s\n", _("NAS identifier"));
345 printf (" %s\n", "-N, --nas-ip-address=STRING");
346 printf (" %s\n", _("NAS IP Address"));
333 printf (" %s\n", "-F, --filename=STRING"); 347 printf (" %s\n", "-F, --filename=STRING");
334 printf (" %s\n", _("Configuration file")); 348 printf (" %s\n", _("Configuration file"));
335 printf (" %s\n", "-e, --expect=STRING"); 349 printf (" %s\n", "-e, --expect=STRING");
@@ -365,8 +379,9 @@ void
365print_usage (void) 379print_usage (void)
366{ 380{
367 printf (_("Usage:")); 381 printf (_("Usage:"));
368 printf ("%s -H host -F config_file -u username -p password [-n nas-id] [-P port]\n\ 382 printf ("%s -H host -F config_file -u username -p password\n\
369 [-t timeout] [-r retries] [-e expect]\n", progname); 383 [-P port] [-t timeout] [-r retries] [-e expect]\n\
384 [-n nas-id] [-N nas-ip-addr]\n", progname);
370} 385}
371 386
372 387