1 files changed, 68 insertions, 35 deletions

diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index d46d2ccc..1390a03e 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -54,6 +54,9 @@ const char *email = "devel@monitoring-plugins.org";
 #endif
 
 #include <sys/time.h>
+#if defined(SIOCGIFADDR)
+#       include <sys/ioctl.h>
+#endif /* SIOCGIFADDR */
 #include <errno.h>
 #include <signal.h>
 #include <ctype.h>
@@ -146,7 +149,7 @@ static get_timevar_wrapper get_timevar(const char *str);
 static time_t get_timevaldiff(struct timeval earlier, struct timeval later);
 static time_t get_timevaldiff_to_now(struct timeval earlier);
 
-static in_addr_t get_ip_address(const char *ifname);
+static in_addr_t get_ip_address(const char *ifname, const int icmp_sock);
 static void set_source_ip(char *arg, int icmp_sock, sa_family_t addr_family);
 
 /* Receiving data */
@@ -274,15 +277,6 @@ typedef struct {
         check_icmp_config config;
 } check_icmp_config_wrapper;
 check_icmp_config_wrapper process_arguments(int argc, char **argv) {
-        /* get calling name the old-fashioned way for portability instead
-         * of relying on the glibc-ism __progname */
-        char *ptr = strrchr(argv[0], '/');
-        if (ptr) {
-                progname = &ptr[1];
-        } else {
-                progname = argv[0];
-        }
-
         check_icmp_config_wrapper result = {
                 .errorcode = OK,
                 .config = check_icmp_config_init(),
@@ -818,6 +812,15 @@ void parse_address(const struct sockaddr_storage *addr, char *dst, socklen_t siz
 }
 
 int main(int argc, char **argv) {
+#ifdef __OpenBSD__
+        /* - rpath is required to read --extra-opts (given up later)
+         * - inet is required for sockets
+         * - dns is required for name lookups (given up later)
+         * - id is required for temporary privilege drops in configparsing and for
+         *   permanent privilege dropping after opening the socket (given up later) */
+        pledge("stdio rpath inet dns id", NULL);
+#endif // __OpenBSD__
+
         setlocale(LC_ALL, "");
         bindtextdomain(PACKAGE, LOCALEDIR);
         textdomain(PACKAGE);
@@ -825,6 +828,14 @@ int main(int argc, char **argv) {
         /* POSIXLY_CORRECT might break things, so unset it (the portable way) */
         environ = NULL;
 
+        /* determine program- and service-name quickly */
+        progname = strrchr(argv[0], '/');
+        if (progname != NULL) {
+                progname++;
+        } else {
+                progname = argv[0];
+        }
+
         /* Parse extra opts if any */
         argv = np_extra_opts(&argc, argv, progname);
 
@@ -834,6 +845,10 @@ int main(int argc, char **argv) {
                 crash("failed to parse config");
         }
 
+#ifdef __OpenBSD__
+        pledge("stdio inet dns id", NULL);
+#endif // __OpenBSD__
+
         const check_icmp_config config = tmp_config.config;
 
         if (config.output_format_is_set) {
@@ -896,6 +911,10 @@ int main(int argc, char **argv) {
                 return 1;
         }
 
+#ifdef __OpenBSD__
+        pledge("stdio inet", NULL);
+#endif // __OpenBSD__
+
         if (sockset.socket4) {
                 int result = setsockopt(sockset.socket4, SOL_IP, IP_TTL, &config.ttl, sizeof(config.ttl));
                 if (debug) {
@@ -1467,10 +1486,13 @@ static recvfrom_wto_wrapper recvfrom_wto(const check_icmp_socket_set sockset, vo
         };
 
         ssize_t ret;
-        if (FD_ISSET(sockset.socket4, &read_fds)) {
+
+        // Test explicitly whether sockets are in use
+        // this is necessary at least on OpenBSD where FD_ISSET will segfault otherwise
+        if ((sockset.socket4 != -1) && FD_ISSET(sockset.socket4, &read_fds)) {
                 ret = recvmsg(sockset.socket4, &hdr, 0);
                 result.recv_proto = AF_INET;
-        } else if (FD_ISSET(sockset.socket6, &read_fds)) {
+        } else if ((sockset.socket6 != -1) && FD_ISSET(sockset.socket6, &read_fds)) {
                 ret = recvmsg(sockset.socket6, &hdr, 0);
                 result.recv_proto = AF_INET6;
         } else {
@@ -1769,7 +1791,7 @@ static void set_source_ip(char *arg, const int icmp_sock, sa_family_t addr_famil
         memset(&src, 0, sizeof(src));
         src.sin_family = addr_family;
         if ((src.sin_addr.s_addr = inet_addr(arg)) == INADDR_NONE) {
-                src.sin_addr.s_addr = get_ip_address(arg);
+                src.sin_addr.s_addr = get_ip_address(arg, icmp_sock);
         }
         if (bind(icmp_sock, (struct sockaddr *)&src, sizeof(src)) == -1) {
                 crash("Cannot bind to IP address %s", arg);
@@ -1777,8 +1799,9 @@ static void set_source_ip(char *arg, const int icmp_sock, sa_family_t addr_famil
 }
 
 /* TODO: Move this to netutils.c and also change check_dhcp to use that. */
-static in_addr_t get_ip_address(const char *ifname) {
+static in_addr_t get_ip_address(const char *ifname, const int icmp_sock) {
         // TODO: Rewrite this so the function return an error and we exit somewhere else
+
         struct sockaddr_in ip_address;
         ip_address.sin_addr.s_addr = 0; // Fake initialization to make compiler happy
 #if defined(SIOCGIFADDR)
@@ -1792,8 +1815,11 @@ static in_addr_t get_ip_address(const char *ifname) {
                 crash("Cannot determine IP address of interface %s", ifname);
         }
 
-        memcpy(&ip, &ifr.ifr_addr, sizeof(ip));
+        memcpy(&ip_address, &ifr.ifr_addr, sizeof(ip_address));
 #else
+        // fake operation to make the compiler happy
+        (void)icmp_sock;
+
         (void)ifname;
         errno = 0;
         crash("Cannot get interface IP address on this platform.");
@@ -2043,7 +2069,7 @@ unsigned short icmp_checksum(uint16_t *packet, size_t packet_size) {
 
         /* mop up the occasional odd byte */
         if (packet_size == 1) {
-                sum += *((uint8_t *)packet - 1);
+                sum += *((uint8_t *)packet);
         }
 
         sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
@@ -2242,7 +2268,7 @@ mp_subcheck evaluate_target(ping_target target, check_icmp_mode_switches modes,
                  * round trip jitter, but double the impact to latency
                  * then add 10 for protocol latencies (in milliseconds).
                  */
-                EffectiveLatency = ((double)rta / 1000) + target.jitter * 2 + 10;
+                EffectiveLatency = ((double)rta / 1000) + (target.jitter * 2) + 10;
 
                 double R;
                 if (EffectiveLatency < 160) {
@@ -2401,25 +2427,32 @@ mp_subcheck evaluate_target(ping_target target, check_icmp_mode_switches modes,
         if (modes.score_mode) {
                 mp_subcheck sc_score = mp_subcheck_init();
                 sc_score = mp_set_subcheck_default_state(sc_score, STATE_OK);
-                xasprintf(&sc_score.output, "Score %f", score);
-
-                if (score <= crit.score) {
-                        sc_score = mp_set_subcheck_state(sc_score, STATE_CRITICAL);
-                        xasprintf(&sc_score.output, "%s <= %f", sc_score.output, crit.score);
-                } else if (score <= warn.score) {
-                        sc_score = mp_set_subcheck_state(sc_score, STATE_WARNING);
-                        xasprintf(&sc_score.output, "%s <= %f", sc_score.output, warn.score);
-                }
 
-                if (packet_loss < 100) {
-                        mp_perfdata pd_score = perfdata_init();
-                        xasprintf(&pd_score.label, "%sscore", address);
-                        pd_score.value = mp_create_pd_value(score);
-                        pd_score.warn = mp_range_set_end(pd_score.warn, mp_create_pd_value(warn.score));
-                        pd_score.crit = mp_range_set_end(pd_score.crit, mp_create_pd_value(crit.score));
-                        pd_score.min = mp_create_pd_value(0);
-                        pd_score.max = mp_create_pd_value(100);
-                        mp_add_perfdata_to_subcheck(&sc_score, pd_score);
+                if (target.icmp_recv > 1) {
+                        xasprintf(&sc_score.output, "Score %f", score);
+
+                        if (score <= crit.score) {
+                                sc_score = mp_set_subcheck_state(sc_score, STATE_CRITICAL);
+                                xasprintf(&sc_score.output, "%s <= %f", sc_score.output, crit.score);
+                        } else if (score <= warn.score) {
+                                sc_score = mp_set_subcheck_state(sc_score, STATE_WARNING);
+                                xasprintf(&sc_score.output, "%s <= %f", sc_score.output, warn.score);
+                        }
+
+                        if (packet_loss < 100) {
+                                mp_perfdata pd_score = perfdata_init();
+                                xasprintf(&pd_score.label, "%sscore", address);
+                                pd_score.value = mp_create_pd_value(score);
+                                pd_score.warn = mp_range_set_end(pd_score.warn, mp_create_pd_value(warn.score));
+                                pd_score.crit = mp_range_set_end(pd_score.crit, mp_create_pd_value(crit.score));
+                                pd_score.min = mp_create_pd_value(0);
+                                pd_score.max = mp_create_pd_value(100);
+                                mp_add_perfdata_to_subcheck(&sc_score, pd_score);
+                        }
+
+                } else {
+                        // score mode disabled due to not enough received packages
+                        xasprintf(&sc_score.output, "Score mode disabled, not enough packets received");
                 }
 
                 mp_add_subcheck_to_subcheck(&result, sc_score);