| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
curl_easy_perform result (#2239)
* check certificates first, before the return code of curl_easy_perform
* fix typo
* simply the comment for the change
details go into PR request.
|
|
* add proxy argument and improve dns cache usage
add proxy argument that useing the -x and --proxy argument. add it to
the static curl config struct, command usage and help outputs of the
cli.
parse these argument together with the environment variables like
http_proxy before setting the CURLOPT_PROXY in the curl configuration
option. this is required, as there is no easy way to ascertain/get what
the CURLOPT_PROXY that libcurl will use. by the point it is set by
libcurl, we have no control over it anymore, and need it for the other
steps in the configuration.
if the CURLOPT_PROXY is set, skip the DNS cache population which would
set the CURLOPT_RESOLVE. this is currently not perfect however. if a
proxy is set with socks4 or socks5 scheme, the host should be resolving
the hostname.
* codespell, clang-format and hints fixes
* add curl version and ssl enabelement macro checks
might fix rocky linux 8 compilation issues.
* add proxy_resolves_hostname, determined by proxy scheme
leave the functions that print out an curl_easyoption, but dont use it. organize the code slightly, print out the final CURLOPT_PROXY and proxy_resolves_hostname flag on verbose mode, add comments
* remove unused handle_curl_easyoption and format_curl_easyoption functions
* fix typo in the proxy argument
* fix typo with proxy scheme socks5a->socks5h
* improve proxy environment parsing
add another argument: --no-proxy , which is used when setting
CURL_NOPROXY
additionally parse all_proxy, ALL_PROXY, no_proxy and NO_PROXY
environment variables in the correct order.
set the curlopt_proxy and curlopt_noproxy of libcurl, and additionally
save them in check_curl_working_state.
add function determine_hostname_resolver, uses the working state and
static config. it can tokenize the no_proxy variable and check for exact
matches, but cannot determine subnet matches for ip addresses yet.
* document proxy cli arguments
clarify and add more examples of proxy environment variables and their
behavior when multiple are specified, overriden etc.
add single wildcard '*' checking for no_proxy to
determine_hostname_resolver, special case per curlopt_noproxy
documentation
* check curlopt_noproxy before accessing it
* switch argument from --no-proxy to --noproxy like curl cli
* check if host name is a subdomain of an noproxy item
* use strdup where destination working_state.curlopt_proxy may be NULL
* add disclaimer about uppercase HTTP_PROXY
* add subdomain checks for each item in the no_proxy, if the target host is a subdomain proxy wont resolve it
add function ip_addr_inside_cidr, use it for checking possible cidr ranges given in the no_proxy
* wip tests that work on local perl http/https server
* wip tests that work on the live debian image
* fix subnet definition
* make apache2 listen on [::1] for ipv6 tests
* remove squid certificate
* rewrite ip_addr_inside_cidr, split ipv4 and ipv6 parsing path and copy them to a shared buffer later on for prefix check
* Adapt tests for the squid sever, disable checking return code for socks 4/5 proxies. Squid does not support it, and we do not install a capable proxy for these schemes.
* specify localhost acl and allow it through the proxy. used in check_curl tests
* typo in comment
* move function comments to header
* fix failing tests
* handle case where proxy is set as empty string
* removed duplicate tests, corrected wrong comments
* corrected some annotations
* move docker apache subdomain setup files to /tools/subdomain1
* add a newline before dying in handle_curl_option_return_code
* fix the -ssl better, now does not segfault on empty --ssl argument as well.
---------
Co-authored-by: Ahmet Oeztuerk <Ahmet.Oeztuerk@consol.de>
|
|
The "T" argument of check_procs is only a switch, but did expect an argument. This changes fixes that.
|
|
Fixes a logic error in the string handling that led to dead code before.
|
|
|
|
|
|
This commits removes the detection of IPv6 availability.
The IPv6 code in the plugins is used unconditionally now.
|
|
OpenBSD's pledge(2) system call allows the current process to
self-restrict itself, being reduced to promised pledges. For example,
unless a process says it wants to write to files, it is not allowed to
do so any longer.
This change starts by calling pledge(2) in some network-facing checks,
removing the more dangerous privileges, such as executing other files.
My initial motivation came from check_icmp, being installed as a setuid
binary and (temporarily) running with root privileges. There, the
pledge(2) calls result in check_icmp to only being allowed to interact
with the network and to setuid(2) to the calling user later on.
Afterwards, I went through my most commonly used monitoring plugins
directly interacting with the network. Thus, I continued with
pledge(2)-ing check_curl - having a huge codebase and all -,
check_ntp_time, check_smtp, check_ssh, and check_tcp.
For most of those, the changes were quite similar: start with
network-friendly promises, parse the configuration, give up file access,
and proceed with the actual check.
|
|
|
|
Within np_extra_opts, the ini parser expects a valid progname as the
default section to select a configuration section in the ini file.
However, within the check_icmp codebase, the progname is being populated
directly after the np_extra_opts call, being a null pointer before.
$ ./check_icmp --extra-opts=@foo.ini
Segmentation fault (core dumped)
> #0 strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:125
> #1 0x000003989615d032 in _libc_strdup (str=Variable "str" is not available.) at /usr/src/lib/libc/string/strdup.c:44
> #2 0x000003966f751b74 in np_get_defaults (locator=0x73ede1e538ea "@foo.ini", default_section=0x0) at parse_ini.c:91
> #3 0x000003966f7518ce in np_extra_opts (argc=0x73ede1e5369c, argv=0x73ede1e53728, plugin_name=0x0) at extra_opts.c:98
> #4 0x000003966f74165a in main (argc=1, argv=0x0) at check_icmp.c:832
The progname variable is set within the process_arguments function,
requiring the already enriched arguments from np_extra_opts. Thus, I
moved the progname detection out of this function, directly before the
np_extra_opts call. This pattern does already exists in check_tcp.
I briefly looked for similar issues in other plugins, but found none.
|
|
* check_disk: compare inode thresholds against the correct value
* check_disk: Detect free inode number correctly in tests
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
|
|
* check_icmp: prevent segfault on OpenBSD
This commit adds a sanity check for sockets in
check_icmp.
Previously FD_ISSET segfaulted when a socket value was
-1 (on OpenBSD). The changes here add an explicit
check whether the socket is -1 (and therefore not
set).
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
|
|
Compute numbers in output summary correctly
|
|
|
|
check_radius: Implement modern output
|
|
Refactor check_ide_smart
|
|
|
|
Fix some minor compiler warnings
|
|
check_real: implement modern output
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Add lib math to check_snmp dependencies
|
|
|
|
Fake changelog in spec file since the rpm build seems to fail
|
|
|
|
fix types for most curl_easy_setopt parameters
|
|
inqrphl/fix/check-curl-append-query-string-on-redirect
check_curl: append the query string from parsed uri
|
|
Sync with Gnulib stable-202507 code (a8ac9f9ce5)
|
|
|
|
|
|
according to https://curl.se/libcurl/c/curl_easy_setopt.html, parameters
are either a long, a function pointer, an object pointer or a curl_off_t,
depending on what the option expects; curl 8.16 checks and warns about
these.
|
|
Fix v3.0.0-rc1 Build on OpenBSD
|
|
check_http: Abort invalid SSL w/ error
|
|
Include the -D flag for certificate verification in the "CHECK
CERTIFICATE" examples. Otherwise, only the certificate dates are
checked, but not if the certificate matches to the hostname or is signed
by a trusted CA.
Fixes #2146.
|
|
previously, the fragment was sent in the request from client, and the
server would parse and increment its value. the incremented value would
be set in the redirected URI.
this does not work as fragments are meaningless to servers and clients
like check_curl strip them in their GET request.
rewrite the fragment handling . if client sends a URI parameter with
'fragment' as its key, the server will set its value for its redirected
URI. it will come up both as a parameter and the fragment at the end.
use this new logic to rewrite the fragment redirection test. remove -p
$http_port argument on tests for this endpoint, which was making https
tests fail. correct the common test count from 75 to 95, as there are 20
total test assertions in the 8 times it uses the new endpoint. remove
unused code on that endpoint as well
|
|
If a SSL connection cannot be established, check_http bailed out with a
die function call with a NULL fmt string. This adds a more meaningful
message.
The motivation for this patch was to get everything from the OpenBSD
ports upstream. It seems like in the old days, this would have resulted
in a segfault.
https://codeberg.org/OpenBSD/ports/commit/b8a6b3cae57bbfd67e667dca583c621d45ab0d6f
However, even if "die" now checks for NULL, a human readable error is
nice to have.
|
|
On OpenBSD's "stdio.h", stdin, stdout, and stderr are not directly
FILE*, but #defines. Thus, naming the output struct fields stdout and
stderr resulted in compiler errors, after replacing the #define.
https://codeberg.org/OpenBSD/src/src/commit/a762189c5efbb2811f3c853bc0e5578fd5fb919d/include/stdio.h#L75-L77
|
|
The refactoring in eafee9c3f91879afa82749fa1d8cd2b0b53a5d5c missed the
part within "#if defined(SIOCGIFADDR)" in get_ip_address.
|
|
The ioctl(2) call within "#if defined(SIOCGIFADDR)" requires the include.
|
|
This library is glibc-only and not necessary at this point. The
getopt_long function is provided by "getopt.h", included via "common.h".
Similar to #2159.
|
|
On OpenBSD, crypt is named crypto. This diff is a portable version of a
patch residing in the OpenBSD ports since ages.
https://codeberg.org/OpenBSD/ports/src/commit/1f15238782c26deb728250cbf591f1ffcd10422f/net/monitoring-plugins/patches/patch-configure_ac
|
|
use the parameters in the last redirected URI that that server returns
HTTP OK to. matches the incrementation count of redirection_count from 0
to 3, as they also get incremented three times alongside it. add
comments about what is happening in the test cases, no need to
understand the endpoint completely
|
|
|
|
plugins/tests/check_curl.t forks and runs a http(s) server that responds
to specific uri endpoints. Added another endpoint under
/redirect_with_increment with dynamic redirection points.
This endpoint will parse different parts of the uri that come after the
path: parameters, query and the fragment. If applicable, seperate
elements within each field are parsed into key/value pairs. value is
incremented in redirected URI.
Tests if check_url redirection logic retains different parts of the url
when parsing the uri and building the new redirected URL. Current tests
show that it ignores the fragment part.
|
|
|
