clarify and add more examples of proxy environment variables and their
behavior when multiple are specified, overriden etc.
add single wildcard '*' checking for no_proxy to
determine_hostname_resolver, special case per curlopt_noproxy
documentation
add another argument: --no-proxy , which is used when setting
CURL_NOPROXY
additionally parse all_proxy, ALL_PROXY, no_proxy and NO_PROXY
environment variables in the correct order.
set the curlopt_proxy and curlopt_noproxy of libcurl, and additionally
save them in check_curl_working_state.
add function determine_hostname_resolver, uses the working state and
static config. it can tokenize the no_proxy variable and check for exact
matches, but cannot determine subnet matches for ip addresses yet.
leave the functions that print out an curl_easyoption, but dont use it. organize the code slightly, print out the final CURLOPT_PROXY and proxy_resolves_hostname flag on verbose mode, add comments
add proxy argument that useing the -x and --proxy argument. add it to
the static curl config struct, command usage and help outputs of the
cli.
parse these argument together with the environment variables like
http_proxy before setting the CURLOPT_PROXY in the curl configuration
option. this is required, as there is no easy way to ascertain/get what
the CURLOPT_PROXY that libcurl will use. by the point it is set by
libcurl, we have no control over it anymore, and need it for the other
steps in the configuration.
if the CURLOPT_PROXY is set, skip the DNS cache population which would
set the CURLOPT_RESOLVE. this is currently not perfect however. if a
proxy is set with socks4 or socks5 scheme, the host should be resolving
the hostname.
OpenBSD's pledge(2) system call allows the current process to
self-restrict itself, being reduced to promised pledges. For example,
unless a process says it wants to write to files, it is not allowed to
do so any longer.
This change starts by calling pledge(2) in some network-facing checks,
removing the more dangerous privileges, such as executing other files.
My initial motivation came from check_icmp, being installed as a setuid
binary and (temporarily) running with root privileges. There, the
pledge(2) calls result in check_icmp to only being allowed to interact
with the network and to setuid(2) to the calling user later on.
Afterwards, I went through my most commonly used monitoring plugins
directly interacting with the network. Thus, I continued with
pledge(2)-ing check_curl - having a huge codebase and all -,
check_ntp_time, check_smtp, check_ssh, and check_tcp.
For most of those, the changes were quite similar: start with
network-friendly promises, parse the configuration, give up file access,
and proceed with the actual check.
Within np_extra_opts, the ini parser expects a valid progname as the
default section to select a configuration section in the ini file.
However, within the check_icmp codebase, the progname is being populated
directly after the np_extra_opts call, being a null pointer before.
$ ./check_icmp --extra-opts=@foo.ini
Segmentation fault (core dumped)
> #0 strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:125
> #1 0x000003989615d032 in _libc_strdup (str=Variable "str" is not available.) at /usr/src/lib/libc/string/strdup.c:44
> #2 0x000003966f751b74 in np_get_defaults (locator=0x73ede1e538ea "@foo.ini", default_section=0x0) at parse_ini.c:91
> #3 0x000003966f7518ce in np_extra_opts (argc=0x73ede1e5369c, argv=0x73ede1e53728, plugin_name=0x0) at extra_opts.c:98
> #4 0x000003966f74165a in main (argc=1, argv=0x0) at check_icmp.c:832
The progname variable is set within the process_arguments function,
requiring the already enriched arguments from np_extra_opts. Thus, I
moved the progname detection out of this function, directly before the
np_extra_opts call. This pattern does already exists in check_tcp.
I briefly looked for similar issues in other plugins, but found none.
* check_disk: compare inode thresholds against the correct value
* check_disk: Detect free inode number correctly in tests
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
* check_icmp: prevent segfault on OpenBSD
This commit adds a sanity check for sockets in
check_icmp.
Previously FD_ISSET segfaulted when a socket value was
-1 (on OpenBSD). The changes here add an explicit
check whether the socket is -1 (and therefore not
set).
---------
Co-authored-by: Lorenz Kästle <lorenz.kaestle@netways.de>
