diff options
author | Robin H. Johnson <robbat2@gentoo.org> | 2015-08-08 13:49:04 -0700 |
---|---|---|
committer | Robin H. Johnson <robbat2@gentoo.org> | 2015-08-08 17:38:18 -0700 |
commit | 56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch) | |
tree | 3f91093cdb475e565ae857f1c5a7fd339e2d781e /net-analyzer/nrpe | |
download | gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.xz |
proj/gentoo: Initial commit
This commit represents a new era for Gentoo:
Storing the gentoo-x86 tree in Git, as converted from CVS.
This commit is the start of the NEW history.
Any historical data is intended to be grafted onto this point.
Creation process:
1. Take final CVS checkout snapshot
2. Remove ALL ChangeLog* files
3. Transform all Manifests to thin
4. Remove empty Manifests
5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$
5.1. Do not touch files with -kb/-ko keyword flags.
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests
X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project
X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration
X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn
X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts
X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration
X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging
X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'net-analyzer/nrpe')
-rw-r--r-- | net-analyzer/nrpe/Manifest | 1 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nagios-nrpe-2.13-command-args.patch | 15 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nagios-nrpe-2.13-multiline.patch | 200 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nagios-nrpe-2.13-tcpd.patch | 33 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe-2.14-multiline.patch | 204 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe-2.14-tcpd-et-al.patch | 74 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe-2.15-autoconf-header.patch | 24 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe-2.15-metachar-security-fix.patch | 26 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe-2.15-tcpd-et-al.patch | 50 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe.init | 50 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe.service | 11 | ||||
-rw-r--r-- | net-analyzer/nrpe/files/nrpe.xinetd.2 | 11 | ||||
-rw-r--r-- | net-analyzer/nrpe/metadata.xml | 22 | ||||
-rw-r--r-- | net-analyzer/nrpe/nrpe-2.15-r1.ebuild | 127 | ||||
-rw-r--r-- | net-analyzer/nrpe/nrpe-2.15-r2.ebuild | 129 | ||||
-rw-r--r-- | net-analyzer/nrpe/nrpe-2.15.ebuild | 127 |
16 files changed, 1104 insertions, 0 deletions
diff --git a/net-analyzer/nrpe/Manifest b/net-analyzer/nrpe/Manifest new file mode 100644 index 00000000000..51876a8e1c1 --- /dev/null +++ b/net-analyzer/nrpe/Manifest @@ -0,0 +1 @@ +DIST nrpe-2.15.tar.gz 419695 SHA256 66383b7d367de25ba031d37762d83e2b55de010c573009c6f58270b137131072 SHA512 03ce9774b5112d03235dc9da075770d89d1bcc5ffa5faf221ff7ea8ec5c92ded1e1ae9222581a87cf53736d190ac047e1acce7edc2f31f26c432d786cdef0e73 WHIRLPOOL f97ad7431138fd96588bb4e9d13404a0425bbdb8582c7c472cb20621bb77a9e9ecdeed88b9247ea20815da33c5b123368a540c5a0a058921e59367c2ce2a2b10 diff --git a/net-analyzer/nrpe/files/nagios-nrpe-2.13-command-args.patch b/net-analyzer/nrpe/files/nagios-nrpe-2.13-command-args.patch new file mode 100644 index 00000000000..fe6751aa55e --- /dev/null +++ b/net-analyzer/nrpe/files/nagios-nrpe-2.13-command-args.patch @@ -0,0 +1,15 @@ +--- configure.old 2008-03-10 22:04:41.000000000 +0100 ++++ configure.in 2012-01-04 09:46:38.000000000 +0100 +@@ -362,7 +362,11 @@ + AC_SUBST(NAGIOS_INSTALL_OPTS) + + +-AC_ARG_ENABLE(command-args,--enable-command-args allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option!,AC_DEFINE_UNQUOTED(ENABLE_COMMAND_ARGUMENTS)) ++AC_ARG_ENABLE(command-args,--enable-command-args allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option!,[ ++ if test x$enableval = xyes; then ++ AC_DEFINE_UNQUOTED(ENABLE_COMMAND_ARGUMENTS) ++ fi ++ ]) + + + AC_PATH_PROG(PERL,perl) diff --git a/net-analyzer/nrpe/files/nagios-nrpe-2.13-multiline.patch b/net-analyzer/nrpe/files/nagios-nrpe-2.13-multiline.patch new file mode 100644 index 00000000000..8d96149cb36 --- /dev/null +++ b/net-analyzer/nrpe/files/nagios-nrpe-2.13-multiline.patch @@ -0,0 +1,200 @@ +diff --git a/include/common.h b/include/common.h +index 202dec4..86f8e32 100755 +--- a/include/common.h ++++ b/include/common.h +@@ -41,7 +41,7 @@ + #define DEFAULT_SOCKET_TIMEOUT 10 /* timeout after 10 seconds */
+ #define DEFAULT_CONNECTION_TIMEOUT 300 /* timeout if daemon is waiting for connection more than this time */
+
+-#define MAX_INPUT_BUFFER 2048 /* max size of most buffers we use */
++#define MAX_INPUT_BUFFER 16384 /* max size of most buffers we use */
+ #define MAX_FILENAME_LENGTH 256
+
+ #define MAX_HOST_ADDRESS_LENGTH 256 /* max size of a host address */
+@@ -55,12 +55,14 @@ +
+ #define QUERY_PACKET 1 /* id code for a packet containing a query */
+ #define RESPONSE_PACKET 2 /* id code for a packet containing a response */
++#define RESPONSE_PACKET_WITH_MORE 3 /* id code for a packet containing a response, with more data to follow */
+
+ #define NRPE_PACKET_VERSION_3 3 /* packet version identifier */
+ #define NRPE_PACKET_VERSION_2 2
+ #define NRPE_PACKET_VERSION_1 1 /* older packet version identifiers (no longer supported) */
+
+ #define MAX_PACKETBUFFER_LENGTH 1024 /* max amount of data we'll send in one query/response */
++ /* WARNING - do not change this as older clients/servers will not work */
+
+ typedef struct packet_struct{
+ int16_t packet_version;
+diff --git a/src/check_nrpe.c b/src/check_nrpe.c +index 0adced1..ff4b920 100755 +--- a/src/check_nrpe.c ++++ b/src/check_nrpe.c +@@ -221,6 +221,11 @@ int main(int argc, char **argv){ + return STATE_UNKNOWN;
+ }
+
++ /* Altinity patch: Allow multiple packets to be received */
++ /* Indentation not corrected to allow simpler patching */
++ /* START MULTI_PACKET LOOP */
++ do {
++
+ /* wait for the response packet */
+ bytes_to_recv=sizeof(receive_packet);
+ if(use_ssl==FALSE)
+@@ -233,31 +238,24 @@ int main(int argc, char **argv){ + /* reset timeout */
+ alarm(0);
+
+- /* close the connection */
+-#ifdef HAVE_SSL
+- if(use_ssl==TRUE){
+- SSL_shutdown(ssl);
+- SSL_free(ssl);
+- SSL_CTX_free(ctx);
+- }
+-#endif
+- graceful_close(sd,1000);
+-
+ /* recv() error */
+ if(rc<0){
+ printf("CHECK_NRPE: Error receiving data from daemon.\n");
++ graceful_close(sd,1000);
+ return STATE_UNKNOWN;
+ }
+
+ /* server disconnected */
+ else if(rc==0){
+ printf("CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.\n");
++ graceful_close(sd,1000);
+ return STATE_UNKNOWN;
+ }
+
+ /* receive underflow */
+ else if(bytes_to_recv<sizeof(receive_packet)){
+ printf("CHECK_NRPE: Receive underflow - only %d bytes received (%d expected).\n",bytes_to_recv,sizeof(receive_packet));
++ graceful_close(sd,1000);
+ return STATE_UNKNOWN;
+ }
+
+@@ -271,21 +269,21 @@ int main(int argc, char **argv){ + calculated_crc32=calculate_crc32((char *)&receive_packet,sizeof(receive_packet));
+ if(packet_crc32!=calculated_crc32){
+ printf("CHECK_NRPE: Response packet had invalid CRC32.\n");
+- close(sd);
++ graceful_close(sd,1000);
+ return STATE_UNKNOWN;
+ }
+
+ /* check packet version */
+ if(ntohs(receive_packet.packet_version)!=NRPE_PACKET_VERSION_2){
+ printf("CHECK_NRPE: Invalid packet version received from server.\n");
+- close(sd);
++ graceful_close(sd,1000);
+ return STATE_UNKNOWN;
+ }
+
+ /* check packet type */
+- if(ntohs(receive_packet.packet_type)!=RESPONSE_PACKET){
++ if(ntohs(receive_packet.packet_type)!=RESPONSE_PACKET && ntohs(receive_packet.packet_type)!=RESPONSE_PACKET_WITH_MORE){
+ printf("CHECK_NRPE: Invalid packet type received from server.\n");
+- close(sd);
++ graceful_close(sd,1000);
+ return STATE_UNKNOWN;
+ }
+
+@@ -297,8 +295,18 @@ int main(int argc, char **argv){ + if(!strcmp(receive_packet.buffer,""))
+ printf("CHECK_NRPE: No output returned from daemon.\n");
+ else
+- printf("%s\n",receive_packet.buffer);
+- }
++ printf("%s",receive_packet.buffer);
++
++ } while (ntohs(receive_packet.packet_type)==RESPONSE_PACKET_WITH_MORE);
++ /* END MULTI_PACKET LOOP */
++
++ /* Finish output with newline */
++ printf("\n");
++
++ /* close the connection */
++ graceful_close(sd,1000);
++
++ }
+
+ /* reset the alarm */
+ else
+@@ -434,6 +442,14 @@ int graceful_close(int sd, int timeout){ + struct timeval tv;
+ char buf[1000];
+
++#ifdef HAVE_SSL
++ if(use_ssl==TRUE){
++ SSL_shutdown(ssl);
++ SSL_free(ssl);
++ SSL_CTX_free(ctx);
++ }
++#endif
++
+ /* send FIN packet */
+ shutdown(sd,SHUT_WR);
+ for(;;){
+diff --git a/src/nrpe.c b/src/nrpe.c +index f2b0164..dfa8262 100755 +--- a/src/nrpe.c ++++ b/src/nrpe.c +@@ -972,6 +972,8 @@ void handle_connection(int sock){ + char processed_command[MAX_INPUT_BUFFER];
+ int result=STATE_OK;
+ int early_timeout=FALSE;
++ int bytes_copied=0;
++ char *pbuffer=&buffer[0];
+ int rc;
+ int x;
+ #ifdef DEBUG
+@@ -1188,6 +1190,14 @@ void handle_connection(int sock){ + if(buffer[strlen(buffer)-1]=='\n')
+ buffer[strlen(buffer)-1]='\x0';
+
++ /* Altinity patch to allow multi packet responses */
++ /* Loop not indented to allow easier patching */
++ /* START MULTI_PACKET LOOP */
++ do {
++
++ if(debug==TRUE)
++ syslog(LOG_DEBUG,"Sending response - bytes left: %d", strlen(pbuffer));
++
+ /* clear the response packet buffer */
+ bzero(&send_packet,sizeof(send_packet));
+
+@@ -1196,11 +1206,17 @@ void handle_connection(int sock){ +
+ /* initialize response packet data */
+ send_packet.packet_version=(int16_t)htons(NRPE_PACKET_VERSION_2);
+- send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET);
+ send_packet.result_code=(int16_t)htons(result);
+- strncpy(&send_packet.buffer[0],buffer,MAX_PACKETBUFFER_LENGTH);
++ strncpy(&send_packet.buffer[0],pbuffer,MAX_PACKETBUFFER_LENGTH);
+ send_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
+-
++
++ bytes_copied = strlen(&send_packet.buffer[0]);
++ pbuffer = pbuffer+bytes_copied;
++ if(strlen(pbuffer)>0)
++ send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET_WITH_MORE);
++ else
++ send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET);
++
+ /* calculate the crc 32 value of the packet */
+ send_packet.crc32_value=(u_int32_t)0L;
+ calculated_crc32=calculate_crc32((char *)&send_packet,sizeof(send_packet));
+@@ -1219,6 +1235,9 @@ void handle_connection(int sock){ + SSL_write(ssl,&send_packet,bytes_to_send);
+ #endif
+
++ } while (strlen(pbuffer) > 0);
++ /* END MULTI_PACKET LOOP */
++
+ #ifdef HAVE_SSL
+ if(ssl){
+ SSL_shutdown(ssl);
diff --git a/net-analyzer/nrpe/files/nagios-nrpe-2.13-tcpd.patch b/net-analyzer/nrpe/files/nagios-nrpe-2.13-tcpd.patch new file mode 100644 index 00000000000..67dd22e0531 --- /dev/null +++ b/net-analyzer/nrpe/files/nagios-nrpe-2.13-tcpd.patch @@ -0,0 +1,33 @@ +--- configure.in.orig 2008-03-10 22:04:41.000000000 +0100 ++++ configure.in 2012-01-08 17:59:49.804613011 +0100 +@@ -147,11 +147,27 @@ + AC_CHECK_LIB(nsl,main,SOCKETLIBS="$SOCKETLIBS -lnsl") + AC_CHECK_LIB(socket,socket,SOCKETLIBS="$SOCKETLIBS -lsocket") + AC_SUBST(SOCKETLIBS) +-AC_CHECK_LIB(wrap,main,[ +- LIBWRAPLIBS="$LIBWRAPLIBS -lwrap" ++ ++AC_ARG_ENABLE(tcp-wrapper,--enable-tcp-wrapper enables support for TCP wrappers. *** DISABLING IS A SECURITY RISK! *** Read the SECURITY file before using this option! (default: auto),[ ++ if test x$enableval = xyes; then ++ enable_tcp_wrapper=yes ++ else ++ enable_tcp_wrapper=no ++ fi ++ ],enable_tcp_wrapper="auto") ++ ++LIBWRAPLIBS="" ++if test "x$enable_tcp_wrapper" = "xauto"; then ++ AC_CHECK_LIB(wrap,main,[ ++ LIBWRAPLIBS="$LIBWRAPLIBS -lwrap" ++ AC_DEFINE(HAVE_LIBWRAP) ++ ]) ++elif test "x$enable_tcp_wrapper" = "xyes"; then ++ AC_CHECK_LIB(wrap,main,LIBWRAPLIBS="$LIBWRAPLIBS -lwrap",[AC_MSG_ERROR([TCP wrapper library not found])]) + AC_DEFINE(HAVE_LIBWRAP) +- ]) ++fi + AC_SUBST(LIBWRAPLIBS) ++ + AC_CHECK_FUNCS(strdup strstr strtoul initgroups closesocket) + + dnl socklen_t check - from curl diff --git a/net-analyzer/nrpe/files/nrpe-2.14-multiline.patch b/net-analyzer/nrpe/files/nrpe-2.14-multiline.patch new file mode 100644 index 00000000000..3af2ef95bab --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe-2.14-multiline.patch @@ -0,0 +1,204 @@ +Add support for large output + +http://opsview-blog.opsera.com/dotorg/2008/08/enhancing-nrpe.htmlIndex: nrpe-2.14/include/common.h +=================================================================== +Index: nrpe-2.14/include/common.h +=================================================================== +--- nrpe-2.14.orig/include/common.h ++++ nrpe-2.14/include/common.h +@@ -41,7 +41,7 @@ + #define DEFAULT_SOCKET_TIMEOUT 10 /* timeout after 10 seconds */ + #define DEFAULT_CONNECTION_TIMEOUT 300 /* timeout if daemon is waiting for connection more than this time */ + +-#define MAX_INPUT_BUFFER 2048 /* max size of most buffers we use */ ++#define MAX_INPUT_BUFFER 16384 /* max size of most buffers we use */ + #define MAX_FILENAME_LENGTH 256 + + #define MAX_HOST_ADDRESS_LENGTH 256 /* max size of a host address */ +@@ -55,12 +55,14 @@ + + #define QUERY_PACKET 1 /* id code for a packet containing a query */ + #define RESPONSE_PACKET 2 /* id code for a packet containing a response */ ++#define RESPONSE_PACKET_WITH_MORE 3 /* id code for a packet containing a response, with more data to follow */ + + #define NRPE_PACKET_VERSION_3 3 /* packet version identifier */ + #define NRPE_PACKET_VERSION_2 2 + #define NRPE_PACKET_VERSION_1 1 /* older packet version identifiers (no longer supported) */ + + #define MAX_PACKETBUFFER_LENGTH 1024 /* max amount of data we'll send in one query/response */ ++ /* WARNING - do not change this as older clients/servers will not work */ + + typedef struct packet_struct{ + int16_t packet_version; +Index: nrpe-2.14/src/check_nrpe.c +=================================================================== +--- nrpe-2.14.orig/src/check_nrpe.c ++++ nrpe-2.14/src/check_nrpe.c +@@ -221,6 +221,11 @@ int main(int argc, char **argv){ + return STATE_UNKNOWN; + } + ++ /* Altinity patch: Allow multiple packets to be received */ ++ /* Indentation not corrected to allow simpler patching */ ++ /* START MULTI_PACKET LOOP */ ++ do { ++ + /* wait for the response packet */ + bytes_to_recv=sizeof(receive_packet); + if(use_ssl==FALSE) +@@ -233,31 +238,24 @@ int main(int argc, char **argv){ + /* reset timeout */ + alarm(0); + +- /* close the connection */ +-#ifdef HAVE_SSL +- if(use_ssl==TRUE){ +- SSL_shutdown(ssl); +- SSL_free(ssl); +- SSL_CTX_free(ctx); +- } +-#endif +- graceful_close(sd,1000); +- + /* recv() error */ + if(rc<0){ + printf("CHECK_NRPE: Error receiving data from daemon.\n"); ++ graceful_close(sd,1000); + return STATE_UNKNOWN; + } + + /* server disconnected */ + else if(rc==0){ + printf("CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.\n"); ++ graceful_close(sd,1000); + return STATE_UNKNOWN; + } + + /* receive underflow */ + else if(bytes_to_recv<sizeof(receive_packet)){ + printf("CHECK_NRPE: Receive underflow - only %d bytes received (%d expected).\n",bytes_to_recv,sizeof(receive_packet)); ++ graceful_close(sd,1000); + return STATE_UNKNOWN; + } + +@@ -271,21 +269,21 @@ int main(int argc, char **argv){ + calculated_crc32=calculate_crc32((char *)&receive_packet,sizeof(receive_packet)); + if(packet_crc32!=calculated_crc32){ + printf("CHECK_NRPE: Response packet had invalid CRC32.\n"); +- close(sd); ++ graceful_close(sd,1000); + return STATE_UNKNOWN; + } + + /* check packet version */ + if(ntohs(receive_packet.packet_version)!=NRPE_PACKET_VERSION_2){ + printf("CHECK_NRPE: Invalid packet version received from server.\n"); +- close(sd); ++ graceful_close(sd,1000); + return STATE_UNKNOWN; + } + + /* check packet type */ +- if(ntohs(receive_packet.packet_type)!=RESPONSE_PACKET){ ++ if(ntohs(receive_packet.packet_type)!=RESPONSE_PACKET && ntohs(receive_packet.packet_type)!=RESPONSE_PACKET_WITH_MORE){ + printf("CHECK_NRPE: Invalid packet type received from server.\n"); +- close(sd); ++ graceful_close(sd,1000); + return STATE_UNKNOWN; + } + +@@ -297,8 +295,18 @@ int main(int argc, char **argv){ + if(!strcmp(receive_packet.buffer,"")) + printf("CHECK_NRPE: No output returned from daemon.\n"); + else +- printf("%s\n",receive_packet.buffer); +- } ++ printf("%s",receive_packet.buffer); ++ ++ } while (ntohs(receive_packet.packet_type)==RESPONSE_PACKET_WITH_MORE); ++ /* END MULTI_PACKET LOOP */ ++ ++ /* Finish output with newline */ ++ printf("\n"); ++ ++ /* close the connection */ ++ graceful_close(sd,1000); ++ ++ } + + /* reset the alarm */ + else +@@ -434,6 +442,14 @@ int graceful_close(int sd, int timeout){ + struct timeval tv; + char buf[1000]; + ++#ifdef HAVE_SSL ++ if(use_ssl==TRUE){ ++ SSL_shutdown(ssl); ++ SSL_free(ssl); ++ SSL_CTX_free(ctx); ++ } ++#endif ++ + /* send FIN packet */ + shutdown(sd,SHUT_WR); + for(;;){ +Index: nrpe-2.14/src/nrpe.c +=================================================================== +--- nrpe-2.14.orig/src/nrpe.c ++++ nrpe-2.14/src/nrpe.c +@@ -1056,6 +1056,8 @@ void handle_connection(int sock){ + char processed_command[MAX_INPUT_BUFFER]; + int result=STATE_OK; + int early_timeout=FALSE; ++ int bytes_copied=0; ++ char *pbuffer=&buffer[0]; + int rc; + int x; + #ifdef DEBUG +@@ -1272,6 +1274,14 @@ void handle_connection(int sock){ + if(buffer[strlen(buffer)-1]=='\n') + buffer[strlen(buffer)-1]='\x0'; + ++ /* Altinity patch to allow multi packet responses */ ++ /* Loop not indented to allow easier patching */ ++ /* START MULTI_PACKET LOOP */ ++ do { ++ ++ if(debug==TRUE) ++ syslog(LOG_DEBUG,"Sending response - bytes left: %d", strlen(pbuffer)); ++ + /* clear the response packet buffer */ + bzero(&send_packet,sizeof(send_packet)); + +@@ -1280,11 +1290,17 @@ void handle_connection(int sock){ + + /* initialize response packet data */ + send_packet.packet_version=(int16_t)htons(NRPE_PACKET_VERSION_2); +- send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET); + send_packet.result_code=(int16_t)htons(result); +- strncpy(&send_packet.buffer[0],buffer,MAX_PACKETBUFFER_LENGTH); ++ strncpy(&send_packet.buffer[0],pbuffer,MAX_PACKETBUFFER_LENGTH); + send_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0'; +- ++ ++ bytes_copied = strlen(&send_packet.buffer[0]); ++ pbuffer = pbuffer+bytes_copied; ++ if(strlen(pbuffer)>0) ++ send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET_WITH_MORE); ++ else ++ send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET); ++ + /* calculate the crc 32 value of the packet */ + send_packet.crc32_value=(u_int32_t)0L; + calculated_crc32=calculate_crc32((char *)&send_packet,sizeof(send_packet)); +@@ -1303,6 +1319,9 @@ void handle_connection(int sock){ + SSL_write(ssl,&send_packet,bytes_to_send); + #endif + ++ } while (strlen(pbuffer) > 0); ++ /* END MULTI_PACKET LOOP */ ++ + #ifdef HAVE_SSL + if(ssl){ + complete_SSL_shutdown( ssl); diff --git a/net-analyzer/nrpe/files/nrpe-2.14-tcpd-et-al.patch b/net-analyzer/nrpe/files/nrpe-2.14-tcpd-et-al.patch new file mode 100644 index 00000000000..f18bc31ac4e --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe-2.14-tcpd-et-al.patch @@ -0,0 +1,74 @@ +--- nrpe-2.14.orig/configure.in ++++ nrpe-2.14/configure.in +@@ -1,12 +1,8 @@ + dnl Process this -*-m4-*- file with autoconf to produce a configure script. + +-dnl Disable caching +-define([AC_CACHE_LOAD],) +-define([AC_CACHE_SAVE],) +- +-2.14([nrpe],[2.13],[nagios-users@lists.sourceforge.net],[nrpe],[http://www.nagios.org]) ++AC_INIT([nrpe],[2.14],[nagios-users@lists.sourceforge.net],[nrpe],[http://www.nagios.org]) + AC_CONFIG_SRCDIR([src/nrpe.c]) +-AC_CONFIG_HEADERS([include/config.h]) ++ + AC_CONFIG_FILES([Makefile + subst + src/Makefile +@@ -16,7 +12,8 @@ + init-script.suse + nrpe.spec + sample-config/nrpe.cfg +- sample-config/nrpe.xinetd]) ++ sample-config/nrpe.xinetd ++ include/config.h]) + AC_PREFIX_DEFAULT(/usr/local/nagios) + + PKG_NAME=nrpe +@@ -45,7 +42,7 @@ + AC_HEADER_STDC + AC_HEADER_TIME + AC_HEADER_SYS_WAIT +-AC_CHECK_HEADERS(ctype.h dirent.h errno.h fcntl.h getopt.h grp.h inttypes.h netdb.h pwd.h signal.h stdint.h strings.h string.h syslog.h tcpd.h unistd.h arpa/inet.h netinet/in.h socket.h sys/types.h sys/time.h sys/resource.h sys/wait.h sys/socket.h sys/stat.h) ++AC_CHECK_HEADERS(ctype.h dirent.h errno.h fcntl.h getopt.h grp.h inttypes.h netdb.h pwd.h signal.h stdint.h strings.h string.h syslog.h unistd.h arpa/inet.h netinet/in.h socket.h sys/types.h sys/time.h sys/resource.h sys/wait.h sys/socket.h sys/stat.h) + + dnl Checks for typedefs, structures, and compiler characteristics. + AC_C_CONST +@@ -164,11 +161,20 @@ + AC_CHECK_LIB(nsl,main,SOCKETLIBS="$SOCKETLIBS -lnsl") + AC_CHECK_LIB(socket,socket,SOCKETLIBS="$SOCKETLIBS -lsocket") + AC_SUBST(SOCKETLIBS) +-AC_CHECK_LIB(wrap,main,[ +- LIBWRAPLIBS="$LIBWRAPLIBS -lwrap" ++ ++AC_ARG_ENABLE([tcp-wrapper], ++ AS_HELP_STRING([--disable-tcp-wrapper], [Disable building with TCP wrappers. *** DISABLING IS A SECURITY RISK! *** Read the SECURITY file before using this option! @<:@default=enable@:>@])) ++ ++LIBWRAPLIBS="" ++AS_IF([test "x$enable_tcp_wrapper" != "xno"], [ ++ AC_CHECK_LIB([wrap],[hosts_access],[ ++ LIBWRAPLIBS="$LIBWRAPLIBS -lwrap" + AC_DEFINE(HAVE_LIBWRAP,[1],[Have the TCP wrappers library]) +- ]) ++ AC_DEFINE(HAVE_TCPD_H,[1],[Have the TCP wrappers library]) ++ ]) ++]) + AC_SUBST(LIBWRAPLIBS) ++ + AC_CHECK_FUNCS(strdup strstr strtoul initgroups closesocket) + + dnl socklen_t check - from curl +@@ -438,8 +444,11 @@ + AC_SUBST(TARGET_PLATFORM) + + AC_ARG_ENABLE([command-args], +- AS_HELP_STRING([--enable-command-args],[allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option!]), +- AC_DEFINE_UNQUOTED(ENABLE_COMMAND_ARGUMENTS,[1],[Enable command-line arguments])) ++ AS_HELP_STRING([--enable-command-args],[allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option!])) ++ ++AS_IF([test "x$enable_command_args" = "xyes"], [ ++ AC_DEFINE(ENABLE_COMMAND_ARGUMENTS,[1],[Enable command-line arguments]) ++]) + + AC_ARG_ENABLE([bash-command-substitution], + AS_HELP_STRING([--enable-bash-command-substitution],[allows clients to pass bash command substitutions of the form $(command). *** THIS IS A HIGH SECURITY RISK! *** Read the SECURITY file before using this option!]), diff --git a/net-analyzer/nrpe/files/nrpe-2.15-autoconf-header.patch b/net-analyzer/nrpe/files/nrpe-2.15-autoconf-header.patch new file mode 100644 index 00000000000..81078c44971 --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe-2.15-autoconf-header.patch @@ -0,0 +1,24 @@ +diff -Nuar --exclude '*.orig' nrpe-2.15.orig/configure.in nrpe-2.15/configure.in +--- nrpe-2.15.orig/configure.in 2013-09-06 08:27:13.000000000 -0700 ++++ nrpe-2.15/configure.in 2014-04-19 09:32:52.251766643 -0700 +@@ -6,7 +6,8 @@ + + AC_INIT([nrpe],[2.15],[nagios-users@lists.sourceforge.net],[nrpe],[http://www.nagios.org]) + AC_CONFIG_SRCDIR([src/nrpe.c]) +-AC_CONFIG_HEADERS([include/config.h]) ++AC_CONFIG_HEADERS([include/autoconf.h]) + AC_CONFIG_FILES([Makefile ++ include/config.h + subst + src/Makefile +diff -Nuar --exclude '*.orig' nrpe-2.15.orig/include/config.h.in nrpe-2.15/include/config.h.in +--- nrpe-2.15.orig/include/config.h.in 2013-09-06 08:27:13.000000000 -0700 ++++ nrpe-2.15/include/config.h.in 2014-04-19 09:33:07.620035056 -0700 +@@ -26,6 +26,7 @@ + + #include <stdio.h> + #include <stdlib.h> ++#include "autoconf.h" + + + #define DEFAULT_SERVER_PORT @nrpe_port@ /* default port to use */ diff --git a/net-analyzer/nrpe/files/nrpe-2.15-metachar-security-fix.patch b/net-analyzer/nrpe/files/nrpe-2.15-metachar-security-fix.patch new file mode 100644 index 00000000000..c42f8bfdec0 --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe-2.15-metachar-security-fix.patch @@ -0,0 +1,26 @@ +Disallow all control characters in argument handling. + +This closes a security hole that allowed passing commands via the argument +handling, if a newline was used to seperate the argument from the rest of the +command. + +X-URL: http://www.exploit-db.com/exploits/32925/ +Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> + +-- +I didn't find any patches from upstream NRPE, so I wrote this quick one. +If somebody else has a valid use for control characters in NRPE arguments, then +this could be relaxed slightly. + +diff -Nuar --exclude '*.orig' nrpe-2.15.orig/src/nrpe.c nrpe-2.15/src/nrpe.c +--- nrpe-2.15.orig/src/nrpe.c 2014-04-19 09:37:16.022373910 -0700 ++++ nrpe-2.15/src/nrpe.c 2014-04-19 09:46:53.237458939 -0700 +@@ -53,7 +53,7 @@ + + #define DEFAULT_COMMAND_TIMEOUT 60 /* default timeout for execution of plugins */ + #define MAXFD 64 +-#define NASTY_METACHARS "|`&><'\"\\[]{};" ++#define NASTY_METACHARS "|`&><'\"\\[]{};\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f" + #define howmany(x,y) (((x)+((y)-1))/(y)) + #define MAX_LISTEN_SOCKS 16 + diff --git a/net-analyzer/nrpe/files/nrpe-2.15-tcpd-et-al.patch b/net-analyzer/nrpe/files/nrpe-2.15-tcpd-et-al.patch new file mode 100644 index 00000000000..b8a0811b831 --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe-2.15-tcpd-et-al.patch @@ -0,0 +1,50 @@ +diff -Nuar --exclude '*.orig' nrpe-2.15.orig/configure.in nrpe-2.15/configure.in +--- nrpe-2.15.orig/configure.in 2013-09-06 08:27:13.000000000 -0700 ++++ nrpe-2.15/configure.in 2014-04-19 09:20:50.406150828 -0700 +@@ -45,7 +45,7 @@ + AC_HEADER_STDC + AC_HEADER_TIME + AC_HEADER_SYS_WAIT +-AC_CHECK_HEADERS(ctype.h dirent.h errno.h fcntl.h getopt.h grp.h inttypes.h netdb.h pwd.h signal.h stdint.h strings.h string.h syslog.h tcpd.h unistd.h arpa/inet.h netinet/in.h socket.h sys/types.h sys/time.h sys/resource.h sys/wait.h sys/socket.h sys/stat.h) ++AC_CHECK_HEADERS(ctype.h dirent.h errno.h fcntl.h getopt.h grp.h inttypes.h netdb.h pwd.h signal.h stdint.h strings.h string.h syslog.h unistd.h arpa/inet.h netinet/in.h socket.h sys/types.h sys/time.h sys/resource.h sys/wait.h sys/socket.h sys/stat.h) + + dnl Checks for typedefs, structures, and compiler characteristics. + AC_C_CONST +@@ -164,11 +164,20 @@ + AC_CHECK_LIB(nsl,main,SOCKETLIBS="$SOCKETLIBS -lnsl") + AC_CHECK_LIB(socket,socket,SOCKETLIBS="$SOCKETLIBS -lsocket") + AC_SUBST(SOCKETLIBS) +-AC_CHECK_LIB(wrap,main,[ +- LIBWRAPLIBS="$LIBWRAPLIBS -lwrap" ++ ++AC_ARG_ENABLE([tcp-wrapper], ++ AS_HELP_STRING([--disable-tcp-wrapper], [Disable building with TCP wrappers. *** DISABLING IS A SECURITY RISK! *** Read the SECURITY file before using this option! @<:@default=enable@:>@])) ++ ++LIBWRAPLIBS="" ++AS_IF([test "x$enable_tcp_wrapper" != "xno"], [ ++ AC_CHECK_LIB([wrap],[hosts_access],[ ++ LIBWRAPLIBS="$LIBWRAPLIBS -lwrap" + AC_DEFINE(HAVE_LIBWRAP,[1],[Have the TCP wrappers library]) +- ]) ++ AC_DEFINE(HAVE_TCPD_H,[1],[Have the TCP wrappers library]) ++ ]) ++]) + AC_SUBST(LIBWRAPLIBS) ++ + AC_CHECK_FUNCS(strdup strstr strtoul initgroups closesocket) + + dnl socklen_t check - from curl +@@ -440,8 +449,11 @@ + AC_SUBST(TARGET_PLATFORM) + + AC_ARG_ENABLE([command-args], +- AS_HELP_STRING([--enable-command-args],[allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option!]), +- AC_DEFINE_UNQUOTED(ENABLE_COMMAND_ARGUMENTS,[1],[Enable command-line arguments])) ++ AS_HELP_STRING([--enable-command-args],[allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option!])) ++ ++AS_IF([test "x$enable_command_args" = "xyes"], [ ++ AC_DEFINE(ENABLE_COMMAND_ARGUMENTS,[1],[Enable command-line arguments]) ++]) + + AC_ARG_ENABLE([bash-command-substitution], + AS_HELP_STRING([--enable-bash-command-substitution],[allows clients to pass bash command substitutions of the form $(command). *** THIS IS A HIGH SECURITY RISK! *** Read the SECURITY file before using this option!]), diff --git a/net-analyzer/nrpe/files/nrpe.init b/net-analyzer/nrpe/files/nrpe.init new file mode 100644 index 00000000000..b1f343070eb --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe.init @@ -0,0 +1,50 @@ +#!/sbin/runscript +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +: ${CFGFILE:=/etc/nagios/nrpe.cfg} + +get_config() { + [ -f ${CFGFILE} ] || return 1 + + sed -n -e 's:^[ \t]*'$1'=\([^#]\+\).*:\1:p' \ + ${CFGFILE} +} + +extra_started_commands="reload" + +command=/usr/libexec/${SVCNAME} +command_args="-c ${CFGFILE} --daemon" +pidfile=$(get_config pid_file) + +depend() { + config ${CFGFILE} +} + +reload() { + ebegin "Reloading ${SVCNAME}" + kill -1 `cat ${pidfile}` + eend $? +} + +start() +{ + mkdir -p $(dirname $pidfile) + local _background= + ebegin "Starting ${name:-$RC_SVCNAME}" + eval start-stop-daemon --start \ + --exec $command \ + ${procname:+--name} $procname \ + ${pidfile:+--pidfile} $pidfile \ + $_background $start_stop_daemon_args \ + -- $command_args + if eend $? "Failed to start $RC_SVCNAME"; then + service_set_value "command" "${command}" + [ -n "${pidfile}" ] && service_set_value "pidfile" "${pidfile}" + [ -n "${procname}" ] && service_set_value "procname" "${procname}" + return 0 + fi + return 1 +} + diff --git a/net-analyzer/nrpe/files/nrpe.service b/net-analyzer/nrpe/files/nrpe.service new file mode 100644 index 00000000000..f6546d703cd --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe.service @@ -0,0 +1,11 @@ +[Unit] +Description=Daemon to answer plugin requests from Nagios on remote hosts +After=network.target +Requires=network.target + +[Service] +Type=forking +ExecStart=/usr/libexec/nrpe -c /etc/nagios/nrpe.cfg -d + +[Install] +WantedBy=multi-user.target diff --git a/net-analyzer/nrpe/files/nrpe.xinetd.2 b/net-analyzer/nrpe/files/nrpe.xinetd.2 new file mode 100644 index 00000000000..dd0331a8814 --- /dev/null +++ b/net-analyzer/nrpe/files/nrpe.xinetd.2 @@ -0,0 +1,11 @@ +service nrpe { + socket_type = stream + protocol = tcp + wait = no + user = nagios + group = nagios + server = /usr/libexec/nrpe + server_args = -c /etc/nagios/nrpe.cfg --inetd +# only_from = 127.0.0.1 + disabled = yes +} diff --git a/net-analyzer/nrpe/metadata.xml b/net-analyzer/nrpe/metadata.xml new file mode 100644 index 00000000000..144670b5c30 --- /dev/null +++ b/net-analyzer/nrpe/metadata.xml @@ -0,0 +1,22 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> + <herd>sysadmin</herd> + <longdescription> + A daemon for allowing Nagios to connect directly to servers and + execute commands defined in a centralized configuration file. + </longdescription> + <use> + <flag name="command-args"> + Build support for specifying the command-line arguments from the + Nagios/Icinga master. Make sure you understand the implications + of this flag as it can be a security risk. + </flag> + <flag name="minimal"> + Only build the check plugins for Nagios/Icinga, and not the daemon. + </flag> + </use> + <upstream> + <remote-id type="sourceforge">nagios</remote-id> + </upstream> +</pkgmetadata> diff --git a/net-analyzer/nrpe/nrpe-2.15-r1.ebuild b/net-analyzer/nrpe/nrpe-2.15-r1.ebuild new file mode 100644 index 00000000000..4da68381e20 --- /dev/null +++ b/net-analyzer/nrpe/nrpe-2.15-r1.ebuild @@ -0,0 +1,127 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 +inherit eutils systemd toolchain-funcs multilib user autotools + +DESCRIPTION="Nagios Remote Plugin Executor" +HOMEPAGE="http://www.nagios.org/" +SRC_URI="mirror://sourceforge/nagios/${P}.tar.gz" + +LICENSE="GPL-2+" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~ppc64 ~sparc ~x86" +IUSE="command-args ssl tcpd minimal" + +DEPEND="ssl? ( dev-libs/openssl ) + !minimal? ( tcpd? ( sys-apps/tcp-wrappers ) )" +RDEPEND="${DEPEND} + !minimal? ( >=net-analyzer/nagios-plugins-1.3.0 )" + +pkg_setup() { + enewgroup nagios + enewuser nagios -1 /bin/bash /dev/null nagios + + elog "If you plan to use \"nrpe_check_control\" then you may want to specify" + elog "different command and services files. You can override the defaults" + elog "through the \"NAGIOS_COMMAND_FILE\" and \"NAGIOS_SERVICES_FILE\" environment variables." + elog "NAGIOS_COMMAND_FILE=${NAGIOS_COMMAND_FILE:-/var/rw/nagios.cmd}" + elog "NAGIOS_SERVICES_FILE=${NAGIOS_SERVICES_FILE:-/etc/services.cfg}" +} + +src_prepare() { + # Add support for large output, + # http://opsview-blog.opsera.com/dotorg/2008/08/enhancing-nrpe.html + epatch "${FILESDIR}"/${PN}-2.14-multiline.patch + # fix configure, among others #326367, #397603 + epatch "${FILESDIR}"/${PN}-2.15-tcpd-et-al.patch + # otherwise autoconf will overwrite the custom include/config.h.in + epatch "${FILESDIR}"/${PN}-2.15-autoconf-header.patch + # improve handling of metachars for security + epatch "${FILESDIR}"/${PN}-2.15-metachar-security-fix.patch + + sed -i -e '/define \(COMMAND\|SERVICES\)_FILE/d' contrib/nrpe_check_control.c || die + + # change the default location of the pid file + sed -i -e '/pid_file/s:/var/run:/run:' sample-config/nrpe.cfg.in || die + + # fix TFU handling of autoheader + sed -i -e '/#undef/d' include/config.h.in || die + + eautoreconf +} + +src_configure() { + local myconf + if use minimal; then + myconf="--disable-tcp-wrapper --disable-command-args" + else + myconf="$(use_enable tcpd tcp-wrapper) $(use_enable command-args)" + fi + + econf \ + --libexecdir=/usr/$(get_libdir)/nagios/plugins \ + --localstatedir=/var/nagios \ + --sysconfdir=/etc/nagios \ + --with-nrpe-user=nagios \ + --with-nrpe-group=nagios \ + $(use_enable ssl) \ + ${myconf} +} + +src_compile() { + emake -C src check_nrpe $(use minimal || echo nrpe) + + # Add nifty nrpe check tool + $(tc-getCC) ${CPPFLAGS} ${CFLAGS} \ + -DCOMMAND_FILE=\"${NAGIOS_COMMAND_FILE:-/var/rw/nagios.cmd}\" \ + -DSERVICES_FILE=\"${NAGIOS_SERVICES_FILE:-/etc/services.cfg}\" \ + ${LDFLAGS} -o nrpe_check_control contrib/nrpe_check_control.c || die +} + +src_install() { + dodoc LEGAL Changelog README SECURITY \ + contrib/README.nrpe_check_control \ + $(use ssl && echo README.SSL) + + exeinto /usr/$(get_libdir)/nagios/plugins + doexe src/check_nrpe nrpe_check_control + + use minimal && return 0 + + ## NON-MINIMAL INSTALL FOLLOWS ## + + insinto /etc/nagios + newins sample-config/nrpe.cfg nrpe.cfg + fowners root:nagios /etc/nagios/nrpe.cfg + fperms 0640 /etc/nagios/nrpe.cfg + + exeinto /usr/libexec + doexe src/nrpe + + newinitd "${FILESDIR}"/nrpe.init nrpe + systemd_dounit "${FILESDIR}/${PN}.service" + + insinto /etc/xinetd.d/ + newins "${FILESDIR}/nrpe.xinetd.2" nrpe + + if use tcpd; then + sed -i -e '/^reload()/, /^}/ d' -e '/extra_started_commands/s:reload::' \ + "${D}"/etc/init.d/nrpe + fi +} + +pkg_postinst() { + elog "If you are using the nrpe daemon, remember to edit" + elog "the config file /etc/nagios/nrpe.cfg" + + if use command-args ; then + ewarn "" + ewarn "You have enabled command-args for NRPE. This enables" + ewarn "the ability for clients to supply arguments to commands" + ewarn "which should be run. " + ewarn "THIS IS CONSIDERED A SECURITY RISK!" + ewarn "Please read /usr/share/doc/${PF}/SECURITY.bz2 for more info" + fi +} diff --git a/net-analyzer/nrpe/nrpe-2.15-r2.ebuild b/net-analyzer/nrpe/nrpe-2.15-r2.ebuild new file mode 100644 index 00000000000..b1bffa06e70 --- /dev/null +++ b/net-analyzer/nrpe/nrpe-2.15-r2.ebuild @@ -0,0 +1,129 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 +inherit eutils systemd toolchain-funcs multilib user autotools + +DESCRIPTION="Nagios Remote Plugin Executor" +HOMEPAGE="http://www.nagios.org/" +SRC_URI="mirror://sourceforge/nagios/${P}.tar.gz" + +LICENSE="GPL-2+" +SLOT="0" +KEYWORDS="alpha amd64 hppa ppc ppc64 sparc x86" +IUSE="command-args ssl tcpd minimal" + +DEPEND="ssl? ( dev-libs/openssl ) + !minimal? ( tcpd? ( sys-apps/tcp-wrappers ) )" +RDEPEND="${DEPEND} + !minimal? ( + || ( net-analyzer/nagios-plugins net-analyzer/monitoring-plugins ) + )" + +pkg_setup() { + enewgroup nagios + enewuser nagios -1 /bin/bash /dev/null nagios + + elog "If you plan to use \"nrpe_check_control\" then you may want to specify" + elog "different command and services files. You can override the defaults" + elog "through the \"NAGIOS_COMMAND_FILE\" and \"NAGIOS_SERVICES_FILE\" environment variables." + elog "NAGIOS_COMMAND_FILE=${NAGIOS_COMMAND_FILE:-/var/rw/nagios.cmd}" + elog "NAGIOS_SERVICES_FILE=${NAGIOS_SERVICES_FILE:-/etc/services.cfg}" +} + +src_prepare() { + # Add support for large output, + # http://opsview-blog.opsera.com/dotorg/2008/08/enhancing-nrpe.html + epatch "${FILESDIR}"/${PN}-2.14-multiline.patch + # fix configure, among others #326367, #397603 + epatch "${FILESDIR}"/${PN}-2.15-tcpd-et-al.patch + # otherwise autoconf will overwrite the custom include/config.h.in + epatch "${FILESDIR}"/${PN}-2.15-autoconf-header.patch + # improve handling of metachars for security + epatch "${FILESDIR}"/${PN}-2.15-metachar-security-fix.patch + + sed -i -e '/define \(COMMAND\|SERVICES\)_FILE/d' contrib/nrpe_check_control.c || die + + # change the default location of the pid file + sed -i -e '/pid_file/s:/var/run:/run:' sample-config/nrpe.cfg.in || die + + # fix TFU handling of autoheader + sed -i -e '/#undef/d' include/config.h.in || die + + eautoreconf +} + +src_configure() { + local myconf + if use minimal; then + myconf="--disable-tcp-wrapper --disable-command-args" + else + myconf="$(use_enable tcpd tcp-wrapper) $(use_enable command-args)" + fi + + econf \ + --libexecdir=/usr/$(get_libdir)/nagios/plugins \ + --localstatedir=/var/nagios \ + --sysconfdir=/etc/nagios \ + --with-nrpe-user=nagios \ + --with-nrpe-group=nagios \ + $(use_enable ssl) \ + ${myconf} +} + +src_compile() { + emake -C src check_nrpe $(use minimal || echo nrpe) + + # Add nifty nrpe check tool + $(tc-getCC) ${CPPFLAGS} ${CFLAGS} \ + -DCOMMAND_FILE=\"${NAGIOS_COMMAND_FILE:-/var/rw/nagios.cmd}\" \ + -DSERVICES_FILE=\"${NAGIOS_SERVICES_FILE:-/etc/services.cfg}\" \ + ${LDFLAGS} -o nrpe_check_control contrib/nrpe_check_control.c || die +} + +src_install() { + dodoc LEGAL Changelog README SECURITY \ + contrib/README.nrpe_check_control \ + $(use ssl && echo README.SSL) + + exeinto /usr/$(get_libdir)/nagios/plugins + doexe src/check_nrpe nrpe_check_control + + use minimal && return 0 + + ## NON-MINIMAL INSTALL FOLLOWS ## + + insinto /etc/nagios + newins sample-config/nrpe.cfg nrpe.cfg + fowners root:nagios /etc/nagios/nrpe.cfg + fperms 0640 /etc/nagios/nrpe.cfg + + exeinto /usr/libexec + doexe src/nrpe + + newinitd "${FILESDIR}"/nrpe.init nrpe + systemd_dounit "${FILESDIR}/${PN}.service" + + insinto /etc/xinetd.d/ + newins "${FILESDIR}/nrpe.xinetd.2" nrpe + + if use tcpd; then + sed -i -e '/^reload()/, /^}/ d' -e '/extra_started_commands/s:reload::' \ + "${D}"/etc/init.d/nrpe + fi +} + +pkg_postinst() { + elog "If you are using the nrpe daemon, remember to edit" + elog "the config file /etc/nagios/nrpe.cfg" + + if use command-args ; then + ewarn "" + ewarn "You have enabled command-args for NRPE. This enables" + ewarn "the ability for clients to supply arguments to commands" + ewarn "which should be run. " + ewarn "THIS IS CONSIDERED A SECURITY RISK!" + ewarn "Please read /usr/share/doc/${PF}/SECURITY.bz2 for more info" + fi +} diff --git a/net-analyzer/nrpe/nrpe-2.15.ebuild b/net-analyzer/nrpe/nrpe-2.15.ebuild new file mode 100644 index 00000000000..51046f67603 --- /dev/null +++ b/net-analyzer/nrpe/nrpe-2.15.ebuild @@ -0,0 +1,127 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=4 + +inherit eutils toolchain-funcs multilib user autotools + +DESCRIPTION="Nagios Remote Plugin Executor" +HOMEPAGE="http://www.nagios.org/" +SRC_URI="mirror://sourceforge/nagios/${P}.tar.gz" + +LICENSE="GPL-2+" +SLOT="0" +KEYWORDS="alpha amd64 hppa ppc ppc64 sparc x86" +IUSE="command-args ssl tcpd minimal" + +DEPEND="ssl? ( dev-libs/openssl ) + !minimal? ( tcpd? ( sys-apps/tcp-wrappers ) )" +RDEPEND="${DEPEND} + !minimal? ( >=net-analyzer/nagios-plugins-1.3.0 )" + +pkg_setup() { + enewgroup nagios + enewuser nagios -1 /bin/bash /dev/null nagios + + elog "If you plan to use \"nrpe_check_control\" then you may want to specify" + elog "different command and services files. You can override the defaults" + elog "through the \"NAGIOS_COMMAND_FILE\" and \"NAGIOS_SERVICES_FILE\" environment variables." + elog "NAGIOS_COMMAND_FILE=${NAGIOS_COMMAND_FILE:-/var/rw/nagios.cmd}" + elog "NAGIOS_SERVICES_FILE=${NAGIOS_SERVICES_FILE:-/etc/services.cfg}" +} + +src_prepare() { + # Add support for large output, + # http://opsview-blog.opsera.com/dotorg/2008/08/enhancing-nrpe.html + epatch "${FILESDIR}"/${PN}-2.14-multiline.patch + # fix configure, among others #326367, #397603 + epatch "${FILESDIR}"/${PN}-2.15-tcpd-et-al.patch + # otherwise autoconf will overwrite the custom include/config.h.in + epatch "${FILESDIR}"/${PN}-2.15-autoconf-header.patch + # improve handling of metachars for security + epatch "${FILESDIR}"/${PN}-2.15-metachar-security-fix.patch + + sed -i -e '/define \(COMMAND\|SERVICES\)_FILE/d' contrib/nrpe_check_control.c || die + + # change the default location of the pid file + sed -i -e '/pid_file/s:/var/run:/run:' sample-config/nrpe.cfg.in || die + + # fix TFU handling of autoheader + sed -i -e '/#undef/d' include/config.h.in || die + + eautoreconf +} + +src_configure() { + local myconf + if use minimal; then + myconf="--disable-tcp-wrapper --disable-command-args" + else + myconf="$(use_enable tcpd tcp-wrapper) $(use_enable command-args)" + fi + + econf \ + --libexecdir=/usr/$(get_libdir)/nagios/plugins \ + --localstatedir=/var/nagios \ + --sysconfdir=/etc/nagios \ + --with-nrpe-user=nagios \ + --with-nrpe-group=nagios \ + $(use_enable ssl) \ + ${myconf} +} + +src_compile() { + emake -C src check_nrpe $(use minimal || echo nrpe) + + # Add nifty nrpe check tool + $(tc-getCC) ${CPPFLAGS} ${CFLAGS} \ + -DCOMMAND_FILE=\"${NAGIOS_COMMAND_FILE:-/var/rw/nagios.cmd}\" \ + -DSERVICES_FILE=\"${NAGIOS_SERVICES_FILE:-/etc/services.cfg}\" \ + ${LDFLAGS} -o nrpe_check_control contrib/nrpe_check_control.c || die +} + +src_install() { + dodoc LEGAL Changelog README SECURITY \ + contrib/README.nrpe_check_control \ + $(use ssl && echo README.SSL) + + exeinto /usr/$(get_libdir)/nagios/plugins + doexe src/check_nrpe nrpe_check_control + + use minimal && return 0 + + ## NON-MINIMAL INSTALL FOLLOWS ## + + insinto /etc/nagios + newins sample-config/nrpe.cfg nrpe.cfg + fowners root:nagios /etc/nagios/nrpe.cfg + fperms 0640 /etc/nagios/nrpe.cfg + + exeinto /usr/libexec + doexe src/nrpe + + newinitd "${FILESDIR}"/nrpe.init nrpe + + insinto /etc/xinetd.d/ + newins "${FILESDIR}/nrpe.xinetd.2" nrpe + + if use tcpd; then + sed -i -e '/^reload()/, /^}/ d' -e '/extra_started_commands/s:reload::' \ + "${D}"/etc/init.d/nrpe + fi +} + +pkg_postinst() { + elog "If you are using the nrpe daemon, remember to edit" + elog "the config file /etc/nagios/nrpe.cfg" + + if use command-args ; then + ewarn "" + ewarn "You have enabled command-args for NRPE. This enables" + ewarn "the ability for clients to supply arguments to commands" + ewarn "which should be run. " + ewarn "THIS IS CONSIDERED A SECURITY RISK!" + ewarn "Please read /usr/share/doc/${PF}/SECURITY.bz2 for more info" + fi +} |