Bug#611914: [Pkg-nagios-devel] Bug#611914: nagios-plugins-basic: check_smtp blindly sends HELO no matter how the server responds to connection

[Jan Wagner]

Hi Daniel,

thanks for taking the time reporting the bug.

On Thursday, 3. February 2011, Daniel Piddock wrote:
 The check_smtp program will blindly send a EHLO/HELO line after getting
 a connection message without paying attention to the response code. If
 the response code indicated a non-OK state, check_smtp should handle it
 cleanly instead of falling over later with recv() failed and quitting
 with WARNING code.

Indeed. I was going into contact with upstream about it and the problem should 
be fixed[1]. I included the patch into our package.

 This is an edge use case. I want to monitor a smtp server that returns
 451 local error after connecting.
 
 Patch attached checks that the response does not contain 220 before
 comparing against any -e argument. If -e does not match, print a message
 and set return code to WARNING. Either way, return and don't send more
 data to the server.

You patch looks a bit weird about that and I won't adopt that into our 
package. It would be nice if you could send you feature request upstream[2].

Many thanks, Jan.
[1] 
http://nagiosplug.git.sourceforge.net/git/gitweb.cgi?p=nagiosplug/nagiosplug;a=commitdiff_plain;h=d16f3fb0a9bb37cc1ce73ef14b5de83e907ef23c
[2] http://sourceforge.net/tracker/?group_id=29880atid=397600
-- 
Never write mail to w...@spamfalle.info, you have been warned!
-BEGIN GEEK CODE BLOCK-
Version: 3.12
GIT d-- s+: a C+++ UL P+ L+++ E--- W+++ N+++ o++ K++ w--- O M V- PS PE Y++
PGP++ t-- 5 X R tv- b+ DI D+ G++ e++ h r+++ y 
--END GEEK CODE BLOCK--


signature.asc
Description: This is a digitally signed message part.

Bug#611914: nagios-plugins-basic: check_smtp blindly sends HELO no matter how the server responds to connection

[Daniel Piddock]

Package: nagios-plugins-basic
Version: 1.4.15-3~bpo50+2
Severity: normal
Tags: patch

The check_smtp program will blindly send a EHLO/HELO line after getting
a connection message without paying attention to the response code. If
the response code indicated a non-OK state, check_smtp should handle it
cleanly instead of falling over later with recv() failed and quitting
with WARNING code.

This is an edge use case. I want to monitor a smtp server that returns
451 local error after connecting.

Patch attached checks that the response does not contain 220 before
comparing against any -e argument. If -e does not match, print a message
and set return code to WARNING. Either way, return and don't send more
data to the server.

-- System Information:
Debian Release: 5.0.8
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages nagios-plugins-basic depends on:
ii  iputils-ping 3:20071127-1+lenny1 Tools to test the
reachability of
ii  libc62.7-18lenny7GNU C Library: Shared libraries
ii  libssl0.9.8  0.9.8g-15+lenny11   SSL shared libraries
ii  procps   1:3.2.7-11  /proc file system utilities
ii  ucf  3.0016  Update Configuration File:
preserv

nagios-plugins-basic recommends no packages.

Versions of packages nagios-plugins-basic suggests:
ii  nagios3   3.0.6-4~lenny2 A host/service/network
monitoring

-- no debconf information

-- 
Daniel Piddock, Systems Administrator, CoreFiling Limited
http://www.corefiling.com
diff -ru nagios-plugins-1.4.15/plugins/check_smtp.c mine/plugins/check_smtp.c
--- nagios-plugins-1.4.15/plugins/check_smtp.c  2010-07-27 21:47:16.0 
+0100
+++ mine/plugins/check_smtp.c   2011-02-03 16:17:29.0 +
@@ -190,14 +190,19 @@
printf (%s, buffer);
/* strip the buffer of carriage returns */
strip (buffer);
-   /* make sure we find the response we are looking for */
-   if (!strstr (buffer, server_expect)) {
-   if (server_port == SMTP_PORT)
-   printf (_(Invalid SMTP response 
received from host: %s\n), buffer);
-   else
-   printf (_(Invalid SMTP response 
received from host on port %d: %s\n),
-   
server_port, buffer);
-   result = STATE_WARNING;
+   /* make sure we got a valid connect response */
+   if (!strstr (buffer, 220)) {
+   /* make sure we find the response we are 
looking for */
+   if (!strstr (buffer, server_expect)) {
+   if (server_port == SMTP_PORT)
+   printf (_(Invalid SMTP 
response received from host: %s\n), buffer);
+   else
+   printf (_(Invalid SMTP 
response received from host on port %d: %s\n),
+   
server_port, buffer);
+   result = STATE_WARNING;
+   }
+   /* Failed to connect, so bail */
+   return result;
}
}