Fix check_radius returning OK on unexpected results

REJECT_RC is defined on some radiusclient versions and differenciates
between auth errors and bad responses. This patch will affect only the
behaviour of those clients exporting REJECT_RC.

In addition, unexpected return codes are now handled properly and
return UNKNOWN.

3 files changed, 14 insertions, 2 deletions

diff --git a/NEWS b/NEWS
index b698768f..8a11b321 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ This file documents the major additions and syntax changes between releases.
         Fix check_disk_smb and check_ircd failures when run via ePN
         check_ldap now allows for specifying an empty LDAP base
         Fix compilation error of pst3 in Solaris 8
+        Fix check_radius returning OK on unexpected results (Craig Leres - #2911752)
         WARNINGS
         Updated developer documentation to say that performance labels should not have an equals sign or
         single quote in the label
diff --git a/THANKS.in b/THANKS.in
index f62a4d8e..0b1dab6c 100644
--- a/THANKS.in
+++ b/THANKS.in
@@ -263,3 +263,4 @@ Konstantin Khomoutov
 Josip Rodin
 Dann Frazier
 Stephane Chazelas
+Craig Leres
diff --git a/plugins/check_radius.c b/plugins/check_radius.c
index 37176257..b2f5732c 100644
--- a/plugins/check_radius.c
+++ b/plugins/check_radius.c
@@ -63,6 +63,13 @@ void print_usage (void);
 #define my_rc_avpair_add(a,b,c,d) rc_avpair_add(a, b, c, d)
 #define my_rc_read_dictionary(a) rc_read_dictionary(a)
 #endif
+
+/* REJECT_RC is only defined in some version of radiusclient. It has
+ * been reported from radiusclient-ng 0.5.6 on FreeBSD 7.2-RELEASE */
+#ifndef REJECT_RC
+#define REJECT_RC BADRESP_RC
+#endif
+
 int my_rc_read_config(char *);
 
 char *server = NULL;
@@ -195,13 +202,16 @@ main (int argc, char **argv)
                 die (STATE_CRITICAL, _("Timeout"));
         if (result == ERROR_RC)
                 die (STATE_CRITICAL, _("Auth Error"));
-        if (result == BADRESP_RC)
+        if (result == REJECT_RC)
                 die (STATE_WARNING, _("Auth Failed"));
+        if (result == BADRESP_RC)
+                die (STATE_WARNING, _("Bad Response"));
         if (expect && !strstr (msg, expect))
                 die (STATE_WARNING, "%s", msg);
         if (result == OK_RC)
                 die (STATE_OK, _("Auth OK"));
-        return (0);
+        (void)snprintf(msg, sizeof(msg), _("Unexpected result code %d"), result);
+        die (STATE_UNKNOWN, msg);
 }