diff options
author | Lorenz Kästle <12514511+RincewindsHat@users.noreply.github.com> | 2023-10-13 19:19:09 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-10-13 19:19:09 +0200 |
commit | 60bdbe5f9ef2c853e4ae214ce61bedc0d880bd2e (patch) | |
tree | 8a4f5e2f2f28976f80ba9b5e68dd19ba917e35f4 /plugins-root | |
parent | bf70f5f847e3407af572d1768cca747af270b993 (diff) | |
parent | b6d3acf5e3f685d6048905d4bef84ebfbb9f4815 (diff) | |
download | monitoring-plugins-60bdbe5f9ef2c853e4ae214ce61bedc0d880bd2e.tar.gz |
Merge pull request #1906 from monitoring-plugins/check_dhcp_rogue_detection
check_dhcp: merged patch from #752
Diffstat (limited to 'plugins-root')
-rw-r--r-- | plugins-root/check_dhcp.c | 43 |
1 files changed, 34 insertions, 9 deletions
diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c index 0ddace5b..5ba9372e 100644 --- a/plugins-root/check_dhcp.c +++ b/plugins-root/check_dhcp.c | |||
@@ -150,6 +150,7 @@ typedef struct dhcp_offer_struct{ | |||
150 | uint32_t lease_time; /* lease time in seconds */ | 150 | uint32_t lease_time; /* lease time in seconds */ |
151 | uint32_t renewal_time; /* renewal time in seconds */ | 151 | uint32_t renewal_time; /* renewal time in seconds */ |
152 | uint32_t rebinding_time; /* rebinding time in seconds */ | 152 | uint32_t rebinding_time; /* rebinding time in seconds */ |
153 | bool desired; /* is this offer desired (necessary in exclusive mode) */ | ||
153 | struct dhcp_offer_struct *next; | 154 | struct dhcp_offer_struct *next; |
154 | }dhcp_offer; | 155 | }dhcp_offer; |
155 | 156 | ||
@@ -192,7 +193,8 @@ typedef struct requested_server_struct{ | |||
192 | #define ETHERNET_HARDWARE_ADDRESS 1 /* used in htype field of dhcp packet */ | 193 | #define ETHERNET_HARDWARE_ADDRESS 1 /* used in htype field of dhcp packet */ |
193 | #define ETHERNET_HARDWARE_ADDRESS_LENGTH 6 /* length of Ethernet hardware addresses */ | 194 | #define ETHERNET_HARDWARE_ADDRESS_LENGTH 6 /* length of Ethernet hardware addresses */ |
194 | 195 | ||
195 | uint8_t unicast = 0; /* unicast mode: mimic a DHCP relay */ | 196 | bool unicast = false; /* unicast mode: mimic a DHCP relay */ |
197 | bool exclusive = false; /* exclusive mode aka "rogue DHCP server detection" */ | ||
196 | struct in_addr my_ip; /* our address (required for relay) */ | 198 | struct in_addr my_ip; /* our address (required for relay) */ |
197 | struct in_addr dhcp_ip; /* server to query (if in unicast mode) */ | 199 | struct in_addr dhcp_ip; /* server to query (if in unicast mode) */ |
198 | unsigned char client_hardware_address[MAX_DHCP_CHADDR_LENGTH]=""; | 200 | unsigned char client_hardware_address[MAX_DHCP_CHADDR_LENGTH]=""; |
@@ -894,6 +896,7 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){ | |||
894 | new_offer->lease_time=dhcp_lease_time; | 896 | new_offer->lease_time=dhcp_lease_time; |
895 | new_offer->renewal_time=dhcp_renewal_time; | 897 | new_offer->renewal_time=dhcp_renewal_time; |
896 | new_offer->rebinding_time=dhcp_rebinding_time; | 898 | new_offer->rebinding_time=dhcp_rebinding_time; |
899 | new_offer->desired=false; /* exclusive mode: we'll check that in get_results */ | ||
897 | 900 | ||
898 | 901 | ||
899 | if(verbose){ | 902 | if(verbose){ |
@@ -939,7 +942,7 @@ int free_requested_server_list(void){ | |||
939 | 942 | ||
940 | /* gets state and plugin output to return */ | 943 | /* gets state and plugin output to return */ |
941 | int get_results(void){ | 944 | int get_results(void){ |
942 | dhcp_offer *temp_offer; | 945 | dhcp_offer *temp_offer, *undesired_offer=NULL; |
943 | requested_server *temp_server; | 946 | requested_server *temp_server; |
944 | int result; | 947 | int result; |
945 | uint32_t max_lease_time=0; | 948 | uint32_t max_lease_time=0; |
@@ -974,11 +977,19 @@ int get_results(void){ | |||
974 | if(!temp_server->answered){ | 977 | if(!temp_server->answered){ |
975 | requested_responses++; | 978 | requested_responses++; |
976 | temp_server->answered=true; | 979 | temp_server->answered=true; |
980 | temp_offer->desired=true; | ||
977 | } | 981 | } |
978 | } | 982 | } |
979 | } | 983 | } |
980 | } | 984 | } |
981 | 985 | ||
986 | /* exclusive mode: check for undesired offers */ | ||
987 | for(temp_offer=dhcp_offer_list;temp_offer!=NULL;temp_offer=temp_offer->next) { | ||
988 | if (!temp_offer->desired) { | ||
989 | undesired_offer=temp_offer; /* Checks only for the first undesired offer */ | ||
990 | break; /* no further checks needed */ | ||
991 | } | ||
992 | } | ||
982 | } | 993 | } |
983 | 994 | ||
984 | /* else check and see if we got our requested address from any server */ | 995 | /* else check and see if we got our requested address from any server */ |
@@ -1006,6 +1017,9 @@ int get_results(void){ | |||
1006 | else if(request_specific_address && !received_requested_address) | 1017 | else if(request_specific_address && !received_requested_address) |
1007 | result=STATE_WARNING; | 1018 | result=STATE_WARNING; |
1008 | 1019 | ||
1020 | if(exclusive && undesired_offer) | ||
1021 | result=STATE_CRITICAL; | ||
1022 | |||
1009 | if(result==0) /* garrett honeycutt 2005 */ | 1023 | if(result==0) /* garrett honeycutt 2005 */ |
1010 | printf("OK: "); | 1024 | printf("OK: "); |
1011 | else if(result==1) | 1025 | else if(result==1) |
@@ -1023,6 +1037,13 @@ int get_results(void){ | |||
1023 | 1037 | ||
1024 | printf(_("Received %d DHCPOFFER(s)"),valid_responses); | 1038 | printf(_("Received %d DHCPOFFER(s)"),valid_responses); |
1025 | 1039 | ||
1040 | |||
1041 | if(exclusive && undesired_offer){ | ||
1042 | printf(_(", Rogue DHCP Server detected! Server %s"),inet_ntoa(undesired_offer->server_address)); | ||
1043 | printf(_(" offered %s \n"),inet_ntoa(undesired_offer->offered_address)); | ||
1044 | return result; | ||
1045 | } | ||
1046 | |||
1026 | if(requested_servers>0) | 1047 | if(requested_servers>0) |
1027 | printf(_(", %s%d of %d requested servers responded"),((requested_responses<requested_servers) && requested_responses>0)?"only ":"",requested_responses,requested_servers); | 1048 | printf(_(", %s%d of %d requested servers responded"),((requested_responses<requested_servers) && requested_responses>0)?"only ":"",requested_responses,requested_servers); |
1028 | 1049 | ||
@@ -1065,16 +1086,16 @@ int call_getopt(int argc, char **argv){ | |||
1065 | {"interface", required_argument,0,'i'}, | 1086 | {"interface", required_argument,0,'i'}, |
1066 | {"mac", required_argument,0,'m'}, | 1087 | {"mac", required_argument,0,'m'}, |
1067 | {"unicast", no_argument, 0,'u'}, | 1088 | {"unicast", no_argument, 0,'u'}, |
1089 | {"exclusive", no_argument, 0,'x'}, | ||
1068 | {"verbose", no_argument, 0,'v'}, | 1090 | {"verbose", no_argument, 0,'v'}, |
1069 | {"version", no_argument, 0,'V'}, | 1091 | {"version", no_argument, 0,'V'}, |
1070 | {"help", no_argument, 0,'h'}, | 1092 | {"help", no_argument, 0,'h'}, |
1071 | {0,0,0,0} | 1093 | {0,0,0,0} |
1072 | }; | 1094 | }; |
1073 | 1095 | ||
1074 | while(1){ | 1096 | int c=0; |
1075 | int c=0; | 1097 | while(true){ |
1076 | 1098 | c=getopt_long(argc,argv,"+hVvxt:s:r:t:i:m:u",long_options,&option_index); | |
1077 | c=getopt_long(argc,argv,"+hVvt:s:r:t:i:m:u",long_options,&option_index); | ||
1078 | 1099 | ||
1079 | if(c==-1||c==EOF||c==1) | 1100 | if(c==-1||c==EOF||c==1) |
1080 | break; | 1101 | break; |
@@ -1121,7 +1142,10 @@ int call_getopt(int argc, char **argv){ | |||
1121 | break; | 1142 | break; |
1122 | 1143 | ||
1123 | case 'u': /* unicast testing */ | 1144 | case 'u': /* unicast testing */ |
1124 | unicast=1; | 1145 | unicast=true; |
1146 | break; | ||
1147 | case 'x': /* exclusive testing aka "rogue DHCP server detection" */ | ||
1148 | exclusive=true; | ||
1125 | break; | 1149 | break; |
1126 | 1150 | ||
1127 | case 'V': /* version */ | 1151 | case 'V': /* version */ |
@@ -1135,7 +1159,6 @@ int call_getopt(int argc, char **argv){ | |||
1135 | case 'v': /* verbose */ | 1159 | case 'v': /* verbose */ |
1136 | verbose=1; | 1160 | verbose=1; |
1137 | break; | 1161 | break; |
1138 | |||
1139 | case '?': /* help */ | 1162 | case '?': /* help */ |
1140 | usage5 (); | 1163 | usage5 (); |
1141 | break; | 1164 | break; |
@@ -1372,6 +1395,8 @@ void print_help(void){ | |||
1372 | printf (" %s\n", _("MAC address to use in the DHCP request")); | 1395 | printf (" %s\n", _("MAC address to use in the DHCP request")); |
1373 | printf (" %s\n", "-u, --unicast"); | 1396 | printf (" %s\n", "-u, --unicast"); |
1374 | printf (" %s\n", _("Unicast testing: mimic a DHCP relay, requires -s")); | 1397 | printf (" %s\n", _("Unicast testing: mimic a DHCP relay, requires -s")); |
1398 | printf (" %s\n", "-x, --exclusive"); | ||
1399 | printf (" %s\n", _("Only requested DHCP server may response (rogue DHCP server detection), requires -s")); | ||
1375 | 1400 | ||
1376 | printf (UT_SUPPORT); | 1401 | printf (UT_SUPPORT); |
1377 | return; | 1402 | return; |
@@ -1382,7 +1407,7 @@ void | |||
1382 | print_usage(void){ | 1407 | print_usage(void){ |
1383 | 1408 | ||
1384 | printf ("%s\n", _("Usage:")); | 1409 | printf ("%s\n", _("Usage:")); |
1385 | printf (" %s [-v] [-u] [-s serverip] [-r requestedip] [-t timeout]\n",progname); | 1410 | printf (" %s [-v] [-u] [-x] [-s serverip] [-r requestedip] [-t timeout]\n",progname); |
1386 | printf (" [-i interface] [-m mac]\n"); | 1411 | printf (" [-i interface] [-m mac]\n"); |
1387 | 1412 | ||
1388 | return; | 1413 | return; |