monit-5.21.0/ 0000755 0001751 0001751 00000000000 13057552763 012652 5 ustar martinp martinp monit-5.21.0/src/ 0000755 0001751 0001751 00000000000 13057552763 013441 5 ustar martinp martinp monit-5.21.0/src/http/ 0000755 0001751 0001751 00000000000 13057552676 014423 5 ustar martinp martinp monit-5.21.0/src/http/base64.h 0000644 0001751 0001751 00000002261 13057552676 015661 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#ifndef BASE64_H
#define BASE64_H
#include "config.h"
size_t decode_base64(unsigned char *dest, const char *src);
char *encode_base64(size_t size, unsigned char *src);
#endif
monit-5.21.0/src/http/processor.h 0000644 0001751 0001751 00000006336 13057552676 016623 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#ifndef PROCESSOR_H
#define PROCESSOR_H
#include "config.h"
#include
#include "monit.h"
#include "net.h"
#include "socket.h"
#include "httpstatus.h"
/* Server masquerade */
#define SERVER_NAME "monit"
#define SERVER_VERSION VERSION
#define SERVER_URL "http://mmonit.com/monit/"
#define SERVER_PROTOCOL "HTTP/1.0"
#define DATEFMT "%a, %d %b %Y %H:%M:%S GMT"
/* Protocol methods supported */
#define METHOD_GET "GET"
#define METHOD_POST "POST"
/* Initial buffer sizes */
#define STRLEN 256
#define REQ_STRLEN 1024
#define RES_STRLEN 2048
#define MAX_URL_LENGTH 512
/* Request timeout in seconds */
#define REQUEST_TIMEOUT 30
struct entry {
char *name;
char *value;
/* For internal use */
struct entry *next;
};
typedef struct entry *HttpHeader;
typedef struct entry *HttpParameter;
typedef struct request {
char *url;
Socket_T S;
char *method;
char *protocol;
char *pathinfo;
char *remote_user;
HttpHeader headers;
HttpParameter params;
Ssl_T ssl;
} *HttpRequest;
typedef struct response {
int status;
Socket_T S;
const char *protocol;
boolean_t is_committed;
HttpHeader headers;
const char *status_msg;
StringBuffer_T outputbuffer;
MD_T token;
Ssl_T ssl;
} *HttpResponse;
/* Public prototypes */
void *http_processor(Socket_T);
char *get_headers(HttpResponse res);
void set_status(HttpResponse res, int status);
const char *get_status_string(int status_code);
void add_Impl(void(*doGet)(HttpRequest, HttpResponse), void(*doPost)(HttpRequest, HttpResponse));
void set_content_type(HttpResponse res, const char *mime);
const char *get_header(HttpRequest req, const char *header_name);
void escapeHTML(StringBuffer_T sb, const char *s);
void send_error(HttpRequest, HttpResponse, int status, const char *message, ...) __attribute__((format (printf, 4, 5)));
const char *get_parameter(HttpRequest req, const char *parameter_name);
void set_header(HttpResponse res, const char *name, const char *value, ...) __attribute__((format (printf, 3, 4)));
void Processor_setHttpPostLimit();
#endif
monit-5.21.0/src/http/base64.c 0000644 0001751 0001751 00000012713 13057552676 015657 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#include "config.h"
#ifdef HAVE_STDIO_H
#include
#endif
#ifdef HAVE_STDLIB_H
#include
#endif
#ifdef HAVE_STRING_H
#include
#endif
#include "monit.h"
#include "base64.h"
/**
* Implementation of base64 encoding/decoding.
*
* @file
*/
/* ----------------------------------------------------------------- Private */
/**
* Base64 encode one byte
*/
static char encode(unsigned char u) {
if (u < 26)
return 'A' + u;
if (u < 52)
return 'a' + (u - 26);
if (u < 62)
return '0' + (u - 52);
if (u == 62)
return '+';
return '/';
}
/**
* Decode a base64 character
*/
static unsigned char decode(char c) {
if (c >= 'A' && c <= 'Z')
return(c - 'A');
if (c >= 'a' && c <= 'z')
return(c - 'a' + 26);
if (c >= '0' && c <= '9')
return(c - '0' + 52);
if (c == '+')
return 62;
return 63;
}
/**
* Return true if 'c' is a valid base64 character, otherwise false
*/
static boolean_t is_base64(char c) {
return ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || (c == '+') || (c == '/') || (c == '=')) ? true : false;
}
/* ------------------------------------------------------------------ Public */
/**
* Base64 encode and return size data in 'src'. The caller must free the
* returned string.
* @param size The size of the data in src
* @param src The data to be base64 encode
* @return encoded string otherwise NULL
*/
char *encode_base64(size_t size, unsigned char *src) {
if (! src)
return NULL;
if (! size)
size = strlen((char *)src);
char *out = CALLOC(sizeof(char), size * 4 / 3 + 4);
char *p = out;
for (int i = 0; i < size; i += 3) {
unsigned char b1 = 0, b2 = 0, b3 = 0, b4 = 0, b5 = 0, b6 = 0, b7 = 0;
b1 = src[i];
if (i + 1 < size)
b2 = src[i + 1];
if (i + 2 < size)
b3 = src[i + 2];
b4 = b1 >> 2;
b5 = ((b1 & 0x3) << 4) | (b2 >> 4);
b6 = ((b2 & 0xf) << 2) | (b3 >> 6);
b7 = b3 & 0x3f;
*p++ = encode(b4);
*p++ = encode(b5);
if (i + 1 < size)
*p++ = encode(b6);
else
*p++ = '=';
if (i + 2 < size)
*p++ = encode(b7);
else
*p++ = '=';
}
return out;
}
/**
* Decode the base64 encoded string 'src' into the memory pointed to by
* 'dest'. The dest buffer is not NUL terminated.
* @param dest Pointer to memory for holding the decoded string.
* Must be large enough to recieve the decoded string.
* @param src A base64 encoded string.
* @return the length of the decoded string if decode
* succeeded otherwise 0.
*/
size_t decode_base64(unsigned char *dest, const char *src) {
if (src && *src) {
unsigned char *p = dest;
size_t k, l = strlen(src) + 1;
unsigned char *buf = CALLOC(1, l);
/* Ignore non base64 chars as per the POSIX standard */
for (k = 0, l = 0; src[k]; k++)
if (is_base64(src[k]))
buf[l++] = src[k];
for (k = 0; k < l; k += 4) {
char c1 = 'A', c2 = 'A', c3 = 'A', c4 = 'A';
unsigned char b1 = 0, b2 = 0, b3 = 0, b4 = 0;
c1 = buf[k];
if (k + 1 < l)
c2 = buf[k + 1];
if (k + 2 < l)
c3 = buf[k + 2];
if (k + 3 < l)
c4 = buf[k + 3];
b1 = decode(c1);
b2 = decode(c2);
b3 = decode(c3);
b4 = decode(c4);
*p++ = ((b1 << 2) | (b2 >> 4));
if (c3 != '=')
*p++ = (((b2&0xf) << 4) | (b3 >> 2));
if (c4 != '=')
*p++ = (((b3 & 0x3) << 6) | b4);
}
FREE(buf);
return (p - dest);
}
return 0;
}
monit-5.21.0/src/http/cervlet.c 0000644 0001751 0001751 00000444032 13057552676 016242 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#include "config.h"
#ifdef HAVE_STDIO_H
#include
#endif
#ifdef HAVE_STDLIB_H
#include
#endif
#ifdef HAVE_ERRNO_H
#include
#endif
#ifdef HAVE_SYS_TYPES_H
#include
#endif
#ifdef HAVE_SYS_SOCKET_H
#include
#endif
#ifdef HAVE_STRING_H
#include
#endif
#ifdef HAVE_STRINGS_H
#include
#endif
#ifdef HAVE_UNISTD_H
#include
#endif
#ifdef HAVE_SYS_STAT_H
#include
#endif
#ifdef HAVE_SYS_TIME_H
#include
#endif
#ifdef HAVE_CTYPE_H
#include
#endif
// libmonit
#include "system/Time.h"
#include "util/List.h"
#include "monit.h"
#include "cervlet.h"
#include "engine.h"
#include "processor.h"
#include "base64.h"
#include "event.h"
#include "alert.h"
#include "ProcessTree.h"
#include "device.h"
#include "protocol.h"
#include "Color.h"
#include "Box.h"
#define ACTION(c) ! strncasecmp(req->url, c, sizeof(c))
/* URL Commands supported */
#define HOME "/"
#define TEST "/_monit"
#define ABOUT "/_about"
#define PING "/_ping"
#define GETID "/_getid"
#define STATUS "/_status"
#define STATUS2 "/_status2"
#define SUMMARY "/_summary"
#define REPORT "/_report"
#define RUNTIME "/_runtime"
#define VIEWLOG "/_viewlog"
#define DOACTION "/_doaction"
#define FAVICON "/favicon.ico"
typedef enum {
TXT = 0,
HTML
} __attribute__((__packed__)) Output_Type;
/* Private prototypes */
static boolean_t is_readonly(HttpRequest);
static void printFavicon(HttpResponse);
static void doGet(HttpRequest, HttpResponse);
static void doPost(HttpRequest, HttpResponse);
static void do_head(HttpResponse res, const char *path, const char *name, int refresh);
static void do_foot(HttpResponse res);
static void do_home(HttpResponse);
static void do_home_system(HttpResponse);
static void do_home_filesystem(HttpResponse);
static void do_home_directory(HttpResponse);
static void do_home_file(HttpResponse);
static void do_home_fifo(HttpResponse);
static void do_home_net(HttpResponse);
static void do_home_process(HttpResponse);
static void do_home_program(HttpResponse);
static void do_home_host(HttpResponse);
static void do_about(HttpResponse);
static void do_ping(HttpResponse);
static void do_getid(HttpResponse);
static void do_runtime(HttpRequest, HttpResponse);
static void do_viewlog(HttpRequest, HttpResponse);
static void handle_service(HttpRequest, HttpResponse);
static void handle_service_action(HttpRequest, HttpResponse);
static void handle_doaction(HttpRequest, HttpResponse);
static void handle_runtime(HttpRequest, HttpResponse);
static void handle_runtime_action(HttpRequest, HttpResponse);
static void is_monit_running(HttpResponse);
static void do_service(HttpRequest, HttpResponse, Service_T);
static void print_alerts(HttpResponse, Mail_T);
static void print_buttons(HttpRequest, HttpResponse, Service_T);
static void print_service_rules_timeout(HttpResponse, Service_T);
static void print_service_rules_nonexistence(HttpResponse, Service_T);
static void print_service_rules_existence(HttpResponse, Service_T);
static void print_service_rules_port(HttpResponse, Service_T);
static void print_service_rules_socket(HttpResponse, Service_T);
static void print_service_rules_icmp(HttpResponse, Service_T);
static void print_service_rules_perm(HttpResponse, Service_T);
static void print_service_rules_uid(HttpResponse, Service_T);
static void print_service_rules_euid(HttpResponse, Service_T);
static void print_service_rules_gid(HttpResponse, Service_T);
static void print_service_rules_timestamp(HttpResponse, Service_T);
static void print_service_rules_fsflags(HttpResponse, Service_T);
static void print_service_rules_filesystem(HttpResponse, Service_T);
static void print_service_rules_size(HttpResponse, Service_T);
static void print_service_rules_linkstatus(HttpResponse, Service_T);
static void print_service_rules_linkspeed(HttpResponse, Service_T);
static void print_service_rules_linksaturation(HttpResponse, Service_T);
static void print_service_rules_uploadbytes(HttpResponse, Service_T);
static void print_service_rules_uploadpackets(HttpResponse, Service_T);
static void print_service_rules_downloadbytes(HttpResponse, Service_T);
static void print_service_rules_downloadpackets(HttpResponse, Service_T);
static void print_service_rules_uptime(HttpResponse, Service_T);
static void print_service_rules_content(HttpResponse, Service_T);
static void print_service_rules_checksum(HttpResponse, Service_T);
static void print_service_rules_pid(HttpResponse, Service_T);
static void print_service_rules_ppid(HttpResponse, Service_T);
static void print_service_rules_program(HttpResponse, Service_T);
static void print_service_rules_resource(HttpResponse, Service_T);
static void print_status(HttpRequest, HttpResponse, int);
static void print_summary(HttpRequest, HttpResponse);
static void _printReport(HttpRequest req, HttpResponse res);
static void status_service_txt(Service_T, HttpResponse);
static char *get_monitoring_status(Output_Type, Service_T s, char *, int);
static char *get_service_status(Output_Type, Service_T, char *, int);
/**
* Implementation of doGet and doPost routines used by the cervlet
* processor module. This particilary cervlet will provide
* information about the monit deamon and programs monitored by
* monit.
*
* @file
*/
/* ------------------------------------------------------------------ Public */
/**
* Callback hook to the Processor module for registering this modules
* doGet and doPost methods.
*/
void init_service() {
add_Impl(doGet, doPost);
}
/* ----------------------------------------------------------------- Private */
static char *_getUptime(time_t delta, char s[256]) {
static int min = 60;
static int hour = 3600;
static int day = 86400;
long rest_d;
long rest_h;
long rest_m;
char *p = s;
if (delta < 0) {
*s = 0;
} else {
if ((rest_d = delta / day) > 0) {
p += snprintf(p, 256 - (p - s), "%ldd ", rest_d);
delta -= rest_d * day;
}
if ((rest_h = delta / hour) > 0 || (rest_d > 0)) {
p += snprintf(p, 256 - (p - s), "%ldh ", rest_h);
delta -= rest_h * hour;
}
rest_m = delta / min;
snprintf(p, 256 - (p - s), "%ldm", rest_m);
}
return s;
}
static void _formatStatus(const char *name, Event_Type errorType, Output_Type type, HttpResponse res, Service_T s, boolean_t validValue, const char *value, ...) {
if (type == HTML) {
StringBuffer_append(res->outputbuffer, "
%c%s
", toupper(name[0]), name + 1);
} else {
StringBuffer_append(res->outputbuffer, " %-28s ", name);
}
if (! validValue) {
StringBuffer_append(res->outputbuffer, type == HTML ? "
This program is free software; you can redistribute it and/or "
"modify it under the terms of the GNU Affero General Public License version 3
"
"
This program is distributed in the hope that it will be useful, but "
"WITHOUT ANY WARRANTY; without even the implied warranty of "
"MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the "
""
"GNU AFFERO GENERAL PUBLIC LICENSE for more details.
", get_service_status(HTML, s, buf, sizeof(buf)));
for (ServiceGroup_T sg = servicegrouplist; sg; sg = sg->next)
for (list_t m = sg->members->head; m; m = m->next)
if (m->e == s)
StringBuffer_append(res->outputbuffer, "
", onrebootnames[s->onreboot]);
for (Dependant_T d = s->dependantlist; d; d = d->next) {
if (d->dependant != NULL) {
StringBuffer_append(res->outputbuffer,
"
");
if (r->events == Event_Null) {
StringBuffer_append(res->outputbuffer, "No events");
} else if (r->events == Event_All) {
StringBuffer_append(res->outputbuffer, "All events");
} else {
if (IS_EVENT_SET(r->events, Event_Action))
StringBuffer_append(res->outputbuffer, "Action ");
if (IS_EVENT_SET(r->events, Event_ByteIn))
StringBuffer_append(res->outputbuffer, "ByteIn ");
if (IS_EVENT_SET(r->events, Event_ByteOut))
StringBuffer_append(res->outputbuffer, "ByteOut ");
if (IS_EVENT_SET(r->events, Event_Checksum))
StringBuffer_append(res->outputbuffer, "Checksum ");
if (IS_EVENT_SET(r->events, Event_Connection))
StringBuffer_append(res->outputbuffer, "Connection ");
if (IS_EVENT_SET(r->events, Event_Content))
StringBuffer_append(res->outputbuffer, "Content ");
if (IS_EVENT_SET(r->events, Event_Data))
StringBuffer_append(res->outputbuffer, "Data ");
if (IS_EVENT_SET(r->events, Event_Exec))
StringBuffer_append(res->outputbuffer, "Exec ");
if (IS_EVENT_SET(r->events, Event_Exist))
StringBuffer_append(res->outputbuffer, "Exist ");
if (IS_EVENT_SET(r->events, Event_FsFlag))
StringBuffer_append(res->outputbuffer, "Fsflags ");
if (IS_EVENT_SET(r->events, Event_Gid))
StringBuffer_append(res->outputbuffer, "Gid ");
if (IS_EVENT_SET(r->events, Event_Instance))
StringBuffer_append(res->outputbuffer, "Instance ");
if (IS_EVENT_SET(r->events, Event_Invalid))
StringBuffer_append(res->outputbuffer, "Invalid ");
if (IS_EVENT_SET(r->events, Event_Link))
StringBuffer_append(res->outputbuffer, "Link ");
if (IS_EVENT_SET(r->events, Event_NonExist))
StringBuffer_append(res->outputbuffer, "Nonexist ");
if (IS_EVENT_SET(r->events, Event_Permission))
StringBuffer_append(res->outputbuffer, "Permission ");
if (IS_EVENT_SET(r->events, Event_PacketIn))
StringBuffer_append(res->outputbuffer, "PacketIn ");
if (IS_EVENT_SET(r->events, Event_PacketOut))
StringBuffer_append(res->outputbuffer, "PacketOut ");
if (IS_EVENT_SET(r->events, Event_Pid))
StringBuffer_append(res->outputbuffer, "PID ");
if (IS_EVENT_SET(r->events, Event_Icmp))
StringBuffer_append(res->outputbuffer, "Ping ");
if (IS_EVENT_SET(r->events, Event_PPid))
StringBuffer_append(res->outputbuffer, "PPID ");
if (IS_EVENT_SET(r->events, Event_Resource))
StringBuffer_append(res->outputbuffer, "Resource ");
if (IS_EVENT_SET(r->events, Event_Saturation))
StringBuffer_append(res->outputbuffer, "Saturation ");
if (IS_EVENT_SET(r->events, Event_Size))
StringBuffer_append(res->outputbuffer, "Size ");
if (IS_EVENT_SET(r->events, Event_Speed))
StringBuffer_append(res->outputbuffer, "Speed ");
if (IS_EVENT_SET(r->events, Event_Status))
StringBuffer_append(res->outputbuffer, "Status ");
if (IS_EVENT_SET(r->events, Event_Timeout))
StringBuffer_append(res->outputbuffer, "Timeout ");
if (IS_EVENT_SET(r->events, Event_Timestamp))
StringBuffer_append(res->outputbuffer, "Timestamp ");
if (IS_EVENT_SET(r->events, Event_Uid))
StringBuffer_append(res->outputbuffer, "Uid ");
if (IS_EVENT_SET(r->events, Event_Uptime))
StringBuffer_append(res->outputbuffer, "Uptime ");
}
StringBuffer_append(res->outputbuffer, "
");
if (r->reminder) {
StringBuffer_append(res->outputbuffer,
"
Alert reminder
%u cycles
",
r->reminder);
}
}
}
static void print_buttons(HttpRequest req, HttpResponse res, Service_T s) {
if (is_readonly(req)) {
// A read-only REMOTE_USER does not get access to these buttons
return;
}
StringBuffer_append(res->outputbuffer, "
");
/* Start program */
if (s->start)
StringBuffer_append(res->outputbuffer,
"
"
""
"
", s->name, res->token);
/* Stop program */
if (s->stop)
StringBuffer_append(res->outputbuffer,
"
"
""
"
", s->name, res->token);
/* Restart program */
if ((s->start && s->stop) || s->restart)
StringBuffer_append(res->outputbuffer,
"
");
}
static void print_service_rules_timeout(HttpResponse res, Service_T s) {
for (ActionRate_T ar = s->actionratelist; ar; ar = ar->next) {
StringBuffer_append(res->outputbuffer, "
Timeout
If restarted %d times within %d cycle(s) then ", ar->count, ar->cycle);
Util_printAction(ar->action->failed, res->outputbuffer);
StringBuffer_append(res->outputbuffer, "
");
}
}
static void print_service_rules_nonexistence(HttpResponse res, Service_T s) {
for (NonExist_T l = s->nonexistlist; l; l = l->next) {
StringBuffer_append(res->outputbuffer, "
", Str_milliToTime(s->program->timeout, (char[23]){}));
for (Status_T status = s->statuslist; status; status = status->next) {
StringBuffer_append(res->outputbuffer, "
Test Exit value
");
if (status->operator == Operator_Changed)
Util_printRule(res->outputbuffer, status->action, "If exit value changed");
else
Util_printRule(res->outputbuffer, status->action, "If exit value %s %d", operatorshortnames[status->operator], status->return_value);
StringBuffer_append(res->outputbuffer, "
");
switch (q->resource_id) {
case Resource_CpuPercent:
StringBuffer_append(res->outputbuffer, "CPU usage limit");
break;
case Resource_CpuPercentTotal:
StringBuffer_append(res->outputbuffer, "CPU usage limit (incl. children)");
break;
case Resource_CpuUser:
StringBuffer_append(res->outputbuffer, "CPU user limit");
break;
case Resource_CpuSystem:
StringBuffer_append(res->outputbuffer, "CPU system limit");
break;
case Resource_CpuWait:
StringBuffer_append(res->outputbuffer, "CPU wait limit");
break;
case Resource_MemoryPercent:
StringBuffer_append(res->outputbuffer, "Memory usage limit");
break;
case Resource_MemoryKbyte:
StringBuffer_append(res->outputbuffer, "Memory amount limit");
break;
case Resource_SwapPercent:
StringBuffer_append(res->outputbuffer, "Swap usage limit");
break;
case Resource_SwapKbyte:
StringBuffer_append(res->outputbuffer, "Swap amount limit");
break;
case Resource_LoadAverage1m:
StringBuffer_append(res->outputbuffer, "Load average (1min)");
break;
case Resource_LoadAverage5m:
StringBuffer_append(res->outputbuffer, "Load average (5min)");
break;
case Resource_LoadAverage15m:
StringBuffer_append(res->outputbuffer, "Load average (15min)");
break;
case Resource_Threads:
StringBuffer_append(res->outputbuffer, "Threads");
break;
case Resource_Children:
StringBuffer_append(res->outputbuffer, "Children");
break;
case Resource_MemoryKbyteTotal:
StringBuffer_append(res->outputbuffer, "Memory amount limit (incl. children)");
break;
case Resource_MemoryPercentTotal:
StringBuffer_append(res->outputbuffer, "Memory usage limit (incl. children)");
break;
case Resource_ReadBytes:
StringBuffer_append(res->outputbuffer, "Disk read limit");
break;
case Resource_ReadOperations:
StringBuffer_append(res->outputbuffer, "Disk read limit");
break;
case Resource_WriteBytes:
StringBuffer_append(res->outputbuffer, "Disk write limit");
break;
case Resource_WriteOperations:
StringBuffer_append(res->outputbuffer, "Disk write limit");
break;
default:
break;
}
StringBuffer_append(res->outputbuffer, "
");
switch (q->resource_id) {
case Resource_CpuPercent:
case Resource_CpuPercentTotal:
case Resource_MemoryPercentTotal:
case Resource_CpuUser:
case Resource_CpuSystem:
case Resource_CpuWait:
case Resource_MemoryPercent:
case Resource_SwapPercent:
Util_printRule(res->outputbuffer, q->action, "If %s %.1f%%", operatornames[q->operator], q->limit);
break;
case Resource_MemoryKbyte:
case Resource_SwapKbyte:
case Resource_MemoryKbyteTotal:
Util_printRule(res->outputbuffer, q->action, "If %s %s", operatornames[q->operator], Str_bytesToSize(q->limit, buf));
break;
case Resource_LoadAverage1m:
case Resource_LoadAverage5m:
case Resource_LoadAverage15m:
Util_printRule(res->outputbuffer, q->action, "If %s %.1f", operatornames[q->operator], q->limit);
break;
case Resource_Threads:
case Resource_Children:
Util_printRule(res->outputbuffer, q->action, "If %s %.0f", operatornames[q->operator], q->limit);
break;
case Resource_ReadBytes:
case Resource_WriteBytes:
Util_printRule(res->outputbuffer, q->action, "if %s %s", operatornames[q->operator], Str_bytesToSize(q->limit, (char[10]){}));
break;
case Resource_ReadOperations:
case Resource_WriteOperations:
Util_printRule(res->outputbuffer, q->action, "if %s %.0f operations/s", operatornames[q->operator], q->limit);
break;
default:
break;
}
StringBuffer_append(res->outputbuffer, "
");
}
}
static boolean_t is_readonly(HttpRequest req) {
if (req->remote_user) {
Auth_T user_creds = Util_getUserCredentials(req->remote_user);
return (user_creds ? user_creds->is_readonly : true);
}
return false;
}
/* ----------------------------------------------------------- Status output */
/* Print status in the given format. Text status is default. */
static void print_status(HttpRequest req, HttpResponse res, int version) {
const char *stringFormat = get_parameter(req, "format");
if (stringFormat && Str_startsWith(stringFormat, "xml")) {
char buf[STRLEN];
StringBuffer_T sb = StringBuffer_create(256);
status_xml(sb, NULL, version, Socket_getLocalHost(req->S, buf, sizeof(buf)));
StringBuffer_append(res->outputbuffer, "%s", StringBuffer_toString(sb));
StringBuffer_free(&sb);
set_content_type(res, "text/xml");
} else {
set_content_type(res, "text/plain");
StringBuffer_append(res->outputbuffer, "Monit %s uptime: %s\n\n", VERSION, _getUptime(ProcessTree_getProcessUptime(getpid()), (char[256]){}));
int found = 0;
const char *stringGroup = Util_urlDecode((char *)get_parameter(req, "group"));
const char *stringService = Util_urlDecode((char *)get_parameter(req, "service"));
if (stringGroup) {
for (ServiceGroup_T sg = servicegrouplist; sg; sg = sg->next) {
if (IS(stringGroup, sg->name)) {
for (list_t m = sg->members->head; m; m = m->next) {
status_service_txt(m->e, res);
found++;
}
break;
}
}
} else {
for (Service_T s = servicelist_conf; s; s = s->next_conf) {
if (! stringService || IS(stringService, s->name)) {
status_service_txt(s, res);
found++;
}
}
}
if (found == 0) {
if (stringGroup)
send_error(req, res, SC_BAD_REQUEST, "Service group '%s' not found", stringGroup);
else if (stringService)
send_error(req, res, SC_BAD_REQUEST, "Service '%s' not found", stringService);
else
send_error(req, res, SC_BAD_REQUEST, "No service found");
}
}
}
static void _printServiceSummary(Box_T t, Service_T s) {
Box_setColumn(t, 1, "%s", s->name);
Box_setColumn(t, 2, "%s", get_service_status(TXT, s, (char[STRLEN]){}, STRLEN));
Box_setColumn(t, 3, "%s", servicetypes[s->type]);
Box_printRow(t);
}
static int _printServiceSummaryByType(Box_T t, Service_Type type) {
int found = 0;
for (Service_T s = servicelist_conf; s; s = s->next_conf) {
if (s->type == type) {
_printServiceSummary(t, s);
found++;
}
}
return found;
}
static void print_summary(HttpRequest req, HttpResponse res) {
set_content_type(res, "text/plain");
StringBuffer_append(res->outputbuffer, "Monit %s uptime: %s\n", VERSION, _getUptime(ProcessTree_getProcessUptime(getpid()), (char[256]){}));
int found = 0;
const char *stringGroup = Util_urlDecode((char *)get_parameter(req, "group"));
const char *stringService = Util_urlDecode((char *)get_parameter(req, "service"));
Box_T t = Box_new(res->outputbuffer, 3, (BoxColumn_T []){
{.name = "Service Name", .width = 31, .wrap = false, .align = BoxAlign_Left},
{.name = "Status", .width = 26, .wrap = false, .align = BoxAlign_Left},
{.name = "Type", .width = 13, .wrap = false, .align = BoxAlign_Left}
}, true);
if (stringGroup) {
for (ServiceGroup_T sg = servicegrouplist; sg; sg = sg->next) {
if (IS(stringGroup, sg->name)) {
for (list_t m = sg->members->head; m; m = m->next) {
_printServiceSummary(t, m->e);
found++;
}
break;
}
}
} else if (stringService) {
for (Service_T s = servicelist_conf; s; s = s->next_conf) {
if (IS(stringService, s->name)) {
_printServiceSummary(t, s);
found++;
}
}
} else {
found += _printServiceSummaryByType(t, Service_System);
found += _printServiceSummaryByType(t, Service_Process);
found += _printServiceSummaryByType(t, Service_File);
found += _printServiceSummaryByType(t, Service_Fifo);
found += _printServiceSummaryByType(t, Service_Directory);
found += _printServiceSummaryByType(t, Service_Filesystem);
found += _printServiceSummaryByType(t, Service_Host);
found += _printServiceSummaryByType(t, Service_Net);
found += _printServiceSummaryByType(t, Service_Program);
}
Box_free(&t);
if (found == 0) {
if (stringGroup)
send_error(req, res, SC_BAD_REQUEST, "Service group '%s' not found", stringGroup);
else if (stringService)
send_error(req, res, SC_BAD_REQUEST, "Service '%s' not found", stringService);
else
send_error(req, res, SC_BAD_REQUEST, "No service found");
}
}
static void _printReport(HttpRequest req, HttpResponse res) {
set_content_type(res, "text/plain");
const char *type = get_parameter(req, "type");
int count = 0;
if (! type) {
float up = 0, down = 0, init = 0, unmonitored = 0, total = 0;
for (Service_T s = servicelist; s; s = s->next) {
if (s->monitor == Monitor_Not)
unmonitored++;
else if (s->monitor & Monitor_Init)
init++;
else if (s->error)
down++;
else
up++;
total++;
}
StringBuffer_append(res->outputbuffer,
"up: %*.0f (%.1f%%)\n"
"down: %*.0f (%.1f%%)\n"
"initialising: %*.0f (%.1f%%)\n"
"unmonitored: %*.0f (%.1f%%)\n"
"total: %*.0f services\n",
3, up, 100. * up / total,
3, down, 100. * down / total,
3, init, 100. * init / total,
3, unmonitored, 100. * unmonitored / total,
3, total);
} else if (Str_isEqual(type, "up")) {
for (Service_T s = servicelist; s; s = s->next)
if (s->monitor != Monitor_Not && ! (s->monitor & Monitor_Init) && ! s->error)
count++;
StringBuffer_append(res->outputbuffer, "%d\n", count);
} else if (Str_isEqual(type, "down")) {
for (Service_T s = servicelist; s; s = s->next)
if (s->monitor != Monitor_Not && ! (s->monitor & Monitor_Init) && s->error)
count++;
StringBuffer_append(res->outputbuffer, "%d\n", count);
} else if (Str_startsWith(type, "initiali")) { // allow 'initiali(s|z)ing'
for (Service_T s = servicelist; s; s = s->next)
if (s->monitor & Monitor_Init)
count++;
StringBuffer_append(res->outputbuffer, "%d\n", count);
} else if (Str_isEqual(type, "unmonitored")) {
for (Service_T s = servicelist; s; s = s->next)
if (s->monitor == Monitor_Not)
count++;
StringBuffer_append(res->outputbuffer, "%d\n", count);
} else if (Str_isEqual(type, "total")) {
for (Service_T s = servicelist; s; s = s->next)
count++;
StringBuffer_append(res->outputbuffer, "%d\n", count);
} else {
send_error(req, res, SC_BAD_REQUEST, "Invalid report type: '%s'", type);
}
}
static void status_service_txt(Service_T s, HttpResponse res) {
char buf[STRLEN];
StringBuffer_append(res->outputbuffer,
COLOR_BOLDCYAN "%s '%s'" COLOR_RESET "\n"
" %-28s %s\n",
servicetypes[s->type], s->name,
"status", get_service_status(TXT, s, buf, sizeof(buf)));
StringBuffer_append(res->outputbuffer,
" %-28s %s\n",
"monitoring status", get_monitoring_status(TXT, s, buf, sizeof(buf)));
StringBuffer_append(res->outputbuffer,
" %-28s %s\n",
"monitoring mode", modenames[s->mode]);
StringBuffer_append(res->outputbuffer,
" %-28s %s\n",
"on reboot", onrebootnames[s->onreboot]);
_printStatus(TXT, res, s);
StringBuffer_append(res->outputbuffer, "\n");
}
static char *get_monitoring_status(Output_Type type, Service_T s, char *buf, int buflen) {
ASSERT(s);
ASSERT(buf);
if (s->monitor == Monitor_Not) {
if (type == HTML)
snprintf(buf, buflen, "Not monitored");
else
snprintf(buf, buflen, Color_lightYellow("Not monitored"));
} else if (s->monitor & Monitor_Waiting) {
if (type == HTML)
snprintf(buf, buflen, "Waiting");
else
snprintf(buf, buflen, Color_white("Waiting"));
} else if (s->monitor & Monitor_Init) {
if (type == HTML)
snprintf(buf, buflen, "Initializing");
else
snprintf(buf, buflen, Color_lightBlue("Initializing"));
} else if (s->monitor & Monitor_Yes) {
if (type == HTML)
snprintf(buf, buflen, "Monitored");
else
snprintf(buf, buflen, "Monitored");
}
return buf;
}
static char *get_service_status(Output_Type type, Service_T s, char *buf, int buflen) {
ASSERT(s);
ASSERT(buf);
if (s->monitor == Monitor_Not || s->monitor & Monitor_Init) {
get_monitoring_status(type, s, buf, buflen);
} else if (s->error == 0) {
snprintf(buf, buflen, type == HTML ? "OK" : Color_lightGreen("OK"));
} else {
// In the case that the service has actualy some failure, the error bitmap will be non zero
char *p = buf;
EventTable_T *et = Event_Table;
while ((*et).id) {
if (s->error & (*et).id) {
if (p > buf)
p += snprintf(p, buflen - (p - buf), " | ");
if (s->error_hint & (*et).id) {
if (type == HTML)
p += snprintf(p, buflen - (p - buf), "%s", (*et).description_changed);
else
p += snprintf(p, buflen - (p - buf), Color_lightYellow("%s", (*et).description_changed));
} else {
if (type == HTML)
p += snprintf(p, buflen - (p - buf), "%s", (*et).description_failed);
else
p += snprintf(p, buflen - (p - buf), Color_lightRed("%s", (*et).description_failed));
}
}
et++;
}
}
if (s->doaction)
snprintf(buf + strlen(buf), buflen - strlen(buf) - 1, " - %s pending", actionnames[s->doaction]);
return buf;
}
monit-5.21.0/src/http/client.h 0000644 0001751 0001751 00000003577 13057552676 016066 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#ifndef HTTPCLIENT_H
#define HTTPCLIENT_H
/**
* Do service action
* @param action A string representation of Action_Type
* @param services List of services
* @return true if succeeded otherwise false
*/
boolean_t HttpClient_action(const char *action, List_T services);
/**
* Print service report
* @param type Report type or NULL
* @return true if succeeded otherwise false
*/
boolean_t HttpClient_report(const char *type);
/**
* Print service status
* @param group Service group or NULL
* @param service Service name or NULL
* @return true if succeeded otherwise false
*/
boolean_t HttpClient_status(const char *group, const char *service);
/**
* Print service summary
* @param group Service group or NULL
* @param service Service name or NULL
* @return true if succeeded otherwise false
*/
boolean_t HttpClient_summary(const char *group, const char *service);
#endif
monit-5.21.0/src/http/cervlet.h 0000644 0001751 0001751 00000020307 13057552676 016242 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#ifndef CERVLET_H
#define CERVLET_H
#include "config.h"
#include "monit.h"
void init_service();
#define FAVICON_ICO "AAABAAIAEBAAAAAAIABoBAAAJgAAACAgAAAAACAAqBAAAI4EAAAoAAAAEAAAACAAAAABACAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAgAAAAMAAAADAAAAAgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAFAAAADAAAABMAAAAXAAAAFwAAABMAAAAMAAAABQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAFAAAAFAAAACgAAAA3AAAAPwAAAD8AAAA3AAAAKAAAABQAAAAFAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAEwAAAC8AjlOHALVkxBzVe+4r3H/uALdoxACOU4cAAAAvAAAAEwAAAAQAAAAAAAAAAAAAAAAAAAABAAAACwAAACUAhUqfAMV6/0j0t/90/9j/hP/f/1b3vv8AyH3/AIdLnwAAACUAAAALAAAAAQAAAAAAAAAAAAAAAgAAABAAbC94AKNY/wDllP8A6Z3/GvCw/yX0t/8A66X/AOaV/wCjWP8AbC94AAAAEAAAAAIAAAAAAAAAAAAAAAIAAAASAGslugCsSv8A1Xr/ANqF/wDbi/8A3ZD/AN+S/wDWfv8Aq0j/AGslugAAABIAAAACAAAAAAAAAAAAAAACAAAAEABmHuoAqzv/Esdp/xTNdv8Uz33/FNKB/xTSgP8Sx2r/AKs7/wBmHuoAAAAQAAAAAgAAAAAAAAAAAAAAAgAAAAsAXxbpDq1N/yC8Yf81xXT/Ncl5/zXJev81xXT/ILxe/w6tTf8AXxbpAAAACwAAAAIAAAAAAAAAAAAAAAEAAAAGAFYQsSOcUP9hzYj/etid/2TPjP9kz4z/etid/2HNiP8jnFD/AFYQsQAAAAYAAAABAAAAAAAAAAAAAAAAAAAAAgBaC2ABcyT/cMyM/67pwf/Q+N3/0Pjd/67pwf9wzIz/AXMk/wBaC2AAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAE4CggJuIP9ns33/iM6a/4jOmv9ns33/Am4g/wBOAoIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAUgBdAEkArABFAOcARQDnAEkArABSAF0AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//AAD//wAA//8AAPgfAADwDwAA8A8AAOAHAADgBwAA4AcAAOAHAADwDwAA8A8AAPw/AAD//wAA//8AAP//AAAoAAAAIAAAAEAAAAABACAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAIAAAACAAAAAwAAAAMAAAACAAAAAgAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAAQAAAAFAAAABgAAAAcAAAAIAAAACAAAAAcAAAAGAAAABQAAAAQAAAADAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAwAAAAUAAAAHAAAACgAAAA0AAAAPAAAAEQAAABIAAAASAAAAEQAAAA8AAAANAAAACgAAAAcAAAAFAAAAAwAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAMAAAAHAAAACwAAABAAAAAVAAAAGQAAAB0AAAAfAAAAIQAAACEAAAAfAAAAHQAAABkAAAAVAAAAEAAAAAsAAAAHAAAAAwAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAABwAAAA0AAAAUAAAAHAAAACQAAAAqAAAALwAAADMAAAA1AAAANQAAADMAAAAvAAAAKgAAACQAAAAcAAAAFAAAAA0AAAAHAAAAAwAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAwAAAAYAAAANAAAAFgAcDiQAQiY2AFAvRgBcNFMDZzleCnJAZxF3RWsVekVrEXRDZwVqPF4AXzRTAFAvRgBCJjYAHA4kAAAAFgAAAA0AAAAGAAAAAwAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAGAAAADAAAABUAAAAiAD4jOgBzQl0AjFB8AJ5YlAatYqkTvWy6HcZywiPJc8IewnC6C7JlqQCgW5QAjFB8AHNCXQA+IzoAAAAiAAAAFQAAAAwAAAAGAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABAAAAAoAAAATACMOJAA+IT4Abj9hAJZZjwasabERv3bIHc6E2yzZjus24ZTzPuOX8zjfk+sk0ojbFMJ8yAevbLEAl1uPAG4/YQA+IT4AIw4kAAAAEwAAAAoAAAAEAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAADwAAABoAQyQ5AG88agCRVJsAsWvKDseB5Svcmu1D6q3zVfK6+WP2xPtr98f7ZPTB+U/ts/M035/tEsuE5QCzbsoAklabAHE+agBDJDkAAAAaAAAADwAAAAcAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAkAIQsXADIWLgBkNFkAhkiYAKJeyQDBdu0N1o3/KOml/0D0uP9T+cf/YfzQ/2j81P9h+87/S/a//zDrq/8Q2ZD/AMR47QClX8kAiEqYAGQ0WQAyFi4AIQsXAAAACQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAFAAAACwBCHSMAWydOAHs8hACWUMYAr2TtAM+A+QThk/8N6J7/Ge6p/ynytf8z9bz/Ofa//zP1vP8f8bH/EOuk/wXjlv8A0IL5AK9l7QCWUMYAezyEAFsnTgBCHSMAAAALAAAABQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAUAAAAMAE4cLgBnKWoAgTqmAJtO4gC0Y/8A0n//AOKQ/wDllf8E55v/Duqj/xXsqf8Z7qz/FO2q/wbqpP8A55z/AOSU/wDTgP8AtGP/AJtO4gCBOqYAZylqAE4cLgAAAAwAAAAFAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABAAAABQAAAA0ATxw3AGclgwCAM78AnUXqALZa/wDNdP8A24P/AN2I/wHfjf8E4JL/B+GW/wjimP8G45n/AuOY/wDgkv8A3Ij/AM52/wC1Wv8AnUTqAIAzvwBnJYMATxw3AAAADQAAAAUAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAFAAAADQBSGT4AZiGZAHwt1QCdPvEBtVL/A8hq/wTTef8E1n7/BdeD/wXYhv8F2Yn/BdqL/wXbjf8F3I3/BNqI/wTVfv8DyWz/AbVS/wCdPfEAfCzVAGYhmQBSGT4AAAANAAAABQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAUAAAAMAFIWRABkHqsAeSjnAJw49wOzSv8Kw2H/Dcxw/w7Pd/8P0Xv/D9J//w/Tgv8P1IT/D9WF/w/Vhf8O03//Dc50/wrDY/8Ds0r/AJw39wB5KOcAZB6rAFIWRAAAAAwAAAAFAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABAAAABQAAAAsAVRZFAGIbswB3Je8Cmzf6CLJJ/xG+Xf8Xxmv/Gspy/xzMd/8czXr/HM59/xzPfv8c0H//HM9+/xrMd/8Xx2z/Eb5d/wiySf8Cmzf6AHcl7wBiG7MAVRZFAAAACwAAAAUAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAAAACQBUE0MAXheyAnUk7webPfoPsU//GLpc/yDBZ/8oxXD/LMh2/yzKef8sy3r/LMt7/yzLe/8syXj/KMZx/yDBZv8Yulv/D7FO/webPfoCdSTvAF4XsgBUE0MAAAAJAAAABAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAMAAAAHAFIQPgBbFKcEciTkDphA9hqvVf8pu2P/NcNw/0DIef9Fyn7/Qst+/0DLfv9Ay37/Qst+/0XKfv9AyHn/NcNu/ym7Yv8ar1T/DphA9gRyJOQAWxSnAFIQPgAAAAcAAAADAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAUATQ41AFgQkQlvJM8XkkLvKqtb/0S/cv9XzIP/Y9GO/2TSkP9cz4r/WM6H/1jOh/9cz4r/ZNKQ/2PRjf9XzIP/RL9y/yqrW/8XkkLvCW8kzwBYEJEATQ41AAAABQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAwBNDCsAVg13CGsitRWHO+ctoVb/Ur54/23RkP9+2Z//hdyl/4Haov9/2qD/f9qg/4Haov+F3KX/ftmf/23RkP9Svnj/LaFW/xWHO+cIayK1AFYNdwBNDCsAAAADAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAFIIHwBXDFgDZxuXCHgp3SKRRv9TuXT/edOW/5Tfrf+m57z/sOzF/7Xuyf+17sn/sOzF/6bnvP+U363/edOW/1O5dP8ikUb/CHgp3QNnG5cAVwxYAFIIHwAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAUQATAFoJNgBkFW4Aax26F4A16EGkXfhmvoH/itKg/6Xgt/+26cX/vu7N/77uzf+26cX/peC3/4rSoP9mvoH/QaRd+BeANegAax26AGQVbgBaCTYAUQATAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVAAYAUQATAFsNOwBcDn8Kah65GH4y6DSUUP9isnn/gceV/5LTpP+a2av/mtmr/5LTpP+Bx5X/YrJ5/zSUUP8YfjLoCmoeuQBcDn8AWw07AFEAEwBVAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEARwAZAE0ASQBaDH8BZxm6F3gv3ECSVOZZpGruY6py9miudvlornb5Y6py9lmkau5AklTmF3gv3AFnGboAWgx/AE0ASQBHABkAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAgARwAZAFgJOgBeDmwKZBaUG2gksiJrKcwkaijiJWop7SVqKe0kaijiImspzBtoJLIKZBaUAF4ObABYCToARwAZAEAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARwASAE4ANABPAFQASgByAEcAjABFAKIARQCtAEUArQBFAKIARwCMAEoAcgBPAFQATgA0AEcAEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqAAYASwARAEkAHABKACYASAAuAEIANgBDADkAQwA5AEIANgBIAC4ASgAmAEkAHABLABEAKgAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/////////////////////////////////wD///wAP//4AB//8AAP/+AAB//gAAf/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/+AAB//gAAf/8AAP//gAH//8AD///gB///+B//////////////////////////////////"
#endif
monit-5.21.0/src/http/engine.h 0000644 0001751 0001751 00000003356 13057552676 016050 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#ifndef ENGINE_H
#define ENGINE_H
/**
* Start the HTTPD server
*/
void Engine_start();
/**
* Stop the HTTPD server.
*/
void Engine_stop();
/**
* Cleanup the HTTPD server resources (remove unix socket).
*/
void Engine_cleanup();
/**
* Add network/host allowed to connect to this server.
* @param pattern A hostname, IP address or network identifier in IP/mask format to be added to the allow list
* @return true if the the pattern was added, otherwise false
*/
boolean_t Engine_addAllow(char *pattern);
/**
* Are any hosts present in the host allow list?
* @return true if the host allow list is non-empty, otherwise false
*/
boolean_t Engine_hasAllow();
/**
* Free the host allow list
*/
void Engine_destroyAllow();
#endif
monit-5.21.0/src/http/engine.c 0000644 0001751 0001751 00000044734 13057552676 016050 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#include "config.h"
#ifdef HAVE_STDIO_H
#include
#endif
#ifdef HAVE_STDLIB_H
#include
#endif
#ifdef HAVE_ERRNO_H
#include
#endif
#ifdef HAVE_SYS_TYPES_H
#include
#endif
#ifdef HAVE_SYS_SOCKET_H
#include
#endif
#ifdef HAVE_NETDB_H
#include
#endif
#ifdef HAVE_UNISTD_H
#include
#endif
#ifdef HAVE_FCNTL_H
#include
#endif
#ifdef HAVE_STRING_H
#include
#endif
#ifdef HAVE_CTYPE_H
#include
#endif
#ifdef HAVE_STRINGS_H
#include
#endif
#ifdef HAVE_SYS_UN_H
#include
#endif
#ifdef HAVE_NETINET_IN_H
#include
#endif
#ifdef HAVE_ARPA_INET_H
#include
#endif
#ifdef HAVE_POLL_H
#include
#endif
#include "monit.h"
#include "engine.h"
#include "net.h"
#include "processor.h"
#include "cervlet.h"
#include "socket.h"
#include "SslServer.h"
// libmonit
#include "system/Net.h"
#include "exceptions/AssertException.h"
#include "exceptions/IOException.h"
/**
* A naive http 1.0 server. The server delegates handling of a HTTP
* request and response to the processor module.
*
* NOTE
* This server does not use threads or forks; Requests are
* serialized and pending requests will be popped from the
* connection queue when the current request finish.
*
* Since this server is written for monit, low traffic is expected.
* Connect from not-authenticated clients will be closed down
* promptly. The authentication schema or access control is based
* on client name/address/pam and only requests from known clients are
* accepted. Hosts allowed to connect to this server should be
* added to the access control list by calling Engine_addHostAllow().
*
* @file
*/
/* ------------------------------------------------------------- Definitions */
typedef struct HostsAllow_T {
uint32_t address[4]; // IPv4 or IPv6 address
uint32_t mask[4]; // mask
/* For internal use */
struct HostsAllow_T *next;
} *HostsAllow_T;
#define MAX_SERVER_SOCKETS 3
static struct {
Socket_Family family;
union {
struct sockaddr_storage addr_in;
struct sockaddr_un addr_un;
} _addr;
struct sockaddr *addr;
socklen_t addrlen;
#ifdef HAVE_OPENSSL
SslServer_T ssl;
#endif
} data[MAX_SERVER_SOCKETS] = {};
static volatile boolean_t stopped = false;
static int myServerSocketsCount = 0;
static struct pollfd myServerSockets[3] = {};
static HostsAllow_T allowlist = NULL;
/* ----------------------------------------------------------------- Private */
static boolean_t _hasAllow(HostsAllow_T host) {
for (HostsAllow_T p = allowlist; p; p = p->next)
if (memcmp(p->address, &(host->address), 16) == 0 && memcmp(p->mask, &(host->mask), 16) == 0)
return true;
return false;
}
static void _pushAllow(HostsAllow_T h, const char *pattern) {
char buf[INET6_ADDRSTRLEN] = {};
if (! Str_sub(pattern, "/"))
inet_ntop(AF_INET6, &(h->address), buf, sizeof(buf));
if (_hasAllow(h)) {
if (*buf)
LogWarning("Skipping 'allow %s' -- host resolved to [%s] which is present in ACL already\n", pattern, buf);
else
LogWarning("Skipping 'allow %s' -- present in ACL already\n", pattern);
FREE(h);
} else {
if (*buf)
DEBUG("Adding 'allow %s' -- host resolved to [%s]\n", pattern, buf);
else
DEBUG("Adding 'allow %s'\n", pattern);
h->next = allowlist;
allowlist = h;
}
}
static boolean_t _matchAllow(uint32_t address1[4], uint32_t address2[4], uint32_t mask[4]) {
for (int i = 0; i < 4; i++)
if ((address1[i] & mask[i]) != (address2[i] & mask[i]))
return false;
return true;
}
static boolean_t _isAllowed(uint32_t address[4]) {
if (allowlist) {
for (HostsAllow_T p = allowlist; p; p = p->next)
if (_matchAllow(p->address, address, p->mask))
return true;
return false;
}
return true;
}
static HostsAllow_T _copyAllow(HostsAllow_T source) {
HostsAllow_T copy;
NEW(copy);
memcpy(copy, source, sizeof(struct HostsAllow_T));
return copy;
}
static void _mapIPv4toIPv6(uint32_t *address4, uint32_t *address6) {
// Map IPv4 address to IPv6 "::ffff:x.x.x.x" notation, so we can compare IPv4 address in IPv6 namespace
*(address6 + 0) = 0x00000000;
*(address6 + 1) = 0x00000000;
*(address6 + 2) = htonl(0x0000ffff);
*(address6 + 3) = *address4;
}
static boolean_t _parseNetwork(char *pattern) {
char *longmask = NULL;
int shortmask = 0;
int slashcount = 0;
int dotcount = 0;
int columncount = 0;
int count = 0;
char buf[STRLEN];
strncpy(buf, pattern, sizeof(buf) - 1);
char *temp = buf;
Socket_Family family = Socket_Ip4;
// check if we have IPv4/IPv6 CIDR notation (x.x.x.x/yyy or x::/y) or IPv4 dot-decimal (x.x.x.x/y.y.y.y)
while (*temp) {
if (*temp == '/') {
if (slashcount > 0 || (family == Socket_Ip4 && dotcount != 3) || (family == Socket_Ip6 && columncount < 2))
return false; // The "/" was found already or its prefix doesn't look like valid address
*temp = 0;
longmask = *(temp + 1) ? temp + 1 : NULL;
slashcount++;
dotcount = columncount = count = 0;
} else if (*temp == '.') {
if (family == Socket_Ip6 && slashcount > 0)
return false; // No "." allowed past "/" for IPv6 address
dotcount++;
} else if (*temp == ':') {
if (slashcount > 0)
return false; // ":" not allowed past "/"
columncount++;
family = Socket_Ip6;
} else {
if (slashcount == 0) {
// [0-9a-fA-F] allowed before "/"
if (! isxdigit((int)*temp))
return false;
} else {
// only [0-9] allowed past "/"
if (! isdigit((int)*temp))
return false;
}
count++;
}
temp++;
}
if (slashcount == 0) {
// Host part only
return false;
} else if (dotcount == 0 && count > 0 && count < 4) {
// Mask in CIDR notation
if (longmask) {
shortmask = atoi(longmask);
longmask = NULL;
}
} else if (family == Socket_Ip4 && dotcount != 3) {
// The IPv4 dot-decimal mask requires three dots
return false;
}
struct HostsAllow_T net = {};
if (family == Socket_Ip4) {
struct sockaddr_in addr;
if (inet_pton(AF_INET, buf, &(addr.sin_addr)) != 1)
return false;
_mapIPv4toIPv6((uint32_t *)&(addr.sin_addr), net.address);
} else {
#ifdef HAVE_IPV6
struct sockaddr_in6 addr;
if (inet_pton(AF_INET6, buf, &(addr.sin6_addr)) != 1)
return false;
memcpy(net.address, &(addr.sin6_addr), 16);
#else
THROW(AssertException, "IPv6 not supported on this system");
#endif
}
if (longmask == NULL) {
// Convert CIDR notation to integer mask
if (shortmask < 0)
return false;
if (family == Socket_Ip4) {
if (shortmask > 32) {
return false;
} else if (shortmask == 32) {
memset(net.mask, 0xff, 16);
} else if (shortmask > 0) {
memset(net.mask, 0xff, 16);
net.mask[3] = htonl(0xffffffff << (32 - shortmask));
}
} else {
if (shortmask > 128) {
return false;
} else if (shortmask == 128) {
memset(net.mask, 0xff, 16);
} else {
for (int i = 0; i < 4; i++) {
if (shortmask > 32) {
net.mask[i] = 0xffffffff;
shortmask -= 32;
} else if (shortmask > 0) {
net.mask[i] = htonl(0xffffffff << (32 - shortmask));
shortmask = 0;
} else {
net.mask[i] = 0x00000000;
}
}
}
}
} else {
// Parse IPv4 dot-decimal mask
struct sockaddr_in addr;
if (! inet_aton(longmask, &(addr.sin_addr)))
return false;
_mapIPv4toIPv6((uint32_t *)&(addr.sin_addr), net.mask);
}
_pushAllow(_copyAllow(&net), pattern);
return true;
}
//FIXME: don't store the translated hostname->IPaddress on Monit startup to support DHCP hosts ... resolve the hostname in _authenticateHost()
static boolean_t _parseHost(char *pattern) {
struct addrinfo *res, hints = {
.ai_protocol = IPPROTO_TCP
};
int added = 0;
if (! getaddrinfo(pattern, NULL, &hints, &res)) {
for (struct addrinfo *_res = res; _res; _res = _res->ai_next) {
HostsAllow_T h = NULL;
if (_res->ai_family == AF_INET) {
NEW(h);
struct sockaddr_in *sin = (struct sockaddr_in *)_res->ai_addr;
_mapIPv4toIPv6((uint32_t *)&(sin->sin_addr), h->address);
}
#ifdef HAVE_IPV6
else if (_res->ai_family == AF_INET6) {
NEW(h);
struct sockaddr_in6 *sin = (struct sockaddr_in6 *)_res->ai_addr;
memcpy(&h->address, &(sin->sin6_addr), 16);
}
#endif
if (h) {
memset(h->mask, 0xff, 16); // compare all 128 bits
_pushAllow(h, pattern);
added++;
}
}
freeaddrinfo(res);
}
return added ? true : false;
}
static boolean_t _authenticateHost(struct sockaddr *addr) {
if (addr->sa_family == AF_INET) {
boolean_t allow = false;
struct sockaddr_in *a = (struct sockaddr_in *)addr;
uint32_t address[4];
_mapIPv4toIPv6((uint32_t *)&(a->sin_addr), (uint32_t *)&address);
if (! (allow = _isAllowed(address)))
LogError("Denied connection from non-authorized client [%s]\n", inet_ntop(addr->sa_family, &a->sin_addr, (char[INET_ADDRSTRLEN]){}, INET_ADDRSTRLEN));
return allow;
}
#ifdef HAVE_IPV6
else if (addr->sa_family == AF_INET6) {
boolean_t allow = false;
struct sockaddr_in6 *a = (struct sockaddr_in6 *)addr;
if (! (allow = _isAllowed((uint32_t *)&(a->sin6_addr))))
LogError("Denied connection from non-authorized client [%s]\n", inet_ntop(addr->sa_family, &(a->sin6_addr), (char[INET6_ADDRSTRLEN]){}, INET6_ADDRSTRLEN));
return allow;
}
#endif
else if (addr->sa_family == AF_UNIX) {
return true;
}
return false;
}
static Socket_T _socketProducer() {
int r = 0;
do {
r = poll(myServerSockets, myServerSocketsCount, 1000);
} while (r == -1 && errno == EINTR);
if (r > 0) {
for (int i = 0; i < myServerSocketsCount; i++) {
if (myServerSockets[i].revents & POLLIN) {
int client = accept(myServerSockets[i].fd, data[i].addr, &(data[i].addrlen));
if (client < 0) {
LogError("HTTP server: cannot accept connection -- %s\n", stopped ? "service stopped" : STRERROR);
return NULL;
}
if (Net_setNonBlocking(client) < 0 || ! Net_canRead(client, 500) || ! Net_canWrite(client, 500) || ! _authenticateHost(data[i].addr)) {
Net_abort(client);
return NULL;
}
#ifdef HAVE_OPENSSL
return Socket_createAccepted(client, data[i].addr, data[i].ssl);
#else
return Socket_createAccepted(client, data[i].addr, NULL);
#endif
}
}
}
return NULL;
}
static void _createTcpServer(Socket_Family family, char error[STRLEN]) {
myServerSockets[myServerSocketsCount].fd = create_server_socket_tcp(Run.httpd.socket.net.address, Run.httpd.socket.net.port, family, 1024, error);
if (myServerSockets[myServerSocketsCount].fd != -1) {
#ifdef HAVE_OPENSSL
if (Run.httpd.socket.net.ssl.flags & SSL_Enabled) {
if (! (data[myServerSocketsCount].ssl = SslServer_new(myServerSockets[myServerSocketsCount].fd, &(Run.httpd.socket.net.ssl)))) {
strncpy(error, "Could not initialize SSL engine", STRLEN - 1);
Net_close(myServerSockets[myServerSocketsCount].fd);
return;
}
}
#endif
data[myServerSocketsCount].family = family;
data[myServerSocketsCount].addr = (struct sockaddr *)&(data[myServerSocketsCount]._addr.addr_in);
data[myServerSocketsCount].addrlen = sizeof(struct sockaddr_storage);
myServerSockets[myServerSocketsCount].events = POLLIN;
myServerSocketsCount++;
}
}
static void _createUnixServer(char error[STRLEN]) {
myServerSockets[myServerSocketsCount].fd = create_server_socket_unix(Run.httpd.socket.unix.path, 1024, error);
if (myServerSockets[myServerSocketsCount].fd != -1) {
data[myServerSocketsCount].family = Socket_Unix;
data[myServerSocketsCount].addr = (struct sockaddr *)&(data[myServerSocketsCount]._addr.addr_un);
data[myServerSocketsCount].addrlen = sizeof(struct sockaddr_un);
myServerSockets[myServerSocketsCount].events = POLLIN;
myServerSocketsCount++;
}
}
/* ------------------------------------------------------------------ Public */
void Engine_start() {
Engine_cleanup();
stopped = Run.flags & Run_Stopped;
init_service();
char error[MAX_SERVER_SOCKETS][STRLEN] = {};
if (Run.httpd.flags & Httpd_Net) {
_createTcpServer(Socket_Ip4, error[0]);
_createTcpServer(Socket_Ip6, error[1]);
}
if (Run.httpd.flags & Httpd_Unix) {
_createUnixServer(error[2]);
}
if (myServerSocketsCount == 0) {
// Log error only if no socket was created
for (int i = 0; i < MAX_SERVER_SOCKETS; i++)
if (STR_DEF(error[i]))
LogError("HTTP server -- %s\n", error[i]);
} else {
while (! stopped) {
Socket_T S = _socketProducer();
if (S)
http_processor(S);
}
for (int i = 0; i < myServerSocketsCount; i++) {
#ifdef HAVE_OPENSSL
if (data[i].ssl)
SslServer_free(&(data[i].ssl));
#endif
Net_close(myServerSockets[i].fd);
}
Engine_cleanup();
}
}
void Engine_stop() {
stopped = true;
}
void Engine_cleanup() {
myServerSocketsCount = 0;
if (Run.httpd.flags & Httpd_Unix)
unlink(Run.httpd.socket.unix.path);
}
boolean_t Engine_addAllow(char *pattern) {
ASSERT(pattern);
if (_parseNetwork(pattern) || _parseHost(pattern))
return true;
return false;
}
boolean_t Engine_hasAllow() {
return allowlist ? true : false;
}
void Engine_destroyAllow() {
for (HostsAllow_T current = allowlist, next = NULL; current; current = next) {
next = current->next;
FREE(current);
}
allowlist = NULL;
}
monit-5.21.0/src/http/client.c 0000644 0001751 0001751 00000020714 13057552676 016051 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#include "config.h"
#ifdef HAVE_STDIO_H
#include
#endif
#ifdef HAVE_STDLIB_H
#include
#endif
#ifdef HAVE_SYS_TYPES_H
#include
#endif
#ifdef HAVE_SYS_SOCKET_H
#include
#endif
#ifdef HAVE_STRING_H
#include
#endif
#ifdef HAVE_STRINGS_H
#include
#endif
#ifdef HAVE_UNISTD_H
#include
#endif
#include "monit.h"
#include "net.h"
#include "socket.h"
#include "ProcessTree.h"
#include "device.h"
#include "Color.h"
#include "Box.h"
// libmonit
#include "exceptions/AssertException.h"
#include "exceptions/IOException.h"
/**
* The monit HTTP GUI client
*
* @file
*/
/* ----------------------------------------------------------------- Private */
static void _argument(StringBuffer_T data, const char *name, const char *value) {
char *_value = Util_urlEncode((char *)value, true);
StringBuffer_append(data, "%s%s=%s", StringBuffer_length(data) ? "&" : "", name, _value);
FREE(_value);
}
static char *_getBasicAuthHeader() {
Auth_T c = Run.httpd.credentials;
// Find the first cleartext credential for authorization
while (c != NULL) {
if (c->digesttype == Digest_Cleartext && ! c->is_readonly)
break;
c = c->next;
}
if (c)
return Util_getBasicAuthHeader(c->uname, c->passwd);
return NULL;
}
static void _parseHttpResponse(Socket_T S) {
char buf[1024];
if (! Socket_readLine(S, buf, sizeof(buf)))
THROW(IOException, "Error receiving data -- %s", STRERROR);
Str_chomp(buf);
int status;
if (! sscanf(buf, "%*s %d", &status))
THROW(IOException, "Cannot parse status in response: %s", buf);
if (status >= 300) {
int content_length = 0;
// Read HTTP headers
while (Socket_readLine(S, buf, sizeof(buf))) {
if (! strncmp(buf, "\r\n", sizeof(buf)))
break;
if (Str_startsWith(buf, "Content-Length") && ! sscanf(buf, "%*s%*[: ]%d", &content_length))
THROW(IOException, "Invalid Content-Length header: %s", buf);
}
// Parse error response
char *message = NULL;
if (content_length > 0 && content_length < 1024 && Socket_readLine(S, buf, sizeof(buf))) {
char token[] = "";
message = strstr(buf, token);
if (strlen(message) > strlen(token)) {
message += strlen(token);
char *footer = NULL;
if ((footer = strstr(message, "
")) || (footer = strstr(message, "
")))
*footer = 0;
}
}
THROW(AssertException, "%s", message ? message : "cannot parse response");
} else {
// Skip HTTP headers
while (Socket_readLine(S, buf, sizeof(buf))) {
if (! strncmp(buf, "\r\n", sizeof(buf)))
break;
}
}
}
static void _send(Socket_T S, const char *request, StringBuffer_T data) {
_argument(data, "format", "text");
char *_auth = _getBasicAuthHeader();
MD_T token;
StringBuffer_append(data, "%ssecuritytoken=%s", StringBuffer_length(data) > 0 ? "&" : "", Util_getToken(token));
int rv = Socket_print(S,
"POST %s HTTP/1.0\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Cookie: securitytoken=%s\r\n"
"Content-Length: %d\r\n"
"%s"
"\r\n"
"%s",
request,
token,
StringBuffer_length(data),
_auth ? _auth : "",
StringBuffer_toString(data));
FREE(_auth);
if (rv < 0)
THROW(IOException, "Monit: cannot send command to the monit daemon -- %s", STRERROR);
}
static void _receive(Socket_T S) {
char buf[1024];
_parseHttpResponse(S);
boolean_t strip = (Run.flags & Run_Batch || ! Color_support()) ? true : false;
while (Socket_readLine(S, buf, sizeof(buf))) {
if (strip)
Color_strip(Box_strip(buf));
printf("%s", buf);
}
}
static boolean_t _client(const char *request, StringBuffer_T data) {
boolean_t status = false;
if (! exist_daemon()) {
LogError("Monit: the monit daemon is not running\n");
return status;
}
Socket_T S = NULL;
if (Run.httpd.flags & Httpd_Net) {
S = Socket_create(Run.httpd.socket.net.address ? Run.httpd.socket.net.address : "localhost", Run.httpd.socket.net.port, Socket_Tcp, Socket_Ip, &(Run.httpd.socket.net.ssl), Run.limits.networkTimeout);
} else if (Run.httpd.flags & Httpd_Unix) {
S = Socket_createUnix(Run.httpd.socket.unix.path, Socket_Tcp, Run.limits.networkTimeout);
} else {
LogError("Monit: the monit HTTP interface is not enabled, please add the 'set httpd' statement and use the 'allow' option to allow monit to connect\n");
}
if (S) {
TRY
{
_send(S, request, data);
_receive(S);
status = true;
}
ELSE
{
LogError("%s\n", Exception_frame.message);
}
END_TRY;
Socket_free(&S);
}
return status;
}
/* ------------------------------------------------------------------ Public */
boolean_t HttpClient_action(const char *action, List_T services) {
ASSERT(services);
ASSERT(action);
if (Util_getAction(action) == Action_Ignored) {
LogError("Invalid action %s\n", action);
return false;
}
StringBuffer_T data = StringBuffer_create(64);
_argument(data, "action", action);
for (list_t s = services->head; s; s = s->next)
_argument(data, "service", s->e);
boolean_t rv = _client("/_doaction", data);
StringBuffer_free(&data);
return rv;
}
boolean_t HttpClient_report(const char *type) {
StringBuffer_T data = StringBuffer_create(64);
if (STR_DEF(type))
_argument(data, "type", type);
boolean_t rv = _client("/_report", data);
StringBuffer_free(&data);
return rv;
}
boolean_t HttpClient_status(const char *group, const char *service) {
StringBuffer_T data = StringBuffer_create(64);
if (STR_DEF(service))
_argument(data, "service", service);
if (STR_DEF(group))
_argument(data, "group", group);
boolean_t rv = _client("/_status", data);
StringBuffer_free(&data);
return rv;
}
boolean_t HttpClient_summary(const char *group, const char *service) {
StringBuffer_T data = StringBuffer_create(64);
if (STR_DEF(service))
_argument(data, "service", service);
if (STR_DEF(group))
_argument(data, "group", group);
boolean_t rv = _client("/_summary", data);
StringBuffer_free(&data);
return rv;
}
monit-5.21.0/src/http/xml.c 0000644 0001751 0001751 00000073411 13057552676 015375 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#include "config.h"
#ifdef HAVE_STDIO_H
#include
#endif
#ifdef HAVE_STRING_H
#include
#endif
#ifdef HAVE_SYS_TYPES_H
#include
#endif
#ifdef HAVE_SYS_SOCKET_H
#include
#endif
#ifdef HAVE_ERRNO_H
#include
#endif
#ifdef HAVE_UNISTD_H
#include
#endif
// libmonit
#include "util/List.h"
#include "monit.h"
#include "event.h"
#include "ProcessTree.h"
#include "protocol.h"
/**
* XML routines for status and event notification message handling.
*
* @file
*/
/* ----------------------------------------------------------------- Private */
/**
* Escape the CDATA "]]>" stop sequence in string
* @param B Output StringBuffer object
* @param buf String to escape
*/
static void _escapeCDATA(StringBuffer_T B, const char *buf) {
for (int i = 0; buf[i]; i++) {
if (buf[i] == '>' && i > 1 && (buf[i - 1] == ']' && buf[i - 2] == ']'))
StringBuffer_append(B, ">");
else
StringBuffer_append(B, "%c", buf[i]);
}
}
/**
* Prints a document header into the given buffer.
* @param B StringBuffer object
* @param V Format version
* @param myip The client-side IP address
*/
static void document_head(StringBuffer_T B, int V, const char *myip) {
StringBuffer_append(B, "");
if (V == 2)
StringBuffer_append(B, "", Run.id, (long long)Run.incarnation, VERSION);
else
StringBuffer_append(B,
""
""
"%s"
"%lld"
"%s",
Run.id,
(long long)Run.incarnation,
VERSION);
StringBuffer_append(B,
"%lld"
"%d"
"%d"
"%s"
"%s",
(long long)ProcessTree_getProcessUptime(getpid()),
Run.polltime,
Run.startdelay,
Run.system->name ? Run.system->name : "",
Run.files.control ? Run.files.control : "");
if (Run.httpd.flags & Httpd_Net || Run.httpd.flags & Httpd_Unix) {
if (Run.httpd.flags & Httpd_Net)
StringBuffer_append(B, "%s%d%d", Run.httpd.socket.net.address ? Run.httpd.socket.net.address : myip ? myip : "", Run.httpd.socket.net.port, Run.httpd.socket.net.ssl.flags & SSL_Enabled);
else if (Run.httpd.flags & Httpd_Unix)
StringBuffer_append(B, "%s", Run.httpd.socket.unix.path ? Run.httpd.socket.unix.path : "");
if (Run.mmonitcredentials)
StringBuffer_append(B, "%s%s", Run.mmonitcredentials->uname, Run.mmonitcredentials->passwd);
}
StringBuffer_append(B,
""
""
"%s"
"%s"
"%s"
"%s"
"%d"
"%llu"
"%llu"
"",
systeminfo.uname.sysname,
systeminfo.uname.release,
systeminfo.uname.version,
systeminfo.uname.machine,
systeminfo.cpu.count,
(unsigned long long)((double)systeminfo.memory.size / 1024.), // Send as kB for backward compatibility
(unsigned long long)((double)systeminfo.swap.size / 1024.)); // Send as kB for backward compatibility
}
/**
* Prints a document footer into the given buffer.
* @param B StringBuffer object
*/
static void document_foot(StringBuffer_T B) {
StringBuffer_append(B, "");
}
static void _ioStatistics(StringBuffer_T B, const char *name, IOStatistics_T statistics) {
StringBuffer_append(B, "<%s>", name);
if (Statistics_initialized(&(statistics->bytes))) {
StringBuffer_append(B,
""
"%.0lf" // bytes per second
"%"PRIu64"" // bytes since boot
"",
Statistics_deltaNormalize(&(statistics->bytes)),
Statistics_raw(&(statistics->bytes)));
}
if (Statistics_initialized(&(statistics->operations))) {
StringBuffer_append(B,
""
"%.0lf" // operations per second
"%"PRIu64"" // operations since boot
"",
Statistics_deltaNormalize(&(statistics->operations)),
Statistics_raw(&(statistics->operations)));
}
StringBuffer_append(B, "", name);
}
/**
* Prints a service status into the given buffer.
* @param S Service object
* @param B StringBuffer object
* @param V Format version
*/
static void status_service(Service_T S, StringBuffer_T B, int V) {
if (V == 2)
StringBuffer_append(B, "%d", S->name ? S->name : "", S->type);
else
StringBuffer_append(B, "%s", S->type, S->name ? S->name : "");
StringBuffer_append(B,
"%lld"
"%ld"
"%d"
"%d"
"%d"
"%d"
"%d"
"%d",
(long long)S->collected.tv_sec,
(long)S->collected.tv_usec,
S->error,
S->error_hint,
S->monitor,
S->mode,
S->onreboot,
S->doaction);
if (S->every.type != Every_Cycle) {
StringBuffer_append(B, "%d", S->every.type);
if (S->every.type == 1)
StringBuffer_append(B, "%d%d", S->every.spec.cycle.counter, S->every.spec.cycle.number);
else
StringBuffer_append(B, "%s", S->every.spec.cron);
StringBuffer_append(B, "");
}
if (Util_hasServiceStatus(S)) {
switch (S->type) {
case Service_File:
StringBuffer_append(B,
"%o"
"%d"
"%d"
"%lld"
"%llu",
S->inf.file->mode & 07777,
(int)S->inf.file->uid,
(int)S->inf.file->gid,
(long long)S->inf.file->timestamp,
(unsigned long long)S->inf.file->size);
if (S->checksum)
StringBuffer_append(B, "%s", checksumnames[S->checksum->type], S->inf.file->cs_sum);
break;
case Service_Directory:
StringBuffer_append(B,
"%o"
"%d"
"%d"
"%lld",
S->inf.directory->mode & 07777,
(int)S->inf.directory->uid,
(int)S->inf.directory->gid,
(long long)S->inf.directory->timestamp);
break;
case Service_Fifo:
StringBuffer_append(B,
"%o"
"%d"
"%d"
"%lld",
S->inf.fifo->mode & 07777,
(int)S->inf.fifo->uid,
(int)S->inf.fifo->gid,
(long long)S->inf.fifo->timestamp);
break;
case Service_Filesystem:
StringBuffer_append(B,
"%s"
"%s"
"%o"
"%d"
"%d"
""
"%.1f"
"%.1lf"
"%.1lf"
"",
S->inf.filesystem->object.type,
S->inf.filesystem->flags,
S->inf.filesystem->mode & 07777,
(int)S->inf.filesystem->uid,
(int)S->inf.filesystem->gid,
S->inf.filesystem->space_percent,
S->inf.filesystem->f_bsize > 0 ? (double)S->inf.filesystem->space_total / 1048576. * (double)S->inf.filesystem->f_bsize : 0.,
S->inf.filesystem->f_bsize > 0 ? (double)S->inf.filesystem->f_blocks / 1048576. * (double)S->inf.filesystem->f_bsize : 0.);
if (S->inf.filesystem->f_files > 0) {
StringBuffer_append(B,
""
"%.1f"
"%lld"
"%lld"
"",
S->inf.filesystem->inode_percent,
S->inf.filesystem->inode_total,
S->inf.filesystem->f_files);
}
_ioStatistics(B, "read", &(S->inf.filesystem->read));
_ioStatistics(B, "write", &(S->inf.filesystem->write));
boolean_t hasReadTime = Statistics_initialized(&(S->inf.filesystem->time.read));
boolean_t hasWriteTime = Statistics_initialized(&(S->inf.filesystem->time.write));
boolean_t hasWaitTime = Statistics_initialized(&(S->inf.filesystem->time.wait));
boolean_t hasRunTime = Statistics_initialized(&(S->inf.filesystem->time.run));
if (hasReadTime || hasWriteTime || hasWaitTime || hasRunTime) {
StringBuffer_append(B, "");
if (hasReadTime)
StringBuffer_append(B, "%.3f", Statistics_deltaNormalize(&(S->inf.filesystem->time.read)));
if (hasWriteTime)
StringBuffer_append(B, "%.3f", Statistics_deltaNormalize(&(S->inf.filesystem->time.write)));
if (hasWaitTime)
StringBuffer_append(B, "%.3f", Statistics_deltaNormalize(&(S->inf.filesystem->time.wait)));
if (hasRunTime)
StringBuffer_append(B, "%.3f", Statistics_deltaNormalize(&(S->inf.filesystem->time.run)));
StringBuffer_append(B, "");
}
break;
case Service_Net:
StringBuffer_append(B,
""
"%d"
"%lld"
"%d"
""
""
"%lld"
"%lld"
""
""
"%lld"
"%lld"
""
""
"%lld"
"%lld"
""
""
""
""
"%lld"
"%lld"
""
""
"%lld"
"%lld"
""
""
"%lld"
"%lld"
""
""
"",
Link_getState(S->inf.net->stats),
Link_getSpeed(S->inf.net->stats),
Link_getDuplex(S->inf.net->stats),
Link_getPacketsInPerSecond(S->inf.net->stats),
Link_getPacketsInTotal(S->inf.net->stats),
Link_getBytesInPerSecond(S->inf.net->stats),
Link_getBytesInTotal(S->inf.net->stats),
Link_getErrorsInPerSecond(S->inf.net->stats),
Link_getErrorsInTotal(S->inf.net->stats),
Link_getPacketsOutPerSecond(S->inf.net->stats),
Link_getPacketsOutTotal(S->inf.net->stats),
Link_getBytesOutPerSecond(S->inf.net->stats),
Link_getBytesOutTotal(S->inf.net->stats),
Link_getErrorsOutPerSecond(S->inf.net->stats),
Link_getErrorsOutTotal(S->inf.net->stats));
break;
case Service_Process:
StringBuffer_append(B,
"%d"
"%d"
"%d"
"%d"
"%d"
"%lld",
S->inf.process->pid,
S->inf.process->ppid,
S->inf.process->uid,
S->inf.process->euid,
S->inf.process->gid,
(long long)S->inf.process->uptime);
if (Run.flags & Run_ProcessEngineEnabled) {
StringBuffer_append(B,
"%d"
"%d"
""
"%.1f"
"%.1f"
"%llu"
"%llu"
""
""
"%.1f"
"%.1f"
"",
S->inf.process->threads,
S->inf.process->children,
S->inf.process->mem_percent,
S->inf.process->total_mem_percent,
(unsigned long long)((double)S->inf.process->mem / 1024.), // Send as kB for backward compatibility
(unsigned long long)((double)S->inf.process->total_mem / 1024.), // Send as kB for backward compatibility
S->inf.process->cpu_percent,
S->inf.process->total_cpu_percent);
}
_ioStatistics(B, "read", &(S->inf.process->read));
_ioStatistics(B, "write", &(S->inf.process->write));
break;
default:
break;
}
for (Icmp_T i = S->icmplist; i; i = i->next) {
StringBuffer_append(B,
""
"%s"
"%.6f"
"",
icmpnames[i->type],
i->is_available == Connection_Ok ? i->response / 1000. : -1.); // We send the response time in [s] for backward compatibility (with microseconds precision)
}
for (Port_T p = S->portlist; p; p = p->next) {
StringBuffer_append(B,
""
"%s"
"%d"
""
"%s"
"%s"
"%.6f",
p->hostname ? p->hostname : "",
p->target.net.port,
Util_portRequestDescription(p),
p->protocol->name ? p->protocol->name : "",
Util_portTypeDescription(p),
p->is_available == Connection_Ok ? p->response / 1000. : -1.); // We send the response time in [s] for backward compatibility (with microseconds precision)
if (p->target.net.ssl.options.flags)
StringBuffer_append(B,
""
"%d"
"",
p->target.net.ssl.certificate.validDays);
StringBuffer_append(B,
"");
}
for (Port_T p = S->socketlist; p; p = p->next) {
StringBuffer_append(B,
""
"%s"
"%s"
"%.6f"
"",
p->target.unix.pathname ? p->target.unix.pathname : "",
p->protocol->name ? p->protocol->name : "",
p->is_available == Connection_Ok ? p->response / 1000. : -1.); // We send the response time in [s] for backward compatibility (with microseconds precision)
}
if (S->type == Service_System && (Run.flags & Run_ProcessEngineEnabled)) {
StringBuffer_append(B,
""
""
"%.2f"
"%.2f"
"%.2f"
""
""
"%.1f"
"%.1f"
#ifdef HAVE_CPU_WAIT
"%.1f"
#endif
""
""
"%.1f"
"%llu"
""
""
"%.1f"
"%llu"
""
"",
systeminfo.loadavg[0],
systeminfo.loadavg[1],
systeminfo.loadavg[2],
systeminfo.cpu.usage.user > 0. ? systeminfo.cpu.usage.user : 0.,
systeminfo.cpu.usage.system > 0. ? systeminfo.cpu.usage.system : 0.,
#ifdef HAVE_CPU_WAIT
systeminfo.cpu.usage.wait > 0. ? systeminfo.cpu.usage.wait : 0.,
#endif
systeminfo.memory.usage.percent,
(unsigned long long)((double)systeminfo.memory.usage.bytes / 1024.), // Send as kB for backward compatibility
systeminfo.swap.usage.percent,
(unsigned long long)((double)systeminfo.swap.usage.bytes / 1024.)); // Send as kB for backward compatibility
}
if (S->type == Service_Program && S->program->started) {
StringBuffer_append(B,
""
"%lld"
"%d"
""
"");
}
}
StringBuffer_append(B, "");
}
/**
* Prints a servicegroups into the given buffer.
* @param SG ServiceGroup object
* @param B StringBuffer object
*/
static void status_servicegroup(ServiceGroup_T SG, StringBuffer_T B) {
StringBuffer_append(B, "", SG->name);
for (list_t m = SG->members->head; m; m = m->next) {
Service_T s = m->e;
StringBuffer_append(B, "%s", s->name);
}
StringBuffer_append(B, "");
}
/**
* Prints a event description into the given buffer.
* @param E Event object
* @param B StringBuffer object
*/
static void status_event(Event_T E, StringBuffer_T B) {
StringBuffer_append(B,
""
"%lld"
"%ld"
"%s"
"%d"
"%ld"
"%d"
"%d"
"collected.tv_sec,
(long)E->collected.tv_usec,
E->id == Event_Instance ? "Monit" : E->source->name,
E->type,
E->id,
E->state,
Event_get_action(E));
_escapeCDATA(B, E->message);
StringBuffer_append(B, "]]>");
if (E->source->token)
StringBuffer_append(B, "%s", E->source->token);
StringBuffer_append(B, "");
}
/* ------------------------------------------------------------------ Public */
/**
* Get a XML formated message for event notification or general status
* of monitored services and resources.
* @param E An event object or NULL for general status
* @param V Format version
* @param myip The client-side IP address
*/
void status_xml(StringBuffer_T B, Event_T E, int V, const char *myip) {
Service_T S;
ServiceGroup_T SG;
document_head(B, V, myip);
if (V == 2)
StringBuffer_append(B, "");
for (S = servicelist_conf; S; S = S->next_conf)
status_service(S, B, V);
if (V == 2) {
StringBuffer_append(B, "");
for (SG = servicegrouplist; SG; SG = SG->next)
status_servicegroup(SG, B);
StringBuffer_append(B, "");
}
if (E)
status_event(E, B);
document_foot(B);
}
monit-5.21.0/src/http/processor.c 0000644 0001751 0001751 00000100104 13057552676 016602 0 ustar martinp martinp /*
* Copyright (C) Tildeslash Ltd. All rights reserved.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License version 3.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*
* In addition, as a special exception, the copyright holders give
* permission to link the code of portions of this program with the
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
* You must obey the GNU Affero General Public License in all respects
* for all of the code used other than OpenSSL.
*/
#include "config.h"
#ifdef HAVE_STDIO_H
#include
#endif
#ifdef HAVE_STDLIB_H
#include
#endif
#ifdef HAVE_ERRNO_H
#include
#endif
#ifdef HAVE_STDARG_H
#include
#endif
#ifdef HAVE_SYS_TYPES_H
#include
#endif
#ifdef HAVE_SYS_SOCKET_H
#include
#endif
#ifdef HAVE_SETJMP_H
#include
#endif
#ifdef HAVE_STRING_H
#include
#endif
#ifdef HAVE_STRINGS_H
#include
#endif
#ifdef HAVE_UNISTD_H
#include
#endif
#ifdef HAVE_LIMITS_H
#include
#endif
#include "monit.h"
#include "processor.h"
#include "base64.h"
// libmonit
#include "util/Str.h"
#include "system/Net.h"
/**
* A naive quasi HTTP Processor module that can handle HTTP requests
* received from a client, and return responses based on those
* requests.
*
* This Processor delegates the actual handling of the request and
* reponse to so called cervlets, which must implement two methods;
* doGet and doPost.
*
* NOTES
* This Processor is command oriented and if a second slash '/' is
* found in the URL it's asumed to be the PATHINFO. In other words
* this processor perceive an URL as:
*
* /COMMAND?QUERYSTRING/PATHINFO
*
* The doGet/doPost routines act's on the COMMAND. See the
* cervlet.c code in this dir. for an example.
*
* @file
*/
static int _httpPostLimit;
/* -------------------------------------------------------------- Prototypes */
static void do_service(Socket_T);
static void destroy_entry(void *);
static char *get_date(char *, int);
static char *get_server(char *, int);
static void create_headers(HttpRequest);
static void send_response(HttpRequest, HttpResponse);
static boolean_t basic_authenticate(HttpRequest);
static void done(HttpRequest, HttpResponse);
static void destroy_HttpRequest(HttpRequest);
static void reset_response(HttpResponse res);
static HttpParameter parse_parameters(char *);
static boolean_t create_parameters(HttpRequest req);
static void destroy_HttpResponse(HttpResponse);
static HttpRequest create_HttpRequest(Socket_T);
static void internal_error(Socket_T, int, char *);
static HttpResponse create_HttpResponse(Socket_T);
static boolean_t is_authenticated(HttpRequest, HttpResponse);
static int get_next_token(char *s, int *cursor, char **r);
/*
* An object for implementors of the service functions; doGet and
* doPost. Implementing modules i.e. CERVLETS, must implement the
* doGet and doPost functions and the engine will call the add_Impl
* function to setup the callback to these functions.
*/
struct ServiceImpl {
void(*doGet)(HttpRequest, HttpResponse);
void(*doPost)(HttpRequest, HttpResponse);
} Impl;
/* ------------------------------------------------------------------ Public */
/**
* Process a HTTP request. This is done by dispatching to the service
* function.
* @param s A Socket_T representing the client connection
*/
void *http_processor(Socket_T s) {
if (! Net_canRead(Socket_getSocket(s), REQUEST_TIMEOUT * 1000))
internal_error(s, SC_REQUEST_TIMEOUT, "Time out when handling the Request");
else
do_service(s);
Socket_free(&s);
return NULL;
}
/**
* Callback for implementors of cervlet functions.
* @param doGetFunc doGet function
* @param doPostFunc doPost function
*/
void add_Impl(void(*doGet)(HttpRequest, HttpResponse), void(*doPost)(HttpRequest, HttpResponse)) {
Impl.doGet = doGet;
Impl.doPost = doPost;
}
void Processor_setHttpPostLimit() {
// Base buffer size (space for e.g. "action=")
_httpPostLimit = STRLEN;
// Add space for each service
for (Service_T s = servicelist; s; s = s->next)
_httpPostLimit += strlen("&service=") + strlen(s->name);
}
void escapeHTML(StringBuffer_T sb, const char *s) {
for (int i = 0; s[i]; i++) {
if (s[i] == '<')
StringBuffer_append(sb, "<");
else if (s[i] == '>')
StringBuffer_append(sb, ">");
else if (s[i] == '&')
StringBuffer_append(sb, "&");
else
StringBuffer_append(sb, "%c", s[i]);
}
}
/**
* Send an error message
* @param res HttpResponse object
* @param code Error Code to lookup and send
* @param msg Optional error message (may be NULL)
*/
void send_error(HttpRequest req, HttpResponse res, int code, const char *msg, ...) {
ASSERT(msg);
const char *err = get_status_string(code);
reset_response(res);
set_content_type(res, "text/html");
set_status(res, code);
StringBuffer_append(res->outputbuffer,
""
""
"%d %s"
""
""
"
%s
",
code, err, err);
char *message;
va_list ap;
va_start(ap, msg);
message = Str_vcat(msg, ap);
va_end(ap);
escapeHTML(res->outputbuffer, message);
if (code != SC_UNAUTHORIZED) // We log details in basic_authenticate() already, no need to log generic error sent to client here
LogError("HttpRequest: error -- client [%s]: %s %d %s\n", NVLSTR(Socket_getRemoteHost(req->S)), SERVER_PROTOCOL, code, message);
FREE(message);
char server[STRLEN];
StringBuffer_append(res->outputbuffer,
""
"%s"
""
""
"\r\n",
SERVER_URL, get_server(server, STRLEN));
}
/* -------------------------------------------------------------- Properties */
/**
* Adds a response header with the given name and value. If the header
* had already been set the new value overwrites the previous one.
* @param res HttpResponse object
* @param name Header key name
* @param value Header key value
*/
void set_header(HttpResponse res, const char *name, const char *value, ...) {
HttpHeader h = NULL;
ASSERT(res);
ASSERT(name);
NEW(h);
h->name = Str_dup(name);
va_list ap;
va_start(ap, value);
h->value = Str_vcat(value, ap);
va_end(ap);
if (res->headers) {
HttpHeader n, p;
for (n = p = res->headers; p; n = p, p = p->next) {
if (IS(p->name, name)) {
FREE(p->value);
p->value = Str_dup(h->value);
destroy_entry(h);
return;
}
}
n->next = h;
} else {
res->headers = h;
}
}
/**
* Sets the status code for the response
* @param res HttpResponse object
* @param code A HTTP status code <100-510>
* @param msg The status code string message
*/
void set_status(HttpResponse res, int code) {
res->status = code;
res->status_msg = get_status_string(code);
}
/**
* Set the response content-type
* @param res HttpResponse object
* @param mime Mime content type, e.g. text/html
*/
void set_content_type(HttpResponse res, const char *mime) {
ASSERT(mime);
set_header(res, "Content-Type", "%s", mime);
}
/**
* Returns the value of the specified header
* @param req HttpRequest object
* @param name Header name to lookup the value for
* @return The value of the specified header, NULL if not found
*/
const char *get_header(HttpRequest req, const char *name) {
for (HttpHeader p = req->headers; p; p = p->next)
if (IS(p->name, name))
return (p->value);
return NULL;
}
/**
* Returns the value of the specified parameter
* @param req HttpRequest object
* @param name The request parameter key to lookup the value for
* @return The value of the specified parameter, or NULL if not found
*/
const char *get_parameter(HttpRequest req, const char *name) {
for (HttpParameter p = req->params; p; p = p->next)
if (IS(p->name, name))
return (p->value);
return NULL;
}
/**
* Returns a string containing all (extra) headers found in the
* response. The headers are newline separated in the returned
* string.
* @param res HttpResponse object
* @return A String containing all headers set in the Response object
*/
char *get_headers(HttpResponse res) {
char buf[RES_STRLEN];
char *b = buf;
*buf = 0;
for (HttpHeader p = res->headers; (((b - buf) + STRLEN) < RES_STRLEN) && p; p = p->next)
b += snprintf(b, STRLEN,"%s: %s\r\n", p->name, p->value);
return buf[0] ? Str_dup(buf) : NULL;
}
/**
* Lookup the corresponding HTTP status string for the given status
* code
* @param status A HTTP status code
* @return A default status message for the specified HTTP status
* code.
*/
const char *get_status_string(int status) {
switch (status) {
case SC_OK:
return "OK";
case SC_ACCEPTED:
return "Accepted";
case SC_BAD_GATEWAY:
return "Bad Gateway";
case SC_BAD_REQUEST:
return "Bad Request";
case SC_CONFLICT:
return "Conflict";
case SC_CONTINUE:
return "Continue";
case SC_CREATED:
return "Created";
case SC_EXPECTATION_FAILED:
return "Expectation Failed";
case SC_FORBIDDEN:
return "Forbidden";
case SC_GATEWAY_TIMEOUT:
return "Gateway Timeout";
case SC_GONE:
return "Gone";
case SC_VERSION_NOT_SUPPORTED:
return "HTTP Version Not Supported";
case SC_INTERNAL_SERVER_ERROR:
return "Internal Server Error";
case SC_LENGTH_REQUIRED:
return "Length Required";
case SC_METHOD_NOT_ALLOWED:
return "Method Not Allowed";
case SC_MOVED_PERMANENTLY:
return "Moved Permanently";
case SC_MOVED_TEMPORARILY:
return "Moved Temporarily";
case SC_MULTIPLE_CHOICES:
return "Multiple Choices";
case SC_NO_CONTENT:
return "No Content";
case SC_NON_AUTHORITATIVE:
return "Non-Authoritative Information";
case SC_NOT_ACCEPTABLE:
return "Not Acceptable";
case SC_NOT_FOUND:
return "Not Found";
case SC_NOT_IMPLEMENTED:
return "Not Implemented";
case SC_NOT_MODIFIED:
return "Not Modified";
case SC_PARTIAL_CONTENT:
return "Partial Content";
case SC_PAYMENT_REQUIRED:
return "Payment Required";
case SC_PRECONDITION_FAILED:
return "Precondition Failed";
case SC_PROXY_AUTHENTICATION_REQUIRED:
return "Proxy Authentication Required";
case SC_REQUEST_ENTITY_TOO_LARGE:
return "Request Entity Too Large";
case SC_REQUEST_TIMEOUT:
return "Request Timeout";
case SC_REQUEST_URI_TOO_LARGE:
return "Request URI Too Large";
case SC_RANGE_NOT_SATISFIABLE:
return "Requested Range Not Satisfiable";
case SC_RESET_CONTENT:
return "Reset Content";
case SC_SEE_OTHER:
return "See Other";
case SC_SERVICE_UNAVAILABLE:
return "Service Unavailable";
case SC_SWITCHING_PROTOCOLS:
return "Switching Protocols";
case SC_UNAUTHORIZED:
return "Unauthorized";
case SC_UNSUPPORTED_MEDIA_TYPE:
return "Unsupported Media Type";
case SC_USE_PROXY:
return "Use Proxy";
default: {
return "Unknown HTTP status";
}
}
}
/* ----------------------------------------------------------------- Private */
/**
* Receives standard HTTP requests from a client socket and dispatches
* them to the doXXX methods defined in a cervlet module.
*/
static void do_service(Socket_T s) {
volatile HttpResponse res = create_HttpResponse(s);
volatile HttpRequest req = create_HttpRequest(s);
if (res && req) {
if (Run.httpd.socket.net.ssl.flags & SSL_Enabled)
set_header(res, "Strict-Transport-Security", "max-age=63072000; includeSubdomains; preload");
if (is_authenticated(req, res)) {
set_header(res, "Set-Cookie", "securitytoken=%s; Max-Age=600; HttpOnly; SameSite=strict%s", res->token, (Run.httpd.socket.net.ssl.flags & SSL_Enabled) ? "; Secure" : "");
if (IS(req->method, METHOD_GET))
Impl.doGet(req, res);
else if (IS(req->method, METHOD_POST))
Impl.doPost(req, res);
else
send_error(req, res, SC_NOT_IMPLEMENTED, "Method not implemented");
}
send_response(req, res);
}
done(req, res);
}
/**
* Return a (RFC1123) Date string
*/
static char *get_date(char *result, int size) {
time_t now;
time(&now);
if (strftime(result, size, DATEFMT, gmtime(&now)) <= 0)
*result = 0;
return result;
}
/**
* Return this server name + version
*/
static char *get_server(char *result, int size) {
snprintf(result, size, "%s %s", SERVER_NAME, Run.httpd.flags & Httpd_Signature ? SERVER_VERSION : "");
return result;
}
/**
* Send the response to the client. If the response has already been
* commited, this function does nothing.
*/
static void send_response(HttpRequest req, HttpResponse res) {
Socket_T S = res->S;
if (! res->is_committed) {
char date[STRLEN];
char server[STRLEN];
#ifdef HAVE_LIBZ
const char *acceptEncoding = get_header(req, "Accept-Encoding");
boolean_t canCompress = acceptEncoding && Str_sub(acceptEncoding, "gzip") ? true : false;
#else
boolean_t canCompress = false;
#endif
const void *body = NULL;
size_t bodyLength = 0;
if (canCompress && StringBuffer_length(res->outputbuffer) > 0) {
body = StringBuffer_toCompressed(res->outputbuffer, 6, &bodyLength);
set_header(res, "Content-Encoding", "gzip");
} else {
body = StringBuffer_toString(res->outputbuffer);
bodyLength = StringBuffer_length(res->outputbuffer);
}
char *headers = get_headers(res);
res->is_committed = true;
get_date(date, STRLEN);
get_server(server, STRLEN);
Socket_print(S, "%s %d %s\r\n", res->protocol, res->status, res->status_msg);
Socket_print(S, "Date: %s\r\n", date);
Socket_print(S, "Server: %s\r\n", server);
Socket_print(S, "Content-Length: %zu\r\n", bodyLength);
Socket_print(S, "Connection: close\r\n");
if (headers)
Socket_print(S, "%s", headers);
Socket_print(S, "\r\n");
if (bodyLength)
Socket_write(S, (unsigned char *)body, bodyLength);
FREE(headers);
}
}
/* --------------------------------------------------------------- Factories */
/**
* Returns a new HttpRequest object wrapping the client request
*/
static HttpRequest create_HttpRequest(Socket_T S) {
char line[REQ_STRLEN];
if (Socket_readLine(S, line, sizeof(line)) == NULL) {
internal_error(S, SC_BAD_REQUEST, "No request found");
return NULL;
}
Str_chomp(line);
char method[STRLEN];
char url[REQ_STRLEN];
char protocol[STRLEN];
if (sscanf(line, "%255s %1023s HTTP/%3[1.0]", method, url, protocol) != 3) {
internal_error(S, SC_BAD_REQUEST, "Cannot parse request");
return NULL;
}
if (strlen(url) >= MAX_URL_LENGTH) {
internal_error(S, SC_BAD_REQUEST, "[error] URL too long");
return NULL;
}
HttpRequest req = NULL;
NEW(req);
req->S = S;
Util_urlDecode(url);
req->url = Str_dup(url);
req->method = Str_dup(method);
req->protocol = Str_dup(protocol);
create_headers(req);
if (! create_parameters(req)) {
destroy_HttpRequest(req);
internal_error(S, SC_BAD_REQUEST, "Cannot parse Request parameters");
return NULL;
}
return req;
}
/**
* Returns a new HttpResponse object wrapping a default response. Use
* the set_XXX methods to change the object.
*/
static HttpResponse create_HttpResponse(Socket_T S) {
HttpResponse res = NULL;
NEW(res);
res->S = S;
res->status = SC_OK;
res->outputbuffer = StringBuffer_create(256);
res->is_committed = false;
res->protocol = SERVER_PROTOCOL;
res->status_msg = get_status_string(SC_OK);
Util_getToken(res->token);
return res;
}
/**
* Create HTTP headers for the given request
*/
static void create_headers(HttpRequest req) {
char line[REQ_STRLEN] = {0};
while (Socket_readLine(req->S, line, sizeof(line)) && ! (Str_isEqual(line, "\r\n") || Str_isEqual(line, "\n"))) {
char *value = strchr(line, ':');
if (value) {
HttpHeader header = NULL;
NEW(header);
*value++ = 0;
Str_trim(line);
Str_trim(value);
Str_chomp(value);
header->name = Str_dup(line);
header->value = Str_dup(value);
header->next = req->headers;
req->headers = header;
}
}
}
/**
* Create parameters for the given request. Returns false if an error
* occurs.
*/
static boolean_t create_parameters(HttpRequest req) {
char *query_string = NULL;
if (IS(req->method, METHOD_POST)) {
int len;
const char *content_length = get_header(req, "Content-Length");
if (! content_length || sscanf(content_length, "%d", &len) != 1 || len < 0 || len > _httpPostLimit)
return false;
if (len != 0) {
query_string = CALLOC(1, _httpPostLimit + 1);
int n = Socket_read(req->S, query_string, len);
if (n != len) {
FREE(query_string);
return false;
}
}
} else if (IS(req->method, METHOD_GET)) {
char *p = strchr(req->url, '?');
if (p) {
*p++ = 0;
query_string = Str_dup(p);
}
}
if (query_string) {
if (*query_string) {
char *p = strchr(query_string, '/');
if (p) {
*p++ = 0;
req->pathinfo = Str_dup(p);
}
req->params = parse_parameters(query_string);
}
FREE(query_string);
}
return true;
}
/* ----------------------------------------------------------------- Cleanup */
/**
* Clear the response output buffer and headers
*/
static void reset_response(HttpResponse res) {
if (res->headers) {
destroy_entry(res->headers);
res->headers = NULL; /* Release Pragma */
}
StringBuffer_clear(res->outputbuffer);
}
/**
* Finalize the request and response object.
*/
static void done(HttpRequest req, HttpResponse res) {
destroy_HttpRequest(req);
destroy_HttpResponse(res);
}
/**
* Free a HttpRequest object
*/
static void destroy_HttpRequest(HttpRequest req) {
if (req) {
FREE(req->method);
FREE(req->url);
FREE(req->pathinfo);
FREE(req->protocol);
FREE(req->remote_user);
if (req->headers)
destroy_entry(req->headers);
if (req->params)
destroy_entry(req->params);
FREE(req);
}
}
/**
* Free a HttpResponse object
*/
static void destroy_HttpResponse(HttpResponse res) {
if (res) {
StringBuffer_free(&(res->outputbuffer));
if (res->headers)
destroy_entry(res->headers);
FREE(res);
}
}
/**
* Free a (linked list of) http entry object(s). Both HttpHeader and
* HttpParameter are of this type.
*/
static void destroy_entry(void *p) {
struct entry *h = p;
if (h->next)
destroy_entry(h->next);
FREE(h->name);
FREE(h->value);
FREE(h);
}
/* ----------------------------------------------------- Checkers/Validators */
static boolean_t _isCookieSeparator(int c) {
return (c == ' ' || c == '\n' || c == ';' || c == ',');
}
static boolean_t is_authenticated(HttpRequest req, HttpResponse res) {
if (Run.httpd.credentials) {
if (! basic_authenticate(req)) {
// Send just generic error message to the client to not disclose e.g. username existence in case of credentials harvesting attack
send_error(req, res, SC_UNAUTHORIZED, "You are not authorized to access monit. Either you supplied the wrong credentials (e.g. bad password), or your browser doesn't understand how to supply the credentials required");
set_header(res, "WWW-Authenticate", "Basic realm=\"monit\"");
return false;
}
}
if (IS(req->method, METHOD_POST)) {
// Check CSRF double-submit cookie (https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Double_Submit_Cookie)
const char *token = get_parameter(req, "securitytoken");
if (! token) {
LogError("HttpRequest: access denied -- client [%s]: missing CSRF token in HTTP parameter\n", NVLSTR(Socket_getRemoteHost(req->S)));
send_error(req, res, SC_FORBIDDEN, "Invalid CSRF Token");
return false;
}
const char *cookie = get_header(req, "Cookie");
if (! cookie) {
LogError("HttpRequest: access denied -- client [%s]: missing CSRF token cookie\n", NVLSTR(Socket_getRemoteHost(req->S)));
send_error(req, res, SC_FORBIDDEN, "Invalid CSRF Token");
return false;
}
const char *cookieName = "securitytoken=";
for (int i = 0, j = 0; cookie[i]; i++) {
if (_isCookieSeparator(cookie[i])) {
// Cookie separator
j = 0;
continue;
}
if (j < 14) {
// Cookie name
if (cookie[i] == cookieName[j]) {
j++;
continue;
} else {
j = 0;
}
} else if (j == 14) {
// Cookie value
char cookieValue[STRLEN] = {};
strncpy(cookieValue, cookie + i, sizeof(cookieValue) - 1);
for (int k = 0; cookieValue[k]; k++) {
if (_isCookieSeparator(cookieValue[k])) {
cookieValue[k] = 0;
break;
}
}
if (Str_compareConstantTime(cookieValue, token)) {
LogError("HttpRequest: access denied -- client [%s]: CSRF token mismatch\n", NVLSTR(Socket_getRemoteHost(req->S)));
send_error(req, res, SC_FORBIDDEN, "Invalid CSRF Token");
return false;
}
return true;
}
}
LogError("HttpRequest: access denied -- client [%s]: no CSRF token in cookie\n", NVLSTR(Socket_getRemoteHost(req->S)));
send_error(req, res, SC_FORBIDDEN, "Invalid CSRF Token");
return false;
}
return true;
}
/**
* Authenticate the basic-credentials (uname/password) submitted by
* the user.
*/
static boolean_t basic_authenticate(HttpRequest req) {
const char *credentials = get_header(req, "Authorization");
if (! (credentials && Str_startsWith(credentials, "Basic "))) {
LogError("HttpRequest: access denied -- client [%s]: missing or invalid Authorization header\n", NVLSTR(Socket_getRemoteHost(req->S)));
return false;
}
char buf[STRLEN] = {0};
strncpy(buf, &credentials[6], sizeof(buf) - 1);
char uname[STRLEN] = {0};
if (decode_base64((unsigned char *)uname, buf) <= 0) {
LogError("HttpRequest: access denied -- client [%s]: invalid Authorization header\n", NVLSTR(Socket_getRemoteHost(req->S)));
return false;
}
if (! *uname) {
LogError("HttpRequest: access denied -- client [%s]: empty username\n", NVLSTR(Socket_getRemoteHost(req->S)));
return false;
}
char *password = password = strchr(uname, ':');
if (! password || ! *password) {
LogError("HttpRequest: access denied -- client [%s]: empty password\n", NVLSTR(Socket_getRemoteHost(req->S)));
return false;
}
*password++ = 0;
/* Check if user exist */
if (! Util_getUserCredentials(uname)) {
LogError("HttpRequest: access denied -- client [%s]: unknown user '%s'\n", NVLSTR(Socket_getRemoteHost(req->S)), uname);
return false;
}
/* Check if user has supplied the right password */
if (! Util_checkCredentials(uname, password)) {
LogError("HttpRequest: access denied -- client [%s]: wrong password for user '%s'\n", NVLSTR(Socket_getRemoteHost(req->S)), uname);
return false;
}
req->remote_user = Str_dup(uname);
return true;
}
/* --------------------------------------------------------------- Utilities */
/**
* Send an error message to the client. This is a helper function,
* used internal if the service function fails to setup the framework
* properly; i.e. with a valid HttpRequest and a valid HttpResponse.
*/
static void internal_error(Socket_T S, int status, char *msg) {
char date[STRLEN];
char server[STRLEN];
const char *status_msg = get_status_string(status);
get_date(date, STRLEN);
get_server(server, STRLEN);
Socket_print(S,
"%s %d %s\r\n"
"Date: %s\r\n"
"Server: %s\r\n"
"Content-Type: text/html\r\n"
"Connection: close\r\n"
"\r\n"
"%s"
"