aboutsummaryrefslogtreecommitdiffstats
path: root/config/checkmk-agent/checkmk.inc
diff options
context:
space:
mode:
Diffstat (limited to 'config/checkmk-agent/checkmk.inc')
-rw-r--r--config/checkmk-agent/checkmk.inc338
1 files changed, 190 insertions, 148 deletions
diff --git a/config/checkmk-agent/checkmk.inc b/config/checkmk-agent/checkmk.inc
index 67d82e6b..1ab92400 100644
--- a/config/checkmk-agent/checkmk.inc
+++ b/config/checkmk-agent/checkmk.inc
@@ -27,10 +27,11 @@
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
*/
+require_once("filter.inc");
+require_once("pfsense-utils.inc");
+require_once("util.inc");
+
define('ETC_SERVICES', '/etc/services');
-define('ETC_INETD', '/etc/inetd.conf');
-define('ETC_HOSTS_ALLOW', '/etc/hosts.allow');
-define('ETC_RC_CONF', '/etc/rc.conf.local');
function checkmk_install() {
/*
@@ -39,24 +40,62 @@ function checkmk_install() {
*/
$checkmk_bin = "/usr/local/bin/check_mk_agent";
$checkmk_url = 'http://git.mathias-kettner.de/git/?p=check_mk.git;a=blob_plain;f=agents/check_mk_agent.freebsd;hb=e13899bde8bdafe13780427811c8153c59be807f';
- mwexec("fetch -o {$checkmk_bin} \"{$checkmk_url}\"");
+ mwexec("/usr/bin/fetch -o {$checkmk_bin} \"{$checkmk_url}\"");
chmod($checkmk_bin, 0755);
- sync_package_checkmk();
+ /* Detect possible junk left over after previous bad package versions */
+ checkmk_decrapify();
+}
+
+function checkmk_deinstall() {
+ /* Remove entry from /etc/services file */
+ checkmk_cleanup_etc_services_file();
+ /* Remove check_mk_agent script fetched via checkmk_install() */
+ unlink_if_exists("/usr/local/bin/check_mk_agent");
+ /* Detect possible junk left over after previous bad package versions */
+ checkmk_decrapify();
+}
+
+function checkmk_decrapify() {
+ $i = 0;
+ if (exec("/usr/bin/wc -l /etc/hosts.allow | /usr/bin/awk '{ print $1 }'") > 5) {
+ log_error("[check_mk-agent] Possibly redundant lines found in /etc/hosts.allow.");
+ $i++;
+ }
+ if (exec("/usr/bin/wc -l /etc/inetd.conf | /usr/bin/awk '{ print $1 }'") > 1) {
+ log_error("[check_mk-agent] Possibly redundant lines found in /etc/inetd.conf.");
+ $i++;
+ }
+ if (file_exists("/etc/rc.conf.local")) {
+ log_error("[check_mk-agent] /etc/rc.conf.local file found; this file does not exist normally on pfSense.");
+ $i++;
+ }
+ if ($i > 0) {
+ log_error("[check_mk-agent] Inconsistent configuration files; possibly caused by previous check_mk package versions.");
+ log_error("[check_mk-agent] Please, compare those against default distribution files at https://github.com/pfsense/pfsense and fix as required manually.");
+ file_notice("check_mk-agent", "Inconsistent configuration files found, possibly caused by previous check_mk package versions. See Status - System Logs - General for details.", "Packages", "");
+ }
}
function checkmk_text_area_decode($text) {
return preg_replace('/\r\n/', "\n", base64_decode($text));
}
+function checkmk_cleanup_etc_services_file() {
+ preg_match_all("/check_mk.*/", file_get_contents(ETC_SERVICES), $matches);
+ foreach ($matches[0] as $match => $value) {
+ if (!empty($value)) {
+ remove_text_from_file(ETC_SERVICES, "{$value}\n");
+ }
+ }
+}
+
function sync_package_checkmk() {
global $config, $g, $mk_config;
- $update_conf = 0;
if (!is_array($config['installedpackages']['checkmk']['config'])) {
return;
}
-
$mk_config = $config['installedpackages']['checkmk']['config'][0];
$checkmk_bin = "/usr/local/bin/check_mk_agent";
@@ -71,193 +110,200 @@ function sync_package_checkmk() {
conf_mount_rw();
-
- /* Check services file. */
- $mk_services = file(ETC_SERVICES);
+ /* Check /etc/services file; remove any previous entries first since port could have changed */
+ checkmk_cleanup_etc_services_file();
$port = ($mk_config['checkmkport'] ? $mk_config['checkmkport'] : "6556");
- foreach ($mk_services as $mk_service) {
- if (!preg_match("/check_mk/", $mk_service)) {
- $mk_service_file.=chop($mk_service)."\n";
- }
- }
- if ($mk_config['checkmkenable']=="on") {
- $mk_service_file .= "check_mk {$port}/tcp #check_mk agent\n";
- file_put_contents(ETC_SERVICES, $mk_service_file, LOCK_EX);
- }
-
- /* Check inetd file. */
- $mk_inetds = file(ETC_INETD);
- foreach ($mk_inetds as $mk_inetd) {
- if (!preg_match("/check_mk/",$mk_inetd)) {
- $mk_inetd_file.=chop($mk_inetd)."\n";
- }
- }
- if ($mk_config['checkmkenable']=="on") {
- $mk_inetd_file .= "check_mk stream tcp nowait root /usr/local/bin/check_mk_agent check_mk\n";
- }
- file_put_contents(ETC_INETD, $mk_inetd_file, LOCK_EX);
-
- /* Check hosts.allow file. */
- $mk_hosts = file(ETC_HOSTS_ALLOW);
- $inet_daemons_count = 0;
- foreach ($mk_hosts as $mk_host) {
- if (!preg_match("/check_mk/",$mk_host)) {
- $mk_hosts_file .= chop($mk_host) . "\n";
- }
- if (preg_match("/^\w+/")) {
- $inet_daemons_count++;
- }
- }
if ($mk_config['checkmkenable'] == "on") {
- foreach (explode(',',$mk_config['checkmkhosts']) as $check_mk_host) {
- $mk_hosts_file .= "check_mk : {$check_mk_host} : allow\n";
- $inet_daemons_count++;
- }
+ $mk_service_file = "check_mk {$port}/tcp #check_mk agent\n";
+ add_text_to_file(ETC_SERVICES, $mk_service_file);
}
- file_put_contents(ETC_HOSTS_ALLOW, $mk_hosts_file, LOCK_EX);
- /* Check inetd daemon rc_conf option. */
- $mk_rc_confs= file(ETC_RC_CONF);
- foreach ($mk_rc_confs as $mk_rc_conf) {
- if (!preg_match("/inetd_/",$mk_rc_conf)) {
- $mk_rc_conf_file .= chop($mk_rc_conf)."\n";
+ conf_mount_ro();
+
+ /* Run XMLRPC sync if not booting */
+ if (function_exists("platform_booting")) {
+ if (platform_booting()) {
+ return;
}
+ } elseif ($g['booting']) {
+ return;
+ } else {
+ checkmk_sync_on_changes();
}
- if ($mk_config['checkmkenable']=="on") {
- $mk_rc_conf_file .= 'inetd_enable="YES"' . "\n";
- $mk_rc_conf_file .= 'inetd_flags="-wW"' . "\n";
- }
+}
- file_put_contents(ETC_RC_CONF, $mk_rc_conf_file, LOCK_EX);
- if ($inet_daemons_count > 0) {
- mwexec("/etc/rc.d/inetd restart");
+function checkmk_generate_rules($type) {
+ global $config;
+
+ if (is_array($config['installedpackages']['checkmk']['config'])) {
+ $mk_config = $config['installedpackages']['checkmk']['config'][0];
} else {
- mwexec("/etc/rc.d/inetd stop");
+ $mk_config = array();
}
-
- /* Write config if any file from filesystem was loaded. */
- if ($update_conf > 0) {
- write_config();
+ $mk_config = $config['installedpackages']['checkmk']['config'][0];
+ if ($mk_config['checkmkenable'] != "on") {
+ return;
}
- conf_mount_ro();
+ if ($type != "nat") {
+ return;
+ }
- checkmk_sync_on_changes();
+ /* Add checkmk daemon to inetd */
+ $inetd_fd = fopen("/var/etc/inetd.conf", "a+");
+ fwrite($inetd_fd, "check_mk\t\tstream\ttcp\tnowait\t\troot\t/usr/local/bin/check_mk_agent\tcheck_mk \n");
+ fclose($inetd_fd);
+
+ /* Generate NAT rules */
+ if (!empty($mk_config['checkmkifaces'])) {
+ $checkmkifs = explode(",", $mk_config['checkmkifaces']);
+ $checkmkhosts = $mk_config['checkmkhosts'] ?: "any";
+ $checkmkport = $mk_config['checkmkport'] ?: "6556";
+ foreach ($checkmkifs as $checkmkif) {
+ if (empty($checkmkif)) {
+ continue;
+ }
+ $interface = get_real_interface($checkmkif);
+ if (empty($interface)) {
+ continue;
+ }
+ $ip = find_interface_ip($interface);
+ if (!is_ipaddrv4($ip)) {
+ continue;
+ }
+
+ if (is_subnetv4($checkmkhosts) || is_ipaddr($checkmkhosts) || $checkmkhosts == "any") {
+ $natrules .= "rdr on {$interface} proto tcp from {$checkmkhosts} to {$ip} port {$checkmkport} -> 127.0.0.1 port {$checkmkport}\n";
+ } elseif (is_alias($checkmkhosts)) {
+ $natrules .= "rdr on {$interface} proto tcp from \${$checkmkhosts} to {$ip} port {$checkmkport} -> 127.0.0.1 port {$checkmkport}\n";
+ }
+ }
+ }
+ return $natrules;
}
function checkmk_validate_input($post, &$input_errors) {
- foreach ($post as $key => $value) {
- if (empty($value)) {
- continue;
- }
- if (substr($key, 0, 3) == "port" && !preg_match("/^\d+$/", $value)) {
- $input_errors[] = "{$value} is no a valid port number";
- }
- if (substr($key, 0, 11) == "description" && !preg_match("@^[a-zA-Z0-9 _/.-]+$@", $value)) {
- $input_errors[] = "Do not use special characters on description";
- }
- if (substr($key, 0, 8) == "fullfile" && !preg_match("@^[a-zA-Z0-9_/.-]+$@", $value)) {
- $input_errors[] = "Do not use special characters on filename";
- }
-
+ if (!empty($post["checkmkport"]) && !is_port($post["checkmkport"])) {
+ $input_errors[] = "You must specify a valid port in 'Listen Port' field.";
+
+ }
+ if (empty($post["checkmkifaces"])) {
+ $input_errors[] = "One or more 'Listen Interface(s)' must be selected";
+ }
+ if (!empty($post["checkmkhosts"]) && !(is_alias($post["checkmkhosts"]) || is_subnetv4($post["checkmkhosts"]) || is_ipaddrv4($post["checkmkhosts"]))) {
+ $input_errors[] = "You must specify a valid IP address, subnet or alias in 'Hosts Allowed' field.";
}
}
/* Uses XMLRPC to synchronize the changes to a remote node. */
function checkmk_sync_on_changes() {
- global $config, $g;
+ global $config;
+
if (is_array($config['installedpackages']['checkmksync']['config'])) {
$checkmk_sync = $config['installedpackages']['checkmksync']['config'][0];
$synconchanges = $checkmk_sync['synconchanges'];
- $synctimeout = $checkmk_sync['synctimeout'];
+ $synctimeout = $checkmk_sync['synctimeout'] ?: '250';
switch ($synconchanges) {
case "manual":
- if (is_array($checkmk_sync[row])) {
- $rs = $checkmksync[row];
+ if (is_array($checkmk_sync['row'])) {
+ $rs = $checkmk_sync['row'];
} else {
- log_error("[check_mk-agent] XMLRPC sync is enabled but there is no hosts to push on squid config.");
+ log_error("[check_mk-agent] XMLRPC sync is enabled but there are no hosts configured as replication targets.");
return;
}
break;
case "auto":
- if (is_array($config['installedpackages']['carpsettings']) && is_array($config['installedpackages']['carpsettings']['config'])) {
- $system_carp = $config['installedpackages']['carpsettings']['config'][0];
+ if (is_array($config['hasync'])) {
+ $system_carp = $config['hasync'];
$rs[0]['ipaddress'] = $system_carp['synchronizetoip'];
$rs[0]['username'] = $system_carp['username'];
$rs[0]['password'] = $system_carp['password'];
+ $rs[0]['syncdestinenable'] = FALSE;
+
+ // XMLRPC sync is currently only supported over connections using the same protocol and port as this system
+ if ($config['system']['webgui']['protocol'] == "http") {
+ $rs[0]['syncprotocol'] = "http";
+ $rs[0]['syncport'] = $config['system']['webgui']['port'] ?: '80';
+ } else {
+ $rs[0]['syncprotocol'] = "https";
+ $rs[0]['syncport'] = $config['system']['webgui']['port'] ?: '443';
+ }
+ if ($system_carp['synchronizetoip'] == "") {
+ log_error("[check_mk-agent] XMLRPC CARP/HA sync is enabled but there are no system backup hosts configured as replication targets.");
+ return;
+ } else {
+ $rs[0]['syncdestinenable'] = TRUE;
+ }
} else {
- log_error("[check_mk-agent] XMLRPC sync is enabled but there is no system backup hosts to push squid config.");
+ log_error("[check_mk-agent] XMLRPC CARP/HA sync is enabled but there are no system backup hosts configured as replication targets.");
return;
}
break;
default:
return;
- break;
+ break;
}
if (is_array($rs)) {
log_error("[check_mk-agent] XMLRPC sync is starting.");
foreach ($rs as $sh) {
- $sync_to_ip = $sh['ipaddress'];
- $password = $sh['password'];
- if ($sh['username']) {
- $username = $sh['username'];
- } else {
- $username = 'admin';
- }
- if ($password && $sync_to_ip) {
- checkmk_do_xmlrpc_sync($sync_to_ip, $username, $password,$synctimeout);
+ // Only sync enabled replication targets
+ if ($sh['syncdestinenable']) {
+ $sync_to_ip = $sh['ipaddress'];
+ $port = $sh['syncport'];
+ $username = $sh['username'] ?: 'admin';
+ $password = $sh['password'];
+ $protocol = $sh['syncprotocol'];
+
+ $error = '';
+ $valid = TRUE;
+
+ if ($password == "") {
+ $error = "Password parameter is empty. ";
+ $valid = FALSE;
+ }
+ if (!is_ipaddr($sync_to_ip) && !is_hostname($sync_to_ip) && !is_domain($sync_to_ip)) {
+ $error .= "Misconfigured Replication Target IP Address or Hostname. ";
+ $valid = FALSE;
+ }
+ if (!is_port($port)) {
+ $error .= "Misconfigured Replication Target Port. ";
+ $valid = FALSE;
+ }
+ if ($valid) {
+ checkmk_do_xmlrpc_sync($sync_to_ip, $port, $protocol, $username, $password, $synctimeout);
+ } else {
+ log_error("[check_mk-agent] XMLRPC sync with '{$sync_to_ip}' aborted due to the following error(s): {$error}");
+ }
}
- log_error("[check_mk-agent] XMLRPC sync is ending.");
}
+ log_error("[check_mk-agent] XMLRPC sync completed.");
}
- }
+ }
}
/* Do the actual XMLRPC sync. */
-function checkmk_do_xmlrpc_sync($sync_to_ip, $username, $password,$synctimeout) {
+function checkmk_do_xmlrpc_sync($sync_to_ip, $port, $protocol, $username, $password, $synctimeout) {
global $config, $g;
- if (!$username) {
+ if ($username == "" || $password == "" || $sync_to_ip == "" || $port == "" || $protocol == "") {
+ log_error("[check_mk-agent] A required XMLRPC sync parameter (username, password, replication target, port or protocol) is empty ... aborting pkg sync");
return;
}
- if (!$password) {
- return;
+ // Take care of IPv6 literal address
+ if (is_ipaddrv6($sync_to_ip)) {
+ $sync_to_ip = "[{$sync_to_ip}]";
}
- if (!$sync_to_ip) {
- return;
- }
+ $url = "{$protocol}://{$sync_to_ip}";
- $xmlrpc_sync_neighbor = $sync_to_ip;
- if($config['system']['webgui']['protocol'] != "") {
- $synchronizetoip = $config['system']['webgui']['protocol'];
- $synchronizetoip .= "://";
- }
- $port = $config['system']['webgui']['port'];
- /* If port is empty, let's rely on the protocol selection. */
- if ($port == "") {
- if($config['system']['webgui']['protocol'] == "http") {
- $port = "80";
- } else {
- $port = "443";
- }
- }
- $synchronizetoip .= $sync_to_ip;
-
- /* xml will hold the sections to sync. */
+ /* XML will hold the sections to sync. */
$xml = array();
$xml['checkmk'] = $config['installedpackages']['checkmk'];
-
/* Assemble XMLRPC payload. */
- $params = array(
- XML_RPC_encode($password),
- XML_RPC_encode($xml)
- );
-
- /* Set a few variables needed for sync code; borrowed from filter.inc. */
- $url = $synchronizetoip;
- log_error("[check_mk-agent] Beginning checkmk XMLRPC sync to {$url}:{$port}.");
+ $params = array(XML_RPC_encode($password), XML_RPC_encode($xml));
+
+ /* Set a few variables needed for sync code */
$method = 'pfsense.merge_installedpackages_section_xmlrpc';
$msg = new XML_RPC_Message($method, $params);
$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
@@ -265,17 +311,17 @@ function checkmk_do_xmlrpc_sync($sync_to_ip, $username, $password,$synctimeout)
if ($g['debug']) {
$cli->setDebug(1);
}
- /* Send our XMLRPC message and timeout after 250 seconds. */
+ /* Send our XMLRPC message and timeout after defined sync timeout value */
$resp = $cli->send($msg, $synctimeout);
if (!$resp) {
- $error = "[check_mk-agent] A communications error occurred while attempting checkmk XMLRPC sync with {$url}:{$port}.";
- log_error($error);
+ $error = "A communications error occurred while attempting XMLRPC sync with {$url}:{$port}.";
+ log_error("[check_mk-agent] {$error}");
file_notice("sync_settings", $error, "checkmk Settings Sync", "");
} elseif ($resp->faultCode()) {
$cli->setDebug(1);
$resp = $cli->send($msg, $synctimeout);
- $error = "[check_mk-agent] An error code was received while attempting checkmk XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
- log_error($error);
+ $error = "An error code was received while attempting XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+ log_error("[check_mk-agent] {$error}");
file_notice("sync_settings", $error, "checkmk Settings Sync", "");
} else {
log_error("[check_mk-agent] XMLRPC sync successfully completed with {$url}:{$port}.");
@@ -286,25 +332,21 @@ function checkmk_do_xmlrpc_sync($sync_to_ip, $username, $password,$synctimeout)
$execcmd = "require_once('/usr/local/pkg/checkmk.inc');\n";
$execcmd .= "sync_package_checkmk();";
/* Assemble XMLRPC payload. */
- $params = array(
- XML_RPC_encode($password),
- XML_RPC_encode($execcmd)
- );
+ $params = array(XML_RPC_encode($password), XML_RPC_encode($execcmd));
- log_error("[check_mk-agent] XMLRPC reload data {$url}:{$port}.");
$msg = new XML_RPC_Message($method, $params);
$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
$cli->setCredentials($username, $password);
$resp = $cli->send($msg, $synctimeout);
if (!$resp) {
- $error = "[check_mk-agent] A communications error occurred while attempting checkmk XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
- log_error($error);
+ $error = "A communications error occurred while attempting XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
+ log_error("[check_mk-agent] {$error}");
file_notice("sync_settings", $error, "checkmk Settings Sync", "");
} elseif ($resp->faultCode()) {
$cli->setDebug(1);
$resp = $cli->send($msg, $synctimeout);
- $error = "[check_mk-agent] An error code was received while attempting checkmk XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
- log_error($error);
+ $error = "An error code was received while attempting XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+ log_error("[check_mk-agent] {$error}");
file_notice("sync_settings", $error, "checkmk Settings Sync", "");
} else {
log_error("[check_mk-agent] XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php).");