NRPE have a 1024 output size, should be 4k according to spec

[littlesandra88]

Hi,

According to this page[1] the limit of $LONGSERVICEOUTPUT$ is 4kB, but it is 1024 bytes.

Code: Select all

# /usr/local/nagios/libexec/check_nrpe -H localhost -c check_zfs_zpool | wc -c
1024

I have tried to change

Code: Select all

contrib/nrpe_check_control.c:#define MAX_CHARS  1024

which had no effect, and changing

Code: Select all

include/common.h:#define MAX_PACKETBUFFER_LENGTH        1024            /* max amount of data we'll send in one query/response */

made NRPE not work.

I would like to make a patch for this. Can anyone explain why changing those values, does work out as I expect?

Hugs,
Sandra


[1]: http://nagios.sourceforge.net/docs/3_0/pluginapi.html

[slansing]

Well you should be able to modify:

Code: Select all

nrpe/include/common.h

And set the the following two:

Code: Select all

#define MAX_INPUT_BUFFER        xxxx    
#define MAX_PLUGINOUTPUT_LENGTH xxxx

Then re-compile nrpe. Are you saying that that actually broke NRPE?

[littlesandra88]

If I search the NRPE source, then I don't see the MAX_PLUGINOUTPUT_LENGTH being defined anywhere.

Code: Select all

wget ftp://ftp.fu-berlin.de/unix/network/nagios/nrpe-2.x/nrpe-2.15/nrpe-2.15.tar.gz
tar xzf nrpe-2.15.tar.gz
cd nrpe-2.15
grep -R MAX_PLUGINOUTPUT_LENGTH *

By default

Code: Select all

#define MAX_INPUT_BUFFER        2048    /* max size of most buffers we use */

and changing this doesn't make any difference. I still only get 1024 bytes of output from NRPE.

NRPE crashed when I edited MAX_PACKETBUFFER_LENGTH, which is probably understandable =)

The strange thing is that there is not that many 1024 constants in in the source

Code: Select all

# grep -R 1024 *
contrib/nrpe_check_control.c:#define MAX_CHARS  1024
include/common.h:#define MAX_PACKETBUFFER_LENGTH        1024            /* max amount of data we'll send in one query/response */
sample-config/nrpe.cfg.in:# NOTE: This must be a non-priviledged port (i.e. > 1024).
sample-config/nrpe.cfg:# NOTE: This must be a non-priviledged port (i.e. > 1024).
src/nrpe.c:                     if(server_port<1024){
src/snprintf.c: char buf1[1024];
src/snprintf.c: char buf2[1024];

MAX_CHARS seams to be for something else.

[sreinhardt]

Well, let's start with what version you are on, so that we don't have conflicting code we are looking at.

[littlesandra88]

Sounds good =) it is NRPE 2.15.

[lmiltchev]

Just wanted to give you heads up. It is going to take some time to test this. We will make a post as soon as we have a solution for you. Meanwhile, you are welcome to file a bug report on our tracker.

[littlesandra88]

Thanks for looking into it. I have now created the bug report at

http://tracker.nagios.org/view.php?id=564

[tmcdonald]

On the Plugin API page it says the max output is 4KB, but in NRPE it is capped at 1024. The reason it crashes is because you have a 1024-byte char buffer that you are trying to stuff too much data into, causing a classic buffer overflow. You would need to change all the relevant occurrences of 1024 to match your desired 4096, and be very mindful of #defined values that rely on other #defined values.

I can take a look at this as well and see if we can up that buffer. Really, all hard-coded values for the most part should be #defined somewhere and only one or two lines should need to change.

[littlesandra88]

I see... If you could take a look at it, I would appreciate it a lot =)

Being able to output even 2k would be enormously useful =)

[tmcdonald]

I might have a solution. Tested only on the local box (not across a network) but here are the changes I made:

Code: Select all

$ grep -R 4096 .
./include/common.h:#define MAX_INPUT_BUFFER     4096    /* max size of most buffers we use */
./include/common.h:#define MAX_PACKETBUFFER_LENGTH      4096            /* max amount of data we'll send in one query/response */
./contrib/nrpe_check_control.c:#define MAX_CHARS        4096
./src/snprintf.c:       char buf1[4096];
./src/snprintf.c:       char buf2[4096];

then make clean, make, and make install.

I tested this with a plugin that simply outputs a certain number of 'A', and obviously the newline takes up one of those. I fed it 4100 A's and wc -c gave back 4096.

EDIT: Did some testing between servers, looks like this might break things. Looking into it.
EDIT2: Was just a firewall issue on the remote box. Should be fine.
EDIT3: In fact, the changes to src/snprintf.c might not even be needed and should probably be kept at 1024 for now, since they are used to compare against standard printf.