1 /*****************************************************************************
2 *
3 * Nagios check_apt plugin
4 *
5 * License: GPL
6 * Copyright (c) 2006-2014 Nagios Plugins Development Team
7 *
8 * Original author: Sean Finney
9 *
10 * Description:
11 *
12 * This file contains the check_apt plugin
13 *
14 * Check for available updates in apt package management systems
15 *
16 *
17 * This program is free software: you can redistribute it and/or modify
18 * it under the terms of the GNU General Public License as published by
19 * the Free Software Foundation, either version 3 of the License, or
20 * (at your option) any later version.
21 *
22 * This program is distributed in the hope that it will be useful,
23 * but WITHOUT ANY WARRANTY; without even the implied warranty of
24 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 * GNU General Public License for more details.
26 *
27 * You should have received a copy of the GNU General Public License
28 * along with this program. If not, see <http://www.gnu.org/licenses/>.
29 *
30 *****************************************************************************/
31
32 const char *progname = "check_apt";
33 const char *copyright = "2006-2014";
34 const char *email = "devel@nagios-plugins.org";
35
36 #include "common.h"
37 #include "runcmd.h"
38 #include "utils.h"
39 #include "regex.h"
40
41 /* some constants */
42 typedef enum { UPGRADE, DIST_UPGRADE, NO_UPGRADE } upgrade_type;
43
44 /* Character for hidden input file option (for testing). */
45 #define INPUT_FILE_OPT CHAR_MAX+1
46 /* the default opts can be overridden via the cmdline */
47 #define UPGRADE_DEFAULT_OPTS "-o 'Debug::NoLocking=true' -s -qq"
48 #define UPDATE_DEFAULT_OPTS "-q"
49 /* until i commit the configure.in patch which gets this, i'll define
50 * it here as well */
51 #ifndef PATH_TO_APTGET
52 # define PATH_TO_APTGET "/usr/bin/apt-get"
53 #endif /* PATH_TO_APTGET */
54 /* String found at the beginning of the apt output lines we're interested in */
55 #define PKGINST_PREFIX "Inst "
56 /* the RE that catches security updates */
57 #define SECURITY_RE "^[^\\(]*\\(.* (Debian-Security:|Ubuntu:[^/]*/[^-]*-security)"
58
59 /* some standard functions */
60 int process_arguments(int, char **);
61 void print_help(void);
62 void print_usage(void);
63
64 /* construct the appropriate apt-get cmdline */
65 char* construct_cmdline(upgrade_type u, const char *opts);
66 /* run an apt-get update */
67 int run_update(void);
68 /* run an apt-get upgrade */
69 int run_upgrade(int *pkgcount, int *secpkgcount);
70 /* add another clause to a regexp */
71 char* add_to_regexp(char *expr, const char *next);
72
73 /* configuration variables */
74 static int verbose = 0; /* -v */
75 static int do_update = 0; /* whether to call apt-get update */
76 static int only_critical = 0; /* whether to warn about non-critical updates */
77 static upgrade_type upgrade = UPGRADE; /* which type of upgrade to do */
78 static char *upgrade_opts = NULL; /* options to override defaults for upgrade */
79 static char *update_opts = NULL; /* options to override defaults for update */
80 static char *do_include = NULL; /* regexp to only include certain packages */
81 static char *do_exclude = NULL; /* regexp to only exclude certain packages */
82 static char *do_critical = NULL; /* regexp specifying critical packages */
83 static char *input_filename = NULL; /* input filename for testing */
84 /* number of packages available for upgrade to return WARNING status */
85 static int packages_warning = 1;
86
87 /* other global variables */
88 static int stderr_warning = 0; /* if a cmd issued output on stderr */
89 static int exec_warning = 0; /* if a cmd exited non-zero */
90
main(int argc,char ** argv)91 int main (int argc, char **argv) {
92 int result=STATE_UNKNOWN, packages_available=0, sec_count=0;
93
94 /* Parse extra opts if any */
95 argv=np_extra_opts(&argc, argv, progname);
96
97 if (process_arguments(argc, argv) == ERROR)
98 usage_va(_("Could not parse arguments"));
99
100 /* Set signal handling and alarm timeout */
101 if (signal (SIGALRM, timeout_alarm_handler) == SIG_ERR) {
102 usage_va(_("Cannot catch SIGALRM"));
103 }
104
105 /* handle timeouts gracefully... */
106 alarm (timeout_interval);
107
108 /* if they want to run apt-get update first... */
109 if(do_update) result = run_update();
110
111 /* apt-get upgrade */
112 result = max_state(result, run_upgrade(&packages_available, &sec_count));
113
114 if(sec_count > 0){
115 result = max_state(result, STATE_CRITICAL);
116 } else if(packages_available >= packages_warning && only_critical == 0){
117 result = max_state(result, STATE_WARNING);
118 } else if(result > STATE_UNKNOWN){
119 result = STATE_UNKNOWN;
120 }
121
122 printf(_("APT %s: %d packages available for %s (%d critical updates). %s%s%s%s|available_upgrades=%d;;;0 critical_updates=%d;;;0\n"),
123 state_text(result),
124 packages_available,
125 (upgrade==DIST_UPGRADE)?"dist-upgrade":"upgrade",
126 sec_count,
127 (stderr_warning)?" warnings detected":"",
128 (stderr_warning && exec_warning)?",":"",
129 (exec_warning)?" errors detected":"",
130 (stderr_warning||exec_warning)?".":"",
131 packages_available,
132 sec_count
133 );
134
135 return result;
136 }
137
138 /* process command-line arguments */
process_arguments(int argc,char ** argv)139 int process_arguments (int argc, char **argv) {
140 int c;
141
142 static struct option longopts[] = {
143 {"version", no_argument, 0, 'V'},
144 {"help", no_argument, 0, 'h'},
145 {"verbose", no_argument, 0, 'v'},
146 {"timeout", required_argument, 0, 't'},
147 {"update", optional_argument, 0, 'u'},
148 {"upgrade", optional_argument, 0, 'U'},
149 {"no-upgrade", no_argument, 0, 'n'},
150 {"dist-upgrade", optional_argument, 0, 'd'},
151 {"include", required_argument, 0, 'i'},
152 {"exclude", required_argument, 0, 'e'},
153 {"critical", required_argument, 0, 'c'},
154 {"only-critical", no_argument, 0, 'o'},
155 {"input-file", required_argument, 0, INPUT_FILE_OPT},
156 {"packages-warning", required_argument, 0, 'w'},
157 {0, 0, 0, 0}
158 };
159
160 while(1) {
161 c = getopt_long(argc, argv, "hVvt:u::U::d::ni:e:c:ow:", longopts, NULL);
162
163 if(c == -1 || c == EOF || c == 1) break;
164
165 switch(c) {
166 case 'h':
167 print_help();
168 exit(STATE_OK);
169 case 'V':
170 print_revision(progname, NP_VERSION);
171 exit(STATE_OK);
172 case 'v':
173 verbose++;
174 break;
175 case 't':
176 timeout_interval=parse_timeout_string(optarg);
177 break;
178 case 'd':
179 upgrade=DIST_UPGRADE;
180 if(optarg!=NULL){
181 upgrade_opts=strdup(optarg);
182 if(upgrade_opts==NULL) die(STATE_UNKNOWN, "strdup failed");
183 }
184 break;
185 case 'U':
186 upgrade=UPGRADE;
187 if(optarg!=NULL){
188 upgrade_opts=strdup(optarg);
189 if(upgrade_opts==NULL) die(STATE_UNKNOWN, "strdup failed");
190 }
191 break;
192 case 'n':
193 upgrade=NO_UPGRADE;
194 break;
195 case 'u':
196 do_update=1;
197 if(optarg!=NULL){
198 update_opts=strdup(optarg);
199 if(update_opts==NULL) die(STATE_UNKNOWN, "strdup failed");
200 }
201 break;
202 case 'i':
203 do_include=add_to_regexp(do_include, optarg);
204 break;
205 case 'e':
206 do_exclude=add_to_regexp(do_exclude, optarg);
207 break;
208 case 'c':
209 do_critical=add_to_regexp(do_critical, optarg);
210 break;
211 case 'o':
212 only_critical=1;
213 break;
214 case INPUT_FILE_OPT:
215 input_filename = optarg;
216 break;
217 case 'w':
218 packages_warning = atoi(optarg);
219 break;
220 default:
221 /* print short usage statement if args not parsable */
222 usage5();
223 }
224 }
225
226 return OK;
227 }
228
229
230 /* run an apt-get upgrade */
run_upgrade(int * pkgcount,int * secpkgcount)231 int run_upgrade(int *pkgcount, int *secpkgcount){
232 int i=0, result=STATE_UNKNOWN, regres=0, pc=0, spc=0;
233 struct output chld_out, chld_err;
234 regex_t ireg, ereg, sreg;
235 char *cmdline=NULL, rerrbuf[64];
236
237 /* initialize ereg as it is possible it is printed while uninitialized */
238 memset(&ereg, '\0', sizeof(ereg.buffer));
239
240 if(upgrade==NO_UPGRADE) return STATE_OK;
241
242 /* compile the regexps */
243 if (do_include != NULL) {
244 regres=regcomp(&ireg, do_include, REG_EXTENDED);
245 if (regres!=0) {
246 regerror(regres, &ireg, rerrbuf, 64);
247 die(STATE_UNKNOWN, _("%s: Error compiling regexp: %s"), progname, rerrbuf);
248 }
249 }
250
251 if(do_exclude!=NULL){
252 regres=regcomp(&ereg, do_exclude, REG_EXTENDED);
253 if(regres!=0) {
254 regerror(regres, &ereg, rerrbuf, 64);
255 die(STATE_UNKNOWN, _("%s: Error compiling regexp: %s"),
256 progname, rerrbuf);
257 }
258 }
259
260 const char *crit_ptr = (do_critical != NULL) ? do_critical : SECURITY_RE;
261 regres=regcomp(&sreg, crit_ptr, REG_EXTENDED);
262 if(regres!=0) {
263 regerror(regres, &ereg, rerrbuf, 64);
264 die(STATE_UNKNOWN, _("%s: Error compiling regexp: %s"),
265 progname, rerrbuf);
266 }
267
268 cmdline=construct_cmdline(upgrade, upgrade_opts);
269 if (input_filename != NULL) {
270 /* read input from a file for testing */
271 result = cmd_file_read(input_filename, &chld_out, 0);
272 } else {
273 /* run the upgrade */
274 result = np_runcmd(cmdline, &chld_out, &chld_err, 0);
275 }
276
277 /* apt-get upgrade only changes exit status if there is an
278 * internal error when run in dry-run mode. therefore we will
279 * treat such an error as UNKNOWN */
280 if(result != 0){
281 exec_warning=1;
282 result = STATE_UNKNOWN;
283 fprintf(stderr, _("'%s' exited with non-zero status.\n"),
284 cmdline);
285 }
286
287 /* parse the output, which should only consist of lines like
288 *
289 * Inst package ....
290 * Conf package ....
291 *
292 * so we'll filter based on "Inst" for the time being. later
293 * we may need to switch to the --print-uris output format,
294 * in which case the logic here will slightly change.
295 */
296 for(i = 0; i < chld_out.lines; i++) {
297 if(verbose){
298 printf("%s\n", chld_out.line[i]);
299 }
300 /* if it is a package we care about */
301 if (strncmp(PKGINST_PREFIX, chld_out.line[i], strlen(PKGINST_PREFIX)) == 0 &&
302 (do_include == NULL || regexec(&ireg, chld_out.line[i], 0, NULL, 0) == 0)) {
303 /* if we're not excluding, or it's not in the
304 * list of stuff to exclude */
305 if(do_exclude==NULL ||
306 regexec(&ereg, chld_out.line[i], 0, NULL, 0)!=0){
307 pc++;
308 if(regexec(&sreg, chld_out.line[i], 0, NULL, 0)==0){
309 spc++;
310 if(verbose) printf("*");
311 }
312 if(verbose){
313 printf("*%s\n", chld_out.line[i]);
314 }
315 }
316 }
317 }
318 *pkgcount=pc;
319 *secpkgcount=spc;
320
321 /* If we get anything on stderr, at least set warning */
322 if (input_filename == NULL && chld_err.buflen) {
323 stderr_warning=1;
324 result = max_state(result, STATE_WARNING);
325 if(verbose){
326 for(i = 0; i < chld_err.lines; i++) {
327 fprintf(stderr, "%s\n", chld_err.line[i]);
328 }
329 }
330 }
331 if (do_include != NULL) regfree(&ireg);
332 regfree(&sreg);
333 if(do_exclude!=NULL) regfree(&ereg);
334 free(cmdline);
335 return result;
336 }
337
338 /* run an apt-get update (needs root) */
run_update(void)339 int run_update(void){
340 int i=0, result=STATE_UNKNOWN;
341 struct output chld_out, chld_err;
342 char *cmdline;
343
344 /* run the upgrade */
345 cmdline = construct_cmdline(NO_UPGRADE, update_opts);
346 result = np_runcmd(cmdline, &chld_out, &chld_err, 0);
347 /* apt-get update changes exit status if it can't fetch packages.
348 * since we were explicitly asked to do so, this is treated as
349 * a critical error. */
350 if(result != 0){
351 exec_warning=1;
352 result = STATE_CRITICAL;
353 fprintf(stderr, _("'%s' exited with non-zero status.\n"),
354 cmdline);
355 }
356
357 if(verbose){
358 for(i = 0; i < chld_out.lines; i++) {
359 printf("%s\n", chld_out.line[i]);
360 }
361 }
362
363 /* If we get anything on stderr, at least set warning */
364 if(chld_err.buflen){
365 stderr_warning=1;
366 result = max_state(result, STATE_WARNING);
367 if(verbose){
368 for(i = 0; i < chld_err.lines; i++) {
369 fprintf(stderr, "%s\n", chld_err.line[i]);
370 }
371 }
372 }
373 free(cmdline);
374 return result;
375 }
376
add_to_regexp(char * expr,const char * next)377 char* add_to_regexp(char *expr, const char *next){
378 char *re=NULL;
379
380 if(expr==NULL){
381 re=malloc(sizeof(char)*(strlen("()")+strlen(next)+1));
382 if(!re) die(STATE_UNKNOWN, "malloc failed!\n");
383 sprintf(re, "(%s)", next);
384 } else {
385 /* resize it, adding an extra char for the new '|' separator */
386 re=realloc(expr, sizeof(char)*(strlen(expr)+1+strlen(next)+1));
387 if(!re) die(STATE_UNKNOWN, "realloc failed!\n");
388 /* append it starting at ')' in the old re */
389 sprintf((char*)(re+strlen(re)-1), "|%s)", next);
390 }
391
392 return re;
393 }
394
construct_cmdline(upgrade_type u,const char * opts)395 char* construct_cmdline(upgrade_type u, const char *opts){
396 int len=0;
397 const char *opts_ptr=NULL, *aptcmd=NULL;
398 char *cmd=NULL;
399
400 switch(u){
401 case UPGRADE:
402 if(opts==NULL) opts_ptr=UPGRADE_DEFAULT_OPTS;
403 else opts_ptr=opts;
404 aptcmd="upgrade";
405 break;
406 case DIST_UPGRADE:
407 if(opts==NULL) opts_ptr=UPGRADE_DEFAULT_OPTS;
408 else opts_ptr=opts;
409 aptcmd="dist-upgrade";
410 break;
411 case NO_UPGRADE:
412 if(opts==NULL) opts_ptr=UPDATE_DEFAULT_OPTS;
413 else opts_ptr=opts;
414 aptcmd="update";
415 break;
416 }
417
418 len+=strlen(PATH_TO_APTGET)+1; /* "/usr/bin/apt-get " */
419 len+=strlen(opts_ptr)+1; /* "opts " */
420 len+=strlen(aptcmd)+1; /* "upgrade\0" */
421
422 cmd=(char*)malloc(sizeof(char)*len);
423 if(cmd==NULL) die(STATE_UNKNOWN, "malloc failed");
424 sprintf(cmd, "%s %s %s", PATH_TO_APTGET, opts_ptr, aptcmd);
425 return cmd;
426 }
427
428 /* informative help message */
429 void
print_help(void)430 print_help (void)
431 {
432 print_revision(progname, NP_VERSION);
433
434 printf(_(COPYRIGHT), copyright, email);
435
436 printf("%s\n", _("This plugin checks for software updates on systems that use"));
437 printf("%s\n", _("package management systems based on the apt-get(8) command"));
438 printf("%s\n", _("found in Debian GNU/Linux"));
439
440 printf ("\n\n");
441
442 print_usage();
443
444 printf(UT_HELP_VRSN);
445 printf(UT_EXTRA_OPTS);
446
447 printf(UT_PLUG_TIMEOUT, timeout_interval);
448
449 printf (" %s\n", "-U, --upgrade=OPTS");
450 printf (" %s\n", _("[Default] Perform an upgrade. If an optional OPTS argument is provided,"));
451 printf (" %s\n", _("apt-get will be run with these command line options instead of the"));
452 printf (" %s", _("default "));
453 printf ("(%s).\n", UPGRADE_DEFAULT_OPTS);
454 printf (" %s\n", _("Note that you may be required to have root privileges if you do not use"));
455 printf (" %s\n", _("the default options."));
456 printf (" %s\n", "-d, --dist-upgrade=OPTS");
457 printf (" %s\n", _("Perform a dist-upgrade instead of normal upgrade. Like with -U OPTS"));
458 printf (" %s\n", _("can be provided to override the default options."));
459 printf (" %s\n", " -n, --no-upgrade");
460 printf (" %s\n", _("Do not run the upgrade. Probably not useful (without -u at least)."));
461 printf (" %s\n", "-i, --include=REGEXP");
462 printf (" %s\n", _("Include only packages matching REGEXP. Can be specified multiple times"));
463 printf (" %s\n", _("the values will be combined together. Any packages matching this list"));
464 printf (" %s\n", _("cause the plugin to return WARNING status. Others will be ignored."));
465 printf (" %s\n", _("Default is to include all packages."));
466 printf (" %s\n", "-e, --exclude=REGEXP");
467 printf (" %s\n", _("Exclude packages matching REGEXP from the list of packages that would"));
468 printf (" %s\n", _("otherwise be included. Can be specified multiple times; the values"));
469 printf (" %s\n", _("will be combined together. Default is to exclude no packages."));
470 printf (" %s\n", "-c, --critical=REGEXP");
471 printf (" %s\n", _("If the full package information of any of the upgradable packages match"));
472 printf (" %s\n", _("this REGEXP, the plugin will return CRITICAL status. Can be specified"));
473 printf (" %s\n", _("multiple times like above. Default is a regexp matching security"));
474 printf (" %s\n", _("upgrades for Debian and Ubuntu:"));
475 printf (" \t\%s\n", SECURITY_RE);
476 printf (" %s\n", _("Note that the package must first match the include list before its"));
477 printf (" %s\n", _("information is compared against the critical list."));
478 printf (" %s\n", "-o, --only-critical");
479 printf (" %s\n", _("Only warn about upgrades matching the critical list. The total number"));
480 printf (" %s\n", _("of upgrades will be printed, but any non-critical upgrades will not cause"));
481 printf (" %s\n\n", _("the plugin to return WARNING status."));
482 printf (" %s\n", "-w, --packages-warning=INTEGER");
483 printf (" %s\n", _("Minumum number of packages available for upgrade to return WARNING status."));
484 printf (" %s\n\n", _("Default is 1 package."));
485
486 printf ("%s\n\n", _("The following options require root privileges and should be used with care:"));
487 printf (" %s\n", "-u, --update=OPTS");
488 printf (" %s\n", _("First perform an 'apt-get update'. An optional OPTS parameter overrides"));
489 printf (" %s\n", _("the default options. Note: you may also need to adjust the global"));
490 printf (" %s\n", _("timeout (with -t) to prevent the plugin from timing out if apt-get"));
491 printf (" %s\n", _("upgrade is expected to take longer than the default timeout."));
492
493 printf(UT_SUPPORT);
494 }
495
496
497 /* simple usage heading */
498 void
print_usage(void)499 print_usage(void)
500 {
501 printf ("%s\n", _("Usage:"));
502 printf ("%s [[-d|-u|-U]opts] [-n] [-t timeout] [-w packages-warning]\n", progname);
503 }
504