Bug: Nagios 3.2.1 status.cgi, action_url / notes_url with Macros

[Jochen Bern]

Hello everyone, I repeated the described behavior on a fresh install of
Nagios 3.2.1 from sources (because our productive Nagios has been
patched, and I don't trust the installed Vautour to *completely* stay
out of this):

1. Configure at least two hosts (I duplicated "localhost" to "thishost")

2. Open a status.cgi page such that one of the hostnames appears
*several* times in the "Host" column (I happen to have two CRITICAL
services, HTTP and SSH; going to "Unhandled Service Problems" and
sorting the list by "Duration" did the trick for me)

3. Add an action_url and/or notes_url statement to the repeated host
which uses a macro, like this:
        notes_url               /something/$HOSTNAME$
        action_url              /another/$HOSTADDRESS$

4. The hyperlinks are OK the *first* time the host is listed, but the
URL gets truncated at the start of the macro on all following mentions:

> $ grep '^<TD align=.*<A HREF=' status.cgi-url-bug.htm | \
> > sed -e '/ BORDER=/s/^/    /' -e 's/ BORDER=.*/ .../' \
> >    -e 's/ title=[^>]*/ .../' -e 's/ align[^>]*/ .../' \
> >    -e 's/ TARGET=[^>]*/ .../' -e "s| SRC=[^ ]*/| SRC='.../|"

> <TD ...><A HREF='extinfo.cgi?type=1&host=localhost' ...>localhost</A></TD>
>     <TD ...><A HREF='/something/localhost' ...><IMG SRC='.../notes.gif' ...
>     <TD ...><A HREF='/another/127.0.0.1' ...><IMG SRC='.../action.gif' ...
> <TD ...><A HREF='extinfo.cgi?type=1&host=thishost' ...>thishost</A></TD>
> <TD ...><A HREF='extinfo.cgi?type=1&host=localhost' ...>localhost</A></TD>
>     <TD ...><A HREF='/something/' ...><IMG SRC='.../notes.gif' ...
>     <TD ...><A HREF='/another/' ...><IMG SRC='.../action.gif' ...

I noticed that

common/macros.c::process_macros(input_buffer,output_buffer,options)

has side effects on the string input_buffer:

>         buf_ptr=input_buffer;
>         while(buf_ptr){
[...]
>                 if((delim_ptr=strchr(buf_ptr,'$'))){
>                            delim_ptr[0]='\x0';

I patched it as listed below, and the symptom vanished. Unfortunately,
I'm not fluent enough in the Nagios code to be sure that this
a) doesn't break functionality in other cases,
b) does not create a memory leak, and
c) conforms to established coding style (I see a "my_free()" used in
other places) ...

Kind regards,
								J. Bern



$ diff -aur common/macros.c.orig common/macros.c
--- common/macros.c.orig        2008-11-30 18:22:58.000000000 +0100
+++ common/macros.c     2010-08-04 22:04:52.985198549 +0200
@@ -77,6 +77,7 @@
 /* replace macros in notification commands with their values */
 int process_macros(char *input_buffer, char **output_buffer, int options){
        char *temp_buffer=NULL;
+       char *save_buffer=NULL;
        char *buf_ptr=NULL;
        char *delim_ptr=NULL;
        int in_macro=FALSE;
@@ -111,7 +112,7 @@
        log_debug_info(DEBUGL_MACROS,1,"Processing: '%s'\n",input_buffer);
 #endif

-       buf_ptr=input_buffer;
+       save_buffer=buf_ptr=(input_buffer?strdup(input_buffer):NULL);
        while(buf_ptr){

                /* save pointer to this working part of buffer */
@@ -267,6 +268,7 @@
        log_debug_info(DEBUGL_MACROS,1,"**** END MACRO PROCESSING
*************\n");
 #endif

+       if (save_buffer) free(save_buffer);
        return OK;
        }
-- 
Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/>
Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt
PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27
Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202
Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

------------------------------------------------------------------------------
The Palm PDK Hot Apps Program offers developers who use the
Plug-In Development Kit to bring their C/C++ apps to Palm for a share
of $1 Million in cash or HP Products. Visit us here for more details:
http://p.sf.net/sfu/dev2dev-palm