diff --git a/pandora_server/ChangeLog b/pandora_server/ChangeLog index bd18f668ac..7f4cac7f7b 100644 --- a/pandora_server/ChangeLog +++ b/pandora_server/ChangeLog @@ -1,3 +1,14 @@ +2013-01-10 Hirofumi Kosaka + + * lib/PandoraFMS/SNMPServer.pm: Rewrite my commit at rev7388 in more + general way. logger() call was deleted here, because the corresponding + error message is recorded by pandora_crash(). Merged from 4.0.x. + + * lib/PandoraFMS/Core.pm: Fixed that invalid regex in + critical_str or warning_str could make server down at worst. + Not used logger() here, because the corresponding error + message is recorded by pandora_crash(). Merged from 4.0.x. + 2013-01-09 Dario Rodriguez * lib/PandoraFMS/NetworkServer.pm: Added log traces to inform diff --git a/pandora_server/lib/PandoraFMS/Core.pm b/pandora_server/lib/PandoraFMS/Core.pm index 3aadb26cbc..940a7299cb 100644 --- a/pandora_server/lib/PandoraFMS/Core.pm +++ b/pandora_server/lib/PandoraFMS/Core.pm @@ -2931,6 +2931,7 @@ sub get_module_status ($$$) { my ($critical_min, $critical_max, $warning_min, $warning_max) = ($module->{'min_critical'}, $module->{'max_critical'}, $module->{'min_warning'}, $module->{'max_warning'}); my ($critical_str, $warning_str) = ($module->{'str_critical'}, $module->{'str_warning'}); + my $eval_result; # Was the module status set in the XML data file? if (defined ($module->{'status'})) { @@ -2991,20 +2992,26 @@ sub get_module_status ($$$) { else { # Critical - if ($module->{'critical_inverse'} == 0) { - return 1 if ($critical_str ne '' && $data =~ /$critical_str/); - } else { - return 1 if ($critical_str ne '' && $data !~ /$critical_str/); - } + $eval_result = eval { + if ($module->{'critical_inverse'} == 0) { + $critical_str ne '' && $data =~ /$critical_str/ ; + } else { + $critical_str ne '' && $data !~ /$critical_str/ ; + } + }; + return 1 if ($eval_result); # Warning - if ($module->{'warning_inverse'} == 0) { - return 2 if ($warning_str ne '' && $data =~ /$warning_str/); - } else { - return 2 if ($warning_str ne '' && $data !~ /$warning_str/); - } + $eval_result = eval { + if ($module->{'warning_inverse'} == 0) { + $warning_str ne '' && $data =~ /$warning_str/ ; + } else { + $warning_str ne '' && $data !~ /$warning_str/ ; + } + }; + return 2 if ($eval_result); } - + # Normal return 0; } diff --git a/pandora_server/lib/PandoraFMS/SNMPServer.pm b/pandora_server/lib/PandoraFMS/SNMPServer.pm index c243f703bc..180e48cac7 100644 --- a/pandora_server/lib/PandoraFMS/SNMPServer.pm +++ b/pandora_server/lib/PandoraFMS/SNMPServer.pm @@ -239,17 +239,18 @@ sub matches_filter ($$$) { my @filters = get_db_rows ($dbh, 'SELECT filter FROM tsnmp_filter'); foreach my $filter (@filters) { my $regexp = safe_output($filter->{'filter'}) ; + my $eval_result; - # Check if $regexp begins with quantifier - if ($regexp =~ m/^[+*?]/ ) { - logger($pa_config, "Invalid SNMP filter. Quantifier follows nothing in regex '$regexp'.", 3); - next; - } + # eval protects against server down (by invalid regular expressions) + $eval_result = eval { + $string =~ m/$regexp/i ; + }; + + if ($eval_result) { + logger($pa_config, "Trap '$string' matches filter '$regexp'. Discarding...", 10); + return 1; + } - if ($string =~ m/$regexp/i) { - logger($pa_config, "Trap '$string' matches filter '$regexp'. Discarding...", 10); - return 1; - } } return 0;