Open Build Service

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 4

check_mk-agent-plugins-apache_status.changes Changed

apache_status.py Changed

@@ -1,11 +1,9 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
-# Copyright (C) 2019 tribe29 GmbH - License: GNU General Public License v2
+# Copyright (C) 2019 Checkmk GmbH - License: GNU General Public License v2
 # This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
 # conditions defined in the file COPYING, which is part of this source code package.
 
-__version__ = "2.2.0i1"
-
 # Checkmk-Agent-Plugin - Apache Server Status
 #
 # Fetches the server-status page from detected or configured apache
@@ -23,35 +21,32 @@
 # It is also possible to override or extend the ssl_ports variable to make the
 # check contact other ports than 443 with HTTPS requests.
 
+import contextlib
 import os
 import re
 import sys
+from urllib.error import HTTPError, URLError
+from urllib.request import build_opener, HTTPSHandler, install_opener, Request, urlopen
+
+__version__ = "2.4.0p36"
+
+USER_AGENT = "checkmk-agent-apache_status-" + __version__
 
 if sys.version_info < (2, 6):
     sys.stderr.write("ERROR: Python 2.5 is not supported. Please use Python 2.6 or newer.\n")
     sys.exit(1)
 
-if sys.version_info0 == 2:
-    from urllib2 import HTTPError, Request, URLError  # pylint: disable=import-error
-    from urllib2 import urlopen as _urlopen  # pylint: disable=import-error
-
-    def urltype(request):
-        return request.get_type()
 
-else:
-    from urllib.error import HTTPError, URLError  # pylint: disable=import-error,no-name-in-module
-    from urllib.request import Request  # pylint: disable=import-error,no-name-in-module
-    from urllib.request import urlopen as _urlopen  # pylint: disable=import-error,no-name-in-module
-
-    def urltype(request):
-        return request.type
-
-
-def urlopen(request, timeout=5, cafile=None, context=None):
-    scheme = urltype(request)
+def urlopen_(request, timeout=5, context=None):
+    if sys.version_info0 == 2:
+        scheme = request.get_type()
+    else:
+        scheme = request.type
     if scheme not in "http", "https":
         raise ValueError("Scheme '%s' is not allowed" % scheme)
-    return _urlopen(request, timeout=timeout, cafile=cafile, context=context)  # nosec - B310
+    return urlopen(  # nosec B310 # BNS:6b61d9
+        request, timeout=timeout, context=context
+    )
 
 
 def get_config():
@@ -72,7 +67,7 @@
     }
     if os.path.exists(config_file):
         with open(config_file) as config_file_obj:
-            exec(config_file_obj.read(), config)
+            exec(config_file_obj.read(), config)  # nosec B102 # BNS:a29406
     return config
 
 
@@ -89,57 +84,102 @@
     return ""
 
 
+def parse_address_and_port(address_and_port, ssl_ports):
+    """
+    parse address:port section from netstat or ss
+    return scheme (http|https), address, port
+    """
+    server_address, _server_port = address_and_port.rsplit(":", 1)
+    server_port = int(_server_port)
+
+    # Use localhost when listening globally
+    if server_address == "0.0.0.0":  # nosec B104 # BNS:537c43
+        server_address = "127.0.0.1"
+    elif server_address in ("::", "*", "::"):
+        server_address = "::1"
+    elif ":" in server_address and server_address0 != "":
+        server_address = "%s" % server_address
+
+    # Switch protocol if port is SSL port. In case you use SSL on another
+    # port you would have to change/extend the ssl_port list
+    if server_port in ssl_ports:
+        scheme = "https"
+    else:
+        scheme = "http"
+
+    return scheme, server_address, server_port
+
+
 def try_detect_servers(ssl_ports):
     results = 
 
-    for netstat_line in os.popen("netstat -tlnp 2>/dev/null").readlines():
-        parts = netstat_line.split()
+    procs = 
+        "apache2",
+        "httpd",
+        "httpd-prefork",
+        "httpd2-prefork",
+        "httpd2-worker",
+        "httpd-worker",
+        "httpd.worker",
+        "httpd-event",
+        "fcgi-pm",
+    
+
+    #  ss lists parent and first level child processes
+    #  last process in line is the parent:
+    #    users:(("apache2",pid=123456,fd=3),...,("apache2",pid=123,fd=3))
+    #  capture content of last brackets (...))
+    pattern = re.compile(r"users:.*$(^\($*?)\)\)$")
+
+    for ss_line in os.popen("ss -tlnp 2>/dev/null").readlines():
+        parts = ss_line.split()
         # Skip lines with wrong format
-        if len(parts) < 7 or "/" not in parts6:
+        if len(parts) < 6 or "users:" not in parts5:
             continue
 
-        pid, proc = parts6.split("/", 1)
-        to_replace = re.compile("^.*/")
-        proc = to_replace.sub("", proc)
-
-        procs = 
-            "apache2",
-            "httpd",
-            "httpd-prefork",
-            "httpd2-prefork",
-            "httpd2-worker",
-            "httpd.worker",
-            "httpd-event",
-            "fcgi-pm",
-        
-        # the pid/proc field length is limited to 19 chars. Thus in case of
-        # long PIDs, the process names are stripped of by that length.
-        # Workaround this problem here
-        procs = p: 19 - len(pid) - 1 for p in procs
+        match = re.match(pattern, parts5)
+        if match is None:
+            continue
+        proc_info = match.group(1)
+        proc, pid, _fd = proc_info.split(",")
+        proc = proc.replace('"', "")
+        pid = pid.replace("pid=", "")
 
         # Skip unwanted processes
         if proc not in procs:
             continue
 
-        server_address, _server_port = parts3.rsplit(":", 1)
-        server_port = int(_server_port)
+        scheme, server_address, server_port = parse_address_and_port(parts3, ssl_ports)
 
-        # Use localhost when listening globally
-        if server_address == "0.0.0.0":  # nosec - B104
-            server_address = "127.0.0.1"
-        elif server_address == "::":
-            server_address = "::1"
-        elif ":" in server_address:
-            server_address = "%s" % server_address
+        results.append((scheme, server_address, server_port))
 
-        # Switch protocol if port is SSL port. In case you use SSL on another
-        # port you would have to change/extend the ssl_port list
-        if server_port in ssl_ports:
-            scheme = "https"
-        else:
-            scheme = "http"
+    if not results:
+        # if ss output was empty (maybe not installed), try netstat instead
+        # (plugin silently fails without any section output,
+        #  if neither netstat nor ss are installed.)
 
-        results.append((scheme, server_address, server_port))
+        for netstat_line in os.popen("netstat -tlnp 2>/dev/null").readlines():
+            parts = netstat_line.split()
+            # Skip lines with wrong format
+            if len(parts) < 7 or "/" not in parts6:
+                continue
+
+            pid, proc = parts6.split("/", 1)
+            to_replace = re.compile("^.*/")
+            proc = to_replace.sub("", proc)
+
+            # the pid/proc field length is limited to 19 chars. Thus in case of
+            # long PIDs, the process names are stripped of by that length.