Merge lp:~logan/ubuntu/raring/nagios-nrpe/2.13-1ubuntu1 into lp:ubuntu/raring/nagios-nrpe

[Logan Rosen]

[Daniel Holbach (dholbach)]

Thanks. Uploaded.

review: Approve

=== removed file '.cvsignore'
--- .cvsignore	2011-10-18 15:09:21 +0000
+++ .cvsignore	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-autom4te.cache

=== modified file 'Changelog' (properties changed: -x to +x)
--- Changelog	2008-08-06 20:33:57 +0000
+++ Changelog	2013-02-02 23:23:20 +0000
@@ -3,6 +3,13 @@
 **************
 
 
+2.13 - 11/11/2011
+-----------------
+- Applied Kaspersky Labs supplied patch for extending allowed_hosts (Konstantin Malov)
+- Fixed bug in allowed_hosts parsing (Eric Stanley)
+- Updated to support compiling on Solaris 10 (thanks to Kevin Pendleton)
+
+
 2.12 - 03/10/2008
 -----------------
 - Fix for unterminated multiline plugin (garbage) output (Krzysztof Oledzki)

=== modified file 'LEGAL' (properties changed: -x to +x)
=== modified file 'Makefile.in' (properties changed: -x to +x)
=== modified file 'README' (properties changed: -x to +x)
=== modified file 'README.SSL' (properties changed: -x to +x)
=== modified file 'SECURITY' (properties changed: -x to +x)
=== added directory 'common'
=== modified file 'configure'
--- configure	2008-08-06 20:33:57 +0000
+++ configure	2013-02-02 23:23:20 +0000
@@ -1298,9 +1298,9 @@
 
 
 PKG_NAME=nrpe
-PKG_VERSION="2.12"
+PKG_VERSION="2.13"
 PKG_HOME_URL="http://www.nagios.org/"
-PKG_REL_DATE="03-10-2008"
+PKG_REL_DATE="11-11-2011"
 
 ac_aux_dir=
 for ac_dir in $srcdir $srcdir/.. $srcdir/../..; do

=== modified file 'configure.in' (properties changed: -x to +x)
--- configure.in	2008-08-06 20:33:57 +0000
+++ configure.in	2013-02-02 23:23:20 +0000
@@ -9,9 +9,9 @@
 AC_PREFIX_DEFAULT(/usr/local/nagios)
 
 PKG_NAME=nrpe
-PKG_VERSION="2.12"
+PKG_VERSION="2.13"
 PKG_HOME_URL="http://www.nagios.org/"
-PKG_REL_DATE="03-10-2008"
+PKG_REL_DATE="11-11-2011"
 
 dnl Figure out how to invoke "install" and what install options to use.
 AC_PROG_INSTALL

=== modified file 'contrib/README.nrpe_check_control' (properties changed: -x to +x)
=== modified file 'contrib/nrpe_check_control.c' (properties changed: -x to +x)
--- contrib/nrpe_check_control.c	2004-05-15 12:02:35 +0000
+++ contrib/nrpe_check_control.c	2013-02-02 23:23:20 +0000
@@ -1,121 +1,121 @@
-#include <stdio.h>
-#include <string.h>
-#include <time.h>
-
-#define MAX_CHARS	1024
-#define SERVICE_COUNT	12
-
-#define COMMAND_FILE	"/usr/local/nagios/var/rw/nagios.cmd"
-#define SERVICES_FILE	"/usr/local/nagios/etc/services.cfg"
-
-int main(int argc, char *argv[])
-{
-  char check_name[MAX_CHARS];
-  char ent_type[MAX_CHARS];
-  char input_buffer[MAX_CHARS];
-  char host_name[MAX_CHARS];
-  char service_name[MAX_CHARS];
-  char state[MAX_CHARS];
-  char state_type[MAX_CHARS];
-  char temp_input[MAX_CHARS];
-  char temp_string[MAX_CHARS];
-  char test_host[MAX_CHARS];
-
-  char *temp_var;
-
-  FILE *command_fp;
-  FILE *services_fp;
-
-  int attempt;
-  int i;
-
-  time_t current_time;
-
-  strcpy(state,argv[1]);
-  strcpy(state_type,argv[2]);
-  attempt=atoi(argv[3]);
-  strcpy(host_name,argv[4]);
-
-  if(strcmp(state,"OK") == 0)
-  {
-    services_fp=fopen(SERVICES_FILE,"r");
-    command_fp=fopen(COMMAND_FILE,"a");
-    while((fgets(input_buffer,MAX_CHARS-1,services_fp)) != NULL)
-    {
-      if(input_buffer[0]=='#' || input_buffer[0]=='\x0' || input_buffer[0]=='\n' || input_buffer[0]=='\r')
-      {
-        continue;
-      }
-      else
-      {
-        strcpy(temp_input,input_buffer);
-        strcpy(temp_string,strtok(temp_input,"="));
-        strcpy(ent_type,strtok(temp_string,"["));
-        if(strcmp(ent_type,"service") == 0)
-        {
-          strcpy(test_host,strtok(NULL,"]"));
-          if(strcmp(test_host,host_name) == 0)
-          {
-            temp_var=strtok(input_buffer,"=");
-            strcpy(service_name,strtok(NULL,";")); 
-            for(i=1;i<=SERVICE_COUNT;i++)
-            {
-              temp_var=strtok(NULL,";");
-            }
-            strcpy(check_name,strtok(temp_var,"!"));
-            if(strcmp(check_name,"check_nrpe") == 0)
-            {
-              time(&current_time);
-              fprintf(command_fp,"[%lu] ENABLE_SVC_CHECK;%s;%s\n",current_time,host_name,service_name);
-            }
-          }
-        }
-      }
-    }
-    fclose(command_fp);
-    fclose(services_fp);
-  }
-  else if(strcmp(state,"CRITICAL") == 0)
-  {
-    if(attempt == 3)
-    {
-      services_fp=fopen(SERVICES_FILE,"r");
-      command_fp=fopen(COMMAND_FILE,"a");
-      while((fgets(input_buffer,MAX_CHARS-1,services_fp)) != NULL)
-      {
-        if(input_buffer[0]=='#' || input_buffer[0]=='\x0' || input_buffer[0]=='\n' || input_buffer[0]=='\r')
-        {
-          continue;
-        }
-        else
-        {
-          strcpy(temp_input,input_buffer);
-          strcpy(temp_string,strtok(temp_input,"="));
-          strcpy(ent_type,strtok(temp_string,"["));
-          if(strcmp(ent_type,"service") == 0)
-          {
-            strcpy(test_host,strtok(NULL,"]"));
-            if(strcmp(test_host,host_name) == 0)
-            {
-              temp_var=strtok(input_buffer,"=");
-              strcpy(service_name,strtok(NULL,";")); 
-              for(i=1;i<=SERVICE_COUNT;i++)
-              {
-                temp_var=strtok(NULL,";");
-              }
-              strcpy(check_name,strtok(temp_var,"!"));
-              if(strcmp(check_name,"check_nrpe") == 0)
-              {
-                time(&current_time);
-                fprintf(command_fp,"[%lu] DISABLE_SVC_CHECK;%s;%s\n",current_time,host_name,service_name);
-              }
-            }
-          }
-        }
-      }
-      fclose(command_fp);
-      fclose(services_fp);
-    }
-  }
-  return 0;
-}
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+
+#define MAX_CHARS	1024
+#define SERVICE_COUNT	12
+
+#define COMMAND_FILE	"/usr/local/nagios/var/rw/nagios.cmd"
+#define SERVICES_FILE	"/usr/local/nagios/etc/services.cfg"
+
+int main(int argc, char *argv[])
+{
+  char check_name[MAX_CHARS];
+  char ent_type[MAX_CHARS];
+  char input_buffer[MAX_CHARS];
+  char host_name[MAX_CHARS];
+  char service_name[MAX_CHARS];
+  char state[MAX_CHARS];
+  char state_type[MAX_CHARS];
+  char temp_input[MAX_CHARS];
+  char temp_string[MAX_CHARS];
+  char test_host[MAX_CHARS];
+
+  char *temp_var;
+
+  FILE *command_fp;
+  FILE *services_fp;
+
+  int attempt;
+  int i;
+
+  time_t current_time;
+
+  strcpy(state,argv[1]);
+  strcpy(state_type,argv[2]);
+  attempt=atoi(argv[3]);
+  strcpy(host_name,argv[4]);
+
+  if(strcmp(state,"OK") == 0)
+  {
+    services_fp=fopen(SERVICES_FILE,"r");
+    command_fp=fopen(COMMAND_FILE,"a");
+    while((fgets(input_buffer,MAX_CHARS-1,services_fp)) != NULL)
+    {
+      if(input_buffer[0]=='#' || input_buffer[0]=='\x0' || input_buffer[0]=='\n' || input_buffer[0]=='\r')
+      {
+        continue;
+      }
+      else
+      {
+        strcpy(temp_input,input_buffer);
+        strcpy(temp_string,strtok(temp_input,"="));
+        strcpy(ent_type,strtok(temp_string,"["));
+        if(strcmp(ent_type,"service") == 0)
+        {
+          strcpy(test_host,strtok(NULL,"]"));
+          if(strcmp(test_host,host_name) == 0)
+          {
+            temp_var=strtok(input_buffer,"=");
+            strcpy(service_name,strtok(NULL,";")); 
+            for(i=1;i<=SERVICE_COUNT;i++)
+            {
+              temp_var=strtok(NULL,";");
+            }
+            strcpy(check_name,strtok(temp_var,"!"));
+            if(strcmp(check_name,"check_nrpe") == 0)
+            {
+              time(&current_time);
+              fprintf(command_fp,"[%lu] ENABLE_SVC_CHECK;%s;%s\n",current_time,host_name,service_name);
+            }
+          }
+        }
+      }
+    }
+    fclose(command_fp);
+    fclose(services_fp);
+  }
+  else if(strcmp(state,"CRITICAL") == 0)
+  {
+    if(attempt == 3)
+    {
+      services_fp=fopen(SERVICES_FILE,"r");
+      command_fp=fopen(COMMAND_FILE,"a");
+      while((fgets(input_buffer,MAX_CHARS-1,services_fp)) != NULL)
+      {
+        if(input_buffer[0]=='#' || input_buffer[0]=='\x0' || input_buffer[0]=='\n' || input_buffer[0]=='\r')
+        {
+          continue;
+        }
+        else
+        {
+          strcpy(temp_input,input_buffer);
+          strcpy(temp_string,strtok(temp_input,"="));
+          strcpy(ent_type,strtok(temp_string,"["));
+          if(strcmp(ent_type,"service") == 0)
+          {
+            strcpy(test_host,strtok(NULL,"]"));
+            if(strcmp(test_host,host_name) == 0)
+            {
+              temp_var=strtok(input_buffer,"=");
+              strcpy(service_name,strtok(NULL,";")); 
+              for(i=1;i<=SERVICE_COUNT;i++)
+              {
+                temp_var=strtok(NULL,";");
+              }
+              strcpy(check_name,strtok(temp_var,"!"));
+              if(strcmp(check_name,"check_nrpe") == 0)
+              {
+                time(&current_time);
+                fprintf(command_fp,"[%lu] DISABLE_SVC_CHECK;%s;%s\n",current_time,host_name,service_name);
+              }
+            }
+          }
+        }
+      }
+      fclose(command_fp);
+      fclose(services_fp);
+    }
+  }
+  return 0;
+}

=== modified file 'debian/changelog'
--- debian/changelog	2012-05-16 17:29:52 +0000
+++ debian/changelog	2013-02-02 23:23:20 +0000
@@ -1,3 +1,21 @@
+nagios-nrpe (2.13-1ubuntu1) raring; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{rules,control}: Add hardening-includes to gain PIE security
+      builds.
+    - debian/rules: Use dpkg-buildflags.
+
+ -- Logan Rosen <[e-mail]>  Sat, 02 Feb 2013 18:16:48 -0500
+
+nagios-nrpe (2.13-1) unstable; urgency=low
+
+  * [3e113b5] Imported Upstream version 2.13
+  * [acc152b] Bump standards version
+  * [c707bce] Use dh9 for hardening
+  * Updated patches
+
+ -- Alexander Wirt <[e-mail]>  Sat, 30 Jun 2012 11:08:22 +0200
+
 nagios-nrpe (2.12-6ubuntu2) quantal; urgency=low
 
   * Fixed compiler hardening configuration. (LP: #1000379)

=== modified file 'debian/compat'
--- debian/compat	2011-09-25 08:35:48 +0000
+++ debian/compat	2013-02-02 23:23:20 +0000
@@ -1,1 +1,1 @@
-8
+9

=== modified file 'debian/control'
--- debian/control	2012-05-03 10:11:11 +0000
+++ debian/control	2013-02-02 23:23:20 +0000
@@ -4,8 +4,8 @@
 Maintainer: Ubuntu Developers <[e-mail]>
 XSBC-Original-Maintainer: Debian Nagios Maintainer Group <[e-mail]>
 Uploaders: sean finney <[e-mail]>, Jason Thomas <[e-mail]>, Alexander Wirt <[e-mail]>, Luk Claes <[e-mail]>
-Build-Depends: debhelper (>= 8), openssl, dpatch (>= 2.0.32~), libssl-dev, libwrap0-dev, autotools-dev (>= 20100122.1), hardening-includes
-Standards-Version: 3.9.2
+Build-Depends: debhelper (>= 9), openssl, dpatch (>= 2.0.32~), libssl-dev, libwrap0-dev, autotools-dev (>= 20100122.1), hardening-includes
+Standards-Version: 3.9.3
 
 Package: nagios-nrpe-server
 Architecture: any

=== modified file 'debian/patches/01_nodevrandom-and-docoptions.dpatch'
--- debian/patches/01_nodevrandom-and-docoptions.dpatch	2006-05-14 21:38:48 +0000
+++ debian/patches/01_nodevrandom-and-docoptions.dpatch	2013-02-02 23:23:20 +0000
@@ -5,58 +5,38 @@
 ## DP: No description.
 
 @DPATCH@
-diff -urNad nagios-nrpe-2.2~/src/check_nrpe.c nagios-nrpe-2.2/src/check_nrpe.c
---- nagios-nrpe-2.2~/src/check_nrpe.c	2006-01-21 20:23:36.000000000 +0100
-+++ nagios-nrpe-2.2/src/check_nrpe.c	2006-01-24 08:36:39.000000000 +0100
-@@ -93,6 +93,9 @@
- 		printf(" [arglist]  = Optional arguments that should be passed to the command.  Multiple\n");
- 		printf("              arguments should be separated by a space.  If provided, this must be\n");
- 		printf("              the last option supplied on the command line.\n");
-+		printf(" -h,--help    Print this short help.\n");
-+		printf(" -l,--license Print licensing information.\n");
-+		printf(" -n,--no-ssl  Do not initial an ssl handshake with the server, talk in plaintext.\n");
- 		printf("\n");
- 		printf("Note:\n");
- 		printf("This plugin requires that you have the NRPE daemon running on the remote host.\n");
-diff -urNad nagios-nrpe-2.2~/src/nrpe.c nagios-nrpe-2.2/src/nrpe.c
---- nagios-nrpe-2.2~/src/nrpe.c	2006-01-21 20:23:36.000000000 +0100
-+++ nagios-nrpe-2.2/src/nrpe.c	2006-01-24 08:38:30.000000000 +0100
-@@ -120,11 +120,13 @@
- 		printf("Usage: nrpe [-n] -c <config_file> <mode>\n");
- 		printf("\n");
- 		printf("Options:\n");
--		printf(" -n            = Do not use SSL\n");
-+		printf(" -n,--no-ssl   = Do not use SSL\n");
- 		printf(" <config_file> = Name of config file to use\n");
- 		printf(" <mode>        = One of the following two operating modes:\n");  
--		printf("   -i          =    Run as a service under inetd or xinetd\n");
--		printf("   -d          =    Run as a standalone daemon\n");
-+		printf("   -i,--inetd    Run as a service under inetd or xinetd\n");
-+		printf("   -d,--daemon   Run as a standalone daemon\n");
-+		printf("   -h,--help     Print this short help.\n");
-+		printf("   -l,--license  Print licensing information.\n");
- 		printf("\n");
- 		printf("Notes:\n");
- 		printf("This program is designed to process requests from the check_nrpe\n");
-diff -urNad nagios-nrpe-2.2~/src/utils.c nagios-nrpe-2.2/src/utils.c
---- nagios-nrpe-2.2~/src/utils.c	2003-10-16 01:14:27.000000000 +0200
-+++ nagios-nrpe-2.2/src/utils.c	2006-01-24 08:36:39.000000000 +0100
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' pkg-nrpe~/src/check_nrpe.c pkg-nrpe/src/check_nrpe.c
+--- pkg-nrpe~/src/check_nrpe.c	2012-04-30 09:36:53.000000000 +0200
++++ pkg-nrpe/src/check_nrpe.c	2012-04-30 09:45:36.129684439 +0200
+@@ -96,6 +96,9 @@
+ 		printf(" [arglist]  = Optional arguments that should be passed to the command.  Multiple\n");
+ 		printf("              arguments should be separated by a space.  If provided, this must be\n");
+ 		printf("              the last option supplied on the command line.\n");
++		printf(" -h,--help    Print this short help.\n");
++		printf(" -l,--license Print licensing information.\n");
++		printf(" -n,--no-ssl  Do not initiate an ssl handshake with the server, talk in plaintext.\n");
+ 		printf("\n");
+ 		printf("Note:\n");
+ 		printf("This plugin requires that you have the NRPE daemon running on the remote host.\n");
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' pkg-nrpe~/src/utils.c pkg-nrpe/src/utils.c
+--- pkg-nrpe~/src/utils.c	2012-04-30 09:36:53.000000000 +0200
++++ pkg-nrpe/src/utils.c	2012-04-30 09:48:03.811163608 +0200
 @@ -90,17 +90,7 @@
- 	   ends and the rest of the buffer (padded randomly) starts.
- 	***************************************************************/
- 
--	/* try to get seed value from /dev/urandom, as its a better source of entropy */
--	fp=fopen("/dev/urandom","r");
--	if(fp!=NULL){
--		seed=fgetc(fp);
--		fclose(fp);
--	        }
--
--	/* else fallback to using the current time as the seed */
--	else
--		seed=(int)time(NULL);
--
-+	seed=(int)time(NULL)*311-getpid()*359+getppid()*383;
- 	srand(seed);
- 	for(x=0;x<buffer_size;x++)
- 		buffer[x]=(int)'0'+(int)(72.0*rand()/(RAND_MAX+1.0));
+ 	   ends and the rest of the buffer (padded randomly) starts.
+ 	***************************************************************/
+ 
+-	/* try to get seed value from /dev/urandom, as its a better source of entropy */
+-	fp=fopen("/dev/urandom","r");
+-	if(fp!=NULL){
+-		seed=fgetc(fp);
+-		fclose(fp);
+-	        }
+-
+-	/* else fallback to using the current time as the seed */
+-	else
+-		seed=(int)time(NULL);
+-
++	seed=(int)time(NULL)*311-getpid()*359+getppid()*383;
+ 	srand(seed);
+ 	for(x=0;x<buffer_size;x++)
+ 		buffer[x]=(int)'0'+(int)(72.0*rand()/(RAND_MAX+1.0));

=== modified file 'debian/patches/04_weird_output.dpatch'
--- debian/patches/04_weird_output.dpatch	2009-03-21 09:33:39 +0000
+++ debian/patches/04_weird_output.dpatch	2013-02-02 23:23:20 +0000
@@ -5,16 +5,16 @@
 ## DP: Clean buffer before use
 
 @DPATCH@
-diff -urNad nagios-nrpe-2.12~/src/nrpe.c nagios-nrpe-2.12/src/nrpe.c
---- nagios-nrpe-2.12~/src/nrpe.c	2008-09-14 16:19:36.000000000 +0200
-+++ nagios-nrpe-2.12/src/nrpe.c	2008-09-14 16:21:19.000000000 +0200
-@@ -1165,6 +1165,9 @@
- 	/* disable connection alarm - a new alarm will be setup during my_system */
- 	alarm(0);
- 
-+	// null buffer before using it!
-+	memset(buffer,0,sizeof(buffer));
-+
- 	/* if this is the version check command, just spew it out */
- 	if(!strcmp(command_name,NRPE_HELLO_COMMAND)){
- 
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' pkg-nrpe~/src/nrpe.c pkg-nrpe/src/nrpe.c
+--- pkg-nrpe~/src/nrpe.c	2012-04-30 09:36:53.000000000 +0200
++++ pkg-nrpe/src/nrpe.c	2012-04-30 09:52:47.890535825 +0200
+@@ -1107,6 +1107,9 @@
+ 	/* disable connection alarm - a new alarm will be setup during my_system */
+ 	alarm(0);
+ 
++	// null buffer before using it!
++	memset(buffer,0,sizeof(buffer));
++
+ 	/* if this is the version check command, just spew it out */
+ 	if(!strcmp(command_name,NRPE_HELLO_COMMAND)){
+ 

=== modified file 'debian/patches/05_pid_privileges.dpatch'
--- debian/patches/05_pid_privileges.dpatch	2009-07-06 07:08:26 +0000
+++ debian/patches/05_pid_privileges.dpatch	2013-02-02 23:23:20 +0000
@@ -5,23 +5,23 @@
 ## DP: No description.
 
 @DPATCH@
-diff -urNad nagios-nrpe-2.12~/src/nrpe.c nagios-nrpe-2.12/src/nrpe.c
---- nagios-nrpe-2.12~/src/nrpe.c	2009-07-06 10:20:37.000000000 +0200
-+++ nagios-nrpe-2.12/src/nrpe.c	2009-07-06 10:22:00.000000000 +0200
-@@ -296,12 +296,13 @@
- 		/* log info to syslog facility */
- 		syslog(LOG_NOTICE,"Starting up daemon");
- 
-+				
-+		/* drop privileges */
-+		drop_privileges(nrpe_user,nrpe_group);
-+
- 		/* write pid file */
- 		if(write_pid_file()==ERROR)
- 			return STATE_CRITICAL;
--		
--		/* drop privileges */
--		drop_privileges(nrpe_user,nrpe_group);
- 
- 		/* make sure we're not root */
- 		check_privileges();
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' pkg-nrpe~/src/nrpe.c pkg-nrpe/src/nrpe.c
+--- pkg-nrpe~/src/nrpe.c	2012-06-30 11:03:29.000000000 +0200
++++ pkg-nrpe/src/nrpe.c	2012-06-30 11:03:46.791280548 +0200
+@@ -301,13 +301,13 @@
+ 		/* log info to syslog facility */
+ 		syslog(LOG_NOTICE,"Starting up daemon");
+ 
++		/* drop privileges */
++		drop_privileges(nrpe_user,nrpe_group);
++
+ 		/* write pid file */
+ 		if(write_pid_file()==ERROR)
+ 			return STATE_CRITICAL;
+ 		
+-		/* drop privileges */
+-		drop_privileges(nrpe_user,nrpe_group);
+-
+ 		/* make sure we're not root */
+ 		check_privileges();
+ 

=== modified file 'docs/NRPE.odt' (properties changed: -x to +x)
=== modified file 'docs/NRPE.pdf' (properties changed: -x to +x)
=== added file 'include/acl.h'
--- include/acl.h	1970-01-01 00:00:00 +0000
+++ include/acl.h	2013-02-02 23:23:20 +0000
@@ -0,0 +1,65 @@
+/*-
+ * acl.c - header file for acl.c
+ * Copyright (c) 2011 Kaspersky Lab ZAO
+ * Last Modified: 08-10-2011 by Konstantin Malov with Oleg Koreshkov's help 
+ *
+ * License: GPL
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef ACL_H_INCLUDED
+#define ACL_H_INCLUDED 1
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <netdb.h>
+#include <syslog.h>
+#include <stdarg.h>
+
+#define CHAR_TO_NUMBER(c)   ((c) - '0')
+
+struct ip_acl {
+        struct in_addr  addr;
+        struct in_addr  mask;
+        struct ip_acl   *next;
+};
+
+struct dns_acl {
+        char domain[255];
+        struct dns_acl *next;
+};
+
+/* Poiters to head ACL structs */
+static struct ip_acl *ip_acl_head, *ip_acl_prev;
+static struct dns_acl *dns_acl_head, *dns_acl_prev;
+
+/* Functions */
+void parse_allowed_hosts(char *allowed_hosts);
+int add_ipv4_to_acl(char *ipv4);
+int add_domain_to_acl(char *domain);
+int is_an_allowed_host(struct in_addr);
+unsigned int prefix_from_mask(struct in_addr mask);
+void show_acl_lists(void);
+
+#endif /* ACL_H_INCLUDED */

=== modified file 'include/common.h' (properties changed: -x to +x)
--- include/common.h	2008-08-06 20:33:57 +0000
+++ include/common.h	2013-02-02 23:23:20 +0000
@@ -1,71 +1,84 @@
-/************************************************************************
- *
- * COMMON.H - NRPE Common Include File
- * Copyright (c) 1999-2007 Ethan Galstad ([e-mail])
- * Last Modified: 03-10-2008
- *
- * License:
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- ************************************************************************/
-
-#include "config.h"
-
-#define PROGRAM_VERSION "2.12"
-#define MODIFICATION_DATE "03-10-2008"
-
-#define OK		0
-#define ERROR		-1
-
-#define TRUE		1
-#define FALSE		0
-
-#define STATE_UNKNOWN  	3	/* service state return codes */
-#define	STATE_CRITICAL 	2
-#define STATE_WARNING 	1
-#define STATE_OK       	0
-
-
-#define DEFAULT_SOCKET_TIMEOUT	10	/* timeout after 10 seconds */
-#define DEFAULT_CONNECTION_TIMEOUT 300	/* timeout if daemon is waiting for connection more than this time */
-
-#define MAX_INPUT_BUFFER	2048	/* max size of most buffers we use */
-#define MAX_FILENAME_LENGTH     256
-
-#define MAX_HOST_ADDRESS_LENGTH	256	/* max size of a host address */
-
-#define NRPE_HELLO_COMMAND      "_NRPE_CHECK"
-
-#define MAX_COMMAND_ARGUMENTS   16
-
-
-/**************** PACKET STRUCTURE DEFINITION **********/
-
-#define QUERY_PACKET		1		/* id code for a packet containing a query */
-#define	RESPONSE_PACKET		2		/* id code for a packet containing a response */
-
-#define NRPE_PACKET_VERSION_3   3               /* packet version identifier */
-#define NRPE_PACKET_VERSION_2   2               
-#define NRPE_PACKET_VERSION_1	1		/* older packet version identifiers (no longer supported) */
-
-#define MAX_PACKETBUFFER_LENGTH	1024		/* max amount of data we'll send in one query/response */
-
-typedef struct packet_struct{
-	int16_t   packet_version;
-	int16_t   packet_type;
-	u_int32_t crc32_value;
-	int16_t   result_code;
-	char      buffer[MAX_PACKETBUFFER_LENGTH];
-        }packet;
+/************************************************************************
+ *
+ * COMMON.H - NRPE Common Include File
+ * Copyright (c) 1999-2007 Ethan Galstad ([e-mail])
+ * Last Modified: 11-11-2011
+ *
+ * License:
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ ************************************************************************/
+
+#include "config.h"
+
+#define PROGRAM_VERSION "2.13"
+#define MODIFICATION_DATE "11-11-2011"
+
+#define OK		0
+#define ERROR		-1
+
+#define TRUE		1
+#define FALSE		0
+
+#define STATE_UNKNOWN  	3	/* service state return codes */
+#define	STATE_CRITICAL 	2
+#define STATE_WARNING 	1
+#define STATE_OK       	0
+
+
+#define DEFAULT_SOCKET_TIMEOUT	10	/* timeout after 10 seconds */
+#define DEFAULT_CONNECTION_TIMEOUT 300	/* timeout if daemon is waiting for connection more than this time */
+
+#define MAX_INPUT_BUFFER	2048	/* max size of most buffers we use */
+#define MAX_FILENAME_LENGTH     256
+
+#define MAX_HOST_ADDRESS_LENGTH	256	/* max size of a host address */
+
+#define NRPE_HELLO_COMMAND      "_NRPE_CHECK"
+
+#define MAX_COMMAND_ARGUMENTS   16
+
+
+/**************** PACKET STRUCTURE DEFINITION **********/
+
+#define QUERY_PACKET		1		/* id code for a packet containing a query */
+#define	RESPONSE_PACKET		2		/* id code for a packet containing a response */
+
+#define NRPE_PACKET_VERSION_3   3               /* packet version identifier */
+#define NRPE_PACKET_VERSION_2   2               
+#define NRPE_PACKET_VERSION_1	1		/* older packet version identifiers (no longer supported) */
+
+#define MAX_PACKETBUFFER_LENGTH	1024		/* max amount of data we'll send in one query/response */
+
+typedef struct packet_struct{
+	int16_t   packet_version;
+	int16_t   packet_type;
+	u_int32_t crc32_value;
+	int16_t   result_code;
+	char      buffer[MAX_PACKETBUFFER_LENGTH];
+        }packet;
+
+/**************** OPERATING SYSTEM SPECIFIC DEFINITIONS **********/
+#ifdef __sun
+
+#  ifndef LOG_AUTHPRIV
+#    define LOG_AUTHPRIV LOG_AUTH
+#  endif
+
+#  ifndef LOG_FTP
+#    define LOG_FTP LOG_DAEMON
+#  endif
+
+#endif

=== modified file 'include/config.h.in' (properties changed: -x to +x)
=== modified file 'include/dh.h' (properties changed: -x to +x)
--- include/dh.h	2008-08-06 20:33:57 +0000
+++ include/dh.h	2013-02-02 23:23:20 +0000
@@ -4,12 +4,12 @@
 DH *get_dh512()
 	{
 	static unsigned char dh512_p[]={
-		0xA0,0xC9,0x8F,0x6D,0x75,0x7A,0x4E,0xED,0xED,0x80,0x11,0x32,
-		0x77,0x14,0xEA,0xE0,0xE7,0x38,0x55,0x01,0x03,0x02,0xC5,0x34,
-		0xCA,0x2D,0xA7,0xFA,0x2E,0x1C,0x5F,0xD9,0xF4,0xDA,0x54,0x40,
-		0xD7,0xB4,0x7B,0x00,0xE5,0x19,0x30,0x69,0xC5,0x93,0x52,0x09,
-		0xB7,0x2D,0x5B,0xAB,0x27,0x0C,0x0D,0xAA,0xCE,0x56,0xB7,0x4D,
-		0xE9,0x8A,0xFB,0x43,
+		0xA4,0x56,0x47,0x7F,0x90,0xF0,0xDE,0xFE,0x73,0x1A,0xBD,0x3E,
+		0xA9,0xF5,0x69,0x46,0x29,0x0B,0x47,0x55,0x8C,0xE8,0xF3,0xDF,
+		0xF6,0x1B,0xC5,0x29,0x1B,0x81,0x97,0x3E,0xE4,0xD9,0xC8,0x2B,
+		0xBB,0x2B,0x7A,0x37,0xE1,0x18,0xDF,0xEC,0x6B,0xEC,0x04,0x77,
+		0x6D,0x51,0x3C,0x7C,0xB7,0x81,0xBD,0x7F,0xC9,0x5A,0x04,0xB4,
+		0xA4,0x3E,0x8B,0x5B,
 		};
 	static unsigned char dh512_g[]={
 		0x02,

=== modified file 'include/nrpe.h' (properties changed: -x to +x)
--- include/nrpe.h	2008-08-06 20:33:57 +0000
+++ include/nrpe.h	2013-02-02 23:23:20 +0000
@@ -1,61 +1,65 @@
-/************************************************************************
- *
- * NRPE.H - NRPE Include File
- * Copyright (c) 1999-2007 Ethan Galstad ([e-mail])
- * Last Modified: 11-23-2007
- *
- * License:
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- ************************************************************************/
-
-
-/**************** COMMAND STRUCTURE DEFINITION **********/
-
-typedef struct command_struct{
-	char *command_name;
-	char *command_line;
-	struct command_struct *next;
-        }command;
-
-int process_arguments(int,char **);
-void wait_for_connections(void);
-void handle_connection(int);
-int read_config_file(char *);
-int read_config_dir(char *);
-int get_log_facility(char *);
-int add_command(char *,char *);
-command *find_command(char *);
-void sighandler(int);
-int drop_privileges(char *,char *);
-int check_privileges(void);
-
-int write_pid_file(void);
-int remove_pid_file(void);
-
-void free_memory(void);
-int is_an_allowed_host(char *);
-int validate_request(packet *);
-int contains_nasty_metachars(char *);
-int process_macros(char *,char *,int);
-int my_system(char *,int,int *,char *,int);            	/* executes a command via popen(), but also protects against timeouts */
-void my_system_sighandler(int);				/* handles timeouts when executing commands via my_system() */
-void my_connection_sighandler(int);			/* handles timeouts of connection */
-
-void sighandler(int);
-void child_sighandler(int);
-
-
+/************************************************************************
+ *
+ * NRPE.H - NRPE Include File
+ * Copyright (c) 1999-2007 Ethan Galstad ([e-mail])
+ * Last Modified: 08-10-2011 by Konstantin Malov
+ *
+ * License:
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ ************************************************************************/
+
+ /*
+  * 08-10-2011 IPv4 subnetworks support added.
+  * Main change in nrpe.c is that is_an_allowed_host() moved to acl.c
+  *
+  */
+
+/**************** COMMAND STRUCTURE DEFINITION **********/
+
+typedef struct command_struct{
+	char *command_name;
+	char *command_line;
+	struct command_struct *next;
+        }command;
+
+int process_arguments(int,char **);
+void wait_for_connections(void);
+void handle_connection(int);
+int read_config_file(char *);
+int read_config_dir(char *);
+int get_log_facility(char *);
+int add_command(char *,char *);
+command *find_command(char *);
+void sighandler(int);
+int drop_privileges(char *,char *);
+int check_privileges(void);
+
+int write_pid_file(void);
+int remove_pid_file(void);
+
+void free_memory(void);
+int validate_request(packet *);
+int contains_nasty_metachars(char *);
+int process_macros(char *,char *,int);
+int my_system(char *,int,int *,char *,int);            	/* executes a command via popen(), but also protects against timeouts */
+void my_system_sighandler(int);				/* handles timeouts when executing commands via my_system() */
+void my_connection_sighandler(int);			/* handles timeouts of connection */
+
+void sighandler(int);
+void child_sighandler(int);
+
+

=== modified file 'include/utils.h' (properties changed: -x to +x)
--- include/utils.h	2007-05-12 12:27:30 +0000
+++ include/utils.h	2013-02-02 23:23:20 +0000
@@ -1,62 +1,62 @@
-/************************************************************************************************
- *
- * UTILS.H - NRPE Utilities Include File
- *
- * License: GPL
- * Copyright (c) 1999-2006 Ethan Galstad ([e-mail])
- *
- * Last Modified: 12-11-2006
- *
- * Description:
- *
- * This file contains common include files and function definitions used in many of the plugins.
- *
- * License Information:
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- ************************************************************************************************/
-
-#ifndef _UTILS_H
-#define _UTILS_H
-
-#include "../include/config.h"
-
-
-void generate_crc32_table(void);
-unsigned long calculate_crc32(char *, int);
-
-void randomize_buffer(char *,int);
-
-int my_tcp_connect(char *,int,int *);
-int my_connect(char *,int,int *,char *);
-
-int my_inet_aton(register const char *,struct in_addr *);
-
-void strip(char *);
-
-int sendall(int,char *,int *);
-int recvall(int,char *,int *,int);
-
-char *my_strsep(char **,const char *);
-
-void display_license(void);
-
-#endif
-
-
-
-
-
+/************************************************************************************************
+ *
+ * UTILS.H - NRPE Utilities Include File
+ *
+ * License: GPL
+ * Copyright (c) 1999-2006 Ethan Galstad ([e-mail])
+ *
+ * Last Modified: 12-11-2006
+ *
+ * Description:
+ *
+ * This file contains common include files and function definitions used in many of the plugins.
+ *
+ * License Information:
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ ************************************************************************************************/
+
+#ifndef _UTILS_H
+#define _UTILS_H
+
+#include "../include/config.h"
+
+
+void generate_crc32_table(void);
+unsigned long calculate_crc32(char *, int);
+
+void randomize_buffer(char *,int);
+
+int my_tcp_connect(char *,int,int *);
+int my_connect(char *,int,int *,char *);
+
+int my_inet_aton(register const char *,struct in_addr *);
+
+void strip(char *);
+
+int sendall(int,char *,int *);
+int recvall(int,char *,int *,int);
+
+char *my_strsep(char **,const char *);
+
+void display_license(void);
+
+#endif
+
+
+
+
+

=== modified file 'init-script.debian.in' (properties changed: -x to +x)
=== modified file 'init-script.in' (properties changed: -x to +x)
=== modified file 'init-script.suse.in' (properties changed: -x to +x)
=== modified file 'nrpe.spec' (properties changed: -x to +x)
--- nrpe.spec	2008-08-06 20:33:57 +0000
+++ nrpe.spec	2013-02-02 23:23:20 +0000
@@ -1,5 +1,5 @@
 %define name nrpe
-%define version 2.12
+%define version 2.13
 %define release 1
 %define nsusr nagios
 %define nsgrp nagios

=== modified file 'sample-config/nrpe.cfg.in' (properties changed: -x to +x)
--- sample-config/nrpe.cfg.in	2008-08-06 20:33:57 +0000
+++ sample-config/nrpe.cfg.in	2013-02-02 23:23:20 +0000
@@ -67,7 +67,9 @@
 
 # ALLOWED HOST ADDRESSES
 # This is an optional comma-delimited list of IP address or hostnames 
-# that are allowed to talk to the NRPE daemon.
+# that are allowed to talk to the NRPE daemon. Network addresses with a bit mask
+# (i.e. 192.168.1.0/24) are also supported. Hostname wildcards are not currently 
+# supported.
 #
 # Note: The daemon only does rudimentary checking of the client's IP
 # address.  I would highly recommend adding entries in your /etc/hosts.allow

=== modified file 'sample-config/nrpe.xinetd.in' (properties changed: -x to +x)
=== removed file 'src/.cvsignore'
--- src/.cvsignore	2011-10-18 15:09:21 +0000
+++ src/.cvsignore	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-dh.h

=== modified file 'src/Makefile.in' (properties changed: -x to +x)
--- src/Makefile.in	2008-08-06 20:33:57 +0000
+++ src/Makefile.in	2013-02-02 23:23:20 +0000
@@ -33,8 +33,8 @@
 
 all: nrpe check_nrpe
 
-nrpe: nrpe.c utils.c $(SRC_INCLUDE)/nrpe.h $(SRC_INCLUDE)/utils.h $(SRC_INCLUDE)/common.h $(SRC_INCLUDE)/config.h $(SNPRINTF_O)
-	$(CC) $(CFLAGS) -o $@ nrpe.c utils.c $(LDFLAGS) $(SOCKETLIBS) $(LIBWRAPLIBS) $(SNPRINTF_O) $(OTHERLIBS)
+nrpe: nrpe.c utils.c acl.c $(SRC_INCLUDE)/nrpe.h $(SRC_INCLUDE)/utils.h $(SRC_INCLUDE)/common.h $(SRC_INCLUDE)/config.h $(SRC_INCLUDE)/acl.h $(SNPRINTF_O)
+	$(CC) $(CFLAGS) -o $@ nrpe.c utils.c acl.c $(LDFLAGS) $(SOCKETLIBS) $(LIBWRAPLIBS) $(SNPRINTF_O) $(OTHERLIBS)
 
 check_nrpe: check_nrpe.c utils.c $(SRC_INCLUDE)/utils.h $(SRC_INCLUDE)/common.h $(SRC_INCLUDE)/config.h
 	$(CC) $(CFLAGS) -o $@ check_nrpe.c utils.c $(LDFLAGS) $(SOCKETLIBS) $(OTHERLIBS)

=== added file 'src/acl.c'
--- src/acl.c	1970-01-01 00:00:00 +0000
+++ src/acl.c	2013-02-02 23:23:20 +0000
@@ -0,0 +1,469 @@
+/*-
+ * acl.c - a small library for nrpe.c. It adds IPv4 subnets support to ACL in nrpe.
+ * Copyright (c) 2011 Kaspersky Lab ZAO
+ * Last Modified: 08-10-2011 by Konstantin Malov with Oleg Koreshkov's help 
+ *
+ * Description:
+ * acl.c creates two linked lists. One is for IPv4 hosts and networks, another is for domain names.
+ * All connecting hosts (if allowed_hosts is defined) are checked in these two lists.
+ *
+ * Some notes:
+ * 1) IPv6 isn't supported in ACL.
+ * 2) Only ANCII names are supported in ACL.
+ *
+ * License: GPL
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <netdb.h>
+#include <syslog.h>
+#include <stdarg.h>
+
+#include "../include/acl.h"
+
+/* This function checks if a char argumnet from valid char range.
+ * Valid range is: ASCII only, a number or a letter, a space, a dot, a slash, a dash, a comma.
+ *
+ * Returns:
+ *      0 - char isn't from valid group
+ *  1 - char is a number
+ *  2 - char is a letter
+ *  3 - char is a space(' ')
+ *  4 - char is a dot('.')
+ *  5 - char is a slash('/')
+ *  6 - char is a dash('-')
+ *  7 - char is a comma(',')
+ */
+
+int isvalidchar(int c) {
+        if (!isascii(c))
+                return 0;
+
+        if (isdigit(c))
+                return 1;
+
+        if (isalpha(c))
+                return 2;
+
+        if (isspace(c))
+                return 3;
+
+        switch (c) {
+        case '.':
+                return 4;
+                break;
+        case '/':
+                return 5;
+                break;
+        case '-':
+                return 6;
+                break;
+        case ',':
+                return 7;
+                break;
+        default:
+                return 0;
+        }
+}
+
+/*
+ * Get substring from allowed_hosts from s position to e position.
+ */
+
+char * acl_substring(char *string, int s, int e) {
+    char *substring;
+    int len = e - s;
+
+        if (len < 0)
+                return NULL;
+
+    if ( (substring = malloc(len + 1)) == NULL)
+        return NULL;
+
+    memmove(substring, string + s, len + 1);
+    return substring;
+}
+
+/*
+ * Add IPv4 host or network to IP ACL. IPv4 format is X.X.X.X[/X].
+ * Host will be added to ACL only if it has passed IPv4 format check.
+ *
+ * Returns:
+ * 1 - on success
+ * 0 - on failure
+ *
+ * States for IPv4 format check:
+ *  0 - numbers(-> 1), dot(-> -1), slash(-> -1), other(-> -1)
+ *  1 - numbers(-> 1), dot(-> 2),  slash(-> -1), other(-> -1)
+ *  2 - numbers(-> 3), dot(-> -1), slash(-> -1), other(-> -1)
+ *  3 - numbers(-> 3), dot(-> 4),  slash(-> -1), other(-> -1)
+ *  4 - numbers(-> 5), dot(-> -1), slash(-> -1), other(-> -1)
+ *  5 - numbers(-> 5), dot(-> 6),  slash(-> -1), other(-> -1)
+ *  6 - numbers(-> 7), dot(-> -1), slash(-> -1), other(-> -1)
+ *  7 - numbers(-> 7), dor(-> -1), slash(-> 8),  other(-> -1)
+ *  8 - numbers(-> 9), dor(-> -1), slash(-> -1), other(-> -1)
+ *  9 - numbers(-> 9), dot(-> -1), slash(-> -1), other(-> -1)
+ *
+ *  Good states are 7(IPv4 host) and 9(IPv4 network)
+ */
+
+int add_ipv4_to_acl(char *ipv4) {
+        int state = 0;
+        int octet = 0;
+        int index = 0;  /* position in data array */
+        int data[5];    /* array to store ip octets and mask */
+        int len = strlen(ipv4);
+        int i, c;
+        unsigned long ip, mask;
+        struct ip_acl *ip_acl_curr;
+
+        /* Check for min and max IPv4 valid length */
+        if (len < 7 || len > 18)
+                return 0;
+
+        /* default mask for ipv4 */
+        data[4] = 32;
+
+        /* Basic IPv4 format check */
+        for (i = 0; i < len; i++) {
+                /* Return 0 on error state */
+                if (state == -1)
+                        return 0;
+
+                c = ipv4[i];
+
+                switch (c) {
+                case '0': case '1': case '2': case '3': case '4':
+                case '5': case '6': case '7': case '8': case '9':
+                        octet = octet * 10 + CHAR_TO_NUMBER(c);
+                        switch (state) {
+                        case 0: case 2: case 4: case 6: case 8:
+                                state++;
+                                break;
+                        }
+                        break;
+                case '.':
+                        switch (state) {
+                        case 1: case 3: case 5:
+                                data[index++] = octet;
+                                octet = 0;
+                                state++;
+                                break;
+                        default:
+                                state = -1;
+                        }
+                        break;
+                case '/':
+                        switch (state) {
+                        case 7:
+                                data[index++] = octet;
+                                octet = 0;
+                                state++;
+                                break;
+                        default:
+                                state = -1;
+                        }
+                        break;
+                default:
+                        state = -1;
+                }
+        }
+
+        /* Exit state handling */
+        switch (state) {
+        case 7: case 9:
+                data[index] = octet;
+                break;
+        default:
+                /* Bad states */
+                return 0;
+        }
+
+        /*
+         * Final IPv4 format check.
+         */
+        for (i=0; i < 4; i++) {
+                if (data[i] < 0 || data[i] > 255) {
+                        syslog(LOG_ERR,"Invalid IPv4 address/network format(%s) in allowed_hosts option\n",ipv4);
+                        return 0;
+                }
+        }
+
+        if (data[4] < 0 || data[4] > 32) {
+                syslog(LOG_ERR,"Invalid IPv4 network mask format(%s) in allowed_hosts option\n",ipv4);
+                return 0;
+        }
+
+        /* Conver ip and mask to unsigned long */
+        ip = htonl((data[0] << 24) + (data[1] << 16) + (data[2] << 8) + data[3]);
+        mask =  htonl(-1 << (32 - data[4]));
+
+        /* Wrong network address */
+        if ( (ip & mask) != ip) {
+                syslog(LOG_ERR,"IP address and mask do not match in %s\n",ipv4);
+                return 0;
+        }
+
+        /* Add addr to ip_acl list */
+        if ( (ip_acl_curr = malloc(sizeof(*ip_acl_curr))) == NULL) {
+                syslog(LOG_ERR,"Can't allocate memory for ACL, malloc error\n");
+                return 0;
+        }
+
+        /* Save result in ACL ip list */
+        ip_acl_curr->addr.s_addr = ip;
+        ip_acl_curr->mask.s_addr = mask;
+        ip_acl_curr->next = NULL;
+
+        if (ip_acl_head == NULL) {
+                ip_acl_head = ip_acl_curr;
+        } else {
+                ip_acl_prev->next = ip_acl_curr;
+        }
+        ip_acl_prev = ip_acl_curr;
+        return 1;
+}
+
+/*
+ * Add domain to DNS ACL list
+ * Domain will be added only if it has passed domain name check.
+ *
+ * In this case domain valid format is:
+ * 1) Domain names must use only alphanumeric characters and dashes (-).
+ * 2) Domain names mustn't begin or end with dashes (-).
+ * 3) Domain names mustn't have more than 63 characters.
+ *
+ * Return:
+ * 1 - for success
+ * 0 - for failure
+ *
+ * 0 - alpha(-> 1), number(-> 1), dot(-> -1), dash(-> -1), all other(-> -1)
+ * 1 - alpha(-> 1), number(-> 1), dot(-> 2),  dash(-> 6),  all other(-> -1)
+ * 2 - alpha(-> 3), number(-> 1), dot(-> -1), dash(-> -1), all other(-> -1)
+ * 3 - alpha(-> 4), number(-> 1), dot(-> 2),  dash(-> 6),  all other(-> -1)
+ * 4 - alpha(-> 5), number(-> 1), dot(-> 2),  dash(-> 6),  all other(-> -1)
+ * 5 - alpha(-> 1), number(-> 1), dot(-> 2),  dash(-> 6),  all other(-> -1)
+ * 6 - alpha(-> 1), number(-> 1), dot(-> 2),  dash(-> 6),  all other(-> -1)
+
+ * For real FQDN only 4 and 5 states are good for exit.
+ * I don't check if top domain exists (com, ru and etc.)
+ * But in real life NRPE could work in LAN,
+ * with local domain zones like .local or with names like 'mars' added to /etc/hosts.
+ * So 1 is good state too. And maybe this check is not necessary at all...
+ */
+
+int add_domain_to_acl(char *domain) {
+        int state = 0;
+        int len = strlen(domain);
+        int i, c;
+
+        struct dns_acl *dns_acl_curr;
+
+        if (len > 63)
+                return 0;
+
+        for (i = 0; i < len; i++) {
+                c = domain[i];
+                switch (isvalidchar(c)) {
+                case 1:
+                        state = 1;
+                        break;
+                case 2:
+                        switch (state) {
+                        case 0: case 1: case 5: case 6:
+                                state = 1;
+                                break;
+                        case 2: case 3: case 4:
+                                state++;
+                                break;
+                        }
+                        break;
+
+                case 4:
+                        switch (state) {
+                        case 0: case 2:
+                                state = -1;
+                                break;
+                        default:
+                                state = 2;
+                        }
+                        break;
+                case 6:
+                        switch (state) {
+                        case 0: case 2:
+                                state = -1;
+                                break;
+                        default:
+                                state = 6;
+                        }
+                        break;
+                default:
+                        /* Not valid chars */
+                        return 0;
+                }
+        }
+
+        /* Check exit code */
+        switch (state) {
+        case 1: case 4: case 5:
+                /* Add name to domain ACL list */
+                if ( (dns_acl_curr = malloc(sizeof(*dns_acl_curr))) == NULL) {
+                        syslog(LOG_ERR,"Can't allocate memory for ACL, malloc error\n");
+                        return 0;
+                }
+                strcpy(dns_acl_curr->domain, domain);
+                dns_acl_curr->next = NULL;
+
+                if (dns_acl_head == NULL)
+                        dns_acl_head = dns_acl_curr;
+                else
+                        dns_acl_prev->next = dns_acl_curr;
+
+                dns_acl_prev = dns_acl_curr;
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+/* Checks connectiong host in ACL
+ *
+ * Returns:
+ * 1 - on success
+ * 0 - on failure
+ */
+
+int is_an_allowed_host(struct in_addr host) {
+        struct ip_acl *ip_acl_curr = ip_acl_head;
+        struct dns_acl *dns_acl_curr = dns_acl_head;
+        struct in_addr addr;
+        struct hostent *he;
+
+        while (ip_acl_curr != NULL) {
+                if ( (host.s_addr & ip_acl_curr->mask.s_addr) == ip_acl_curr->addr.s_addr)
+                        return 1;
+
+                ip_acl_curr = ip_acl_curr->next;
+        }
+
+        while(dns_acl_curr != NULL) {
+        he = gethostbyname(dns_acl_curr->domain);
+        if (he == NULL)
+                        return 0;
+
+                while (*he->h_addr_list) {
+                        memmove((char *)&addr,*he->h_addr_list++, sizeof(addr));
+                        if (addr.s_addr == host.s_addr)
+                                return 1;
+                }
+                dns_acl_curr = dns_acl_curr->next;
+        }
+        return 0;
+}
+
+/* The trim() function takes a source string and copies it to the destination string,
+ * stripped of leading and training whitespace. The destination string must be 
+ * allocated at least as large as the source string.
+ */
+
+void trim( char *src, char *dest) {
+	char *sptr, *dptr;
+
+	for( sptr = src; isblank( *sptr) && *sptr; sptr++); /* Jump past leading spaces */
+	for( dptr = dest; !isblank( *sptr) && *sptr; ) {
+		*dptr = *sptr;
+		sptr++;
+		dptr++;
+	}
+	*dptr = '\0';
+	return;
+}
+
+/* This function splits allowed_hosts to substrings with comma(,) as a delimeter.
+ * It doesn't check validness of ACL record (add_ipv4_to_acl() and add_domain_to_acl() do),
+ * just trims spaces from ACL records.
+ * After this it sends ACL records to add_ipv4_to_acl() or add_domain_to_acl().
+ */
+
+void parse_allowed_hosts(char *allowed_hosts) {
+	char *hosts = strdup( allowed_hosts);	/* Copy since strtok* modifes original */
+	char *saveptr;
+	char *tok;
+	const char *delim = ",";
+	char *trimmed_tok;
+
+	tok = strtok_r( hosts, delim, &saveptr);
+	while( tok) {
+		trimmed_tok = malloc( sizeof( char) * ( strlen( tok) + 1));
+		trim( tok, trimmed_tok);
+		if( strlen( trimmed_tok) > 0) {
+			if (!add_ipv4_to_acl(trimmed_tok) && !add_domain_to_acl(trimmed_tok)) {
+				syslog(LOG_ERR,"Can't add to ACL this record (%s). Check allowed_hosts option!\n",trimmed_tok);
+			}
+		}
+		free( trimmed_tok);
+		tok = strtok_r(( char *)0, delim, &saveptr);
+	}
+
+	free( hosts);
+}
+
+/*
+ * Converts mask in unsigned long format to two digit prefix
+ */
+
+unsigned int prefix_from_mask(struct in_addr mask) {
+        int prefix = 0;
+        unsigned long bit = 1;
+        int i;
+
+        for (i = 0; i < 32; i++) {
+                if (mask.s_addr & bit)
+                        prefix++;
+
+                bit = bit << 1;
+        }
+        return (prefix);
+}
+
+/*
+ * It shows all hosts in ACL lists
+ */
+
+void show_acl_lists(void) {
+        struct ip_acl *ip_acl_curr = ip_acl_head;
+        struct dns_acl *dns_acl_curr = dns_acl_head;
+
+        while (ip_acl_curr != NULL) {
+                printf(" IP ACL: %s/%u %u\n", inet_ntoa(ip_acl_curr->addr), prefix_from_mask(ip_acl_curr->mask), ip_acl_curr->addr.s_addr);
+                ip_acl_curr = ip_acl_curr->next;
+        }
+
+        while (dns_acl_curr != NULL) {
+                printf("DNS ACL: %s\n", dns_acl_curr->domain);
+                dns_acl_curr = dns_acl_curr->next;
+        }
+}

=== modified file 'src/check_nrpe.c' (properties changed: -x to +x)
--- src/check_nrpe.c	2008-08-06 20:33:57 +0000
+++ src/check_nrpe.c	2013-02-02 23:23:20 +0000
@@ -1,462 +1,462 @@
-/********************************************************************************************
- *
- * CHECK_NRPE.C - NRPE Plugin For Nagios
- * Copyright (c) 1999-2008 Ethan Galstad ([e-mail])
- * License: GPL
- *
- * Last Modified: 03-10-2008
- *
- * Command line: CHECK_NRPE -H <host_address> [-p port] [-c command] [-to to_sec]
- *
- * Description:
- *
- * This plugin will attempt to connect to the NRPE daemon on the specified server and port.
- * The daemon will attempt to run the command defined as [command].  Program output and
- * return code are sent back from the daemon and displayed as this plugin's own output and
- * return code.
- *
- ********************************************************************************************/
-
-#include "../include/common.h"
-#include "../include/config.h"
-#include "../include/utils.h"
-
-
-#define DEFAULT_NRPE_COMMAND	"_NRPE_CHECK"  /* check version of NRPE daemon */
-
-int server_port=DEFAULT_SERVER_PORT;
-char *server_name=NULL;
-char *command_name=NULL;
-int socket_timeout=DEFAULT_SOCKET_TIMEOUT;
-int timeout_return_code=STATE_CRITICAL;
-int sd;
-
-char query[MAX_INPUT_BUFFER]="";
-
-int show_help=FALSE;
-int show_license=FALSE;
-int show_version=FALSE;
-
-#ifdef HAVE_SSL
-SSL_METHOD *meth;
-SSL_CTX *ctx;
-SSL *ssl;
-int use_ssl=TRUE;
-#else
-int use_ssl=FALSE;
-#endif
-
-
-int process_arguments(int,char **);
-void alarm_handler(int);
-int graceful_close(int,int);
-
-
-
-
-int main(int argc, char **argv){
-        u_int32_t packet_crc32;
-        u_int32_t calculated_crc32;
-	int16_t result;
-	int rc;
-	packet send_packet;
-	packet receive_packet;
-	int bytes_to_send;
-	int bytes_to_recv;
-
-	result=process_arguments(argc,argv);
-
-        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE){
-
-		if(result!=OK)
-			printf("Incorrect command line arguments supplied\n");
-                printf("\n");
-		printf("NRPE Plugin for Nagios\n");
-		printf("Copyright (c) 1999-2008 Ethan Galstad ([e-mail])\n");
-		printf("Version: %s\n",PROGRAM_VERSION);
-		printf("Last Modified: %s\n",MODIFICATION_DATE);
-		printf("License: GPL v2 with exemptions (-l for more info)\n");
-#ifdef HAVE_SSL
-		printf("SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required\n");
-#endif
-		printf("\n");
-	        }
-
-	if(result!=OK || show_help==TRUE){
-
-		printf("Usage: check_nrpe -H <host> [-n] [-u] [-p <port>] [-t <timeout>] [-c <command>] [-a <arglist...>]\n");
-		printf("\n");
-		printf("Options:\n");
-		printf(" -n         = Do no use SSL\n");
-		printf(" -u         = Make socket timeouts return an UNKNOWN state instead of CRITICAL\n");
-		printf(" <host>     = The address of the host running the NRPE daemon\n");
-		printf(" [port]     = The port on which the daemon is running (default=%d)\n",DEFAULT_SERVER_PORT);
-		printf(" [timeout]  = Number of seconds before connection times out (default=%d)\n",DEFAULT_SOCKET_TIMEOUT);
-		printf(" [command]  = The name of the command that the remote daemon should run\n");
-		printf(" [arglist]  = Optional arguments that should be passed to the command.  Multiple\n");
-		printf("              arguments should be separated by a space.  If provided, this must be\n");
-		printf("              the last option supplied on the command line.\n");
-		printf("\n");
-		printf("Note:\n");
-		printf("This plugin requires that you have the NRPE daemon running on the remote host.\n");
-		printf("You must also have configured the daemon to associate a specific plugin command\n");
-		printf("with the [command] option you are specifying here.  Upon receipt of the\n");
-		printf("[command] argument, the NRPE daemon will run the appropriate plugin command and\n");
-		printf("send the plugin output and return code back to *this* plugin.  This allows you\n");
-		printf("to execute plugins on remote hosts and 'fake' the results to make Nagios think\n");
-		printf("the plugin is being run locally.\n");
-		printf("\n");
-	        }
-
-	if(show_license==TRUE)
-		display_license();
-
-        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE)
-		exit(STATE_UNKNOWN);
-
-
-        /* generate the CRC 32 table */
-        generate_crc32_table();
-
-#ifdef HAVE_SSL
-	/* initialize SSL */
-	if(use_ssl==TRUE){
-		SSL_library_init();
-		SSLeay_add_ssl_algorithms();
-		meth=SSLv23_client_method();
-		SSL_load_error_strings();
-		if((ctx=SSL_CTX_new(meth))==NULL){
-			printf("CHECK_NRPE: Error - could not create SSL context.\n");
-			exit(STATE_CRITICAL);
-		        }
-
-		/* ADDED 01/19/2004 */
-		/* use only TLSv1 protocol */
-		SSL_CTX_set_options(ctx,SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
-                }
-#endif
-
-	/* initialize alarm signal handling */
-	signal(SIGALRM,alarm_handler);
-
-	/* set socket timeout */
-	alarm(socket_timeout);
-
-	/* try to connect to the host at the given port number */
-	result=my_tcp_connect(server_name,server_port,&sd);
-
-#ifdef HAVE_SSL
-	/* do SSL handshake */
-	if(result==STATE_OK && use_ssl==TRUE){
-		if((ssl=SSL_new(ctx))!=NULL){
-			SSL_CTX_set_cipher_list(ctx,"ADH");
-			SSL_set_fd(ssl,sd);
-			if((rc=SSL_connect(ssl))!=1){
-				printf("CHECK_NRPE: Error - Could not complete SSL handshake.\n");
-#ifdef DEBUG
-				printf("SSL_connect=%d\n",rc);
-				/*
-				rc=SSL_get_error(ssl,rc);
-				printf("SSL_get_error=%d\n",rc);
-				printf("ERR_get_error=%lu\n",ERR_get_error());
-				printf("%s\n",ERR_error_string(rc,NULL));
-				*/
-				ERR_print_errors_fp(stdout);
-#endif
-				result=STATE_CRITICAL;
-			        }
-		        }
-		else{
-			printf("CHECK_NRPE: Error - Could not create SSL connection structure.\n");
-			result=STATE_CRITICAL;
-		        }
-
-		/* bail if we had errors */
-		if(result!=STATE_OK){
-			SSL_CTX_free(ctx);
-			close(sd);
-			exit(result);
-		        }
-	        }
-#endif
-
-	/* we're connected and ready to go */
-	if(result==STATE_OK){
-
-		/* clear the packet buffer */
-		bzero(&send_packet,sizeof(send_packet));
-
-		/* fill the packet with semi-random data */
-		randomize_buffer((char *)&send_packet,sizeof(send_packet));
-
-		/* initialize packet data */
-		send_packet.packet_version=(int16_t)htons(NRPE_PACKET_VERSION_2);
-		send_packet.packet_type=(int16_t)htons(QUERY_PACKET);
-		strncpy(&send_packet.buffer[0],query,MAX_PACKETBUFFER_LENGTH);
-		send_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
-
-		/* calculate the crc 32 value of the packet */
-		send_packet.crc32_value=(u_int32_t)0L;
-		calculated_crc32=calculate_crc32((char *)&send_packet,sizeof(send_packet));
-		send_packet.crc32_value=(u_int32_t)htonl(calculated_crc32);
-
-
-		/***** ENCRYPT REQUEST *****/
-
-
-		/* send the packet */
-		bytes_to_send=sizeof(send_packet);
-		if(use_ssl==FALSE)
-			rc=sendall(sd,(char *)&send_packet,&bytes_to_send);
-#ifdef HAVE_SSL
-		else{
-			rc=SSL_write(ssl,&send_packet,bytes_to_send);
-			if(rc<0)
-				rc=-1;
-		        }
-#endif
-		if(rc==-1){
-			printf("CHECK_NRPE: Error sending query to host.\n");
-			close(sd);
-			return STATE_UNKNOWN;
-		        }
-
-		/* wait for the response packet */
-		bytes_to_recv=sizeof(receive_packet);
-		if(use_ssl==FALSE)
-			rc=recvall(sd,(char *)&receive_packet,&bytes_to_recv,socket_timeout);
-#ifdef HAVE_SSL
-		else
-			rc=SSL_read(ssl,&receive_packet,bytes_to_recv);
-#endif
-
-		/* reset timeout */
-		alarm(0);
-
-		/* close the connection */
-#ifdef HAVE_SSL
-		if(use_ssl==TRUE){
-			SSL_shutdown(ssl);
-			SSL_free(ssl);
-			SSL_CTX_free(ctx);
-	                }
-#endif
-		graceful_close(sd,1000);
-
-		/* recv() error */
-		if(rc<0){
-			printf("CHECK_NRPE: Error receiving data from daemon.\n");
-			return STATE_UNKNOWN;
-		        }
-
-		/* server disconnected */
-		else if(rc==0){
-			printf("CHECK_NRPE: Received 0 bytes from daemon.  Check the remote server logs for error messages.\n");
-			return STATE_UNKNOWN;
-		        }
-
-		/* receive underflow */
-		else if(bytes_to_recv<sizeof(receive_packet)){
-			printf("CHECK_NRPE: Receive underflow - only %d bytes received (%d expected).\n",bytes_to_recv,sizeof(receive_packet));
-			return STATE_UNKNOWN;
-		        }
-
-		
-		/***** DECRYPT RESPONSE *****/
-
-
-		/* check the crc 32 value */
-		packet_crc32=ntohl(receive_packet.crc32_value);
-		receive_packet.crc32_value=0L;
-		calculated_crc32=calculate_crc32((char *)&receive_packet,sizeof(receive_packet));
-		if(packet_crc32!=calculated_crc32){
-			printf("CHECK_NRPE: Response packet had invalid CRC32.\n");
-			close(sd);
-			return STATE_UNKNOWN;
-                        }
-	
-		/* check packet version */
-		if(ntohs(receive_packet.packet_version)!=NRPE_PACKET_VERSION_2){
-			printf("CHECK_NRPE: Invalid packet version received from server.\n");
-			close(sd);
-			return STATE_UNKNOWN;
-			}
-
-		/* check packet type */
-		if(ntohs(receive_packet.packet_type)!=RESPONSE_PACKET){
-			printf("CHECK_NRPE: Invalid packet type received from server.\n");
-			close(sd);
-			return STATE_UNKNOWN;
-			}
-
-		/* get the return code from the remote plugin */
-		result=(int16_t)ntohs(receive_packet.result_code);
-
-		/* print the output returned by the daemon */
-		receive_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
-		if(!strcmp(receive_packet.buffer,""))
-			printf("CHECK_NRPE: No output returned from daemon.\n");
-		else
-			printf("%s\n",receive_packet.buffer);
-	        }
-
-	/* reset the alarm */
-	else
-		alarm(0);
-
-	return result;
-        }
-
-
-
-/* process command line arguments */
-int process_arguments(int argc, char **argv){
-	char optchars[MAX_INPUT_BUFFER];
-	int argindex=0;
-	int c=1;
-	int i=1;
-
-#ifdef HAVE_GETOPT_LONG
-	int option_index=0;
-	static struct option long_options[]={
-		{"host", required_argument, 0, 'H'},
-		{"command", required_argument, 0, 'c'},
-		{"args", required_argument, 0, 'a'},
-		{"no-ssl", no_argument, 0, 'n'},
-		{"unknown-timeout", no_argument, 0, 'u'},
-		{"timeout", required_argument, 0, 't'},
-		{"port", required_argument, 0, 'p'},
-		{"help", no_argument, 0, 'h'},
-		{"license", no_argument, 0, 'l'},
-		{0, 0, 0, 0}
-                };
-#endif
-
-	/* no options were supplied */
-	if(argc<2)
-		return ERROR;
-
-	snprintf(optchars,MAX_INPUT_BUFFER,"H:c:a:t:p:nuhl");
-
-	while(1){
-#ifdef HAVE_GETOPT_LONG
-		c=getopt_long(argc,argv,optchars,long_options,&option_index);
-#else
-		c=getopt(argc,argv,optchars);
-#endif
-		if(c==-1 || c==EOF)
-			break;
-
-		/* process all arguments */
-		switch(c){
-
-		case '?':
-		case 'h':
-			show_help=TRUE;
-			break;
-		case 'V':
-			show_version=TRUE;
-			break;
-		case 'l':
-			show_license=TRUE;
-			break;
-		case 't':
-			socket_timeout=atoi(optarg);
-			if(socket_timeout<=0)
-				return ERROR;
-			break;
-		case 'p':
-			server_port=atoi(optarg);
-			if(server_port<=0)
-				return ERROR;
-			break;
-		case 'H':
-			server_name=strdup(optarg);
-			break;
-		case 'c':
-			command_name=strdup(optarg);
-			break;
-		case 'a':
-			argindex=optind;
-			break;
-		case 'n':
-			use_ssl=FALSE;
-			break;
-		case 'u':
-			timeout_return_code=STATE_UNKNOWN;
-			break;
-		default:
-			return ERROR;
-			break;
-		        }
-	        }
-
-	/* determine (base) command query */
-	snprintf(query,sizeof(query),"%s",(command_name==NULL)?DEFAULT_NRPE_COMMAND:command_name);
-	query[sizeof(query)-1]='\x0';
-
-	/* get the command args */
-	if(argindex>0){
-
-		for(c=argindex-1;c<argc;c++){
-
-			i=sizeof(query)-strlen(query)-2;
-			if(i<=0)
-				break;
-
-			strcat(query,"!");
-			strncat(query,argv[c],i);
-			query[sizeof(query)-1]='\x0';
-		        }
-	        }
-
-	/* make sure required args were supplied */
-	if(server_name==NULL && show_help==FALSE && show_version==FALSE  && show_license==FALSE)
-		return ERROR;
-
-
-	return OK;
-        }
-
-
-
-void alarm_handler(int sig){
-
-	printf("CHECK_NRPE: Socket timeout after %d seconds.\n",socket_timeout);
-
-	exit(timeout_return_code);
-        }
-
-
-/* submitted by Mark Plaksin 08/31/2006 */
-int graceful_close(int sd, int timeout){
-        fd_set in;
-        struct timeval tv;
-        char buf[1000];
-
-	/* send FIN packet */
-        shutdown(sd,SHUT_WR);  
-        for(;;){
-
-                FD_ZERO(&in);
-                FD_SET(sd,&in);
-                tv.tv_sec=timeout/1000;
-                tv.tv_usec=(timeout % 1000)*1000;
-
-		/* timeout or error */
-                if(1!=select(sd+1,&in,NULL,NULL,&tv))
-			break;   
-
-		/* no more data (FIN or RST) */
-                if(0>=recv(sd,buf,sizeof(buf),0))
-			break;
-		}
-
-#ifdef HAVE_CLOSESOCKET
-        closesocket(sd);
-#else
-	close(sd);
-#endif
-
-	return OK;
-	}
+/********************************************************************************************
+ *
+ * CHECK_NRPE.C - NRPE Plugin For Nagios
+ * Copyright (c) 1999-2008 Ethan Galstad ([e-mail])
+ * License: GPL
+ *
+ * Last Modified: 11-11-2011
+ *
+ * Command line: CHECK_NRPE -H <host_address> [-p port] [-c command] [-to to_sec]
+ *
+ * Description:
+ *
+ * This plugin will attempt to connect to the NRPE daemon on the specified server and port.
+ * The daemon will attempt to run the command defined as [command].  Program output and
+ * return code are sent back from the daemon and displayed as this plugin's own output and
+ * return code.
+ *
+ ********************************************************************************************/
+
+#include "../include/common.h"
+#include "../include/config.h"
+#include "../include/utils.h"
+
+
+#define DEFAULT_NRPE_COMMAND	"_NRPE_CHECK"  /* check version of NRPE daemon */
+
+int server_port=DEFAULT_SERVER_PORT;
+char *server_name=NULL;
+char *command_name=NULL;
+int socket_timeout=DEFAULT_SOCKET_TIMEOUT;
+int timeout_return_code=STATE_CRITICAL;
+int sd;
+
+char query[MAX_INPUT_BUFFER]="";
+
+int show_help=FALSE;
+int show_license=FALSE;
+int show_version=FALSE;
+
+#ifdef HAVE_SSL
+SSL_METHOD *meth;
+SSL_CTX *ctx;
+SSL *ssl;
+int use_ssl=TRUE;
+#else
+int use_ssl=FALSE;
+#endif
+
+
+int process_arguments(int,char **);
+void alarm_handler(int);
+int graceful_close(int,int);
+
+
+
+
+int main(int argc, char **argv){
+        u_int32_t packet_crc32;
+        u_int32_t calculated_crc32;
+	int16_t result;
+	int rc;
+	packet send_packet;
+	packet receive_packet;
+	int bytes_to_send;
+	int bytes_to_recv;
+
+	result=process_arguments(argc,argv);
+
+        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE){
+
+		if(result!=OK)
+			printf("Incorrect command line arguments supplied\n");
+                printf("\n");
+		printf("NRPE Plugin for Nagios\n");
+		printf("Copyright (c) 1999-2008 Ethan Galstad ([e-mail])\n");
+		printf("Version: %s\n",PROGRAM_VERSION);
+		printf("Last Modified: %s\n",MODIFICATION_DATE);
+		printf("License: GPL v2 with exemptions (-l for more info)\n");
+#ifdef HAVE_SSL
+		printf("SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required\n");
+#endif
+		printf("\n");
+	        }
+
+	if(result!=OK || show_help==TRUE){
+
+		printf("Usage: check_nrpe -H <host> [-n] [-u] [-p <port>] [-t <timeout>] [-c <command>] [-a <arglist...>]\n");
+		printf("\n");
+		printf("Options:\n");
+		printf(" -n         = Do no use SSL\n");
+		printf(" -u         = Make socket timeouts return an UNKNOWN state instead of CRITICAL\n");
+		printf(" <host>     = The address of the host running the NRPE daemon\n");
+		printf(" [port]     = The port on which the daemon is running (default=%d)\n",DEFAULT_SERVER_PORT);
+		printf(" [timeout]  = Number of seconds before connection times out (default=%d)\n",DEFAULT_SOCKET_TIMEOUT);
+		printf(" [command]  = The name of the command that the remote daemon should run\n");
+		printf(" [arglist]  = Optional arguments that should be passed to the command.  Multiple\n");
+		printf("              arguments should be separated by a space.  If provided, this must be\n");
+		printf("              the last option supplied on the command line.\n");
+		printf("\n");
+		printf("Note:\n");
+		printf("This plugin requires that you have the NRPE daemon running on the remote host.\n");
+		printf("You must also have configured the daemon to associate a specific plugin command\n");
+		printf("with the [command] option you are specifying here.  Upon receipt of the\n");
+		printf("[command] argument, the NRPE daemon will run the appropriate plugin command and\n");
+		printf("send the plugin output and return code back to *this* plugin.  This allows you\n");
+		printf("to execute plugins on remote hosts and 'fake' the results to make Nagios think\n");
+		printf("the plugin is being run locally.\n");
+		printf("\n");
+	        }
+
+	if(show_license==TRUE)
+		display_license();
+
+        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE)
+		exit(STATE_UNKNOWN);
+
+
+        /* generate the CRC 32 table */
+        generate_crc32_table();
+
+#ifdef HAVE_SSL
+	/* initialize SSL */
+	if(use_ssl==TRUE){
+		SSL_library_init();
+		SSLeay_add_ssl_algorithms();
+		meth=SSLv23_client_method();
+		SSL_load_error_strings();
+		if((ctx=SSL_CTX_new(meth))==NULL){
+			printf("CHECK_NRPE: Error - could not create SSL context.\n");
+			exit(STATE_CRITICAL);
+		        }
+
+		/* ADDED 01/19/2004 */
+		/* use only TLSv1 protocol */
+		SSL_CTX_set_options(ctx,SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+                }
+#endif
+
+	/* initialize alarm signal handling */
+	signal(SIGALRM,alarm_handler);
+
+	/* set socket timeout */
+	alarm(socket_timeout);
+
+	/* try to connect to the host at the given port number */
+	result=my_tcp_connect(server_name,server_port,&sd);
+
+#ifdef HAVE_SSL
+	/* do SSL handshake */
+	if(result==STATE_OK && use_ssl==TRUE){
+		if((ssl=SSL_new(ctx))!=NULL){
+			SSL_CTX_set_cipher_list(ctx,"ADH");
+			SSL_set_fd(ssl,sd);
+			if((rc=SSL_connect(ssl))!=1){
+				printf("CHECK_NRPE: Error - Could not complete SSL handshake.\n");
+#ifdef DEBUG
+				printf("SSL_connect=%d\n",rc);
+				/*
+				rc=SSL_get_error(ssl,rc);
+				printf("SSL_get_error=%d\n",rc);
+				printf("ERR_get_error=%lu\n",ERR_get_error());
+				printf("%s\n",ERR_error_string(rc,NULL));
+				*/
+				ERR_print_errors_fp(stdout);
+#endif
+				result=STATE_CRITICAL;
+			        }
+		        }
+		else{
+			printf("CHECK_NRPE: Error - Could not create SSL connection structure.\n");
+			result=STATE_CRITICAL;
+		        }
+
+		/* bail if we had errors */
+		if(result!=STATE_OK){
+			SSL_CTX_free(ctx);
+			close(sd);
+			exit(result);
+		        }
+	        }
+#endif
+
+	/* we're connected and ready to go */
+	if(result==STATE_OK){
+
+		/* clear the packet buffer */
+		bzero(&send_packet,sizeof(send_packet));
+
+		/* fill the packet with semi-random data */
+		randomize_buffer((char *)&send_packet,sizeof(send_packet));
+
+		/* initialize packet data */
+		send_packet.packet_version=(int16_t)htons(NRPE_PACKET_VERSION_2);
+		send_packet.packet_type=(int16_t)htons(QUERY_PACKET);
+		strncpy(&send_packet.buffer[0],query,MAX_PACKETBUFFER_LENGTH);
+		send_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
+
+		/* calculate the crc 32 value of the packet */
+		send_packet.crc32_value=(u_int32_t)0L;
+		calculated_crc32=calculate_crc32((char *)&send_packet,sizeof(send_packet));
+		send_packet.crc32_value=(u_int32_t)htonl(calculated_crc32);
+
+
+		/***** ENCRYPT REQUEST *****/
+
+
+		/* send the packet */
+		bytes_to_send=sizeof(send_packet);
+		if(use_ssl==FALSE)
+			rc=sendall(sd,(char *)&send_packet,&bytes_to_send);
+#ifdef HAVE_SSL
+		else{
+			rc=SSL_write(ssl,&send_packet,bytes_to_send);
+			if(rc<0)
+				rc=-1;
+		        }
+#endif
+		if(rc==-1){
+			printf("CHECK_NRPE: Error sending query to host.\n");
+			close(sd);
+			return STATE_UNKNOWN;
+		        }
+
+		/* wait for the response packet */
+		bytes_to_recv=sizeof(receive_packet);
+		if(use_ssl==FALSE)
+			rc=recvall(sd,(char *)&receive_packet,&bytes_to_recv,socket_timeout);
+#ifdef HAVE_SSL
+		else
+			rc=SSL_read(ssl,&receive_packet,bytes_to_recv);
+#endif
+
+		/* reset timeout */
+		alarm(0);
+
+		/* close the connection */
+#ifdef HAVE_SSL
+		if(use_ssl==TRUE){
+			SSL_shutdown(ssl);
+			SSL_free(ssl);
+			SSL_CTX_free(ctx);
+	                }
+#endif
+		graceful_close(sd,1000);
+
+		/* recv() error */
+		if(rc<0){
+			printf("CHECK_NRPE: Error receiving data from daemon.\n");
+			return STATE_UNKNOWN;
+		        }
+
+		/* server disconnected */
+		else if(rc==0){
+			printf("CHECK_NRPE: Received 0 bytes from daemon.  Check the remote server logs for error messages.\n");
+			return STATE_UNKNOWN;
+		        }
+
+		/* receive underflow */
+		else if(bytes_to_recv<sizeof(receive_packet)){
+			printf("CHECK_NRPE: Receive underflow - only %d bytes received (%d expected).\n",bytes_to_recv,sizeof(receive_packet));
+			return STATE_UNKNOWN;
+		        }
+
+		
+		/***** DECRYPT RESPONSE *****/
+
+
+		/* check the crc 32 value */
+		packet_crc32=ntohl(receive_packet.crc32_value);
+		receive_packet.crc32_value=0L;
+		calculated_crc32=calculate_crc32((char *)&receive_packet,sizeof(receive_packet));
+		if(packet_crc32!=calculated_crc32){
+			printf("CHECK_NRPE: Response packet had invalid CRC32.\n");
+			close(sd);
+			return STATE_UNKNOWN;
+                        }
+	
+		/* check packet version */
+		if(ntohs(receive_packet.packet_version)!=NRPE_PACKET_VERSION_2){
+			printf("CHECK_NRPE: Invalid packet version received from server.\n");
+			close(sd);
+			return STATE_UNKNOWN;
+			}
+
+		/* check packet type */
+		if(ntohs(receive_packet.packet_type)!=RESPONSE_PACKET){
+			printf("CHECK_NRPE: Invalid packet type received from server.\n");
+			close(sd);
+			return STATE_UNKNOWN;
+			}
+
+		/* get the return code from the remote plugin */
+		result=(int16_t)ntohs(receive_packet.result_code);
+
+		/* print the output returned by the daemon */
+		receive_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
+		if(!strcmp(receive_packet.buffer,""))
+			printf("CHECK_NRPE: No output returned from daemon.\n");
+		else
+			printf("%s\n",receive_packet.buffer);
+	        }
+
+	/* reset the alarm */
+	else
+		alarm(0);
+
+	return result;
+        }
+
+
+
+/* process command line arguments */
+int process_arguments(int argc, char **argv){
+	char optchars[MAX_INPUT_BUFFER];
+	int argindex=0;
+	int c=1;
+	int i=1;
+
+#ifdef HAVE_GETOPT_LONG
+	int option_index=0;
+	static struct option long_options[]={
+		{"host", required_argument, 0, 'H'},
+		{"command", required_argument, 0, 'c'},
+		{"args", required_argument, 0, 'a'},
+		{"no-ssl", no_argument, 0, 'n'},
+		{"unknown-timeout", no_argument, 0, 'u'},
+		{"timeout", required_argument, 0, 't'},
+		{"port", required_argument, 0, 'p'},
+		{"help", no_argument, 0, 'h'},
+		{"license", no_argument, 0, 'l'},
+		{0, 0, 0, 0}
+                };
+#endif
+
+	/* no options were supplied */
+	if(argc<2)
+		return ERROR;
+
+	snprintf(optchars,MAX_INPUT_BUFFER,"H:c:a:t:p:nuhl");
+
+	while(1){
+#ifdef HAVE_GETOPT_LONG
+		c=getopt_long(argc,argv,optchars,long_options,&option_index);
+#else
+		c=getopt(argc,argv,optchars);
+#endif
+		if(c==-1 || c==EOF)
+			break;
+
+		/* process all arguments */
+		switch(c){
+
+		case '?':
+		case 'h':
+			show_help=TRUE;
+			break;
+		case 'V':
+			show_version=TRUE;
+			break;
+		case 'l':
+			show_license=TRUE;
+			break;
+		case 't':
+			socket_timeout=atoi(optarg);
+			if(socket_timeout<=0)
+				return ERROR;
+			break;
+		case 'p':
+			server_port=atoi(optarg);
+			if(server_port<=0)
+				return ERROR;
+			break;
+		case 'H':
+			server_name=strdup(optarg);
+			break;
+		case 'c':
+			command_name=strdup(optarg);
+			break;
+		case 'a':
+			argindex=optind;
+			break;
+		case 'n':
+			use_ssl=FALSE;
+			break;
+		case 'u':
+			timeout_return_code=STATE_UNKNOWN;
+			break;
+		default:
+			return ERROR;
+			break;
+		        }
+	        }
+
+	/* determine (base) command query */
+	snprintf(query,sizeof(query),"%s",(command_name==NULL)?DEFAULT_NRPE_COMMAND:command_name);
+	query[sizeof(query)-1]='\x0';
+
+	/* get the command args */
+	if(argindex>0){
+
+		for(c=argindex-1;c<argc;c++){
+
+			i=sizeof(query)-strlen(query)-2;
+			if(i<=0)
+				break;
+
+			strcat(query,"!");
+			strncat(query,argv[c],i);
+			query[sizeof(query)-1]='\x0';
+		        }
+	        }
+
+	/* make sure required args were supplied */
+	if(server_name==NULL && show_help==FALSE && show_version==FALSE  && show_license==FALSE)
+		return ERROR;
+
+
+	return OK;
+        }
+
+
+
+void alarm_handler(int sig){
+
+	printf("CHECK_NRPE: Socket timeout after %d seconds.\n",socket_timeout);
+
+	exit(timeout_return_code);
+        }
+
+
+/* submitted by Mark Plaksin 08/31/2006 */
+int graceful_close(int sd, int timeout){
+        fd_set in;
+        struct timeval tv;
+        char buf[1000];
+
+	/* send FIN packet */
+        shutdown(sd,SHUT_WR);  
+        for(;;){
+
+                FD_ZERO(&in);
+                FD_SET(sd,&in);
+                tv.tv_sec=timeout/1000;
+                tv.tv_usec=(timeout % 1000)*1000;
+
+		/* timeout or error */
+                if(1!=select(sd+1,&in,NULL,NULL,&tv))
+			break;   
+
+		/* no more data (FIN or RST) */
+                if(0>=recv(sd,buf,sizeof(buf),0))
+			break;
+		}
+
+#ifdef HAVE_CLOSESOCKET
+        closesocket(sd);
+#else
+	close(sd);
+#endif
+
+	return OK;
+	}

=== modified file 'src/nrpe.c' (properties changed: -x to +x)
--- src/nrpe.c	2008-08-06 20:33:57 +0000
+++ src/nrpe.c	2013-02-02 23:23:20 +0000
@@ -1,1968 +1,1912 @@
-/*******************************************************************************
- *
- * NRPE.C - Nagios Remote Plugin Executor
- * Copyright (c) 1999-2008 Ethan Galstad ([e-mail])
- * License: GPL
- *
- * Last Modified: 03-10-2008
- *
- * Command line: nrpe -c <config_file> [--inetd | --daemon]
- *
- * Description:
- *
- * This program is designed to run as a background process and
- * handle incoming requests (from the host running Nagios) for
- * plugin execution.  It is useful for running "local" plugins
- * such as check_users, check_load, check_disk, etc. without
- * having to use rsh or ssh.
- * 
- ******************************************************************************/
-
-#include "../include/common.h"
-#include "../include/config.h"
-#include "../include/nrpe.h"
-#include "../include/utils.h"
-
-#ifdef HAVE_SSL
-#include "../include/dh.h"
-#endif
-
-#ifdef HAVE_LIBWRAP
-int allow_severity=LOG_INFO;
-int deny_severity=LOG_WARNING;
-#endif
-
-#ifdef HAVE_SSL
-SSL_METHOD *meth;
-SSL_CTX *ctx;
-int use_ssl=TRUE;
-#else
-int use_ssl=FALSE;
-#endif
-
-#define DEFAULT_COMMAND_TIMEOUT	60			/* default timeout for execution of plugins */
-#define MAXFD                   64
-#define NASTY_METACHARS         "|`&><'\"\\[]{};"
-
-char    *command_name=NULL;
-char    *macro_argv[MAX_COMMAND_ARGUMENTS];
-
-char    config_file[MAX_INPUT_BUFFER]="nrpe.cfg";
-int     log_facility=LOG_DAEMON;
-int     server_port=DEFAULT_SERVER_PORT;
-char    server_address[16]="0.0.0.0";
-int     socket_timeout=DEFAULT_SOCKET_TIMEOUT;
-int     command_timeout=DEFAULT_COMMAND_TIMEOUT;
-int     connection_timeout=DEFAULT_CONNECTION_TIMEOUT;
-char    *command_prefix=NULL;
-
-command *command_list=NULL;
-
-char    *nrpe_user=NULL;
-char    *nrpe_group=NULL;
-
-char    *allowed_hosts=NULL;
-
-char    *pid_file=NULL;
-int     wrote_pid_file=FALSE;
-
-int     allow_arguments=FALSE;
-
-int     allow_weak_random_seed=FALSE;
-
-int     sigrestart=FALSE;
-int     sigshutdown=FALSE;
-
-int     show_help=FALSE;
-int     show_license=FALSE;
-int     show_version=FALSE;
-int     use_inetd=TRUE;
-int     debug=FALSE;
-
-
-
-
-int main(int argc, char **argv){
-	int result=OK;
-	int x;
-	char buffer[MAX_INPUT_BUFFER];
-	char *env_string=NULL;
-#ifdef HAVE_SSL
-	DH *dh;
-	char seedfile[FILENAME_MAX];
-	int i,c;
-#endif
-
-	/* set some environment variables */
-	asprintf(&env_string,"NRPE_MULTILINESUPPORT=1");
-	putenv(env_string);
-	asprintf(&env_string,"NRPE_PROGRAMVERSION=%s",PROGRAM_VERSION);
-	putenv(env_string);
-
-	/* process command-line args */
-	result=process_arguments(argc,argv);
-
-        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE){
-
-		printf("\n");
-		printf("NRPE - Nagios Remote Plugin Executor\n");
-		printf("Copyright (c) 1999-2008 Ethan Galstad ([e-mail])\n");
-		printf("Version: %s\n",PROGRAM_VERSION);
-		printf("Last Modified: %s\n",MODIFICATION_DATE);
-		printf("License: GPL v2 with exemptions (-l for more info)\n");
-#ifdef HAVE_SSL
-		printf("SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required\n");
-#endif
-#ifdef HAVE_LIBWRAP
-		printf("TCP Wrappers Available\n");
-#endif
-		printf("\n");
-#ifdef ENABLE_COMMAND_ARGUMENTS
-		printf("***************************************************************\n");
-		printf("** POSSIBLE SECURITY RISK - COMMAND ARGUMENTS ARE SUPPORTED! **\n");
-		printf("**      Read the NRPE SECURITY file for more information     **\n");
-		printf("***************************************************************\n");
-		printf("\n");
-#endif
-#ifndef HAVE_LIBWRAP
-		printf("***************************************************************\n");
-		printf("** POSSIBLE SECURITY RISK - TCP WRAPPERS ARE NOT AVAILABLE!  **\n");
-		printf("**      Read the NRPE SECURITY file for more information     **\n");
-		printf("***************************************************************\n");
-		printf("\n");
-#endif
-	        }
-
-	if(show_license==TRUE)
-		display_license();
-
-	else if(result!=OK || show_help==TRUE){
-
-		printf("Usage: nrpe [-n] -c <config_file> <mode>\n");
-		printf("\n");
-		printf("Options:\n");
-		printf(" -n            = Do not use SSL\n");
-		printf(" <config_file> = Name of config file to use\n");
-		printf(" <mode>        = One of the following two operating modes:\n");  
-		printf("   -i          =    Run as a service under inetd or xinetd\n");
-		printf("   -d          =    Run as a standalone daemon\n");
-		printf("\n");
-		printf("Notes:\n");
-		printf("This program is designed to process requests from the check_nrpe\n");
-		printf("plugin on the host(s) running Nagios.  It can run as a service\n");
-		printf("under inetd or xinetd (read the docs for info on this), or as a\n");
-		printf("standalone daemon. Once a request is received from an authorized\n");
-		printf("host, NRPE will execute the command/plugin (as defined in the\n");
-		printf("config file) and return the plugin output and return code to the\n");
-		printf("check_nrpe plugin.\n");
-		printf("\n");
-		}
-
-        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE)
-		exit(STATE_UNKNOWN);
-
-
-	/* open a connection to the syslog facility */
-	/* facility name may be overridden later */
-	get_log_facility(NRPE_LOG_FACILITY);
-        openlog("nrpe",LOG_PID,log_facility); 
-
-	/* make sure the config file uses an absolute path */
-	if(config_file[0]!='/'){
-
-		/* save the name of the config file */
-		strncpy(buffer,config_file,sizeof(buffer));
-		buffer[sizeof(buffer)-1]='\x0';
-
-		/* get absolute path of current working directory */
-		strcpy(config_file,"");
-		getcwd(config_file,sizeof(config_file));
-
-		/* append a forward slash */
-		strncat(config_file,"/",sizeof(config_file)-2);
-		config_file[sizeof(config_file)-1]='\x0';
-
-		/* append the config file to the path */
-		strncat(config_file,buffer,sizeof(config_file)-strlen(config_file)-1);
-		config_file[sizeof(config_file)-1]='\x0';
-	        }
-
-	/* read the config file */
-	result=read_config_file(config_file);	
-
-	/* exit if there are errors... */
-	if(result==ERROR){
-		syslog(LOG_ERR,"Config file '%s' contained errors, aborting...",config_file);
-		return STATE_CRITICAL;
-		}
-
-        /* generate the CRC 32 table */
-        generate_crc32_table();
-
-	/* initialize macros */
-	for(x=0;x<MAX_COMMAND_ARGUMENTS;x++)
-		macro_argv[x]=NULL;
-
-#ifdef HAVE_SSL
-	/* initialize SSL */
-	if(use_ssl==TRUE){
-		SSL_library_init();
-		SSLeay_add_ssl_algorithms();
-		meth=SSLv23_server_method();
-		SSL_load_error_strings();
-
-		/* use week random seed if necessary */
-		if(allow_weak_random_seed && (RAND_status()==0)){
-
-			if(RAND_file_name(seedfile,sizeof(seedfile)-1))
-				if(RAND_load_file(seedfile,-1))
-					RAND_write_file(seedfile);
-
-			if(RAND_status()==0){
-				syslog(LOG_ERR,"Warning: SSL/TLS uses a weak random seed which is highly discouraged");
-				srand(time(NULL));
-				for(i=0;i<500 && RAND_status()==0;i++){
-					for(c=0;c<sizeof(seedfile);c+=sizeof(int)){
-						*((int *)(seedfile+c))=rand();
-					        }
-					RAND_seed(seedfile,sizeof(seedfile));
-					}
-				}
-			}
-
-		if((ctx=SSL_CTX_new(meth))==NULL){
-			syslog(LOG_ERR,"Error: could not create SSL context.\n");
-			exit(STATE_CRITICAL);
-		        }
-
-		/* ADDED 01/19/2004 */
-		/* use only TLSv1 protocol */
-		SSL_CTX_set_options(ctx,SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
-
-		/* use anonymous DH ciphers */
-		SSL_CTX_set_cipher_list(ctx,"ADH");
-		dh=get_dh512();
-		SSL_CTX_set_tmp_dh(ctx,dh);
-		DH_free(dh);
-		if(debug==TRUE)
-			syslog(LOG_INFO,"INFO: SSL/TLS initialized. All network traffic will be encrypted.");
-	        }
-	else{
-		if(debug==TRUE)
-			syslog(LOG_INFO,"INFO: SSL/TLS NOT initialized. Network encryption DISABLED.");
-	        }
-#endif
-
-	/* if we're running under inetd... */
-	if(use_inetd==TRUE){
-
-		/* make sure we're not root */
-		check_privileges();
-
-		/* redirect STDERR to /dev/null */
-		close(2);
-		open("/dev/null",O_WRONLY);
-
-		/* handle the connection */
-		handle_connection(0);
-	        }
-
-	/* else daemonize and start listening for requests... */
-	else if(fork()==0){
-		
-		/* we're a daemon - set up a new process group */
-		setsid();
-
-		/* close standard file descriptors */
-		close(0);
-		close(1);
-		close(2);
-
-		/* redirect standard descriptors to /dev/null */
-		open("/dev/null",O_RDONLY);
-		open("/dev/null",O_WRONLY);
-		open("/dev/null",O_WRONLY);
-
-		chdir("/");
-		/*umask(0);*/
-
-		/* handle signals */
-		signal(SIGQUIT,sighandler);
-		signal(SIGTERM,sighandler);
-		signal(SIGHUP,sighandler);
-
-		/* log info to syslog facility */
-		syslog(LOG_NOTICE,"Starting up daemon");
-
-		/* write pid file */
-		if(write_pid_file()==ERROR)
-			return STATE_CRITICAL;
-		
-		/* drop privileges */
-		drop_privileges(nrpe_user,nrpe_group);
-
-		/* make sure we're not root */
-		check_privileges();
-
-		do{
-
-			/* reset flags */
-			sigrestart=FALSE;
-			sigshutdown=FALSE;
-
-			/* wait for connections */
-			wait_for_connections();
-
-			/* free all memory we allocated */
-			free_memory();
-
-			if(sigrestart==TRUE){
-
-				/* read the config file */
-				result=read_config_file(config_file);	
-
-				/* exit if there are errors... */
-				if(result==ERROR){
-					syslog(LOG_ERR,"Config file '%s' contained errors, bailing out...",config_file);
-					return STATE_CRITICAL;
-				        }
-			        }
-	
-		        }while(sigrestart==TRUE && sigshutdown==FALSE);
-
-		/* remove pid file */
-		remove_pid_file();
-
-		syslog(LOG_NOTICE,"Daemon shutdown\n");
-	        }
-
-#ifdef HAVE_SSL
-	if(use_ssl==TRUE)
-		SSL_CTX_free(ctx);
-#endif
-
-	/* We are now running in daemon mode, or the connection handed over by inetd has
-	   been completed, so the parent process exits */
-        return STATE_OK;
-	}
-
-
-
-
-/* read in the configuration file */
-int read_config_file(char *filename){
-	FILE *fp;
-	char config_file[MAX_FILENAME_LENGTH];
-	char input_buffer[MAX_INPUT_BUFFER];
-	char *input_line;
-	char *temp_buffer;
-	char *varname;
-	char *varvalue;
-	int line=0;
-	int len=0;
-	int x=0;
-
-
-	/* open the config file for reading */
-	fp=fopen(filename,"r");
-
-	/* exit if we couldn't open the config file */
-	if(fp==NULL){
-		syslog(LOG_ERR,"Unable to open config file '%s' for reading\n",filename);
-		return ERROR;
-	        }
-
-	while(fgets(input_buffer,MAX_INPUT_BUFFER-1,fp)){
-
-		line++;
-		input_line=input_buffer;
-
-		/* skip leading whitespace */
-		while(isspace(*input_line))
-			++input_line;
-
-		/* trim trailing whitespace */
-		len=strlen(input_line);
-		for(x=len-1;x>=0;x--){
-			if(isspace(input_line[x]))
-				input_line[x]='\x0';
-			else
-				break;
-		        }
-
-		/* skip comments and blank lines */
-		if(input_line[0]=='#')
-			continue;
-		if(input_line[0]=='\x0')
-			continue;
-		if(input_line[0]=='\n')
-			continue;
-
-		/* get the variable name */
-		varname=strtok(input_line,"=");
-		if(varname==NULL){
-			syslog(LOG_ERR,"No variable name specified in config file '%s' - Line %d\n",filename,line);
-			return ERROR;
-		        }
-
-		/* get the variable value */
-		varvalue=strtok(NULL,"\n");
-		if(varvalue==NULL){
-			syslog(LOG_ERR,"No variable value specified in config file '%s' - Line %d\n",filename,line);
-			return ERROR;
-		        }
-
-		/* allow users to specify directories to recurse into for config files */
-		else if(!strcmp(varname,"include_dir")){
-
-			strncpy(config_file,varvalue,sizeof(config_file)-1);
-			config_file[sizeof(config_file)-1]='\x0';
-
-			/* strip trailing / if necessary */
-			if(config_file[strlen(config_file)-1]=='/')
-				config_file[strlen(config_file)-1]='\x0';
-
-			/* process the config directory... */
-			if(read_config_dir(config_file)==ERROR)
-				syslog(LOG_ERR,"Continuing with errors...");
-			}
-
-		/* allow users to specify individual config files to include */
-		else if(!strcmp(varname,"include") || !strcmp(varname,"include_file")){
-
-			/* process the config file... */
-			if(read_config_file(varvalue)==ERROR)
-				syslog(LOG_ERR,"Continuing with errors...");
-		        }
-
-		else if(!strcmp(varname,"server_port")){
-			server_port=atoi(varvalue);
-			if(server_port<1024){
-				syslog(LOG_ERR,"Invalid port number specified in config file '%s' - Line %d\n",filename,line);
-				return ERROR;
-			        }
-		        }
-		else if(!strcmp(varname,"command_prefix"))
-			command_prefix=strdup(varvalue);
-
-		else if(!strcmp(varname,"server_address")){
-                        strncpy(server_address,varvalue,sizeof(server_address) - 1);
-                        server_address[sizeof(server_address)-1]='\0';
-                        }
-
-                else if(!strcmp(varname,"allowed_hosts"))
-			allowed_hosts=strdup(varvalue);
-
-		else if(strstr(input_line,"command[")){
-			temp_buffer=strtok(varname,"[");
-			temp_buffer=strtok(NULL,"]");
-			if(temp_buffer==NULL){
-				syslog(LOG_ERR,"Invalid command specified in config file '%s' - Line %d\n",filename,line);
-				return ERROR;
-			        }
-			add_command(temp_buffer,varvalue);
-		        }
-
-		else if(strstr(input_buffer,"debug")){
-			debug=atoi(varvalue);
-			if(debug>0)
-				debug=TRUE;
-			else 
-				debug=FALSE;
-		        }
-
-                else if(!strcmp(varname,"nrpe_user"))
-			nrpe_user=strdup(varvalue);
-
-                else if(!strcmp(varname,"nrpe_group"))
-			nrpe_group=strdup(varvalue);
-		
-		else if(!strcmp(varname,"dont_blame_nrpe"))
-			allow_arguments=(atoi(varvalue)==1)?TRUE:FALSE;
-
- 		else if(!strcmp(varname,"command_timeout")){
-			command_timeout=atoi(varvalue);
-			if(command_timeout<1){
-				syslog(LOG_ERR,"Invalid command_timeout specified in config file '%s' - Line %d\n",filename,line);
-				return ERROR;
-			        }
-		        }
-
- 		else if(!strcmp(varname,"connection_timeout")){
-			connection_timeout=atoi(varvalue);
-			if(connection_timeout<1){
-				syslog(LOG_ERR,"Invalid connection_timeout specified in config file '%s' - Line %d\n",filename,line);
-				return ERROR;
-			        }
-		        }
-
-		else if(!strcmp(varname,"allow_weak_random_seed"))
-			allow_weak_random_seed=(atoi(varvalue)==1)?TRUE:FALSE;
-
-		else if(!strcmp(varname,"pid_file"))
-			pid_file=strdup(varvalue);
-
-		else if(!strcmp(varname,"log_facility")){
-			if((get_log_facility(varvalue))==OK){
-				/* re-open log using new facility */
-				closelog();
-				openlog("nrpe",LOG_PID,log_facility); 
-				}
-			else
-				syslog(LOG_WARNING,"Invalid log_facility specified in config file '%s' - Line %d\n",filename,line);
-			}
-
-		else{
-			syslog(LOG_WARNING,"Unknown option specified in config file '%s' - Line %d\n",filename,line);
-			continue;
-		        }
-
-	        }
-
-
-	/* close the config file */
-	fclose(fp);
-
-	return OK;
-	}
-
-
-/* process all config files in a specific config directory (with directory recursion) */
-int read_config_dir(char *dirname){
-	char config_file[MAX_FILENAME_LENGTH];
-	DIR *dirp;
-	struct dirent *dirfile;
-	struct stat buf;
-	int result=OK;
-	int x;
-
-	/* open the directory for reading */
-	dirp=opendir(dirname);
-        if(dirp==NULL){
-		syslog(LOG_ERR,"Could not open config directory '%s' for reading.\n",dirname);
-		return ERROR;
-	        }
-
-	/* process all files in the directory... */
-	while((dirfile=readdir(dirp))!=NULL){
-
-		/* create the full path to the config file or subdirectory */
-		snprintf(config_file,sizeof(config_file)-1,"%s/%s",dirname,dirfile->d_name);
-		config_file[sizeof(config_file)-1]='\x0';
-		stat(config_file, &buf);
-
-		/* process this if it's a config file... */
-		x=strlen(dirfile->d_name);
-		if(x>4 && !strcmp(dirfile->d_name+(x-4),".cfg")){
-
-			/* only process normal files */
-			if(!S_ISREG(buf.st_mode))
-				continue;
-
-			/* process the config file */
-			result=read_config_file(config_file);
-
-			/* break out if we encountered an error */
-			if(result==ERROR)
-				break;
-		        }
-
-		/* recurse into subdirectories... */
-		if(S_ISDIR(buf.st_mode)){
-
-			/* ignore current, parent and hidden directory entries */
-			if(dirfile->d_name[0]=='.')
-				continue;
-
-			/* process the config directory */
-			result=read_config_dir(config_file);
-
-			/* break out if we encountered an error */
-			if(result==ERROR)
-				break;
-		        }
-		}
-
-	closedir(dirp);
-
-	return result;
-        }
-
-
-
-/* determines facility to use with syslog */
-int get_log_facility(char *varvalue){
-
-	if(!strcmp(varvalue,"kern"))
-		log_facility=LOG_KERN;
-	else if(!strcmp(varvalue,"user"))
-		log_facility=LOG_USER;
-	else if(!strcmp(varvalue,"mail"))
-		log_facility=LOG_MAIL;
-	else if(!strcmp(varvalue,"daemon"))
-		log_facility=LOG_DAEMON;
-	else if(!strcmp(varvalue,"auth"))
-		log_facility=LOG_AUTH;
-	else if(!strcmp(varvalue,"syslog"))
-		log_facility=LOG_SYSLOG;
-	else if(!strcmp(varvalue,"lrp"))
-		log_facility=LOG_LPR;
-	else if(!strcmp(varvalue,"news"))
-		log_facility=LOG_NEWS;
-	else if(!strcmp(varvalue,"uucp"))
-		log_facility=LOG_UUCP;
-	else if(!strcmp(varvalue,"cron"))
-		log_facility=LOG_CRON;
-	else if(!strcmp(varvalue,"authpriv"))
-		log_facility=LOG_AUTHPRIV;
-	else if(!strcmp(varvalue,"ftp"))
-		log_facility=LOG_FTP;
-	else if(!strcmp(varvalue,"local0"))
-		log_facility=LOG_LOCAL0;
-	else if(!strcmp(varvalue,"local1"))
-		log_facility=LOG_LOCAL1;
-	else if(!strcmp(varvalue,"local2"))
-		log_facility=LOG_LOCAL2;
-	else if(!strcmp(varvalue,"local3"))
-		log_facility=LOG_LOCAL3;
-	else if(!strcmp(varvalue,"local4"))
-		log_facility=LOG_LOCAL4;
-	else if(!strcmp(varvalue,"local5"))
-		log_facility=LOG_LOCAL5;
-	else if(!strcmp(varvalue,"local6"))
-		log_facility=LOG_LOCAL6;
-	else if(!strcmp(varvalue,"local7"))
-		log_facility=LOG_LOCAL7;
-	else{
-		log_facility=LOG_DAEMON;
-		return ERROR;
-		}
-
-	return OK;
-	}
-
-
-
-/* adds a new command definition from the config file to the list in memory */
-int add_command(char *command_name, char *command_line){
-	command *new_command;
-
-	if(command_name==NULL || command_line==NULL)
-		return ERROR;
-
-	/* allocate memory for the new command */
-	new_command=(command *)malloc(sizeof(command));
-	if(new_command==NULL)
-		return ERROR;
-
-	new_command->command_name=strdup(command_name);
-	if(new_command->command_name==NULL){
-		free(new_command);
-		return ERROR;
-	        }
-	new_command->command_line=strdup(command_line);
-	if(new_command->command_line==NULL){
-		free(new_command->command_name);
-		free(new_command);
-		return ERROR;
-	        }
-
-	/* add new command to head of list in memory */
-	new_command->next=command_list;
-	command_list=new_command;
-
-	if(debug==TRUE)
-		syslog(LOG_DEBUG,"Added command[%s]=%s\n",command_name,command_line);
-
-	return OK;
-        }
-
-
-
-/* given a command name, find the structure in memory */
-command *find_command(char *command_name){
-	command *temp_command;
-
-	for(temp_command=command_list;temp_command!=NULL;temp_command=temp_command->next)
-		if(!strcmp(command_name,temp_command->command_name))
-			return temp_command;
-
-	return NULL;
-        }
-
-
-
-/* wait for incoming connection requests */
-void wait_for_connections(void){
-	struct sockaddr_in myname;
-	struct sockaddr_in *nptr;
-	struct sockaddr addr;
-	int rc;
-	int sock, new_sd;
-	socklen_t addrlen;
-	pid_t pid;
-	int flag=1;
-	fd_set fdread;
-	struct timeval timeout;
-	int retval;
-#ifdef HAVE_LIBWRAP
-	struct request_info req;
-#endif
-
-	/* create a socket for listening */
-	sock=socket(AF_INET,SOCK_STREAM,0);
-
-	/* exit if we couldn't create the socket */
-	if(sock<0){
-	        syslog(LOG_ERR,"Network server socket failure (%d: %s)",errno,strerror(errno));
-	        exit(STATE_CRITICAL);
-		}
-
-	/* socket should be non-blocking */
-	fcntl(sock,F_SETFL,O_NONBLOCK);
-
-        /* set the reuse address flag so we don't get errors when restarting */
-        flag=1;
-        if(setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,(char *)&flag,sizeof(flag))<0){
-		syslog(LOG_ERR,"Could not set reuse address option on socket!\n");
-		exit(STATE_UNKNOWN);
-	        }
-
-	myname.sin_family=AF_INET;
-	myname.sin_port=htons(server_port);
- 	bzero(&myname.sin_zero,8);
-
-	/* what address should we bind to? */
-        if(!strlen(server_address))
-		myname.sin_addr.s_addr=INADDR_ANY;
-
-	else if(!my_inet_aton(server_address,&myname.sin_addr)){
-		syslog(LOG_ERR,"Server address is not a valid IP address\n");
-		exit(STATE_CRITICAL);
-                }
-
-	/* bind the address to the Internet socket */
-	if(bind(sock,(struct sockaddr *)&myname,sizeof(myname))<0){
-		syslog(LOG_ERR,"Network server bind failure (%d: %s)\n",errno,strerror(errno));
-	        exit(STATE_CRITICAL);
-	        }
-
-	/* open the socket for listening */
-	if(listen(sock,5)<0){
-	    	syslog(LOG_ERR,"Network server listen failure (%d: %s)\n",errno,strerror(errno));
-	        exit(STATE_CRITICAL);
-		}
-
-	/* log warning about command arguments */
-#ifdef ENABLE_COMMAND_ARGUMENTS
-	if(allow_arguments==TRUE)
-		syslog(LOG_NOTICE,"Warning: Daemon is configured to accept command arguments from clients!");
-#endif
-
-	syslog(LOG_INFO,"Listening for connections on port %d\n",htons(myname.sin_port));
-
-	if(allowed_hosts)
-		syslog(LOG_INFO,"Allowing connections from: %s\n",allowed_hosts);
-
-	/* listen for connection requests - fork() if we get one */
-	while(1){
-
-		/* wait for a connection request */
-	        while(1){
-
-			/* wait until there's something to do */
-			FD_ZERO(&fdread);
-			FD_SET(sock,&fdread);
-			timeout.tv_sec=0;
-			timeout.tv_usec=500000;
-			retval=select(sock+1,&fdread,NULL,&fdread,&timeout);
-
-			/* bail out if necessary */
-			if(sigrestart==TRUE || sigshutdown==TRUE)
-				break;
-
-			/* error */
-			if(retval<0)
-				continue;
-
-			/* accept a new connection request */
-			new_sd=accept(sock,0,0);
-
-			/* some kind of error occurred... */
-			if(new_sd<0){
-
-				/* bail out if necessary */
-				if(sigrestart==TRUE || sigshutdown==TRUE)
-					break;
-
-				/* retry */
-				if(errno==EWOULDBLOCK || errno==EINTR)
-					continue;
-
-				/* socket is nonblocking and we don't have a connection yet */
-				if(errno==EAGAIN)
-					continue;
-
-				/* fix for HP-UX 11.0 - just retry */
-				if(errno==ENOBUFS)
-					continue;
-
-				/* else handle the error later */
-				break;
-			        }
-
-			/* connection was good */
-			break;
-		        }
-
-		/* bail out if necessary */
-		if(sigrestart==TRUE || sigshutdown==TRUE)
-			break;
-
-		/* child process should handle the connection */
-    		pid=fork();
-    		if(pid==0){
-
-			/* fork again so we don't create zombies */
-			pid=fork();
-			if(pid==0){
-
-				/* hey, there was an error... */
-				if(new_sd<0){
-
-					/* log error to syslog facility */
-					syslog(LOG_ERR,"Network server accept failure (%d: %s)",errno,strerror(errno));
-
-					/* close socket prioer to exiting */
-					close(sock);
-			
-					return;
-				        }
-
-				/* handle signals */
-				signal(SIGQUIT,child_sighandler);
-				signal(SIGTERM,child_sighandler);
-				signal(SIGHUP,child_sighandler);
-
-				/* grandchild does not need to listen for connections, so close the socket */
-				close(sock);  
-
-				/* find out who just connected... */
-				addrlen=sizeof(addr);
-				rc=getpeername(new_sd,&addr,&addrlen);
-
-				if(rc<0){
-
-				        /* log error to syslog facility */
-					syslog(LOG_ERR,"Error: Network server getpeername() failure (%d: %s)",errno,strerror(errno));
-
-				        /* close socket prior to exiting */
-					close(new_sd);
-
-					return;
-		                        }
-
-				nptr=(struct sockaddr_in *)&addr;
-
-				/* log info to syslog facility */
-				if(debug==TRUE)
-					syslog(LOG_DEBUG,"Connection from %s port %d",inet_ntoa(nptr->sin_addr),nptr->sin_port);
-
-                                /* is this is a blessed machine? */
-				if(allowed_hosts){
-
-					if(!is_an_allowed_host(inet_ntoa(nptr->sin_addr))){
-
-                                               /* log error to syslog facility */
-                                               syslog(LOG_ERR,"Host %s is not allowed to talk to us!",inet_ntoa(nptr->sin_addr));
-
-                                               /* log info to syslog facility */
-					       if(debug==TRUE)
-						       syslog(LOG_DEBUG,"Connection from %s closed.",inet_ntoa(nptr->sin_addr));
-
-					       /* close socket prior to exiting */
-                                               close(new_sd);
-
-					       exit(STATE_OK);
-				               }
-                                       else{
-
-                                               /* log info to syslog facility */
-                                               if(debug==TRUE)
-                                                       syslog(LOG_DEBUG,"Host address is in allowed_hosts");
-				               }
-				        }
-
-#ifdef HAVE_LIBWRAP
-
-				/* Check whether or not connections are allowed from this host */
-				request_init(&req,RQ_DAEMON,"nrpe",RQ_FILE,new_sd,0);
-				fromhost(&req);
-
-				if(!hosts_access(&req)){
-
-					syslog(LOG_DEBUG,"Connection refused by TCP wrapper");
-
-					/* refuse the connection */
-					refuse(&req);
-					close(new_sd);
-
-					/* should not be reached */
-					syslog(LOG_ERR,"libwrap refuse() returns!");
-					exit(STATE_CRITICAL);
-					}
-#endif
-
-				/* handle the client connection */
-				handle_connection(new_sd);
-
-				/* log info to syslog facility */
-				if(debug==TRUE)
-					syslog(LOG_DEBUG,"Connection from %s closed.",inet_ntoa(nptr->sin_addr));
-
-				/* close socket prior to exiting */
-				close(new_sd);
-
-				exit(STATE_OK);
-    			        }
-
-			/* first child returns immediately, grandchild is inherited by INIT process -> no zombies... */
-			else
-				exit(STATE_OK);
-		        }
-		
-		/* parent ... */
-		else{
-			/* parent doesn't need the new connection */
-			close(new_sd);
-
-			/* parent waits for first child to exit */
-			waitpid(pid,NULL,0);
-		        }
-  		}
-
-	/* close the socket we're listening on */
-	close(sock);
-
-	return;
-	}
-
-
-
-/* checks to see if a given host is allowed to talk to us */
-int is_an_allowed_host(char *connecting_host){
-	char *temp_buffer=NULL;
-	char *temp_ptr=NULL;
-	int result=0;
-        struct hostent *myhost;
-	char **pptr=NULL;
-	char *save_connecting_host=NULL;
-	struct in_addr addr;
-	
-	/* make sure we have something */
-	if(connecting_host==NULL)
-		return 0;
-	if(allowed_hosts==NULL)
-		return 1;
-
-	if((temp_buffer=strdup(allowed_hosts))==NULL)
-		return 0;
-	
-	/* try and match IP addresses first */
-	for(temp_ptr=strtok(temp_buffer,",");temp_ptr!=NULL;temp_ptr=strtok(NULL,",")){
-
-		if(!strcmp(connecting_host,temp_ptr)){
-			result=1;
-			break;
-		        }
-	        }
-
-	/* try DNS lookups if needed */
-	if(result==0){
-
-		free(temp_buffer);
-		if((temp_buffer=strdup(allowed_hosts))==NULL)
-			return 0;
-
-		save_connecting_host=strdup(connecting_host);
-		for(temp_ptr=strtok(temp_buffer,",");temp_ptr!=NULL;temp_ptr=strtok(NULL,",")){
-
-			myhost=gethostbyname(temp_ptr);
-			if(myhost!=NULL){
-
-				/* check all addresses for the host... */
-				for(pptr=myhost->h_addr_list;*pptr!=NULL;pptr++){
-					memcpy(&addr, *pptr, sizeof(addr));
-					if(!strcmp(save_connecting_host, inet_ntoa(addr))){
-						result=1;
-						break;
-					        }
-				        }
-			        }
-
-			if(result==1)
-				break;
-		        }
-
-		strcpy(connecting_host, save_connecting_host);
-		free(save_connecting_host);
-	        }
-
-	free(temp_buffer);
-
-	return result;
-        }
-
-
-
-/* handles a client connection */
-void handle_connection(int sock){
-        u_int32_t calculated_crc32;
-	command *temp_command;
-	packet receive_packet;
-	packet send_packet;
-	int bytes_to_send;
-	int bytes_to_recv;
-	char buffer[MAX_INPUT_BUFFER];
-	char raw_command[MAX_INPUT_BUFFER];
-	char processed_command[MAX_INPUT_BUFFER];
-	int result=STATE_OK;
-	int early_timeout=FALSE;
-	int rc;
-	int x;
-#ifdef DEBUG
-	FILE *errfp;
-#endif
-#ifdef HAVE_SSL
-	SSL *ssl=NULL;
-#endif
-
-
-	/* log info to syslog facility */
-	if(debug==TRUE)
-		syslog(LOG_DEBUG,"Handling the connection...");
-
-#ifdef OLDSTUFF
-	/* socket should be non-blocking */
-	fcntl(sock,F_SETFL,O_NONBLOCK);
-#endif
-
-	/* set connection handler */
-	signal(SIGALRM,my_connection_sighandler);
-	alarm(connection_timeout);
-
-#ifdef HAVE_SSL
-	/* do SSL handshake */
-	if(result==STATE_OK && use_ssl==TRUE){
-		if((ssl=SSL_new(ctx))!=NULL){
-			SSL_set_fd(ssl,sock);
-
-			/* keep attempting the request if needed */
-                        while(((rc=SSL_accept(ssl))!=1) && (SSL_get_error(ssl,rc)==SSL_ERROR_WANT_READ));
-
-			if(rc!=1){
-				syslog(LOG_ERR,"Error: Could not complete SSL handshake. %d\n",SSL_get_error(ssl,rc));
-#ifdef DEBUG
-				errfp=fopen("/tmp/err.log","w");
-				ERR_print_errors_fp(errfp);
-				fclose(errfp);
-#endif
-				return;
-			        }
-		        }
-		else{
-			syslog(LOG_ERR,"Error: Could not create SSL connection structure.\n");
-#ifdef DEBUG
-			errfp=fopen("/tmp/err.log","w");
-			ERR_print_errors_fp(errfp);
-			fclose(errfp);
-#endif
-			return;
-		        }
-	        }
-#endif
-
-	bytes_to_recv=sizeof(receive_packet);
-	if(use_ssl==FALSE)
-		rc=recvall(sock,(char *)&receive_packet,&bytes_to_recv,socket_timeout);
-#ifdef HAVE_SSL
-	else{
-                while(((rc=SSL_read(ssl,&receive_packet,bytes_to_recv))<=0) && (SSL_get_error(ssl,rc)==SSL_ERROR_WANT_READ));
-		}
-#endif
-
-	/* recv() error or client disconnect */
-	if(rc<=0){
-
-		/* log error to syslog facility */
-		syslog(LOG_ERR,"Could not read request from client, bailing out...");
-
-#ifdef HAVE_SSL
-		if(ssl){
-			SSL_shutdown(ssl);
-			SSL_free(ssl);
-			syslog(LOG_INFO,"INFO: SSL Socket Shutdown.\n");
-			}
-#endif
-
-		return;
-                }
-
-	/* we couldn't read the correct amount of data, so bail out */
-	else if(bytes_to_recv!=sizeof(receive_packet)){
-
-		/* log error to syslog facility */
-		syslog(LOG_ERR,"Data packet from client was too short, bailing out...");
-
-#ifdef HAVE_SSL
-		if(ssl){
-			SSL_shutdown(ssl);
-			SSL_free(ssl);
-			}
-#endif
-
-		return;
-	        }
-
-#ifdef DEBUG
-	fp=fopen("/tmp/packet","w");
-	if(fp){
-		fwrite(&receive_packet,1,sizeof(receive_packet),fp);
-		fclose(fp);
-	        }
-#endif
-
-	/* make sure the request is valid */
-	if(validate_request(&receive_packet)==ERROR){
-
-		/* log an error */
-		syslog(LOG_ERR,"Client request was invalid, bailing out...");
-
-		/* free memory */
-		free(command_name);
-		command_name=NULL;
-		for(x=0;x<MAX_COMMAND_ARGUMENTS;x++){
-			free(macro_argv[x]);
-			macro_argv[x]=NULL;
-	                }
-
-#ifdef HAVE_SSL
-		if(ssl){
-			SSL_shutdown(ssl);
-			SSL_free(ssl);
-			}
-#endif
-
-		return;
-	        }
-
-	/* log info to syslog facility */
-	if(debug==TRUE)
-		syslog(LOG_DEBUG,"Host is asking for command '%s' to be run...",receive_packet.buffer);
-
-	/* disable connection alarm - a new alarm will be setup during my_system */
-	alarm(0);
-
-	/* if this is the version check command, just spew it out */
-	if(!strcmp(command_name,NRPE_HELLO_COMMAND)){
-
-		snprintf(buffer,sizeof(buffer),"NRPE v%s",PROGRAM_VERSION);
-		buffer[sizeof(buffer)-1]='\x0';
-
-		/* log info to syslog facility */
-		if(debug==TRUE)
-			syslog(LOG_DEBUG,"Response: %s",buffer);
-
-		result=STATE_OK;
-	        }
-
-	/* find the command we're supposed to run */
-	else{
-		temp_command=find_command(command_name);
-		if(temp_command==NULL){
-
-			snprintf(buffer,sizeof(buffer),"NRPE: Command '%s' not defined",command_name);
-			buffer[sizeof(buffer)-1]='\x0';
-
-			/* log error to syslog facility */
-			if(debug==TRUE)
-				syslog(LOG_DEBUG,"%s",buffer);
-
-			result=STATE_CRITICAL;
-	                }
-
-		else{
-
-			/* process command line */
-			if(command_prefix==NULL)
-				strncpy(raw_command,temp_command->command_line,sizeof(raw_command)-1);
-			else
-				snprintf(raw_command,sizeof(raw_command)-1,"%s %s",command_prefix,temp_command->command_line);
-			raw_command[sizeof(raw_command)-1]='\x0';
-			process_macros(raw_command,processed_command,sizeof(processed_command));
-
-			/* log info to syslog facility */
-			if(debug==TRUE)
-				syslog(LOG_DEBUG,"Running command: %s",processed_command);
-
-			/* run the command */
-			strcpy(buffer,"");
-			result=my_system(processed_command,command_timeout,&early_timeout,buffer,sizeof(buffer));
-
-			/* log debug info */
-			if(debug==TRUE)
-				syslog(LOG_DEBUG,"Command completed with return code %d and output: %s",result,buffer);
-
-			/* see if the command timed out */
-			if(early_timeout==TRUE)
-				snprintf(buffer,sizeof(buffer)-1,"NRPE: Command timed out after %d seconds\n",command_timeout);
-			else if(!strcmp(buffer,""))
-				snprintf(buffer,sizeof(buffer)-1,"NRPE: Unable to read output\n");
-
-			buffer[sizeof(buffer)-1]='\x0';
-
-			/* check return code bounds */
-			if((result<0) || (result>3)){
-
-				/* log error to syslog facility */
-				syslog(LOG_ERR,"Bad return code for [%s]: %d", buffer,result);
-
-				result=STATE_UNKNOWN;
-			        }
-		        }
-	        }
-
-	/* free memory */
-	free(command_name);
-	command_name=NULL;
-	for(x=0;x<MAX_COMMAND_ARGUMENTS;x++){
-		free(macro_argv[x]);
-		macro_argv[x]=NULL;
-	        }
-
-	/* strip newline character from end of output buffer */
-	if(buffer[strlen(buffer)-1]=='\n')
-		buffer[strlen(buffer)-1]='\x0';
-
-	/* clear the response packet buffer */
-	bzero(&send_packet,sizeof(send_packet));
-
-	/* fill the packet with semi-random data */
-	randomize_buffer((char *)&send_packet,sizeof(send_packet));
-
-	/* initialize response packet data */
-	send_packet.packet_version=(int16_t)htons(NRPE_PACKET_VERSION_2);
-	send_packet.packet_type=(int16_t)htons(RESPONSE_PACKET);
-	send_packet.result_code=(int16_t)htons(result);
-	strncpy(&send_packet.buffer[0],buffer,MAX_PACKETBUFFER_LENGTH);
-	send_packet.buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
-	
-	/* calculate the crc 32 value of the packet */
-	send_packet.crc32_value=(u_int32_t)0L;
-	calculated_crc32=calculate_crc32((char *)&send_packet,sizeof(send_packet));
-	send_packet.crc32_value=(u_int32_t)htonl(calculated_crc32);
-
-
-	/***** ENCRYPT RESPONSE *****/
-
-
-	/* send the response back to the client */
-	bytes_to_send=sizeof(send_packet);
-	if(use_ssl==FALSE)
-		sendall(sock,(char *)&send_packet,&bytes_to_send);
-#ifdef HAVE_SSL
-	else
-		SSL_write(ssl,&send_packet,bytes_to_send);
-#endif
-
-#ifdef HAVE_SSL
-	if(ssl){
-		SSL_shutdown(ssl);
-		SSL_free(ssl);
-		}
-#endif
-
-	/* log info to syslog facility */
-	if(debug==TRUE)
-		syslog(LOG_DEBUG,"Return Code: %d, Output: %s",result,buffer);
-
-	return;
-        }
-
-
-
-/* free all allocated memory */
-void free_memory(void){
-	command *this_command;
-	command *next_command;
-	
-	/* free memory for the command list */
-	this_command=command_list;
-	while(this_command!=NULL){
-		next_command=this_command->next;
-		if(this_command->command_name)
-			free(this_command->command_name);
-		if(this_command->command_line)
-			free(this_command->command_line);
-		free(this_command);
-		this_command=next_command;
-	        }
-
-	command_list=NULL;
-
-	return;
-        }
-
-
-
-/* executes a system command via popen(), but protects against timeouts */
-int my_system(char *command,int timeout,int *early_timeout,char *output,int output_length){
-        pid_t pid;
-	int status;
-	int result;
-	extern int errno;
-	char buffer[MAX_INPUT_BUFFER];
-	int fd[2];
-	FILE *fp;
-	int bytes_read=0;
-	time_t start_time,end_time;
-
-	/* initialize return variables */
-	if(output!=NULL)
-		strcpy(output,"");
-	*early_timeout=FALSE;
-
-	/* if no command was passed, return with no error */
-	if(command==NULL)
-	        return STATE_OK;
-
-	/* create a pipe */
-	pipe(fd);
-
-	/* make the pipe non-blocking */
-	fcntl(fd[0],F_SETFL,O_NONBLOCK);
-	fcntl(fd[1],F_SETFL,O_NONBLOCK);
-
-	/* get the command start time */
-	time(&start_time);
-
-	/* fork */
-	pid=fork();
-
-	/* return an error if we couldn't fork */
-	if(pid==-1){
-
-		snprintf(buffer,sizeof(buffer)-1,"NRPE: Call to fork() failed\n");
-		buffer[sizeof(buffer)-1]='\x0';
-
-		if(output!=NULL){
-			strncpy(output,buffer,output_length-1);
-			output[output_length-1]='\x0';
-		        }
-
-		/* close both ends of the pipe */
-		close(fd[0]);
-		close(fd[1]);
-		
-	        return STATE_UNKNOWN;  
-	        }
-
-	/* execute the command in the child process */
-        if(pid==0){
-
-		/* close pipe for reading */
-		close(fd[0]);
-
-		/* become process group leader */
-		setpgid(0,0);
-
-		/* trap commands that timeout */
-		signal(SIGALRM,my_system_sighandler);
-		alarm(timeout);
-
-		/* run the command */
-		fp=popen(command,"r");
-		
-		/* report an error if we couldn't run the command */
-		if(fp==NULL){
-
-			strncpy(buffer,"NRPE: Call to popen() failed\n",sizeof(buffer)-1);
-			buffer[sizeof(buffer)-1]='\x0';
-
-			/* write the error back to the parent process */
-			write(fd[1],buffer,strlen(buffer)+1);
-
-			result=STATE_CRITICAL;
-		        }
-		else{
-
-			/* read all lines of output - supports Nagios 3.x multiline output */
-			while((bytes_read=fread(buffer,1,sizeof(buffer)-1,fp))>0){
-
-				/* write the output back to the parent process */
-				write(fd[1],buffer,bytes_read);
-				}
-
-			/* close the command and get termination status */
-			status=pclose(fp);
-
-			/* report an error if we couldn't close the command */
-			if(status==-1)
-				result=STATE_CRITICAL;
-			/* report an error if child died due to signal (Klas Lindfors) */
-			else if(!WIFEXITED(status))
-				result=STATE_CRITICAL;
-			else
-				result=WEXITSTATUS(status);
-		        }
-
-		/* close pipe for writing */
-		close(fd[1]);
-
-		/* reset the alarm */
-		alarm(0);
-
-		/* return plugin exit code to parent process */
-		exit(result);
-	        }
-
-	/* parent waits for child to finish executing command */
-	else{
-		
-		/* close pipe for writing */
-		close(fd[1]);
-
-		/* wait for child to exit */
-		waitpid(pid,&status,0);
-
-		/* get the end time for running the command */
-		time(&end_time);
-
-		/* get the exit code returned from the program */
-		result=WEXITSTATUS(status);
-
-		/* because of my idiotic idea of having UNKNOWN states be equivalent to -1, I must hack things a bit... */
-		if(result==255)
-			result=STATE_UNKNOWN;
-
-		/* check bounds on the return value */
-		if(result<0 || result>3)
-			result=STATE_UNKNOWN;
-
-		/* try and read the results from the command output (retry if we encountered a signal) */
-		if(output!=NULL){
-			do{
-				bytes_read=read(fd[0], output, output_length-1);
-			}while (bytes_read==-1 && errno==EINTR);
-
-			if(bytes_read==-1)
-				*output='\0';
-			else
-				output[bytes_read]='\0';
-			}
-
-		/* if there was a critical return code and no output AND the command time exceeded the timeout thresholds, assume a timeout */
-		if(result==STATE_CRITICAL && bytes_read==-1 && (end_time-start_time)>=timeout){
-			*early_timeout=TRUE;
-
-			/* send termination signal to child process group */
-			kill((pid_t)(-pid),SIGTERM);
-			kill((pid_t)(-pid),SIGKILL);
-		        }
-
-		/* close the pipe for reading */
-		close(fd[0]);
-	        }
-
-#ifdef DEBUG
-	printf("my_system() end\n");
-#endif
-
-	return result;
-        }
-
-
-
-/* handle timeouts when executing commands via my_system() */
-void my_system_sighandler(int sig){
-
-	/* force the child process to exit... */
-	exit(STATE_CRITICAL);
-        }
-
-
-/* handle errors where connection takes too long */
-void my_connection_sighandler(int sig) {
-
-	syslog(LOG_ERR,"Connection has taken too long to establish. Exiting...");
-
-	exit(STATE_CRITICAL);
-	}
-
-
-/* drops privileges */
-int drop_privileges(char *user, char *group){
-	uid_t uid=-1;
-	gid_t gid=-1;
-	struct group *grp;
-	struct passwd *pw;
-
-	/* set effective group ID */
-	if(group!=NULL){
-		
-		/* see if this is a group name */
-		if(strspn(group,"0123456789")<strlen(group)){
-			grp=(struct group *)getgrnam(group);
-			if(grp!=NULL)
-				gid=(gid_t)(grp->gr_gid);
-			else
-				syslog(LOG_ERR,"Warning: Could not get group entry for '%s'",group);
-			endgrent();
-		        }
-
-		/* else we were passed the GID */
-		else
-			gid=(gid_t)atoi(group);
-
-		/* set effective group ID if other than current EGID */
-		if(gid!=getegid()){
-
-			if(setgid(gid)==-1)
-				syslog(LOG_ERR,"Warning: Could not set effective GID=%d",(int)gid);
-		        }
-	        }
-
-
-	/* set effective user ID */
-	if(user!=NULL){
-		
-		/* see if this is a user name */
-		if(strspn(user,"0123456789")<strlen(user)){
-			pw=(struct passwd *)getpwnam(user);
-			if(pw!=NULL)
-				uid=(uid_t)(pw->pw_uid);
-			else
-				syslog(LOG_ERR,"Warning: Could not get passwd entry for '%s'",user);
-			endpwent();
-		        }
-
-		/* else we were passed the UID */
-		else
-			uid=(uid_t)atoi(user);
-			
-		/* set effective user ID if other than current EUID */
-		if(uid!=geteuid()){
-
-#ifdef HAVE_INITGROUPS
-			/* initialize supplementary groups */
-			if(initgroups(user,gid)==-1){
-				if(errno==EPERM)
-					syslog(LOG_ERR,"Warning: Unable to change supplementary groups using initgroups()");
-				else{
-					syslog(LOG_ERR,"Warning: Possibly root user failed dropping privileges with initgroups()");
-					return ERROR;
-			                }
-	                        }
-#endif
-
-			if(setuid(uid)==-1)
-				syslog(LOG_ERR,"Warning: Could not set effective UID=%d",(int)uid);
-		        }
-	        }
-
-	return OK;
-        }
-
-
-/* write an optional pid file */
-int write_pid_file(void){
-	int fd;
-	int result=0;
-	pid_t pid=0;
-	char pbuf[16];
-
-	/* no pid file was specified */
-	if(pid_file==NULL)
-		return OK;
-
-	/* read existing pid file */
-	if((fd=open(pid_file,O_RDONLY))>=0){
-
-		result=read(fd,pbuf,(sizeof pbuf)-1);
-
-		close(fd);
-
-		if(result>0){
-
-			pbuf[result]='\x0';
-			pid=(pid_t)atoi(pbuf);
-
-			/* if previous process is no longer running running, remove the old pid file */
-			if(pid && (pid==getpid() || kill(pid,0)<0))
-				unlink(pid_file);
-
-			/* previous process is still running */
-			else{
-				syslog(LOG_ERR,"There's already an NRPE server running (PID %lu).  Bailing out...",(unsigned long)pid);
-				return ERROR;
-			        }
-		        }
-	        } 
-
-	/* write new pid file */
-	if((fd=open(pid_file,O_WRONLY | O_CREAT,0644))>=0){
-		sprintf(pbuf,"%d\n",(int)getpid());
-		write(fd,pbuf,strlen(pbuf));
-		close(fd);
-		wrote_pid_file=TRUE;
-	        }
-	else{
-		syslog(LOG_ERR,"Cannot write to pidfile '%s' - check your privileges.",pid_file);
-	        }
-
-	return OK;
-        }
-
-
-
-/* remove pid file */
-int remove_pid_file(void){
-
-	/* no pid file was specified */
-	if(pid_file==NULL)
-		return OK;
-
-	/* pid file was not written */
-	if(wrote_pid_file==FALSE)
-		return OK;
-
-	/* remove existing pid file */
-	if(unlink(pid_file)==-1){
-		syslog(LOG_ERR,"Cannot remove pidfile '%s' - check your privileges.",pid_file);
-		return ERROR;
-	        }
-
-	return OK;
-        }
-
-
-
-/* bail if daemon is running as root */
-int check_privileges(void){
-	uid_t uid=-1;
-	gid_t gid=-1;
-
-	uid=geteuid();
-	gid=getegid();
-
-	if(uid==0 || gid==0){
-		syslog(LOG_ERR,"Error: NRPE daemon cannot be run as user/group root!");
-		exit(STATE_CRITICAL);
-	        }
-
-	return OK;
-        }
-
-
-
-/* handle signals (parent process) */
-void sighandler(int sig){
-	static char *sigs[]={"EXIT","HUP","INT","QUIT","ILL","TRAP","ABRT","BUS","FPE","KILL","USR1","SEGV","USR2","PIPE","ALRM","TERM","STKFLT","CHLD","CONT","STOP","TSTP","TTIN","TTOU","URG","XCPU","XFSZ","VTALRM","PROF","WINCH","IO","PWR","UNUSED","ZERR","DEBUG",(char *)NULL};
-	int i;
-
-	if(sig<0)
-		sig=-sig;
-
-	for(i=0;sigs[i]!=(char *)NULL;i++);
-
-	sig%=i;
-
-	/* we received a SIGHUP, so restart... */
-	if(sig==SIGHUP){
-
-		sigrestart=TRUE;
-
-		syslog(LOG_NOTICE,"Caught SIGHUP - restarting...\n");
-	        }
-
-	/* else begin shutting down... */
-	if(sig==SIGTERM){
-
-		/* if shutdown is already true, we're in a signal trap loop! */
-		if(sigshutdown==TRUE)
-			exit(STATE_CRITICAL);
-
-		sigshutdown=TRUE;
-
-		syslog(LOG_NOTICE,"Caught SIG%s - shutting down...\n",sigs[sig]);
-	        }
-
-	return;
-        }
-
-
-
-/* handle signals (child processes) */
-void child_sighandler(int sig){
-
-	/* free all memory we allocated */
-	free_memory();
-
-	/* terminate */
-	exit(0);
-	
-	/* so the compiler doesn't complain... */
-	return;
-        }
-
-
-
-/* tests whether or not a client request is valid */
-int validate_request(packet *pkt){
-        u_int32_t packet_crc32;
-        u_int32_t calculated_crc32;
-	char *ptr;
-#ifdef ENABLE_COMMAND_ARGUMENTS
-	int x;
-#endif
-
-
-	/***** DECRYPT REQUEST ******/
-
-
-        /* check the crc 32 value */
-        packet_crc32=ntohl(pkt->crc32_value);
-        pkt->crc32_value=0L;
-        calculated_crc32=calculate_crc32((char *)pkt,sizeof(packet));
-        if(packet_crc32!=calculated_crc32){
-                syslog(LOG_ERR,"Error: Request packet had invalid CRC32.");
-                return ERROR;
-                }
-
-	/* make sure this is the right type of packet */
-	if(ntohs(pkt->packet_type)!=QUERY_PACKET || ntohs(pkt->packet_version)!=NRPE_PACKET_VERSION_2){
-		syslog(LOG_ERR,"Error: Request packet type/version was invalid!");
-		return ERROR;
-	        }
-
-	/* make sure buffer is terminated */
-	pkt->buffer[MAX_PACKETBUFFER_LENGTH-1]='\x0';
-
-	/* client must send some kind of request */
-	if(!strcmp(pkt->buffer,"")){
-		syslog(LOG_ERR,"Error: Request contained no query!");
-		return ERROR;
-	        }
-
-	/* make sure request doesn't contain nasties */
-	if(contains_nasty_metachars(pkt->buffer)==TRUE){
-		syslog(LOG_ERR,"Error: Request contained illegal metachars!");
-		return ERROR;
-	        }
-
-	/* make sure the request doesn't contain arguments */
-	if(strchr(pkt->buffer,'!')){
-#ifdef ENABLE_COMMAND_ARGUMENTS
-		if(allow_arguments==FALSE){
-			syslog(LOG_ERR,"Error: Request contained command arguments, but argument option is not enabled!");
-			return ERROR;
-	                }
-#else
-		syslog(LOG_ERR,"Error: Request contained command arguments!");
-		return ERROR;
-#endif
-	        }
-
-	/* get command name */
-#ifdef ENABLE_COMMAND_ARGUMENTS
-	ptr=strtok(pkt->buffer,"!");
-#else
-	ptr=pkt->buffer;
-#endif	
-	command_name=strdup(ptr);
-	if(command_name==NULL){
-		syslog(LOG_ERR,"Error: Memory allocation failed");
-		return ERROR;
-	        }
-
-#ifdef ENABLE_COMMAND_ARGUMENTS
-	/* get command arguments */
-	if(allow_arguments==TRUE){
-
-		for(x=0;x<MAX_COMMAND_ARGUMENTS;x++){
-			ptr=strtok(NULL,"!");
-			if(ptr==NULL)
-				break;
-			macro_argv[x]=strdup(ptr);
-			if(macro_argv[x]==NULL){
-				syslog(LOG_ERR,"Error: Memory allocation failed");
-				return ERROR;
-			        }
-			if(!strcmp(macro_argv[x],"")){
-				syslog(LOG_ERR,"Error: Request contained an empty command argument");
-				return ERROR;
-		                }
-		        }
-	        }
-#endif
-
-	return OK;
-        }
-
-
-
-/* tests whether a buffer contains illegal metachars */
-int contains_nasty_metachars(char *str){
-	int result;
-
-	if(str==NULL)
-		return FALSE;
-	
-	result=strcspn(str,NASTY_METACHARS);
-	if(result!=strlen(str))
-		return TRUE;
-
-	return FALSE;
-        }
-
-
-
-/* replace macros in buffer */
-int process_macros(char *input_buffer,char *output_buffer,int buffer_length){
-	char *temp_buffer;
-	int in_macro;
-	int arg_index=0;
-	char *selected_macro=NULL;
-
-	strcpy(output_buffer,"");
-
-	in_macro=FALSE;
-
-	for(temp_buffer=my_strsep(&input_buffer,"$");temp_buffer!=NULL;temp_buffer=my_strsep(&input_buffer,"$")){
-
-		selected_macro=NULL;
-
-		if(in_macro==FALSE){
-			if(strlen(output_buffer)+strlen(temp_buffer)<buffer_length-1){
-				strncat(output_buffer,temp_buffer,buffer_length-strlen(output_buffer)-1);
-				output_buffer[buffer_length-1]='\x0';
-			        }
-			in_macro=TRUE;
-			}
-		else{
-
-			if(strlen(output_buffer)+strlen(temp_buffer)<buffer_length-1){
-
-				/* argument macro */
-				if(strstr(temp_buffer,"ARG")==temp_buffer){
-					arg_index=atoi(temp_buffer+3);
-					if(arg_index>=1 && arg_index<=MAX_COMMAND_ARGUMENTS)
-						selected_macro=macro_argv[arg_index-1];
-				        }
-
-				/* an escaped $ is done by specifying two $$ next to each other */
-				else if(!strcmp(temp_buffer,"")){
-					strncat(output_buffer,"$",buffer_length-strlen(output_buffer)-1);
-				        }
-				
-				/* a non-macro, just some user-defined string between two $s */
-				else{
-					strncat(output_buffer,"$",buffer_length-strlen(output_buffer)-1);
-					output_buffer[buffer_length-1]='\x0';
-					strncat(output_buffer,temp_buffer,buffer_length-strlen(output_buffer)-1);
-					output_buffer[buffer_length-1]='\x0';
-					strncat(output_buffer,"$",buffer_length-strlen(output_buffer)-1);
-				        }
-
-				
-				/* insert macro */
-				if(selected_macro!=NULL)
-					strncat(output_buffer,(selected_macro==NULL)?"":selected_macro,buffer_length-strlen(output_buffer)-1);
-
-				output_buffer[buffer_length-1]='\x0';
-				}
-
-			in_macro=FALSE;
-			}
-		}
-
-	return OK;
-	}
-
-
-
-/* process command line arguments */
-int process_arguments(int argc, char **argv){
-	char optchars[MAX_INPUT_BUFFER];
-	int c=1;
-	int have_mode=FALSE;
-
-#ifdef HAVE_GETOPT_LONG
-	int option_index=0;
-	static struct option long_options[]={
-		{"config", required_argument, 0, 'c'},
-		{"inetd", no_argument, 0, 'i'},
-		{"daemon", no_argument, 0, 'd'},
-		{"no-ssl", no_argument, 0, 'n'},
-		{"help", no_argument, 0, 'h'},
-		{"license", no_argument, 0, 'l'},
-		{0, 0, 0, 0}
-                };
-#endif
-
-	/* no options were supplied */
-	if(argc<2)
-		return ERROR;
-
-	snprintf(optchars,MAX_INPUT_BUFFER,"c:hVldin");
-
-	while(1){
-#ifdef HAVE_GETOPT_LONG
-		c=getopt_long(argc,argv,optchars,long_options,&option_index);
-#else
-		c=getopt(argc,argv,optchars);
-#endif
-		if(c==-1 || c==EOF)
-			break;
-
-		/* process all arguments */
-		switch(c){
-
-		case '?':
-		case 'h':
-			show_help=TRUE;
-			break;
-		case 'V':
-			show_version=TRUE;
-			break;
-		case 'l':
-			show_license=TRUE;
-			break;
-		case 'c':
-			strncpy(config_file,optarg,sizeof(config_file));
-			config_file[sizeof(config_file)-1]='\x0';
-			break;
-		case 'd':
-			use_inetd=FALSE;
-			have_mode=TRUE;
-			break;
-		case 'i':
-			use_inetd=TRUE;
-			have_mode=TRUE;
-			break;
-		case 'n':
-			use_ssl=FALSE;
-			break;
-		default:
-			return ERROR;
-			break;
-		        }
-	        }
-
-	/* bail if we didn't get required args */
-	if(have_mode==FALSE)
-		return ERROR;
-
-	return OK;
-        }
-
+/*******************************************************************************
+ *
+ * NRPE.C - Nagios Remote Plugin Executor
+ * Copyright (c) 1999-2008 Ethan Galstad ([e-mail])
+ * License: GPL
+ *
+ * Last Modified: 11-11-2011
+ *
+ * Command line: nrpe -c <config_file> [--inetd | --daemon]
+ *
+ * Description:
+ *
+ * This program is designed to run as a background process and
+ * handle incoming requests (from the host running Nagios) for
+ * plugin execution.  It is useful for running "local" plugins
+ * such as check_users, check_load, check_disk, etc. without
+ * having to use rsh or ssh.
+ * 
+ ******************************************************************************/
+
+/*
+ * 08-10-2011 IPv4 subnetworks support added.
+ * Main change in nrpe.c is that is_an_allowed_host() moved to acl.c.
+ * now allowed_hosts is parsed by parse_allowed_hosts() from acl.c.
+ */ 
+
+#include "../include/common.h"
+#include "../include/config.h"
+#include "../include/nrpe.h"
+#include "../include/utils.h"
+#include "../include/acl.h"
+
+#ifdef HAVE_SSL
+#include "../include/dh.h"
+#endif
+
+#ifdef HAVE_LIBWRAP
+int allow_severity=LOG_INFO;
+int deny_severity=LOG_WARNING;
+#endif
+
+#ifdef HAVE_SSL
+SSL_METHOD *meth;
+SSL_CTX *ctx;
+int use_ssl=TRUE;
+#else
+int use_ssl=FALSE;
+#endif
+
+#define DEFAULT_COMMAND_TIMEOUT	60			/* default timeout for execution of plugins */
+#define MAXFD                   64
+#define NASTY_METACHARS         "|`&><'\"\\[]{};"
+
+char    *command_name=NULL;
+char    *macro_argv[MAX_COMMAND_ARGUMENTS];
+
+char    config_file[MAX_INPUT_BUFFER]="nrpe.cfg";
+int     log_facility=LOG_DAEMON;
+int     server_port=DEFAULT_SERVER_PORT;
+char    server_address[16]="0.0.0.0";
+int     socket_timeout=DEFAULT_SOCKET_TIMEOUT;
+int     command_timeout=DEFAULT_COMMAND_TIMEOUT;
+int     connection_timeout=DEFAULT_CONNECTION_TIMEOUT;
+char    *command_prefix=NULL;
+
+command *command_list=NULL;
+
+char    *nrpe_user=NULL;
+char    *nrpe_group=NULL;
+
+char    *allowed_hosts=NULL;
+
+char    *pid_file=NULL;
+int     wrote_pid_file=FALSE;
+
+int     allow_arguments=FALSE;
+
+int     allow_weak_random_seed=FALSE;
+
+int     sigrestart=FALSE;
+int     sigshutdown=FALSE;
+
+int     show_help=FALSE;
+int     show_license=FALSE;
+int     show_version=FALSE;
+int     use_inetd=TRUE;
+int     debug=FALSE;
+
+
+
+
+int main(int argc, char **argv){
+	int result=OK;
+	int x;
+	char buffer[MAX_INPUT_BUFFER];
+	char *env_string=NULL;
+#ifdef HAVE_SSL
+	DH *dh;
+	char seedfile[FILENAME_MAX];
+	int i,c;
+#endif
+
+	/* set some environment variables */
+	asprintf(&env_string,"NRPE_MULTILINESUPPORT=1");
+	putenv(env_string);
+	asprintf(&env_string,"NRPE_PROGRAMVERSION=%s",PROGRAM_VERSION);
+	putenv(env_string);
+
+	/* process command-line args */
+	result=process_arguments(argc,argv);
+
+        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE){
+
+		printf("\n");
+		printf("NRPE - Nagios Remote Plugin Executor\n");
+		printf("Copyright (c) 1999-2008 Ethan Galstad ([e-mail])\n");
+		printf("Version: %s\n",PROGRAM_VERSION);
+		printf("Last Modified: %s\n",MODIFICATION_DATE);
+		printf("License: GPL v2 with exemptions (-l for more info)\n");
+#ifdef HAVE_SSL
+		printf("SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required\n");
+#endif
+#ifdef HAVE_LIBWRAP
+		printf("TCP Wrappers Available\n");
+#endif
+		printf("\n");
+#ifdef ENABLE_COMMAND_ARGUMENTS
+		printf("***************************************************************\n");
+		printf("** POSSIBLE SECURITY RISK - COMMAND ARGUMENTS ARE SUPPORTED! **\n");
+		printf("**      Read the NRPE SECURITY file for more information     **\n");
+		printf("***************************************************************\n");
+		printf("\n");
+#endif
+#ifndef HAVE_LIBWRAP
+		printf("***************************************************************\n");
+		printf("** POSSIBLE SECURITY RISK - TCP WRAPPERS ARE NOT AVAILABLE!  **\n");
+		printf("**      Read the NRPE SECURITY file for more information     **\n");
+		printf("***************************************************************\n");
+		printf("\n");
+#endif
+	        }
+
+	if(show_license==TRUE)
+		display_license();
+
+	else if(result!=OK || show_help==TRUE){
+
+		printf("Usage: nrpe [-n] -c <config_file> <mode>\n");
+		printf("\n");
+		printf("Options:\n");
+		printf(" -n            = Do not use SSL\n");
+		printf(" <config_file> = Name of config file to use\n");
+		printf(" <mode>        = One of the following two operating modes:\n");  
+		printf("   -i          =    Run as a service under inetd or xinetd\n");
+		printf("   -d          =    Run as a standalone daemon\n");
+		printf("\n");
+		printf("Notes:\n");
+		printf("This program is designed to process requests from the check_nrpe\n");
+		printf("plugin on the host(s) running Nagios.  It can run as a service\n");
+		printf("under inetd or xinetd (read the docs for info on this), or as a\n");
+		printf("standalone daemon. Once a request is received from an authorized\n");
+		printf("host, NRPE will execute the command/plugin (as defined in the\n");
+		printf("config file) and return the plugin output and return code to the\n");
+		printf("check_nrpe plugin.\n");
+		printf("\n");
+		}
+
+        if(result!=OK || show_help==TRUE || show_license==TRUE || show_version==TRUE)
+		exit(STATE_UNKNOWN);
+
+
+	/* open a connection to the syslog facility */
+	/* facility name may be overridden later */
+	get_log_facility(NRPE_LOG_FACILITY);
+        openlog("nrpe",LOG_PID,log_facility); 
+
+	/* make sure the config file uses an absolute path */
+	if(config_file[0]!='/'){
+
+		/* save the name of the config file */
+		strncpy(buffer,config_file,sizeof(buffer));
+		buffer[sizeof(buffer)-1]='\x0';
+
+		/* get absolute path of current working directory */
+		strcpy(config_file,"");
+		getcwd(config_file,sizeof(config_file));
+
+		/* append a forward slash */
+		strncat(config_file,"/",sizeof(config_file)-2);
+		config_file[sizeof(config_file)-1]='\x0';
+
+		/* append the config file to the path */
+		strncat(config_file,buffer,sizeof(config_file)-strlen(config_file)-1);
+		config_file[sizeof(config_file)-1]='\x0';
+	        }
+
+	/* read the config file */
+	result=read_config_file(config_file);	
+
+	/* exit if there are errors... */
+	if(result==ERROR){
+		syslog(LOG_ERR,"Config file '%s' contained errors, aborting...",config_file);
+		return STATE_CRITICAL;
+		}
+
+        /* generate the CRC 32 table */
+        generate_crc32_table();
+
+	/* initialize macros */
+	for(x=0;x<MAX_COMMAND_ARGUMENTS;x++)
+		macro_argv[x]=NULL;
+
+#ifdef HAVE_SSL
+	/* initialize SSL */
+	if(use_ssl==TRUE){
+		SSL_library_init();
+		SSLeay_add_ssl_algorithms();
+		meth=SSLv23_server_method();
+		SSL_load_error_strings();
+
+		/* use week random seed if necessary */
+		if(allow_weak_random_seed && (RAND_status()==0)){
+
+			if(RAND_file_name(seedfile,sizeof(seedfile)-1))
+				if(RAND_load_file(seedfile,-1))
+					RAND_write_file(seedfile);
+
+			if(RAND_status()==0){
+				syslog(LOG_ERR,"Warning: SSL/TLS uses a weak random seed which is highly discouraged");
+				srand(time(NULL));
+				for(i=0;i<500 && RAND_status()==0;i++){
+					for(c=0;c<sizeof(seedfile);c+=sizeof(int)){
+						*((int *)(seedfile+c))=rand();
+					        }
+					RAND_seed(seedfile,sizeof(seedfile));
+					}
+				}
+			}
+
+		if((ctx=SSL_CTX_new(meth))==NULL){
+			syslog(LOG_ERR,"Error: could not create SSL context.\n");
+			exit(STATE_CRITICAL);
+		        }
+
+		/* ADDED 01/19/2004 */
+		/* use only TLSv1 protocol */
+		SSL_CTX_set_options(ctx,SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+
+		/* use anonymous DH ciphers */
+		SSL_CTX_set_cipher_list(ctx,"ADH");
+		dh=get_dh512();
+		SSL_CTX_set_tmp_dh(ctx,dh);
+		DH_free(dh);
+		if(debug==TRUE)
+			syslog(LOG_INFO,"INFO: SSL/TLS initialized. All network traffic will be encrypted.");
+	        }
+	else{
+		if(debug==TRUE)
+			syslog(LOG_INFO,"INFO: SSL/TLS NOT initialized. Network encryption DISABLED.");
+	        }
+#endif
+
+	/* if we're running under inetd... */
+	if(use_inetd==TRUE){
+
+		/* make sure we're not root */
+		check_privileges();
+
+		/* redirect STDERR to /dev/null */
+		close(2);
+		open("/dev/null",O_WRONLY);
+
+		/* handle the connection */
+		handle_connection(0);
+	        }
+
+	/* else daemonize and start listening for requests... */
+	else if(fork()==0){
+		
+		/* we're a daemon - set up a new process group */
+		setsid();
+
+		/* close standard file descriptors */
+		close(0);
+		close(1);
+		close(2);
+
+		/* redirect standard descriptors to /dev/null */
+		open("/dev/null",O_RDONLY);
+		open("/dev/null",O_WRONLY);
+		open("/dev/null",O_WRONLY);
+
+		chdir("/");
+		/*umask(0);*/
+
+		/* handle signals */
+		signal(SIGQUIT,sighandler);
+		signal(SIGTERM,sighandler);
+		signal(SIGHUP,sighandler);
+
+		/* log info to syslog facility */
+		syslog(LOG_NOTICE,"Starting up daemon");
+
+		/* write pid file */
+		if(write_pid_file()==ERROR)
+			return STATE_CRITICAL;
+		
+		/* drop privileges */
+		drop_privileges(nrpe_user,nrpe_group);
+
+		/* make sure we're not root */
+		check_privileges();
+
+		do{
+
+			/* reset flags */
+			sigrestart=FALSE;
+			sigshutdown=FALSE;
+
+			/* wait for connections */
+			wait_for_connections();
+
+			/* free all memory we allocated */
+			free_memory();
+
+			if(sigrestart==TRUE){
+
+				/* read the config file */
+				result=read_config_file(config_file);	
+
+				/* exit if there are errors... */
+				if(result==ERROR){
+					syslog(LOG_ERR,"Config file '%s' contained errors, bailing out...",config_file);
+					return STATE_CRITICAL;
+				        }
+			        }
+	
+		        }while(sigrestart==TRUE && sigshutdown==FALSE);
+
+		/* remove pid file */
+		remove_pid_file();
+
+		syslog(LOG_NOTICE,"Daemon shutdown\n");
+	        }
+
+#ifdef HAVE_SSL
+	if(use_ssl==TRUE)
+		SSL_CTX_free(ctx);
+#endif
+
+	/* We are now running in daemon mode, or the connection handed over by inetd has
+	   been completed, so the parent process exits */
+        return STATE_OK;
+	}
+
+
+
+
+/* read in the configuration file */
+int read_config_file(char *filename){
+	FILE *fp;
+	char config_file[MAX_FILENAME_LENGTH];
+	char input_buffer[MAX_INPUT_BUFFER];
+	char *input_line;
+	char *temp_buffer;
+	char *varname;
+	char *varvalue;
+	int line=0;
+	int len=0;
+	int x=0;
+
+
+	/* open the config file for reading */
+	fp=fopen(filename,"r");
+
+	/* exit if we couldn't open the config file */
+	if(fp==NULL){
+		syslog(LOG_ERR,"Unable to open config file '%s' for reading\n",filename);
+		return ERROR;
+	        }
+
+	while(fgets(input_buffer,MAX_INPUT_BUFFER-1,fp)){
+
+		line++;
+		input_line=input_buffer;
+
+		/* skip leading whitespace */
+		while(isspace(*input_line))
+			++input_line;
+
+		/* trim trailing whitespace */
+		len=strlen(input_line);
+		for(x=len-1;x>=0;x--){
+			if(isspace(input_line[x]))
+				input_line[x]='\x0';
+			else
+				break;
+		        }
+
+		/* skip comments and blank lines */
+		if(input_line[0]=='#')
+			continue;
+		if(input_line[0]=='\x0')
+			continue;
+		if(input_line[0]=='\n')
+			continue;
+
+		/* get the variable name */
+		varname=strtok(input_line,"=");
+		if(varname==NULL){
+			syslog(LOG_ERR,"No variable name specified in config file '%s' - Line %d\n",filename,line);
+			return ERROR;
+		        }
+
+		/* get the variable value */
+		varvalue=strtok(NULL,"\n");
+		if(varvalue==NULL){
+			syslog(LOG_ERR,"No variable value specified in config file '%s' - Line %d\n",filename,line);
+			return ERROR;
+		        }
+
+		/* allow users to specify directories to recurse into for config files */
+		else if(!strcmp(varname,"include_dir")){
+
+			strncpy(config_file,varvalue,sizeof(config_file)-1);
+			config_file[sizeof(config_file)-1]='\x0';
+
+			/* strip trailing / if necessary */
+			if(config_file[strlen(config_file)-1]=='/')
+				config_file[strlen(config_file)-1]='\x0';
+
+			/* process the config directory... */
+			if(read_config_dir(config_file)==ERROR)
+				syslog(LOG_ERR,"Continuing with errors...");
+			}
+
+		/* allow users to specify individual config files to include */
+		else if(!strcmp(varname,"include") || !strcmp(varname,"include_file")){
+
+			/* process the config file... */
+			if(read_config_file(varvalue)==ERROR)
+				syslog(LOG_ERR,"Continuing with errors...");
+		        }
+
+		else if(!strcmp(varname,"server_port")){
+			server_port=atoi(varvalue);
+			if(server_port<1024){
+				syslog(LOG_ERR,"Invalid port number specified in config file '%s' - Line %d\n",filename,line);
+				return ERROR;
+			        }
+		        }
+		else if(!strcmp(varname,"command_prefix"))
+			command_prefix=strdup(varvalue);
+
+		else if(!strcmp(varname,"server_address")){
+                        strncpy(server_address,varvalue,sizeof(server_address) - 1);
+                        server_address[sizeof(server_address)-1]='\0';
+                        }
+		else if(!strcmp(varname,"allowed_hosts")) {
+				allowed_hosts=strdup(varvalue);
+				parse_allowed_hosts(allowed_hosts);
+		}
+		else if(strstr(input_line,"command[")){
+			temp_buffer=strtok(varname,"[");
+			temp_buffer=strtok(NULL,"]");
+			if(temp_buffer==NULL){
+				syslog(LOG_ERR,"Invalid command specified in config file '%s' - Line %d\n",filename,line);
+				return ERROR;
+			        }
+			add_command(temp_buffer,varvalue);
+		        }
+
+		else if(strstr(input_buffer,"debug")){
+			debug=atoi(varvalue);
+			if(debug>0)
+				debug=TRUE;
+			else 
+				debug=FALSE;
+		        }
+
+                else if(!strcmp(varname,"nrpe_user"))
+			nrpe_user=strdup(varvalue);
+
+                else if(!strcmp(varname,"nrpe_group"))
+			nrpe_group=strdup(varvalue);
+		
+		else if(!strcmp(varname,"dont_blame_nrpe"))
+			allow_arguments=(atoi(varvalue)==1)?TRUE:FALSE;
+
+ 		else if(!strcmp(varname,"command_timeout")){
+			command_timeout=atoi(varvalue);
+			if(command_timeout<1){
+				syslog(LOG_ERR,"Invalid command_timeout specified in config file '%s' - Line %d\n",filename,line);
+				return ERROR;
+			        }
+		        }
+
+ 		else if(!strcmp(varname,"connection_timeout")){
+			connection_timeout=atoi(varvalue);
+			if(connection_timeout<1){
+				syslog(LOG_ERR,"Invalid connection_timeout specified in config file '%s' - Line %d\n",filename,line);
+				return ERROR;
+			        }
+		        }
+
+		else if(!strcmp(varname,"allow_weak_random_seed"))
+			allow_weak_random_seed=(atoi(varvalue)==1)?TRUE:FALSE;
+
+		else if(!strcmp(varname,"pid_file"))
+			pid_file=strdup(varvalue);
+
+		else if(!strcmp(varname,"log_facility")){
+			if((get_log_facility(varvalue))==OK){
+				/* re-open log using new facility */
+				closelog();
+				openlog("nrpe",LOG_PID,log_facility); 
+				}
+			else
+				syslog(LOG_WARNING,"Invalid log_facility specified in config file '%s' - Line %d\n",filename,line);
+			}
+