Changeset b7ed6ac in nscp


Ignore:
Timestamp:
03/21/08 18:15:51 (5 years ago)
Author:
Michael Medin <michael@…>
Branches:
master, 0.4.0, 0.4.1, 0.4.2, stable
Children:
367bf20
Parents:
dd02c15
Message:

+ Added command line support for process checks

New option: cmdLine will toggle so full command lines are used instead of just process names.

+ Added regular expression matching to process checks

New option: match=regexp (match=strings is the default and "old" way)

+ Added substring matching to process checks

New option: match=substr (match=strings is the default and "old" way)
This is *NOT* case blind so might be hard to use, plan to add case blindness to it in the future.

: Sample command: check_nt ... -v PROCSTATE -l cmdLine,match=regexp,.*exp.* -d SHOWALL

  • Ohh yeah... it is 2008 this year... not 2007, fixed a few entries in the changelog :)
  • BREAKING CHANGE! -- Removed TOOLHELPER API as PSAPI is simpler and toolhel is really only usefull on w9x (which I dont oficcaly support)
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • changelog

    rdd02c15 rb7ed6ac  
    66 * "The message is blocked by User Interface Privilege Isolation, Administrative applications that need to see it can allow it through by calling ChangeWindowMessageFilter after making sure the necessary security precautions are in place. " 
    77 
    8 2007-03-20 
     82008-03-21 
     9 + Added command line support for process checks 
     10   New option: cmdLine will toggle so full command lines are used instead of just process names. 
     11 + Added regular expression matching to process checks 
     12   New option: match=regexp (match=strings is the default and "old" way) 
     13 + Added substring matching to process checks 
     14   New option: match=substr (match=strings is the default and "old" way) 
     15   This is *NOT* case blind so might be hard to use, plan to add case blindness to it in the future. 
     16 : Sample command: check_nt ... -v PROCSTATE -l cmdLine,match=regexp,.*exp.* -d SHOWALL 
     17 * Ohh yeah... it is 2008 this year... not 2007, fixed a few entries in the changelog :) 
     18 - BREAKING CHANGE! -- Removed TOOLHELPER API as PSAPI is simpler and toolhel is really only usefull on w9x (which I dont oficcaly support) 
     19 
     202008-03-20 
    921 + Added host-lookupos for NSCA server (#149) 
    1022 + Added option (cache_hostname=1|0) to cache the NSCA host name (Ie. only lookup once) 
    … …  
    1325   Added option debug_skip_data_collection to simulate this (just for kicks) 
    1426 
    15 2007-03-18 
     272008-03-18 
    1628 * Added some more error mesages to the NSCA module 
    1729 * Added support for srguments to LUA module. 
    1830   syntax: function debug (command, args) -- args is a table with all arguments 
    1931 
    20 2007-03-11 MickeM 
     322008-03-11 MickeM 
    2133 ! 0.3.1 Released 
    2234 

  • include/EnumProcess.cpp

    r978bd31 rb7ed6ac  
    3434{ 
    3535  lpString = new TCHAR[MAX_FILENAME+1]; 
    36   m_hProcessSnap = INVALID_HANDLE_VALUE; 
    37   m_hModuleSnap = INVALID_HANDLE_VALUE; 
    3836 
    3937  PSAPI = ::LoadLibrary(_TEXT("PSAPI")); 
    … …  
    5553  } 
    5654 
    57   TOOLHELP = ::LoadLibrary(_TEXT("Kernel32")); 
    58   if (TOOLHELP)   
    59   { 
    60     // Setup variables 
    61     m_pe.dwSize = sizeof(m_pe); 
    62     m_me.dwSize = sizeof(m_me); 
    63     // Find ToolHelp functions 
    64 #ifdef UNICODE 
    65     FCreateToolhelp32Snapshot = (PFCreateToolhelp32Snapshot)::GetProcAddress(TOOLHELP, "CreateToolhelp32Snapshot"); 
    66     FProcess32First = (PFProcess32First)::GetProcAddress(TOOLHELP, "Process32FirstW"); 
    67     FProcess32Next = (PFProcess32Next)::GetProcAddress(TOOLHELP, "Process32NextW"); 
    68     FModule32First = (PFModule32First)::GetProcAddress(TOOLHELP, "Module32FirstW"); 
    69     FModule32Next = (PFModule32Next)::GetProcAddress(TOOLHELP, "Module32NextW"); 
    70 #else 
    71     FCreateToolhelp32Snapshot = (PFCreateToolhelp32Snapshot)::GetProcAddress(TOOLHELP, "CreateToolhelp32SnapshotA"); 
    72     FProcess32First = (PFProcess32First)::GetProcAddress(TOOLHELP, "Process32FirstA"); 
    73     FProcess32Next = (PFProcess32Next)::GetProcAddress(TOOLHELP, "Process32NextA"); 
    74     FModule32First = (PFModule32First)::GetProcAddress(TOOLHELP, "Module32FirstA"); 
    75     FModule32Next = (PFModule32Next)::GetProcAddress(TOOLHELP, "Module32NextA"); 
    76 #endif 
    77   } 
    78  
    7955  // Find the preferred method of enumeration 
    8056  m_method = ENUM_METHOD::NONE; 
    8157  int method = GetAvailableMethods(); 
    8258  if (method == (method|ENUM_METHOD::PSAPI))    m_method = ENUM_METHOD::PSAPI; 
    83   if (method == (method|ENUM_METHOD::TOOLHELP)) m_method = ENUM_METHOD::TOOLHELP; 
    84   if (method == (method|ENUM_METHOD::PROC16))   m_method += ENUM_METHOD::PROC16; 
    8559 
    8660} 
    … …  
    9266  if (m_pModules)   {delete[] m_pModules;} 
    9367  if (PSAPI) FreeLibrary(PSAPI); 
    94   if (TOOLHELP) FreeLibrary(TOOLHELP); 
    95   if (INVALID_HANDLE_VALUE != m_hProcessSnap) ::CloseHandle(m_hProcessSnap); 
    96   if (INVALID_HANDLE_VALUE != m_hModuleSnap)  ::CloseHandle(m_hModuleSnap); 
    97 } 
    98  
    99  
    100  
    101 int CEnumProcess::GetAvailableMethods() 
    102 { 
     68} 
     69 
     70 
     71 
     72int CEnumProcess::GetAvailableMethods() { 
    10373  int res = 0; 
    10474  // Does all psapi functions exist? 
    10575  if (PSAPI&&FEnumProcesses&&FEnumProcessModules&&FGetModuleFileNameEx)  
    10676    res += ENUM_METHOD::PSAPI; 
    107   // How about Toolhelp? 
    108   if (TOOLHELP&&FCreateToolhelp32Snapshot&&FProcess32Next&&FProcess32Next&&FModule32First&&FModule32Next)  
    109     res += ENUM_METHOD::TOOLHELP; 
    110  
    11177  return res; 
    11278} 
    11379 
    114 int CEnumProcess::SetMethod(int method) 
    115 { 
     80int CEnumProcess::SetMethod(int method) { 
    11681  int avail = GetAvailableMethods(); 
    117  
    118   if (method != ENUM_METHOD::PROC16 && avail == (method|avail))  
     82  if (avail == (method|avail))  
    11983    m_method = method; 
    120  
    12184  return m_method; 
    12285} 
    … …  
    13194BOOL CEnumProcess::GetProcessFirst(CEnumProcess::CProcessEntry *pEntry) 
    13295{ 
    133   if (ENUM_METHOD::NONE == m_method) return FALSE;  
    134  
    135   if ((ENUM_METHOD::TOOLHELP|m_method) == m_method) 
    136     // Use ToolHelp functions 
    137     // ---------------------- 
    138   { 
    139     m_hProcessSnap = FCreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 
    140     if (INVALID_HANDLE_VALUE == m_hProcessSnap) return FALSE; 
    141     if (!FProcess32First(m_hProcessSnap, &m_pe)) return FALSE; 
    142     pEntry->dwPID = m_pe.th32ProcessID; 
    143     pEntry->sFilename, m_pe.szExeFile; 
    144   } 
    145   else 
     96  if (ENUM_METHOD::NONE == m_method) { 
     97    return FALSE;  
     98  } else if ((ENUM_METHOD::PSAPI|m_method) == m_method) { 
    14699    // Use PSAPI functions 
    147100    // ---------------------- 
    148   { 
    149101    if (m_pProcesses) {delete[] m_pProcesses;} 
    150102    m_pProcesses = new DWORD[m_MAX_COUNT]; 
    … …  
    163115    m_cProcesses = cbNeeded/sizeof(DWORD);  
    164116    return FillPStructPSAPI(*m_pProcesses, pEntry); 
    165   } 
    166  
     117  } else { 
     118    return FALSE; 
     119  } 
    167120  return TRUE; 
    168121} 
    … …  
    173126{ 
    174127  if (ENUM_METHOD::NONE == m_method) return FALSE;  
    175   pEntry->hTask16 = 0; 
    176  
    177128 
    178129  // Use ToolHelp functions 
    179130  // ---------------------- 
    180   if ((ENUM_METHOD::TOOLHELP|m_method) == m_method) 
    181   { 
    182     if (!FProcess32Next(m_hProcessSnap, &m_pe)) return FALSE; 
    183     pEntry->dwPID = m_pe.th32ProcessID; 
    184     pEntry->sFilename = m_pe.szExeFile; 
    185   } 
    186   else 
     131  if ((ENUM_METHOD::PSAPI|m_method) == m_method) { 
    187132    // Use PSAPI functions 
    188133    // ---------------------- 
    189   { 
    190134    if (--m_cProcesses <= 0) return FALSE; 
    191135    FillPStructPSAPI(*++m_pCurrentP, pEntry); 
    192   } 
    193  
     136  } else { 
     137    return FALSE; 
     138  } 
    194139  return TRUE; 
    195140} 
    … …  
    199144{ 
    200145  if (ENUM_METHOD::NONE == m_method) return FALSE;  
    201   // Use ToolHelp functions 
    202   // ---------------------- 
    203   if ((ENUM_METHOD::TOOLHELP|m_method) == m_method) 
    204   { 
    205     if (INVALID_HANDLE_VALUE != m_hModuleSnap)  ::CloseHandle(m_hModuleSnap); 
    206     m_hModuleSnap = FCreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID); 
    207  
    208     if(!FModule32First(m_hModuleSnap, &m_me)) return FALSE; 
    209  
    210     pEntry->pLoadBase = m_me.modBaseAddr; 
    211     pEntry->sFilename = m_me.szExePath; 
    212     pEntry->pPreferredBase = GetModulePreferredBase(dwPID, m_me.modBaseAddr); 
    213     return TRUE; 
    214   } 
    215   else 
     146  if ((ENUM_METHOD::PSAPI|m_method) == m_method) { 
    216147    // Use PSAPI functions 
    217148    // ---------------------- 
    218   { 
    219149    if (m_pModules) {delete[] m_pModules;} 
    220150    m_pModules = new HMODULE[m_MAX_COUNT]; 
    … …  
    240170    } 
    241171    return FALSE; 
     172  } else { 
     173    return FALSE; 
    242174  } 
    243175} 
    … …  
    247179{ 
    248180  if (ENUM_METHOD::NONE == m_method) return FALSE;  
    249  
    250   // Use ToolHelp functions 
    251   // ---------------------- 
    252   if ((ENUM_METHOD::TOOLHELP|m_method) == m_method) 
    253   { 
    254     if(!FModule32Next(m_hModuleSnap, &m_me)) return FALSE; 
    255  
    256     pEntry->pLoadBase = m_me.modBaseAddr; 
    257     pEntry->sFilename = m_me.szExePath; 
    258     pEntry->pPreferredBase = GetModulePreferredBase(dwPID, m_me.modBaseAddr); 
    259     return TRUE; 
    260   } 
    261   else 
     181  if ((ENUM_METHOD::PSAPI|m_method) == m_method) { 
    262182    // Use PSAPI functions 
    263183    // ---------------------- 
    264   { 
    265184    if (--m_cModules <= 0) return FALSE; 
    266185    return FillMStructPSAPI(dwPID, *++m_pCurrentM, pEntry); 
    267   } 
    268  
    269 } 
    270  
     186  } else { 
     187    return FALSE; 
     188  } 
     189 
     190} 
     191 
     192 
     193BOOL CEnumProcess::EnableTokenPrivilege (LPTSTR privilege) 
     194{ 
     195  HANDLE hToken;                         
     196  TOKEN_PRIVILEGES token_privileges;                   
     197  DWORD dwSize;                         
     198  ZeroMemory (&token_privileges, sizeof (token_privileges)); 
     199  token_privileges.PrivilegeCount = 1; 
     200  if ( !OpenProcessToken (GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) 
     201    return FALSE; 
     202  if (!LookupPrivilegeValue ( NULL, privilege, &token_privileges.Privileges[0].Luid)) 
     203  {  
     204    CloseHandle (hToken); 
     205    return FALSE; 
     206  } 
     207 
     208  token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
     209  if (!AdjustTokenPrivileges ( hToken, FALSE, &token_privileges, 0, NULL, &dwSize)) 
     210  {  
     211    CloseHandle (hToken); 
     212    return FALSE; 
     213  } 
     214  CloseHandle (hToken); 
     215  return TRUE; 
     216} 
     217 
     218// Process data block is found in an NT machine. 
     219// on an Intel system at 0x00020000  which is the 32 
     220// memory page. At offset 0x0498 is what I believe to be 
     221// the process' startup directory which is followed by 
     222// the system's PATH. Next is  process full command 
     223// followed by the exe name. 
     224#define PROCESS_DATA_BLOCK_ADDRESS      (LPVOID)0x00020498 
     225// align pointer 
     226#define ALIGNMENT(x) ( (x & 0xFFFFFFFC) ? (x & 0xFFFFFFFC) + sizeof(DWORD) : x ) 
     227 
     228std::wstring CEnumProcess::GetCommandLine(HANDLE hProcess) 
     229{ 
     230  SYSTEM_INFO sysinfo; 
     231  GetSystemInfo (&sysinfo); 
     232 
     233  MEMORY_BASIC_INFORMATION mbi; 
     234  if (VirtualQueryEx (hProcess, PROCESS_DATA_BLOCK_ADDRESS, &mbi, sizeof(mbi) ) == 0) 
     235    throw EnumProcException(_T("VirtualQueryEx failed"), GetLastError()); 
     236  LPBYTE lpBuffer = (LPBYTE)malloc (sysinfo.dwPageSize); 
     237  if (lpBuffer == NULL) 
     238    throw EnumProcException(_T("Failed to allocate buffer")); 
     239  DWORD dwBytesRead; 
     240  if (!ReadProcessMemory( hProcess, mbi.BaseAddress, (LPVOID)lpBuffer, sysinfo.dwPageSize, &dwBytesRead)) { 
     241    free(lpBuffer); 
     242    throw EnumProcException(_T("ReadProcessMemory failed"), GetLastError()); 
     243  } 
     244  LPBYTE lpPos = lpPos = lpBuffer + ((DWORD)PROCESS_DATA_BLOCK_ADDRESS - (DWORD)mbi.BaseAddress); 
     245 
     246  // Skip programs current directory and path 
     247  lpPos += (wcslen((LPWSTR)lpPos) + 1) * sizeof(WCHAR); 
     248 
     249  // Aligned on a DWORD boundary skip it, and copy the next string into 
     250  // buffer and null terminate it. 
     251  lpPos = (LPBYTE)ALIGNMENT((DWORD)lpPos); 
     252  lpPos += (wcslen((LPWSTR)lpPos) + 1) * sizeof(WCHAR); 
     253 
     254  // Sometimes there is an extra \0 here 
     255  /* 
     256  if ( *lpPos == '\0' )  
     257    lpPos += sizeof(WCHAR); 
     258  */ 
     259 
     260  DWORD nStrLength = (wcslen((LPWSTR)lpPos) + 1) * sizeof(WCHAR); 
     261  WCHAR *buffer = new TCHAR[nStrLength+2]; 
     262  buffer[0] = L'\0'; 
     263  if(nStrLength > sizeof(WCHAR)) { 
     264    wcsncpy(buffer, (LPWSTR)lpPos, nStrLength); 
     265    buffer[nStrLength] = L'\0'; 
     266  } 
     267  free(lpBuffer); 
     268  std::wstring ret = buffer; 
     269  delete [] buffer; 
     270  return ret; 
     271} 
    271272 
    272273 
    … …  
    274275{ 
    275276  pEntry->dwPID = dwPID; 
    276  
    277277  // Open process to get filename 
    278   HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwPID); 
    279   if (hProc) 
    280   { 
    281     HMODULE hMod; 
    282     DWORD size; 
    283     // Get the first module (the process itself) 
    284     if( FEnumProcessModules(hProc, &hMod, sizeof(hMod), &size) ) 
    285     { 
    286       //Get filename 
    287  
    288       if( !FGetModuleFileNameEx( hProc, hMod, lpString, MAX_FILENAME) ) {  
    289         pEntry->sFilename = _T("N/A (error)"); 
    290       } else { 
    291         std::wstring path = lpString; 
    292         std::wstring::size_type pos = path.find_last_of(_T("\\")); 
    293         if (pos != std::wstring::npos) { 
    294           path = path.substr(++pos); 
    295         } 
    296         pEntry->sFilename = path; 
     278  bool bCmdLine = pEntry->getCommandLine(); 
     279  DWORD openArgs = PROCESS_QUERY_INFORMATION|PROCESS_VM_READ; 
     280  if (bCmdLine) 
     281    openArgs |= PROCESS_VM_OPERATION; 
     282  HANDLE hProc = OpenProcess(openArgs, FALSE, dwPID); 
     283  if (!hProc) { 
     284    pEntry->filename = _T("N/A (security restriction)"); 
     285    return TRUE; 
     286  } 
     287  if (bCmdLine) { 
     288    try { 
     289      pEntry->command_line = GetCommandLine(hProc); 
     290    } catch (EnumProcException &e) { 
     291      pEntry->command_line = _T("ERROR: " + e.getMessage();); 
     292    } catch (...) { 
     293      pEntry->command_line = _T("ERROR: Failed to get CommandLine."); 
     294    } 
     295  } 
     296  HMODULE hMod; 
     297  DWORD size; 
     298  // Get the first module (the process itself) 
     299  if( FEnumProcessModules(hProc, &hMod, sizeof(hMod), &size) ) { 
     300    //Get filename 
     301    //GetModuleFileNameEx 
     302 
     303    if( !FGetModuleFileNameEx( hProc, hMod, lpString, MAX_FILENAME) ) {  
     304      pEntry->filename = _T("N/A (error)"); 
     305    } else { 
     306      std::wstring path = lpString; 
     307      std::wstring::size_type pos = path.find_last_of(_T("\\")); 
     308      if (pos != std::wstring::npos) { 
     309        path = path.substr(++pos); 
    297310      } 
    298     } 
    299     CloseHandle(hProc); 
    300   } 
    301   else 
    302     pEntry->sFilename = _T("N/A (security restriction)"); 
    303  
    304   return TRUE; 
     311      pEntry->filename = path; 
     312    } 
     313  } 
     314  CloseHandle(hProc); 
    305315} 
    306316 

  • include/EnumProcess.h

    r978bd31 rb7ed6ac  
    2222 
    2323#include <psapi.h> 
    24 #include <tlhelp32.h> 
    2524#include <string> 
     25#include <error.hpp> 
    2626 
    2727 
    … …  
    3030  const int NONE    = 0x0; 
    3131  const int PSAPI   = 0x1; 
    32   const int TOOLHELP= 0x2; 
    33   const int PROC16  = 0x4; 
    3432}  
    3533 
    … …  
    4139typedef BOOL (WINAPI *PFEnumProcessModules)(HANDLE hProcess, HMODULE * lphModule, DWORD cb, LPDWORD lpcbNeeded); 
    4240typedef DWORD (WINAPI *PFGetModuleFileNameEx)(HANDLE hProcess, HMODULE hModule, LPTSTR lpFilename, DWORD nSize); 
    43  
    44 //Functions loaded from Kernel32 
    45 typedef HANDLE (WINAPI *PFCreateToolhelp32Snapshot)(DWORD dwFlags, DWORD th32ProcessID); 
    46 typedef BOOL (WINAPI *PFProcess32First)(HANDLE hSnapshot, LPPROCESSENTRY32W lppe); 
    47 typedef BOOL (WINAPI *PFProcess32Next)(HANDLE hSnapshot, LPPROCESSENTRY32W lppe); 
    48 typedef BOOL (WINAPI *PFModule32First)(HANDLE hSnapshot, LPMODULEENTRY32W lpme); 
    49 typedef BOOL (WINAPI *PFModule32Next)(HANDLE hSnapshot, LPMODULEENTRY32W lpme); 
    5041#else 
    5142// Functions loaded from PSAPI 
    … …  
    5344typedef BOOL (WINAPI *PFEnumProcessModules)(HANDLE hProcess, HMODULE * lphModule, DWORD cb, LPDWORD lpcbNeeded); 
    5445typedef DWORD (WINAPI *PFGetModuleFileNameEx)(HANDLE hProcess, HMODULE hModule, LPTSTR lpFilename, DWORD nSize); 
    55  
    56 //Functions loaded from Kernel32 
    57 typedef HANDLE (WINAPI *PFCreateToolhelp32Snapshot)(DWORD dwFlags, DWORD th32ProcessID); 
    58 typedef BOOL (WINAPI *PFProcess32First)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe); 
    59 typedef BOOL (WINAPI *PFProcess32Next)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe); 
    60 typedef BOOL (WINAPI *PFModule32First)(HANDLE hSnapshot, LPMODULEENTRY32 lpme); 
    61 typedef BOOL (WINAPI *PFModule32Next)(HANDLE hSnapshot, LPMODULEENTRY32 lpme); 
    6246#endif 
    6347 
    … …  
    6650public: 
    6751 
     52  class EnumProcException { 
     53    std::wstring error_; 
     54  public: 
     55    EnumProcException(std::wstring error) : error_(error) {} 
     56    EnumProcException(std::wstring error, DWORD code) : error_(error) { 
     57      error_ += _T(":" ) + error::format::from_system(code); 
     58    } 
     59    std::wstring getMessage() const { 
     60      return error_; 
     61    } 
     62  }; 
     63 
    6864  struct CProcessEntry 
    6965  { 
    70     std::wstring sFilename; 
     66    static const int fill_filename = 0x1; 
     67    static const int fill_command_line = 0x2; 
     68    DWORD fill; 
     69    std::wstring filename; 
     70    std::wstring command_line; 
    7171    DWORD  dwPID; 
    72     WORD   hTask16; 
    73     // Constructors/Destructors 
    74     CProcessEntry() : dwPID(0), hTask16(0) {} 
    75     CProcessEntry(CProcessEntry &e) : dwPID(e.dwPID), hTask16(e.hTask16), sFilename(e.sFilename) {} 
     72    // Constructors/Destructor 
     73    CProcessEntry() : dwPID(0), fill(0) {} 
     74    CProcessEntry(DWORD toFill) : dwPID(0), fill(toFill) {} 
     75    CProcessEntry(const CProcessEntry &e) : dwPID(e.dwPID), fill(e.fill), filename(e.filename), command_line(e.command_line) {} 
    7676    virtual ~CProcessEntry() {} 
     77    bool getCommandLine() const { return fill&fill_command_line!=0; } 
     78    bool getFilename() const { return fill&fill_filename!=0; } 
    7779  }; 
    7880 
    … …  
    9597  BOOL GetProcessNext(CProcessEntry *pEntry);     
    9698  BOOL GetProcessFirst(CProcessEntry* pEntry); 
     99  BOOL EnableTokenPrivilege(LPTSTR privilege); 
     100  std::wstring GetCommandLine(HANDLE hProcess); 
    97101 
    98102  int GetAvailableMethods(); 
    … …  
    120124  BOOL FillPStructPSAPI(DWORD pid, CProcessEntry* pEntry); 
    121125  BOOL FillMStructPSAPI(DWORD dwPID, HMODULE mMod, CModuleEntry* pEntry); 
    122  
    123   // ToolHelp related members 
    124   HANDLE m_hProcessSnap, m_hModuleSnap; 
    125   HMODULE TOOLHELP;   //Handle to the module (Kernel32) 
    126 #ifdef UNICODE 
    127   PROCESSENTRY32W m_pe; 
    128   MODULEENTRY32W  m_me; 
    129 #else 
    130   PROCESSENTRY32 m_pe; 
    131   MODULEENTRY32  m_me; 
    132 #endif 
    133   // ToolHelp related functions 
    134   PFCreateToolhelp32Snapshot FCreateToolhelp32Snapshot; 
    135   PFProcess32First FProcess32First; 
    136   PFProcess32Next  FProcess32Next; 
    137   PFModule32First  FModule32First; 
    138   PFModule32Next   FModule32Next;    
    139126  LPTSTR lpString; 
    140  
    141127}; 
    142128 

  • include/error.hpp

    r047516e rb7ed6ac  
    33#include <string> 
    44#include <windows.h> 
     5#include <strEx.h> 
    56 
    67namespace error { 

  • include/filter_framework.hpp

    r7f596ce rb7ed6ac  
    126126        } catch (const boost::bad_expression e) { 
    127127          throw handler_exception(_T("Invalid syntax in regular expression:") + str); 
     128        } catch (...) { 
     129          throw handler_exception(_T("Invalid syntax in regular expression:") + str); 
    128130        } 
    129131      } 

  • modules/CheckSystem/CheckSystem.cpp

    rdd02c15 rb7ed6ac  
    3030#include <set> 
    3131#include <sysinfo.h> 
     32#ifndef NO_BOOST_DEP 
     33#include <boost/regex.hpp> 
     34#endif 
    3235 
    3336CheckSystem gCheckSystem; 
    … …  
    6871  if (wantedMethod == C_SYSTEM_ENUMPROC_METHOD_AUTO) { 
    6972    OSVERSIONINFO osVer = systemInfo::getOSVersion(); 
     73    /* 
    7074    if (systemInfo::isBelowNT4(osVer)) { 
    7175      NSC_DEBUG_MSG_STD(_T("Autodetected NT4<, using PSAPI process enumeration.")); 
    … …  
    8488      } 
    8589    } else { 
     90    */ 
    8691      NSC_DEBUG_MSG_STD(_T("Autodetected failed, using PSAPI process enumeration.")); 
    8792      processMethod_ = ENUM_METHOD::PSAPI; 
    … …  
    9297        NSC_LOG_ERROR_STD(_T("Try this URL: http://www.microsoft.com/downloads/details.aspx?FamilyID=3d1fbaed-d122-45cf-9d46-1cae384097ac")); 
    9398      } 
    94     } 
     99    //} 
    95100  } else if (wantedMethod == C_SYSTEM_ENUMPROC_METHOD_PSAPI) { 
    96101    NSC_DEBUG_MSG_STD(_T("Using PSAPI method.")); 
    … …  
    101106    } 
    102107  } else { 
    103     NSC_DEBUG_MSG_STD(_T("Using TOOLHELP method.")); 
    104     if (method == (method|ENUM_METHOD::TOOLHELP)) { 
    105       processMethod_ = ENUM_METHOD::TOOLHELP; 
    106     } else { 
    107       NSC_LOG_ERROR_STD(_T("TOOLHELP method not avalible, check ") C_SYSTEM_ENUMPROC_METHOD _T(" option.")); 
    108     } 
     108    NSC_LOG_ERROR_STD(_T("TOOLHELP method has been removed sine we dont really want to support w9x ") C_SYSTEM_ENUMPROC_METHOD _T(".")); 
    109109  } 
    110110  try { 
    … …  
    751751} 
    752752typedef struct NSPROCDATA__ { 
    753   NSPROCDATA__() : count(0) {} 
    754   NSPROCDATA__(const NSPROCDATA__ &other) { 
    755     count = other.count; 
    756     entry = other.entry; 
    757   } 
    758  
    759753  unsigned int count; 
    760754  CEnumProcess::CProcessEntry entry; 
     755  std::wstring key; 
     756 
     757  NSPROCDATA__() : count(0) {} 
     758  NSPROCDATA__(const NSPROCDATA__ &other) : count(other.count), entry(other.entry), key(other.key) {} 
    761759} NSPROCDATA; 
    762760typedef std::map<std::wstring,NSPROCDATA,strEx::case_blind_string_compare> NSPROCLST; 
    … …  
    765763* @return a hash_map with all running processes 
    766764*/ 
    767 NSPROCLST GetProcessList(int processMethod) 
     765NSPROCLST GetProcessList(int processMethod, bool getCmdLines) 
    768766{ 
    769767  NSPROCLST ret; 
    … …  
    777775    return ret; 
    778776  } 
    779   CEnumProcess::CProcessEntry entry; 
     777  int toFill = CEnumProcess::CProcessEntry::fill_filename; 
     778  if (getCmdLines) 
     779    toFill |= CEnumProcess::CProcessEntry::fill_command_line; 
     780  CEnumProcess::CProcessEntry entry(toFill); 
    780781  for (BOOL OK = enumeration.GetProcessFirst(&entry); OK; OK = enumeration.GetProcessNext(&entry) ) { 
    781     NSPROCLST::iterator it = ret.find(entry.sFilename); 
     782    std::wstring key; 
     783    if (getCmdLines) 
     784      key = entry.command_line; 
     785    else 
     786      key = entry.filename; 
     787    NSPROCLST::iterator it = ret.find(key); 
    782788    if (it == ret.end()) { 
    783       ret[entry.sFilename].entry = entry; 
    784       ret[entry.sFilename].count = 1; 
     789      ret[key].entry = entry; 
     790      ret[key].count = 1; 
     791      ret[key].key = key; 
    785792    } else 
    786793      (*it).second.count++; 
    … …  
    812819  StateConatiner tmpObject; 
    813820  bool bPerfData = true; 
     821  bool useCmdLine = false; 
     822  typedef enum { 
     823    match_string, match_substring, match_regexp 
     824  } match_type; 
     825  match_type match = match_string; 
     826 
     827   
    814828 
    815829  tmpObject.data = _T("uptime"); 
    … …  
    822836    MAP_OPTIONS_BOOL_FALSE(IGNORE_PERFDATA, bPerfData) 
    823837    MAP_OPTIONS_BOOL_TRUE(NSCLIENT, bNSClient) 
     838    MAP_OPTIONS_BOOL_TRUE(_T("cmdLine"), useCmdLine) 
     839    MAP_OPTIONS_MODE(_T("match"), _T("string"), match,  match_string) 
     840    MAP_OPTIONS_MODE(_T("match"), _T("regexp"), match,  match_regexp) 
     841    MAP_OPTIONS_MODE(_T("match"), _T("substr"), match,  match_substring) 
     842    MAP_OPTIONS_MODE(_T("match"), _T("substring"), match,  match_substring) 
    824843    MAP_OPTIONS_SECONDARY_BEGIN(_T(":"), p2) 
    825844  else if (p2.first == _T("Proc")) { 
    … …  
    840859  MAP_OPTIONS_END() 
    841860 
    842  
    843861  NSPROCLST runningProcs; 
    844862  try { 
    845     runningProcs = GetProcessList(processMethod_); 
     863    runningProcs = GetProcessList(processMethod_, useCmdLine); 
    846864  } catch (TCHAR *c) { 
    847865    NSC_LOG_ERROR_STD(_T("ERROR: ") + c); 
    … …  
    851869 
    852870  for (std::list<StateConatiner>::iterator it = list.begin(); it != list.end(); ++it) { 
    853     NSPROCLST::iterator proc = runningProcs.find((*it).data); 
     871    NSPROCLST::iterator proc; 
     872    if (match == match_string) { 
     873      proc = runningProcs.find((*it).data); 
     874    } else if (match == match_substring) { 
     875      for (proc=runningProcs.begin();proc!=runningProcs.end();++proc) { 
     876        if ((*proc).first.find((*it).data) != std::wstring::npos) 
     877          break; 
     878      } 
     879#ifndef NO_BOOST_DEP 
     880    } else if (match == match_regexp) { 
     881      try { 
     882        boost::wregex filter((*it).data,boost::regex::icase); 
     883        for (proc=runningProcs.begin();proc!=runningProcs.end();++proc) { 
     884          std::wstring value = (*proc).first; 
     885          if (boost::regex_match(value, filter)) 
     886            break; 
     887        } 
     888      } catch (const boost::bad_expression e) { 
     889        NSC_LOG_ERROR_STD(_T("Failed to compile regular expression: ") + (*proc).first); 
     890        msg = _T("Failed to compile regular expression: ") + (*proc).first; 
     891        return NSCAPI::returnUNKNOWN; 
     892      } catch (...) { 
     893        NSC_LOG_ERROR_STD(_T("Failed to compile regular expression: ") + (*proc).first); 
     894        msg = _T("Failed to compile regular expression: ") + (*proc).first; 
     895        return NSCAPI::returnUNKNOWN; 
     896      } 
     897#endif 
     898    } else { 
     899      NSC_LOG_ERROR_STD(_T("Unsupported mode for: ") + (*proc).first); 
     900      msg = _T("Unsupported mode for: ") + (*proc).first; 
     901      return NSCAPI::returnUNKNOWN; 
     902    } 
    854903    bool bFound = (proc != runningProcs.end()); 
    855     std::wstring tmp; 
    856     TNtServiceInfo info; 
    857904    if (bNSClient) { 
    858905      if (bFound && (*it).showAll()) { 
    859906        if (!msg.empty()) msg += _T(" - "); 
    860         msg += (*it).data + _T(": Running"); 
     907        msg += (*proc).first + _T(": Running"); 
    861908      } else if (bFound) { 
    862909      } else { 
    … …  
    873920        value.count = 0; 
    874921        value.state = checkHolders::state_stopped; 
     922      } 
     923      if (bFound && (*it).alias.empty()) { 
     924        (*it).alias = (*proc).first; 
    875925      } 
    876926      (*it).perfData = bPerfData; 

  • modules/LUAScript/script_wrapper.hpp

    rd76af81 rb7ed6ac  
    4545    return strEx::string_to_wstring(s); 
    4646  } 
    47  
    48  
    49  
    50  
    51   class Account { 
    52     lua_Number m_balance; 
    53   public: 
    54     static const char className[]; 
    55     static Luna<Account>::RegType methods[]; 
    56  
    57     Account(lua_State *L)      { m_balance = luaL_checknumber(L, 1); } 
    58     int inject(lua_State *L) { 
    59       m_balance += luaL_checknumber(L, 1); return 0;  
    60     } 
    61     int withdraw(lua_State *L) { m_balance -= luaL_checknumber(L, 1); return 0; } 
    62     int balance (lua_State *L) { lua_pushnumber(L, m_balance); return 1; } 
    63     ~Account() { printf("deleted Account (%p)\n", this); } 
    64   }; 
    65  
    66   const char Account::className[] = "Account"; 
    67  
    68   #define method(class, name) {#name, &class::name} 
    69  
    70   Luna<Account>::RegType Account::methods[] = { 
    71     method(Account, inject), 
    72     method(Account, withdraw), 
    73     method(Account, balance), 
    74     {0,0} 
    75   }; 
     47  typedef std::pair<std::wstring,int> where_type; 
     48  where_type where(lua_State *L, int level = 1) { 
     49    lua_Debug ar; 
     50    if (lua_getstack(L, level, &ar)) {  /* check function at level */ 
     51      lua_getinfo(L, "Sl", &ar);  /* get info about it */ 
     52      if (ar.currentline > 0) {  /* is there info? */ 
     53        return where_type(s2w(ar.short_src), ar.currentline); 
     54      } 
     55    } 
     56    return where_type(_T("unknown"),0); 
     57  } 
    7658  std::wstring extract_string(lua_State *L) { 
    7759    return strEx::string_to_wstring(lua_tostring( L, lua_gettop( L ) )); 
    … …  
    120102    lua_pushstring(L, strEx::wstring_to_string(_T("unknown")).c_str()); 
    121103  } 
    122  
    123   static int inject(lua_State *L) { 
    124     int nargs = lua_gettop( L ); 
    125     unsigned int argLen = nargs-1; 
    126     arrayBuffer::arrayBuffer arguments = arrayBuffer::createArrayBuffer(argLen); 
    127     for (unsigned int i=argLen;i>0;i--) { 
    128       std::wstring arg = extract_string(L); 
    129       arrayBuffer::set(arguments, argLen, i-1, arg); 
    130       lua_pop(L, 1); 
    131     } 
    132     std::wstring command = extract_string(L); 
    133     lua_pop(L, 1); 
    134  
    135     std::wstring msg; 
    136     std::wstring perf; 
    137     NSCAPI::nagiosReturn ret = NSCModuleHelper::InjectCommand(command.c_str(), argLen, arguments, msg, perf); 
    138     push_code(L, ret); 
    139     lua_pushstring(L, strEx::wstring_to_string(msg).c_str()); 
    140     lua_pushstring(L, strEx::wstring_to_string(perf).c_str()); 
    141     return 3; 
     104  void push_string(lua_State *L, std::wstring s) { 
     105    lua_pushstring(L, strEx::wstring_to_string(s).c_str()); 
    142106  } 
    143107 
    … …  
    198162 
    199163  }; 
     164  class nsclient_wrapper { 
     165  public: 
     166 
     167    static int execute (lua_State *L) { 
     168      try { 
     169        int nargs = lua_gettop( L ); 
     170        if (nargs == 0) { 
     171          return luaL_error(L, "nscp.execute requires atleast 1 argument!"); 
     172        } 
     173        unsigned int argLen = nargs-1; 
     174        arrayBuffer::arrayBuffer arguments = arrayBuffer::createArrayBuffer(argLen); 
     175        for (unsigned int i=argLen;i>0;i--) { 
     176          std::wstring arg = extract_string(L); 
     177          arrayBuffer::set(arguments, argLen, i-1, arg); 
     178          lua_pop(L, 1); 
     179        } 
     180        std::wstring command = extract_string(L); 
     181        lua_pop(L, 1); 
     182        std::wstring msg; 
     183        std::wstring perf; 
     184        NSCAPI::nagiosReturn ret = NSCModuleHelper::InjectCommand(command.c_str(), argLen, arguments, msg, perf); 
     185        push_code(L, ret); 
     186        lua_pushstring(L, strEx::wstring_to_string(msg).c_str()); 
     187        lua_pushstring(L, strEx::wstring_to_string(perf).c_str()); 
     188        return 3; 
     189      } catch (...) { 
     190        return luaL_error(L, "Unknown exception in: nscp.execute"); 
     191      } 
     192    } 
     193 
     194    static int register_command(lua_State *L) { 
     195      try { 
     196        lua_handler *handler = lua_manager::get_handler(L); 
     197        lua_script *script = lua_manager::get_script(L); 
     198        int nargs = lua_gettop( L ); 
     199        if (nargs != 2) 
     200          return luaL_error(L, "Incorrect syntax: nscp.register(<key>, <function>);"); 
     201        handler->register_command(script, pop_string(L), pop_string(L)); 
     202        return 0; 
     203      } catch (LUAException e) { 
     204        return luaL_error(L, std::string("Error in nscp.register: " + w2s(e.getMessage())).c_str()); 
     205      } catch (...) { 
     206        return luaL_error(L, "Unknown exception in: nscp.register"); 
     207      } 
     208    } 
     209 
     210    static int getSetting (lua_State *L) { 
     211      int nargs = lua_gettop( L ); 
     212      if (nargs < 2 || nargs > 3) 
     213        return luaL_error(L, "Incorrect syntax: nscp.getSetting(<section>, <key>[, <default value>]);"); 
     214      std::wstring v; 
     215      if (nargs > 2) 
     216        v = pop_string(L); 
     217      std::wstring k = pop_string(L); 
     218      std::wstring s = pop_string(L); 
     219      push_string(L, NSCModuleHelper::getSettingsString(s, k, v)); 
     220      return 1; 
     221    } 
     222    static int getSection (lua_State *L) { 
     223      NSC_DEBUG_MSG_STD(_T("LUA::setSettings")); 
     224      return 0; 
     225    } 
     226    static int info (lua_State *L) { 
     227      return log_any(L, NSCAPI::log); 
     228    } 
     229    static int error (lua_State *L) { 
     230      return log_any(L, NSCAPI::error); 
     231    } 
     232    static int log_any(lua_State *L, int mode) { 
     233      where_type w = where(L); 
     234      int nargs = lua_gettop( L ); 
     235      std::wstring str; 
     236      for (int i=0;i<nargs;i++) { 
     237        str += pop_string(L); 
     238      } 
     239      NSCModuleHelper::Message(mode, w.first, w.second, str); 
     240      return 0; 
     241    } 
     242 
     243    static const luaL_Reg my_funcs[]; 
     244 
     245    static int luaopen(lua_State *L) { 
     246      luaL_register(L, "nscp", my_funcs); 
     247      return 1; 
     248    } 
     249 
     250 
     251  }; 
     252  const luaL_Reg nsclient_wrapper::my_funcs[] = { 
     253    {"execute", execute}, 
     254    {"info", info}, 
     255    {"print", info}, 
     256    {"error", error}, 
     257    {"register", register_command}, 
     258    {"getSetting", getSetting}, 
     259    {"getSection", getSection}, 
     260    {NULL, NULL} 
     261  }; 
     262 
    200263  lua_manager::handler_type lua_manager::handlers; 
    201264  lua_manager::script_type lua_manager::scripts; 
    202265  double lua_manager::last_value = 0; 
    203266  char lua_manager::handler_key[] = "registry.key.handler"; 
    204   char lua_manager::script_key[] = "registry.key.sctrip"; 
    205  
    206   static int register_command(lua_State *L) { 
    207     try { 
    208       lua_handler *handler = lua_manager::get_handler(L); 
    209       lua_script *script = lua_manager::get_script(L); 
    210       int nargs = lua_gettop( L ); 
    211       if (nargs < 2) { 
    212         return luaL_error(L, "Missing argument for register_command! usage: register_command(<key>, <function>);"); 
    213       } 
    214       if (nargs > 2) { 
    215         return luaL_error(L, "To many arguments for register_command! usage: register_command(<key>, <function>);"); 
    216       } 
    217       handler->register_command(script, pop_string(L), pop_string(L)); 
    218       return 0; 
    219     } catch (LUAException e) { 
    220       return luaL_error(L, std::string("Error: " + w2s(e.getMessage())).c_str()); 
    221     } catch (...) { 
    222       return luaL_error(L, "Unknown exception in: register_command"); 
    223     } 
    224   } 
     267  char lua_manager::script_key[] = "registry.key.script"; 
     268 
    225269  class lua_script { 
    226270    Lua_State L; 
    … …  
    232276    void load() { 
    233277      luaL_openlibs(L); 
     278      nsclient_wrapper::luaopen(L); 
    234279      //Luna<Account>::Register(L); 
    235       lua_register(L, "inject", inject); 
    236       lua_register(L, "register_command", register_command); 
     280      //lua_register(L, "register_command", register_command); 
    237281 
    238282      if (luaL_loadfile(L, strEx::wstring_to_string(script_).c_str()) != 0) { 
Note: See TracChangeset for help on using the changeset viewer.