NSClient++ 0.18.1 다운로드

# Security hardening and bugfixes of monitoring clients

0.18.1 is a security and correctness release for the passive/outbound side of
the agent. A review pass over the client modules — Icinga, NRDP, NSCA, NSCA-NG,
check_mk, Elastic, Graphite, syslog, and a second round on SMTP — turned up the
same three shapes over and over：**configuration that parsed fine and was then
thrown away**, **network operations that could never time out**, and
**attacker-influenced text reaching another system's log unscrubbed**. The
external-script launcher and the filter framework got the same treatment.

The most consequential single item is NSCA-NG cert mode, which applied its TLS
configuration too late and therefore accepted any server certificate. Alongside
the hardening, the Elastic module can finally talk to a current Elasticsearch,
the web UI moves to MUI 9 / react-router 8 with its test suites wired into CI,
and a coverage sweep adds unit tests to every source file that was under 50%.

## ✨ Highlights

• 🔐 **NSCA-NG cert mode verifies the server again — and presents your client
certificate.** The OpenSSL context was configured *after* the TLS stream was
created from it, and `SSL_new()` copies the verify mode, certificate, cipher
list and version bounds at creation time. So `verify mode = peer-cert` ran
with verification off, any certificate was accepted, and the configured client
certificate was never sent. The default PSK mode was never affected. (#1461)
• 🧾 **Configuration that silently did nothing now applies.** check_mk client
targets discarded every TLS key (`use ssl`, `certificate`, `verify mode`, …)
and connected in plaintext regardless; syslog targets never read `severity`,
`facility`, `tag_syntax` or `message_syntax`; `NSCAServer`'s
`performance data = false` was ignored; and `ext-scr install --arguments=…`
wrote its lockdown to a key the module does not read. All four are fixed.
• ⏱️ **A stalled endpoint can no longer wedge a submitting thread forever.**
Icinga, NRDP, Graphite and Elastic submissions all ran with no deadline; each
is now bounded by the target's `timeout` (default 30 s) as a single budget
over resolve, connect, handshake and exchange. External scripts enforce their
`timeout` by wall clock on both platforms. (#1464, #1465, #1466, #1467, #1468,
#1453)
• 🔎 **The Elastic module works against Elasticsearch 8 — and verifies TLS.**
Verification was hardcoded off; it now defaults to `peer` with `tls version`,
`verify mode` and `ca` settings, plus new `user`/`password` and `api key`
authentication. The legacy `_type` parameter is no longer sent by default, and
every document in a bulk request gets its own `_id` — previously they shared
one and overwrote each other. (#1453)
• 🔒 **`tls version = 1.2+` means "1.2 or later" again.** The `+` was stripped
and the value mapped onto a version-pinned method, which pins the *maximum*
too — so the common default negotiated TLS 1.2 only and silently excluded
TLS 1.3. Fixed in the shared stack：all HTTP-based clients, the NRPE/NSCA
socket clients and servers, and `check_tcp`. (#1464)
• 📨 **Syslog datagrams carry the RFC 3164 HOSTNAME field**, so a conforming
receiver stops promoting the tag to origin host — which meant check output
could choose which host a record was filed under. An unknown `severity` or
`facility` now degrades to `<13>` (user.notice) instead of `<0>`,
kernel.**emergency**. (#1470)
• 🧱 **Filter expressions are bounded** at 1024 characters and 64 nesting levels.
The parser and the AST evaluator both recurse with the shape of the input, so
a long or deeply nested expression could exhaust the stack and crash the
agent. Real filters sit an order of magnitude below the limits. (#1469)
• 🖥️ **The web UI moves to MUI 9, react-router 8 and TypeScript 6**, with its 65
vitest unit tests and 18 Playwright integration tests now running in CI on
every build. (#1459)

## 🔍 Detailed changes

### 🔐 NSCA-NG — cert mode applies TLS configuration before the stream exists

`use psk = false` targets built the `ssl::context`, created the connection from
it, and *then* set the verify mode, client certificate, cipher list and TLS
version bounds. OpenSSL copies all of that out of the context when the stream is
created, so none of it took effect：`verify mode = peer-cert` accepted a
man-in-the-middle's certificate, and a server asking for a client certificate
never got one. Configuration is applied first now.

Two visible consequences：a cert-mode target whose server certificate does not
chain to the configured `ca` (or does not match the host name) will now fail to
connect — that is the verification working — and servers requiring a client
certificate will start receiving it. The default PSK mode authenticates both
ends through the pre-shared key and is unaffected.

### 🧾 Settings that were read but never applied

| Module | Setting(s) | What happened |
|--------|------------|---------------|
| `CheckMKClient` | `use ssl`, `certificate`, `certificate key`, `ca`, `allowed ciphers`, `verify mode`, `dh` | The target object never called `register_all()`/`notify()`, so the keys were parsed and thrown away — the client connected in plaintext whatever the configuration said, and the keys were missing from the reference docs. |
| `SyslogClient` | `severity`, `facility`, `tag_syntax`, `message_syntax`, `ok-severity`/`warning-severity`/`critical-severity`/`unknown-severity` | Stored under keys the sender never read, so built-in defaults always won：a settings-defined target sent an empty tag and dropped the message text. |
| `NSCAServer` | `performance data = false` | Ignored; perfdata is stripped from forwarded submissions again, as documented. |
| `CheckExternalScripts` | `ext-scr install --arguments=…` | Wrote the lockdown to a path nothing reads, so it reported success while leaving arguments enabled. Re-run it after upgrading. |
| `GraphiteClient` | `timeout` | Looked up in the free-form option map, where the well-known `timeout` key is not stored — the default 30 always won. |

Values you configured — possibly years ago, without effect — now apply. Review
those target sections for stale keys before upgrading.

### ⏱️ Operations that could never time out

Each of these ran with no deadline, so an endpoint that accepted the connection
and then went silent held the submitting thread indefinitely, quietly stopping
passive results until a service restart.

• **Icinga**, **NRDP**, **Graphite** (both the submission and the recurring
metrics flush) and **Elastic** are now bounded by the configured `timeout`
(default 30 s; 10 s for one-shot `nscp client` submissions) as one budget
covering name resolution, connect, TLS handshake and the exchange. NRDP also
retries transport failures up to `retry`, each attempt on a fresh connection.
• **Graphite's `retry` is gone.** It never had any effect — the module always
made exactly one attempt — and a retry loop would multiply the worst-case time
a stalled endpoint can hold a thread. It is still registered centrally for all
client modules, so it remains in the reference, but `GraphiteClient` does not
act on it. Mirrors the SMTP `retry` change in 0.18.0.
• **External scripts.** On Unix the single-string shell fallback ran through
`popen()`, which hides the child PID, so `timeout=` was unenforced and a hung
script wedged a worker thread per invocation. On Windows the read loop counted
iterations rather than elapsed time, so a continuously chatty script escaped
the timeout entirely and leaked an unkillable process each run. Both launchers
now bound the wait by wall-clock deadline, with captured output capped at
8 MiB.
• **SMTP** already bounded its submission, but a budget that expired mid-connect
left the cancelled operation's completion handler queued — to be run by the
retry against the next resolved address, with references into a stack frame
that no longer existed. Handler state is heap-owned now, and a spent budget
ends the endpoint walk instead of retrying into it. (#1471)

### 🧹 Injection, scrubbing and resource limits

• **Graphite status paths** go through the same scrub as the perf path. The
`${check_alias}` substituted into them can come from a remote submitter, so an
alias carrying a newline injected an extra, attacker-chosen metric line into
Graphite (and a `;` injected carbon tags) — a way to hide a real problem or
fabricate one. (#1465, #1467)
• **Inbound NSCA wire fields** are validated before they reach the logs and the
inbox channel：control characters are stripped from host and service names,
and a return code outside 0–3 is clamped to UNKNOWN instead of flowing on as
an arbitrary 16-bit integer. (#1460)
• **SMTP reply text is rendered inert before it is logged.** Anything outside
printable US-ASCII is replaced — the C0 controls *and* the C1 range
(0x80–0x9F), which carries single-byte terminal escapes such as CSI — so a
multi-line reply can no longer forge extra log lines. The reply to `STARTTLS`
must be exactly `220` per RFC 3207 rather than any `2xx`, and AUTH credentials
containing a NUL are refused before connecting. (#1471)
• **Buffers are bounded.** An NRDP response body is capped at 5 MB (previously
unbounded — a hostile server, or a man in the middle on a plain `http://`
target, could stream the agent out of memory), and an SMTP reply at 64 KB per
line and 100 lines. Nothing previously capped how much a peer could make the
client buffer *inside* its timeout window, so bytes without a line ending, or
endless `250-` continuations, turned a 30-second budget into gigabytes.
• **Credentials are masked in the trace log.** The trace-level target dump
printed raw `password` / `token` values; the fix is in the shared client
machinery, so ev