Update to SSL cert age checks (-X for critical)
Mike Lindsey <[email protected]>
| Newsgroups | gmane.network.nagios.plugins.devel |
|---|---|
| Message-ID | <[email protected]> |
At my work it's a critical issue if an SSL cert is going to expire in less time than it takes to order and install the cert. If the cert's actually expired, it's too late. So, I went and added an option to have check_http throw a critical, instead of a warning on a soon-to-expire cert. Since check_tcp and check_smtp both import sslutils.c, I added the feature there as well. I would have loved to use -W and -C, but I didn't want to break backwards compatibility on any of these plugins. Should I just be checking this into the Git repository? -- Mike Lindsey ------------------------------------------------------------------------------ Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex infrastructure or vast IT resources to deliver seamless, secure access to virtual desktops. With this all-in-one solution, easily deploy virtual desktops for less than the cost of PCs and save 60% on VDI infrastructure costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox _______________________________________________________ Nagios Plugin Development Mailing List Nagiosplug-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Unsubscribe at https://lists.sourceforge.net/lists/listinfo/nagiosplug-devel ::: Please include plugins version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null
certificatecrit.patch
(text/plain, 17.5 KB)
*** nagios-plugins-1.4.15/plugins/sslutils.c 2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/sslutils.c 2011-12-29 15:57:25.000000000 -0800
***************
*** 94,100 ****
return SSL_read(s, buf, num);
}
! int np_net_ssl_check_cert(int days_till_exp){
# ifdef USE_OPENSSL
X509 *certificate=NULL;
ASN1_STRING *tm;
--- 94,100 ----
return SSL_read(s, buf, num);
}
! int np_net_ssl_check_cert(int days_till_exp, int days_till_exp_crit){
# ifdef USE_OPENSSL
X509 *certificate=NULL;
ASN1_STRING *tm;
***************
*** 154,171 ****
stamp.tm_mon + 1,
stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
! if (days_left > 0 && days_left <= days_till_exp) {
! printf (_("WARNING - Certificate expires in %d day(s) (%s).\n"), days_left, timestamp);
! return STATE_WARNING;
! } else if (time_left < 0) {
printf (_("CRITICAL - Certificate expired on %s.\n"), timestamp);
return STATE_CRITICAL;
} else if (days_left == 0) {
printf (_("WARNING - Certificate expires today (%s).\n"), timestamp);
return STATE_WARNING;
}
printf (_("OK - Certificate will expire on %s.\n"), timestamp);
X509_free (certificate);
return STATE_OK;
# else /* ifndef USE_OPENSSL */
--- 154,175 ----
stamp.tm_mon + 1,
stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
! if (time_left < 0) {
printf (_("CRITICAL - Certificate expired on %s.\n"), timestamp);
return STATE_CRITICAL;
+ } else if (days_till_exp_crit > 0 && days_left <= days_till_exp_crit) {
+ printf (_("CRITICAL - Certificate expires in %d day(s) (%s).\n"), days_left, timestamp);
+ return STATE_CRITICAL;
+ } else if (days_left > 0 && days_left <= days_till_exp) {
+ printf (_("WARNING - Certificate expires in %d day(s) (%s).\n"), days_left, timestamp);
+ return STATE_WARNING;
} else if (days_left == 0) {
printf (_("WARNING - Certificate expires today (%s).\n"), timestamp);
return STATE_WARNING;
}
printf (_("OK - Certificate will expire on %s.\n"), timestamp);
+ printf (_("Days_left: %i; Days_till_exp_crit: %i\n"), days_left, days_till_exp_crit);
X509_free (certificate);
return STATE_OK;
# else /* ifndef USE_OPENSSL */
*** nagios-plugins-1.4.15/plugins/check_http.c 2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/check_http.c 2011-12-29 15:51:33.000000000 -0800
***************
*** 58,64 ****
#ifdef HAVE_SSL
int check_cert = FALSE;
! int days_till_exp;
char *randbuff;
X509 *server_cert;
# define my_recv(buf, len) ((use_ssl) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
--- 58,65 ----
#ifdef HAVE_SSL
int check_cert = FALSE;
! int days_till_exp = 0;
! int days_till_exp_crit = 0;
char *randbuff;
X509 *server_cert;
# define my_recv(buf, len) ((use_ssl) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
***************
*** 206,211 ****
--- 207,213 ----
{"linespan", no_argument, 0, 'l'},
{"onredirect", required_argument, 0, 'f'},
{"certificate", required_argument, 0, 'C'},
+ {"certificatecrit", required_argument, 0, 'X'},
{"useragent", required_argument, 0, 'A'},
{"header", required_argument, 0, 'k'},
{"no-body", no_argument, 0, 'N'},
***************
*** 235,241 ****
}
while (1) {
! c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:e:p:s:R:r:u:f:C:nlLSm:M:N", longopts, &option);
if (c == -1 || c == EOF)
break;
--- 237,243 ----
}
while (1) {
! c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:e:p:s:R:r:u:f:C:X:nlLSm:M:N", longopts, &option);
if (c == -1 || c == EOF)
break;
***************
*** 291,305 ****
display_html = FALSE;
break;
case 'C': /* Check SSL cert validity */
! #ifdef HAVE_SSL
if (!is_intnonneg (optarg))
usage2 (_("Invalid certificate expiration period"), optarg);
else {
days_till_exp = atoi (optarg);
check_cert = TRUE;
}
! /* Fall through to -S option */
#endif
case 'S': /* use SSL */
#ifndef HAVE_SSL
usage4 (_("Invalid option - SSL is not available"));
--- 293,325 ----
display_html = FALSE;
break;
case 'C': /* Check SSL cert validity */
! #ifndef HAVE_SSL
! usage4 (_("Invalid option - SSL is not available"));
! #endif
if (!is_intnonneg (optarg))
usage2 (_("Invalid certificate expiration period"), optarg);
else {
days_till_exp = atoi (optarg);
check_cert = TRUE;
}
! use_ssl = TRUE;
! if (specify_port == FALSE)
! server_port = HTTPS_PORT;
! break;
! case 'X': /* Check SSL cert validity and throw Critical */
! #ifndef HAVE_SSL
! usage4 (_("Invalid option - SSL is not available"));
#endif
+ if (!is_intnonneg (optarg))
+ usage2 (_("Invalid critical certificate expiration period"), optarg);
+ else {
+ days_till_exp_crit = atoi (optarg);
+ check_cert = TRUE;
+ }
+ use_ssl = TRUE;
+ if (specify_port == FALSE)
+ server_port = HTTPS_PORT;
+ break;
case 'S': /* use SSL */
#ifndef HAVE_SSL
usage4 (_("Invalid option - SSL is not available"));
***************
*** 809,815 ****
if (use_ssl == TRUE) {
np_net_ssl_init_with_hostname(sd, (use_sni ? host_name : NULL));
if (check_cert == TRUE) {
! result = np_net_ssl_check_cert(days_till_exp);
np_net_ssl_cleanup();
if (sd) close(sd);
return result;
--- 829,835 ----
if (use_ssl == TRUE) {
np_net_ssl_init_with_hostname(sd, (use_sni ? host_name : NULL));
if (check_cert == TRUE) {
! result = np_net_ssl_check_cert(days_till_exp, days_till_exp_crit);
np_net_ssl_cleanup();
if (sd) close(sd);
return result;
***************
*** 1342,1347 ****
--- 1362,1371 ----
printf (" %s\n", "-C, --certificate=INTEGER");
printf (" %s\n", _("Minimum number of days a certificate has to be valid. Port defaults to 443"));
printf (" %s\n", _("(when this option is used the URL is not checked.)\n"));
+ printf (" %s\n", "-X, --certificatecrit=INTEGER");
+ printf (" %s\n", _("Minimum number of days a certificate has to be valid. Returns Critical."));
+ printf (" %s\n", _("Port defaults to 443"));
+ printf (" %s\n", _("(when this option is used the URL is not checked.)\n"));
#endif
printf (" %s\n", "-e, --expect=STRING");
***************
*** 1419,1429 ****
printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
printf (" %s\n\n", _("a STATE_CRITICAL will be returned."));
! printf (" %s\n\n", "CHECK CERTIFICATE: check_http -H www.verisign.com -C 14");
printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
! printf (" %s\n", _("the certificate is expired."));
#endif
printf (UT_SUPPORT);
--- 1443,1453 ----
printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
printf (" %s\n\n", _("a STATE_CRITICAL will be returned."));
! printf (" %s\n\n", "CHECK CERTIFICATE: check_http -H www.verisign.com -C 14 -X 7");
printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
! printf (" %s\n", _("the certificate is expired (if -X is not passed) or valid for fewer than 7 days."));
#endif
printf (UT_SUPPORT);
***************
*** 1441,1446 ****
printf (" [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]\n");
printf (" [-e <expect>] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
printf (" [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
! printf (" [-A string] [-k string] [-S] [--sni] [-C <age>] [-T <content-type>]\n");
! printf (" [-j method]\n");
}
--- 1465,1470 ----
printf (" [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]\n");
printf (" [-e <expect>] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
printf (" [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
! printf (" [-A string] [-k string] [-S] [--sni] [-C <age>] [-X <age>]\n");
! printf (" [-T <content-type>] [-j method]\n");
}
*** nagios-plugins-1.4.15/plugins/check_smtp.c 2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/check_smtp.c 2011-12-29 16:03:04.000000000 -0800
***************
*** 41,47 ****
#ifdef HAVE_SSL
int check_cert = FALSE;
! int days_till_exp;
# define my_recv(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
# define my_send(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
#else /* ifndef HAVE_SSL */
--- 41,48 ----
#ifdef HAVE_SSL
int check_cert = FALSE;
! int days_till_exp = 0;
! int days_till_exp_crit = 0;
# define my_recv(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
# define my_send(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
#else /* ifndef HAVE_SSL */
***************
*** 271,277 ****
# ifdef USE_OPENSSL
if ( check_cert ) {
! result = np_net_ssl_check_cert(days_till_exp);
if(result != STATE_OK){
printf ("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
}
--- 272,278 ----
# ifdef USE_OPENSSL
if ( check_cert ) {
! result = np_net_ssl_check_cert(days_till_exp, days_till_exp_crit);
if(result != STATE_OK){
printf ("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
}
***************
*** 476,481 ****
--- 477,483 ----
{"help", no_argument, 0, 'h'},
{"starttls",no_argument,0,'S'},
{"certificate",required_argument,0,'D'},
+ {"certificatecrit",required_argument,0,'X'},
{0, 0, 0, 0}
};
***************
*** 492,498 ****
}
while (1) {
! c = getopt_long (argc, argv, "+hVv46t:p:f:e:c:w:H:C:R:SD:F:A:U:P:",
longopts, &option);
if (c == -1 || c == EOF)
--- 494,500 ----
}
while (1) {
! c = getopt_long (argc, argv, "+hVv46t:p:f:e:c:w:H:C:X:R:SD:F:A:U:P:",
longopts, &option);
if (c == -1 || c == EOF)
***************
*** 603,608 ****
--- 605,621 ----
usage (_("SSL support not available - install OpenSSL and recompile"));
#endif
break;
+ case 'X':
+ /* Check SSL cert validity, return Critical */
+ #ifdef USE_OPENSSL
+ if (!is_intnonneg (optarg))
+ usage2 ("Invalid certificate expiration period",optarg);
+ days_till_exp_crit = atoi (optarg);
+ check_cert = TRUE;
+ #else
+ usage (_("SSL support not available - install OpenSSL and recompile"));
+ #endif
+ break;
case '4':
address_family = AF_INET;
break;
***************
*** 787,792 ****
--- 800,807 ----
#ifdef HAVE_SSL
printf (" %s\n", "-D, --certificate=INTEGER");
printf (" %s\n", _("Minimum number of days a certificate has to be valid."));
+ printf (" %s\n", "-X, --certificatecrit=INTEGER");
+ printf (" %s\n", _("Minimum number of days a certificate has to be valid before Critical."));
printf (" %s\n", "-S, --starttls");
printf (" %s\n", _("Use STARTTLS for the connection."));
#endif
***************
*** 821,826 ****
printf ("%s\n", _("Usage:"));
printf ("%s -H host [-p port] [-e expect] [-C command] [-f from addr]", progname);
printf ("[-A authtype -U authuser -P authpass] [-w warn] [-c crit] [-t timeout]\n");
! printf ("[-F fqdn] [-S] [-D days] [-v] [-4|-6]\n");
}
--- 836,841 ----
printf ("%s\n", _("Usage:"));
printf ("%s -H host [-p port] [-e expect] [-C command] [-f from addr]", progname);
printf ("[-A authtype -U authuser -P authpass] [-w warn] [-c crit] [-t timeout]\n");
! printf ("[-F fqdn] [-S] [-D days] [-X critdays] [-v] [-4|-6]\n");
}
*** nagios-plugins-1.4.15/plugins/check_tcp.c 2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/check_tcp.c 2011-12-29 16:03:29.000000000 -0800
***************
*** 39,45 ****
#ifdef HAVE_SSL
static int check_cert = FALSE;
! static int days_till_exp;
# define my_recv(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
# define my_send(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
#else
--- 39,46 ----
#ifdef HAVE_SSL
static int check_cert = FALSE;
! static int days_till_exp = 0;
! static int days_till_exp_crit = 0;
# define my_recv(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
# define my_send(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
#else
***************
*** 235,241 ****
if (flags & FLAG_SSL){
result = np_net_ssl_init(sd);
if (result == STATE_OK && check_cert == TRUE) {
! result = np_net_ssl_check_cert(days_till_exp);
if(result != STATE_OK) {
printf(_("CRITICAL - Cannot retrieve server certificate.\n"));
}
--- 236,242 ----
if (flags & FLAG_SSL){
result = np_net_ssl_init(sd);
if (result == STATE_OK && check_cert == TRUE) {
! result = np_net_ssl_check_cert(days_till_exp, days_till_exp_crit);
if(result != STATE_OK) {
printf(_("CRITICAL - Cannot retrieve server certificate.\n"));
}
***************
*** 411,416 ****
--- 412,418 ----
{"help", no_argument, 0, 'h'},
{"ssl", no_argument, 0, 'S'},
{"certificate", required_argument, 0, 'D'},
+ {"certificatecrit", required_argument, 0, 'X'},
{0, 0, 0, 0}
};
***************
*** 435,441 ****
}
while (1) {
! c = getopt_long (argc, argv, "+hVv46EAH:s:e:q:m:c:w:t:p:C:W:d:Sr:jD:M:",
longopts, &option);
if (c == -1 || c == EOF || c == 1)
--- 437,443 ----
}
while (1) {
! c = getopt_long (argc, argv, "+hVv46EAH:s:e:q:m:c:w:t:p:C:X:W:d:Sr:jD:M:",
longopts, &option);
if (c == -1 || c == EOF || c == 1)
***************
*** 563,568 ****
--- 565,582 ----
break;
# endif /* USE_OPENSSL */
#endif
+ case 'X': /* Check SSL cert validity - days 'til certificate expiration,
+ return Critical */
+ #ifdef HAVE_SSL
+ # ifdef USE_OPENSSL /* XXX */
+ if (!is_intnonneg (optarg))
+ usage2 (_("Invalid certificate expiration period"), optarg);
+ days_till_exp_crit = atoi (optarg);
+ check_cert = TRUE;
+ flags |= FLAG_SSL;
+ break;
+ # endif /* USE_OPENSSL */
+ #endif
/* fallthrough if we don't have ssl */
case 'S':
#ifdef HAVE_SSL
***************
*** 629,636 ****
printf (" %s\n", _("Seconds to wait between sending string and polling for response"));
#ifdef HAVE_SSL
! printf (" %s\n", "-D, --certificate=INTEGER");
printf (" %s\n", _("Minimum number of days a certificate has to be valid."));
printf (" %s\n", "-S, --ssl");
printf (" %s\n", _("Use SSL for the connection."));
#endif
--- 643,652 ----
printf (" %s\n", _("Seconds to wait between sending string and polling for response"));
#ifdef HAVE_SSL
! printf (" %s\n", "-D, --certificate=INTEGER");
printf (" %s\n", _("Minimum number of days a certificate has to be valid."));
+ printf (" %s\n", "-X, --certificatecrit=INTEGER");
+ printf (" %s\n", _("Minimum number of days a certificate has to be valid before Critical."));
printf (" %s\n", "-S, --ssl");
printf (" %s\n", _("Use SSL for the connection."));
#endif
***************
*** 652,657 ****
printf ("%s -H host -p port [-w <warning time>] [-c <critical time>] [-s <send string>]\n",progname);
printf ("[-e <expect string>] [-q <quit string>][-m <maximum bytes>] [-d <delay>]\n");
printf ("[-t <timeout seconds>] [-r <refuse state>] [-M <mismatch state>] [-v] [-4|-6] [-j]\n");
! printf ("[-D <days to cert expiry>] [-S <use SSL>] [-E]\n");
}
--- 668,673 ----
printf ("%s -H host -p port [-w <warning time>] [-c <critical time>] [-s <send string>]\n",progname);
printf ("[-e <expect string>] [-q <quit string>][-m <maximum bytes>] [-d <delay>]\n");
printf ("[-t <timeout seconds>] [-r <refuse state>] [-M <mismatch state>] [-v] [-4|-6] [-j]\n");
! printf ("[-D <days to cert expiry>] [-X <days to critical cert expiry>] [-S <use SSL>] [-E]\n");
}