Re: New release planned next week
Jochen Bern <Jochen.Bern-RMkW/[email protected]>
| Newsgroups | gmane.network.nagios.plugins.devel |
|---|---|
| Organization | LINworks GmbH |
| Message-ID | <[email protected]> |
On 12.09.2013 22:17, Holger Weiß wrote: > In the meantime, a few fixes that might have the potential to break > other things have been applied, so we'll delay the release until (at > least) next week. If some of you could test the current code¹, that > would be great! Sorry for the late reply, haven't gotten around to testing 'til today - and while (still) preparing to test, I found that I had written a mini patch for 4.1.16 (sslutils.c and a proof-of-concept use in check_http.c) so that you can not only force a specific SSL version (SSLv2/SSLv3/TLSv1), but also *exclude* just one of the three instead. (Had to start monitoring a web app doing its own SSL which would fail just for one of the three ... don't ask. :-S ) I haven't checked thoroughly, but I'm under the impression that the corresponding feature has been stable in the OpenSSL libs for *quite* a long time now ... Kind regards, J. Bern -- *NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>: Server--Storage--Virtualisierung--Management SW--Passion for Performance Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel ------------------------------------------------------------------------------ LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99! 1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/20/13. http://pubads.g.doubleclick.net/gampad/clk?id=58041151&iu=/4140/ostg.clktrk _______________________________________________________ Nagios Plugin Development Mailing List Nagiosplug-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Unsubscribe at https://lists.sourceforge.net/lists/listinfo/nagiosplug-devel ::: Please include plugins version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null
NegSSLVers.patch
(text/x-patch, 2.3 KB)
--- nagios-plugins-1.4.16/plugins/sslutils.c 2012-06-27 19:32:47.000000000 +0200
+++ nagios-plugins-1.4.16b/plugins/sslutils.c 2013-04-30 12:05:14.000000000 +0200
@@ -46,8 +46,21 @@
int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int version) {
const SSL_METHOD *method = NULL;
+ long ver_option = 0;
switch (version) {
+ case -3: /* Anything *but* SSLv3 */
+ method = SSLv23_client_method();
+ ver_option = SSL_OP_NO_SSLv3;
+ break;
+ case -2: /* Anything *but* SSLv2 */
+ method = SSLv23_client_method();
+ ver_option = SSL_OP_NO_SSLv2;
+ break;
+ case -1: /* Anything *but* TLSv1 */
+ method = SSLv23_client_method();
+ ver_option = SSL_OP_NO_TLSv1;
+ break;
case 0: /* Deafult to auto negotiation */
method = SSLv23_client_method();
break;
@@ -83,6 +96,7 @@
#ifdef SSL_OP_NO_TICKET
SSL_CTX_set_options(c, SSL_OP_NO_TICKET);
#endif
+ if (ver_option) SSL_CTX_set_options(c, ver_option);
if ((s = SSL_new(c)) != NULL) {
#ifdef SSL_set_tlsext_host_name
if (host_name != NULL)
--- nagios-plugins-1.4.16/plugins/check_http.c 2012-06-27 19:32:47.000000000 +0200
+++ nagios-plugins-1.4.16b/plugins/check_http.c 2013-04-30 12:08:48.000000000 +0200
@@ -312,8 +312,8 @@
ssl_version = 0;
else {
ssl_version = atoi(optarg);
- if (ssl_version < 1 || ssl_version > 3)
- usage4 (_("Invalid option - Valid values for SSL Version are 1 (TLSv1), 2 (SSLv2) or 3 (SSLv3)"));
+ if (ssl_version < -3 || ssl_version > 3)
+ usage4 (_("Invalid option - Valid values for SSL Version are 1 (TLSv1), 2 (SSLv2), 3 (SSLv3) and their negatives (exclude that version)"));
}
if (specify_port == FALSE)
server_port = HTTPS_PORT;
@@ -1348,7 +1348,8 @@
#ifdef HAVE_SSL
printf (" %s\n", "-S, --ssl=VERSION");
printf (" %s\n", _("Connect via SSL. Port defaults to 443. VERSION is optional, and prevents"));
- printf (" %s\n", _("auto-negotiation (1 = TLSv1, 2 = SSLv2, 3 = SSLv3)."));
+ printf (" %s\n", _("auto-negotiation (1 = TLSv1, 2 = SSLv2, 3 = SSLv3) for positive values, or"));
+ printf (" %s\n", _("use of the respective protocol in auto-negotiation when negative."));
printf (" %s\n", "--sni");
printf (" %s\n", _("Enable SSL/TLS hostname extension support (SNI)"));
printf (" %s\n", "-C, --certificate=INTEGER");