plugins/sslutils.c

   1 /*****************************************************************************
   2 *
   3 * Nagios plugins SSL utilities
   4 *
   5 * License: GPL
   6 * Copyright (c) 2005-2010 Nagios Plugins Development Team
   7 *
   8 * Description:
   9 *
  10 * This file contains common functions for plugins that require SSL.
  11 *
  12 *
  13 * This program is free software: you can redistribute it and/or modify
  14 * it under the terms of the GNU General Public License as published by
  15 * the Free Software Foundation, either version 3 of the License, or
  16 * (at your option) any later version.
  17 *
  18 * This program is distributed in the hope that it will be useful,
  19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21 * GNU General Public License for more details.
  22 *
  23 * You should have received a copy of the GNU General Public License
  24 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  25 *
  26 *
  27 *****************************************************************************/
  28
  29 #define MAX_CN_LENGTH 256
  30 #define LOCAL_TIMEOUT_ALARM_HANDLER
  31 #include "common.h"
  32 #include "netutils.h"
  33
  34 #ifdef HAVE_SSL
  35 static SSL_CTX *c=NULL;
  36 static SSL *s=NULL;
  37 static int initialized=0;
  38
  39 int np_net_ssl_init(int sd) {
  40         return np_net_ssl_init_with_hostname(sd, NULL);
  41 }
  42
  43 int np_net_ssl_init_with_hostname(int sd, char *host_name) {
  44         return np_net_ssl_init_with_hostname_and_version(sd, host_name, 0);
  45 }
  46
  47 int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int version) {
  48         return np_net_ssl_init_with_hostname_version_and_certificate(sd, host_name, version, NULL, NULL);
  49 }
  50
  51 int np_net_ssl_init_with_hostname_version_and_certificate(int sd, char *host_name, int version, char *cert, char *privkey) {
  52         const SSL_METHOD *method = NULL;
  53
  54         switch (version) {
  55         case 0: /* Deafult to auto negotiation */
  56                 method = SSLv23_client_method();
  57                 break;
  58         case 1: /* TLSv1 protocol */
  59                 method = TLSv1_client_method();
  60                 break;
  61         case 2: /* SSLv2 protocol */
  62 #if defined(USE_GNUTLS) || defined(OPENSSL_NO_SSL2)
  63                 printf(("%s\n", _("CRITICAL - SSL protocol version 2 is not supported by your SSL library.")));
  64                 return STATE_CRITICAL;
  65 #else
  66                 method = SSLv2_client_method();
  67 #endif
  68                 break;
  69         case 3: /* SSLv3 protocol */
  70                 method = SSLv3_client_method();
  71                 break;
  72         default: /* Unsupported */
  73                 printf("%s\n", _("CRITICAL - Unsupported SSL protocol version."));
  74                 return STATE_CRITICAL;
  75         }
  76         if (!initialized) {
  77                 /* Initialize SSL context */
  78                 SSLeay_add_ssl_algorithms();
  79                 SSL_load_error_strings();
  80                 OpenSSL_add_all_algorithms();
  81                 initialized = 1;
  82         }
  83         if ((c = SSL_CTX_new(method)) == NULL) {
  84                 printf("%s\n", _("CRITICAL - Cannot create SSL context."));
  85                 return STATE_CRITICAL;
  86         }
  87         if (cert && privkey) {
  88                 SSL_CTX_use_certificate_file(c, cert, SSL_FILETYPE_PEM);
  89                 SSL_CTX_use_PrivateKey_file(c, privkey, SSL_FILETYPE_PEM);
  90                 if (!SSL_CTX_check_private_key(c)) {
  91                         printf ("%s\n", _("CRITICAL - Private key does not seem to match certificate!\n"));
  92                         return STATE_CRITICAL;
  93                 }
  94         }
  95 #ifdef SSL_OP_NO_TICKET
  96         SSL_CTX_set_options(c, SSL_OP_NO_TICKET);
  97 #endif
  98         if ((s = SSL_new(c)) != NULL) {
  99 #ifdef SSL_set_tlsext_host_name
 100                 if (host_name != NULL)
 101                         SSL_set_tlsext_host_name(s, host_name);
 102 #endif
 103                 SSL_set_fd(s, sd);
 104                 if (SSL_connect(s) == 1) {
 105                         return OK;
 106                 } else {
 107                         printf("%s\n", _("CRITICAL - Cannot make SSL connection."));
 108 #  ifdef USE_OPENSSL /* XXX look into ERR_error_string */
 109                         ERR_print_errors_fp(stdout);
 110 #  endif /* USE_OPENSSL */
 111                 }
 112         } else {
 113                         printf("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
 114         }
 115         return STATE_CRITICAL;
 116 }
 117
 118 void np_net_ssl_cleanup() {
 119         if (s) {
 120 #ifdef SSL_set_tlsext_host_name
 121                 SSL_set_tlsext_host_name(s, NULL);
 122 #endif
 123                 SSL_shutdown(s);
 124                 SSL_free(s);
 125                 if (c) {
 126                         SSL_CTX_free(c);
 127                         c=NULL;
 128                 }
 129                 s=NULL;
 130         }
 131 }
 132
 133 int np_net_ssl_write(const void *buf, int num) {
 134         return SSL_write(s, buf, num);
 135 }
 136
 137 int np_net_ssl_read(void *buf, int num) {
 138         return SSL_read(s, buf, num);
 139 }
 140
 141 int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
 142 #  ifdef USE_OPENSSL
 143         X509 *certificate=NULL;
 144         X509_NAME *subj=NULL;
 145         char cn[MAX_CN_LENGTH]= "";
 146         int cnlen =-1;
 147         int status=STATE_UNKNOWN;
 148
 149         ASN1_STRING *tm;
 150         int offset;
 151         struct tm stamp;
 152         float time_left;
 153         int days_left;
 154         char timestamp[17] = "";
 155
 156         certificate=SSL_get_peer_certificate(s);
 157         if (!certificate) {
 158                 printf("%s\n",_("CRITICAL - Cannot retrieve server certificate."));
 159                 return STATE_CRITICAL;
 160         }
 161
 162         /* Extract CN from certificate subject */
 163         subj=X509_get_subject_name(certificate);
 164
 165         if (!subj) {
 166                 printf("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
 167                 return STATE_CRITICAL;
 168         }
 169         cnlen = X509_NAME_get_text_by_NID(subj, NID_commonName, cn, sizeof(cn));
 170         if (cnlen == -1)
 171                 strcpy(cn, _("Unknown CN"));
 172
 173         /* Retrieve timestamp of certificate */
 174         tm = X509_get_notAfter(certificate);
 175
 176         /* Generate tm structure to process timestamp */
 177         if (tm->type == V_ASN1_UTCTIME) {
 178                 if (tm->length < 10) {
 179                         printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
 180                         return STATE_CRITICAL;
 181                 } else {
 182                         stamp.tm_year = (tm->data[0] - '0') * 10 + (tm->data[1] - '0');
 183                         if (stamp.tm_year < 50)
 184                                 stamp.tm_year += 100;
 185                         offset = 0;
 186                 }
 187         } else {
 188                 if (tm->length < 12) {
 189                         printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
 190                         return STATE_CRITICAL;
 191                 } else {
 192                         stamp.tm_year =
 193                                 (tm->data[0] - '0') * 1000 + (tm->data[1] - '0') * 100 +
 194                                 (tm->data[2] - '0') * 10 + (tm->data[3] - '0');
 195                         stamp.tm_year -= 1900;
 196                         offset = 2;
 197                 }
 198         }
 199         stamp.tm_mon =
 200                 (tm->data[2 + offset] - '0') * 10 + (tm->data[3 + offset] - '0') - 1;
 201         stamp.tm_mday =
 202                 (tm->data[4 + offset] - '0') * 10 + (tm->data[5 + offset] - '0');
 203         stamp.tm_hour =
 204                 (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
 205         stamp.tm_min =
 206                 (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
 207         stamp.tm_sec = 0;
 208         stamp.tm_isdst = -1;
 209
 210         time_left = difftime(timegm(&stamp), time(NULL));
 211         days_left = time_left / 86400;
 212         snprintf
 213                 (timestamp, 17, "%02d/%02d/%04d %02d:%02d",
 214                  stamp.tm_mon + 1,
 215                  stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
 216
 217         if (days_left > 0 && days_left <= days_till_exp_warn) {
 218                 printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, days_left, timestamp);
 219                 if (days_left > days_till_exp_crit)
 220                         return STATE_WARNING;
 221                 else
 222                         return STATE_CRITICAL;
 223         } else if (time_left < 0) {
 224                 printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
 225                 status=STATE_CRITICAL;
 226         } else if (days_left == 0) {
 227                 printf (_("%s - Certificate '%s' expires today (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
 228                 if (days_left > days_till_exp_crit)
 229                         return STATE_WARNING;
 230                 else
 231                         return STATE_CRITICAL;
 232         } else {
 233                 printf(_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
 234                 status=STATE_OK;
 235         }
 236         X509_free(certificate);
 237         return status;
 238 #  else /* ifndef USE_OPENSSL */
 239         printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
 240         return STATE_WARNING;
 241 #  endif /* USE_OPENSSL */
 242 }
 243
 244 #endif /* HAVE_SSL */