plugins/sslutils.c

   1 /*****************************************************************************
   2 *
   3 * Monitoring Plugins SSL utilities
   4 *
   5 * License: GPL
   6 * Copyright (c) 2005-2010 Monitoring Plugins Development Team
   7 *
   8 * Description:
   9 *
  10 * This file contains common functions for plugins that require SSL.
  11 *
  12 *
  13 * This program is free software: you can redistribute it and/or modify
  14 * it under the terms of the GNU General Public License as published by
  15 * the Free Software Foundation, either version 3 of the License, or
  16 * (at your option) any later version.
  17 *
  18 * This program is distributed in the hope that it will be useful,
  19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21 * GNU General Public License for more details.
  22 *
  23 * You should have received a copy of the GNU General Public License
  24 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  25 *
  26 *
  27 *****************************************************************************/
  28
  29 #define MAX_CN_LENGTH 256
  30 #include "common.h"
  31 #include "netutils.h"
  32
  33 #ifdef HAVE_SSL
  34 static SSL_CTX *c=NULL;
  35 static SSL *s=NULL;
  36 static int initialized=0;
  37
  38 int np_net_ssl_init(int sd) {
  39         return np_net_ssl_init_with_hostname(sd, NULL);
  40 }
  41
  42 int np_net_ssl_init_with_hostname(int sd, char *host_name) {
  43         return np_net_ssl_init_with_hostname_and_version(sd, host_name, 0);
  44 }
  45
  46 int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int version) {
  47         return np_net_ssl_init_with_hostname_version_and_cert(sd, host_name, version, NULL, NULL);
  48 }
  49
  50 int np_net_ssl_init_with_hostname_version_and_cert(int sd, char *host_name, int version, char *cert, char *privkey) {
  51         const SSL_METHOD *method = NULL;
  52         long options = 0;
  53
  54         switch (version) {
  55         case MP_SSLv2: /* SSLv2 protocol */
  56 #if defined(USE_GNUTLS) || defined(OPENSSL_NO_SSL2)
  57                 printf("%s\n", _("UNKNOWN - SSL protocol version 2 is not supported by your SSL library."));
  58                 return STATE_UNKNOWN;
  59 #else
  60                 method = SSLv2_client_method();
  61                 break;
  62 #endif
  63         case MP_SSLv3: /* SSLv3 protocol */
  64 #if defined(OPENSSL_NO_SSL3)
  65                 printf("%s\n", _("UNKNOWN - SSL protocol version 3 is not supported by your SSL library."));
  66                 return STATE_UNKNOWN;
  67 #else
  68                 method = SSLv3_client_method();
  69                 break;
  70 #endif
  71         case MP_TLSv1: /* TLSv1 protocol */
  72 #if defined(OPENSSL_NO_TLS1)
  73                 printf("%s\n", _("UNKNOWN - TLS protocol version 1 is not supported by your SSL library."));
  74                 return STATE_UNKNOWN;
  75 #else
  76                 method = TLSv1_client_method();
  77                 break;
  78 #endif
  79         case MP_TLSv1_1: /* TLSv1.1 protocol */
  80 #if !defined(SSL_OP_NO_TLSv1_1)
  81                 printf("%s\n", _("UNKNOWN - TLS protocol version 1.1 is not supported by your SSL library."));
  82                 return STATE_UNKNOWN;
  83 #else
  84                 method = TLSv1_1_client_method();
  85                 break;
  86 #endif
  87         case MP_TLSv1_2: /* TLSv1.2 protocol */
  88 #if !defined(SSL_OP_NO_TLSv1_2)
  89                 printf("%s\n", _("UNKNOWN - TLS protocol version 1.2 is not supported by your SSL library."));
  90                 return STATE_UNKNOWN;
  91 #else
  92                 method = TLSv1_2_client_method();
  93                 break;
  94 #endif
  95         case MP_TLSv1_2_OR_NEWER:
  96 #if !defined(SSL_OP_NO_TLSv1_1)
  97                 printf("%s\n", _("UNKNOWN - Disabling TLSv1.1 is not supported by your SSL library."));
  98                 return STATE_UNKNOWN;
  99 #else
 100                 options |= SSL_OP_NO_TLSv1_1;
 101 #endif
 102                 /* FALLTHROUGH */
 103         case MP_TLSv1_1_OR_NEWER:
 104 #if !defined(SSL_OP_NO_TLSv1)
 105                 printf("%s\n", _("UNKNOWN - Disabling TLSv1 is not supported by your SSL library."));
 106                 return STATE_UNKNOWN;
 107 #else
 108                 options |= SSL_OP_NO_TLSv1;
 109 #endif
 110                 /* FALLTHROUGH */
 111         case MP_TLSv1_OR_NEWER:
 112 #if defined(SSL_OP_NO_SSLv3)
 113                 options |= SSL_OP_NO_SSLv3;
 114 #endif
 115                 /* FALLTHROUGH */
 116         case MP_SSLv3_OR_NEWER:
 117 #if defined(SSL_OP_NO_SSLv2)
 118                 options |= SSL_OP_NO_SSLv2;
 119 #endif
 120         case MP_SSLv2_OR_NEWER:
 121                 /* FALLTHROUGH */
 122         default: /* Default to auto negotiation */
 123                 method = SSLv23_client_method();
 124         }
 125         if (!initialized) {
 126                 /* Initialize SSL context */
 127                 SSLeay_add_ssl_algorithms();
 128                 SSL_load_error_strings();
 129                 OpenSSL_add_all_algorithms();
 130                 initialized = 1;
 131         }
 132         if ((c = SSL_CTX_new(method)) == NULL) {
 133                 printf("%s\n", _("CRITICAL - Cannot create SSL context."));
 134                 return STATE_CRITICAL;
 135         }
 136         if (cert && privkey) {
 137                 SSL_CTX_use_certificate_file(c, cert, SSL_FILETYPE_PEM);
 138                 SSL_CTX_use_PrivateKey_file(c, privkey, SSL_FILETYPE_PEM);
 139 #ifdef USE_OPENSSL
 140                 if (!SSL_CTX_check_private_key(c)) {
 141                         printf ("%s\n", _("CRITICAL - Private key does not seem to match certificate!\n"));
 142                         return STATE_CRITICAL;
 143                 }
 144 #endif
 145         }
 146 #ifdef SSL_OP_NO_TICKET
 147         options |= SSL_OP_NO_TICKET;
 148 #endif
 149         SSL_CTX_set_options(c, options);
 150         SSL_CTX_set_mode(c, SSL_MODE_AUTO_RETRY);
 151         if ((s = SSL_new(c)) != NULL) {
 152 #ifdef SSL_set_tlsext_host_name
 153                 if (host_name != NULL)
 154                         SSL_set_tlsext_host_name(s, host_name);
 155 #endif
 156                 SSL_set_fd(s, sd);
 157                 if (SSL_connect(s) == 1) {
 158                         return OK;
 159                 } else {
 160                         printf("%s\n", _("CRITICAL - Cannot make SSL connection."));
 161 #  ifdef USE_OPENSSL /* XXX look into ERR_error_string */
 162                         ERR_print_errors_fp(stdout);
 163 #  endif /* USE_OPENSSL */
 164                 }
 165         } else {
 166                         printf("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
 167         }
 168         return STATE_CRITICAL;
 169 }
 170
 171 void np_net_ssl_cleanup() {
 172         if (s) {
 173 #ifdef SSL_set_tlsext_host_name
 174                 SSL_set_tlsext_host_name(s, NULL);
 175 #endif
 176                 SSL_shutdown(s);
 177                 SSL_free(s);
 178                 if (c) {
 179                         SSL_CTX_free(c);
 180                         c=NULL;
 181                 }
 182                 s=NULL;
 183         }
 184 }
 185
 186 int np_net_ssl_write(const void *buf, int num) {
 187         return SSL_write(s, buf, num);
 188 }
 189
 190 int np_net_ssl_read(void *buf, int num) {
 191         return SSL_read(s, buf, num);
 192 }
 193
 194 int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
 195 #  ifdef USE_OPENSSL
 196         X509 *certificate=NULL;
 197         X509_NAME *subj=NULL;
 198         char timestamp[50] = "";
 199         char cn[MAX_CN_LENGTH]= "";
 200         char *tz;
 201
 202         int cnlen =-1;
 203         int status=STATE_UNKNOWN;
 204
 205         ASN1_STRING *tm;
 206         int offset;
 207         struct tm stamp;
 208         float time_left;
 209         int days_left;
 210         int time_remaining;
 211         time_t tm_t;
 212
 213         certificate=SSL_get_peer_certificate(s);
 214         if (!certificate) {
 215                 printf("%s\n",_("CRITICAL - Cannot retrieve server certificate."));
 216                 return STATE_CRITICAL;
 217         }
 218
 219         /* Extract CN from certificate subject */
 220         subj=X509_get_subject_name(certificate);
 221
 222         if (!subj) {
 223                 printf("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
 224                 return STATE_CRITICAL;
 225         }
 226         cnlen = X509_NAME_get_text_by_NID(subj, NID_commonName, cn, sizeof(cn));
 227         if (cnlen == -1)
 228                 strcpy(cn, _("Unknown CN"));
 229
 230         /* Retrieve timestamp of certificate */
 231         tm = X509_get_notAfter(certificate);
 232
 233         /* Generate tm structure to process timestamp */
 234         if (tm->type == V_ASN1_UTCTIME) {
 235                 if (tm->length < 10) {
 236                         printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
 237                         return STATE_CRITICAL;
 238                 } else {
 239                         stamp.tm_year = (tm->data[0] - '0') * 10 + (tm->data[1] - '0');
 240                         if (stamp.tm_year < 50)
 241                                 stamp.tm_year += 100;
 242                         offset = 0;
 243                 }
 244         } else {
 245                 if (tm->length < 12) {
 246                         printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
 247                         return STATE_CRITICAL;
 248                 } else {
 249                         stamp.tm_year =
 250                                 (tm->data[0] - '0') * 1000 + (tm->data[1] - '0') * 100 +
 251                                 (tm->data[2] - '0') * 10 + (tm->data[3] - '0');
 252                         stamp.tm_year -= 1900;
 253                         offset = 2;
 254                 }
 255         }
 256         stamp.tm_mon =
 257                 (tm->data[2 + offset] - '0') * 10 + (tm->data[3 + offset] - '0') - 1;
 258         stamp.tm_mday =
 259                 (tm->data[4 + offset] - '0') * 10 + (tm->data[5 + offset] - '0');
 260         stamp.tm_hour =
 261                 (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
 262         stamp.tm_min =
 263                 (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
 264         stamp.tm_sec =
 265                 (tm->data[10 + offset] - '0') * 10 + (tm->data[11 + offset] - '0');
 266         stamp.tm_isdst = -1;
 267
 268         tm_t = timegm(&stamp);
 269         time_left = difftime(tm_t, time(NULL));
 270         days_left = time_left / 86400;
 271         tz = getenv("TZ");
 272         setenv("TZ", "GMT", 1);
 273         tzset();
 274         strftime(timestamp, 50, "%c %z", localtime(&tm_t));
 275         if (tz)
 276                 setenv("TZ", tz, 1);
 277         else
 278                 unsetenv("TZ");
 279         tzset();
 280
 281         if (days_left > 0 && days_left <= days_till_exp_warn) {
 282                 printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, days_left, timestamp);
 283                 if (days_left > days_till_exp_crit)
 284                         status = STATE_WARNING;
 285                 else
 286                         status = STATE_CRITICAL;
 287         } else if (days_left == 0 && time_left > 0) {
 288                 if (time_left >= 3600)
 289                         time_remaining = (int) time_left / 3600;
 290                 else
 291                         time_remaining = (int) time_left / 60;
 292
 293                 printf (_("%s - Certificate '%s' expires in %u %s (%s)\n"),
 294                         (days_left>days_till_exp_crit) ? "WARNING" : "CRITICAL", cn, time_remaining,
 295                         time_left >= 3600 ? "hours" : "minutes", timestamp);
 296
 297                 if ( days_left > days_till_exp_crit)
 298                         status = STATE_WARNING;
 299                 else
 300                         status = STATE_CRITICAL;
 301         } else if (time_left < 0) {
 302                 printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
 303                 status=STATE_CRITICAL;
 304         } else if (days_left == 0) {
 305                 printf (_("%s - Certificate '%s' just expired (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
 306                 if (days_left > days_till_exp_crit)
 307                         status = STATE_WARNING;
 308                 else
 309                         status = STATE_CRITICAL;
 310         } else {
 311                 printf(_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
 312                 status = STATE_OK;
 313         }
 314         X509_free(certificate);
 315         return status;
 316 #  else /* ifndef USE_OPENSSL */
 317         printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
 318         return STATE_WARNING;
 319 #  endif /* USE_OPENSSL */
 320 }
 321
 322 #endif /* HAVE_SSL */