plugins/check_ldap.c

   1 /*****************************************************************************
   2 *
   3 * Monitoring check_ldap plugin
   4 *
   5 * License: GPL
   6 * Copyright (c) 2000-2024 Monitoring Plugins Development Team
   7 *
   8 * Description:
   9 *
  10 * This file contains the check_ldap plugin
  11 *
  12 *
  13 * This program is free software: you can redistribute it and/or modify
  14 * it under the terms of the GNU General Public License as published by
  15 * the Free Software Foundation, either version 3 of the License, or
  16 * (at your option) any later version.
  17 *
  18 * This program is distributed in the hope that it will be useful,
  19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21 * GNU General Public License for more details.
  22 *
  23 * You should have received a copy of the GNU General Public License
  24 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  25 *
  26 *
  27 *****************************************************************************/
  28
  29 /* progname may be check_ldaps */
  30 char *progname = "check_ldap";
  31 const char *copyright = "2000-2024";
  32 const char *email = "devel@monitoring-plugins.org";
  33
  34 #include "common.h"
  35 #include "netutils.h"
  36 #include "utils.h"
  37
  38 #include <lber.h>
  39 #define LDAP_DEPRECATED 1
  40 #include <ldap.h>
  41
  42 enum {
  43         UNDEFINED = 0,
  44 #ifdef HAVE_LDAP_SET_OPTION
  45         DEFAULT_PROTOCOL = 2,
  46 #endif
  47         DEFAULT_PORT = 389
  48 };
  49
  50 int process_arguments (int, char **);
  51 int validate_arguments (void);
  52 void print_help (void);
  53 void print_usage (void);
  54
  55 char ld_defattr[] = "(objectclass=*)";
  56 char *ld_attr = ld_defattr;
  57 char *ld_host = NULL;
  58 char *ld_base = NULL;
  59 char *ld_passwd = NULL;
  60 char *ld_binddn = NULL;
  61 int ld_port = -1;
  62 #ifdef HAVE_LDAP_SET_OPTION
  63 int ld_protocol = DEFAULT_PROTOCOL;
  64 #endif
  65 #ifndef LDAP_OPT_SUCCESS
  66 # define LDAP_OPT_SUCCESS LDAP_SUCCESS
  67 #endif
  68 double warn_time = UNDEFINED;
  69 double crit_time = UNDEFINED;
  70 thresholds *entries_thresholds = NULL;
  71 struct timeval tv;
  72 char* warn_entries = NULL;
  73 char* crit_entries = NULL;
  74 bool starttls = false;
  75 bool ssl_on_connect = false;
  76 bool verbose = false;
  77
  78 /* for ldap tls */
  79
  80 char *SERVICE = "LDAP";
  81
  82 int
  83 main (int argc, char *argv[])
  84 {
  85
  86         LDAP *ld;
  87         LDAPMessage *result;
  88
  89         /* should be    int result = STATE_UNKNOWN; */
  90
  91         int status = STATE_UNKNOWN;
  92         long microsec;
  93         double elapsed_time;
  94
  95         /* for ldap tls */
  96
  97         int tls;
  98         int version=3;
  99
 100         int status_entries = STATE_OK;
 101         int num_entries = 0;
 102
 103         setlocale (LC_ALL, "");
 104         bindtextdomain (PACKAGE, LOCALEDIR);
 105         textdomain (PACKAGE);
 106
 107         if (strstr(argv[0],"check_ldaps")) {
 108                 xasprintf (&progname, "check_ldaps");
 109         }
 110
 111         /* Parse extra opts if any */
 112         argv=np_extra_opts (&argc, argv, progname);
 113
 114         if (process_arguments (argc, argv) == ERROR)
 115                 usage4 (_("Could not parse arguments"));
 116
 117         if (strstr(argv[0],"check_ldaps") && ! starttls && ! ssl_on_connect)
 118                 starttls = true;
 119
 120         /* initialize alarm signal handling */
 121         signal (SIGALRM, socket_timeout_alarm_handler);
 122
 123         /* set socket timeout */
 124         alarm (socket_timeout);
 125
 126         /* get the start time */
 127         gettimeofday (&tv, NULL);
 128
 129         /* initialize ldap */
 130 #ifdef HAVE_LDAP_INIT
 131         if (!(ld = ldap_init (ld_host, ld_port))) {
 132                 printf ("Could not connect to the server at port %i\n", ld_port);
 133                 return STATE_CRITICAL;
 134         }
 135 #else
 136         if (!(ld = ldap_open (ld_host, ld_port))) {
 137                 if (verbose)
 138                         ldap_perror(ld, "ldap_open");
 139                 printf (_("Could not connect to the server at port %i\n"), ld_port);
 140                 return STATE_CRITICAL;
 141         }
 142 #endif /* HAVE_LDAP_INIT */
 143
 144 #ifdef HAVE_LDAP_SET_OPTION
 145         /* set ldap options */
 146         if (ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &ld_protocol) !=
 147                         LDAP_OPT_SUCCESS ) {
 148                 printf(_("Could not set protocol version %d\n"), ld_protocol);
 149                 return STATE_CRITICAL;
 150         }
 151 #endif
 152
 153         if (ld_port == LDAPS_PORT || ssl_on_connect) {
 154                 xasprintf (&SERVICE, "LDAPS");
 155 #if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
 156                 /* ldaps: set option tls */
 157                 tls = LDAP_OPT_X_TLS_HARD;
 158
 159                 if (ldap_set_option (ld, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
 160                 {
 161                         if (verbose)
 162                                 ldap_perror(ld, "ldaps_option");
 163                         printf (_("Could not init TLS at port %i!\n"), ld_port);
 164                         return STATE_CRITICAL;
 165                 }
 166 #else
 167                 printf (_("TLS not supported by the libraries!\n"));
 168                 return STATE_CRITICAL;
 169 #endif /* LDAP_OPT_X_TLS */
 170         } else if (starttls) {
 171                 xasprintf (&SERVICE, "LDAP-TLS");
 172 #if defined(HAVE_LDAP_SET_OPTION) && defined(HAVE_LDAP_START_TLS_S)
 173                 /* ldap with startTLS: set option version */
 174                 if (ldap_get_option(ld,LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS )
 175                 {
 176                         if (version < LDAP_VERSION3)
 177                         {
 178                                 version = LDAP_VERSION3;
 179                                 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version);
 180                         }
 181                 }
 182                 /* call start_tls */
 183                 if (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS)
 184                 {
 185                         if (verbose)
 186                                 ldap_perror(ld, "ldap_start_tls");
 187                         printf (_("Could not init startTLS at port %i!\n"), ld_port);
 188                         return STATE_CRITICAL;
 189                 }
 190 #else
 191                 printf (_("startTLS not supported by the library, needs LDAPv3!\n"));
 192                 return STATE_CRITICAL;
 193 #endif /* HAVE_LDAP_START_TLS_S */
 194         }
 195
 196         /* bind to the ldap server */
 197         if (ldap_bind_s (ld, ld_binddn, ld_passwd, LDAP_AUTH_SIMPLE) !=
 198                         LDAP_SUCCESS) {
 199                 if (verbose)
 200                         ldap_perror(ld, "ldap_bind");
 201                 printf (_("Could not bind to the LDAP server\n"));
 202                 return STATE_CRITICAL;
 203         }
 204
 205         /* do a search of all objectclasses in the base dn */
 206         if (ldap_search_s (ld, ld_base, (crit_entries!=NULL || warn_entries!=NULL) ? LDAP_SCOPE_SUBTREE : LDAP_SCOPE_BASE, ld_attr, NULL, 0, &result)
 207                         != LDAP_SUCCESS) {
 208                 if (verbose)
 209                         ldap_perror(ld, "ldap_search");
 210                 printf (_("Could not search/find objectclasses in %s\n"), ld_base);
 211                 return STATE_CRITICAL;
 212         } else if (crit_entries!=NULL || warn_entries!=NULL) {
 213                 num_entries = ldap_count_entries(ld, result);
 214         }
 215
 216         /* unbind from the ldap server */
 217         ldap_unbind (ld);
 218
 219         /* reset the alarm handler */
 220         alarm (0);
 221
 222         /* calculate the elapsed time and compare to thresholds */
 223
 224         microsec = deltime (tv);
 225         elapsed_time = (double)microsec / 1.0e6;
 226
 227         if (crit_time!=UNDEFINED && elapsed_time>crit_time)
 228                 status = STATE_CRITICAL;
 229         else if (warn_time!=UNDEFINED && elapsed_time>warn_time)
 230                 status = STATE_WARNING;
 231         else
 232                 status = STATE_OK;
 233
 234         if(entries_thresholds != NULL) {
 235                 if (verbose) {
 236                         printf ("entries found: %d\n", num_entries);
 237                         print_thresholds("entry thresholds", entries_thresholds);
 238                 }
 239                 status_entries = get_status(num_entries, entries_thresholds);
 240                 if (status_entries == STATE_CRITICAL) {
 241                         status = STATE_CRITICAL;
 242                 } else if (status != STATE_CRITICAL) {
 243                         status = status_entries;
 244                 }
 245         }
 246
 247         /* print out the result */
 248         if (crit_entries!=NULL || warn_entries!=NULL) {
 249                 printf (_("LDAP %s - found %d entries in %.3f seconds|%s %s\n"),
 250                         state_text (status),
 251                         num_entries,
 252                         elapsed_time,
 253                         fperfdata ("time", elapsed_time, "s",
 254                                 (int)warn_time, warn_time,
 255                                 (int)crit_time, crit_time,
 256                                 true, 0, false, 0),
 257                         sperfdata ("entries", (double)num_entries, "",
 258                                 warn_entries,
 259                                 crit_entries,
 260                                 true, 0.0, false, 0.0));
 261         } else {
 262                 printf (_("LDAP %s - %.3f seconds response time|%s\n"),
 263                         state_text (status),
 264                         elapsed_time,
 265                         fperfdata ("time", elapsed_time, "s",
 266                                 (int)warn_time, warn_time,
 267                                 (int)crit_time, crit_time,
 268                                 true, 0, false, 0));
 269         }
 270
 271         return status;
 272 }
 273
 274 /* process command-line arguments */
 275 int
 276 process_arguments (int argc, char **argv)
 277 {
 278         int c;
 279
 280         int option = 0;
 281         /* initialize the long option struct */
 282         static struct option longopts[] = {
 283                 {"help", no_argument, 0, 'h'},
 284                 {"version", no_argument, 0, 'V'},
 285                 {"timeout", required_argument, 0, 't'},
 286                 {"hostname", required_argument, 0, 'H'},
 287                 {"base", required_argument, 0, 'b'},
 288                 {"attr", required_argument, 0, 'a'},
 289                 {"bind", required_argument, 0, 'D'},
 290                 {"pass", required_argument, 0, 'P'},
 291 #ifdef HAVE_LDAP_SET_OPTION
 292                 {"ver2", no_argument, 0, '2'},
 293                 {"ver3", no_argument, 0, '3'},
 294 #endif
 295                 {"starttls", no_argument, 0, 'T'},
 296                 {"ssl", no_argument, 0, 'S'},
 297                 {"use-ipv4", no_argument, 0, '4'},
 298                 {"use-ipv6", no_argument, 0, '6'},
 299                 {"port", required_argument, 0, 'p'},
 300                 {"warn", required_argument, 0, 'w'},
 301                 {"crit", required_argument, 0, 'c'},
 302                 {"warn-entries", required_argument, 0, 'W'},
 303                 {"crit-entries", required_argument, 0, 'C'},
 304                 {"verbose", no_argument, 0, 'v'},
 305                 {0, 0, 0, 0}
 306         };
 307
 308         if (argc < 2)
 309                 return ERROR;
 310
 311         for (c = 1; c < argc; c++) {
 312                 if (strcmp ("-to", argv[c]) == 0)
 313                         strcpy (argv[c], "-t");
 314         }
 315
 316         while (true) {
 317                 c = getopt_long (argc, argv, "hvV234TS6t:c:w:H:b:p:a:D:P:C:W:", longopts, &option);
 318
 319                 if (c == -1 || c == EOF)
 320                         break;
 321
 322                 switch (c) {
 323                 case 'h':                                                                       /* help */
 324                         print_help ();
 325                         exit (STATE_UNKNOWN);
 326                 case 'V':                                                                       /* version */
 327                         print_revision (progname, NP_VERSION);
 328                         exit (STATE_UNKNOWN);
 329                 case 't':                                                                       /* timeout period */
 330                         if (!is_intnonneg (optarg))
 331                                 usage2 (_("Timeout interval must be a positive integer"), optarg);
 332                         else
 333                                 socket_timeout = atoi (optarg);
 334                         break;
 335                 case 'H':
 336                         ld_host = optarg;
 337                         break;
 338                 case 'b':
 339                         ld_base = optarg;
 340                         break;
 341                 case 'p':
 342                         ld_port = atoi (optarg);
 343                         break;
 344                 case 'a':
 345                         ld_attr = optarg;
 346                         break;
 347                 case 'D':
 348                         ld_binddn = optarg;
 349                         break;
 350                 case 'P':
 351                         ld_passwd = optarg;
 352                         break;
 353                 case 'w':
 354                         warn_time = strtod (optarg, NULL);
 355                         break;
 356                 case 'c':
 357                         crit_time = strtod (optarg, NULL);
 358                         break;
 359                 case 'W':
 360                         warn_entries = optarg;
 361                         break;
 362                 case 'C':
 363                         crit_entries = optarg;
 364                         break;
 365 #ifdef HAVE_LDAP_SET_OPTION
 366                 case '2':
 367                         ld_protocol = 2;
 368                         break;
 369                 case '3':
 370                         ld_protocol = 3;
 371                         break;
 372 #endif
 373                 case '4':
 374                         address_family = AF_INET;
 375                         break;
 376                 case 'v':
 377                         verbose = true;
 378                         break;
 379                 case 'T':
 380                         if (! ssl_on_connect)
 381                                 starttls = true;
 382                         else
 383                                 usage_va(_("%s cannot be combined with %s"), "-T/--starttls", "-S/--ssl");
 384                         break;
 385                 case 'S':
 386                         if (! starttls) {
 387                                 ssl_on_connect = true;
 388                                 if (ld_port == -1)
 389                                         ld_port = LDAPS_PORT;
 390                         } else
 391                                 usage_va(_("%s cannot be combined with %s"), "-S/--ssl", "-T/--starttls");
 392                         break;
 393                 case '6':
 394 #ifdef USE_IPV6
 395                         address_family = AF_INET6;
 396 #else
 397                         usage (_("IPv6 support not available\n"));
 398 #endif
 399                         break;
 400                 default:
 401                         usage5 ();
 402                 }
 403         }
 404
 405         c = optind;
 406         if (ld_host == NULL && is_host(argv[c]))
 407                 ld_host = strdup (argv[c++]);
 408
 409         if (ld_base == NULL && argv[c])
 410                 ld_base = strdup (argv[c++]);
 411
 412         if (ld_port == -1)
 413                 ld_port = DEFAULT_PORT;
 414
 415         return validate_arguments ();
 416 }
 417
 418
 419 int
 420 validate_arguments ()
 421 {
 422         if (ld_host==NULL || strlen(ld_host)==0)
 423                 usage4 (_("Please specify the host name\n"));
 424
 425         if (ld_base==NULL)
 426                 usage4 (_("Please specify the LDAP base\n"));
 427
 428         if (crit_entries!=NULL || warn_entries!=NULL) {
 429                 set_thresholds(&entries_thresholds,
 430                         warn_entries, crit_entries);
 431         }
 432         if (ld_passwd==NULL)
 433                 ld_passwd = getenv("LDAP_PASSWORD");
 434
 435         return OK;
 436 }
 437
 438
 439 void
 440 print_help (void)
 441 {
 442         char *myport;
 443         xasprintf (&myport, "%d", DEFAULT_PORT);
 444
 445         print_revision (progname, NP_VERSION);
 446
 447         printf ("Copyright (c) 1999 Didi Rieder (adrieder@sbox.tu-graz.ac.at)\n");
 448         printf (COPYRIGHT, copyright, email);
 449
 450         printf ("\n\n");
 451
 452         print_usage ();
 453
 454         printf (UT_HELP_VRSN);
 455         printf (UT_EXTRA_OPTS);
 456
 457         printf (UT_HOST_PORT, 'p', myport);
 458
 459         printf (UT_IPv46);
 460
 461         printf (" %s\n", "-a [--attr]");
 462   printf ("    %s\n", _("ldap attribute to search (default: \"(objectclass=*)\""));
 463   printf (" %s\n", "-b [--base]");
 464   printf ("    %s\n", _("ldap base (eg. ou=my unit, o=my org, c=at"));
 465   printf (" %s\n", "-D [--bind]");
 466   printf ("    %s\n", _("ldap bind DN (if required)"));
 467   printf (" %s\n", "-P [--pass]");
 468   printf ("    %s\n", _("ldap password (if required, or set the password through environment variable 'LDAP_PASSWORD')"));
 469   printf (" %s\n", "-T [--starttls]");
 470   printf ("    %s\n", _("use starttls mechanism introduced in protocol version 3"));
 471   printf (" %s\n", "-S [--ssl]");
 472   printf ("    %s %i\n", _("use ldaps (ldap v2 ssl method). this also sets the default port to"), LDAPS_PORT);
 473
 474 #ifdef HAVE_LDAP_SET_OPTION
 475         printf (" %s\n", "-2 [--ver2]");
 476   printf ("    %s\n", _("use ldap protocol version 2"));
 477   printf (" %s\n", "-3 [--ver3]");
 478   printf ("    %s\n", _("use ldap protocol version 3"));
 479   printf ("    (%s %d)\n", _("default protocol version:"), DEFAULT_PROTOCOL);
 480 #endif
 481
 482         printf (UT_WARN_CRIT);
 483
 484   printf (" %s\n", "-W [--warn-entries]");
 485   printf ("    %s\n", _("Number of found entries to result in warning status"));
 486   printf (" %s\n", "-C [--crit-entries]");
 487   printf ("    %s\n", _("Number of found entries to result in critical status"));
 488
 489         printf (UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
 490
 491         printf (UT_VERBOSE);
 492
 493         printf ("\n");
 494         printf ("%s\n", _("Notes:"));
 495         printf (" %s\n", _("If this plugin is called via 'check_ldaps', method 'STARTTLS' will be"));
 496         printf (_(" implied (using default port %i) unless --port=636 is specified. In that case\n"), DEFAULT_PORT);
 497         printf (" %s\n", _("'SSL on connect' will be used no matter how the plugin was called."));
 498         printf (" %s\n", _("This detection is deprecated, please use 'check_ldap' with the '--starttls' or '--ssl' flags"));
 499         printf (" %s\n", _("to define the behaviour explicitly instead."));
 500         printf (" %s\n", _("The parameters --warn-entries and --crit-entries are optional."));
 501
 502         printf (UT_SUPPORT);
 503 }
 504
 505 void
 506 print_usage (void)
 507 {
 508   printf ("%s\n", _("Usage:"));
 509         printf (" %s -H <host> -b <base_dn> [-p <port>] [-a <attr>] [-D <binddn>]",progname);
 510   printf ("\n       [-P <password>] [-w <warn_time>] [-c <crit_time>] [-t timeout]%s\n",
 511 #ifdef HAVE_LDAP_SET_OPTION
 512                         "\n       [-2|-3] [-4|-6]"
 513 #else
 514                         ""
 515 #endif
 516                         );
 517 }