plugins/sslutils.c

   1 /*****************************************************************************
   2  *
   3  * Monitoring Plugins SSL utilities
   4  *
   5  * License: GPL
   6  * Copyright (c) 2005-2024 Monitoring Plugins Development Team
   7  *
   8  * Description:
   9  *
  10  * This file contains common functions for plugins that require SSL.
  11  *
  12  *
  13  * This program is free software: you can redistribute it and/or modify
  14  * it under the terms of the GNU General Public License as published by
  15  * the Free Software Foundation, either version 3 of the License, or
  16  * (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  25  *
  26  *
  27  *****************************************************************************/
  28
  29 #define MAX_CN_LENGTH 256
  30 #include "common.h"
  31 #include "netutils.h"
  32
  33 #ifdef HAVE_SSL
  34 static SSL_CTX *ctx = NULL;
  35 static SSL *s = NULL;
  36
  37 int np_net_ssl_init(int sd) { return np_net_ssl_init_with_hostname(sd, NULL); }
  38
  39 int np_net_ssl_init_with_hostname(int sd, char *host_name) { return np_net_ssl_init_with_hostname_and_version(sd, host_name, 0); }
  40
  41 int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int version) {
  42         return np_net_ssl_init_with_hostname_version_and_cert(sd, host_name, version, NULL, NULL);
  43 }
  44
  45 int np_net_ssl_init_with_hostname_version_and_cert(int sd, char *host_name, int version, char *cert, char *privkey) {
  46         long options = 0;
  47
  48         if ((ctx = SSL_CTX_new(TLS_client_method())) == NULL) {
  49                 printf("%s\n", _("CRITICAL - Cannot create SSL context."));
  50                 return STATE_CRITICAL;
  51         }
  52
  53         switch (version) {
  54         case MP_SSLv2: /* SSLv2 protocol */
  55                 printf("%s\n", _("UNKNOWN - SSL protocol version 2 is not supported by your SSL library."));
  56                 return STATE_UNKNOWN;
  57         case MP_SSLv3: /* SSLv3 protocol */
  58 #       if defined(OPENSSL_NO_SSL3)
  59                 printf("%s\n", _("UNKNOWN - SSL protocol version 3 is not supported by your SSL library."));
  60                 return STATE_UNKNOWN;
  61 #       else
  62                 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
  63                 SSL_CTX_set_max_proto_version(ctx, SSL3_VERSION);
  64                 break;
  65 #       endif
  66         case MP_TLSv1: /* TLSv1 protocol */
  67 #       if defined(OPENSSL_NO_TLS1)
  68                 printf("%s\n", _("UNKNOWN - TLS protocol version 1 is not supported by your SSL library."));
  69                 return STATE_UNKNOWN;
  70 #       else
  71                 SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
  72                 SSL_CTX_set_max_proto_version(ctx, TLS1_VERSION);
  73                 break;
  74 #       endif
  75         case MP_TLSv1_1: /* TLSv1.1 protocol */
  76 #       if !defined(SSL_OP_NO_TLSv1_1)
  77                 printf("%s\n", _("UNKNOWN - TLS protocol version 1.1 is not supported by your SSL library."));
  78                 return STATE_UNKNOWN;
  79 #       else
  80                 SSL_CTX_set_min_proto_version(ctx, TLS1_1_VERSION);
  81                 SSL_CTX_set_max_proto_version(ctx, TLS1_1_VERSION);
  82                 break;
  83 #       endif
  84         case MP_TLSv1_2: /* TLSv1.2 protocol */
  85 #       if !defined(SSL_OP_NO_TLSv1_2)
  86                 printf("%s\n", _("UNKNOWN - TLS protocol version 1.2 is not supported by your SSL library."));
  87                 return STATE_UNKNOWN;
  88 #       else
  89                 SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
  90                 SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION);
  91                 break;
  92 #       endif
  93         case MP_TLSv1_2_OR_NEWER:
  94 #       if !defined(SSL_OP_NO_TLSv1_1)
  95                 printf("%s\n", _("UNKNOWN - Disabling TLSv1.1 is not supported by your SSL library."));
  96                 return STATE_UNKNOWN;
  97 #       else
  98                 SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
  99                 break;
 100 #       endif
 101         case MP_TLSv1_1_OR_NEWER:
 102 #       if !defined(SSL_OP_NO_TLSv1)
 103                 printf("%s\n", _("UNKNOWN - Disabling TLSv1 is not supported by your SSL library."));
 104                 return STATE_UNKNOWN;
 105 #       else
 106                 SSL_CTX_set_min_proto_version(ctx, TLS1_1_VERSION);
 107                 break;
 108 #       endif
 109         case MP_TLSv1_OR_NEWER:
 110 #       if defined(SSL_OP_NO_SSLv3)
 111                 SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
 112                 break;
 113 #       endif
 114         case MP_SSLv3_OR_NEWER:
 115 #       if defined(SSL_OP_NO_SSLv2)
 116                 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
 117                 break;
 118 #       endif
 119         }
 120
 121         if (cert && privkey) {
 122 #       ifdef USE_OPENSSL
 123                 if (!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
 124 #       elif USE_GNUTLS
 125                 if (!SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM)) {
 126 #       else
 127 #               error Unported for unknown SSL library
 128 #       endif
 129                         printf("%s\n", _("CRITICAL - Unable to open certificate chain file!\n"));
 130                         return STATE_CRITICAL;
 131                 }
 132                 SSL_CTX_use_PrivateKey_file(ctx, privkey, SSL_FILETYPE_PEM);
 133 #       ifdef USE_OPENSSL
 134                 if (!SSL_CTX_check_private_key(ctx)) {
 135                         printf("%s\n", _("CRITICAL - Private key does not seem to match certificate!\n"));
 136                         return STATE_CRITICAL;
 137                 }
 138 #       endif
 139         }
 140 #       ifdef SSL_OP_NO_TICKET
 141         options |= SSL_OP_NO_TICKET;
 142 #       endif
 143         SSL_CTX_set_options(ctx, options);
 144         SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
 145         if ((s = SSL_new(ctx)) != NULL) {
 146 #       ifdef SSL_set_tlsext_host_name
 147                 if (host_name != NULL)
 148                         SSL_set_tlsext_host_name(s, host_name);
 149 #       endif
 150                 SSL_set_fd(s, sd);
 151                 if (SSL_connect(s) == 1) {
 152                         return OK;
 153                 } else {
 154                         printf("%s\n", _("CRITICAL - Cannot make SSL connection."));
 155 #       ifdef USE_OPENSSL /* XXX look into ERR_error_string */
 156                         ERR_print_errors_fp(stdout);
 157 #       endif /* USE_OPENSSL */
 158                 }
 159         } else {
 160                 printf("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
 161         }
 162         return STATE_CRITICAL;
 163 }
 164
 165 void np_net_ssl_cleanup() {
 166         if (s) {
 167 #       ifdef SSL_set_tlsext_host_name
 168                 SSL_set_tlsext_host_name(s, NULL);
 169 #       endif
 170                 SSL_shutdown(s);
 171                 SSL_free(s);
 172                 if (ctx) {
 173                         SSL_CTX_free(ctx);
 174                         ctx = NULL;
 175                 }
 176                 s = NULL;
 177         }
 178 }
 179
 180 int np_net_ssl_write(const void *buf, int num) { return SSL_write(s, buf, num); }
 181
 182 int np_net_ssl_read(void *buf, int num) { return SSL_read(s, buf, num); }
 183
 184 int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int days_till_exp_crit) {
 185 #       ifdef USE_OPENSSL
 186         X509_NAME *subj = NULL;
 187         char timestamp[50] = "";
 188         char cn[MAX_CN_LENGTH] = "";
 189         char *tz;
 190
 191         int cnlen = -1;
 192         int status = STATE_UNKNOWN;
 193
 194         ASN1_STRING *tm;
 195         int offset;
 196         struct tm stamp;
 197         float time_left;
 198         int days_left;
 199         int time_remaining;
 200         time_t tm_t;
 201
 202         if (!certificate) {
 203                 printf("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
 204                 return STATE_CRITICAL;
 205         }
 206
 207         /* Extract CN from certificate subject */
 208         subj = X509_get_subject_name(certificate);
 209
 210         if (!subj) {
 211                 printf("%s\n", _("CRITICAL - Cannot retrieve certificate subject."));
 212                 return STATE_CRITICAL;
 213         }
 214         cnlen = X509_NAME_get_text_by_NID(subj, NID_commonName, cn, sizeof(cn));
 215         if (cnlen == -1)
 216                 strcpy(cn, _("Unknown CN"));
 217
 218         /* Retrieve timestamp of certificate */
 219         tm = X509_get_notAfter(certificate);
 220
 221         /* Generate tm structure to process timestamp */
 222         if (tm->type == V_ASN1_UTCTIME) {
 223                 if (tm->length < 10) {
 224                         printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
 225                         return STATE_CRITICAL;
 226                 } else {
 227                         stamp.tm_year = (tm->data[0] - '0') * 10 + (tm->data[1] - '0');
 228                         if (stamp.tm_year < 50)
 229                                 stamp.tm_year += 100;
 230                         offset = 0;
 231                 }
 232         } else {
 233                 if (tm->length < 12) {
 234                         printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
 235                         return STATE_CRITICAL;
 236                 } else {
 237                         stamp.tm_year = (tm->data[0] - '0') * 1000 + (tm->data[1] - '0') * 100 + (tm->data[2] - '0') * 10 + (tm->data[3] - '0');
 238                         stamp.tm_year -= 1900;
 239                         offset = 2;
 240                 }
 241         }
 242         stamp.tm_mon = (tm->data[2 + offset] - '0') * 10 + (tm->data[3 + offset] - '0') - 1;
 243         stamp.tm_mday = (tm->data[4 + offset] - '0') * 10 + (tm->data[5 + offset] - '0');
 244         stamp.tm_hour = (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
 245         stamp.tm_min = (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
 246         stamp.tm_sec = (tm->data[10 + offset] - '0') * 10 + (tm->data[11 + offset] - '0');
 247         stamp.tm_isdst = -1;
 248
 249         tm_t = timegm(&stamp);
 250         time_left = difftime(tm_t, time(NULL));
 251         days_left = time_left / 86400;
 252         tz = getenv("TZ");
 253         setenv("TZ", "GMT", 1);
 254         tzset();
 255         strftime(timestamp, 50, "%c %z", localtime(&tm_t));
 256         if (tz)
 257                 setenv("TZ", tz, 1);
 258         else
 259                 unsetenv("TZ");
 260         tzset();
 261
 262         if (days_left > 0 && days_left <= days_till_exp_warn) {
 263                 printf(_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left > days_till_exp_crit) ? "WARNING" : "CRITICAL", cn,
 264                            days_left, timestamp);
 265                 if (days_left > days_till_exp_crit)
 266                         status = STATE_WARNING;
 267                 else
 268                         status = STATE_CRITICAL;
 269         } else if (days_left == 0 && time_left > 0) {
 270                 if (time_left >= 3600)
 271                         time_remaining = (int)time_left / 3600;
 272                 else
 273                         time_remaining = (int)time_left / 60;
 274
 275                 printf(_("%s - Certificate '%s' expires in %u %s (%s)\n"), (days_left > days_till_exp_crit) ? "WARNING" : "CRITICAL", cn,
 276                            time_remaining, time_left >= 3600 ? "hours" : "minutes", timestamp);
 277
 278                 if (days_left > days_till_exp_crit)
 279                         status = STATE_WARNING;
 280                 else
 281                         status = STATE_CRITICAL;
 282         } else if (time_left < 0) {
 283                 printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
 284                 status = STATE_CRITICAL;
 285         } else if (days_left == 0) {
 286                 printf(_("%s - Certificate '%s' just expired (%s).\n"), (days_left > days_till_exp_crit) ? "WARNING" : "CRITICAL", cn, timestamp);
 287                 if (days_left > days_till_exp_crit)
 288                         status = STATE_WARNING;
 289                 else
 290                         status = STATE_CRITICAL;
 291         } else {
 292                 printf(_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
 293                 status = STATE_OK;
 294         }
 295         X509_free(certificate);
 296         return status;
 297 #       else  /* ifndef USE_OPENSSL */
 298         printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
 299         return STATE_WARNING;
 300 #       endif /* USE_OPENSSL */
 301 }
 302
 303 int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit) {
 304 #       ifdef USE_OPENSSL
 305         X509 *certificate = NULL;
 306         certificate = SSL_get_peer_certificate(s);
 307         return (np_net_ssl_check_certificate(certificate, days_till_exp_warn, days_till_exp_crit));
 308 #       else  /* ifndef USE_OPENSSL */
 309         printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
 310         return STATE_WARNING;
 311 #       endif /* USE_OPENSSL */
 312 }
 313
 314 #endif /* HAVE_SSL */