12 files changed, 290 insertions, 165 deletions

diff --git a/.gitignore b/.gitignore
index 7def6f80..0ffb91e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@ NP-VERSION-FILE
 /Makefile
 /Makefile.in
 /missing
+/nagios-plugins.spec
 /stamp-h1
 /test.pl
 /THANKS
diff --git a/NEWS b/NEWS
index 1234178a..2ccc65d1 100644
--- a/NEWS
+++ b/NEWS
@@ -6,10 +6,14 @@ This file documents the major additions and syntax changes between releases.
         check_disk_smb now allows spaces in share names (#990948, #1370031, Debian #601699)
         check_http now uses standard threshold functions (enables floating point and ranges)
         check_http now checks for and prints the certificate cn (hostname) in SSL certificate checks (Stéphane Urbanovski)
+        check_http now supports an optional -S/--ssl value to choose the SSL protocol version (#3066166 - Jason Lunn)
         Add perfdata to check_ssh (#3244097 - Marco Beck)
         New option to check_smtp to ignore failures when sending QUIT (#3358348 - Duncan Ferguson)
         New check_by_ssh -F option which allows for specifying an alternative ssh_config(5) file (#2895334 - Sven Nierlein)
         check_sensors now detects faulty sensors unless --ignore-fault is specified (Jan Wagner)
+        utils.sh now provides a check_range function (Alex Griffin)
+        Improved the performance of check_users (Marc Remy)
+        Add perfdata to check_disk_smb (Debian #654259 - Charles-Henri Larose)
         Updated Nagios::Plugin perl module
 
         FIXES
@@ -20,7 +24,9 @@ This file documents the major additions and syntax changes between releases.
         Fix check_procs where regex input of '|' would get displayed in output - now replaced with ','
         Fix segfault in check_host when hostname returns multiple IP addresses (Sebastian Harl)
         Fix check_smtp and check_tcp where duplicate messages were displayed for certificate errors
-        Fix check_ping where output of ping6 when unreachable (Debian #662638)
+        Fix check_ping's parsing of ping6(1) output (#1894850, Debian #514588, Debian #662638 - Matej Vela)
+        Fix a check_dhcp bug which was triggered by using it to check Windows 2003 DHCP servers (#3503921)
+        Disable RFC4507 support, to work around SSL negotiation issues with (at least) some Tomcat versions
 
 1.4.15 27th July 2010
         ENHANCEMENTS
diff --git a/THANKS.in b/THANKS.in
index c6775bcd..470a7ee5 100644
--- a/THANKS.in
+++ b/THANKS.in
@@ -269,3 +269,10 @@ Ryan Kelly
 Stéphane Urbanovski
 Marco Beck
 Sebastian Harl
+Jason Lunn
+Alex Griffin
+Marc Remy
+Matej Vela
+Jason Ellison
+Charles-Henri Larose
+Tobias Brox
diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c
index 2a1875c4..b02ee49c 100644
--- a/plugins-root/check_dhcp.c
+++ b/plugins-root/check_dhcp.c
@@ -141,7 +141,7 @@ typedef struct dhcp_packet_struct{
         u_int16_t flags;                /* flags */
         struct in_addr ciaddr;          /* IP address of this machine (if we already have one) */
         struct in_addr yiaddr;          /* IP address of this machine (offered by the DHCP server) */
-        struct in_addr siaddr;          /* IP address of DHCP server */
+        struct in_addr siaddr;          /* IP address of next server */
         struct in_addr giaddr;          /* IP address of DHCP relay */
         unsigned char chaddr [MAX_DHCP_CHADDR_LENGTH];      /* hardware address of this machine */
         char sname [MAX_DHCP_SNAME_LENGTH];    /* name of DHCP server */
@@ -587,11 +587,6 @@ int get_dhcp_offer(int sock){
                 /* Save a copy of "source" into "via" even if it's via itself */
                 memcpy(&via,&source,sizeof(source)) ;
 
-                /* If siaddr is non-zero, set "source" to siaddr */
-                if(offer_packet.siaddr.s_addr != 0L){
-                        source.sin_addr.s_addr = offer_packet.siaddr.s_addr ;
-                        }
-
                 if(verbose){
                         printf(_("DHCPOFFER from IP address %s"),inet_ntoa(source.sin_addr));
                         printf(_(" via %s\n"),inet_ntoa(via.sin_addr));
@@ -839,8 +834,7 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
         /* process all DHCP options present in the packet */
         for(x=4;x<MAX_DHCP_OPTIONS_LENGTH;){
 
-                /* end of options (0 is really just a pad, but bail out anyway) */
-                if((int)offer_packet->options[x]==-1 || (int)offer_packet->options[x]==0)
+                if((int)offer_packet->options[x]==-1)
                         break;
 
                 /* get option type */
@@ -872,7 +866,9 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
                         }
 
                 /* skip option data we're ignoring */
-                if(option_type!=DHCP_OPTION_REBINDING_TIME)
+                if(option_type==0) /* "pad" option, see RFC 2132 (3.1) */
+                        x+=1;
+                else
                         x+=option_length;
                 }
 
@@ -903,9 +899,9 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
          * the next bootstrap service (e.g., delivery of an operating system
          * executable image).  A DHCP server always returns its own address in
          * the 'server identifier' option."  'serv_ident' is the 'server
-         * identifier' option, 'source' is the 'siaddr' field or (if 'siaddr'
-         * wasn't available) the IP address we received the DHCPOFFER from.  If
-         * 'serv_ident' isn't available for some reason, we use 'source'.
+         * identifier' option, 'source' is the IP address we received the
+         * DHCPOFFER from.  If 'serv_ident' isn't available for some reason, we
+         * use 'source'.
          */
         new_offer->server_address=serv_ident.s_addr?serv_ident:source;
         new_offer->offered_address=offer_packet->yiaddr;
diff --git a/plugins-scripts/check_disk_smb.pl b/plugins-scripts/check_disk_smb.pl
index 6783543b..43841c36 100755
--- a/plugins-scripts/check_disk_smb.pl
+++ b/plugins-scripts/check_disk_smb.pl
@@ -166,6 +166,7 @@ my $address = $1 if (defined($opt_a) && $opt_a =~ /(.*)/);
 my $state = "OK";
 my $answer = undef;
 my $res = undef;
+my $perfdata = "";
 my @lines = undef;
 
 # Just in case of problems, let's not hang Nagios
@@ -204,11 +205,23 @@ $_ = $lines[$#lines];
 #If line does not match required regexp, return an UNKNOWN error
 if (/\s*(\d*) blocks of size (\d*)\. (\d*) blocks available/) {
 
-        my ($avail) = ($3*$2)/1024;
-        my ($avail_bytes) = $avail;
+        my ($avail_bytes) = $3 * $2;
+        my ($total_bytes) = $1 * $2;
+        my ($occupied_bytes) = $1 * $2 - $avail_bytes;
+        my ($avail) = $avail_bytes/1024;
         my ($capper) = int(($3/$1)*100);
         my ($mountpt) = "\\\\$host\\$share";
 
+        # TODO : why is the kB the standard unit for args ?
+        my ($warn_bytes) = $total_bytes - $warn * 1024;
+        if ($warn_type eq "P") {
+                $warn_bytes = $warn * $1 * $2 / 100;
+        }
+        my ($crit_bytes) = $total_bytes - $crit * 1024;
+        if ($crit_type eq "P") {
+                $crit_bytes = $crit * $1 * $2 / 100;
+        }
+
 
         if (int($avail / 1024) > 0) {
                 $avail = int($avail / 1024);
@@ -225,32 +238,37 @@ if (/\s*(\d*) blocks of size (\d*)\. (\d*) blocks available/) {
 #print ":$warn:$warn_type:\n";
 #print ":$crit:$crit_type:\n";
 #print ":$avail:$avail_bytes:$capper:$mountpt:\n";
+        $perfdata = "'" . $share . "'=" . $occupied_bytes . 'B;'
+                . $warn_bytes . ';'
+                . $crit_bytes . ';'
+                . '0;'
+                . $total_bytes;
 
-        if ((($warn_type eq "P") && (100 - $capper) < $warn) || (($warn_type eq "K") && ($avail_bytes > $warn))) { 
-                $answer = "Disk ok - $avail ($capper%) free on $mountpt\n";
-        } elsif ((($crit_type eq "P") && (100 - $capper) < $crit) || (($crit_type eq "K") && ($avail_bytes > $crit))) {
+        if ($occupied_bytes > $crit_bytes) {
+                $state = "CRITICAL";
+                $answer = "CRITICAL: Only $avail ($capper%) free on $mountpt";
+        } elsif ( $occupied_bytes > $warn_bytes ) {
                 $state = "WARNING";
-                $answer = "WARNING: Only $avail ($capper%) free on $mountpt\n";
+                $answer = "WARNING: Only $avail ($capper%) free on $mountpt";
         } else {
-                $state = "CRITICAL";
-                $answer = "CRITICAL: Only $avail ($capper%) free on $mountpt\n";
+                $answer = "Disk ok - $avail ($capper%) free on $mountpt";
         }
 } else {
-        $answer = "Result from smbclient not suitable\n";
+        $answer = "Result from smbclient not suitable";
         $state = "UNKNOWN";
         foreach (@lines) {
                 if (/(Access denied|NT_STATUS_LOGON_FAILURE|NT_STATUS_ACCESS_DENIED)/) {
-                        $answer = "Access Denied\n";
+                        $answer = "Access Denied";
                         $state = "CRITICAL";
                         last;
                 }
                 if (/(Unknown host \w*|Connection.*failed)/) {
-                        $answer = "$1\n";
+                        $answer = "$1";
                         $state = "CRITICAL";
                         last;
                 }
                 if (/(You specified an invalid share name|NT_STATUS_BAD_NETWORK_NAME)/) {
-                        $answer = "Invalid share name \\\\$host\\$share\n";
+                        $answer = "Invalid share name \\\\$host\\$share";
                         $state = "CRITICAL";
                         last;
                 }
@@ -259,6 +277,8 @@ if (/\s*(\d*) blocks of size (\d*)\. (\d*) blocks available/) {
 
 
 print $answer;
+print " | " . $perfdata if ($perfdata);
+print "\n";
 print "$state\n" if ($verbose);
 exit $ERRORS{$state};
 
diff --git a/plugins-scripts/utils.sh.in b/plugins-scripts/utils.sh.in
index b30b9083..5fae6adb 100644
--- a/plugins-scripts/utils.sh.in
+++ b/plugins-scripts/utils.sh.in
@@ -21,3 +21,88 @@ support() {
         $ECHO "@SUPPORT@" | sed -e 's/\n/ /g'
 }
 
+#
+# check_range takes a value and a range string, returning successfully if an
+# alert should be raised based on the range.
+#
+check_range() {
+        local v range yes no err decimal start end cmp match
+        v="$1"
+        range="$2"
+
+        # whether to raise an alert or not
+        yes=0
+        no=1
+        err=2
+
+        # regex to match a decimal number
+        decimal="-?([0-9]+\.?[0-9]*|[0-9]*\.[0-9]+)"
+
+        # compare numbers (including decimals), returning true/false
+        cmp() { awk "BEGIN{ if ($1) exit(0); exit(1)}"; }
+
+        # returns successfully if the string in the first argument matches the
+        # regex in the second
+        match() { echo "$1" | grep -E -q -- "$2"; }
+
+        # make sure value is valid
+        if ! match "$v" "^$decimal$"; then
+                echo "${0##*/}: check_range: invalid value" >&2
+                unset -f cmp match
+                return "$err"
+        fi
+
+        # make sure range is valid
+        if ! match "$range" "^@?(~|$decimal)(:($decimal)?)?$"; then
+                echo "${0##*/}: check_range: invalid range" >&2
+                unset -f cmp match
+                return "$err"
+        fi
+
+        # check for leading @ char, which negates the range
+        if match $range '^@'; then
+                range=${range#@}
+                yes=1
+                no=0
+        fi
+
+        # parse the range string
+        if ! match "$range" ':'; then
+                start=0
+                end="$range"
+        else
+                start="${range%%:*}"
+                end="${range#*:}"
+        fi
+
+        # do the comparison, taking positive ("") and negative infinity ("~")
+        # into account
+        if [ "$start" != "~" ] && [ "$end" != "" ]; then
+                if cmp "$start <= $v" && cmp "$v <= $end"; then
+                        unset -f cmp match
+                        return "$no"
+                else
+                        unset -f cmp match
+                        return "$yes"
+                fi
+        elif [ "$start" != "~" ] && [ "$end" = "" ]; then
+                if cmp "$start <= $v"; then
+                        unset -f cmp match
+                        return "$no"
+                else
+                        unset -f cmp match
+                        return "$yes"
+                fi
+        elif [ "$start" = "~" ] && [ "$end" != "" ]; then
+                if cmp "$v <= $end"; then
+                        unset -f cmp match
+                        return "$no"
+                else
+                        unset -f cmp match
+                        return "$yes"
+                fi
+        else
+                unset -f cmp match
+                return "$no"
+        fi
+}
diff --git a/plugins/Makefile.am b/plugins/Makefile.am
index 36a28b0b..3a2afc15 100644
--- a/plugins/Makefile.am
+++ b/plugins/Makefile.am
@@ -101,7 +101,7 @@ check_tcp_LDADD = $(SSLOBJS) $(NETLIBS) $(SSLLIBS)
 check_time_LDADD = $(NETLIBS)
 check_ntp_time_LDADD = $(NETLIBS) $(MATHLIBS)
 check_ups_LDADD = $(NETLIBS)
-check_users_LDADD = $(BASEOBJS) popen.o
+check_users_LDADD = $(BASEOBJS)
 check_by_ssh_LDADD = $(NETLIBS)
 check_ide_smart_LDADD = $(BASEOBJS)
 negate_LDADD = $(BASEOBJS)
diff --git a/plugins/check_http.c b/plugins/check_http.c
index 3175f6cb..315848fc 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -34,7 +34,7 @@
 /* splint -I. -I../../plugins -I../../lib/ -I/usr/kerberos/include/ ../../plugins/check_http.c */
 
 const char *progname = "check_http";
-const char *copyright = "1999-2008";
+const char *copyright = "1999-2011";
 const char *email = "nagiosplug-devel@lists.sourceforge.net";
 
 #include "common.h"
@@ -59,6 +59,7 @@ enum {
 #ifdef HAVE_SSL
 int check_cert = FALSE;
 int days_till_exp;
+int ssl_version;
 char *randbuff;
 X509 *server_cert;
 #  define my_recv(buf, len) ((use_ssl) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
@@ -188,7 +189,7 @@ process_arguments (int argc, char **argv)
     STD_LONG_OPTS,
     {"link", no_argument, 0, 'L'},
     {"nohtml", no_argument, 0, 'n'},
-    {"ssl", no_argument, 0, 'S'},
+    {"ssl", optional_argument, 0, 'S'},
     {"sni", no_argument, 0, SNI_OPTION},
     {"post", required_argument, 0, 'P'},
     {"method", required_argument, 0, 'j'},
@@ -234,7 +235,7 @@ process_arguments (int argc, char **argv)
   }
 
   while (1) {
-    c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:e:p:s:R:r:u:f:C:nlLSm:M:N", longopts, &option);
+    c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:e:p:s:R:r:u:f:C:nlLS::m:M:N", longopts, &option);
     if (c == -1 || c == EOF)
       break;
 
@@ -294,6 +295,13 @@ process_arguments (int argc, char **argv)
       usage4 (_("Invalid option - SSL is not available"));
 #endif
       use_ssl = TRUE;
+      if (optarg == NULL || c != 'S')
+        ssl_version = 0;
+      else {
+        ssl_version = atoi(optarg);
+        if (ssl_version < 1 || ssl_version > 3)
+            usage4 (_("Invalid option - Valid values for SSL Version are 1 (TLSv1), 2 (SSLv2) or 3 (SSLv3)"));
+      }
       if (specify_port == FALSE)
         server_port = HTTPS_PORT;
       break;
@@ -798,7 +806,9 @@ check_http (void)
     die (STATE_CRITICAL, _("HTTP CRITICAL - Unable to open TCP socket\n"));
 #ifdef HAVE_SSL
   if (use_ssl == TRUE) {
-    np_net_ssl_init_with_hostname(sd, (use_sni ? host_name : NULL));
+    result = np_net_ssl_init_with_hostname_and_version(sd, (use_sni ? host_name : NULL), ssl_version);
+    if (result != STATE_OK)
+      return result;
     if (check_cert == TRUE) {
       result = np_net_ssl_check_cert(days_till_exp);
       np_net_ssl_cleanup();
@@ -1323,8 +1333,9 @@ print_help (void)
   printf (UT_IPv46);
 
 #ifdef HAVE_SSL
-  printf (" %s\n", "-S, --ssl");
-  printf ("    %s\n", _("Connect via SSL. Port defaults to 443"));
+  printf (" %s\n", "-S, --ssl=VERSION");
+  printf ("    %s\n", _("Connect via SSL. Port defaults to 443. VERSION is optional, and prevents"));
+  printf ("    %s\n", _("auto-negotiation (1 = TLSv1, 2 = SSLv2, 3 = SSLv3)."));
   printf (" %s\n", "--sni");
   printf ("    %s\n", _("Enable SSL/TLS hostname extension support (SNI)"));
   printf (" %s\n", "-C, --certificate=INTEGER");
@@ -1433,6 +1444,6 @@ print_usage (void)
   printf ("       [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]\n");
   printf ("       [-e <expect>] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
   printf ("       [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
-  printf ("       [-A string] [-k string] [-S] [--sni] [-C <age>] [-T <content-type>]\n");
+  printf ("       [-A string] [-k string] [-S <version>] [--sni] [-C <age>] [-T <content-type>]\n");
   printf ("       [-j method]\n");
 }
diff --git a/plugins/check_ping.c b/plugins/check_ping.c
index 9f9dcabd..23dcd6a8 100644
--- a/plugins/check_ping.c
+++ b/plugins/check_ping.c
@@ -432,6 +432,7 @@ run_ping (const char *cmd, const char *addr)
 {
         char buf[MAX_INPUT_BUFFER];
         int result = STATE_UNKNOWN;
+        int match;
 
         if ((child_process = spopen (cmd)) == NULL)
                 die (STATE_UNKNOWN, _("Could not open pipe: %s\n"), cmd);
@@ -448,28 +449,29 @@ run_ping (const char *cmd, const char *addr)
                 result = max_state (result, error_scan (buf, addr));
 
                 /* get the percent loss statistics */
-                if(sscanf(buf,"%*d packets transmitted, %*d packets received, +%*d errors, %d%% packet loss",&pl)==1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d packets received, +%*d duplicates, %d%% packet loss", &pl) == 1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d received, +%*d duplicates, %d%% packet loss", &pl) == 1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d packets received, %d%% packet loss",&pl)==1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d packets received, %d%% loss, time",&pl)==1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d received, %d%% loss, time", &pl)==1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d received, %d%% packet loss, time", &pl)==1 ||
-                         sscanf(buf,"%*d packets transmitted, %*d received, +%*d errors, %d%% packet loss", &pl) == 1 ||
-                         sscanf(buf,"%*d packets transmitted %*d received, +%*d errors, %d%% packet loss", &pl) == 1
+                match = 0;
+                if((sscanf(buf,"%*d packets transmitted, %*d packets received, +%*d errors, %d%% packet loss%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d packets received, +%*d duplicates, %d%% packet loss%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d received, +%*d duplicates, %d%% packet loss%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d packets received, %d%% packet loss%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d packets received, %d%% loss, time%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d received, %d%% loss, time%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d received, %d%% packet loss, time%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted, %*d received, +%*d errors, %d%% packet loss%n",&pl,&match) && match) ||
+                         (sscanf(buf,"%*d packets transmitted %*d received, +%*d errors, %d%% packet loss%n",&pl,&match) && match)
                          )
                         continue;
 
                 /* get the round trip average */
                 else
-                        if(sscanf(buf,"round-trip min/avg/max = %*f/%f/%*f",&rta)==1 ||
-                                 sscanf(buf,"round-trip min/avg/max/mdev = %*f/%f/%*f/%*f",&rta)==1 ||
-                                 sscanf(buf,"round-trip min/avg/max/sdev = %*f/%f/%*f/%*f",&rta)==1 ||
-                                 sscanf(buf,"round-trip min/avg/max/stddev = %*f/%f/%*f/%*f",&rta)==1 ||
-                                 sscanf(buf,"round-trip min/avg/max/std-dev = %*f/%f/%*f/%*f",&rta)==1 ||
-                                 sscanf(buf,"round-trip (ms) min/avg/max = %*f/%f/%*f",&rta)==1 ||
-                                 sscanf(buf,"round-trip (ms) min/avg/max/stddev = %*f/%f/%*f/%*f",&rta)==1 ||
-                                 sscanf(buf,"rtt min/avg/max/mdev = %*f/%f/%*f/%*f ms",&rta)==1)
+                        if((sscanf(buf,"round-trip min/avg/max = %*f/%f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"round-trip min/avg/max/mdev = %*f/%f/%*f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"round-trip min/avg/max/sdev = %*f/%f/%*f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"round-trip min/avg/max/stddev = %*f/%f/%*f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"round-trip min/avg/max/std-dev = %*f/%f/%*f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"round-trip (ms) min/avg/max = %*f/%f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"round-trip (ms) min/avg/max/stddev = %*f/%f/%*f/%*f%n",&rta,&match) && match) ||
+                                 (sscanf(buf,"rtt min/avg/max/mdev = %*f/%f/%*f/%*f ms%n",&rta,&match) && match))
                         continue;
         }
 
@@ -498,9 +500,7 @@ run_ping (const char *cmd, const char *addr)
         (void) fclose (child_stderr);
 
 
-        /* close the pipe - WARNING if status is set */
-        if (spclose (child_process))
-                result = max_state (result, STATE_WARNING);
+        spclose (child_process);
 
         if (warn_text == NULL)
                 warn_text = strdup("");
@@ -534,7 +534,7 @@ error_scan (char buf[MAX_INPUT_BUFFER], const char *addr)
         else if (strstr (buf, "Time to live exceeded"))
                 die (STATE_CRITICAL, _("CRITICAL - Time to live exceeded (%s)"), addr);
         else if (strstr (buf, "Destination unreachable: "))
-                die (STATE_CRITICAL, _("CRITICAL - DestinationUnreachable (%s)"), addr);
+                die (STATE_CRITICAL, _("CRITICAL - Destination Unreachable (%s)"), addr);
 
         if (strstr (buf, "(DUP!)") || strstr (buf, "DUPLICATES FOUND")) {
                 if (warn_text == NULL)
diff --git a/plugins/check_users.c b/plugins/check_users.c
index 8368612a..37662928 100644
--- a/plugins/check_users.c
+++ b/plugins/check_users.c
@@ -3,7 +3,7 @@
 * Nagios check_users plugin
 * 
 * License: GPL
-* Copyright (c) 2000-2007 Nagios Plugins Development Team
+* Copyright (c) 2000-2012 Nagios Plugins Development Team
 * 
 * Description:
 * 
@@ -35,8 +35,8 @@ const char *copyright = "2000-2007";
 const char *email = "nagiosplug-devel@lists.sourceforge.net";
 
 #include "common.h"
-#include "popen.h"
 #include "utils.h"
+#include <utmpx.h>
 
 #define possibly_set(a,b) ((a) == 0 ? (b) : 0)
 
@@ -52,58 +52,33 @@ main (int argc, char **argv)
 {
         int users = -1;
         int result = STATE_UNKNOWN;
-        char input_buffer[MAX_INPUT_BUFFER];
         char *perf;
+        struct utmpx *putmpx;
 
         setlocale (LC_ALL, "");
         bindtextdomain (PACKAGE, LOCALEDIR);
         textdomain (PACKAGE);
 
-        perf = strdup("");
+        perf = strdup ("");
 
         /* Parse extra opts if any */
-        argv=np_extra_opts (&argc, argv, progname);
+        argv = np_extra_opts (&argc, argv, progname);
 
         if (process_arguments (argc, argv) == ERROR)
                 usage4 (_("Could not parse arguments"));
 
-        /* run the command */
-        child_process = spopen (WHO_COMMAND);
-        if (child_process == NULL) {
-                printf (_("Could not open pipe: %s\n"), WHO_COMMAND);
-                return STATE_UNKNOWN;
-        }
-
-        child_stderr = fdopen (child_stderr_array[fileno (child_process)], "r");
-        if (child_stderr == NULL)
-                printf (_("Could not open stderr for %s\n"), WHO_COMMAND);
-
         users = 0;
 
-        while (fgets (input_buffer, MAX_INPUT_BUFFER - 1, child_process)) {
+        /* get currently logged users from utmpx */
+        setutxent ();
 
-                /* increment 'users' on all lines except total user count */
-                if (input_buffer[0] != '#') {
+        while ((putmpx = getutxent ()) != NULL)
+                if (putmpx->ut_type == USER_PROCESS)
                         users++;
-                        continue;
-                }
-
-                /* get total logged in users */
-                if (sscanf (input_buffer, _("# users=%d"), &users) == 1)
-                        break;
-
-        }
 
-        /* check STDERR */
-        if (fgets (input_buffer, MAX_INPUT_BUFFER - 1, child_stderr))
-                result = possibly_set (result, STATE_UNKNOWN);
-        (void) fclose (child_stderr);
+        endutxent ();
 
-        /* close the pipe */
-        if (spclose (child_process))
-                result = possibly_set (result, STATE_UNKNOWN);
-
-        /* else check the user count against warning and critical thresholds */
+        /* check the user count against warning and critical thresholds */
         if (users > cusers)
                 result = STATE_CRITICAL;
         else if (users > wusers)
@@ -114,7 +89,7 @@ main (int argc, char **argv)
         if (result == STATE_UNKNOWN)
                 printf ("%s\n", _("Unable to read output"));
         else {
-                asprintf(&perf, "%s", perfdata ("users", users, "",
+                asprintf (&perf, "%s", perfdata ("users", users, "",
                   TRUE, wusers,
                   TRUE, cusers,
                   TRUE, 0,
@@ -126,14 +101,11 @@ main (int argc, char **argv)
         return result;
 }
 
-
-
 /* process command-line arguments */
 int
 process_arguments (int argc, char **argv)
 {
         int c;
-
         int option = 0;
         static struct option longopts[] = {
                 {"critical", required_argument, 0, 'c'},
@@ -183,7 +155,6 @@ process_arguments (int argc, char **argv)
                 else
                         wusers = atoi (argv[c++]);
         }
-
         if (cusers == -1 && argc > c) {
                 if (is_intnonneg (argv[c]) == FALSE)
                         usage4 (_("Warning threshold must be a positive integer"));
@@ -194,8 +165,6 @@ process_arguments (int argc, char **argv)
         return OK;
 }
 
-
-
 void
 print_help (void)
 {
@@ -205,9 +174,9 @@ print_help (void)
         printf (COPYRIGHT, copyright, email);
 
         printf ("%s\n", _("This plugin checks the number of users currently logged in on the local"));
-  printf ("%s\n", _("system and generates an error if the number exceeds the thresholds specified."));
+        printf ("%s\n", _("system and generates an error if the number exceeds the thresholds specified."));
 
-  printf ("\n\n");
+        printf ("\n\n");
 
         print_usage ();
 
@@ -215,17 +184,16 @@ print_help (void)
         printf (UT_EXTRA_OPTS);
 
         printf (" %s\n", "-w, --warning=INTEGER");
-  printf ("    %s\n", _("Set WARNING status if more than INTEGER users are logged in"));
-  printf (" %s\n", "-c, --critical=INTEGER");
-  printf ("    %s\n", _("Set CRITICAL status if more than INTEGER users are logged in"));
+        printf ("    %s\n", _("Set WARNING status if more than INTEGER users are logged in"));
+        printf (" %s\n", "-c, --critical=INTEGER");
+        printf ("    %s\n", _("Set CRITICAL status if more than INTEGER users are logged in"));
 
         printf (UT_SUPPORT);
 }
 
-
 void
 print_usage (void)
 {
-  printf ("%s\n", _("Usage:"));
+        printf ("%s\n", _("Usage:"));
         printf ("%s -w <users> -c <users>\n", progname);
 }
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index 0bc61ed3..5425bb2c 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -36,66 +36,97 @@ static SSL_CTX *c=NULL;
 static SSL *s=NULL;
 static int initialized=0;
 
-int np_net_ssl_init (int sd) {
-                return np_net_ssl_init_with_hostname(sd, NULL);
+int np_net_ssl_init(int sd) {
+        return np_net_ssl_init_with_hostname(sd, NULL);
 }
 
-int np_net_ssl_init_with_hostname (int sd, char *host_name) {
-                if (!initialized) {
-                        /* Initialize SSL context */
-                        SSLeay_add_ssl_algorithms ();
-                        SSL_load_error_strings ();
-                        OpenSSL_add_all_algorithms ();
-                        initialized = 1;
-                }
-                if ((c = SSL_CTX_new (SSLv23_client_method ())) == NULL) {
-                                printf ("%s\n", _("CRITICAL - Cannot create SSL context."));
-                                return STATE_CRITICAL;
-                }
-                if ((s = SSL_new (c)) != NULL){
+int np_net_ssl_init_with_hostname(int sd, char *host_name) {
+        return np_net_ssl_init_with_hostname_and_version(sd, host_name, 0);
+}
+
+int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int version) {
+        const SSL_METHOD *method = NULL;
+
+        switch (version) {
+        case 0: /* Deafult to auto negotiation */
+                method = SSLv23_client_method();
+                break;
+        case 1: /* TLSv1 protocol */
+                method = TLSv1_client_method();
+                break;
+        case 2: /* SSLv2 protocol */
+#if defined(USE_GNUTLS) || defined(OPENSSL_NO_SSL2)
+                printf(("%s\n", _("CRITICAL - SSL protocol version 2 is not supported by your SSL library.")));
+                return STATE_CRITICAL;
+#else
+                method = SSLv2_client_method();
+#endif
+                break;
+        case 3: /* SSLv3 protocol */
+                method = SSLv3_client_method();
+                break;
+        default: /* Unsupported */
+                printf("%s\n", _("CRITICAL - Unsupported SSL protocol version."));
+                return STATE_CRITICAL;
+        }
+        if (!initialized) {
+                /* Initialize SSL context */
+                SSLeay_add_ssl_algorithms();
+                SSL_load_error_strings();
+                OpenSSL_add_all_algorithms();
+                initialized = 1;
+        }
+        if ((c = SSL_CTX_new(method)) == NULL) {
+                printf("%s\n", _("CRITICAL - Cannot create SSL context."));
+                return STATE_CRITICAL;
+        }
+#ifdef SSL_OP_NO_TICKET
+        SSL_CTX_set_options(c, SSL_OP_NO_TICKET);
+#endif
+        if ((s = SSL_new(c)) != NULL) {
 #ifdef SSL_set_tlsext_host_name
-                                if (host_name != NULL)
-                                        SSL_set_tlsext_host_name(s, host_name);
+                if (host_name != NULL)
+                        SSL_set_tlsext_host_name(s, host_name);
 #endif
-                                SSL_set_fd (s, sd);
-                                if (SSL_connect(s) == 1){
-                                                return OK;
-                                } else {
-                                                printf ("%s\n", _("CRITICAL - Cannot make SSL connection "));
+                SSL_set_fd(s, sd);
+                if (SSL_connect(s) == 1) {
+                        return OK;
+                } else {
+                        printf("%s\n", _("CRITICAL - Cannot make SSL connection."));
 #  ifdef USE_OPENSSL /* XXX look into ERR_error_string */
-                                                ERR_print_errors_fp (stdout);
+                        ERR_print_errors_fp(stdout);
 #  endif /* USE_OPENSSL */
-                                }
-                } else {
-                                printf ("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
                 }
-                return STATE_CRITICAL;
+        } else {
+                        printf("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
+        }
+        return STATE_CRITICAL;
 }
 
-void np_net_ssl_cleanup (){
-                if(s){
+void np_net_ssl_cleanup() {
+        if (s) {
 #ifdef SSL_set_tlsext_host_name
-                                SSL_set_tlsext_host_name(s, NULL);
+                SSL_set_tlsext_host_name(s, NULL);
 #endif
-                                SSL_shutdown (s);
-                                SSL_free (s);
-                                if(c) {
-                                        SSL_CTX_free (c);
-                                        c=NULL;
-                                }
-                                s=NULL;
+                SSL_shutdown(s);
+                SSL_free(s);
+                if (c) {
+                        SSL_CTX_free(c);
+                        c=NULL;
                 }
+                s=NULL;
+        }
 }
 
-int np_net_ssl_write(const void *buf, int num){
+int np_net_ssl_write(const void *buf, int num) {
         return SSL_write(s, buf, num);
 }
 
-int np_net_ssl_read(void *buf, int num){
+int np_net_ssl_read(void *buf, int num) {
         return SSL_read(s, buf, num);
 }
 
-int np_net_ssl_check_cert(int days_till_exp){
+int np_net_ssl_check_cert(int days_till_exp) {
 #  ifdef USE_OPENSSL
         X509 *certificate=NULL;
         X509_NAME *subj=NULL;
@@ -111,29 +142,29 @@ int np_net_ssl_check_cert(int days_till_exp){
         char timestamp[17] = "";
 
         certificate=SSL_get_peer_certificate(s);
-        if(! certificate){
-                printf ("%s\n",_("CRITICAL - Cannot retrieve server certificate."));
+        if (!certificate) {
+                printf("%s\n",_("CRITICAL - Cannot retrieve server certificate."));
                 return STATE_CRITICAL;
         }
 
         /* Extract CN from certificate subject */
         subj=X509_get_subject_name(certificate);
 
-        if(! subj){
-                printf ("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
+        if (!subj) {
+                printf("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
                 return STATE_CRITICAL;
         }
-        cnlen = X509_NAME_get_text_by_NID (subj, NID_commonName, cn, sizeof(cn));
-        if ( cnlen == -1 )
-                strcpy(cn , _("Unknown CN"));
+        cnlen = X509_NAME_get_text_by_NID(subj, NID_commonName, cn, sizeof(cn));
+        if (cnlen == -1)
+                strcpy(cn, _("Unknown CN"));
 
         /* Retrieve timestamp of certificate */
-        tm = X509_get_notAfter (certificate);
+        tm = X509_get_notAfter(certificate);
 
         /* Generate tm structure to process timestamp */
         if (tm->type == V_ASN1_UTCTIME) {
                 if (tm->length < 10) {
-                        printf ("%s\n", _("CRITICAL - Wrong time format in certificate."));
+                        printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
                         return STATE_CRITICAL;
                 } else {
                         stamp.tm_year = (tm->data[0] - '0') * 10 + (tm->data[1] - '0');
@@ -143,7 +174,7 @@ int np_net_ssl_check_cert(int days_till_exp){
                 }
         } else {
                 if (tm->length < 12) {
-                        printf ("%s\n", _("CRITICAL - Wrong time format in certificate."));
+                        printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
                         return STATE_CRITICAL;
                 } else {
                         stamp.tm_year =
@@ -172,22 +203,22 @@ int np_net_ssl_check_cert(int days_till_exp){
                  stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
 
         if (days_left > 0 && days_left <= days_till_exp) {
-                printf (_("WARNING - Certificate '%s' expires in %d day(s) (%s).\n"), cn, days_left, timestamp);
+                printf(_("WARNING - Certificate '%s' expires in %d day(s) (%s).\n"), cn, days_left, timestamp);
                 status=STATE_WARNING;
         } else if (time_left < 0) {
-                printf (_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
+                printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
                 status=STATE_CRITICAL;
         } else if (days_left == 0) {
-                printf (_("WARNING - Certificate '%s' expires today (%s).\n"), cn, timestamp);
+                printf(_("WARNING - Certificate '%s' expires today (%s).\n"), cn, timestamp);
                 status=STATE_WARNING;
         } else {
-                printf (_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
+                printf(_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
                 status=STATE_OK;
         }
-        X509_free (certificate);
+        X509_free(certificate);
         return status;
 #  else /* ifndef USE_OPENSSL */
-        printf ("%s\n", _("WARNING - Plugin does not support checking certificates."));
+        printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
         return STATE_WARNING;
 #  endif /* USE_OPENSSL */
 }
diff --git a/plugins/t/check_by_ssh.t b/plugins/t/check_by_ssh.t
index cca72c96..8d1b1904 100644
--- a/plugins/t/check_by_ssh.t
+++ b/plugins/t/check_by_ssh.t
@@ -27,11 +27,11 @@ plan skip_all => "SSH_HOST and SSH_IDENTITY must be defined" unless ($ssh_servic
 plan tests => 42;
 
 # Some random check strings/response
-my @responce = ('OK: Everything is fine!',
-                'WARNING: Hey, pick me, pick me!',
-                'CRITICAL: Shit happens...',
-                'UNKNOWN: What can I do for ya?',
-                'WOOPS: What did I smoke?',
+my @responce = ('OK: Everything is fine',
+                'WARNING: Hey, pick me, pick me',
+                'CRITICAL: Shit happens',
+                'UNKNOWN: What can I do for ya',
+                'WOOPS: What did I smoke',
 );
 my @responce_re;
 my @check;