summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--plugins/check_ssh.c398
1 files changed, 178 insertions, 220 deletions
diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index e9c55ad..42a88cf 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -1,32 +1,32 @@
1/***************************************************************************** 1/*****************************************************************************
2* 2 *
3* Monitoring check_ssh plugin 3 * Monitoring check_ssh plugin
4* 4 *
5* License: GPL 5 * License: GPL
6* Copyright (c) 2000-2024 Monitoring Plugins Development Team 6 * Copyright (c) 2000-2024 Monitoring Plugins Development Team
7* 7 *
8* Description: 8 * Description:
9* 9 *
10* This file contains the check_ssh plugin 10 * This file contains the check_ssh plugin
11* 11 *
12* Try to connect to an SSH server at specified server and port 12 * Try to connect to an SSH server at specified server and port
13* 13 *
14* 14 *
15* This program is free software: you can redistribute it and/or modify 15 * This program is free software: you can redistribute it and/or modify
16* it under the terms of the GNU General Public License as published by 16 * it under the terms of the GNU General Public License as published by
17* the Free Software Foundation, either version 3 of the License, or 17 * the Free Software Foundation, either version 3 of the License, or
18* (at your option) any later version. 18 * (at your option) any later version.
19* 19 *
20* This program is distributed in the hope that it will be useful, 20 * This program is distributed in the hope that it will be useful,
21* but WITHOUT ANY WARRANTY; without even the implied warranty of 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23* GNU General Public License for more details. 23 * GNU General Public License for more details.
24* 24 *
25* You should have received a copy of the GNU General Public License 25 * You should have received a copy of the GNU General Public License
26* along with this program. If not, see <http://www.gnu.org/licenses/>. 26 * along with this program. If not, see <http://www.gnu.org/licenses/>.
27* 27 *
28* 28 *
29*****************************************************************************/ 29 *****************************************************************************/
30 30
31const char *progname = "check_ssh"; 31const char *progname = "check_ssh";
32const char *copyright = "2000-2024"; 32const char *copyright = "2000-2024";
@@ -37,108 +37,96 @@ const char *email = "devel@monitoring-plugins.org";
37#include "utils.h" 37#include "utils.h"
38 38
39#ifndef MSG_DONTWAIT 39#ifndef MSG_DONTWAIT
40#define MSG_DONTWAIT 0 40# define MSG_DONTWAIT 0
41#endif 41#endif
42 42
43#define SSH_DFL_PORT 22 43#define SSH_DFL_PORT 22
44#define BUFF_SZ 256 44#define BUFF_SZ 256
45 45
46int port = -1; 46static int port = -1;
47char *server_name = NULL; 47static char *server_name = NULL;
48char *remote_version = NULL; 48static char *remote_version = NULL;
49char *remote_protocol = NULL; 49static char *remote_protocol = NULL;
50bool verbose = false; 50static bool verbose = false;
51 51
52int process_arguments (int, char **); 52static int process_arguments(int /*argc*/, char ** /*argv*/);
53int validate_arguments (void); 53static int validate_arguments(void);
54void print_help (void); 54static void print_help(void);
55void print_usage (void); 55void print_usage(void);
56 56
57int ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol); 57static int ssh_connect(char *haddr, int hport, char *remote_version, char *remote_protocol);
58 58
59 59int main(int argc, char **argv) {
60int 60 setlocale(LC_ALL, "");
61main (int argc, char **argv) 61 bindtextdomain(PACKAGE, LOCALEDIR);
62{ 62 textdomain(PACKAGE);
63 int result = STATE_UNKNOWN;
64
65 setlocale (LC_ALL, "");
66 bindtextdomain (PACKAGE, LOCALEDIR);
67 textdomain (PACKAGE);
68 63
69 /* Parse extra opts if any */ 64 /* Parse extra opts if any */
70 argv=np_extra_opts (&argc, argv, progname); 65 argv = np_extra_opts(&argc, argv, progname);
71 66
72 if (process_arguments (argc, argv) == ERROR) 67 if (process_arguments(argc, argv) == ERROR)
73 usage4 (_("Could not parse arguments")); 68 usage4(_("Could not parse arguments"));
74 69
75 /* initialize alarm signal handling */ 70 /* initialize alarm signal handling */
76 signal (SIGALRM, socket_timeout_alarm_handler); 71 signal(SIGALRM, socket_timeout_alarm_handler);
77 72
78 alarm (socket_timeout); 73 alarm(socket_timeout);
79 74
80 /* ssh_connect exits if error is found */ 75 /* ssh_connect exits if error is found */
81 result = ssh_connect (server_name, port, remote_version, remote_protocol); 76 int result = ssh_connect(server_name, port, remote_version, remote_protocol);
82 77
83 alarm (0); 78 alarm(0);
84 79
85 return (result); 80 return (result);
86} 81}
87 82
88
89
90/* process command-line arguments */ 83/* process command-line arguments */
91int 84int process_arguments(int argc, char **argv) {
92process_arguments (int argc, char **argv) 85 static struct option longopts[] = {{"help", no_argument, 0, 'h'},
93{ 86 {"version", no_argument, 0, 'V'},
94 int c; 87 {"host", required_argument, 0, 'H'}, /* backward compatibility */
95 88 {"hostname", required_argument, 0, 'H'},
96 int option = 0; 89 {"port", required_argument, 0, 'p'},
97 static struct option longopts[] = { 90 {"use-ipv4", no_argument, 0, '4'},
98 {"help", no_argument, 0, 'h'}, 91 {"use-ipv6", no_argument, 0, '6'},
99 {"version", no_argument, 0, 'V'}, 92 {"timeout", required_argument, 0, 't'},
100 {"host", required_argument, 0, 'H'}, /* backward compatibility */ 93 {"verbose", no_argument, 0, 'v'},
101 {"hostname", required_argument, 0, 'H'}, 94 {"remote-version", required_argument, 0, 'r'},
102 {"port", required_argument, 0, 'p'}, 95 {"remote-protocol", required_argument, 0, 'P'},
103 {"use-ipv4", no_argument, 0, '4'}, 96 {0, 0, 0, 0}};
104 {"use-ipv6", no_argument, 0, '6'},
105 {"timeout", required_argument, 0, 't'},
106 {"verbose", no_argument, 0, 'v'},
107 {"remote-version", required_argument, 0, 'r'},
108 {"remote-protocol", required_argument, 0, 'P'},
109 {0, 0, 0, 0}
110 };
111 97
112 if (argc < 2) 98 if (argc < 2)
113 return ERROR; 99 return ERROR;
114 100
115 for (c = 1; c < argc; c++) 101 for (int i = 1; i < argc; i++)
116 if (strcmp ("-to", argv[c]) == 0) 102 if (strcmp("-to", argv[i]) == 0)
117 strcpy (argv[c], "-t"); 103 strcpy(argv[i], "-t");
118 104
119 while (1) { 105 int option_char;
120 c = getopt_long (argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option); 106 while (true) {
107 int option = 0;
108 option_char = getopt_long(argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option);
121 109
122 if (c == -1 || c == EOF) 110 if (option_char == -1 || option_char == EOF)
123 break; 111 break;
124 112
125 switch (c) { 113 switch (option_char) {
126 case '?': /* help */ 114 case '?': /* help */
127 usage5 (); 115 usage5();
128 case 'V': /* version */ 116 case 'V': /* version */
129 print_revision (progname, NP_VERSION); 117 print_revision(progname, NP_VERSION);
130 exit (STATE_UNKNOWN); 118 exit(STATE_UNKNOWN);
131 case 'h': /* help */ 119 case 'h': /* help */
132 print_help (); 120 print_help();
133 exit (STATE_UNKNOWN); 121 exit(STATE_UNKNOWN);
134 case 'v': /* verbose */ 122 case 'v': /* verbose */
135 verbose = true; 123 verbose = true;
136 break; 124 break;
137 case 't': /* timeout period */ 125 case 't': /* timeout period */
138 if (!is_integer (optarg)) 126 if (!is_integer(optarg))
139 usage2 (_("Timeout interval must be a positive integer"), optarg); 127 usage2(_("Timeout interval must be a positive integer"), optarg);
140 else 128 else
141 socket_timeout = atoi (optarg); 129 socket_timeout = atoi(optarg);
142 break; 130 break;
143 case '4': 131 case '4':
144 address_family = AF_INET; 132 address_family = AF_INET;
@@ -147,121 +135,104 @@ process_arguments (int argc, char **argv)
147#ifdef USE_IPV6 135#ifdef USE_IPV6
148 address_family = AF_INET6; 136 address_family = AF_INET6;
149#else 137#else
150 usage4 (_("IPv6 support not available")); 138 usage4(_("IPv6 support not available"));
151#endif 139#endif
152 break; 140 break;
153 case 'r': /* remote version */ 141 case 'r': /* remote version */
154 remote_version = optarg; 142 remote_version = optarg;
155 break; 143 break;
156 case 'P': /* remote version */ 144 case 'P': /* remote version */
157 remote_protocol = optarg; 145 remote_protocol = optarg;
158 break; 146 break;
159 case 'H': /* host */ 147 case 'H': /* host */
160 if (!is_host (optarg)) 148 if (!is_host(optarg))
161 usage2 (_("Invalid hostname/address"), optarg); 149 usage2(_("Invalid hostname/address"), optarg);
162 server_name = optarg; 150 server_name = optarg;
163 break; 151 break;
164 case 'p': /* port */ 152 case 'p': /* port */
165 if (is_intpos (optarg)) { 153 if (is_intpos(optarg)) {
166 port = atoi (optarg); 154 port = atoi(optarg);
167 } 155 } else {
168 else { 156 usage2(_("Port number must be a positive integer"), optarg);
169 usage2 (_("Port number must be a positive integer"), optarg);
170 } 157 }
171 } 158 }
172 } 159 }
173 160
174 c = optind; 161 option_char = optind;
175 if (server_name == NULL && c < argc) { 162 if (server_name == NULL && option_char < argc) {
176 if (is_host (argv[c])) { 163 if (is_host(argv[option_char])) {
177 server_name = argv[c++]; 164 server_name = argv[option_char++];
178 } 165 }
179 } 166 }
180 167
181 if (port == -1 && c < argc) { 168 if (port == -1 && option_char < argc) {
182 if (is_intpos (argv[c])) { 169 if (is_intpos(argv[option_char])) {
183 port = atoi (argv[c++]); 170 port = atoi(argv[option_char++]);
184 } 171 } else {
185 else { 172 print_usage();
186 print_usage (); 173 exit(STATE_UNKNOWN);
187 exit (STATE_UNKNOWN);
188 } 174 }
189 } 175 }
190 176
191 return validate_arguments (); 177 return validate_arguments();
192} 178}
193 179
194int 180int validate_arguments(void) {
195validate_arguments (void)
196{
197 if (server_name == NULL) 181 if (server_name == NULL)
198 return ERROR; 182 return ERROR;
199 if (port == -1) /* funky, but allows -p to override stray integer in args */ 183 if (port == -1) /* funky, but allows -p to override stray integer in args */
200 port = SSH_DFL_PORT; 184 port = SSH_DFL_PORT;
201 return OK; 185 return OK;
202} 186}
203 187
204
205/************************************************************************ 188/************************************************************************
206* 189 *
207* Try to connect to SSH server at specified server and port 190 * Try to connect to SSH server at specified server and port
208* 191 *
209*-----------------------------------------------------------------------*/ 192 *-----------------------------------------------------------------------*/
210
211
212int
213ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol)
214{
215 int sd;
216 int result;
217 int len = 0;
218 ssize_t recv_ret = 0;
219 char *version_control_string = NULL;
220 char *buffer = NULL;
221 char *ssh_proto = NULL;
222 char *ssh_server = NULL;
223 static char *rev_no = VERSION;
224 struct timeval tv;
225 double elapsed_time;
226 193
194int ssh_connect(char *haddr, int hport, char *remote_version, char *remote_protocol) {
195 struct timeval tv;
227 gettimeofday(&tv, NULL); 196 gettimeofday(&tv, NULL);
228 197
229 result = my_tcp_connect (haddr, hport, &sd); 198 int socket;
199 int result = my_tcp_connect(haddr, hport, &socket);
230 200
231 if (result != STATE_OK) 201 if (result != STATE_OK)
232 return result; 202 return result;
233 203
234 char *output = (char *) calloc (BUFF_SZ + 1, sizeof(char)); 204 char *output = (char *)calloc(BUFF_SZ + 1, sizeof(char));
235 205 char *buffer = NULL;
236 unsigned int iteration = 0; 206 ssize_t recv_ret = 0;
207 char *version_control_string = NULL;
237 ssize_t byte_offset = 0; 208 ssize_t byte_offset = 0;
238 209 while ((version_control_string == NULL) && (recv_ret = recv(socket, output + byte_offset, BUFF_SZ - byte_offset, 0) > 0)) {
239 while ((version_control_string == NULL) && (recv_ret = recv(sd, output+byte_offset, BUFF_SZ - byte_offset, 0) > 0)) {
240 210
241 if (strchr(output, '\n')) { /* we've got at least one full line, start parsing*/ 211 if (strchr(output, '\n')) { /* we've got at least one full line, start parsing*/
242 byte_offset = 0; 212 byte_offset = 0;
243 213
244 char *index = NULL; 214 char *index = NULL;
245 while ((index = strchr(output+byte_offset, '\n')) != NULL) { 215 int len = 0;
216 while ((index = strchr(output + byte_offset, '\n')) != NULL) {
246 /*Partition the buffer so that this line is a separate string, 217 /*Partition the buffer so that this line is a separate string,
247 * by replacing the newline with NUL*/ 218 * by replacing the newline with NUL*/
248 output[(index - output)] = '\0'; 219 output[(index - output)] = '\0';
249 len = strlen(output + byte_offset); 220 len = strlen(output + byte_offset);
250 221
251 if ((len >= 4) && (strncmp (output+byte_offset, "SSH-", 4) == 0)) { 222 if ((len >= 4) && (strncmp(output + byte_offset, "SSH-", 4) == 0)) {
252 /*if the string starts with SSH-, this _should_ be a valid version control string*/ 223 /*if the string starts with SSH-, this _should_ be a valid version control string*/
253 version_control_string = output+byte_offset; 224 version_control_string = output + byte_offset;
254 break; 225 break;
255 } 226 }
256 227
257 /*the start of the next line (if one exists) will be after the current one (+ NUL)*/ 228 /*the start of the next line (if one exists) will be after the current one (+ NUL)*/
258 byte_offset += (len + 1); 229 byte_offset += (len + 1);
259 } 230 }
260 231
261 if(version_control_string == NULL) { 232 if (version_control_string == NULL) {
262 /* move unconsumed data to beginning of buffer, null rest */ 233 /* move unconsumed data to beginning of buffer, null rest */
263 memmove((void *)output, (void *)output+byte_offset+1, BUFF_SZ - len+1); 234 memmove((void *)output, (void *)(output + byte_offset + 1), BUFF_SZ - len + 1);
264 memset(output+byte_offset+1, 0, BUFF_SZ-byte_offset+1); 235 memset(output + byte_offset + 1, 0, BUFF_SZ - byte_offset + 1);
265 236
266 /*start reading from end of current line chunk on next recv*/ 237 /*start reading from end of current line chunk on next recv*/
267 byte_offset = strlen(output); 238 byte_offset = strlen(output);
@@ -287,10 +258,11 @@ ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol
287 * SSH-protoversion-softwareversion SP comments CR LF" 258 * SSH-protoversion-softwareversion SP comments CR LF"
288 * - RFC 4253:4.2 259 * - RFC 4253:4.2
289 */ 260 */
290 strip (version_control_string); 261 strip(version_control_string);
291 if (verbose) 262 if (verbose)
292 printf ("%s\n", version_control_string); 263 printf("%s\n", version_control_string);
293 ssh_proto = version_control_string + 4; 264
265 char *ssh_proto = version_control_string + 4;
294 266
295 /* 267 /*
296 * We assume the protoversion is of the form Major.Minor, although 268 * We assume the protoversion is of the form Major.Minor, although
@@ -308,7 +280,7 @@ ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol
308 * "1.x" (e.g., "1.5" or "1.3")." 280 * "1.x" (e.g., "1.5" or "1.3")."
309 * - RFC 4253:5 281 * - RFC 4253:5
310 */ 282 */
311 ssh_server = ssh_proto + strspn (ssh_proto, "0123456789.") + 1; /* (+1 for the '-' separating protoversion from softwareversion) */ 283 char *ssh_server = ssh_proto + strspn(ssh_proto, "0123456789.") + 1; /* (+1 for the '-' separating protoversion from softwareversion) */
312 284
313 /* If there's a space in the version string, whatever's after the space is a comment 285 /* If there's a space in the version string, whatever's after the space is a comment
314 * (which is NOT part of the server name/version)*/ 286 * (which is NOT part of the server name/version)*/
@@ -318,86 +290,72 @@ ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol
318 } 290 }
319 if (strlen(ssh_proto) == 0 || strlen(ssh_server) == 0) { 291 if (strlen(ssh_proto) == 0 || strlen(ssh_server) == 0) {
320 printf(_("SSH CRITICAL - Invalid protocol version control string %s\n"), version_control_string); 292 printf(_("SSH CRITICAL - Invalid protocol version control string %s\n"), version_control_string);
321 exit (STATE_CRITICAL); 293 exit(STATE_CRITICAL);
322 } 294 }
323 ssh_proto[strspn (ssh_proto, "0123456789. ")] = 0; 295 ssh_proto[strspn(ssh_proto, "0123456789. ")] = 0;
324 296
325 xasprintf (&buffer, "SSH-%s-check_ssh_%s\r\n", ssh_proto, rev_no); 297 static char *rev_no = VERSION;
326 send (sd, buffer, strlen (buffer), MSG_DONTWAIT); 298 xasprintf(&buffer, "SSH-%s-check_ssh_%s\r\n", ssh_proto, rev_no);
299 send(socket, buffer, strlen(buffer), MSG_DONTWAIT);
327 if (verbose) 300 if (verbose)
328 printf ("%s\n", buffer); 301 printf("%s\n", buffer);
329 302
330 if (remote_version && strcmp(remote_version, ssh_server)) { 303 if (remote_version && strcmp(remote_version, ssh_server)) {
331 printf 304 printf(_("SSH CRITICAL - %s (protocol %s) version mismatch, expected '%s'\n"), ssh_server, ssh_proto, remote_version);
332 (_("SSH CRITICAL - %s (protocol %s) version mismatch, expected '%s'\n"), 305 close(socket);
333 ssh_server, ssh_proto, remote_version); 306 exit(STATE_CRITICAL);
334 close(sd);
335 exit (STATE_CRITICAL);
336 } 307 }
337 308
309 double elapsed_time = (double)deltime(tv) / 1.0e6;
338 if (remote_protocol && strcmp(remote_protocol, ssh_proto)) { 310 if (remote_protocol && strcmp(remote_protocol, ssh_proto)) {
339 printf 311 printf(_("SSH CRITICAL - %s (protocol %s) protocol version mismatch, expected '%s' | %s\n"), ssh_server, ssh_proto, remote_protocol,
340 (_("SSH CRITICAL - %s (protocol %s) protocol version mismatch, expected '%s' | %s\n"), 312 fperfdata("time", elapsed_time, "s", false, 0, false, 0, true, 0, true, (int)socket_timeout));
341 ssh_server, ssh_proto, remote_protocol, fperfdata("time", elapsed_time, "s", 313 close(socket);
342 false, 0, false, 0, true, 0, true, (int)socket_timeout)); 314 exit(STATE_CRITICAL);
343 close(sd);
344 exit (STATE_CRITICAL);
345 } 315 }
346 elapsed_time = (double)deltime(tv) / 1.0e6;
347
348 printf
349 (_("SSH OK - %s (protocol %s) | %s\n"),
350 ssh_server, ssh_proto, fperfdata("time", elapsed_time, "s",
351 false, 0, false, 0, true, 0, true, (int)socket_timeout));
352 close(sd);
353 exit (STATE_OK);
354}
355
356 316
317 printf(_("SSH OK - %s (protocol %s) | %s\n"), ssh_server, ssh_proto,
318 fperfdata("time", elapsed_time, "s", false, 0, false, 0, true, 0, true, (int)socket_timeout));
319 close(socket);
320 exit(STATE_OK);
321}
357 322
358void 323void print_help(void) {
359print_help (void)
360{
361 char *myport; 324 char *myport;
362 xasprintf (&myport, "%d", SSH_DFL_PORT); 325 xasprintf(&myport, "%d", SSH_DFL_PORT);
363 326
364 print_revision (progname, NP_VERSION); 327 print_revision(progname, NP_VERSION);
365 328
366 printf ("Copyright (c) 1999 Remi Paulmier <remi@sinfomic.fr>\n"); 329 printf("Copyright (c) 1999 Remi Paulmier <remi@sinfomic.fr>\n");
367 printf (COPYRIGHT, copyright, email); 330 printf(COPYRIGHT, copyright, email);
368 331
369 printf ("%s\n", _("Try to connect to an SSH server at specified server and port")); 332 printf("%s\n", _("Try to connect to an SSH server at specified server and port"));
370 333
371 printf ("\n\n"); 334 printf("\n\n");
372 335
373 print_usage (); 336 print_usage();
374 337
375 printf (UT_HELP_VRSN); 338 printf(UT_HELP_VRSN);
376 printf (UT_EXTRA_OPTS); 339 printf(UT_EXTRA_OPTS);
377 340
378 printf (UT_HOST_PORT, 'p', myport); 341 printf(UT_HOST_PORT, 'p', myport);
379 342
380 printf (UT_IPv46); 343 printf(UT_IPv46);
381 344
382 printf (UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT); 345 printf(UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
383 346
384 printf (" %s\n", "-r, --remote-version=STRING"); 347 printf(" %s\n", "-r, --remote-version=STRING");
385 printf (" %s\n", _("Alert if string doesn't match expected server version (ex: OpenSSH_3.9p1)")); 348 printf(" %s\n", _("Alert if string doesn't match expected server version (ex: OpenSSH_3.9p1)"));
386 349
387 printf (" %s\n", "-P, --remote-protocol=STRING"); 350 printf(" %s\n", "-P, --remote-protocol=STRING");
388 printf (" %s\n", _("Alert if protocol doesn't match expected protocol version (ex: 2.0)")); 351 printf(" %s\n", _("Alert if protocol doesn't match expected protocol version (ex: 2.0)"));
389 352
390 printf (UT_VERBOSE); 353 printf(UT_VERBOSE);
391 354
392 printf (UT_SUPPORT); 355 printf(UT_SUPPORT);
393} 356}
394 357
395 358void print_usage(void) {
396 359 printf("%s\n", _("Usage:"));
397void 360 printf("%s [-4|-6] [-t <timeout>] [-r <remote version>] [-p <port>] <host>\n", progname);
398print_usage (void)
399{
400 printf ("%s\n", _("Usage:"));
401 printf ("%s [-4|-6] [-t <timeout>] [-r <remote version>] [-p <port>] <host>\n", progname);
402} 361}
403