summaryrefslogtreecommitdiffstats
path: root/plugins/check_ssh.c
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/check_ssh.c')
-rw-r--r--plugins/check_ssh.c476
1 files changed, 255 insertions, 221 deletions
diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index 4eb746cb..42a88cf9 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -1,144 +1,132 @@
1/***************************************************************************** 1/*****************************************************************************
2* 2 *
3* Monitoring check_ssh plugin 3 * Monitoring check_ssh plugin
4* 4 *
5* License: GPL 5 * License: GPL
6* Copyright (c) 2000-2007 Monitoring Plugins Development Team 6 * Copyright (c) 2000-2024 Monitoring Plugins Development Team
7* 7 *
8* Description: 8 * Description:
9* 9 *
10* This file contains the check_ssh plugin 10 * This file contains the check_ssh plugin
11* 11 *
12* Try to connect to an SSH server at specified server and port 12 * Try to connect to an SSH server at specified server and port
13* 13 *
14* 14 *
15* This program is free software: you can redistribute it and/or modify 15 * This program is free software: you can redistribute it and/or modify
16* it under the terms of the GNU General Public License as published by 16 * it under the terms of the GNU General Public License as published by
17* the Free Software Foundation, either version 3 of the License, or 17 * the Free Software Foundation, either version 3 of the License, or
18* (at your option) any later version. 18 * (at your option) any later version.
19* 19 *
20* This program is distributed in the hope that it will be useful, 20 * This program is distributed in the hope that it will be useful,
21* but WITHOUT ANY WARRANTY; without even the implied warranty of 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23* GNU General Public License for more details. 23 * GNU General Public License for more details.
24* 24 *
25* You should have received a copy of the GNU General Public License 25 * You should have received a copy of the GNU General Public License
26* along with this program. If not, see <http://www.gnu.org/licenses/>. 26 * along with this program. If not, see <http://www.gnu.org/licenses/>.
27* 27 *
28* 28 *
29*****************************************************************************/ 29 *****************************************************************************/
30 30
31const char *progname = "check_ssh"; 31const char *progname = "check_ssh";
32const char *copyright = "2000-2007"; 32const char *copyright = "2000-2024";
33const char *email = "devel@monitoring-plugins.org"; 33const char *email = "devel@monitoring-plugins.org";
34 34
35#include "common.h" 35#include "./common.h"
36#include "netutils.h" 36#include "./netutils.h"
37#include "utils.h" 37#include "utils.h"
38 38
39#ifndef MSG_DONTWAIT 39#ifndef MSG_DONTWAIT
40#define MSG_DONTWAIT 0 40# define MSG_DONTWAIT 0
41#endif 41#endif
42 42
43#define SSH_DFL_PORT 22 43#define SSH_DFL_PORT 22
44#define BUFF_SZ 256 44#define BUFF_SZ 256
45 45
46int port = -1; 46static int port = -1;
47char *server_name = NULL; 47static char *server_name = NULL;
48char *remote_version = NULL; 48static char *remote_version = NULL;
49char *remote_protocol = NULL; 49static char *remote_protocol = NULL;
50bool verbose = false; 50static bool verbose = false;
51 51
52int process_arguments (int, char **); 52static int process_arguments(int /*argc*/, char ** /*argv*/);
53int validate_arguments (void); 53static int validate_arguments(void);
54void print_help (void); 54static void print_help(void);
55void print_usage (void); 55void print_usage(void);
56 56
57int ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol); 57static int ssh_connect(char *haddr, int hport, char *remote_version, char *remote_protocol);
58 58
59 59int main(int argc, char **argv) {
60int 60 setlocale(LC_ALL, "");
61main (int argc, char **argv) 61 bindtextdomain(PACKAGE, LOCALEDIR);
62{ 62 textdomain(PACKAGE);
63 int result = STATE_UNKNOWN;
64
65 setlocale (LC_ALL, "");
66 bindtextdomain (PACKAGE, LOCALEDIR);
67 textdomain (PACKAGE);
68 63
69 /* Parse extra opts if any */ 64 /* Parse extra opts if any */
70 argv=np_extra_opts (&argc, argv, progname); 65 argv = np_extra_opts(&argc, argv, progname);
71 66
72 if (process_arguments (argc, argv) == ERROR) 67 if (process_arguments(argc, argv) == ERROR)
73 usage4 (_("Could not parse arguments")); 68 usage4(_("Could not parse arguments"));
74 69
75 /* initialize alarm signal handling */ 70 /* initialize alarm signal handling */
76 signal (SIGALRM, socket_timeout_alarm_handler); 71 signal(SIGALRM, socket_timeout_alarm_handler);
77 72
78 alarm (socket_timeout); 73 alarm(socket_timeout);
79 74
80 /* ssh_connect exits if error is found */ 75 /* ssh_connect exits if error is found */
81 result = ssh_connect (server_name, port, remote_version, remote_protocol); 76 int result = ssh_connect(server_name, port, remote_version, remote_protocol);
82 77
83 alarm (0); 78 alarm(0);
84 79
85 return (result); 80 return (result);
86} 81}
87 82
88
89
90/* process command-line arguments */ 83/* process command-line arguments */
91int 84int process_arguments(int argc, char **argv) {
92process_arguments (int argc, char **argv) 85 static struct option longopts[] = {{"help", no_argument, 0, 'h'},
93{ 86 {"version", no_argument, 0, 'V'},
94 int c; 87 {"host", required_argument, 0, 'H'}, /* backward compatibility */
95 88 {"hostname", required_argument, 0, 'H'},
96 int option = 0; 89 {"port", required_argument, 0, 'p'},
97 static struct option longopts[] = { 90 {"use-ipv4", no_argument, 0, '4'},
98 {"help", no_argument, 0, 'h'}, 91 {"use-ipv6", no_argument, 0, '6'},
99 {"version", no_argument, 0, 'V'}, 92 {"timeout", required_argument, 0, 't'},
100 {"host", required_argument, 0, 'H'}, /* backward compatibility */ 93 {"verbose", no_argument, 0, 'v'},
101 {"hostname", required_argument, 0, 'H'}, 94 {"remote-version", required_argument, 0, 'r'},
102 {"port", required_argument, 0, 'p'}, 95 {"remote-protocol", required_argument, 0, 'P'},
103 {"use-ipv4", no_argument, 0, '4'}, 96 {0, 0, 0, 0}};
104 {"use-ipv6", no_argument, 0, '6'},
105 {"timeout", required_argument, 0, 't'},
106 {"verbose", no_argument, 0, 'v'},
107 {"remote-version", required_argument, 0, 'r'},
108 {"remote-protcol", required_argument, 0, 'P'},
109 {0, 0, 0, 0}
110 };
111 97
112 if (argc < 2) 98 if (argc < 2)
113 return ERROR; 99 return ERROR;
114 100
115 for (c = 1; c < argc; c++) 101 for (int i = 1; i < argc; i++)
116 if (strcmp ("-to", argv[c]) == 0) 102 if (strcmp("-to", argv[i]) == 0)
117 strcpy (argv[c], "-t"); 103 strcpy(argv[i], "-t");
118 104
119 while (1) { 105 int option_char;
120 c = getopt_long (argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option); 106 while (true) {
107 int option = 0;
108 option_char = getopt_long(argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option);
121 109
122 if (c == -1 || c == EOF) 110 if (option_char == -1 || option_char == EOF)
123 break; 111 break;
124 112
125 switch (c) { 113 switch (option_char) {
126 case '?': /* help */ 114 case '?': /* help */
127 usage5 (); 115 usage5();
128 case 'V': /* version */ 116 case 'V': /* version */
129 print_revision (progname, NP_VERSION); 117 print_revision(progname, NP_VERSION);
130 exit (STATE_UNKNOWN); 118 exit(STATE_UNKNOWN);
131 case 'h': /* help */ 119 case 'h': /* help */
132 print_help (); 120 print_help();
133 exit (STATE_UNKNOWN); 121 exit(STATE_UNKNOWN);
134 case 'v': /* verbose */ 122 case 'v': /* verbose */
135 verbose = true; 123 verbose = true;
136 break; 124 break;
137 case 't': /* timeout period */ 125 case 't': /* timeout period */
138 if (!is_integer (optarg)) 126 if (!is_integer(optarg))
139 usage2 (_("Timeout interval must be a positive integer"), optarg); 127 usage2(_("Timeout interval must be a positive integer"), optarg);
140 else 128 else
141 socket_timeout = atoi (optarg); 129 socket_timeout = atoi(optarg);
142 break; 130 break;
143 case '4': 131 case '4':
144 address_family = AF_INET; 132 address_family = AF_INET;
@@ -147,181 +135,227 @@ process_arguments (int argc, char **argv)
147#ifdef USE_IPV6 135#ifdef USE_IPV6
148 address_family = AF_INET6; 136 address_family = AF_INET6;
149#else 137#else
150 usage4 (_("IPv6 support not available")); 138 usage4(_("IPv6 support not available"));
151#endif 139#endif
152 break; 140 break;
153 case 'r': /* remote version */ 141 case 'r': /* remote version */
154 remote_version = optarg; 142 remote_version = optarg;
155 break; 143 break;
156 case 'P': /* remote version */ 144 case 'P': /* remote version */
157 remote_protocol = optarg; 145 remote_protocol = optarg;
158 break; 146 break;
159 case 'H': /* host */ 147 case 'H': /* host */
160 if (!is_host (optarg)) 148 if (!is_host(optarg))
161 usage2 (_("Invalid hostname/address"), optarg); 149 usage2(_("Invalid hostname/address"), optarg);
162 server_name = optarg; 150 server_name = optarg;
163 break; 151 break;
164 case 'p': /* port */ 152 case 'p': /* port */
165 if (is_intpos (optarg)) { 153 if (is_intpos(optarg)) {
166 port = atoi (optarg); 154 port = atoi(optarg);
167 } 155 } else {
168 else { 156 usage2(_("Port number must be a positive integer"), optarg);
169 usage2 (_("Port number must be a positive integer"), optarg);
170 } 157 }
171 } 158 }
172 } 159 }
173 160
174 c = optind; 161 option_char = optind;
175 if (server_name == NULL && c < argc) { 162 if (server_name == NULL && option_char < argc) {
176 if (is_host (argv[c])) { 163 if (is_host(argv[option_char])) {
177 server_name = argv[c++]; 164 server_name = argv[option_char++];
178 } 165 }
179 } 166 }
180 167
181 if (port == -1 && c < argc) { 168 if (port == -1 && option_char < argc) {
182 if (is_intpos (argv[c])) { 169 if (is_intpos(argv[option_char])) {
183 port = atoi (argv[c++]); 170 port = atoi(argv[option_char++]);
184 } 171 } else {
185 else { 172 print_usage();
186 print_usage (); 173 exit(STATE_UNKNOWN);
187 exit (STATE_UNKNOWN);
188 } 174 }
189 } 175 }
190 176
191 return validate_arguments (); 177 return validate_arguments();
192} 178}
193 179
194int 180int validate_arguments(void) {
195validate_arguments (void)
196{
197 if (server_name == NULL) 181 if (server_name == NULL)
198 return ERROR; 182 return ERROR;
199 if (port == -1) /* funky, but allows -p to override stray integer in args */ 183 if (port == -1) /* funky, but allows -p to override stray integer in args */
200 port = SSH_DFL_PORT; 184 port = SSH_DFL_PORT;
201 return OK; 185 return OK;
202} 186}
203 187
204
205/************************************************************************ 188/************************************************************************
206* 189 *
207* Try to connect to SSH server at specified server and port 190 * Try to connect to SSH server at specified server and port
208* 191 *
209*-----------------------------------------------------------------------*/ 192 *-----------------------------------------------------------------------*/
210
211
212int
213ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol)
214{
215 int sd;
216 int result;
217 char *output = NULL;
218 char *buffer = NULL;
219 char *ssh_proto = NULL;
220 char *ssh_server = NULL;
221 static char *rev_no = VERSION;
222 struct timeval tv;
223 double elapsed_time;
224 193
194int ssh_connect(char *haddr, int hport, char *remote_version, char *remote_protocol) {
195 struct timeval tv;
225 gettimeofday(&tv, NULL); 196 gettimeofday(&tv, NULL);
226 197
227 result = my_tcp_connect (haddr, hport, &sd); 198 int socket;
199 int result = my_tcp_connect(haddr, hport, &socket);
228 200
229 if (result != STATE_OK) 201 if (result != STATE_OK)
230 return result; 202 return result;
231 203
232 output = (char *) malloc (BUFF_SZ + 1); 204 char *output = (char *)calloc(BUFF_SZ + 1, sizeof(char));
233 memset (output, 0, BUFF_SZ + 1); 205 char *buffer = NULL;
234 recv (sd, output, BUFF_SZ, 0); 206 ssize_t recv_ret = 0;
235 if (strncmp (output, "SSH", 3)) { 207 char *version_control_string = NULL;
236 printf (_("Server answer: %s"), output); 208 ssize_t byte_offset = 0;
237 close(sd); 209 while ((version_control_string == NULL) && (recv_ret = recv(socket, output + byte_offset, BUFF_SZ - byte_offset, 0) > 0)) {
238 exit (STATE_CRITICAL); 210
239 } 211 if (strchr(output, '\n')) { /* we've got at least one full line, start parsing*/
240 else { 212 byte_offset = 0;
241 strip (output); 213
242 if (verbose) 214 char *index = NULL;
243 printf ("%s\n", output); 215 int len = 0;
244 ssh_proto = output + 4; 216 while ((index = strchr(output + byte_offset, '\n')) != NULL) {
245 ssh_server = ssh_proto + strspn (ssh_proto, "-0123456789. "); 217 /*Partition the buffer so that this line is a separate string,
246 ssh_proto[strspn (ssh_proto, "0123456789. ")] = 0; 218 * by replacing the newline with NUL*/
247 219 output[(index - output)] = '\0';
248 xasprintf (&buffer, "SSH-%s-check_ssh_%s\r\n", ssh_proto, rev_no); 220 len = strlen(output + byte_offset);
249 send (sd, buffer, strlen (buffer), MSG_DONTWAIT); 221
250 if (verbose) 222 if ((len >= 4) && (strncmp(output + byte_offset, "SSH-", 4) == 0)) {
251 printf ("%s\n", buffer); 223 /*if the string starts with SSH-, this _should_ be a valid version control string*/
252 224 version_control_string = output + byte_offset;
253 if (remote_version && strcmp(remote_version, ssh_server)) { 225 break;
254 printf 226 }
255 (_("SSH CRITICAL - %s (protocol %s) version mismatch, expected '%s'\n"), 227
256 ssh_server, ssh_proto, remote_version); 228 /*the start of the next line (if one exists) will be after the current one (+ NUL)*/
257 close(sd); 229 byte_offset += (len + 1);
258 exit (STATE_CRITICAL); 230 }
259 }
260 231
261 if (remote_protocol && strcmp(remote_protocol, ssh_proto)) { 232 if (version_control_string == NULL) {
262 printf 233 /* move unconsumed data to beginning of buffer, null rest */
263 (_("SSH CRITICAL - %s (protocol %s) protocol version mismatch, expected '%s'\n"), 234 memmove((void *)output, (void *)(output + byte_offset + 1), BUFF_SZ - len + 1);
264 ssh_server, ssh_proto, remote_protocol); 235 memset(output + byte_offset + 1, 0, BUFF_SZ - byte_offset + 1);
265 close(sd); 236
266 exit (STATE_CRITICAL); 237 /*start reading from end of current line chunk on next recv*/
238 byte_offset = strlen(output);
239 }
240 } else {
241 byte_offset += recv_ret;
267 } 242 }
243 }
268 244
269 elapsed_time = (double)deltime(tv) / 1.0e6; 245 if (recv_ret < 0) {
246 printf("SSH CRITICAL - %s", strerror(errno));
247 exit(STATE_CRITICAL);
248 }
270 249
271 printf 250 if (version_control_string == NULL) {
272 (_("SSH OK - %s (protocol %s) | %s\n"), 251 printf("SSH CRITICAL - No version control string received");
273 ssh_server, ssh_proto, fperfdata("time", elapsed_time, "s", 252 exit(STATE_CRITICAL);
274 false, 0, false, 0, true, 0, true, (int)socket_timeout));
275 close(sd);
276 exit (STATE_OK);
277 } 253 }
278} 254 /*
255 * "When the connection has been established, both sides MUST send an
256 * identification string. This identification string MUST be
257 *
258 * SSH-protoversion-softwareversion SP comments CR LF"
259 * - RFC 4253:4.2
260 */
261 strip(version_control_string);
262 if (verbose)
263 printf("%s\n", version_control_string);
264
265 char *ssh_proto = version_control_string + 4;
266
267 /*
268 * We assume the protoversion is of the form Major.Minor, although
269 * this is not _strictly_ required. See
270 *
271 * "Both the 'protoversion' and 'softwareversion' strings MUST consist of
272 * printable US-ASCII characters, with the exception of whitespace
273 * characters and the minus sign (-)"
274 * - RFC 4253:4.2
275 * and,
276 *
277 * "As stated earlier, the 'protoversion' specified for this protocol is
278 * "2.0". Earlier versions of this protocol have not been formally
279 * documented, but it is widely known that they use 'protoversion' of
280 * "1.x" (e.g., "1.5" or "1.3")."
281 * - RFC 4253:5
282 */
283 char *ssh_server = ssh_proto + strspn(ssh_proto, "0123456789.") + 1; /* (+1 for the '-' separating protoversion from softwareversion) */
284
285 /* If there's a space in the version string, whatever's after the space is a comment
286 * (which is NOT part of the server name/version)*/
287 char *tmp = strchr(ssh_server, ' ');
288 if (tmp) {
289 ssh_server[tmp - ssh_server] = '\0';
290 }
291 if (strlen(ssh_proto) == 0 || strlen(ssh_server) == 0) {
292 printf(_("SSH CRITICAL - Invalid protocol version control string %s\n"), version_control_string);
293 exit(STATE_CRITICAL);
294 }
295 ssh_proto[strspn(ssh_proto, "0123456789. ")] = 0;
279 296
297 static char *rev_no = VERSION;
298 xasprintf(&buffer, "SSH-%s-check_ssh_%s\r\n", ssh_proto, rev_no);
299 send(socket, buffer, strlen(buffer), MSG_DONTWAIT);
300 if (verbose)
301 printf("%s\n", buffer);
302
303 if (remote_version && strcmp(remote_version, ssh_server)) {
304 printf(_("SSH CRITICAL - %s (protocol %s) version mismatch, expected '%s'\n"), ssh_server, ssh_proto, remote_version);
305 close(socket);
306 exit(STATE_CRITICAL);
307 }
308
309 double elapsed_time = (double)deltime(tv) / 1.0e6;
310 if (remote_protocol && strcmp(remote_protocol, ssh_proto)) {
311 printf(_("SSH CRITICAL - %s (protocol %s) protocol version mismatch, expected '%s' | %s\n"), ssh_server, ssh_proto, remote_protocol,
312 fperfdata("time", elapsed_time, "s", false, 0, false, 0, true, 0, true, (int)socket_timeout));
313 close(socket);
314 exit(STATE_CRITICAL);
315 }
280 316
317 printf(_("SSH OK - %s (protocol %s) | %s\n"), ssh_server, ssh_proto,
318 fperfdata("time", elapsed_time, "s", false, 0, false, 0, true, 0, true, (int)socket_timeout));
319 close(socket);
320 exit(STATE_OK);
321}
281 322
282void 323void print_help(void) {
283print_help (void)
284{
285 char *myport; 324 char *myport;
286 xasprintf (&myport, "%d", SSH_DFL_PORT); 325 xasprintf(&myport, "%d", SSH_DFL_PORT);
287 326
288 print_revision (progname, NP_VERSION); 327 print_revision(progname, NP_VERSION);
289 328
290 printf ("Copyright (c) 1999 Remi Paulmier <remi@sinfomic.fr>\n"); 329 printf("Copyright (c) 1999 Remi Paulmier <remi@sinfomic.fr>\n");
291 printf (COPYRIGHT, copyright, email); 330 printf(COPYRIGHT, copyright, email);
292 331
293 printf ("%s\n", _("Try to connect to an SSH server at specified server and port")); 332 printf("%s\n", _("Try to connect to an SSH server at specified server and port"));
294 333
295 printf ("\n\n"); 334 printf("\n\n");
296 335
297 print_usage (); 336 print_usage();
298 337
299 printf (UT_HELP_VRSN); 338 printf(UT_HELP_VRSN);
300 printf (UT_EXTRA_OPTS); 339 printf(UT_EXTRA_OPTS);
301 340
302 printf (UT_HOST_PORT, 'p', myport); 341 printf(UT_HOST_PORT, 'p', myport);
303 342
304 printf (UT_IPv46); 343 printf(UT_IPv46);
305 344
306 printf (UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT); 345 printf(UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
307 346
308 printf (" %s\n", "-r, --remote-version=STRING"); 347 printf(" %s\n", "-r, --remote-version=STRING");
309 printf (" %s\n", _("Alert if string doesn't match expected server version (ex: OpenSSH_3.9p1)")); 348 printf(" %s\n", _("Alert if string doesn't match expected server version (ex: OpenSSH_3.9p1)"));
310 349
311 printf (" %s\n", "-P, --remote-protocol=STRING"); 350 printf(" %s\n", "-P, --remote-protocol=STRING");
312 printf (" %s\n", _("Alert if protocol doesn't match expected protocol version (ex: 2.0)")); 351 printf(" %s\n", _("Alert if protocol doesn't match expected protocol version (ex: 2.0)"));
313 352
314 printf (UT_VERBOSE); 353 printf(UT_VERBOSE);
315 354
316 printf (UT_SUPPORT); 355 printf(UT_SUPPORT);
317} 356}
318 357
319 358void print_usage(void) {
320 359 printf("%s\n", _("Usage:"));
321void 360 printf("%s [-4|-6] [-t <timeout>] [-r <remote version>] [-p <port>] <host>\n", progname);
322print_usage (void)
323{
324 printf ("%s\n", _("Usage:"));
325 printf ("%s [-4|-6] [-t <timeout>] [-r <remote version>] [-p <port>] <host>\n", progname);
326} 361}
327