9 files changed, 110 insertions, 80 deletions

diff --git a/plugins/Makefile.am b/plugins/Makefile.am
index 41906c5..0ddf9bd 100644
--- a/plugins/Makefile.am
+++ b/plugins/Makefile.am
@@ -71,7 +71,7 @@ check_apt_LDADD = $(BASEOBJS)
 check_cluster_LDADD = $(BASEOBJS)
 check_dbi_LDADD = $(NETLIBS) $(DBILIBS)
 check_dig_LDADD = $(NETLIBS)
-check_disk_LDADD = $(BASEOBJS) $(THREADLIBS)
+check_disk_LDADD = $(BASEOBJS)
 check_dns_LDADD = $(NETLIBS)
 check_dummy_LDADD = $(BASEOBJS)
 check_fping_LDADD = $(NETLIBS)
diff --git a/plugins/check_disk.c b/plugins/check_disk.c
index 9693bad..874a0ee 100644
--- a/plugins/check_disk.c
+++ b/plugins/check_disk.c
@@ -51,9 +51,6 @@ const char *email = "devel@monitoring-plugins.org";
 # include <limits.h>
 #endif
 #include "regex.h"
-#if HAVE_PTHREAD_H
-# include <pthread.h>
-#endif
 
 #ifdef __CYGWIN__
 # include <windows.h>
@@ -133,7 +130,6 @@ void print_help (void);
 void print_usage (void);
 double calculate_percent(uintmax_t, uintmax_t);
 void stat_path (struct parameter_list *p);
-void *do_stat_path (void *p);
 void get_stats (struct parameter_list *p, struct fs_usage *fsp);
 void get_path_stats (struct parameter_list *p, struct fs_usage *fsp);
 
@@ -972,44 +968,6 @@ print_usage (void)
 void
 stat_path (struct parameter_list *p)
 {
-#ifdef HAVE_PTHREAD_H
-  pthread_t stat_thread;
-  int statdone = 0;
-  int timer = timeout_interval;
-  struct timespec req, rem;
-
-  req.tv_sec = 0;
-  pthread_create(&stat_thread, NULL, do_stat_path, p);
-  while (timer-- > 0) {
-    req.tv_nsec = 10000000;
-    nanosleep(&req, &rem);
-    if (pthread_kill(stat_thread, 0)) {
-      statdone = 1;
-      break;
-    } else {
-      req.tv_nsec = 990000000;
-      nanosleep(&req, &rem);
-    }
-  }
-  if (statdone == 1) {
-    pthread_join(stat_thread, NULL);
-  } else {
-    pthread_detach(stat_thread);
-    if (verbose >= 3)
-      printf("stat did not return within %ds on %s\n", timeout_interval, p->name);
-    printf("DISK %s - ", _("CRITICAL"));
-    die (STATE_CRITICAL, _("%s %s: %s\n"), p->name, _("hangs"), _("Timeout"));
-  }
-#else
-  do_stat_path(p);
-#endif
-}
-
-void *
-do_stat_path (void *in)
-{
-  struct parameter_list *p = in;
-
   /* Stat entry to check that dir exists and is accessible */
   if (verbose >= 3)
     printf("calling stat on %s\n", p->name);
@@ -1019,7 +977,6 @@ do_stat_path (void *in)
     printf("DISK %s - ", _("CRITICAL"));
     die (STATE_CRITICAL, _("%s %s: %s\n"), p->name, _("is not accessible"), strerror(errno));
   }
-  return NULL;
 }
 
 
diff --git a/plugins/check_http.c b/plugins/check_http.c
index 68b470c..2038f4a 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -343,9 +343,20 @@ process_arguments (int argc, char **argv)
          parameters, like -S and -C combinations */
       use_ssl = TRUE;
       if (c=='S' && optarg != NULL) {
-        ssl_version = atoi(optarg);
-        if (ssl_version < 1 || ssl_version > 3)
-            usage4 (_("Invalid option - Valid values for SSL Version are 1 (TLSv1), 2 (SSLv2) or 3 (SSLv3)"));
+        int got_plus = strchr(optarg, '+') != NULL;
+
+        if (!strncmp (optarg, "1.2", 3))
+          ssl_version = got_plus ? MP_TLSv1_2_OR_NEWER : MP_TLSv1_2;
+        else if (!strncmp (optarg, "1.1", 3))
+          ssl_version = got_plus ? MP_TLSv1_1_OR_NEWER : MP_TLSv1_1;
+        else if (optarg[0] == '1')
+          ssl_version = got_plus ? MP_TLSv1_OR_NEWER : MP_TLSv1;
+        else if (optarg[0] == '3')
+          ssl_version = got_plus ? MP_SSLv3_OR_NEWER : MP_SSLv3;
+        else if (optarg[0] == '2')
+          ssl_version = got_plus ? MP_SSLv2_OR_NEWER : MP_SSLv2;
+        else
+          usage4 (_("Invalid option - Valid SSL/TLS versions: 2, 3, 1, 1.1, 1.2 (with optional '+' suffix)"));
       }
       if (specify_port == FALSE)
         server_port = HTTPS_PORT;
@@ -1514,9 +1525,10 @@ print_help (void)
   printf (UT_IPv46);
 
 #ifdef HAVE_SSL
-  printf (" %s\n", "-S, --ssl=VERSION");
+  printf (" %s\n", "-S, --ssl=VERSION[+]");
   printf ("    %s\n", _("Connect via SSL. Port defaults to 443. VERSION is optional, and prevents"));
-  printf ("    %s\n", _("auto-negotiation (1 = TLSv1, 2 = SSLv2, 3 = SSLv3)."));
+  printf ("    %s\n", _("auto-negotiation (2 = SSLv2, 3 = SSLv3, 1 = TLSv1, 1.1 = TLSv1.1,"));
+  printf ("    %s\n", _("1.2 = TLSv1.2). With a '+' suffix, newer versions are also accepted."));
   printf (" %s\n", "--sni");
   printf ("    %s\n", _("Enable SSL/TLS hostname extension support (SNI)"));
   printf (" %s\n", "-C, --certificate=INTEGER[,INTEGER]");
diff --git a/plugins/check_smtp.c b/plugins/check_smtp.c
index 56040ff..1996c6d 100644
--- a/plugins/check_smtp.c
+++ b/plugins/check_smtp.c
@@ -231,7 +231,7 @@ main (int argc, char **argv)
                   send(sd, SMTP_STARTTLS, strlen(SMTP_STARTTLS), 0);
 
                   recvlines(buffer, MAX_INPUT_BUFFER); /* wait for it */
-                  if (!strstr (buffer, server_expect)) {
+                  if (!strstr (buffer, SMTP_EXPECT)) {
                     printf (_("Server does not support STARTTLS\n"));
                     smtp_quit();
                     return STATE_UNKNOWN;
@@ -276,6 +276,7 @@ main (int argc, char **argv)
 #  ifdef USE_OPENSSL
                   if ( check_cert ) {
                     result = np_net_ssl_check_cert(days_till_exp_warn, days_till_exp_crit);
+                    smtp_quit();
                     my_close();
                     return result;
                   }
@@ -581,11 +582,6 @@ process_arguments (int argc, char **argv)
                                 usage4 (_("Timeout interval must be a positive integer"));
                         }
                         break;
-                case 'S':
-                /* starttls */
-                        use_ssl = TRUE;
-                        use_ehlo = TRUE;
-                        break;
                 case 'D':
                 /* Check SSL cert validity */
 #ifdef USE_OPENSSL
@@ -607,9 +603,14 @@ process_arguments (int argc, char **argv)
                             days_till_exp_warn = atoi (optarg);
                         }
                         check_cert = TRUE;
+                        ignore_send_quit_failure = TRUE;
 #else
                         usage (_("SSL support not available - install OpenSSL and recompile"));
 #endif
+                case 'S':
+                /* starttls */
+                        use_ssl = TRUE;
+                        use_ehlo = TRUE;
                         break;
                 case '4':
                         address_family = AF_INET;
diff --git a/plugins/check_snmp.c b/plugins/check_snmp.c
index 28cc44d..9839d6e 100644
--- a/plugins/check_snmp.c
+++ b/plugins/check_snmp.c
@@ -41,7 +41,6 @@ const char *email = "devel@monitoring-plugins.org";
 #define DEFAULT_PORT "161"
 #define DEFAULT_MIBLIST "ALL"
 #define DEFAULT_PROTOCOL "1"
-#define DEFAULT_TIMEOUT 1
 #define DEFAULT_RETRIES 5
 #define DEFAULT_AUTH_PROTOCOL "MD5"
 #define DEFAULT_PRIV_PROTOCOL "DES"
@@ -227,7 +226,7 @@ main (int argc, char **argv)
         outbuff = strdup ("");
         delimiter = strdup (" = ");
         output_delim = strdup (DEFAULT_OUTPUT_DELIMITER);
-        timeout_interval = DEFAULT_TIMEOUT;
+        timeout_interval = DEFAULT_SOCKET_TIMEOUT;
         retries = DEFAULT_RETRIES;
 
         np_init( (char *) progname, argc, argv );
diff --git a/plugins/check_ups.c b/plugins/check_ups.c
index dc5a348..e9e56a5 100644
--- a/plugins/check_ups.c
+++ b/plugins/check_ups.c
@@ -242,8 +242,8 @@ main (int argc, char **argv)
                         }
                         xasprintf (&data, "%s %s", data,
                                   perfdata ("battery", (long)ups_battery_percent, "%",
-                                            check_warn, (long)(1000*warning_value),
-                                            check_crit, (long)(1000*critical_value),
+                                            check_warn, (long)(warning_value),
+                                            check_crit, (long)(critical_value),
                                             TRUE, 0, TRUE, 100));
                 } else {
                         xasprintf (&data, "%s %s", data,
@@ -271,8 +271,8 @@ main (int argc, char **argv)
                         }
                         xasprintf (&data, "%s %s", data,
                                   perfdata ("load", (long)ups_load_percent, "%",
-                                            check_warn, (long)(1000*warning_value),
-                                            check_crit, (long)(1000*critical_value),
+                                            check_warn, (long)(warning_value),
+                                            check_crit, (long)(critical_value),
                                             TRUE, 0, TRUE, 100));
                 } else {
                         xasprintf (&data, "%s %s", data,
@@ -308,8 +308,8 @@ main (int argc, char **argv)
                         }
                         xasprintf (&data, "%s %s", data,
                                   perfdata ("temp", (long)ups_temperature, tunits,
-                                            check_warn, (long)(1000*warning_value),
-                                            check_crit, (long)(1000*critical_value),
+                                            check_warn, (long)(warning_value),
+                                            check_crit, (long)(critical_value),
                                             TRUE, 0, FALSE, 0));
                 } else {
                         xasprintf (&data, "%s %s", data,
diff --git a/plugins/netutils.h b/plugins/netutils.h
index c6fce90..2766029 100644
--- a/plugins/netutils.h
+++ b/plugins/netutils.h
@@ -91,6 +91,16 @@ RETSIGTYPE socket_timeout_alarm_handler (int) __attribute__((noreturn));
 
 /* SSL-Related functionality */
 #ifdef HAVE_SSL
+#  define MP_SSLv2 1
+#  define MP_SSLv3 2
+#  define MP_TLSv1 3
+#  define MP_TLSv1_1 4
+#  define MP_TLSv1_2 5
+#  define MP_SSLv2_OR_NEWER 6
+#  define MP_SSLv3_OR_NEWER 7
+#  define MP_TLSv1_OR_NEWER 8
+#  define MP_TLSv1_1_OR_NEWER 9
+#  define MP_TLSv1_2_OR_NEWER 10
 /* maybe this could be merged with the above np_net_connect, via some flags */
 int np_net_ssl_init(int sd);
 int np_net_ssl_init_with_hostname(int sd, char *host_name);
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index c9882c6..4f9c793 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -49,28 +49,78 @@ int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int versi
 
 int np_net_ssl_init_with_hostname_version_and_cert(int sd, char *host_name, int version, char *cert, char *privkey) {
         SSL_METHOD *method = NULL;
+        long options = 0;
 
         switch (version) {
-        case 0: /* Deafult to auto negotiation */
-                method = SSLv23_client_method();
-                break;
-        case 1: /* TLSv1 protocol */
-                method = TLSv1_client_method();
-                break;
-        case 2: /* SSLv2 protocol */
+        case MP_SSLv2: /* SSLv2 protocol */
 #if defined(USE_GNUTLS) || defined(OPENSSL_NO_SSL2)
-                printf(("%s\n", _("CRITICAL - SSL protocol version 2 is not supported by your SSL library.")));
-                return STATE_CRITICAL;
+                printf("%s\n", _("UNKNOWN - SSL protocol version 2 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
 #else
                 method = SSLv2_client_method();
-#endif
                 break;
-        case 3: /* SSLv3 protocol */
+#endif
+        case MP_SSLv3: /* SSLv3 protocol */
+#if defined(OPENSSL_NO_SSL3)
+                printf("%s\n", _("UNKNOWN - SSL protocol version 3 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
+#else
                 method = SSLv3_client_method();
                 break;
-        default: /* Unsupported */
-                printf("%s\n", _("CRITICAL - Unsupported SSL protocol version."));
-                return STATE_CRITICAL;
+#endif
+        case MP_TLSv1: /* TLSv1 protocol */
+#if defined(OPENSSL_NO_TLS1)
+                printf("%s\n", _("UNKNOWN - TLS protocol version 1 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
+#else
+                method = TLSv1_client_method();
+                break;
+#endif
+        case MP_TLSv1_1: /* TLSv1.1 protocol */
+#if !defined(SSL_OP_NO_TLSv1_1)
+                printf("%s\n", _("UNKNOWN - TLS protocol version 1.1 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
+#else
+                method = TLSv1_1_client_method();
+                break;
+#endif
+        case MP_TLSv1_2: /* TLSv1.2 protocol */
+#if !defined(SSL_OP_NO_TLSv1_2)
+                printf("%s\n", _("UNKNOWN - TLS protocol version 1.2 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
+#else
+                method = TLSv1_2_client_method();
+                break;
+#endif
+        case MP_TLSv1_2_OR_NEWER:
+#if !defined(SSL_OP_NO_TLSv1_1)
+                printf("%s\n", _("UNKNOWN - Disabling TLSv1.1 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
+#else
+                options |= SSL_OP_NO_TLSv1_1;
+#endif
+                /* FALLTHROUGH */
+        case MP_TLSv1_1_OR_NEWER:
+#if !defined(SSL_OP_NO_TLSv1)
+                printf("%s\n", _("UNKNOWN - Disabling TLSv1 is not supported by your SSL library."));
+                return STATE_UNKNOWN;
+#else
+                options |= SSL_OP_NO_TLSv1;
+#endif
+                /* FALLTHROUGH */
+        case MP_TLSv1_OR_NEWER:
+#if defined(SSL_OP_NO_SSLv3)
+                options |= SSL_OP_NO_SSLv3;
+#endif
+                /* FALLTHROUGH */
+        case MP_SSLv3_OR_NEWER:
+#if defined(SSL_OP_NO_SSLv2)
+                options |= SSL_OP_NO_SSLv2;
+#endif
+        case MP_SSLv2_OR_NEWER:
+                /* FALLTHROUGH */
+        default: /* Default to auto negotiation */
+                method = SSLv23_client_method();
         }
         if (!initialized) {
                 /* Initialize SSL context */
@@ -94,8 +144,9 @@ int np_net_ssl_init_with_hostname_version_and_cert(int sd, char *host_name, int
 #endif
         }
 #ifdef SSL_OP_NO_TICKET
-        SSL_CTX_set_options(c, SSL_OP_NO_TICKET);
+        options |= SSL_OP_NO_TICKET;
 #endif
+        SSL_CTX_set_options(c, options);
         SSL_CTX_set_mode(c, SSL_MODE_AUTO_RETRY);
         if ((s = SSL_new(c)) != NULL) {
 #ifdef SSL_set_tlsext_host_name
diff --git a/plugins/t/check_snmp.t b/plugins/t/check_snmp.t
index 2d6c44a..aefd872 100644
--- a/plugins/t/check_snmp.t
+++ b/plugins/t/check_snmp.t
@@ -166,8 +166,8 @@ SKIP: {
 SKIP: {
     skip "no non responsive host defined", 2 if ( ! $host_nonresponsive );
     $res = NPTest->testCmd( "./check_snmp -H $host_nonresponsive -C np_foobar -o system.sysUpTime.0 -w 1: -c 1:");
-    cmp_ok( $res->return_code, '==', 3, "Exit UNKNOWN with non responsive host" );
-    like($res->output, '/External command error: Timeout: No Response from /', "String matches timeout problem");
+    cmp_ok( $res->return_code, '==', 2, "Exit CRITICAL with non responsive host" );
+    like($res->output, '/Plugin timed out while executing system call/', "String matches timeout problem");
 }
 
 SKIP: {