From 8c937fbfac89e632d86dcde9c6b8e5f7d6790902 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lorenz=20K=C3=A4stle?=
<12514511+RincewindsHat@users.noreply.github.com>
Date: Thu, 31 Oct 2024 14:32:03 +0100
Subject: sslutils.c: clang-format
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index 6bc0ba8..b8cbc7c 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -1,46 +1,42 @@
/*****************************************************************************
-*
-* Monitoring Plugins SSL utilities
-*
-* License: GPL
-* Copyright (c) 2005-2010 Monitoring Plugins Development Team
-*
-* Description:
-*
-* This file contains common functions for plugins that require SSL.
-*
-*
-* This program is free software: you can redistribute it and/or modify
-* it under the terms of the GNU General Public License as published by
-* the Free Software Foundation, either version 3 of the License, or
-* (at your option) any later version.
-*
-* This program is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU General Public License for more details.
-*
-* You should have received a copy of the GNU General Public License
-* along with this program. If not, see .
-*
-*
-*****************************************************************************/
+ *
+ * Monitoring Plugins SSL utilities
+ *
+ * License: GPL
+ * Copyright (c) 2005-2010 Monitoring Plugins Development Team
+ *
+ * Description:
+ *
+ * This file contains common functions for plugins that require SSL.
+ *
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ *
+ *
+ *****************************************************************************/
#define MAX_CN_LENGTH 256
#include "common.h"
#include "netutils.h"
#ifdef HAVE_SSL
-static SSL_CTX *ctx=NULL;
-static SSL *s=NULL;
+static SSL_CTX *ctx = NULL;
+static SSL *s = NULL;
-int np_net_ssl_init(int sd) {
- return np_net_ssl_init_with_hostname(sd, NULL);
-}
+int np_net_ssl_init(int sd) { return np_net_ssl_init_with_hostname(sd, NULL); }
-int np_net_ssl_init_with_hostname(int sd, char *host_name) {
- return np_net_ssl_init_with_hostname_and_version(sd, host_name, 0);
-}
+int np_net_ssl_init_with_hostname(int sd, char *host_name) { return np_net_ssl_init_with_hostname_and_version(sd, host_name, 0); }
int np_net_ssl_init_with_hostname_and_version(int sd, char *host_name, int version) {
return np_net_ssl_init_with_hostname_version_and_cert(sd, host_name, version, NULL, NULL);
@@ -59,145 +55,141 @@ int np_net_ssl_init_with_hostname_version_and_cert(int sd, char *host_name, int
printf("%s\n", _("UNKNOWN - SSL protocol version 2 is not supported by your SSL library."));
return STATE_UNKNOWN;
case MP_SSLv3: /* SSLv3 protocol */
-#if defined(OPENSSL_NO_SSL3)
+# if defined(OPENSSL_NO_SSL3)
printf("%s\n", _("UNKNOWN - SSL protocol version 3 is not supported by your SSL library."));
return STATE_UNKNOWN;
-#else
+# else
SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
SSL_CTX_set_max_proto_version(ctx, SSL3_VERSION);
break;
-#endif
+# endif
case MP_TLSv1: /* TLSv1 protocol */
-#if defined(OPENSSL_NO_TLS1)
+# if defined(OPENSSL_NO_TLS1)
printf("%s\n", _("UNKNOWN - TLS protocol version 1 is not supported by your SSL library."));
return STATE_UNKNOWN;
-#else
+# else
SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
SSL_CTX_set_max_proto_version(ctx, TLS1_VERSION);
break;
-#endif
+# endif
case MP_TLSv1_1: /* TLSv1.1 protocol */
-#if !defined(SSL_OP_NO_TLSv1_1)
+# if !defined(SSL_OP_NO_TLSv1_1)
printf("%s\n", _("UNKNOWN - TLS protocol version 1.1 is not supported by your SSL library."));
return STATE_UNKNOWN;
-#else
+# else
SSL_CTX_set_min_proto_version(ctx, TLS1_1_VERSION);
SSL_CTX_set_max_proto_version(ctx, TLS1_1_VERSION);
break;
-#endif
+# endif
case MP_TLSv1_2: /* TLSv1.2 protocol */
-#if !defined(SSL_OP_NO_TLSv1_2)
+# if !defined(SSL_OP_NO_TLSv1_2)
printf("%s\n", _("UNKNOWN - TLS protocol version 1.2 is not supported by your SSL library."));
return STATE_UNKNOWN;
-#else
+# else
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION);
break;
-#endif
+# endif
case MP_TLSv1_2_OR_NEWER:
-#if !defined(SSL_OP_NO_TLSv1_1)
+# if !defined(SSL_OP_NO_TLSv1_1)
printf("%s\n", _("UNKNOWN - Disabling TLSv1.1 is not supported by your SSL library."));
return STATE_UNKNOWN;
-#else
+# else
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
break;
-#endif
+# endif
case MP_TLSv1_1_OR_NEWER:
-#if !defined(SSL_OP_NO_TLSv1)
+# if !defined(SSL_OP_NO_TLSv1)
printf("%s\n", _("UNKNOWN - Disabling TLSv1 is not supported by your SSL library."));
return STATE_UNKNOWN;
-#else
+# else
SSL_CTX_set_min_proto_version(ctx, TLS1_1_VERSION);
break;
-#endif
+# endif
case MP_TLSv1_OR_NEWER:
-#if defined(SSL_OP_NO_SSLv3)
+# if defined(SSL_OP_NO_SSLv3)
SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
break;
-#endif
+# endif
case MP_SSLv3_OR_NEWER:
-#if defined(SSL_OP_NO_SSLv2)
+# if defined(SSL_OP_NO_SSLv2)
SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
break;
-#endif
+# endif
}
if (cert && privkey) {
-#ifdef USE_OPENSSL
+# ifdef USE_OPENSSL
if (!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
-#elif USE_GNUTLS
+# elif USE_GNUTLS
if (!SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM)) {
-#else
-#error Unported for unknown SSL library
-#endif
- printf ("%s\n", _("CRITICAL - Unable to open certificate chain file!\n"));
+# else
+# error Unported for unknown SSL library
+# endif
+ printf("%s\n", _("CRITICAL - Unable to open certificate chain file!\n"));
return STATE_CRITICAL;
}
SSL_CTX_use_PrivateKey_file(ctx, privkey, SSL_FILETYPE_PEM);
-#ifdef USE_OPENSSL
+# ifdef USE_OPENSSL
if (!SSL_CTX_check_private_key(ctx)) {
- printf ("%s\n", _("CRITICAL - Private key does not seem to match certificate!\n"));
+ printf("%s\n", _("CRITICAL - Private key does not seem to match certificate!\n"));
return STATE_CRITICAL;
}
-#endif
+# endif
}
-#ifdef SSL_OP_NO_TICKET
+# ifdef SSL_OP_NO_TICKET
options |= SSL_OP_NO_TICKET;
-#endif
+# endif
SSL_CTX_set_options(ctx, options);
SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
if ((s = SSL_new(ctx)) != NULL) {
-#ifdef SSL_set_tlsext_host_name
+# ifdef SSL_set_tlsext_host_name
if (host_name != NULL)
SSL_set_tlsext_host_name(s, host_name);
-#endif
+# endif
SSL_set_fd(s, sd);
if (SSL_connect(s) == 1) {
return OK;
} else {
printf("%s\n", _("CRITICAL - Cannot make SSL connection."));
-# ifdef USE_OPENSSL /* XXX look into ERR_error_string */
+# ifdef USE_OPENSSL /* XXX look into ERR_error_string */
ERR_print_errors_fp(stdout);
-# endif /* USE_OPENSSL */
+# endif /* USE_OPENSSL */
}
} else {
- printf("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
+ printf("%s\n", _("CRITICAL - Cannot initiate SSL handshake."));
}
return STATE_CRITICAL;
}
void np_net_ssl_cleanup() {
if (s) {
-#ifdef SSL_set_tlsext_host_name
+# ifdef SSL_set_tlsext_host_name
SSL_set_tlsext_host_name(s, NULL);
-#endif
+# endif
SSL_shutdown(s);
SSL_free(s);
if (ctx) {
SSL_CTX_free(ctx);
- ctx=NULL;
+ ctx = NULL;
}
- s=NULL;
+ s = NULL;
}
}
-int np_net_ssl_write(const void *buf, int num) {
- return SSL_write(s, buf, num);
-}
+int np_net_ssl_write(const void *buf, int num) { return SSL_write(s, buf, num); }
-int np_net_ssl_read(void *buf, int num) {
- return SSL_read(s, buf, num);
-}
+int np_net_ssl_read(void *buf, int num) { return SSL_read(s, buf, num); }
-int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int days_till_exp_crit){
-# ifdef USE_OPENSSL
- X509_NAME *subj=NULL;
+int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int days_till_exp_crit) {
+# ifdef USE_OPENSSL
+ X509_NAME *subj = NULL;
char timestamp[50] = "";
- char cn[MAX_CN_LENGTH]= "";
+ char cn[MAX_CN_LENGTH] = "";
char *tz;
- int cnlen =-1;
- int status=STATE_UNKNOWN;
+ int cnlen = -1;
+ int status = STATE_UNKNOWN;
ASN1_STRING *tm;
int offset;
@@ -208,15 +200,15 @@ int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int
time_t tm_t;
if (!certificate) {
- printf("%s\n",_("CRITICAL - Cannot retrieve server certificate."));
+ printf("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
return STATE_CRITICAL;
}
/* Extract CN from certificate subject */
- subj=X509_get_subject_name(certificate);
+ subj = X509_get_subject_name(certificate);
if (!subj) {
- printf("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
+ printf("%s\n", _("CRITICAL - Cannot retrieve certificate subject."));
return STATE_CRITICAL;
}
cnlen = X509_NAME_get_text_by_NID(subj, NID_commonName, cn, sizeof(cn));
@@ -242,23 +234,16 @@ int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int
printf("%s\n", _("CRITICAL - Wrong time format in certificate."));
return STATE_CRITICAL;
} else {
- stamp.tm_year =
- (tm->data[0] - '0') * 1000 + (tm->data[1] - '0') * 100 +
- (tm->data[2] - '0') * 10 + (tm->data[3] - '0');
+ stamp.tm_year = (tm->data[0] - '0') * 1000 + (tm->data[1] - '0') * 100 + (tm->data[2] - '0') * 10 + (tm->data[3] - '0');
stamp.tm_year -= 1900;
offset = 2;
}
}
- stamp.tm_mon =
- (tm->data[2 + offset] - '0') * 10 + (tm->data[3 + offset] - '0') - 1;
- stamp.tm_mday =
- (tm->data[4 + offset] - '0') * 10 + (tm->data[5 + offset] - '0');
- stamp.tm_hour =
- (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
- stamp.tm_min =
- (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
- stamp.tm_sec =
- (tm->data[10 + offset] - '0') * 10 + (tm->data[11 + offset] - '0');
+ stamp.tm_mon = (tm->data[2 + offset] - '0') * 10 + (tm->data[3 + offset] - '0') - 1;
+ stamp.tm_mday = (tm->data[4 + offset] - '0') * 10 + (tm->data[5 + offset] - '0');
+ stamp.tm_hour = (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
+ stamp.tm_min = (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
+ stamp.tm_sec = (tm->data[10 + offset] - '0') * 10 + (tm->data[11 + offset] - '0');
stamp.tm_isdst = -1;
tm_t = timegm(&stamp);
@@ -275,30 +260,30 @@ int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int
tzset();
if (days_left > 0 && days_left <= days_till_exp_warn) {
- printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, days_left, timestamp);
+ printf(_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left > days_till_exp_crit) ? "WARNING" : "CRITICAL", cn,
+ days_left, timestamp);
if (days_left > days_till_exp_crit)
status = STATE_WARNING;
else
status = STATE_CRITICAL;
} else if (days_left == 0 && time_left > 0) {
if (time_left >= 3600)
- time_remaining = (int) time_left / 3600;
+ time_remaining = (int)time_left / 3600;
else
- time_remaining = (int) time_left / 60;
+ time_remaining = (int)time_left / 60;
- printf (_("%s - Certificate '%s' expires in %u %s (%s)\n"),
- (days_left>days_till_exp_crit) ? "WARNING" : "CRITICAL", cn, time_remaining,
- time_left >= 3600 ? "hours" : "minutes", timestamp);
+ printf(_("%s - Certificate '%s' expires in %u %s (%s)\n"), (days_left > days_till_exp_crit) ? "WARNING" : "CRITICAL", cn,
+ time_remaining, time_left >= 3600 ? "hours" : "minutes", timestamp);
- if ( days_left > days_till_exp_crit)
+ if (days_left > days_till_exp_crit)
status = STATE_WARNING;
else
status = STATE_CRITICAL;
} else if (time_left < 0) {
printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
- status=STATE_CRITICAL;
+ status = STATE_CRITICAL;
} else if (days_left == 0) {
- printf (_("%s - Certificate '%s' just expired (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
+ printf(_("%s - Certificate '%s' just expired (%s).\n"), (days_left > days_till_exp_crit) ? "WARNING" : "CRITICAL", cn, timestamp);
if (days_left > days_till_exp_crit)
status = STATE_WARNING;
else
@@ -309,22 +294,21 @@ int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int
}
X509_free(certificate);
return status;
-# else /* ifndef USE_OPENSSL */
+# else /* ifndef USE_OPENSSL */
printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
return STATE_WARNING;
-# endif /* USE_OPENSSL */
+# endif /* USE_OPENSSL */
}
-int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
-# ifdef USE_OPENSSL
+int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit) {
+# ifdef USE_OPENSSL
X509 *certificate = NULL;
- certificate=SSL_get_peer_certificate(s);
- return(np_net_ssl_check_certificate(certificate, days_till_exp_warn, days_till_exp_crit));
-# else /* ifndef USE_OPENSSL */
+ certificate = SSL_get_peer_certificate(s);
+ return (np_net_ssl_check_certificate(certificate, days_till_exp_warn, days_till_exp_crit));
+# else /* ifndef USE_OPENSSL */
printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
return STATE_WARNING;
-# endif /* USE_OPENSSL */
+# endif /* USE_OPENSSL */
}
-
#endif /* HAVE_SSL */
--
cgit v0.10-9-g596f