fc1d3c6cf0ffea4ec5df885c9344387a677f1db6
1 /******************************************************************************
2 *
3 * Nagios check_ldap plugin
4 *
5 * License: GPL
6 * Copyright (c) 2000-2006 nagios-plugins team
7 *
8 * Last Modified: $Date$
9 *
10 * Description:
11 *
12 * This file contains the check_ldap plugin
13 *
14 * License Information:
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, write to the Free Software
28 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
30 $Id$
32 ******************************************************************************/
34 /* progname may be check_ldaps */
35 char *progname = "check_ldap";
36 const char *revision = "$Revision$";
37 const char *copyright = "2000-2006";
38 const char *email = "nagiosplug-devel@lists.sourceforge.net";
40 #include "common.h"
41 #include "netutils.h"
42 #include "utils.h"
44 #include <lber.h>
45 #include <ldap.h>
47 enum {
48 UNDEFINED = 0,
49 #ifdef HAVE_LDAP_SET_OPTION
50 DEFAULT_PROTOCOL = 2,
51 #endif
52 DEFAULT_PORT = 389
53 };
55 int process_arguments (int, char **);
56 int validate_arguments (void);
57 void print_help (void);
58 void print_usage (void);
60 char ld_defattr[] = "(objectclass=*)";
61 char *ld_attr = ld_defattr;
62 char *ld_host = NULL;
63 char *ld_base = NULL;
64 char *ld_passwd = NULL;
65 char *ld_binddn = NULL;
66 int ld_port = DEFAULT_PORT;
67 #ifdef HAVE_LDAP_SET_OPTION
68 int ld_protocol = DEFAULT_PROTOCOL;
69 #endif
70 double warn_time = UNDEFINED;
71 double crit_time = UNDEFINED;
72 struct timeval tv;
73 int starttls = FALSE;
74 int ssl_on_connect = FALSE;
76 /* for ldap tls */
78 char *SERVICE = "LDAP";
80 int
81 main (int argc, char *argv[])
82 {
84 LDAP *ld;
85 LDAPMessage *result;
87 /* should be int result = STATE_UNKNOWN; */
89 int status = STATE_UNKNOWN;
90 long microsec;
91 double elapsed_time;
93 /* for ldap tls */
95 int tls;
96 int version=3;
98 setlocale (LC_ALL, "");
99 bindtextdomain (PACKAGE, LOCALEDIR);
100 textdomain (PACKAGE);
102 if (strstr(argv[0],"check_ldaps")) {
103 asprintf (&progname, "check_ldaps");
104 }
106 if (process_arguments (argc, argv) == ERROR)
107 usage4 (_("Could not parse arguments"));
109 if (strstr(argv[0],"check_ldaps") && ! starttls && ! ssl_on_connect)
110 starttls = TRUE;
112 /* initialize alarm signal handling */
113 signal (SIGALRM, socket_timeout_alarm_handler);
115 /* set socket timeout */
116 alarm (socket_timeout);
118 /* get the start time */
119 gettimeofday (&tv, NULL);
121 /* initialize ldap */
122 #ifdef HAVE_LDAP_INIT
123 if (!(ld = ldap_init (ld_host, ld_port))) {
124 printf ("Could not connect to the server at port %i\n", ld_port);
125 return STATE_CRITICAL;
126 }
127 #else
128 if (!(ld = ldap_open (ld_host, ld_port))) {
129 /*ldap_perror(ld, "ldap_open"); */
130 printf (_("Could not connect to the server at port %i\n"), ld_port);
131 return STATE_CRITICAL;
132 }
133 #endif /* HAVE_LDAP_INIT */
135 #ifdef HAVE_LDAP_SET_OPTION
136 /* set ldap options */
137 if (ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &ld_protocol) !=
138 LDAP_OPT_SUCCESS ) {
139 printf(_("Could not set protocol version %d\n"), ld_protocol);
140 return STATE_CRITICAL;
141 }
142 #endif
144 if (ld_port == LDAPS_PORT || ssl_on_connect) {
145 asprintf (&SERVICE, "LDAPS");
146 #if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
147 /* ldaps: set option tls */
148 tls = LDAP_OPT_X_TLS_HARD;
150 if (ldap_set_option (ld, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
151 {
152 /*ldap_perror(ld, "ldaps_option"); */
153 printf (_("Could not init TLS at port %i!\n"), ld_port);
154 return STATE_CRITICAL;
155 }
156 #else
157 printf (_("TLS not supported by the libraries!\n"));
158 return STATE_CRITICAL;
159 #endif /* LDAP_OPT_X_TLS */
160 } else if (starttls) {
161 asprintf (&SERVICE, "LDAP-TLS");
162 #if defined(HAVE_LDAP_SET_OPTION) && defined(HAVE_LDAP_START_TLS_S)
163 /* ldap with startTLS: set option version */
164 if (ldap_get_option(ld,LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS )
165 {
166 if (version < LDAP_VERSION3)
167 {
168 version = LDAP_VERSION3;
169 ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version);
170 }
171 }
172 /* call start_tls */
173 if (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS)
174 {
175 /*ldap_perror(ld, "ldap_start_tls"); */
176 printf (_("Could not init startTLS at port %i!\n"), ld_port);
177 return STATE_CRITICAL;
178 }
179 #else
180 printf (_("startTLS not supported by the library, needs LDAPv3!\n"));
181 return STATE_CRITICAL;
182 #endif /* HAVE_LDAP_START_TLS_S */
183 }
185 /* bind to the ldap server */
186 if (ldap_bind_s (ld, ld_binddn, ld_passwd, LDAP_AUTH_SIMPLE) !=
187 LDAP_SUCCESS) {
188 /*ldap_perror(ld, "ldap_bind"); */
189 printf (_("Could not bind to the ldap-server\n"));
190 return STATE_CRITICAL;
191 }
193 /* do a search of all objectclasses in the base dn */
194 if (ldap_search_s (ld, ld_base, LDAP_SCOPE_BASE, ld_attr, NULL, 0, &result)
195 != LDAP_SUCCESS) {
196 /*ldap_perror(ld, "ldap_search"); */
197 printf (_("Could not search/find objectclasses in %s\n"), ld_base);
198 return STATE_CRITICAL;
199 }
201 /* unbind from the ldap server */
202 ldap_unbind (ld);
204 /* reset the alarm handler */
205 alarm (0);
207 /* calcutate the elapsed time and compare to thresholds */
209 microsec = deltime (tv);
210 elapsed_time = (double)microsec / 1.0e6;
212 if (crit_time!=UNDEFINED && elapsed_time>crit_time)
213 status = STATE_CRITICAL;
214 else if (warn_time!=UNDEFINED && elapsed_time>warn_time)
215 status = STATE_WARNING;
216 else
217 status = STATE_OK;
219 /* print out the result */
220 printf (_("LDAP %s - %.3f seconds response time|%s\n"),
221 state_text (status),
222 elapsed_time,
223 fperfdata ("time", elapsed_time, "s",
224 (int)warn_time, warn_time,
225 (int)crit_time, crit_time,
226 TRUE, 0, FALSE, 0));
228 return status;
229 }
231 /* process command-line arguments */
232 int
233 process_arguments (int argc, char **argv)
234 {
235 int c;
237 int option = 0;
238 /* initialize the long option struct */
239 static struct option longopts[] = {
240 {"help", no_argument, 0, 'h'},
241 {"version", no_argument, 0, 'V'},
242 {"timeout", required_argument, 0, 't'},
243 {"host", required_argument, 0, 'H'},
244 {"base", required_argument, 0, 'b'},
245 {"attr", required_argument, 0, 'a'},
246 {"bind", required_argument, 0, 'D'},
247 {"pass", required_argument, 0, 'P'},
248 #ifdef HAVE_LDAP_SET_OPTION
249 {"ver2", no_argument, 0, '2'},
250 {"ver3", no_argument, 0, '3'},
251 #endif
252 {"starttls", no_argument, 0, 'T'},
253 {"ssl", no_argument, 0, 'S'},
254 {"use-ipv4", no_argument, 0, '4'},
255 {"use-ipv6", no_argument, 0, '6'},
256 {"port", required_argument, 0, 'p'},
257 {"warn", required_argument, 0, 'w'},
258 {"crit", required_argument, 0, 'c'},
259 {0, 0, 0, 0}
260 };
262 if (argc < 2)
263 return ERROR;
265 for (c = 1; c < argc; c++) {
266 if (strcmp ("-to", argv[c]) == 0)
267 strcpy (argv[c], "-t");
268 }
270 while (1) {
271 c = getopt_long (argc, argv, "hV234TS6t:c:w:H:b:p:a:D:P:", longopts, &option);
273 if (c == -1 || c == EOF)
274 break;
276 switch (c) {
277 case 'h': /* help */
278 print_help ();
279 exit (STATE_OK);
280 case 'V': /* version */
281 print_revision (progname, revision);
282 exit (STATE_OK);
283 case 't': /* timeout period */
284 if (!is_intnonneg (optarg))
285 usage2 (_("Timeout interval must be a positive integer"), optarg);
286 else
287 socket_timeout = atoi (optarg);
288 break;
289 case 'H':
290 ld_host = optarg;
291 break;
292 case 'b':
293 ld_base = optarg;
294 break;
295 case 'p':
296 ld_port = atoi (optarg);
297 break;
298 case 'a':
299 ld_attr = optarg;
300 break;
301 case 'D':
302 ld_binddn = optarg;
303 break;
304 case 'P':
305 ld_passwd = optarg;
306 break;
307 case 'w':
308 warn_time = strtod (optarg, NULL);
309 break;
310 case 'c':
311 crit_time = strtod (optarg, NULL);
312 break;
313 #ifdef HAVE_LDAP_SET_OPTION
314 case '2':
315 ld_protocol = 2;
316 break;
317 case '3':
318 ld_protocol = 3;
319 break;
320 #endif
321 case '4':
322 address_family = AF_INET;
323 break;
324 case 'T':
325 if (! ssl_on_connect)
326 starttls = TRUE;
327 else
328 usage_va(_("%s cannot be combined with %s"), "-T/--starttls", "-S/--ssl");
329 break;
330 case 'S':
331 if (! starttls) {
332 ssl_on_connect = TRUE;
333 ld_port = LDAPS_PORT;
334 } else
335 usage_va(_("%s cannot be combined with %s"), "-S/--ssl", "-T/--starttls");
336 break;
337 case '6':
338 #ifdef USE_IPV6
339 address_family = AF_INET6;
340 #else
341 usage (_("IPv6 support not available\n"));
342 #endif
343 break;
344 default:
345 usage5 ();
346 }
347 }
349 c = optind;
350 if (ld_host == NULL && is_host(argv[c]))
351 ld_host = strdup (argv[c++]);
353 if (ld_base == NULL && argv[c])
354 ld_base = strdup (argv[c++]);
356 return validate_arguments ();
357 }
360 int
361 validate_arguments ()
362 {
363 if (ld_host==NULL || strlen(ld_host)==0)
364 usage4 (_("Please specify the host name\n"));
366 if (ld_base==NULL || strlen(ld_base)==0)
367 usage4 (_("Please specify the LDAP base\n"));
369 return OK;
370 }
373 void
374 print_help (void)
375 {
376 char *myport;
377 asprintf (&myport, "%d", DEFAULT_PORT);
379 print_revision (progname, revision);
381 printf ("Copyright (c) 1999 Didi Rieder (adrieder@sbox.tu-graz.ac.at)\n");
382 printf (COPYRIGHT, copyright, email);
384 printf ("\n\n");
386 print_usage ();
388 printf (_(UT_HELP_VRSN));
390 printf (_(UT_HOST_PORT), 'p', myport);
392 printf (_(UT_IPv46));
394 printf (" %s\n", "-a [--attr]");
395 printf (" %s\n", _("ldap attribute to search (default: \"(objectclass=*)\""));
396 printf (" %s\n", "-b [--base]");
397 printf (" %s\n", _("ldap base (eg. ou=my unit, o=my org, c=at"));
398 printf (" %s\n", "-D [--bind]");
399 printf (" %s\n", _("ldap bind DN (if required)"));
400 printf (" %s\n", "-P [--pass]");
401 printf (" %s\n", _("ldap password (if required)"));
402 printf (" %s\n", "-T [--starttls]");
403 printf (" %s\n", _("use starttls mechanism introduced in protocol version 3"));
404 printf (" %s\n", "-S [--ssl]");
405 printf (" %s\n", _("use ldaps (ldap v2 ssl method). this also sets the default port to %s"), LDAPS_PORT);
407 #ifdef HAVE_LDAP_SET_OPTION
408 printf (" %s\n", "-2 [--ver2]");
409 printf (" %s\n", _("use ldap protocol version 2"));
410 printf (" %s\n", "-3 [--ver3]");
411 printf (" %s\n", _("use ldap protocol version 3"));
412 printf (" (default protocol version: %d)\n", DEFAULT_PROTOCOL);
413 #endif
415 printf (_(UT_WARN_CRIT));
417 printf (_(UT_TIMEOUT), DEFAULT_SOCKET_TIMEOUT);
419 printf (_(UT_VERBOSE));
421 printf ("\n%s\n", _("Note:"));
422 printf ("%s\n", _("If this plugin is called via 'check_ldaps', method 'STARTTLS' will be"));
423 printf (_("implied (using default port %i) unless --port=636 is specified. In that case %s"), DEFAULT_PORT, "\n");
424 printf ("%s\n", _("'SSL on connect' will be used no matter how the plugin was called."));
425 printf ("%s\n", _("This detection is deprecated, please use 'check_ldap' with the '--starttls' or '--ssl' flags"));
426 printf ("%s\n", _("to define the behaviour explicitly instead."));
428 printf (_(UT_SUPPORT));
429 }
431 /* todo
432 * add option -4 and -6 to the long manual
433 *
434 */
436 void
437 print_usage (void)
438 {
439 printf (_("Usage:"));
440 printf (" %s -H <host> -b <base_dn> [-p <port>] [-a <attr>] [-D <binddn>]",progname);
441 printf ("\n [-P <password>] [-w <warn_time>] [-c <crit_time>] [-t timeout]%s\n",
442 #ifdef HAVE_LDAP_SET_OPTION
443 "\n [-2|-3] [-4|-6]"
444 #else
445 ""
446 #endif
447 );
448 }