X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=plugins%2Fcheck_ldap.c;h=d731cbca63aeffbe3da71ca8a130a414640ef30f;hb=fb6f6237818372ccf4fde37e57e999e22b38e226;hp=9664c0fb5c211cc10c22f9e23a547282b6647cd8;hpb=edf60f6dceba48555f2534d9a217a8c5913ce029;p=nagiosplug.git diff --git a/plugins/check_ldap.c b/plugins/check_ldap.c index 9664c0f..d731cbc 100644 --- a/plugins/check_ldap.c +++ b/plugins/check_ldap.c @@ -1,26 +1,40 @@ /****************************************************************************** - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +* +* Nagios check_ldap plugin +* +* License: GPL +* Copyright (c) 2000-2006 nagios-plugins team +* +* Last Modified: $Date$ +* +* Description: +* +* This file contains the check_ldap plugin +* +* License Information: +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of the GNU General Public License as published by +* the Free Software Foundation; either version 2 of the License, or +* (at your option) any later version. +* +* This program is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +* GNU General Public License for more details. +* +* You should have received a copy of the GNU General Public License +* along with this program; if not, write to the Free Software +* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. $Id$ ******************************************************************************/ -const char *progname = "check_ldap"; +/* progname may be check_ldaps */ +char *progname = "check_ldap"; const char *revision = "$Revision$"; -const char *copyright = "2000-2004"; +const char *copyright = "2000-2006"; const char *email = "nagiosplug-devel@lists.sourceforge.net"; #include "common.h" @@ -56,6 +70,13 @@ int ld_protocol = DEFAULT_PROTOCOL; double warn_time = UNDEFINED; double crit_time = UNDEFINED; struct timeval tv; +int starttls = FALSE; +int ssl_on_connect = FALSE; +int verbose = 0; + +/* for ldap tls */ + +char *SERVICE = "LDAP"; int main (int argc, char *argv[]) @@ -69,14 +90,26 @@ main (int argc, char *argv[]) int status = STATE_UNKNOWN; long microsec; double elapsed_time; + + /* for ldap tls */ + + int tls; + int version=3; setlocale (LC_ALL, ""); bindtextdomain (PACKAGE, LOCALEDIR); textdomain (PACKAGE); - if (process_arguments (argc, argv) != TRUE) + if (strstr(argv[0],"check_ldaps")) { + asprintf (&progname, "check_ldaps"); + } + + if (process_arguments (argc, argv) == ERROR) usage4 (_("Could not parse arguments")); + if (strstr(argv[0],"check_ldaps") && ! starttls && ! ssl_on_connect) + starttls = TRUE; + /* initialize alarm signal handling */ signal (SIGALRM, socket_timeout_alarm_handler); @@ -87,12 +120,20 @@ main (int argc, char *argv[]) gettimeofday (&tv, NULL); /* initialize ldap */ +#ifdef HAVE_LDAP_INIT + if (!(ld = ldap_init (ld_host, ld_port))) { + printf ("Could not connect to the server at port %i\n", ld_port); + return STATE_CRITICAL; + } +#else if (!(ld = ldap_open (ld_host, ld_port))) { - /*ldap_perror(ld, "ldap_open"); */ + if (verbose) + ldap_perror(ld, "ldap_open"); printf (_("Could not connect to the server at port %i\n"), ld_port); return STATE_CRITICAL; } - +#endif /* HAVE_LDAP_INIT */ + #ifdef HAVE_LDAP_SET_OPTION /* set ldap options */ if (ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &ld_protocol) != @@ -101,10 +142,55 @@ main (int argc, char *argv[]) return STATE_CRITICAL; } #endif + + if (ld_port == LDAPS_PORT || ssl_on_connect) { + asprintf (&SERVICE, "LDAPS"); +#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS) + /* ldaps: set option tls */ + tls = LDAP_OPT_X_TLS_HARD; + + if (ldap_set_option (ld, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS) + { + if (verbose) + ldap_perror(ld, "ldaps_option"); + printf (_("Could not init TLS at port %i!\n"), ld_port); + return STATE_CRITICAL; + } +#else + printf (_("TLS not supported by the libraries!\n")); + return STATE_CRITICAL; +#endif /* LDAP_OPT_X_TLS */ + } else if (starttls) { + asprintf (&SERVICE, "LDAP-TLS"); +#if defined(HAVE_LDAP_SET_OPTION) && defined(HAVE_LDAP_START_TLS_S) + /* ldap with startTLS: set option version */ + if (ldap_get_option(ld,LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS ) + { + if (version < LDAP_VERSION3) + { + version = LDAP_VERSION3; + ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); + } + } + /* call start_tls */ + if (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS) + { + if (verbose) + ldap_perror(ld, "ldap_start_tls"); + printf (_("Could not init startTLS at port %i!\n"), ld_port); + return STATE_CRITICAL; + } +#else + printf (_("startTLS not supported by the library, needs LDAPv3!\n")); + return STATE_CRITICAL; +#endif /* HAVE_LDAP_START_TLS_S */ + } + /* bind to the ldap server */ if (ldap_bind_s (ld, ld_binddn, ld_passwd, LDAP_AUTH_SIMPLE) != LDAP_SUCCESS) { - /*ldap_perror(ld, "ldap_bind"); */ + if (verbose) + ldap_perror(ld, "ldap_bind"); printf (_("Could not bind to the ldap-server\n")); return STATE_CRITICAL; } @@ -112,7 +198,8 @@ main (int argc, char *argv[]) /* do a search of all objectclasses in the base dn */ if (ldap_search_s (ld, ld_base, LDAP_SCOPE_BASE, ld_attr, NULL, 0, &result) != LDAP_SUCCESS) { - /*ldap_perror(ld, "ldap_search"); */ + if (verbose) + ldap_perror(ld, "ldap_search"); printf (_("Could not search/find objectclasses in %s\n"), ld_base); return STATE_CRITICAL; } @@ -168,11 +255,14 @@ process_arguments (int argc, char **argv) {"ver2", no_argument, 0, '2'}, {"ver3", no_argument, 0, '3'}, #endif + {"starttls", no_argument, 0, 'T'}, + {"ssl", no_argument, 0, 'S'}, {"use-ipv4", no_argument, 0, '4'}, {"use-ipv6", no_argument, 0, '6'}, {"port", required_argument, 0, 'p'}, {"warn", required_argument, 0, 'w'}, {"crit", required_argument, 0, 'c'}, + {"verbose", no_argument, 0, 'v'}, {0, 0, 0, 0} }; @@ -185,7 +275,7 @@ process_arguments (int argc, char **argv) } while (1) { - c = getopt_long (argc, argv, "hV2346t:c:w:H:b:p:a:D:P:", longopts, &option); + c = getopt_long (argc, argv, "hvV234TS6t:c:w:H:b:p:a:D:P:", longopts, &option); if (c == -1 || c == EOF) break; @@ -238,6 +328,22 @@ process_arguments (int argc, char **argv) case '4': address_family = AF_INET; break; + case 'v': + verbose++; + break; + case 'T': + if (! ssl_on_connect) + starttls = TRUE; + else + usage_va(_("%s cannot be combined with %s"), "-T/--starttls", "-S/--ssl"); + break; + case 'S': + if (! starttls) { + ssl_on_connect = TRUE; + ld_port = LDAPS_PORT; + } else + usage_va(_("%s cannot be combined with %s"), "-S/--ssl", "-T/--starttls"); + break; case '6': #ifdef USE_IPV6 address_family = AF_INET6; @@ -246,9 +352,7 @@ process_arguments (int argc, char **argv) #endif break; default: - printf (_("%s: Unknown argument: %s\n\n"), progname, optarg); - print_usage (); - exit (STATE_UNKNOWN); + usage5 (); } } @@ -262,23 +366,20 @@ process_arguments (int argc, char **argv) return validate_arguments (); } + int validate_arguments () { if (ld_host==NULL || strlen(ld_host)==0) - usage (_("please specify the host name\n")); + usage4 (_("Please specify the host name\n")); if (ld_base==NULL || strlen(ld_base)==0) - usage (_("please specify the LDAP base\n")); + usage4 (_("Please specify the LDAP base\n")); return OK; - } - - - void print_help (void) { @@ -290,6 +391,8 @@ print_help (void) printf ("Copyright (c) 1999 Didi Rieder (adrieder@sbox.tu-graz.ac.at)\n"); printf (COPYRIGHT, copyright, email); + printf ("\n\n"); + print_usage (); printf (_(UT_HELP_VRSN)); @@ -298,24 +401,25 @@ print_help (void) printf (_(UT_IPv46)); - printf (_("\ - -a [--attr]\n\ - ldap attribute to search (default: \"(objectclass=*)\"\n\ - -b [--base]\n\ - ldap base (eg. ou=my unit, o=my org, c=at)\n\ - -D [--bind]\n\ - ldap bind DN (if required)\n\ - -P [--pass]\n\ - ldap password (if required)\n")); + printf (" %s\n", "-a [--attr]"); + printf (" %s\n", _("ldap attribute to search (default: \"(objectclass=*)\"")); + printf (" %s\n", "-b [--base]"); + printf (" %s\n", _("ldap base (eg. ou=my unit, o=my org, c=at")); + printf (" %s\n", "-D [--bind]"); + printf (" %s\n", _("ldap bind DN (if required)")); + printf (" %s\n", "-P [--pass]"); + printf (" %s\n", _("ldap password (if required)")); + printf (" %s\n", "-T [--starttls]"); + printf (" %s\n", _("use starttls mechanism introduced in protocol version 3")); + printf (" %s\n", "-S [--ssl]"); + printf (_(" use ldaps (ldap v2 ssl method). this also sets the default port to %i\n"), LDAPS_PORT); #ifdef HAVE_LDAP_SET_OPTION - printf (_("\ - -2 [--ver2]\n\ - use ldap protocol version 2\n\ - -3 [--ver3]\n\ - use ldap protocol version 3\n\ - (default protocol version: %d)\n"), - DEFAULT_PROTOCOL); + printf (" %s\n", "-2 [--ver2]"); + printf (" %s\n", _("use ldap protocol version 2")); + printf (" %s\n", "-3 [--ver3]"); + printf (" %s\n", _("use ldap protocol version 3")); + printf (" (default protocol version: %d)\n", DEFAULT_PROTOCOL); #endif printf (_(UT_WARN_CRIT)); @@ -324,21 +428,29 @@ print_help (void) printf (_(UT_VERBOSE)); + printf ("\n%s\n", _("Note:")); + printf ("%s\n", _("If this plugin is called via 'check_ldaps', method 'STARTTLS' will be")); + printf (_("implied (using default port %i) unless --port=636 is specified. In that case %s"), DEFAULT_PORT, "\n"); + printf ("%s\n", _("'SSL on connect' will be used no matter how the plugin was called.")); + printf ("%s\n", _("This detection is deprecated, please use 'check_ldap' with the '--starttls' or '--ssl' flags")); + printf ("%s\n", _("to define the behaviour explicitly instead.")); + printf (_(UT_SUPPORT)); } - +/* todo +* add option -4 and -6 to the long manual +* +*/ void print_usage (void) { - printf ("\ -Usage: %s -H -b [-p ] [-a ] [-D ]\n\ - [-P ] [-w ] [-c ] [-t timeout]%s\n", -//(Note: all times are in seconds.)\n", - progname, + printf (_("Usage:")); + printf (" %s -H -b [-p ] [-a ] [-D ]",progname); + printf ("\n [-P ] [-w ] [-c ] [-t timeout]%s\n", #ifdef HAVE_LDAP_SET_OPTION - " [-2|-3] [-4|-6]" + "\n [-2|-3] [-4|-6]" #else "" #endif