ius/nagios/check-ssl-cert: comparison check-cert.pl

equal deleted inserted replaced

-:acac1ec01fd8
+:0e4dd7478d70
 use DB_File;
 use Getopt::Long;
 use IPC::Open2;
 use Date::Manip;
 use POSIX ":sys_wait_h";
+use feature qw(:5.10);
 use lib "/usr/lib/nagios/plugins";
 use utils qw (%ERRORS &print_revision &support);
 my $ME        = basename $0;
+my $USAGE = <<EOF;
+Usage: $ME [-b <binary>] [-i init] [-d <path>] [-w <time>] [-c <time>] [-s <signature algorithm>] [-e <file,file,file,...>]
+$ME [-h | --help]
+$ME [-V | --version]
+EOF
 my $VERSION   = "0.4";
 my $hash_file = "/var/tmp/" . basename($0) . ".known.db";
-my %known;
+my (%known, %excluded);
 my %certs = ();
 my $no_print =
 "no_header,no_version,no_serial,no_validity,no_subject,no_issuer,no_pubkey,no_sigdump,no_extensions";
 my @cmd_x509 = (
 "openssl",  "x509",      "-noout",   "-text",
 "-certopt", "$no_print", "-subject", "-enddate"
 );
-my @cmd_pkcs12 =
+my @cmd_pkcs12 = qw(openssl pkcs12 -clcerts -nokeys -nomacver -passin pass:);
-("openssl", "pkcs12", "-clcerts", "-nokeys", "-nomacver", "-passin", "pass:");
 my @cmd_pipe = (
 "openssl",  "x509",    "-noout",   "-text",
 "-certopt", $no_print, "-subject", "-enddate"
 );
 $opt_directory = "/etc";
 sub process_file();
 sub print_help();
 sub print_usage();
+sub get_id(;$);
 MAIN: {
 Getopt::Long::Configure('bundling');
 GetOptions(
 tie(%known, DB_File => $hash_file, O_RDWR | O_CREAT, 0600)
 or die "Couldn't tie hash to file $hash_file: $!; aborting";
 # initiate file-data hash
 %known = () if $opt_init;
+	@excluded{@opt_exclude} = ();
 find({ wanted => \&process_file }, $opt_directory);
+	exit;
 # calculate the time
+	# $w_time = time() + 4 * 7 * 86400;
 $w_time = DateCalc("today", "+ $opt_warning");
 $c_time = DateCalc("today", "+ $opt_critical");
 # check expire date
 foreach (sort keys %certs) {
 untie %known;
 exit;
 }
+sub get_id(;$) { return join " ", (@_ ? stat($_[0]) : stat(_))[7, 9] }
 sub process_file() {
+	return if exists $excluded{$File::Find::name};
 return if not -f;
-my $id             = join " ", (stat)[7, 9];
+my $id             = get_id();
 my $is_certificate = 0;
 my $in_cert        = 0;
 my @cert           = ();
 my ($rc, $temp, $signature, $subject, $enddate);
 # excluded files
-@opt_exclude = split(/,/, join(',', @opt_exclude)) if @opt_exclude;
+	# @opt_exclude = split(/,/, join(',', @opt_exclude)) if @opt_exclude;
-foreach my $exclude_file (@opt_exclude) {
-if ($exclude_file eq $File::Find::name) {
-$known{$File::Find::name} = $id;
-return;
-}
-}
 return
 if exists $known{$File::Find::name}
 and $known{$File::Find::name} eq $id;
+	  #say $File::Find::name;
 # checking for pkcs12 certificates
+	if (0) {
 my @cmd_pkcs12_current = @cmd_pkcs12;
 push @cmd_pkcs12_current, "-in", $File::Find::name, "2>/dev/null";
 my $cid = open(FILE, "@cmd_pkcs12_current |") || die "Can't fork: $!";
 while (<FILE>) {
 /^$cid:error:.*/ and last;
 $temp .= $_;
 push(@{ $certs{$File::Find::name} }, ($subject, $enddate, $signature));
 $known{$File::Find::name} = $id if not($is_certificate);
 return;
 }
+}
-open(FILE, $File::Find::name) or die "can't open $_: $!";
+open(FILE, $_) or die "can't open $File::Find::name: $!";
-while (<FILE>) {
+	my $file = join "", <FILE>;
+	close(FILE);
-# cheking for x509 certificates
-if ($in_cert) {
+	while ($file =~ /^(-+BEGIN CERTIFICATE.*?-+END CERTIFICATE-+)$/msg) {
-push @cert, $_;
-if (/^-----END CERTIFICATE-----$/) {
+			# open filehandles (for read and write)
-$in_cert = 0;
+			local (*READ, *WRITE);
+			my $cid = open2(\*READ, \*WRITE, @cmd_x509)
-# open filehandles (for read and write)
+			  or die "Can' fork: $!\n";
-local (*READ, *WRITE);
+			print WRITE $1;
-my $cid = open2(\*READ, \*WRITE, @cmd_x509)
+			close(WRITE);
-or die "Can' fork: $!\n";
-print WRITE @cert;
+			while (<READ>) {
-close(WRITE);
+				/Signature\sAlgorithm:\s(.*)\s+$/ and $signature = $1;
-@cert = ();
+				/^subject=\s+(.*)$/               and $subject   = $1;
+				/^notAfter=(.*)\s+$/              and $enddate   = $1;
-while (<READ>) {
+			}
-/Signature\sAlgorithm:\s(.*)\s+$/ and $signature = $1;
+			close(READ);
-/^subject=\s+(.*)$/               and $subject   = $1;
-/^notAfter=(.*)\s+$/              and $enddate   = $1;
+			waitpid($cid, 0) < 0 and die "no child with pid $cid\n";
-}
-close(READ);
-# waiting for child processes
-do {
-$cid = waitpid(-1, WNOHANG);
-} while $cid > 0;
 if ($opt_debug) {
 print "-----\n";
 print "$File::Find::name\n";
 print "Signature Algorithm: $signature\n" if ($signature);
 push(
 @{ $certs{$File::Find::name} },
 ($subject, $enddate, $signature)
 );
-$is_certificate = 1;
-next;
+				$is_certificate = 1;
 }
-}
-if (/^-----BEGIN CERTIFICATE-----$/) {
-$in_cert = 1;
-push @cert, $_;
-next;
-}
-}
 $known{$File::Find::name} = $id if not($is_certificate);
-close(FILE);
+}
-}
-sub print_usage() {
+sub print_usage() { print $USAGE };
-print "Usage:\n";
-print
-"  $ME [-b <binary>] [-i init] [-d <path>] [-w <time>] [-c <time>] [-s <signature algorithm>] [-e <file,file,file,...>]\n";
-print "  $ME [-h | --help]\n";
-print "  $ME [-V | --version]\n";
-}
 sub print_help() {
 print_revision($ME, $VERSION);
-print "Copyright (c) 2009 Christian Arnold\n\n";
+print <<EOF;
-print "This plugin checks the expire date for openssl certificates.\n\n";
+Copyright (c) 2009 Christian Arnold
-print_usage();
-print "\n";
+This plugin checks the expire date for openssl certificates.
-print "  -b, --binary <binary>\n";
-print "     Path of openssl binary (default: /usr/bin/openssl)\n";
+$USAGE
-print "  -d, --directory <path>\n";
+	-b, --binary <binary>
-print
+Path of openssl binary (default: /usr/bin/openssl)
-"     Absolute directory path in which will be recursively search for certificate files (default: /etc).\n";
+	-d, --directory <path>
+EOF
+print "Absolute directory path in which will be recursively search for certificate files (default: /etc).\n";
 print "  -w, --warning <time>\n";
 print
 "     Certificat should not be more than this time older (default: 1month).\n";
 print
 "     For time can be used year, month, day, hour, minute, second and weeks.\n";

branch	hs12
changeset 2	0e4dd7478d70
parent 1	acac1ec01fd8
child 3	23a6e0a1407e