ius/nagios/check-ssl-cert: comparison check-cert.pl

equal deleted inserted replaced

-:0e4dd7478d70
+:23a6e0a1407e
 use POSIX ":sys_wait_h";
 use feature qw(:5.10);
 use lib "/usr/lib/nagios/plugins";
 use utils qw (%ERRORS &print_revision &support);
-my $ME        = basename $0;
+my $ME    = basename $0;
 my $USAGE = <<EOF;
 Usage: $ME [-b <binary>] [-i init] [-d <path>] [-w <time>] [-c <time>] [-s <signature algorithm>] [-e <file,file,file,...>]
 $ME [-h | --help]
 $ME [-V | --version]
+Consult „--help“ for even more options.
 EOF
-my $VERSION   = "0.4";
+my $VERSION = "0.4";
-my $hash_file = "/var/tmp/" . basename($0) . ".known.db";
-my (%known, %excluded);
-my %certs = ();
 my $no_print =
 "no_header,no_version,no_serial,no_validity,no_subject,no_issuer,no_pubkey,no_sigdump,no_extensions";
 my @cmd_x509 = (
 "openssl",  "x509",      "-noout",   "-text",
 "-certopt", "$no_print", "-subject", "-enddate"
 );
 my @cmd_pkcs12 = qw(openssl pkcs12 -clcerts -nokeys -nomacver -passin pass:);
-my @cmd_pipe = (
+my @cmd_pipe   = (
 "openssl",  "x509",    "-noout",   "-text",
 "-certopt", $no_print, "-subject", "-enddate"
 );
-my (
+my (%cache, %excluded, %certs);
-$opt_debug,  $opt_init,    $opt_signature, $opt_version,
-$opt_help,   $opt_warning, $opt_directory, $opt_critical,
+my $opt_binary    = "/usr/bin/openssl";
-$opt_binary, @opt_exclude
+my $opt_signature = "md5WithRSAEncryption";
-);
+my $opt_warning   = "1month";
-my ($file, $w_time, $c_time);
+my $opt_critical  = "1week";
+my $opt_directory = "/etc";
-my (@critical, @warning);
+my $opt_debug     = 0;
+my $opt_init      = undef;
-$opt_binary    = "/usr/bin/openssl";
+my @opt_exclude   = ();
-$opt_signature = "md5WithRSAEncryption";
-$opt_warning   = "1month";
+my $opt_cache = "/var/tmp/@{[basename($0)]}.known.db";
-$opt_critical  = "1week";
-$opt_directory = "/etc";
 sub process_file();
 sub print_help();
 sub print_usage();
 sub get_id(;$);
 MAIN: {
+my ($w_time,   $c_time);
+my (@critical, @warning);
 Getopt::Long::Configure('bundling');
 GetOptions(
-"i|init"        => \$opt_init,
+"i|init"    => \$opt_init,
-"h|help"        => \$opt_help,
+"h|help"    => sub { print_help(); exit $ERRORS{OK}; },
-"V|version"     => \$opt_version,
+"V|version" => sub { print_revision($ME, $VERSION); exit $ERRORS{OK}; },
 "b|binary=s"    => \$opt_binary,
 "d|directory=s" => \$opt_directory,
 "w|warning=s"   => \$opt_warning,
 "c|critical=s"  => \$opt_critical,
 "s|signature"   => \$opt_signature,
 "e|exclude=s"   => \@opt_exclude,
 "d|debug"       => \$opt_debug,
+	"cache=s"	=> \$opt_cache,
 );
-print_revision($ME, $VERSION) and exit $ERRORS{"OK"} if $opt_version;
+tie(%cache, DB_File => $opt_cache, O_RDWR | O_CREAT, 0600)
-print_help() and exit $ERRORS{"OK"} if $opt_help;
+or die "Couldn't tie hash to file $opt_cache: $!; aborting";
-tie(%known, DB_File => $hash_file, O_RDWR | O_CREAT, 0600)
-or die "Couldn't tie hash to file $hash_file: $!; aborting";
 # initiate file-data hash
-%known = () if $opt_init;
+%cache = () if $opt_init;
-	@excluded{@opt_exclude} = ();
+@excluded{@opt_exclude} = ();
 find({ wanted => \&process_file }, $opt_directory);
-	exit;
+exit;
 # calculate the time
-	# $w_time = time() + 4 * 7 * 86400;
+# $w_time = time() + 4 * 7 * 86400;
 $w_time = DateCalc("today", "+ $opt_warning");
 $c_time = DateCalc("today", "+ $opt_critical");
 # check expire date
 foreach (sort keys %certs) {
 else {
 print "CERT OK: all certificates in limit\n";
 exit $ERRORS{"OK"};
 }
-untie %known;
+untie %cache;
 exit;
 }
 sub get_id(;$) { return join " ", (@_ ? stat($_[0]) : stat(_))[7, 9] }
 sub process_file() {
-	return if exists $excluded{$File::Find::name};
+return if exists $excluded{$File::Find::name};
 return if not -f;
 my $id             = get_id();
 my $is_certificate = 0;
 my $in_cert        = 0;
 my @cert           = ();
 my ($rc, $temp, $signature, $subject, $enddate);
 # excluded files
-	# @opt_exclude = split(/,/, join(',', @opt_exclude)) if @opt_exclude;
+# @opt_exclude = split(/,/, join(',', @opt_exclude)) if @opt_exclude;
 return
-if exists $known{$File::Find::name}
+if exists $cache{$File::Find::name}
-and $known{$File::Find::name} eq $id;
+and $cache{$File::Find::name} eq $id;
-	  #say $File::Find::name;
+#say $File::Find::name;
 # checking for pkcs12 certificates
-	if (0) {
+if (0) {
 my @cmd_pkcs12_current = @cmd_pkcs12;
 push @cmd_pkcs12_current, "-in", $File::Find::name, "2>/dev/null";
 my $cid = open(FILE, "@cmd_pkcs12_current |") || die "Can't fork: $!";
 while (<FILE>) {
 /^$cid:error:.*/ and last;
 $temp .= $_;
 }
+close(FILE);
+if ($temp) {
+local (*READ, *WRITE);
+my $cid = open2(\*READ, \*WRITE, @cmd_pipe)
+or die "Can't fork: $!\n";
+print WRITE $temp;
+close(WRITE);
+while (<READ>) {
+/Signature\sAlgorithm:\s(.*)\s+$/ and $signature = $1;
+/^subject=\s+(.*)\s+$/            and $subject   = $1;
+/^notAfter=(.*)\s+$/              and $enddate   = $1;
+}
+close(READ);
+# waiting for child processes
+do {
+$cid = waitpid(-1, WNOHANG);
+} while $cid > 0;
+$is_certificate = 1;
+push(
+@{ $certs{$File::Find::name} },
+($subject, $enddate, $signature)
+);
+$cache{$File::Find::name} = $id if not($is_certificate);
+return;
+}
+}
+open(FILE, $_) or die "can't open $File::Find::name: $!";
+my $file = join "", <FILE>;
 close(FILE);
-if ($temp) {
+while ($file =~ /^(-+BEGIN CERTIFICATE.*?-+END CERTIFICATE-+)$/msg) {
+# open filehandles (for read and write)
 local (*READ, *WRITE);
-my $cid = open2(\*READ, \*WRITE, @cmd_pipe)
+my $cid = open2(\*READ, \*WRITE, @cmd_x509)
-or die "Can't fork: $!\n";
+or die "Can' fork: $!\n";
-print WRITE $temp;
+print WRITE $1;
 close(WRITE);
 while (<READ>) {
 /Signature\sAlgorithm:\s(.*)\s+$/ and $signature = $1;
-/^subject=\s+(.*)\s+$/            and $subject   = $1;
+/^subject=\s+(.*)$/               and $subject   = $1;
 /^notAfter=(.*)\s+$/              and $enddate   = $1;
 }
 close(READ);
-# waiting for child processes
+waitpid($cid, 0) < 0 and die "no child with pid $cid\n";
-do {
-$cid = waitpid(-1, WNOHANG);
+if ($opt_debug) {
-} while $cid > 0;
+print "-----\n";
+print "$File::Find::name\n";
+print "Signature Algorithm: $signature\n" if ($signature);
+print "subject: $subject\n"               if ($subject);
+print "enddate: $enddate\n"               if ($enddate);
+}
+push(@{ $certs{$File::Find::name} }, ($subject, $enddate, $signature));
 $is_certificate = 1;
-push(@{ $certs{$File::Find::name} }, ($subject, $enddate, $signature));
+}
-$known{$File::Find::name} = $id if not($is_certificate);
+$cache{$File::Find::name} = $id if not($is_certificate);
-return;
-}
 }
-open(FILE, $_) or die "can't open $File::Find::name: $!";
+sub print_usage() { print $USAGE }
-	my $file = join "", <FILE>;
-	close(FILE);
-	while ($file =~ /^(-+BEGIN CERTIFICATE.*?-+END CERTIFICATE-+)$/msg) {
-			# open filehandles (for read and write)
-			local (*READ, *WRITE);
-			my $cid = open2(\*READ, \*WRITE, @cmd_x509)
-			  or die "Can' fork: $!\n";
-			print WRITE $1;
-			close(WRITE);
-			while (<READ>) {
-				/Signature\sAlgorithm:\s(.*)\s+$/ and $signature = $1;
-				/^subject=\s+(.*)$/               and $subject   = $1;
-				/^notAfter=(.*)\s+$/              and $enddate   = $1;
-			}
-			close(READ);
-			waitpid($cid, 0) < 0 and die "no child with pid $cid\n";
-if ($opt_debug) {
-print "-----\n";
-print "$File::Find::name\n";
-print "Signature Algorithm: $signature\n" if ($signature);
-print "subject: $subject\n"               if ($subject);
-print "enddate: $enddate\n"               if ($enddate);
-}
-push(
-@{ $certs{$File::Find::name} },
-($subject, $enddate, $signature)
-);
-				$is_certificate = 1;
-}
-$known{$File::Find::name} = $id if not($is_certificate);
-}
-sub print_usage() { print $USAGE };
 sub print_help() {
 print_revision($ME, $VERSION);
 print <<EOF;
 Copyright (c) 2009 Christian Arnold
 This plugin checks the expire date for openssl certificates.
 $USAGE
 	-b, --binary <binary>
 Path of openssl binary (default: /usr/bin/openssl)
 	-d, --directory <path>
+	… --cache=s db file where the known files are stored
 EOF
-print "Absolute directory path in which will be recursively search for certificate files (default: /etc).\n";
+print
+"Absolute directory path in which will be recursively search for certificate files (default: /etc).\n";
 print "  -w, --warning <time>\n";
 print
 "     Certificat should not be more than this time older (default: 1month).\n";
 print
 "     For time can be used year, month, day, hour, minute, second and weeks.\n";

branch	hs12
changeset 3	23a6e0a1407e
parent 2	0e4dd7478d70