--- a/check_tlsa Mon May 02 23:07:41 2016 +0200
+++ b/check_tlsa Mon May 02 23:08:42 2016 +0200
@@ -34,63 +34,72 @@
my $url = 'https://schlittermann.de';
my $author = 'Heike Yvonne Pesch';
my $email = '<pesch@schlittermann.de>';
-my $extra = LF.'Author: '.$author.' '.$email.LF
- . 'For more information visit '.$url;
+my $extra =
+ LF
+ . 'Author: '
+ . $author . ' '
+ . $email
+ . LF
+ . 'For more information visit '
+ . $url;
my $license = 'GPLv3';
-my $usage = 'Usage: %s [ -v|--verbose ] [-H <host>] [-t <timeout>] '
- . '[ -c|--critical=<critical threshold> ] '
- . '[ -w|--warning=<warning threshold> ] '
- . '[ -p|--port=<portnumber> ] '
- . '[ -q|--queryserver=<DNS-Server-IP> ] ';
+my $usage =
+ 'Usage: %s [ -v|--verbose ] [-H <host>] [-t <timeout>] '
+ . '[ -c|--critical=<critical threshold> ] '
+ . '[ -w|--warning=<warning threshold> ] '
+ . '[ -p|--port=<portnumber> ] '
+ . '[ -q|--queryserver=<DNS-Server-IP> ] ';
my $check_tlsa = Monitoring::Plugin->new(
- usage => $usage,
- version => $VERSION,
- blurb => $blurb,
- extra => $extra,
- url => $url,
- license => $license,
- plugin => basename $0,
- timeout => 60,
-);
-
-$check_tlsa->add_arg(
- spec => 'host|H=s',
- help => q|Host/Domain to check|,
- required => 0,
+ usage => $usage,
+ version => $VERSION,
+ blurb => $blurb,
+ extra => $extra,
+ url => $url,
+ license => $license,
+ plugin => basename $0,
+ timeout => 60,
);
$check_tlsa->add_arg(
- spec => 'hostlist|f=s',
- help => q|Host/Domainlist in file to check|,
- required => 0,
+ spec => 'host|H=s',
+ help => q|Host/Domain to check|,
+ required => 0,
);
$check_tlsa->add_arg(
- spec => 'expiry|e',
- help => q|check expiry of Certificate|,
- required => 0,
+ spec => 'hostlist|f=s',
+ help => q|Host/Domainlist in file to check|,
+ required => 0,
+);
+
+$check_tlsa->add_arg(
+ spec => 'expiry|e',
+ help => q|check expiry of Certificate|,
+ required => 0,
);
$check_tlsa->add_arg(
- spec => 'port|p=i',
- help => q|Port of Domain to check the TLSA (default: 443)|,
- required => 0,
- default => 443,
+ spec => 'port|p=i',
+ help => q|Port of Domain to check the TLSA (default: 443)|,
+ required => 0,
+ default => 443,
);
$check_tlsa->add_arg(
- spec => 'queryserver|q=s',
- help => q|DNS Server to ask to check the TLSA (default: defined in resolve.conf)|,
- required => 0,
- #default => '8.8.8.8',
+ spec => 'queryserver|q=s',
+ help =>
+ q|DNS Server to ask to check the TLSA (default: defined in resolve.conf)|,
+ required => 0,
+
+ #default => '8.8.8.8',
);
$check_tlsa->add_arg(
- spec => 'protocol|P=s',
- help => q|DNS Server to ask to check the TLSA (default: tcp)|,
- required => 0,
- default => 'tcp',
+ spec => 'protocol|P=s',
+ help => q|DNS Server to ask to check the TLSA (default: tcp)|,
+ required => 0,
+ default => 'tcp',
);
$check_tlsa->getopts;
@@ -100,129 +109,123 @@
my $expiry = $check_tlsa->opts->expiry;
if (!$domain && !$domainlist) {
- my $script = basename $0;
- my $excuse = "Please set -H <domain> or -f <domainlist>\n"
- . "For all options try $script --help";
+ my $script = basename $0;
+ my $excuse = "Please set -H <domain> or -f <domainlist>\n"
+ . "For all options try $script --help";
- print $excuse,LF;
- exit 1;
+ print $excuse, LF;
+ exit 1;
}
-
- my $port;
- my $cert;
- my $check_date;
+my $port;
+my $cert;
+my $check_date;
- if ( defined $domainlist && -e $domainlist){
- print get_domains();
- }
- else { print check_tlsa(); }
+if (defined $domainlist && -e $domainlist) {
+ print get_domains();
+}
+else { print check_tlsa(); }
sub check_tlsa {
- my $protocol = $check_tlsa->opts->protocol;
+ my $protocol = $check_tlsa->opts->protocol;
- $port = $check_tlsa->opts->port unless $port ;
+ $port = $check_tlsa->opts->port unless $port;
- if ("$port" eq '25') {
- $cert = "openssl s_client -starttls smtp -connect $domain:$port "
- . '< /dev/null 2>/dev/null';
- }
- else {
- #$port = $check_tlsa->opts->port;
- $cert = "openssl s_client -connect $domain:$port "
- . '< /dev/null 2>/dev/null';
- }
+ if ("$port" eq '25') {
+ $cert = "openssl s_client -starttls smtp -connect $domain:$port "
+ . '< /dev/null 2>/dev/null';
+ }
+ else {
+ #$port = $check_tlsa->opts->port;
+ $cert = "openssl s_client -connect $domain:$port "
+ . '< /dev/null 2>/dev/null';
+ }
- my $digquery = "dig TLSA _$port._$protocol.$domain +short";
- my $diganswer = qx($digquery);
- my $dig = substr($diganswer, 6, );
- $dig =~ s/(\S*)\s+(\S*)$/$1$2/;
- my $tlsa_usage = substr($diganswer, 0, 1);
- my $tlsa_selector = substr($diganswer, 2, 1);
- my $tlsa_match_type = substr($diganswer, 4, 1);
- my $hashit;
+ my $digquery = "dig TLSA _$port._$protocol.$domain +short";
+ my $diganswer = qx($digquery);
+ my $dig = substr($diganswer, 6,);
+ $dig =~ s/(\S*)\s+(\S*)$/$1$2/;
+ my $tlsa_usage = substr($diganswer, 0, 1);
+ my $tlsa_selector = substr($diganswer, 2, 1);
+ my $tlsa_match_type = substr($diganswer, 4, 1);
+ my $hashit;
- for ($tlsa_match_type) {
- when('0') { die 'certs will be compared directly'}
- when('1') {$hashit = 'sha256'}
- when('2') {$hashit = 'sha512'}
- default {$hashit = 'sha256'}
- };
+ for ($tlsa_match_type) {
+ when ('0') { die 'certs will be compared directly' }
+ when ('1') { $hashit = 'sha256' }
+ when ('2') { $hashit = 'sha512' }
+ default { $hashit = 'sha256' }
+ }
- my $gentlsa = 'openssl x509 -pubkey | '
- . 'openssl rsa -pubin -inform PEM -outform DER 2>/dev/null| '
- . "openssl $hashit";
- my $certtlsa = "$cert | $gentlsa";
+ my $gentlsa =
+ 'openssl x509 -pubkey | '
+ . 'openssl rsa -pubin -inform PEM -outform DER 2>/dev/null| '
+ . "openssl $hashit";
+ my $certtlsa = "$cert | $gentlsa";
- $check_date = 'openssl x509 -noout -startdate -enddate';
- $check_date = "$cert|$check_date";
-
+ $check_date = 'openssl x509 -noout -startdate -enddate';
+ $check_date = "$cert|$check_date";
- my $return;
+ my $return;
- my $tlsa_record = qx($certtlsa) or die "nothing found!\n";
- $tlsa_record =~ s/^.*= (.*$)/$1/gi;
- $tlsa_record = uc($tlsa_record);
+ my $tlsa_record = qx($certtlsa) or die "nothing found!\n";
+ $tlsa_record =~ s/^.*= (.*$)/$1/gi;
+ $tlsa_record = uc($tlsa_record);
- if (defined $expiry) {
- print check_cert_expiry();
- }
+ if (defined $expiry) {
+ print check_cert_expiry();
+ }
+
+ if ("$tlsa_record" eq "$dig") {
- if ("$tlsa_record" eq "$dig") {
- #$return = "TLSA record is $tlsa_record and valid";
- #funktioniert nich nicht optimal mit hostliste
- $return = $check_tlsa->plugin_exit(OK, "$domain: TLSA record is valid")
- . "$domain: TLSA record is valid\n";
- }
- else {
- $check_tlsa->plugin_exit(CRITICAL, "$domain: TLSA record NOT valid");
- }
- return $return;
- #return $cert;
+ #$return = "TLSA record is $tlsa_record and valid";
+ #funktioniert nich nicht optimal mit hostliste
+ $return = $check_tlsa->plugin_exit(OK, "$domain: TLSA record is valid")
+ . "$domain: TLSA record is valid\n";
+ }
+ else {
+ $check_tlsa->plugin_exit(CRITICAL, "$domain: TLSA record NOT valid");
+ }
+ return $return;
+
+ #return $cert;
}
-
-
sub get_domains {
- open(my $filehandle, '<', $domainlist);
+ open(my $filehandle, '<', $domainlist);
- my $pattern = '^(?<domain>\S*\.[a-z]{2,4}?):{0,1}(?<port>[0-9]*$)';
- my %domain2check;
- while(<$filehandle>) {
- if (/$pattern/ig) {
- $domain = $+{domain};
- $port = $+{port};
- #print "nunu,file ok",LF,"port: $+{port}",LF,"domain: $+{domain}",LF;
- $domain2check{$domain} = $port;
+ my $pattern = '^(?<domain>\S*\.[a-z]{2,4}?):{0,1}(?<port>[0-9]*$)';
+ my %domain2check;
+ while (<$filehandle>) {
+ if (/$pattern/ig) {
+ $domain = $+{domain};
+ $port = $+{port};
-
-
-
+ #print "nunu,file ok",LF,"port: $+{port}",LF,"domain: $+{domain}",LF;
+ $domain2check{$domain} = $port;
- #print check_tlsa();
- }
- else {
- die "wrong content";
- }
+ #print check_tlsa();
+ }
+ else {
+ die "wrong content";
+ }
- foreach my $key (%domain2check)
- {
- $domain = $key;
- $port = $domain2check{$key};
- print $domain, ' ', $port,"\n";
-
+ foreach my $key (%domain2check) {
+ $domain = $key;
+ $port = $domain2check{$key};
+ print $domain, ' ', $port, "\n";
- if ( "$port" =~ /^\s*$/) { $port = '443'; }
- print $domain, ' ', $port,"\n";
+ if ("$port" =~ /^\s*$/) { $port = '443'; }
+ print $domain, ' ', $port, "\n";
- check_tlsa($domain,$port);
- }
+ check_tlsa($domain, $port);
+ }
- }
+ }
}
sub check_cert_expiry {
- my $return = qx($check_date);
- return $return;
+ my $return = qx($check_date);
+ return $return;
}