- initial attempt at consolidating ssl-related code into netutils.{c,h}

- added some #ifdefs to common.h and netutils.h to prevent multiple
  inclusions (as netlibs now includes common.h)
- all ssl plugins (tcp/http/smtp) compile cleanly against gnutls, though
  certificate checking still needs to be done.
- modified configure script so you can also explicitly say "without-gnutls"
  too (otherwise if you disable openssl you have no way of disabling
  gnutls too)


git-svn-id: https://nagiosplug.svn.sourceforge.net/svnroot/nagiosplug/nagiosplug/trunk@1255 f882894a-f735-0410-b71e-b25c423dba1c

9 files changed, 151 insertions, 128 deletions

diff --git a/configure.in b/configure.in
index 7ae486ce..383f1788 100644
--- a/configure.in
+++ b/configure.in
@@ -488,7 +488,7 @@ fi
 
 dnl check for gnutls if openssl isn't found (or is disabled)
 FOUNDGNUTLS="no"
-if ! test "$FOUNDSSL" = "yes"; then
+if ! test "$FOUNDSSL" = "yes" && ! test "$with_gnutls" = "no"; then
         if test "$GNUTLS" = ""; then
                 CPPFLAGS="$CPPFLAGS -I$GNUTLS"
         elif ! test "$LIBGNUTLS_CONFIG" = ""; then
diff --git a/plugins-root/Makefile.am b/plugins-root/Makefile.am
index 81679d53..54e91b08 100644
--- a/plugins-root/Makefile.am
+++ b/plugins-root/Makefile.am
@@ -2,12 +2,12 @@
 
 VPATH = $(top_srcdir) $(top_srcdir)/lib $(top_srcdir)/plugins $(top_srcdir)/plugins/t 
 
-INCLUDES = -I.. -I$(top_srcdir)/lib -I$(top_srcdir)/intl -I$(top_srcdir)/plugins
+INCLUDES = -I.. -I$(top_srcdir)/lib -I$(top_srcdir)/intl -I$(top_srcdir)/plugins @SSLINCLUDE@
 
 datadir = @datadir@
 localedir = $(datadir)/locale
 DEFS = -DLOCALEDIR=\"$(localedir)\" @DEFS@
-LIBS = @LIBINTL@ @LIBS@ @SSLINCLUDE@
+LIBS = @LIBINTL@ @LIBS@ @SSLLIBS@
 
 EXTRA_PROGRAMS = check_dhcp check_icmp
 
diff --git a/plugins/Makefile.am b/plugins/Makefile.am
index 6b7de7e3..beefb32f 100644
--- a/plugins/Makefile.am
+++ b/plugins/Makefile.am
@@ -2,12 +2,12 @@
 
 VPATH = $(top_srcdir) $(top_srcdir)/lib $(top_srcdir)/plugins $(top_srcdir)/plugins/t 
 
-INCLUDES = -I.. -I$(top_srcdir)/lib -I$(top_srcdir)/intl @LDAPINCLUDE@ @PGINCLUDE@ 
+INCLUDES = -I.. -I$(top_srcdir)/lib -I$(top_srcdir)/intl @LDAPINCLUDE@ @PGINCLUDE@ @SSLINCLUDE@
 
 datadir = @datadir@
 localedir = $(datadir)/locale
 DEFS = -DLOCALEDIR=\"$(localedir)\" @DEFS@
-LIBS = @LIBINTL@ @LIBS@ @SSLINCLUDE@
+LIBS = @LIBINTL@ @LIBS@ @SSLLIBS@ 
 MATHLIBS = @MATHLIBS@
 
 libexec_PROGRAMS = check_disk check_dummy check_http check_load \
@@ -51,7 +51,7 @@ check_dns_LDADD = $(NETLIBS) popen.o
 check_dummy_LDADD = $(BASEOBJS)
 check_fping_LDADD = $(NETLIBS) popen.o
 check_game_LDADD = $(BASEOBJS) popen.o
-check_http_LDADD = $(NETLIBS) $(SSLLIBS)
+check_http_LDADD = $(NETLIBS)
 check_hpjd_LDADD = $(NETLIBS) popen.o
 check_ldap_LDADD = $(NETLIBS) $(LDAPLIBS)
 check_load_LDADD = $(BASEOBJS) popen.o
@@ -68,10 +68,10 @@ check_procs_LDADD = $(BASEOBJS) popen.o
 check_radius_LDADD = $(NETLIBS) $(RADIUSLIBS)
 check_real_LDADD = $(NETLIBS)
 check_snmp_LDADD = $(BASEOBJS) popen.o
-check_smtp_LDADD = $(NETLIBS) $(SSLLIBS)
+check_smtp_LDADD = $(NETLIBS) 
 check_ssh_LDADD = $(NETLIBS)
 check_swap_LDADD = $(MATHLIBS) $(BASEOBJS) popen.o
-check_tcp_LDADD = $(NETLIBS) $(SSLLIBS)
+check_tcp_LDADD = $(NETLIBS)
 check_time_LDADD = $(NETLIBS)
 check_udp_LDADD = $(NETLIBS)
 check_ups_LDADD = $(NETLIBS)
diff --git a/plugins/check_http.c b/plugins/check_http.c
index 35b2cca3..d47f5ce6 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -65,7 +65,9 @@ SSL_CTX *ctx;
 SSL *ssl;
 X509 *server_cert;
 int connect_SSL (void);
+#  ifdef USE_OPENSSL
 int check_certificate (X509 **);
+#  endif
 #endif
 int no_body = FALSE;
 int maximum_age = -1;
@@ -166,7 +168,7 @@ main (int argc, char **argv)
         (void) alarm (socket_timeout);
         gettimeofday (&tv, NULL);
 
-#ifdef HAVE_SSL
+#ifdef USE_OPENSSL
         if (use_ssl && check_cert == TRUE) {
                 if (connect_SSL () != OK)
                         die (STATE_CRITICAL, _("HTTP CRITICAL - Could not make SSL connection\n"));
@@ -305,7 +307,7 @@ process_arguments (int argc, char **argv)
                                 server_port = HTTPS_PORT;
                         break;
                 case 'C': /* Check SSL cert validity */
-#ifdef HAVE_SSL
+#ifdef USE_OPENSSL
                         if (!is_intnonneg (optarg))
                                 usage2 (_("Invalid certificate expiration period"), optarg);
                         else {
@@ -799,10 +801,11 @@ check_http (void)
                 if (connect_SSL () != OK) {
                         die (STATE_CRITICAL, _("Unable to open TCP socket\n"));
                 }
-
+#ifdef USE_OPENSSL
                 if ((server_cert = SSL_get_peer_certificate (ssl)) != NULL) {
                         X509_free (server_cert);
                 }
+#endif
                 else {
                         printf (_("CRITICAL - Cannot retrieve server certificate.\n"));
                         return STATE_CRITICAL;
@@ -857,7 +860,9 @@ check_http (void)
 #ifdef HAVE_SSL
         if (use_ssl == TRUE) {
                 if (SSL_write (ssl, buf, (int)strlen(buf)) == -1) {
+#  ifdef USE_OPENSSL
                         ERR_print_errors_fp (stderr);
+#  endif
                         return STATE_CRITICAL;
                 }
         }
@@ -1278,11 +1283,15 @@ int connect_SSL (void)
         if (my_tcp_connect (server_address, server_port, &sd) == STATE_OK) {
                 /* Do the SSL handshake */
                 if ((ssl = SSL_new (ctx)) != NULL) {
+#ifdef USE_OPENSSL
                         SSL_set_cipher_list(ssl, "ALL");
+#endif
                         SSL_set_fd (ssl, sd);
                         if (SSL_connect (ssl) != -1)
                                 return OK;
+#ifdef USE_OPENSSL
                         ERR_print_errors_fp (stderr);
+#endif
                 }
                 else {
                         printf (_("CRITICAL - Cannot initiate SSL handshake.\n"));
@@ -1299,7 +1308,7 @@ int connect_SSL (void)
 
 
 
-#ifdef HAVE_SSL
+#ifdef USE_OPENSSL
 int
 check_certificate (X509 ** certificate)
 {
diff --git a/plugins/check_smtp.c b/plugins/check_smtp.c
index 3bb6a32b..19e9aea8 100644
--- a/plugins/check_smtp.c
+++ b/plugins/check_smtp.c
@@ -53,7 +53,9 @@ SSL_CTX *ctx;
 SSL *ssl;
 X509 *server_cert;
 int connect_STARTTLS (void);
+#  ifdef USE_OPENSSL
 int check_certificate (X509 **);
+#  endif
 #endif
 
 enum {
@@ -241,6 +243,7 @@ main (int argc, char **argv)
                   } else {
                         ssl_established = TRUE;
                   }
+#  ifdef USE_OPENSSL
                   if ( check_cert ) {
                     if ((server_cert = SSL_get_peer_certificate (ssl)) != NULL) {
                       result = check_certificate (&server_cert);
@@ -254,6 +257,7 @@ main (int argc, char **argv)
                     my_close();
                     return result;
                   }
+#  endif /* USE_OPENSSL */
                 }
 #endif
                                 
@@ -491,7 +495,7 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'D':
                 /* Check SSL cert validity */
-#ifdef HAVE_SSL
+#ifdef USE_OPENSSL
                         if (!is_intnonneg (optarg))
                                 usage2 ("Invalid certificate expiration period",optarg);
                                 days_till_exp = atoi (optarg);
@@ -645,7 +649,9 @@ connect_STARTTLS (void)
          I look for success instead (1) */
       if (SSL_connect (ssl) == 1)
         return OK;
+#  ifdef USE_OPENSSL
       ERR_print_errors_fp (stderr);
+#  endif
     }
   else
     {
@@ -656,6 +662,7 @@ connect_STARTTLS (void)
   return STATE_CRITICAL;
 }
 
+#  ifdef USE_OPENSSL
 int
 check_certificate (X509 ** certificate)
 {
@@ -728,6 +735,7 @@ check_certificate (X509 ** certificate)
   
   return STATE_OK;  
 }
+#  endif /* USE_OPENSSL */
 #endif
 
 int
diff --git a/plugins/check_tcp.c b/plugins/check_tcp.c
index 157588fd..3ffa4cd6 100644
--- a/plugins/check_tcp.c
+++ b/plugins/check_tcp.c
@@ -28,42 +28,19 @@ const char *email = "nagiosplug-devel@lists.sourceforge.net";
 #include "netutils.h"
 #include "utils.h"
 
-#ifdef HAVE_GNUTLS_OPENSSL_H
-#  include <gnutls/openssl.h>
-#else
-#  ifdef HAVE_SSL_H
-#    include <rsa.h>
-#    include <crypto.h>
-#    include <x509.h>
-#    include <pem.h>
-#    include <ssl.h>
-#    include <err.h>
-#  else
-#    ifdef HAVE_OPENSSL_SSL_H
-#      include <openssl/rsa.h>
-#      include <openssl/crypto.h>
-#      include <openssl/x509.h>
-#      include <openssl/pem.h>
-#      include <openssl/ssl.h>
-#      include <openssl/err.h>
-#    endif
-#  endif
-#endif
-
 #ifdef HAVE_SSL
 static int check_cert = FALSE;
 static int days_till_exp;
 static char *randbuff = "";
-static SSL_CTX *ctx;
-static SSL *ssl;
 static X509 *server_cert;
-static int connect_SSL (void);
 # ifdef USE_OPENSSL
 static int check_certificate (X509 **);
 # endif /* USE_OPENSSL */
-# define my_recv(buf, len) ((flags & FLAG_SSL) ? SSL_read(ssl, buf, len) : read(sd, buf, len))
+# define my_recv(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
+# define my_send(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
 #else
 # define my_recv(buf, len) read(sd, buf, len)
+# define my_send(buf, len) send(sd, buf, len, 0)
 #endif
 
 
@@ -233,11 +210,21 @@ main (int argc, char **argv)
 
         /* try to connect to the host at the given port number */
         gettimeofday (&tv, NULL);
+
+        result = np_net_connect (server_address, server_port, &sd, PROTOCOL);
+        if (result == STATE_CRITICAL) return STATE_CRITICAL;
+
 #ifdef HAVE_SSL
-        if (flags & FLAG_SSL && check_cert == TRUE) {
-                if (connect_SSL () != OK)
+        if (flags & FLAG_SSL){
+                result = np_net_ssl_init(sd);
+                if(result != STATE_OK) return result;
+                /* XXX does np_net_ssl take care of printing an error?
                         die (STATE_CRITICAL,_("CRITICAL - Could not make SSL connection\n"));
+                */
+        }
 #  ifdef USE_OPENSSL /* XXX gnutls does cert checking differently */
+        /*
+        if (flags & FLAG_SSL && check_cert == TRUE) {
                 if ((server_cert = SSL_get_peer_certificate (ssl)) != NULL) {
                         result = check_certificate (&server_cert);
                         X509_free(server_cert);
@@ -246,30 +233,21 @@ main (int argc, char **argv)
                         printf(_("CRITICAL - Cannot retrieve server certificate.\n"));
                         result = STATE_CRITICAL;
                 }
+        }
+        */
 #  endif /* USE_OPENSSL */
+#endif
 
-                SSL_shutdown (ssl);
-                SSL_free (ssl);
-                SSL_CTX_free (ctx);
-                close (sd);
+        if(result != STATE_OK){
+#ifdef HAVE_SSL
+                np_net_ssl_cleanup();
+#endif
+                if(sd) close(sd);
                 return result;
         }
-        else if (flags & FLAG_SSL)
-                result = connect_SSL ();
-        else
-#endif
-                result = np_net_connect (server_address, server_port, &sd, PROTOCOL);
-
-        if (result == STATE_CRITICAL)
-                return STATE_CRITICAL;
 
         if (server_send != NULL) {              /* Something to send? */
-#ifdef HAVE_SSL
-                if (flags & FLAG_SSL)
-                        SSL_write(ssl, server_send, (int)strlen(server_send));
-                else
-#endif
-                        send (sd, server_send, strlen(server_send), 0);
+                my_send(server_send, strlen(server_send));
         }
 
         if (delay > 0) {
@@ -332,21 +310,12 @@ main (int argc, char **argv)
         }
 
         if (server_quit != NULL) {
-#ifdef HAVE_SSL
-                if (flags & FLAG_SSL) {
-                        SSL_write (ssl, server_quit, (int)strlen(server_quit));
-                        SSL_shutdown (ssl);
-                        SSL_free (ssl);
-                        SSL_CTX_free (ctx);
-                }
-                else
-#endif
-                        send (sd, server_quit, strlen (server_quit), 0);
+                my_send(server_quit, strlen(server_quit));
         }
-
-        /* close the connection */
-        if (sd)
-                close (sd);
+#ifdef HAVE_SSL
+        np_net_ssl_cleanup();
+#endif 
+        if (sd) close (sd);
 
         microsec = deltime (tv);
         elapsed_time = (double)microsec / 1.0e6;
@@ -600,61 +569,7 @@ process_arguments (int argc, char **argv)
 
 /* SSL-specific functions */
 #ifdef HAVE_SSL
-static int
-connect_SSL (void)
-{
-  SSL_METHOD *meth;
-
-  /* Initialize SSL context */
-  SSLeay_add_ssl_algorithms ();
-  meth = SSLv23_client_method ();
-  SSL_load_error_strings ();
-  OpenSSL_add_all_algorithms();
-  if ((ctx = SSL_CTX_new (meth)) == NULL)
-    {
-      printf (_("CRITICAL - Cannot create SSL context.\n"));
-      return STATE_CRITICAL;
-    }
-
-  /* Initialize alarm signal handling */
-  signal (SIGALRM, socket_timeout_alarm_handler);
-
-  /* Set socket timeout */
-  alarm (socket_timeout);
-
-  /* Save start time */
-  time (&start_time);
-
-  /* Make TCP connection */
-  if (my_tcp_connect (server_address, server_port, &sd) == STATE_OK && was_refused == FALSE)
-    {
-    /* Do the SSL handshake */
-      if ((ssl = SSL_new (ctx)) != NULL)
-      {
-        SSL_set_fd (ssl, sd);
-        if (SSL_connect(ssl) == 1)
-          return OK;
-        /* ERR_print_errors_fp (stderr); */
-        printf (_("CRITICAL - Cannot make  SSL connection "));
-#ifdef USE_OPENSSL /* XXX */
-        ERR_print_errors_fp (stdout);
-#endif /* USE_OPENSSL */
-        /* printf("\n"); */
-      }
-      else
-      {
-        printf (_("CRITICAL - Cannot initiate SSL handshake.\n"));
-      }
-      SSL_free (ssl);
-    }
-
-  SSL_CTX_free (ctx);
-  close (sd);
-
-  return STATE_CRITICAL;
-}
-
-#ifdef USE_OPENSSL /* XXX */
+#  ifdef USE_OPENSSL /* XXX */
 static int
 check_certificate (X509 ** certificate)
 {
diff --git a/plugins/common.h b/plugins/common.h
index e10586bc..5eac63e4 100644
--- a/plugins/common.h
+++ b/plugins/common.h
@@ -32,6 +32,9 @@
  *
  *****************************************************************************/
 
+#ifndef _COMMON_H_
+#define _COMMON_H_
+
 #include "config.h"
 
 #ifdef HAVE_FEATURES_H
@@ -146,6 +149,29 @@ int snprintf(char *str, size_t size, const  char  *format, ...);
 int vsnprintf(char *str, size_t size, const char  *format, va_list ap);
 #endif
 
+/* SSL implementations */
+#ifdef HAVE_GNUTLS_OPENSSL_H
+#  include <gnutls/openssl.h>
+#else
+#  ifdef HAVE_SSL_H
+#    include <rsa.h>
+#    include <crypto.h>
+#    include <x509.h>
+#    include <pem.h>
+#    include <ssl.h>
+#    include <err.h>
+#  else
+#    ifdef HAVE_OPENSSL_SSL_H
+#      include <openssl/rsa.h>
+#      include <openssl/crypto.h>
+#      include <openssl/x509.h>
+#      include <openssl/pem.h>
+#      include <openssl/ssl.h>
+#      include <openssl/err.h>
+#    endif
+#  endif
+#endif
+
 /*
  *
  * Standard Values
@@ -191,3 +217,5 @@ enum {
 #ifndef __GNUC__
 # define __attribute__(x) /* do nothing */
 #endif
+
+#endif /* _COMMON_H_ */
diff --git a/plugins/netutils.c b/plugins/netutils.c
index 9539a7f0..e3fbb3aa 100644
--- a/plugins/netutils.c
+++ b/plugins/netutils.c
@@ -234,6 +234,54 @@ np_net_connect (const char *host_name, int port, int *sd, int proto)
         }
 }
 
+#ifdef HAVE_SSL
+static SSL_CTX *c=NULL;
+static SSL *s=NULL;
+
+int np_net_ssl_init (int sd){
+                SSL_METHOD *m=NULL;
+                /* Initialize SSL context */
+                SSLeay_add_ssl_algorithms ();
+                m = SSLv23_client_method ();
+                SSL_load_error_strings ();
+                OpenSSL_add_all_algorithms();
+                if ((c = SSL_CTX_new (m)) == NULL) {
+                                printf (_("CRITICAL - Cannot create SSL context.\n"));
+                                return STATE_CRITICAL;
+                }
+                if ((s = SSL_new (c)) != NULL){
+                                SSL_set_fd (s, sd);
+                                if (SSL_connect(s) == 1){
+                                                return OK;
+                                } else {
+                                                printf (_("CRITICAL - Cannot make SSL connection "));
+#ifdef USE_OPENSSL /* XXX look into ERR_error_string */
+                                                ERR_print_errors_fp (stdout);
+#endif /* USE_OPENSSL */
+                                }
+                } else {
+                                printf (_("CRITICAL - Cannot initiate SSL handshake.\n"));
+                }
+                return STATE_CRITICAL;
+}
+
+void np_net_ssl_cleanup (){
+                if(s){
+                                SSL_shutdown (s);
+                                SSL_free (s);
+                                if(c) SSL_CTX_free (c);
+                }
+}
+
+int np_net_ssl_write(const void *buf, int num){
+        return SSL_write(s, buf, num);
+}
+
+int np_net_ssl_read(void *buf, int num){
+        return SSL_read(s, buf, num);
+}
+
+#endif /* HAVE_SSL */
 
 int
 send_request (int sd, int proto, const char *send_buffer, char *recv_buffer, int recv_size)
diff --git a/plugins/netutils.h b/plugins/netutils.h
index 1a52eecc..85b5aa99 100644
--- a/plugins/netutils.h
+++ b/plugins/netutils.h
@@ -32,7 +32,11 @@
 *
 ******************************************************************************/
 
+#ifndef _NETUTILS_H_
+#define _NETUTILS_H_
+
 #include "config.h"
+#include "common.h"
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
@@ -77,3 +81,14 @@ extern unsigned int socket_timeout;
 extern int econn_refuse_state;
 extern int was_refused;
 extern int address_family;
+
+/* SSL-Related functionality */
+#ifdef HAVE_SSL
+/* maybe this could be merged with the above np_net_connect, via some flags */
+int np_net_ssl_init(int sd);
+void np_net_ssl_cleanup();
+int np_net_ssl_write(const void *buf, int num);
+int np_net_ssl_read(void *buf, int num);
+#endif /* HAVE_SSL */
+
+#endif /* _NETUTILS_H_ */