Fabre

#689960 nagios-plugins-basic: Please add support for loading openssl configuration (for engines support, etc) #689960

Package:: nagios-plugins-basic

Source:: monitoring-plugins

Submitter:: Max Kosmach

Date:: 2023-04-26 09:21:07 UTC

Severity:: wishlist

Tags:

#689960#5

Date:: 2012-10-08 12:15:16 UTC

From:

To:

Current check_http and other ssl-enabled check doesn't support loading of openssl configuration.

Please add pacth below to enable loading default configuration.
Patches based on CryptoCom patches of other ssl-enabled software (http://cryptocom.ru/opensource/index.html)

Patch:

diff -urN nagios-plugins-1.4.16.current/plugins/sslutils.c nagios-plugins-1.4.16/plugins/sslutils.c
--- nagios-plugins-1.4.16.current/plugins/sslutils.c    2012-06-27 21:32:47.000000000 +0400
+++ nagios-plugins-1.4.16/plugins/sslutils.c    2012-10-08 16:04:01.000000000 +0400
@@ -71,6 +71,9 @@
        }
        if (!initialized) {
                /* Initialize SSL context */
+#if OPENSSL_VERSION_NUMBER >= 0x00907000
+               OPENSSL_config(NULL);
+#endif
                SSLeay_add_ssl_algorithms();
                SSL_load_error_strings();
                OpenSSL_add_all_algorithms();
diff -urN nagios-plugins-1.4.16.current/plugins/common.h nagios-plugins-1.4.16/plugins/common.h
--- nagios-plugins-1.4.16.current/plugins/common.h      2012-06-27 21:32:47.000000000 +0400
+++ nagios-plugins-1.4.16/plugins/common.h      2012-10-08 16:03:16.000000000 +0400
@@ -156,6 +156,9 @@
 #      include <openssl/pem.h>
 #      include <openssl/ssl.h>
 #      include <openssl/err.h>
+#if OPENSSL_VERSION_NUMBER >= 0x00907000
+#include <openssl/conf.h>
+#endif
 #    endif
 #  endif
 #endif

#689960#12

Date:: 2012-10-09 08:42:12 UTC

From:

To:

tags 689960 + fixed-upstream
thanks

Hi Max,

thanks for your bugreport.

this is fixed upstream with
https://github.com/nagios-plugins/nagios-plugins/commit/b74543a and
should be fixed at least with next upstream release. Unfortunately
this will not get fixed within wheezy.

Cheers, Jan.

#689960#17

Date:: 2012-10-09 10:11:38 UTC

From:

To:

Hi, Jan

I think that this patch is not enough.

If I try to apply only this patch to 1.4.16 - check_http doesn't load
oenssl.cnf -

With upstream patch b74543a applied to 1.4.16

strace -ff -eopen ./check_http  -H www.cryptopro.ru -P 4444 -C30,14
     open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/i686/cmov/libnsl.so.1", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libresolv.so.2", O_RDONLY) = 3
open("/usr/lib/i386-linux-gnu/i686/cmov/libssl.so.1.0.0", O_RDONLY) = 3
open("/usr/lib/i386-linux-gnu/i686/cmov/libcrypto.so.1.0.0", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libpthread.so.0", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libdl.so.2", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libc.so.6", O_RDONLY) = 3
open("/lib/i386-linux-gnu/libz.so.1", O_RDONLY) = 3
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/host.conf", O_RDONLY)        = 3
open("/etc/resolv.conf", O_RDONLY)      = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/i686/cmov/libnss_files.so.2", O_RDONLY) = 3
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/i686/cmov/libnss_dns.so.2", O_RDONLY) = 3
open("/etc/resolv.conf", O_RDONLY)      = 3
open("/usr/share/locale/locale.alias", O_RDONLY) = 4
open("/usr/share/locale/ru_RU/LC_MESSAGES/libc.mo", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/usr/share/locale/ru/LC_MESSAGES/libc.mo", O_RDONLY) = 4
open("/usr/lib/i386-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 4
open("/usr/lib/ssl/openssl.cnf", O_RDONLY|O_LARGEFILE) = 4
open("/usr/lib/i386-linux-gnu/openssl-1.0.0/engines/libgost.so",
O_RDONLY) = 4
open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 4
open("/usr/share/locale/ru_RU/LC_MESSAGES/nagios-plugins.mo", O_RDONLY)
= -1 ENOENT (No such file or directory)
open("/usr/share/locale/ru/LC_MESSAGES/nagios-plugins.mo", O_RDONLY) =
-1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/nagios-plugins.mo", O_RDONLY)
= -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/nagios-plugins.mo", O_RDONLY) =
-1 ENOENT (No such file or directory)
CRITICAL - Cannot make SSL connection.
3073676936:error:140820A5:SSL
routines:SSL3_CHECK_CERT_AND_ALGORITHM:missing dsa signing
cert:s3_clnt.c:3227:



But with my patch -

strace -ff -eopen /usr/local/bin/check_http  -H www.cryptopro.ru -P 4444
-C30,14
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/i686/cmov/libnsl.so.1", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libresolv.so.2", O_RDONLY) = 3
open("/usr/lib/i386-linux-gnu/i686/cmov/libssl.so.1.0.0", O_RDONLY) = 3
open("/usr/lib/i386-linux-gnu/i686/cmov/libcrypto.so.1.0.0", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libpthread.so.0", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libdl.so.2", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/libc.so.6", O_RDONLY) = 3
open("/lib/i386-linux-gnu/libz.so.1", O_RDONLY) = 3
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/host.conf", O_RDONLY)        = 3
open("/etc/resolv.conf", O_RDONLY)      = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/i686/cmov/libnss_files.so.2", O_RDONLY) = 3
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/i686/cmov/libnss_dns.so.2", O_RDONLY) = 3
open("/etc/resolv.conf", O_RDONLY)      = 3

open("/usr/lib/ssl/openssl.cnf", O_RDONLY|O_LARGEFILE) = 4

open("/usr/lib/i386-linux-gnu/openssl-1.0.0/engines/libgost.so",
O_RDONLY) = 4
open("/usr/share/locale/locale.alias", O_RDONLY) = 4
open("/usr/share/locale/ru_RU/LC_MESSAGES/libc.mo", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/usr/share/locale/ru/LC_MESSAGES/libc.mo", O_RDONLY) = 4
open("/usr/lib/i386-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 4
open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 4
open("/etc/localtime", O_RDONLY)        = 4
open("/usr/share/locale/ru_RU/LC_MESSAGES/nagios-plugins.mo", O_RDONLY)
= -1 ENOENT (No such file or directory)
open("/usr/share/locale/ru/LC_MESSAGES/nagios-plugins.mo", O_RDONLY) =
-1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/nagios-plugins.mo", O_RDONLY)
= -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/nagios-plugins.mo", O_RDONLY) =
-1 ENOENT (No such file or directory)
OK - Certificate 'Веб-сервер ООО "КРИПТО-ПРО"' will expire on 02/15/2013
15:43.





09.10.2012 12:42, Jan Wagner пишет:

#689960#22

Date:: 2012-10-09 10:53:01 UTC

From:

To:

Hi Max,

I'll keeping Holger in the loop.

did you notice, that in both cases "/usr/lib/ssl/openssl.cnf" is loaded?
Could you please provide your openssl.cnf for having a closer look
into the issue?

Thanks, Jan.

#689960#27

Date:: 2012-10-09 11:06:21 UTC

From:

To:

09.10.2012 14:53, Jan Wagner пишет:

Hm, yes, my fault, opebssl.cnf is loaded in both cases.
But version with upstream patch doesn't work with algorithms, loaded
from gost engine.

my openssl.cnf attached
demo site with gost SSL - https://www.cryptopro.ru:4444

#689960 nagios-plugins-basic: Please add support for loading openssl configuration (for engines support, etc) #689960

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)