1 /******************************************************************************
6 * Created: Oct 09 2010 19:14:12
7 * Last modified: Oct 09 2010 19:14:12
9 * Author: Ladislav Láska
10 * e-mail: ladislav.laska@gmail.com
12 ******************************************************************************/
14 #define _XOPEN_SOURCE 500
16 #include <gnutls/gnutls.h>
17 #include <gnutls/x509.h>
20 #include <sys/types.h>
21 #include <sys/socket.h>
28 #define S_UNREACHABLE -1
35 int warning_after = 30;
42 #define die(msg) { fprintf(stderr, "Error: " msg "\n" ); exit(3); }
43 #define gnutls_die(code) { gnutls_perror(code); exit(3); }
49 int tcp_open( char *hostname, char *service ) {
50 struct addrinfo hints;
51 struct addrinfo *result, *result_ptr;
55 memset(&hints, 0, sizeof(struct addrinfo));
56 hints.ai_family = AF_UNSPEC;
57 hints.ai_socktype = SOCK_STREAM;
58 err = getaddrinfo(hostname, service, &hints, &result);
60 fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(err));
64 for (result_ptr = result; result_ptr != NULL; result_ptr = result_ptr->ai_next) {
65 sfd = socket(result_ptr->ai_family, result_ptr->ai_socktype,
66 result_ptr->ai_protocol);
67 if (sfd == -1) continue;
69 if (connect(sfd, result_ptr->ai_addr, result_ptr->ai_addrlen) != -1)
72 close(sfd); /* connect(2) failed. */
75 if (result_ptr == NULL) {
76 /* No address succeeded */
85 int check( char * hostname, char *service ) {
89 gnutls_session_t session;
90 gnutls_certificate_credentials_t xcred;
94 err = gnutls_certificate_allocate_credentials( &xcred );
95 if (err < 0) gnutls_die(err);
97 err = gnutls_init( &session, GNUTLS_CLIENT );
98 if (err < 0) gnutls_die(err);
101 err = gnutls_priority_set_direct(session, "EXPORT", NULL);
102 if (err < 0) gnutls_die(err);
104 err = gnutls_credentials_set( session, GNUTLS_CRD_CERTIFICATE, xcred );
105 if (err < 0) gnutls_die(err);
107 /* Connect to server */
109 long fd = tcp_open( hostname, service );
112 state= S_UNREACHABLE;
116 /* Socket opened, establish tls connection */
118 /* Associate socket with session */
119 gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t) fd );
122 err = gnutls_handshake( session );
123 if (err < 0) gnutls_die(err);
125 /* Get server certificate. */
126 const gnutls_datum_t *cert_list;
127 unsigned int cert_list_size = 0;
128 time_t expiration_time, today;
129 gnutls_x509_crt_t cert;
131 if ( gnutls_certificate_type_get( session ) != GNUTLS_CRT_X509 ) {
136 cert_list = gnutls_certificate_get_peers( session, &cert_list_size );
140 for (int i = 0; i < cert_list_size; i++) {
141 gnutls_x509_crt_init( &cert );
142 gnutls_x509_crt_import( cert, &cert_list[0], GNUTLS_X509_FMT_DER );
143 expiration_time = gnutls_x509_crt_get_expiration_time( cert );
144 int expires_in = (expiration_time - today) / 86400;
145 struct tm * t = gmtime( &expiration_time );
146 if ((state == S_OK) && (expires_in <= warning_after)) {
148 sprintf(errmsg, "Warning - Will expire in %i days (%i-%02i-%02i).", expires_in,
149 t->tm_year+1900, t->tm_mon+1, t->tm_mday );
151 if ((state <= S_WARNING) && (expires_in <= error_after)) {
153 sprintf(errmsg, "Critical - Will expire in %i days (%i-%02i-%02i).", expires_in,
154 t->tm_year+1900, t->tm_mon+1, t->tm_mday );
157 sprintf(errmsg, "OK - Will expire in %i days (%i-%02i-%02i).", expires_in,
158 t->tm_year+1900, t->tm_mon+1, t->tm_mday );
163 err = gnutls_bye( session, GNUTLS_SHUT_WR );
164 if (err < 0) gnutls_die(err);
167 gnutls_deinit( session );
168 gnutls_certificate_free_credentials( xcred );
173 void log_func( int level, char *msg ) {
174 fprintf(stderr, "[%2i] %s", level, msg);
178 * This signal handler is wrong, but it's just a failsafe.
180 void sig_handler(int k) {
181 fputs("Timeout.\n", stderr);
185 int main(int argc, char **argv) {
187 char *service = NULL;
191 while ((opt = getopt(argc, argv, "hvw:c:H:p:s:t:")) != -1) {
194 warning_after = atoi(optarg);
197 error_after = atoi(optarg);
200 hostname = strdup(optarg);
203 timeout = atoi( optarg );
204 if (timeout < 0) die("Timeout must be >= 0");
208 if (service != NULL) die("Only one service can be specified.");
209 service = strdup(optarg);
220 if (argc <= 1) die("No address to try.");
222 gnutls_global_set_log_function((gnutls_log_func) log_func);
223 gnutls_global_set_log_level(LOG_LEVEL);
226 /* Initialize gnutls */
228 if ((err = gnutls_global_init())) {
233 sprintf(errmsg, "OK");
239 /* TODO: doesn't work. */
240 signal(SIGALRM, sig_handler);
244 state = check(hostname, service);
246 sprintf(errmsg, "Internal error %i.", state);
250 gnutls_global_deinit();
255 printf("%s\n", errmsg);
256 return (state < 0) ? 127 : state;
261 "Usage: cert-checker [options] -H hostname -p|s port|service\n"
262 " Where options could be: \n"
263 " -h hostname this help\n"
264 " -w n warning level (in days, default 30)\n"
265 " -c n critical level (in days, default 7)\n"
266 " -v verbosity level\n"
267 " -t n timeout (in seconds, n=0 disables timeout\n"