tls-check

   1 #!/usr/bin/python
   2
   3 from __future__ import print_function
   4 from optparse import OptionParser
   5 from ssl import SSLContext, PROTOCOL_TLSv1_2, CERT_REQUIRED, cert_time_to_seconds, SSLError, CertificateError
   6 from socket import socket, AF_INET6, create_connection
   7 from datetime import datetime, timedelta
   8 from smtplib import SMTP
   9 import yaml
  10
  11 VERBOSE=False
  12
  13 class Verifier:
  14     def __init__(self, cafile, warn, crit):
  15         self.cafile = cafile
  16         self.crit = crit
  17         self.warn = warn
  18
  19     def check(self, proto, host, port, name):
  20         context = SSLContext(PROTOCOL_TLSv1_2)
  21         context.verify_mode = CERT_REQUIRED
  22         context.load_verify_locations(self.cafile)
  23         if hasattr(self, 'remote_check_%s' % proto):
  24             getattr(self, 'remote_check_%s' % proto)(context, host, port, name)
  25
  26     def remote_check_xmpp(self, context, host, port, name):
  27         xmpp_open = ("<stream:stream xmlns='jabber:client' xmlns:stream='"
  28                      "http://etherx.jabber.org/streams' xmlns:tls='http://www.ietf.org/rfc/"
  29                      "rfc2595.txt' to='{0}' xml:lang='en' version='1.0'>" )
  30         xmpp_starttls = "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"
  31
  32         connection = create_connection((host, port))
  33         connection.sendall(xmpp_open.format(name).encode('utf-8'))
  34         response = connection.recv(4096).decode('utf-8')
  35
  36         if not '</stream:features>' in response:
  37             response = response + connection.recv(4096).decode('utf-8')
  38
  39         connection.sendall(xmpp_starttls.encode('utf-8'))
  40         response = response + "\n\n" + connection.recv(4096).decode('utf-8')
  41
  42         connection = context.wrap_socket(connection, server_hostname=name)
  43         connection.do_handshake()
  44
  45         cert = connection.getpeercert()
  46         return self.check_cert(cert, host, port, name)
  47
  48     def remote_check_smtp(self, context, host, port, name):
  49         smtp = SMTP(host, port)
  50         try:
  51             smtp.starttls(context=context)
  52         except SSLError:
  53             print("CRIT (invalid certificate) %s:%d" % (host, port))
  54             return 2
  55
  56         cert = smtp.sock.getpeercert()
  57         return self.check_cert(cert, host, port, name)
  58
  59     def remote_check_ssl(self, context, host, port, name):
  60         connection = context.wrap_socket(socket(AF_INET6),
  61                                      server_hostname=name)
  62         try:
  63             connection.connect((host, port))
  64         except SSLError:
  65             print("CRIT (invalid certificate) %s:%d" % (host, port))
  66             return 2
  67
  68         cert = connection.getpeercert()
  69         return self.check_cert(cert, host, port, name)
  70
  71     def check_cert(self, data, host, port, name):
  72         expiretimestamp = cert_time_to_seconds(data['notAfter'])
  73         delta = datetime.utcfromtimestamp(expiretimestamp) - datetime.utcnow()
  74
  75         if delta < self.crit:
  76             print("CRIT (expires in %s) %s:%d" % (delta, name, port))
  77             return 2
  78         elif delta < self.warn:
  79             print("WARN (expires in %s) %s:%d" % (delta, name, port))
  80             return 1
  81
  82 def main():
  83     global VERBOSE
  84     parser = OptionParser()
  85     parser.add_option("--config", action="store", type="string", dest="config",
  86                       help="configuration file to use")
  87     parser.add_option("-n", "--name",
  88                       action="append", type="string", dest="names",
  89                       help="hostname:port to check for expired certificates")
  90     parser.add_option("-w", "--warning-days",
  91                       action="store", type=int, dest="warn",
  92                       help="minimum remaining validity in days before a warning is issued")
  93     parser.add_option("-c", "--critical-days",
  94                       action="store", type=int, dest="crit",
  95                       help="minimum remaining validity in days before a warning is issued")
  96     parser.add_option("-v", action="store_true", dest="verbose", default=False)
  97     parser.add_option("-q", action="store_false", dest="verbose")
  98     parser.add_option("--ca", action="store", type="string", dest="ca",
  99                       help="ca certificate bundle")
 100
 101
 102     opts, _args = parser.parse_args()
 103
 104     if opts.config:
 105         configuration = yaml.load(open(opts.config))
 106     else:
 107         configuration = dict()
 108
 109     if opts.names:
 110         configuration['names'] = opts.names
 111     if opts.warn:
 112         configuration['warn_days'] = opts.warn
 113     if opts.crit:
 114         configuration['crit_days'] = opts.crit
 115     if opts.ca:
 116         configuration['cacertificates'] = opts.ca
 117     if opts.verbose:
 118         configuration['verbose'] = opts.verbose
 119
 120     if 'verbose' in configuration:
 121         VERBOSE = configuration['verbose']
 122
 123     if not 'names' in configuration:
 124         parser.error("needs at least one host")
 125
 126     verifier = Verifier(configuration['cacertificates'] if 'cacertificates' in configuration else '/etc/ssl/certs/ca-certificates.crt',
 127                         timedelta(configuration['warn_days'] if 'warn_days' in configuration else 15),
 128                         timedelta(configuration['crit_days'] if 'crit_days' in configuration else 5))
 129
 130     try:
 131         hosts = [ (i[0], i[1], int(i[2]), i[3] if len(i) == 4 else i[1]) for i in [ j.split(':', 3) for j in configuration['names'] ] ]
 132     except (ValueError, IndexError):
 133         parser.error("names need to be in PROTO:DNSNAME:PORT format")
 134
 135     for proto, host, port, name in hosts:
 136         verifier.check(proto, host, port, name)
 137
 138 if __name__ == "__main__":
 139     main()