Add parameter (-S) for custom SSL/TLS protocol version

check_esxi_hardware.py

@@ -15,16 +15,14 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-# 02110-1301, USA.
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # Pre-req : pywbem
 #
 # Copyright (c) 2008 David Ligeret
 # Copyright (c) 2009 Joshua Daniel Franklin
 # Copyright (c) 2010 Branden Schneider
-# Copyright (c) 2010-2019 Claudio Kuenzler
+# Copyright (c) 2010-2020 Claudio Kuenzler
 # Copyright (c) 2010 Samir Ibradzic
 # Copyright (c) 2010 Aaron Rogers
 # Copyright (c) 2011 Ludovic Hutin
@@ -39,13 +37,14 @@
 # Copyright (c) 2015 Stanislav German-Evtushenko
 # Copyright (c) 2015 Stefan Roos
 # Copyright (c) 2018 Peter Newman
+# Copyright (c) 2020 Luca Berra
 #
 # The VMware 4.1 CIM API is documented here:
 #   http://www.vmware.com/support/developer/cim-sdk/4.1/smash/cim_smash_410_prog.pdf
 #   http://www.vmware.com/support/developer/cim-sdk/smash/u2/ga/apirefdoc/
 #
-# The VMware 5.x CIM API is documented here:
-#   http://pubs.vmware.com/vsphere-50/index.jsp?nav=/5_1_1
+# The VMware 5.5 and above CIM API is documented here:
+#   https://code.vmware.com/apis/207/cim
 #
 # This monitoring plugin is maintained and documented here:
 #   https://www.claudiokuenzler.com/monitoring-plugins/check_esxi_hardware.php
@@ -267,6 +266,15 @@
 #@ Date   : 20190701
 #@ Author : Phil Randal (phil.randal@gmail.com)
 #@ Reason : Fix lookup of warranty info for Dell (again)
+#@---------------------------------------------------
+#@ Date   : 20200605
+#@ Author : Luca Berra
+#@ Reason : Add option to ignore chassis intrusion (Supermicro)
+#@---------------------------------------------------
+#@ Date   : 20200605
+#@ Author : Claudio Kuenzler
+#@ Reason : Add parameter (-S) for custom SSL/TLS protocol version
+#@---------------------------------------------------
 
 from __future__ import print_function
 import sys
@@ -276,7 +284,7 @@ import re
 import pkg_resources
 from optparse import OptionParser,OptionGroup
 
-version = '20190701'
+version = '20200605'
 
 NS = 'root/cimv2'
 hosturl = ''
@@ -376,6 +384,7 @@ get_current = True
 get_temp    = True
 get_fan     = True
 get_lcd     = True
+get_intrusion = True
 
 # define exit codes
 ExitOK = 0
@@ -500,22 +509,23 @@ def verboseoutput(message) :
 # ----------------------------------------------------------------------
 
 def getopts() :
-  global hosturl,cimport,user,password,vendor,verbose,perfdata,urlise_country,timeout,ignore_list,regex,get_power,get_volts,get_current,get_temp,get_fan,get_lcd
-  usage = "usage: %prog -H hostname -U username -P password [-C port -V vendor -v -p -I XX -i list,list -r]\n" \
+  global hosturl,hostname,cimport,sslproto,user,password,vendor,verbose,perfdata,urlise_country,timeout,ignore_list,regex,get_power,get_volts,get_current,get_temp,get_fan,get_lcd,get_intrusion
+  usage = "usage: %prog -H hostname -U username -P password [-C port -S proto -V vendor -v -p -I XX -i list,list -r]\n" \
     "example: %prog -H hostname -U root -P password -C 5989 -V auto -I uk\n\n" \
     "or, verbosely:\n\n" \
-    "usage: %prog --host=hostname --user=username --pass=password [--cimport=port --vendor=system --verbose --perfdata --html=XX]\n"
+    "usage: %prog --host=hostname --user=username --pass=password [--cimport=port --sslproto=version --vendor=system --verbose --perfdata --html=XX]\n"
 
   parser = OptionParser(usage=usage, version="%prog "+version)
   group1 = OptionGroup(parser, 'Mandatory parameters')
   group2 = OptionGroup(parser, 'Optional parameters')
 
-  group1.add_option("-H", "--host", dest="host", help="report on HOST", metavar="HOST")
+  group1.add_option("-H", "--host", dest="host", help="connect to HOST", metavar="HOST")
   group1.add_option("-U", "--user", dest="user", help="user to connect as", metavar="USER")
   group1.add_option("-P", "--pass", dest="password", \
       help="password, if password matches file:<path>, first line of given file will be used as password", metavar="PASS")
 
   group2.add_option("-C", "--cimport", dest="cimport", help="CIM port (default 5989)", metavar="CIMPORT")
+  group2.add_option("-S", "--sslproto", dest="sslproto", help="SSL/TLS protocol version to overwrite system default: SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3", metavar="SSLPROTO")
   group2.add_option("-V", "--vendor", dest="vendor", help="Vendor code: auto, dell, hp, ibm, intel, or unknown (default)", \
       metavar="VENDOR", type='choice', choices=['auto','dell','hp','ibm','intel','unknown'],default="unknown")
   group2.add_option("-v", "--verbose", action="store_true", dest="verbose", default=False, \
@@ -542,6 +552,8 @@ def getopts() :
       help="don't collect fan performance data")
   group2.add_option("--no-lcd", action="store_false", dest="get_lcd", default=True, \
       help="don't collect lcd/front display status")
+  group2.add_option("--no-intrusion", action="store_false", dest="get_intrusion", default=True, \
+      help="don't collect chassis intrusion status")
 
   parser.add_option_group(group1)
   parser.add_option_group(group2)
@@ -588,6 +600,7 @@ def getopts() :
     user=options.user
     password=options.password
     cimport=options.cimport
+    sslproto=options.sslproto
     vendor=options.vendor.lower()
     verbose=options.verbose
     perfdata=options.perfdata
@@ -601,6 +614,7 @@ def getopts() :
     get_temp=options.get_temp
     get_fan=options.get_fan
     get_lcd=options.get_lcd
+    get_intrusion=options.get_intrusion
 
   # if user or password starts with 'file:', use the first string in file as user, second as password
   if (re.match('^file:', user) or re.match('^file:', password)):
@@ -632,10 +646,30 @@ if os_platform != "win32":
     print('UNKNOWN: Execution time too long!')
     sys.exit(ExitUnknown)
 
+# Use non-default CIM port
 if cimport:
   verboseoutput("Using manually defined CIM port "+cimport)
   hosturl += ':'+cimport 
 
+# Use non-default SSL protocol version
+if sslproto:
+  verboseoutput("Using non-default SSL protocol: "+sslproto)
+  allowed_protos = ["SSLv2", "SSLv3", "TLSv1.0", "TLSv1.1", "TLSv1.2", "TLSv1.3"]
+  if any(proto.lower() == sslproto.lower() for proto in allowed_protos):
+    import os
+    sslconfpath = '/tmp/'+hostname+'_openssl.conf'
+    verboseoutput("Creating OpenSSL config file: "+sslconfpath)
+    try:
+      with open(sslconfpath, 'w') as config_file:
+          config_file.write("openssl_conf = openssl_init\n[openssl_init]\nssl_conf = ssl_configuration\n[ssl_configuration]\nsystem_default = tls_system_default\n[tls_system_default]\nMinProtocol = "+sslproto+"\n")
+    except Exception as e:
+      print('CRITICAL: An error occured while trying to write ssl config file: %s (%s)' % (sslconfpath, e))
+      sys.exit(ExitCritical)
+    os.environ["OPENSSL_CONF"] = sslconfpath
+  else:
+    print('CRITICAL: Invalid SSL protocol version given!')
+    sys.exit(ExitCritical)
+
 # Append lcd related elements to ignore list if --no-lcd was used
 verboseoutput("LCD Status: %s" % get_lcd)
 if not get_lcd:
@@ -644,6 +678,18 @@ if not get_lcd:
   ignore_list.append("Front Panel Board 1 FP LCD Cable 0: Connected")
   ignore_list.append("Front Panel Board 1 FP LCD Cable 0: Config Error")
 
+# Append chassis intrusion related elements to ignore list if --no-intrusion was used
+verboseoutput("Chassis Intrusion Status: %s" % get_intrusion)
+if not get_intrusion:
+  ignore_list.append("System Chassis 1 Chassis Intru: General Chassis intrusion")
+  ignore_list.append("System Chassis 1 Chassis Intru: Drive Bay intrusion")
+  ignore_list.append("System Chassis 1 Chassis Intru: I/O Card area intrusion")
+  ignore_list.append("System Chassis 1 Chassis Intru: Processor area intrusion")
+  ignore_list.append("System Chassis 1 Chassis Intru: System unplugged from LAN")
+  ignore_list.append("System Chassis 1 Chassis Intru: Unauthorized dock")
+  ignore_list.append("System Chassis 1 Chassis Intru: FAN area intrusion")
+  ignore_list.append("System Chassis 1 Chassis Intru: Unknown")
+
 # connection to host
 verboseoutput("Connection to "+hosturl)
 # pywbem 0.7.0 handling is special, some patched 0.7.0 installations work differently
@@ -696,6 +742,10 @@ if vendor=='auto':
       sys.exit (ExitUnknown)
     else:
       verboseoutput("Unknown CIM Error: %s" % args)
+  except pywbem._exceptions.ConnectionError as args:
+    GlobalStatus = ExitUnknown
+    print("UNKNOWN: {}".format(args))
+    sys.exit (GlobalStatus)
   except pywbem.cim_http.AuthError as arg:
     verboseoutput("Global exit set to UNKNOWN")
     GlobalStatus = ExitUnknown
@@ -727,6 +777,10 @@ for classe in ClassesToCheck :
       sys.exit (ExitUnknown)
     else:
       verboseoutput("Unknown CIM Error: %s" % args)
+  except pywbem._exceptions.ConnectionError as args:
+    GlobalStatus = ExitUnknown
+    print("UNKNOWN: {}".format(args))
+    sys.exit (GlobalStatus)
   except pywbem.cim_http.AuthError as arg:
     verboseoutput("Global exit set to UNKNOWN")
     GlobalStatus = ExitUnknown