ITL: add check_http args for SSL version forcing

The -S argument of check_http can take a number, which forces the connection to
use a specific SSL version.  This is implemented as multiple options because
check_http does not accept the number following -S if they are separated.

fixes #10358

Signed-off-by: Michael Friedrich <michael.friedrich@netways.de>

diff --git a/doc/7-icinga-template-library.md b/doc/7-icinga-template-library.md
index 710dbb186c89ec1e8a84418895976e063ce190b9..7839b914b10e96a684141bec579a5e2238560864 100644 (file)
--- a/doc/7-icinga-template-library.md
+++ b/doc/7-icinga-template-library.md
@@ -446,6 +446,9 @@ http_vhost               | **Optional.** The virtual host that should be sent in
 http_uri                 | **Optional.** The request URI for GET or POST. Defaults to `/`.
 http_port                | **Optional.** The TCP port. Defaults to 80 when not using SSL, 443 otherwise.
 http_ssl                 | **Optional.** Whether to use SSL. Defaults to false.
+http_ssl_force_tlsv1     | **Optional.** Whether to force TLSv1.
+http_ssl_force_sslv2     | **Optional.** Whether to force SSLv2.
+http_ssl_force_sslv3     | **Optional.** Whether to force SSLv3.
 http_sni                 | **Optional.** Whether to use SNI. Defaults to false.
 http_auth_pair           | **Optional.** Add 'username:password' authorization pair.
 http_proxy_auth_pair     | **Optional.** Add 'username:password' authorization pair for proxy.

diff --git a/itl/command-plugins.conf b/itl/command-plugins.conf
index 610cd83f9389725f7adff22e302d998a3ccf04df..61b78eb8bf22480eb7a023679b789ffd3ef0c3d7 100644 (file)
--- a/itl/command-plugins.conf
+++ b/itl/command-plugins.conf
@@ -331,6 +331,15 @@ object CheckCommand "http" {
                "-S" = {
                        set_if = "$http_ssl$"
                }
+               "-S1" = {
+                       set_if = "$http_ssl_force_tlsv1$"
+               }
+               "-S2" = {
+                       set_if = "$http_ssl_force_sslv2$"
+               }
+               "-S3" = {
+                       set_if = "$http_ssl_force_sslv3$"
+               }
                "--sni" = {
                        set_if = "$http_sni$"
                }