Merge lp:~pirabarlen-cheenaramen/ubuntu/wily/nagios-plugins/crypto-fix into lp:ubuntu/wily/nagios-plugins

[Pirabarlen Cheenaramen ( Selven )]

Backported from latest. Use SSLv3 only if the system was compiled with SSLv3 support

[lp:~pirabarlen-cheenaramen/ubuntu/wily/nagios-plugins/crypto-fix]

58. By Pirabarlen Cheenaramen ( Selven ) on 2016-04-25

Backported from latest, use SSLv3 only if the system was compiled with SSLv3

[Marc Deslauriers (mdeslaur)]

Thanks for the merge request, but I don't see why this is still necessary.

nagios-plugins in no longer in Ubuntu 16.04 LTS and later.

This merge proposal was made against Wily, but in Wily, SSLv3 is not autonegotiated in OpenSSL. The only way SSLv3 would be used is if someone specifically used check_http with -S 3 to force it. As such, I don't think it's even worth doing an SRU for this.

Thanks!

review: Disapprove

Unmerged revisions

58. By Pirabarlen Cheenaramen ( Selven ) on 2016-04-25

Backported from latest, use SSLv3 only if the system was compiled with SSLv3

57. By Pirabarlen Cheenaramen ( Selven ) on 2016-04-21

Backported from latest, use SSLv3 only if specified, SSLv3 has known weaknesses

56. By Pirabarlen Cheenaramen ( Selven ) on 2016-04-20

Backported from Latest. Disable SSLv3 if OpenSSL hasn't been compiled with SSLv3 support

=== modified file 'debian/changelog'
--- debian/changelog	2014-03-05 13:49:01 +0000
+++ debian/changelog	2016-04-25 18:57:51 +0000
@@ -1,3 +1,9 @@
+nagios-plugins (1.5-3ubuntu2) UNRELEASED; urgency=medium
+
+  * Backported from latest, use SSLv3 only if the system was compiled with SSLv3
+
+ -- Pirabarlen Cheenaramen <[e-mail]>  Thu, 21 Apr 2016 14:20:00 +0400
+
 nagios-plugins (1.5-3ubuntu1) trusty; urgency=low
 
   * Merge from Debian unstable (LP: #1276032).  Remaining changes:

=== modified file 'plugins/sslutils.c'
--- plugins/sslutils.c	2013-09-11 13:02:31 +0000
+++ plugins/sslutils.c	2016-04-25 18:57:51 +0000
@@ -66,7 +66,12 @@
 #endif
 		break;
 	case 3: /* SSLv3 protocol */
+#if defined(OPENSSL_NO_SSL3)
+		printf(("%s\n", _("CRITICAL - SSL protocol version 3 is not supported by your SSL library.")));
+		return STATE_CRITICAL;
+#else
 		method = SSLv3_client_method();
+#endif
 		break;
 	default: /* Unsupported */
 		printf("%s\n", _("CRITICAL - Unsupported SSL protocol version."));