proxy support about check_sslscan

[philfry]

Hi and thanks.

Using a proxy is already supported by using the http_proxy and https_proxy environment. Or do you mean specifying a proxy via switch (like: --proxy=http://foo.domain.example:3128)?

[MAngel666]

yeah that would be cool

[philfry]

Please try the current version (1.2).

[MAngel666]

it works with proxy but there seems to be an other bug. If the checked host could be resolved via dns but it's not reachable for ssllabs then I get an OK status:

/usr/lib64/nagios/plugins/check_sslscan.py --crit C --host myhostname --proxy 192.168.110.100:8080 --warn B --debug

{'host': 'myhostname', 'port': 443, 'protocol': 'http', 'isPublic': False, 'status': 'READY', 'startTime': 1649926244500, 'testTime': 1649926260141, 'engineVersion': '2.1.10', 'criteriaVersion': '2009q', 'cacheExpiryTime': 1649926860141, 'endpoints': [{'ipAddress': '...', 'serverName': 'myhostname', 'statusMessage': 'Unable to connect to the server', 'statusDetails': 'TESTING_PROTO_2_0', 'statusDetailsMessage': 'Testing SSL 2.0', 'progress': -1, 'duration': 15024, 'eta': -1, 'delegation': 1}]}

OK: score(s)

IMHO it should be an UNKNOWN

[philfry]

Qualys doesn't seem to consider an unreachable host to be an error, otherwise status would return ERROR instead of READY. Which is okay if you have multiple ip addresses for a host name and do not want to fail the whole test in case of one ip address not responding. Still, I agree it is advisable to return UNKNOWN if any of the ip addresses fails.
It should be fixed in 1.3.

[MAngel666]

this change works but found something new :) If I start a new check, it ends immediately with "UNKNOWN: 'endpoints'". I need to start it for the second time to get the right rating.

[philfry]

Merde, yes, my bad. Fixed in 1.3.1.