Improve error responses

- Try to make SSL & non-SSL responses more consistent
- Fix various error messages
- Fix printing sizeof buffer len variable, instead of actual buffer length
- ensure we log cert details if asked

src/check_nrpe.c

@@ -927,7 +927,7 @@ int connect_to_remote(void)
 		if (ssl_err == 5) {
 			/* Often, errno will be zero, so print a generic message here */
 			if (ern == 0)
-				printf("CHECK_NRPE: Error - Could not connect to %s. Check system logs on %s\n", rem_host, rem_host);
+				printf("CHECK_NRPE: Error - Could not connect to %s: Check system logs on %s\n", rem_host, rem_host);
 			else
 				printf("CHECK_NRPE: Error - Could not connect to %s: %s\n", rem_host, strerror(ern));
 		} else {
@@ -944,7 +944,8 @@ int connect_to_remote(void)
 		 */
 		ERR_print_errors_fp(stdout);
 # endif
-		result = timeout_return_code;
+		/* fb4bdfa says we should be returning UNKOWN to match the non-SSL case*/
+		result = STATE_UNKNOWN;
 
 	} else {
 
@@ -1093,7 +1094,7 @@ int read_response(void)
 	u_int32_t packet_crc32;
 	u_int32_t calculated_crc32;
 	int32_t pkt_size, buffer_size;
-	int rc, result;
+	int rc, result, ern;
 
 	alarm(0);
 	set_sig_handlers();
@@ -1103,6 +1104,7 @@ int read_response(void)
 #else
 	rc = read_packet(sd, NULL, &v2_receive_packet, &v3_receive_packet);
 #endif
+	ern = errno;
 
 	alarm(0);
 
@@ -1127,6 +1129,11 @@ int read_response(void)
 		if (packet_ver >= NRPE_PACKET_VERSION_3) {
 			return -1;
 		}
+		if (ern == 0)
+			printf("CHECK_NRPE: Error - Could not connect to %s: Check system logs on %s\n", rem_host, rem_host);
+		else
+			printf("CHECK_NRPE: Error - Could not connect to %s: %s\n", rem_host, strerror(ern));
+
 		return STATE_UNKNOWN;
 
 	} else if (rc == 0) {
@@ -1244,9 +1251,9 @@ int read_packet(int sock, void *ssl_ptr, v2_packet ** v2_pkt, v3_packet ** v3_pk
 		rc = recvall(sock, (char *)&packet, &tot_bytes, socket_timeout);
 
 		if (rc <= 0 || rc != bytes_to_recv) {
-			if (rc >= 0 && rc < bytes_to_recv) {
+			if (rc > 0 && rc < bytes_to_recv) {
 				if (packet_ver <= NRPE_PACKET_VERSION_3)
-					printf("CHECK_NRPE: Receive header underflow - only %d bytes received (%zu expected).\n", rc, sizeof(bytes_to_recv));
+					printf("CHECK_NRPE: Receive header underflow - only %d bytes received (%ld expected).\n", rc, (long)bytes_to_recv);
 			}
 			return -1;
 		}
@@ -1322,7 +1329,7 @@ int read_packet(int sock, void *ssl_ptr, v2_packet ** v2_pkt, v3_packet ** v3_pk
 				*v2_pkt = NULL;
 			}
 			if (rc < buffer_size)
-				printf("CHECK_NRPE: Receive underflow - only %d bytes received (%zu expected).\n", rc, sizeof(buffer_size));
+				printf("CHECK_NRPE: Receive underflow - only %d bytes received (%ld expected).\n", rc, (long)buffer_size);
 			return -1;
 		} else
 			tot_bytes += rc;
@@ -1336,9 +1343,9 @@ int read_packet(int sock, void *ssl_ptr, v2_packet ** v2_pkt, v3_packet ** v3_pk
 		}
 
 		if (rc <= 0 || rc != bytes_to_recv) {
-			if (rc < bytes_to_recv) {
+			if (rc > 0 && rc < bytes_to_recv) {
 				if (packet_ver < NRPE_PACKET_VERSION_3 || packet_ver > NRPE_PACKET_VERSION_4)
-					printf("CHECK_NRPE: Receive header underflow - only %d bytes received (%zu expected).\n", rc, sizeof(bytes_to_recv));
+					printf("CHECK_NRPE: Receive header underflow - only %d bytes received (%ld expected).\n", rc, (long)bytes_to_recv);
 			}
 			return -1;
 		}
@@ -1430,9 +1437,9 @@ int read_packet(int sock, void *ssl_ptr, v2_packet ** v2_pkt, v3_packet ** v3_pk
 			}
 			if (bytes_read != buffer_size) {
 				if (packet_ver >= NRPE_PACKET_VERSION_3) {
-					printf("CHECK_NRPE: Receive buffer size - %ld bytes received (%zu expected).\n", (long)bytes_read, sizeof(buffer_size));
+					printf("CHECK_NRPE: Receive buffer size - %ld bytes received (%ld expected).\n", (long)bytes_read, (long)buffer_size);
 				} else {
-					printf("CHECK_NRPE: Receive underflow - only %ld bytes received (%zu expected).\n", (long)bytes_read, sizeof(buffer_size));
+					printf("CHECK_NRPE: Receive underflow - only %ld bytes received (%ld expected).\n", (long)bytes_read, (long)buffer_size);
 				}
 			}
 			return -1;

src/nrpe-ssl.c

@@ -266,7 +266,7 @@ int ssl_verify_callback_common(int preverify_ok, X509_STORE_CTX * ctx, int is_in
 	X509 *err_cert;
 	int err;
 
-	if (preverify_ok || ((sslprm.log_opts & SSL_LogCertDetails) == 0))
+	if (preverify_ok && ((sslprm.log_opts & SSL_LogCertDetails) == 0))
 		return preverify_ok;
 
 	if (is_invalid || sslprm.log_opts & SSL_LogCertDetails) {