git.lirion.de

Of git, get, and gud

summaryrefslogtreecommitdiffstats
path: root/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration
diff options
context:
space:
mode:
Diffstat (limited to 'nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration')
-rw-r--r--nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/Makefile1
-rw-r--r--nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/check_zone_rrsig_expiration313
-rw-r--r--nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/control7
-rw-r--r--nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/copyright27
-rw-r--r--nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/zone-rrsig.cfg4
5 files changed, 352 insertions, 0 deletions
diff --git a/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/Makefile b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/Makefile
new file mode 100644
index 0000000..23f8a8f
--- /dev/null
+++ b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/Makefile
@@ -0,0 +1 @@
+include ../common.mk
diff --git a/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/check_zone_rrsig_expiration b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/check_zone_rrsig_expiration
new file mode 100644
index 0000000..bed0455
--- /dev/null
+++ b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/check_zone_rrsig_expiration
@@ -0,0 +1,313 @@
+#!/usr/bin/perl
+
+# $Id: check_zone_rrsig_expiration,v 1.14 2015/10/12 16:54:20 wessels Exp $
+#
+# check_zone_rrsig_expiration
+#
+# nagios plugin to check expiration times of RRSIG records. Reminds
+# you if its time to re-sign your zone.
+
+# Copyright (c) 2008, The Measurement Factory, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution.
+# Neither the name of The Measurement Factory nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+# usage
+#
+# define command {
+# command_name check-zone-rrsig
+# command_line /usr/local/libexec/nagios-local/check_zone_rrsig -Z $HOSTADDRESS$
+# }
+#
+# define service {
+# name dns-rrsig-service
+# check_command check-zone-rrsig
+# ...
+# }
+#
+# define host {
+# use dns-zone
+# host_name zone.example.com
+# alias ZONE example.com
+# }
+#
+# define service {
+# use dns-rrsig-service
+# host_name zone.example.com
+# }
+
+use warnings;
+use strict;
+
+use Getopt::Std;
+use Net::DNS::Resolver;
+use Time::HiRes qw ( gettimeofday tv_interval);
+use Time::Local;
+use List::Util qw ( shuffle );
+
+# options
+# -Z zone Zone to test
+# -t seconds DNS query timeout
+# -d debug
+# -C days Critical if expiring in this many days
+# -W days Warning if expiring in this many days
+# -T type Query type (default SOA)
+# -4 use IPv4 only
+# -U size EDNS0 UDP packet size (default 4096)
+my %opts = (t=>30, C=>2, W=>3, T=>'SOA', U=>4096);
+getopts('4Z:dt:W:C:T:U:', \%opts);
+usage() unless $opts{Z};
+usage() if $opts{h};
+my $zone = $opts{Z};
+$zone =~ s/^zone\.//;
+
+my $data;
+my $start;
+my $stop;
+
+my @refs = qw (
+a.root-servers.net
+b.root-servers.net
+c.root-servers.net
+d.root-servers.net
+e.root-servers.net
+f.root-servers.net
+g.root-servers.net
+h.root-servers.net
+i.root-servers.net
+j.root-servers.net
+k.root-servers.net
+l.root-servers.net
+m.root-servers.net
+);
+
+$start = [gettimeofday()];
+do_recursion();
+do_queries();
+$stop = [gettimeofday()];
+do_analyze();
+
+sub do_recursion {
+ my $done = 0;
+ my $res = Net::DNS::Resolver->new;
+ do {
+ print STDERR "\nRECURSE\n" if $opts{d};
+ my $pkt;
+ foreach my $ns (shuffle @refs) {
+ print STDERR "sending query for $zone $opts{T} to $ns\n" if $opts{d};
+ $res->nameserver($ns);
+ $res->udp_timeout($opts{t});
+ $res->recurse(0);
+ $res->dnssec(1);
+ $res->udppacketsize($opts{U});
+ $res->force_v4(1) if $opts{'4'};
+ $pkt = $res->send($zone, $opts{T});
+ last if $pkt;
+ }
+ critical("No response to seed query") unless $pkt;
+ critical($pkt->header->rcode . " from " . $pkt->answerfrom)
+ unless ($pkt->header->rcode eq 'NOERROR');
+ @refs = ();
+ foreach my $rr ($pkt->authority) {
+ next unless $rr->type eq 'NS';
+ print STDERR $rr->string, "\n" if $opts{d};
+ push (@refs, $rr->nsdname);
+ next unless names_equal($rr->name, $zone);
+ add_nslist_to_data($pkt);
+ $done = 1;
+ }
+ } while (! $done);
+}
+
+
+sub do_queries {
+ my $n;
+ do {
+ $n = 0;
+ foreach my $ns (keys %$data) {
+ next if $data->{$ns}->{done};
+ print STDERR "\nQUERY $ns\n" if $opts{d};
+
+ my $pkt = send_query($zone, $opts{T}, $ns);
+ add_nslist_to_data($pkt);
+ $data->{$ns}->{queries}->{$opts{T}} = $pkt;
+
+ print STDERR "done with $ns\n" if $opts{d};
+ $data->{$ns}->{done} = 1;
+ $n++;
+ }
+ } while ($n);
+}
+
+sub do_analyze {
+ my $nscount = 0;
+ my $NOW = time;
+ my %MAX_EXP_BY_TYPE;
+ foreach my $ns (keys %$data) {
+ print STDERR "\nANALYZE $ns\n" if $opts{d};
+ my $pkt = $data->{$ns}->{queries}->{$opts{T}};
+ critical("No response from $ns") unless $pkt;
+ print STDERR $pkt->string if $opts{d};
+ critical($pkt->header->rcode . " from $ns")
+ unless ($pkt->header->rcode eq 'NOERROR');
+ critical("$ns is lame") unless $pkt->header->ancount;
+ foreach my $rr ($pkt->answer) {
+ next unless $rr->type eq 'RRSIG';
+ my $exp = sigrr_exp_epoch($rr);
+ my $T = $rr->typecovered;
+ if (!defined($MAX_EXP_BY_TYPE{$T}->{exp}) || $exp > $MAX_EXP_BY_TYPE{$T}->{exp}) {
+ $MAX_EXP_BY_TYPE{$T}->{exp} = $exp;
+ $MAX_EXP_BY_TYPE{$T}->{ns} = $ns;
+ }
+ }
+ $nscount++;
+ }
+ warning("No nameservers found. Is '$zone' a zone?") if ($nscount < 1);
+ warning("No RRSIGs found") unless %MAX_EXP_BY_TYPE;
+ my $min_exp = undef;
+ my $min_ns = undef;
+ my $min_type = undef;
+ foreach my $T (keys %MAX_EXP_BY_TYPE) {
+ printf STDERR ("%s RRSIG expires in %.1f days\n", $T, ($MAX_EXP_BY_TYPE{$T}->{exp}-$NOW)/86400) if $opts{d};
+ if (!defined($min_exp) || $MAX_EXP_BY_TYPE{$T}->{exp} < $min_exp) {
+ $min_exp = $MAX_EXP_BY_TYPE{$T}->{exp};
+ $min_ns = $MAX_EXP_BY_TYPE{$T}->{ns};
+ $min_type = $T;
+ }
+ }
+ critical("$min_ns has expired RRSIGs") if ($min_exp < $NOW);
+ if ($min_exp - $NOW < ($opts{C}*86400)) {
+ my $ND = sprintf "%3.1f days", ($min_exp-$NOW)/86400;
+ critical("$min_type RRSIG expires in $ND at $min_ns")
+ }
+ if ($min_exp - $NOW < ($opts{W}*86400)) {
+ my $ND = sprintf "%3.1f days", ($min_exp-$NOW)/86400;
+ warning("$min_type RRSIG expires in $ND at $min_ns")
+ }
+ success("No RRSIGs expiring in the next $opts{W} days");
+}
+
+sub sigrr_exp_epoch {
+ my $rr = shift;
+ die unless $rr->type eq 'RRSIG';
+ my $exp = $rr->sigexpiration;
+ die "bad exp time '$exp'"
+ unless $exp =~ /^(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)$/;
+ my $exp_epoch = timegm($6,$5,$4,$3,$2-1,$1);
+ return $exp_epoch;
+}
+
+sub add_nslist_to_data {
+ my $pkt = shift;
+ foreach my $ns (get_nslist($pkt)) {
+ next if defined $data->{$ns}->{done};
+ print STDERR "adding NS $ns\n" if $opts{d};
+ $data->{$ns}->{done} |= 0;
+ }
+}
+
+sub success {
+ output('OK', shift);
+ exit(0);
+}
+
+sub warning {
+ output('WARNING', shift);
+ exit(1);
+}
+
+sub critical {
+ output('CRITICAL', shift);
+ exit(2);
+}
+
+sub output {
+ my $state = shift;
+ my $msg = shift;
+ $stop = [gettimeofday()] unless $stop;
+ my $latency = tv_interval($start, $stop);
+ printf "ZONE %s: %s; (%.2fs) |time=%.6fs;;;0.000000\n",
+ $state,
+ $msg,
+ $latency,
+ $latency;
+}
+
+sub usage {
+ print STDERR "usage: $0 -Z zone -d -t timeout -W days -C days\n";
+ print STDERR "\t-Z zone zone to test\n";
+ print STDERR "\t-T type query type (default SOA)\n";
+ print STDERR "\t-d debug\n";
+ print STDERR "\t-t seconds timeout on DNS queries\n";
+ print STDERR "\t-W days warning threshhold\n";
+ print STDERR "\t-C days critical threshold\n";
+ print STDERR "\t-4 use IPv4 only\n";
+ print STDERR "\t-U bytes EDNS0 UDP buffer size (default 4096)\n";
+ exit 3;
+}
+
+sub send_query {
+ my $qname = shift;
+ my $qtype = shift;
+ my $server = shift;
+ my $res = Net::DNS::Resolver->new;
+ $res->nameserver($server) if $server;
+ $res->udp_timeout($opts{t});
+ $res->retry(2);
+ $res->recurse(0);
+ $res->dnssec(1);
+ $res->udppacketsize($opts{U});
+ $res->force_v4(1) if $opts{'4'};
+ my $pkt = $res->send($qname, $qtype);
+ unless ($pkt) {
+ $res->usevc(1);
+ $res->tcp_timeout($opts{t});
+ $pkt = $res->send($qname, $qtype);
+ }
+ return $pkt;
+}
+
+sub get_nslist {
+ my $pkt = shift;
+ return () unless $pkt;
+ return () unless $pkt->authority;
+ my @nslist;
+ foreach my $rr ($pkt->authority) {
+ next unless ($rr->type eq 'NS');
+ next unless names_equal($rr->name, $zone);
+ push(@nslist, lc($rr->nsdname));
+ }
+ return @nslist;
+}
+
+sub names_equal {
+ my $a = shift;
+ my $b = shift;
+ $a =~ s/\.$//;
+ $b =~ s/\.$//;
+ lc($a) eq lc($b);
+}
+
diff --git a/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/control b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/control
new file mode 100644
index 0000000..a19575f
--- /dev/null
+++ b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/control
@@ -0,0 +1,7 @@
+Homepage: http://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.html
+Watch: http://dns.measurement-factory.com/tools/nagios-plugins/src/check_zone_rrsig_expiration Id: check_zone_rrsig_expiration,v ([0-9.]+)
+Uploaders: Bernd Zeimetz <bzed@debian.org>
+Description: plugin to check for expiration of
+ signatures in dnssec-enabled zones.
+Recommends: libnet-dns-perl, libnet-dns-sec-perl
+Version: 1.14
diff --git a/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/copyright b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/copyright
new file mode 100644
index 0000000..fab5e90
--- /dev/null
+++ b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/copyright
@@ -0,0 +1,27 @@
+Copyright (c) 2008, The Measurement Factory, Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+Neither the name of The Measurement Factory nor the names of its
+contributors may be used to endorse or promote products derived
+from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
diff --git a/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/zone-rrsig.cfg b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/zone-rrsig.cfg
new file mode 100644
index 0000000..ca10ed4
--- /dev/null
+++ b/nagios-plugins-contrib-24.20190301~bpo9+1/check_zone_rrsig_expiration/zone-rrsig.cfg
@@ -0,0 +1,4 @@
+define command {
+ command_name check_zone_rrsig
+ command_line /usr/lib/nagios/plugins/check_zone_rrsig -Z $HOSTADDRESS$
+}