#!/usr/bin/perl
#
# check_snmp_iproute - nagios plugin 
#
# Copyright (C) 2014 Bernard Hoffman
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
#
#
use strict;
use warnings;
use lib "/usr/local/nagios/libexec"  ;
use utils qw($TIMEOUT %ERRORS &print_revision &support);
use vars qw($PROGNAME);

# Just in case of problems, let's not hang Nagios
$SIG{'ALRM'} = sub {
	print ("ERROR: Plugin took too long to complete (alarm)\n");
	exit $ERRORS{"UNKNOWN"};
};
alarm($TIMEOUT);

$PROGNAME = "check_snmp_iproute.pl";
sub print_help ();
sub print_usage ();
use POSIX qw(floor);
sub seconds_to_string($);

my ($opt_h,$opt_V);
my $community = "public";
my $snmp_version = 2;
my ($hostname,$routeip,$routemask,$routegw);;

use Getopt::Long;
&Getopt::Long::config('bundling');
GetOptions(
	"V"   => \$opt_V,	"version"    => \$opt_V,
	"h"   => \$opt_h,	"help"       => \$opt_h,
	"C=s" => \$community,	"community=s" => \$community,
	"H=s" => \$hostname,	"hostname=s" => \$hostname,
	"r=s" => \$routeip,	"route=s" => \$routeip,
	"m=s" => \$routemask,	"netmask=s" => \$routemask,
	"g=s" => \$routegw,	"gw=s" => \$routegw,
	"v=i" => \$snmp_version,"snmp_version=i" => \$snmp_version
);
# -h & --help print help
if ($opt_h) { print_help(); exit $ERRORS{'OK'}; }
# -V & --version print version
if ($opt_V) { print_revision($PROGNAME,'$Revision: 0.1 $ '); exit $ERRORS{'OK'}; }
# Invalid hostname print usage
if (!utils::is_hostname($hostname)) { print_usage(); exit $ERRORS{'UNKNOWN'}; }
# No route/gw is specified, print usage
if (!defined($routeip) || !defined($routemask) || !defined($routegw)) { print_usage(); exit $ERRORS{'UNKNOWN'}; }

# Setup SNMP object
use Net::SNMP qw(INTEGER OCTET_STRING IPADDRESS OBJECT_IDENTIFIER NULL);
my ($snmp, $snmperror);
if ($snmp_version == 2) {
	($snmp, $snmperror) = Net::SNMP->session(
		-hostname => $hostname,
		-version => 'snmpv2c',
		-community => $community
	);
} elsif ($snmp_version == 3) {
	my ($v3_username,$v3_password,$v3_protocol,$v3_priv_passphrase,$v3_priv_protocol) = split(":",$community);
	my @auth = ();
	if (defined($v3_password)) { push(@auth,($v3_password =~ /^0x/) ? 'authkey' : 'authpassword',$v3_password); }
	if (defined($v3_protocol)) { push(@auth,'authprotocol',$v3_protocol); }
	if (defined($v3_priv_passphrase)) { push(@auth,($v3_priv_passphrase =~ /^0x/) ? 'privkey' : 'privpassword',$v3_priv_passphrase); }
	if (defined($v3_priv_protocol)) { push(@auth,'privprotocol',$v3_priv_protocol); }

	($snmp, $snmperror) = Net::SNMP->session(
		-hostname => $hostname,
		-version => 'snmpv3',
		-username => $v3_username,
		@auth
	);
} else {
	($snmp, $snmperror) = Net::SNMP->session(
		-hostname => $hostname,
		-version => 'snmpv1',
		-community => $community
	);
}

if (!defined($snmp)) {
	print ("UNKNOWN: SNMP error: $snmperror\n");
	exit $ERRORS{'UNKNOWN'};
}

my $state = 'UNKNOWN';
my $output = "$routeip/$routemask gw $routegw retrieval failed.";
# Begin plugin check code
{
	my $ipRouteNextHop = "";
	my $ipRouteNextHopCidr = "";
	my $ipRouteEntry = "1.3.6.1.2.1.4.21.1.7";
	my $ipRouteEntryCidr = "1.3.6.1.2.1.4.24.4.1.4";

	my @snmpoids;
	push (@snmpoids,"$ipRouteEntry.$routeip");
	push (@snmpoids,"$ipRouteEntryCidr.$routeip.$routemask.0.$routegw");
	my $result = $snmp->get_request(
		-varbindlist => \@snmpoids
	);
	if (!defined($result)) {
		my $answer = $snmp->error;
		$snmp->close;
		print ("UNKNOWN: SNMP error: $answer\n");
		exit $ERRORS{'UNKNOWN'};
	}

	$ipRouteNextHop = $result->{"$ipRouteEntry.$routeip"};
	$ipRouteNextHopCidr = $result->{"$ipRouteEntryCidr.$routeip.$routemask.0.$routegw"};
	if ($ipRouteNextHop eq "noSuchObject") {
print "got $ipRouteNextHop and $ipRouteNextHopCidr from SNMP\n";
		#fall back and try older CIDR
		if ($ipRouteNextHopCidr eq "noSuchInstance") {
			$output = "$routeip is not in CIDR routing table.";
			$state = 'CRITICAL';
		} elsif ($ipRouteNextHopCidr eq $routegw) {
			$output = "$routeip (Router ID $ipRouteNextHopCidr) found in CIDR";
			$state = 'OK';
		} else {
			$output = "Unexpected GW for $routeip ($ipRouteNextHopCidr) in CIDR.";
			$state = 'CRITICAL';
		}
			
	} elsif ($ipRouteNextHop eq $routegw) {
		$output = "$routeip (Router ID $ipRouteNextHop) found";
		$state = 'OK';
	} else {
		$output = "Unexpected GW for $routeip ($ipRouteNextHop).";
		$state = 'CRITICAL';
	}
	
}
print "$state - $output\n";
exit $ERRORS{$state};

sub print_help() {
	print_revision($PROGNAME,'$Revision: 0.1 $ ');
	print "Copyright (c) 2014 Bernard Hoffman\n";
	print "This program is licensed under the terms of the\n";
	print "GNU General Public License\n(check source code for details)\n";
	print "\n";
	printf "Check routing table entry status via SNMP.\n";
	print "\n";
	print_usage();
	print "\n";
	print " -H (--hostname)     Hostname to query - (required)\n";
	print " -C (--community)    SNMP read community or v3 auth (defaults to public)\n";
	print "                     (v3 specified as username:authpassword:... )\n";
	print "                       username = SNMPv3 security name\n";
	print "                       authpassword = SNMPv3 authentication pass phrase (or hexidecimal key)\n";
	print "                       authprotocol = SNMPv3 authentication protocol (md5 (default) or sha)\n";
	print "                       privpassword = SNMPv3 privacy pass phrase (or hexidecmal key)\n";
	print "                       privprotocol = SNMPv3 privacy protocol (des (default) or aes)\n";
	print " -v (--snmp_version) 1 for SNMP v1\n";
	print "                     2 for SNMP v2c (default)\n";
	print "                     3 for SNMP v3\n";
	print " -r {--routeip}        IP (dot.quad) of route to be verified\n";
	print " -m {--routemask}      Netmask (dot.quad) for route to be verified\n";
	print " -g {--routegw}        IP (dot.quad) of route gateway to be verified\n";
	print " -V (--version)      Plugin version\n";
	print " -h (--help)         usage help\n";
	print "\n";
	support();
}

sub print_usage() {
	print "Usage: \n";
	print "  $PROGNAME -H <HOSTNAME> [-C <community>] -r <route IP> -m <netmask> -g <route GW IP>\n";
	print "  $PROGNAME [-h | --help]\n";
	print "  $PROGNAME [-V | --version]\n";
}


