#!/bin/ksh
# Nagios plugin to check availability and expiration of
# Certificate Revocation List file URLs.
#
# Requires curl, openssl, date, sed, etc. in shell's PATH.
PROGNAME=`basename $0`
PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`

# Set remaining variables
_timewarn=240 # Default warning threshold in minutes before expiration
_timecrit=60  # Default critical threshold in minutes before expiration
_useragent=BeadnallCRLMonitor/0.1

# Import Nagios plugin definitions and functions
. $PROGPATH/utils.sh

# Function to set message text and exit code
alert () {
    if [ -n "${2}" ];
    then
        echo ${2}
    else
        echo "Unspecified CRL monitor message"
    fi
    case "$1" in
        'crit'|'error'|'fatal') exit $STATE_CRITICAL ;;
        'debug') ;;
        'ok') exit $STATE_OK ;;
        'warn') exit $STATE_WARNING ;;
        *) exit $STATE_UNKNOWN ;;
    esac
}

usage() {
    echo "Certificate Revocation List file plugin for Nagios"
    alert fatal "Usage: $PROGNAME -crl http://server-name/FileName.crl\
        -crit 60 -warn 240"
}

# Verify correct number of command line arguments
if [ $# -lt 1 ];
then
    usage
fi

# Parse command line arguments
while test -n "$1";
do
    case "$1" in
        '-crl')
            if [ -n "${2}" ];
            then
                _crl=${2}
            else
                alert fatal "No CRL file specified. Type --help for usage"
            fi
            shift
            ;;
        '-crit'|'-c')
            if [ -n "${2}" ];
            then
                _timecrit=${2}
            else
                alert fatal "Must provide critical threshold with argument"
            fi
            shift
            ;;
        '-warn'|'-w')
            if [ -n "${2}" ];
            then
                _timewarn=${2}
            else
                alert fatal "Must provide warning threshold with argument"
            fi
            shift
            ;;
        '-debug')
            _crl=http://crl.verisign.com/Class1GW.crl
            alert debug "Using debug test CRL file ${_crl}."
            set -x
            ;;
        *)
            usage
            ;;
    esac
    shift
done

# Run Curl with OpenSSL CRL to capture next update time
# A little ugly with one long command pipe ...
_nextupdate=$(curl --user-agent "${_useragent}" --silent --url "${_crl}"|\
 openssl crl -inform DER -nextupdate -noout|\
 sed -e s/^nextUpdate=//) > /dev/null 2>&1
# awk -F"[': =]" '{print $7 $2 $3 $4 $5}'

# Determine which alert message to send, if any
if [ -z "${_nextupdate}" ];
then
    alert fatal "Failed to find nextUpdate in CRL ${_crl}!"
else
    # Date format provided in CRL= %b %e %T %Y %Z
    _update=$(date --date="${_nextupdate}" '+%Y%m%d%H%M')
    # -u sets local time check to GMT/UTC
    _date=$(date -u '+%Y%m%d%H%M')
    _timediff=$((${_update}-${_date}))
    if [ ${_timediff} -le 0 ];
    then
        alert crit "CRL expired ${_nextupdate}"
    elif [ ${_timediff} -le ${_timecrit} ];
    then
        alert crit "CRL will expire in ${_timediff} minutes"
    elif [ ${_timediff} -le ${_timewarn} ];
    then
        alert warn "CRL will expire in ${_timediff} minutes"
    fi
fi

alert ok "Next CRL update scheduled for ${_nextupdate}"
