ius/nagios/nagios-plugin-ldap-repl: comparison check_ldap

equal deleted inserted replaced

-:dcdc1a43d887
+:5d59fd79e7f4
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 #    Matthias Förste <foerste@schlittermann.de>
 use strict;
+use warnings;
+# required? https://rt.cpan.org/Public/Bug/Display.html?id=95875
+use threads;
 use File::Basename;
-use Getopt::Long;
+use AppConfig;
-use Config::IniFiles;
 use Net::LDAP;
-use IO::Prompt;
 use File::stat;
 use Pod::Usage;
 use if $ENV{DEBUG} => "Smart::Comments";
-sub version($$);
-sub read_config();
-sub ldap_object($);
-sub get_stamp($$);
-sub compare_results(%);
 my %ERRORS = (
 	OK        => 0,
 	WARNING   => 1,
 	CRITICAL  => 2,
 	DEPENDENT => 4
 );
 my $ME      = basename $0;
 my $NAME    = "LDAPREPL";
-my $VERSION = "0.3.2";
+my $VERSION = "0.3.3";
-my $master_default = "ldap://ldap-master:389/";
+my $defaults = {
-my $slave_default = "ldap://ldap-slave:389/";
+'init|i!'       => 0,
-my $cn_default = "replcheck";
+'delete|d!'     => 0,
+'refresh|r!'    => 1,
-my %opt = (
+'dn=s'          => undef,
-	init	=> 0,
+'binddn|D=s'    => undef,
-	delete  => 0,
+'password=s'    => undef,
-	refresh => 0,
+'wait|w=i'      => 1,
-	cn      => $cn_default,
+'config=s'      => '/etc/nagios/ius/plugins/config/check_ldap_repl.cfg',
-	wait    => 1,
+'provider|p=s'  => 'ldap://provider:389',
-	file    => "/etc/nagios/ius/plugins/config/check_ldap_repl.cfg",
+'consumer|c=s@' => 'ldap://consumer:389',
-	master	=> $master_default,
+'help|h!'       => sub { pod2usage(-verbose => 1, -exitval => $ERRORS{OK}) },
-	slave	=> $slave_default
+'man|m!'        => sub { pod2usage(-verbose => 2, -exitval => $ERRORS{OK}) },
-);
+'version|V!'    => sub { version($ME, $VERSION); exit $ERRORS{OK}; }
+};
-MAIN: {
-	Getopt::Long::Configure('bundling');
+my $attr = 'description';
-	GetOptions(
-		"i|init"       => \$opt{init},
+sub critical { print STDERR "$NAME CRITICAL: ", @_; exit $ERRORS{CRITICAL}; }
-		"d|delete"     => \$opt{delete},
+$SIG{__DIE__} = sub { print STDERR "$NAME UNKNOWN: ", @_; exit $ERRORS{UNKNOWN}; };
-		"r|refresh"    => \$opt{refresh},
-		"b|binddn=s"   => \$opt{binddn},
+sub stamp {
-		"p|password=s" => \$opt{password},
+my ($u, $dn) = @_;
-		"c|cn=s"       => \$opt{cn},
-		"w|wait=i"     => \$opt{wait},
+my $l = ref $u eq 'Net::LDAP' ? $u : Net::LDAP->new($u, onerror => 'die') or die "$@";
-		"M|master=s"   => \$opt{master},
+my $r = $l->search(base => $dn, scope => 'base', filter => '(objectClass=*)');
-		"S|slave=s"    => \$opt{slave},
+die "unexpected result count: ", $r->count unless $r->count == 1;
-		"f|file=s"     => \$opt{file},
+my @v = $r->entry(0)->get_value($attr);
-		"h|help"       => sub { pod2usage( -verbose => 1, -exitval => $ERRORS{OK} ) },
+die "unexpected value count [@v]" unless @v == 1;
-		"m|man"        => sub { pod2usage( -verbose => 2, -exitval => $ERRORS{OK} ) },
+return $v[0];
-		"V|version"    => sub { version( $ME, $VERSION ); exit $ERRORS{OK}; }
-	) or pod2usage( -verbose => 1, -exitval => $ERRORS{CRITICAL} );
-	# init or delete the ldap object
-	if ($opt{init}) {
-		ldap_object("init");
-		print "new object successfully initialized\n";
-		exit $ERRORS{OK};
-	} elsif ($opt{delete}) {
-		ldap_object("delete");
-		print "object successfully deleted\n";
-		exit $ERRORS{OK};
-	}
-	# refresh our ldap object
-	ldap_object("refresh") if ($opt{refresh});
-	my ($master, $slave, $cn) = undef;
-	my @slaves = ();
-	my %results = ();
-	# preparing for the comparison of ldap entries
-if (($opt{master} ne $master_default) || ($opt{slave} ne $slave_default) || ($opt{cn} ne $cn_default)) {
-$master = $opt{master};
-@slaves = split(/,/, $opt{slave});
-$cn = $opt{cn};
-} elsif (-r $opt{file}) {
-(undef, undef, $master, $slave, $cn) = read_config();
-@slaves = split(/,/, $slave);
-} else {
-$master = $opt{master};
-@slaves = split(/,/, $opt{slave});
-$cn = $opt{cn};
-}
-	# get the values from the ldap
-	$results{$master}{'master'} = get_stamp($master, $cn);
-	sleep $opt{wait};
-	foreach (@slaves) {
-		$results{$_}{'slave'} = get_stamp($_, $cn);
-	}
-	# compare the time stamps and generate the output
-	compare_results(\%results);
 }
-sub compare_results(%) {
+sub version {
-	my @output = ();
-	my %stamps = ();
-	my (%results) = %{$_[0]};
-	for my $server ( keys %results ) {
-		for my $type ( keys %{ $results{$server} } ) {
-			$stamps{$results{$server}{$type}} = "";
-			push @output, "$type: $server = $results{$server}{$type}";
-		}
-	}
-	@output = sort(@output);
-	if (scalar(keys(%stamps)) != 1 ) {
-		print "$NAME CRITICAL: server are not in sync @output\n";
-		exit $ERRORS{CRITICAL};
-	} else {
-		print "$NAME OK: servers are in sync @output\n";
-		exit $ERRORS{OK};
-	}
-}
-sub read_config() {
-	my ($binddn, $password, $cn, $master, $slave);
-	my $cfg = new Config::IniFiles( -file => "$opt{file}");
-	$binddn = $cfg->val('bind', 'dn')?$cfg->val('bind', 'dn'):$opt{binddn};
-	$password = $cfg->val('bind', 'password')?$cfg->val('bind', 'password'):$opt{password};
-	$master = $cfg->val('master', 'server')?$cfg->val('master', 'server'):$opt{master};
-	$slave = $cfg->val('slave', 'server')?$cfg->val('slave', 'server'):$opt{slave};
-	$cn = $cfg->val('object', 'cn')? $cfg->val('object', 'cn'):$opt{cn};
-	return ($binddn, $password, $master, $slave, $cn);
-}
-sub ldap_object($) {
-	my $type = shift;
-	my ($binddn, $password) = undef;
-	my $master = $opt{master};
-	my $cn = $opt{cn};
-	# ldap object init/delete is only allowed at the prompt
-	if ( ($type eq "init") || ($type eq "delete") ) {
-		$binddn = prompt('BindDN: ');
-		$password = prompt('Password: ', -e => '*');
-		if (($opt{master} ne $master_default) || ($opt{cn} ne $cn_default)) {
-			$master = $opt{master};
-			$cn = $opt{cn};
-		} elsif ( -r $opt{file} ) {
-			(undef, undef, $master, undef, $cn) = read_config();
-		}
-	} else {
-		if ($opt{binddn} && $opt{password}) {
-			$binddn = $opt{binddn};
-			$password = $opt{password};
-		} elsif ( -r $opt{file} ) {
-			($binddn, $password, undef, undef, undef) = read_config();
-		} else {
-			$binddn = prompt('BindDN: ');
-			$password = prompt('Password: ', -e => '*');
-		}
-		if (($opt{master} ne $master_default) || ($opt{cn} ne $cn_default)) {
-			$master = $opt{master};
-			$cn = $opt{cn};
-		} elsif ( -r $opt{file} ) {
-			(undef, undef, $master, undef, $cn) = read_config();
-		}
-	}
-	my $ldap = Net::LDAP->new( $master );
-	if (!$ldap) {
-		print "$NAME CRITICAL: [$master] $!\n";
-		exit $ERRORS{CRITICAL};
-	}
-	my $mesg = $ldap->bind("$binddn", password => $password);
-	if ($mesg->code) {
-		$ldap->unbind() if ($ldap);
-		print "$NAME CRITICAL: " . $mesg->error . "\n";
-		exit $ERRORS{CRITICAL};
-	}
-	# get ldap naming context
-	my $dse = $ldap->root_dse();
-	my $context = $dse->get_value('namingContexts');
-	if (! defined $context) {
-		print "$NAME CRITICAL: can't determine ldap 'naming context'\n";
-		exit $ERRORS{CRITICAL};
-	}
-	if ($mesg->code) {
-		print "$NAME CRITICAL: " . $mesg->error . "\n";
-		exit $ERRORS{CRITICAL};
-	}
-	# initialize check object
-	$mesg = $ldap->add(
-		"cn=$cn,$context",
-		attr => [
-			'objectclass' => [ 'top', 'person' ],
-			'cn' => "$cn",
-			'sn' => "$cn",
-			'description' => time()
-			],
-	) if ($type eq "init");
-	# delete check object
-	$mesg = $ldap->delete("cn=$cn,$context") if ($type eq "delete");
-	# refresh check object
-	$mesg = $ldap->modify(
-		"cn=$cn,$context",
-		replace => {
-			description => time()
-		}
-	) if ($opt{refresh});
-	if ($mesg->code && ($type eq "delete" || $type eq "init" || $type eq "refresh")) {
-		print "$NAME WARNING: [ldapt] " . $mesg->error . "\n";
-		exit $ERRORS{WARNING};
-	}
-	$ldap->unbind() if ($ldap);
-	return 0;
-}
-sub get_stamp($$) {
-	my ($server, $cn) = @_;
-	my $ldap = Net::LDAP->new( $server );
-	if (!$ldap) {
-		print "$NAME CRITICAL: [$server] $!\n";
-		exit $ERRORS{CRITICAL};
-	}
-	my $mesg = $ldap->bind();
-	if ($mesg->code) {
-		$ldap->unbind() if ($ldap);
-		print "$NAME CRITICAL: " . $mesg->error . "\n";
-		exit $ERRORS{CRITICAL};
-	}
-	# get ldap naming context
-	my $dse = $ldap->root_dse();
-	my $context = $dse->get_value('namingContexts');
-	if (! defined $context) {
-		print "$NAME CRITICAL: can't determine ldap 'naming context'\n";
-		exit $ERRORS{CRITICAL};
-	}
-	$mesg = $ldap->search(
-		base => "cn=replcheck,$context",
-		scope => "base",
-		filter => "(cn=$cn)",
-		attr => [ 'description' ]
-	);
-	if ($mesg->code) {
-		$ldap->unbind() if ($ldap);
-		print "$NAME CRITICAL: " . $mesg->error . "\n";
-		exit $ERRORS{CRITICAL};
-	}
-	if ($mesg->count != 1) {
-		print "$NAME CRITICAL: \n";
-		exit $ERRORS{CRITICAL};
-	}
-	my $entry = $mesg->entry(0);
-	return $entry->get_value("description");
-	$ldap->unbind() if ($ldap);
-}
-sub version($$) {
 	my ( $progname, $version ) = @_;
 	print <<_VERSION;
 $progname version $version
 Copyright (C) 2012 by Christian Arnold and Schlittermann internet & unix support.
 and you are welcome to redistribute it under certain conditions.
 See the GNU General Public Licence for details.
 _VERSION
 }
+MAIN: {
+my $c = AppConfig->new( { CASE => 1 },
+map { $_, { ref $defaults->{$_} eq 'CODE' ? 'ACTION' : 'DEFAULT' => $defaults->{$_} } } keys %{$defaults}
+) or die "Can't initialize";
+my $cf = $c->get('config');
+# ignore default configuration file if it does not exist
+$c->file($cf) if -e $cf;
+# read configuration file if passed on command line
+$c->getopt(qw(no_ignore_case));
+$c->file($cf) if $cf ne ($cf = $c->get('config'));
+# make sure that command line options override any config file options
+$c->getopt;
+my %o = $c->varlist('.');
+my $t = time();
+my $p = Net::LDAP->new($o{provider}, onerror => 'die' ) or die $@;
+$p->bind($o{binddn}, password => $o{password});
+$p->modify($o{dn}, replace => { $attr => $t });
+my $tp = stamp($p, $o{dn});
+if ($o{refresh}) {
+die "Provider update failed for unknown reason\n" unless $tp == $t;
+sleep $o{wait};
+}
+for (@{$o{consumer}}) { critical "'$_' out of sync\n" unless $tp == stamp($_, $o{dn}); }
+print "$NAME OK: servers are in sync\n";
+exit $ERRORS{OK};
+}
 __END__
 =head1 NAME
 check_ldap_repl - nagios/icinga plugin to check correctly working of ldap replication.
 =head1 SYNOPSIS
-check_ldap_repl [-i|--init]
+check_ldap_repl [-c|--cn string]
-[-d|--delete]
-[-r|--refresh]
-[-c|--cn string]
 [-b|--binddn string]
 [-p|--password string]
 [-f|--file string]
 [-M|--master string]
 [-S|--slave string]
 =head1 OPTIONS
 =over
-=item B<-i>|B<--init>
-Add the check object cn=replcheck,I<namingContext> to the master server if not exists. See also the B<--cn> option.
-You will ask for an B<binddn> and B<password>, if not given B<--binddn> and B<--password> options.
-LDAP object initialisation is only allowed at the prompt. Your B<binddn> must have write permission to the ldap master server.
-=item B<-d>|B<--delete>
-Delete the check object from the ldap master server if exists. See also the B<--cn> option.
-You will ask for an B<binddn> and B<password>, if not given B<--binddn> and B<--password> options.
-LDAP object deletion is only allowed at the prompt. Your B<binddn> must have write permission to the ldap master server.
-=item B<-r>|B<--refresh>
-Refresh the stamp attribute of the check attribute with current unix time.
-You will ask for an B<binddn> and B<password>, if not given B<--binddn> and B<--password> options. See also B<--file> option.
-Your B<binddn> must have write permission to the ldap master server.
 =item B<-c>|B<--cn> I<string>
 cn for the initialized object. See also the B<--init> option. (default: replcheck)
 =item B<-b>|B<--binddn> I<string>

changeset 11	5d59fd79e7f4
parent 10	dcdc1a43d887
child 12	7202e55a0713