#! /usr/bin/perl

use strict;
use warnings;
use feature qw(say);
use Nagios::Check::DNS::check_tlsa_record;
use File::Basename;
use Monitoring::Plugin;

my $ME     = basename $0;
my $blurb  = 'This Plugin is intended to check validity of TLSA Records';
my $url    = 'http://www.schlittermann.de';
my $author = 'Heike Yvonne Pesch';
my $email  = '<pesch@schlittermann.de>';
my $usage  = <<_;
Usage: %s [-v|--verbose ] [-H <host>] [-t <timeout>]
	[-c|--critical=<critical threshold>]
	[-w|--warning=<warning threshold>]
	[-p|--port=<portnumber>]
	[-q|--queryserver=<DNS-Server-IP>]
_
my $extra = <<_;

NOTICE
If you want to use a hostlist, you have to put entries like this:

host
host:port


EXAMPLES
$ME -H ssl.schlittermann.de 
$ME -H hh.schlittermann.de -p25
$ME -H hh.schlittermann.de:25
$ME -f hostlist.txt

Author: $author $email
For more information visit $url
_

my $nagios_tlsa = Monitoring::Plugin->new(
    usage   => $usage,
    blurb   => $blurb,
    extra   => $extra,
    url     => $url,
    plugin  => $ME,
    timeout => 120,

);
$nagios_tlsa->add_arg(
    spec     => 'host|H=s',
    help     => 'Host/Domain to check',
    required => 0,
);

$nagios_tlsa->add_arg(
    spec     => 'hostlist|f=s',
    help     => 'Host/Domainlist in file to check',
    required => 0,
);

$nagios_tlsa->add_arg(
    spec     => 'expiry|e',
    help     => 'check expiry of certificate',
    required => 0,
);

$nagios_tlsa->add_arg(
    spec     => 'port|p=i',
    help     => 'port of host to check the TLSA (default: 443)',
    required => 0,
    default  => 443,
);

$nagios_tlsa->add_arg(
    spec     => 'queryserver|q=s',
    required => 0,
    help =>
      'DNS server to ask to check the TLSA (default: defined in resolv.conf)',

);

$nagios_tlsa->add_arg(
    spec => 'protocol|P=s',
    help => 'Protocol to ask to check the TLSA record of domain (default: tcp)',
    required => 0,
    default  => 'tcp',
);

$nagios_tlsa->getopts;

my $domain     = $nagios_tlsa->opts->host;
my $port       = $nagios_tlsa->opts->port;
my $protocol   = $nagios_tlsa->opts->protocol;
my $domainlist = $nagios_tlsa->opts->hostlist;
my $expiry     = $nagios_tlsa->opts->expiry;
my $pattern    = '^(?<domain>\S*\.[a-z]{2,4}?):{0,1}(?<port>[0-9]*$)';

if (!$domain && !$domainlist) {
    my $script = basename $0;
    my $excuse = "Please set -H <domain> or -f <domainlist>\n"
      . "For all options try $script --help";

    say $excuse;
    exit 1;
}

if ($domainlist) {
    get_domains();
    exit 0;
}

if ($domain) {

    my $pattern = '^(?<domain>\S*\.[a-z]{2,4}?):{1}(?<port>[0-9]+$)';
    if ($domain =~ /$pattern/gi) {
        $domain = $+{domain};
        $port   = $+{port};
    }

    if (!$port || $port eq '') {
        $port = 443;
    }

    if (!$protocol || $protocol ne 'tcp' || $protocol ne 'udp') {
        $protocol = 'tcp';
    }

    my $return =
      Nagios::Check::DNS::check_tlsa_record::main(($domain, $port, $protocol));
    say $return;
    exit 0;
}

sub get_domains {
    open(my $filehandle, '<', $domainlist);

    while (<$filehandle>) {
        if (/$pattern/ig) {
            $domain = $+{domain};

            if   ("$+{port}" =~ /^\s*$/) { $port = '443'; }
            else                         { $port = $+{port}; }

            my $return =
              Nagios::Check::DNS::check_tlsa_record::main(($domain, $port));
            say $return;
        }
        else {
            die "$domainlist has wrong or malformed content\n";
        }

    }
}

# vim: ft=perl ts=2 sw=2
