X-Git-Url: https://git.siccegge.de//index.cgi?a=blobdiff_plain;f=dnssec-check;h=ad3d08c965660fb15d42b005234d83a51379dd39;hb=4abb5d1a4e910e698b98f03b00f313b2743e8d53;hp=2b745daac5027944e03123ccae88add68248c1c3;hpb=60602036d9381eaeca370cf93568b20518cea65d;p=tools.git

diff --git a/dnssec-check b/dnssec-check
index 2b745da..ad3d08c 100755
--- a/dnssec-check
+++ b/dnssec-check
@@ -2,7 +2,7 @@
 
 from __future__ import print_function
 import ldns
-from unbound import ub_ctx, idn2dname, RR_TYPE_SOA, RR_TYPE_RRSIG, ub_strerror
+from unbound import ub_ctx, idn2dname, RR_TYPE_SOA, RR_TYPE_DNSKEY, RR_TYPE_RRSIG, ub_strerror
 from optparse import OptionParser
 import sys
 from datetime import datetime, timedelta
@@ -19,20 +19,29 @@ def parse_rrsig_expire(expirestring):
     return delta
 
 def check_dnssec_expire(resolver, name, warn, crit):
-    s, result = resolver.resolve(name, rrtype=RR_TYPE_SOA)
-    if 0 != s:
-        ub_strerror(s)
-        return
+    for rrtype in [RR_TYPE_SOA, RR_TYPE_DNSKEY]:
+        s, result = resolver.resolve(name, rrtype=rrtype)
+        if 0 != s:
+            ub_strerror(s)
+            return 3
 
-    s, packet = ldns.ldns_wire2pkt(result.packet)
-    rrsigs = packet.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_ANSWER).rrs()
-    for rrsig in rrsigs:
-        delta = parse_rrsig_expire(str(rrsig.rrsig_expiration()))
+        if not result.secure:
+            print("CRIT (does not verify) %s" % (name, ))
+            return 2
 
-        if delta < crit:
-            print("CRIT (%s) %s" % (delta, name))
-        elif delta < warn:
-            print("WARN (%s) %s" % (delta, name))
+        s, packet = ldns.ldns_wire2pkt(result.packet)
+        rrsigs = packet.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_ANSWER).rrs()
+
+        for rrsig in rrsigs:
+            delta = parse_rrsig_expire(str(rrsig.rrsig_expiration()))
+
+            if delta < crit:
+                print("CRIT (expires in %s) %s" % (delta, name))
+                return 2
+            elif delta < warn:
+                print("WARN (expires in %s) %s" % (delta, name))
+                return 1
+    return 0
     
 
 def main():
@@ -50,16 +59,32 @@ def main():
     parser.add_option("-c", "--critical-days",
                       action="store", type=int, dest="crit", default=2,
                       help="minimum remaining validity in days before a warning is issued")
-    
+    parser.add_option("-v", action="store_true", dest="verbose", default=False)
+    parser.add_option("-q", action="store_false", dest="verbose")
         
     opts, _args = parser.parse_args()
+    if not opts.names:
+        parser.error("needs at least one DNS name")
+
     resolver = ub_ctx()
     resolver.add_ta_file(opts.ancor)
     encoding = sys.getfilesystemencoding()
-    
-    for name in  opts.names:
-        check_dnssec_expire(resolver, idn2dname(name.decode(encoding)),
-                            timedelta(opts.warn), timedelta(opts.crit))
+
+    final = 0
+    for name in opts.names:
+        name = idn2dname(name.decode(encoding))
+        result = check_dnssec_expire(resolver, name,
+                                     timedelta(opts.warn), timedelta(opts.crit))
+        if result == 0 and opts.verbose:
+            print("OK %s" % name)
+        if result == 2:
+            final = 2
+        elif result == 1 and final != 2:
+            final = 1
+        elif result == 3 and final not in [1, 2]:
+            final = 3
+
+    sys.exit(final)
 
 if __name__ == "__main__":
     main()