#! /bin/bash
#
# check_netfilter.nf_conntrack.sh nagios plugin
#
# by Jeronimo Zucco <jczucco+nagios@gmail.com>
# April/20/2012
#
# This Nagios plugin was created to check the status of netfilter conntrack table
#
# sysctl net.netfilter.nf_conntrack_count : check the number of connections in table
# sysctl net.netfilter.nf_conntrack_max : check the max size of netfilter conntrack table
#
# Licence: "GNU Public License v2"
# Dependencies: expr, grep, sed
#
# If you are running a Linux firewall, you should be using this script ;-)
#
# nagiosgraph map:
# /output:Conntrack Tables.*?(\d+)\n/
# and push @s, [ 'conntrack',
#                [ 'entries', GAUGE, $1 ] ];
#
# Modified: 05/15/2017 John Villasenor (john.villasenor@dreamhost.com)
# Previous check only used /proc/config.gz to check if conntrack module is loaded.
# Updated to check module using /boot/config in case the config.gz does not exist.


PROGNAME=`basename $0`
PROGPATH=`dirname $0`
REVISION="0.2"


print_usage() {
	echo "Usage:"
	echo "  $PROGNAME WARNING CRITICAL"
	echo "  $PROGNAME --help"
	echo "  $PROGNAME --version"
	echo "Check netfilter conntrack table status"
}

if [ $# -eq 2 ]
then
	# properly bail if we're not using conntrack
	# not all machines are configured to write a config file at /proc/config.gz - JV
	# added a check to see if the file exists otherwise to check the module using /boot/config -JV
	if [ ! -f /proc/config.gz ]; then
		grep CONFIG_NF_CONNTRACK=m /boot/config-`uname -r` 2>&1 > /dev/null
		EXISTS=$?
	else
		zgrep CONFIG_NF_CONNTRACK=y /proc/config.gz 2>&1 > /dev/null
		EXISTS=$?
	fi
	if [[ $EXISTS -ne 0 ]]; then
		echo "CONFIG_NF_CONNTRACK not loaded!"
		exit 3;
	fi

	USED=$(sysctl -n net.netfilter.nf_conntrack_count)
	MAX=$(sysctl -n net.netfilter.nf_conntrack_max)

	WARNING=$(echo $1 | sed s/%//)
	CRITICAL=$(echo $2 | sed s/%//)

	if [ ${MAX} -gt 0 ]; then
		AUX=$(expr ${USED} \* 100 / ${MAX} )

                if [ ${AUX} -lt ${WARNING} ]; then
                        echo "Conntrack Tables OK - ${USED}"
                        exit 0
                else
                        if [ ${AUX} -ge ${CRITICAL} ]; then
				echo "Conntrack Tables CRITICAL - ${USED}"
                                exit 2
                        else
                                if [ ${AUX} -ge ${WARNING} ]; then
					echo "Conntrack Tables WARNING - ${USED}"
                                        exit 1
                                fi
                        fi
                fi
	else
                echo "Can't check net.netfilter.nf_conntrack_max"
		exit 3
        fi


else
	case $1 in
		--help)
		print_usage
			exit 0
			;;
		--version)
		print_revision $PROGNAME $REVISION
			exit 0
			;;
		*)
			print_usage
			exit 0
			;;
	esac
fi

