#! /bin/sh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

print_help() {
	echo ""
	echo "Checks for outbound SYN floods"
	echo ""
	exit 0
}

is_increasing(){
	packetcount=`iptables -nxvL dh-syn-flood | grep DROP | awk '{print $1}'`
	sleep 2
	newpacketcount=`iptables -nxvL dh-syn-flood | grep DROP | awk '{print $1}'`

	if [ "$packetcount" -lt "$newpacketcount" ];then
		return 0
	else
		return 1
	fi
}

user() {
        if [[ $EUID -ne 0 ]]; then
                echo "must run as EUID 0"
                exit 3
        fi
}

case "$1" in
	--help)
		print_help
		exit 0
		;;
	-h)
		print_help
		exit 0
		;;
	*)
		user

		chainexists=`iptables -nvL dh-syn-flood 2>&1 > /dev/null`
		status=$?

		if test ${status} -eq 1; then
			echo "No dh-syn-flood chain detected. Firewall problems?"
			exit 3
		fi

		is_increasing
		status=$?

		if [ ${status} -eq 0 ]; then
			echo "CRITICAL: Outbound SYN flood in progress!"
			exit 2
		else
			echo "OK: No outbound SYN floods currently"
			exit 0
		fi
		;;
esac
