#!/usr/bin/env perl

#####################################
#####################################
### ______               _     =) ###
### | ___ \             | |       ###
### | |_/ / __ _  _ __  | |       ###
### |    / / _` || '_ \ | |       ###
### | |\ \| (_| || | | || |____   ###
### \_| \_|\__,_||_| |_|\_____/   ###
#####################################
#####################################
## Original version written by 
## ran.leibman@gmail.com
## Additionial checks code written
## by laurent.dufour@havas.com
##
## the following parameters has
## been tested against a PA5050
##
## cpu|firmware|ha|model|
## sessions|udp_sessions|tcp_sessions
## |icmp_sessions
##
#####################################
#####################################


use strict;
use lib "/usr/lib/nagios/plugins/";
use Net::SNMP;
my $stat;
my $msg;
my $perf;
my $script_name = "check-paloalto-A500.pl";
my $script_version = 1.1;


### SNMP OIDs
###############
my $s_cpu_mgmt = '.1.3.6.1.2.1.25.3.3.1.2.1';
my $s_cpu_data = '.1.3.6.1.2.1.25.3.3.1.2.2';
my $s_firmware = '.1.3.6.1.2.1.25.3.3.1.2.2';
my $s_firmware_version = '.1.3.6.1.4.1.25461.2.1.2.1.1.0';
my $s_ha_mode = '.1.3.6.1.4.1.25461.2.1.2.1.13.0';
my $s_ha_local_state = '.1.3.6.1.4.1.25461.2.1.2.1.11.0';
my $s_ha_peer_state = '.1.3.6.1.4.1.25461.2.1.2.1.12.0';
my $s_pa_model = '.1.3.6.1.4.1.25461.2.1.2.2.1.0';
my $s_pa_max_sessions = '.1.3.6.1.4.1.25461.2.1.2.3.2.0';
my $s_pa_total_active_sessions = '.1.3.6.1.4.1.25461.2.1.2.3.3.0';
my $s_pa_total_tcp_active_sessions = '.1.3.6.1.4.1.25461.2.1.2.3.4.0';
my $s_pa_total_udp_active_sessions = '.1.3.6.1.4.1.25461.2.1.2.3.5.0';
my $s_pa_total_icmp_active_sessions = '.1.3.6.1.4.1.25461.2.1.2.3.6.0';

### Functions
###############
sub _create_session {
    my ($server, $comm) = @_;
    my $snmp_version = 2;
    my ($sess, $err) = Net::SNMP->session( -hostname => $server, -version => $snmp_version, -community => $comm);
    if (!defined($sess)) {
	print "Can't create SNMP session to $server\n";
	exit(1);
    }
    return $sess;
}

sub FSyntaxError {
    print "Syntax Error !\n";
# print "$0 -H [ip|dnsname] -C [snmp community] -t [temp|fan|ps|cpu|mem|module|freeint|firmware|ha|model|sessions|udp_sessions|tcp_sessions|icmp_sessions] -w [warning value] -c [critical value] -d [days]\n";
    print "$script_name\n";
    print "Version : $script_version\n";
    print "-H = Ip/Dns Name of the FW\n";
    print "-C = SNMP Community\n";
    print "-t = Check type (currently only cpu/firmware/model/ha/sessions/icmp_sessions/tcp_sessions/udp_sessions)\n";
    print "-w = Warning Value\n";
    print "-c = Critical Value\n";
    exit(3);
}

if($#ARGV != 9) {
    FSyntaxError;
}

### Gather input from user
#############################
my $switch;
my $community;
my $check_type;
my $warn = 0;
my $crit = 0;
my $int;

while(@ARGV) {
    my $temp = shift(@ARGV);
    if("$temp" eq '-H') {
	$switch = shift(@ARGV);
    } elsif("$temp" eq '-C') {
	$community = shift(@ARGV);
    } elsif("$temp" eq '-t') {
	$check_type = shift(@ARGV);
    } elsif("$temp" eq '-w') {
	$warn = shift(@ARGV);
    } elsif("$temp" eq '-c') {
	$crit = shift(@ARGV);
    } else {
	FSyntaxError();
    }
}

# Validate Warning
if($warn > $crit) {
    print "Warning can't be larger then Critical: $warn > $crit\n";
    FSyntaxError();
}

# Establish SNMP Session
our $snmp_session = _create_session($switch,$community);


### model ###
if($check_type eq "model") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_pa_model]);
    my $palo_model = "$R_firm->{$s_pa_model}";

    $msg = "OK: Palo Alto $palo_model";
    $perf="";
    $stat = 0;
}

### HA MODE ###
elsif($check_type eq "ha") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_ha_mode]);
    my $ha_mode = "$R_firm->{$s_ha_mode}";

    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_ha_local_state]);
    my $ha_local_state = "$R_firm->{$s_ha_local_state}";

    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_ha_peer_state]);
    my $ha_peer_state = "$R_firm->{$s_ha_peer_state}";

    $msg =  "OK: High Availablity Mode: $ha_mode, Local: $ha_local_state, Peer: $ha_peer_state\n";
    $perf="";
    $stat = 0;
}


### SESSIONS ###
elsif($check_type eq "sessions") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_pa_max_sessions]);
    my $pa_max_sessions = "$R_firm->{$s_pa_max_sessions}";

    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_pa_total_active_sessions]);
    my $pa_total_active_sessions = "$R_firm->{$s_pa_total_active_sessions}";

	$perf=" - Max Active Sessions :  $pa_max_sessions";
    
    if($pa_total_active_sessions > $crit ) {
	$msg =  "CRITICAL: Total Active Sessions: $pa_total_active_sessions".$perf;
	$stat = 2;
    } elsif($pa_total_active_sessions > $warn ) {
	$msg =  "WARNING: Total Active Sessions: $pa_total_active_sessions".$perf;
	$stat = 1;
    } else {
	$msg =  "OK: Total Active Sessions: $pa_total_active_sessions".$perf;
	$stat = 0;
    }
	$perf="";
}

### TCP SESSIONS ###
elsif($check_type eq "tcp_sessions") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_pa_total_tcp_active_sessions]);
    my $pa_total_tcp_active_sessions = "$R_firm->{$s_pa_total_tcp_active_sessions}";

    if($pa_total_tcp_active_sessions > $crit ) {
	$msg =  "CRITICAL: TCP Active Sessions: $pa_total_tcp_active_sessions";
	$stat = 2;
    } elsif($pa_total_tcp_active_sessions > $warn ) {
	$msg =  "WARNING: TCP Active Sessions: $pa_total_tcp_active_sessions";
	$stat = 1;
    } else {
	$msg =  "OK: TCP Active Sessions: $pa_total_tcp_active_sessions";
	$stat = 0;
    }
	$perf="";
}

### UDP SESSIONS ###
elsif($check_type eq "udp_sessions") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_pa_total_udp_active_sessions]);
    my $pa_total_udp_active_sessions = "$R_firm->{$s_pa_total_udp_active_sessions}";
    
    if($pa_total_udp_active_sessions > $crit ) {
	$msg =  "CRITICAL: UDP Active Sessions: $pa_total_udp_active_sessions";
	$stat = 2;
    } elsif($pa_total_udp_active_sessions > $warn ) {
	$msg =  "WARNING: UDP Active Sessions: $pa_total_udp_active_sessions";
	$stat = 1;
    } else {
	$msg =  "OK: UDP Active Sessions: $pa_total_udp_active_sessions";
	$stat = 0;
    }
	$perf="";
}

### ICMP SESSIONS ###
elsif($check_type eq "icmp_sessions") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_pa_total_icmp_active_sessions]);
    my $pa_total_icmp_active_sessions = "$R_firm->{$s_pa_total_icmp_active_sessions}";

    
    if($pa_total_icmp_active_sessions > $crit ) {
	$msg =  "CRITICAL: ICMP Active Sessions: $pa_total_icmp_active_sessions";
	$stat = 2;
    } elsif($pa_total_icmp_active_sessions > $warn ) {
	$msg =  "WARNING: ICMP Active Sessions: $pa_total_icmp_active_sessions";
	$stat = 1;
    } else {
	$msg =  "OK: ICMP Active Sessions: $pa_total_icmp_active_sessions";
	$stat = 0;

    }
	$perf="";
}

### firmware ###
elsif($check_type eq "firmware") {
    my $R_firm = $snmp_session->get_request(-varbindlist => [$s_firmware_version]);
    my $palo_os_ver = "$R_firm->{$s_firmware_version}";

    $msg = "OK: Firmware $palo_os_ver";
    $perf="";
    $stat = 0;
}

### CPU ###
elsif($check_type eq "cpu") {
    my $R_mgmt = $snmp_session->get_request(-varbindlist => [$s_cpu_mgmt]);
    my $mgmt = "$R_mgmt->{$s_cpu_mgmt}";
    my $R_data = $snmp_session->get_request(-varbindlist => [$s_cpu_data]);
    my $data = "$R_data->{$s_cpu_data}";

    if($mgmt > $crit or $data > $crit) {
	$msg = "CRITICAL: Mgmt: $mgmt, Data: $data";
	$stat = 2;
    } elsif($mgmt > $warn or $data > $warn) {
	$msg = "WARNING: Mgmt: $mgmt, Data: $data";
	$stat = 1;
    } else {
	$msg = "OK: Mgmt: $mgmt, Data: $data";
	$stat = 0;
    }
    $perf = "mgmt=$mgmt;data=$data;$warn;$crit";

### Bad Syntax ###

} else {
    FSyntaxError();
}

if ($perf eq "") { 
 print "$msg\n";
} else {
 print "$msg | $perf\n";
}

exit($stat);