dsa-check-zone-rrsig-expiration: Handle cases where a child and parent domain share...

[mirror/dsa-nagios.git] / dsa-nagios-checks / checks / dsa-check-zone-rrsig-expiration

diff --git a/dsa-nagios-checks/checks/dsa-check-zone-rrsig-expiration b/dsa-nagios-checks/checks/dsa-check-zone-rrsig-expiration
index 7a92768..3d5d584 100755 (executable)
--- a/dsa-nagios-checks/checks/dsa-check-zone-rrsig-expiration
+++ b/dsa-nagios-checks/checks/dsa-check-zone-rrsig-expiration
@@ -45,6 +45,8 @@
 #  - add -s option to configure udp packet size.  default changed from 4k to 1k
 # Copyright (c) 2013 Peter Palfrader <peter@palfrader.org>
 #  - add -r option to override initial refs.
+# Copyright (c) 2014 Peter Palfrader <peter@palfrader.org>
+#  - Do not ask for RRSIG directly, instead ask for SOA with dnssec data
 
 
 # usage
@@ -137,25 +139,28 @@ sub do_recursion {
        do {
                print STDERR "\nRECURSE\n" if $opts{d};
                my $pkt;
+               my $prettyrefs = (scalar @refs) ? join(", ", @refs) : "empty set(!?)";
                foreach my $ns (shuffle @refs) {
-                       print STDERR "sending query for $zone RRSIG to $ns\n" if $opts{d};
+                       print STDERR "sending query for $zone NS to $ns\n" if $opts{d};
                        $res->nameserver($ns);
                        $res->udp_timeout($opts{t});
                        $res->udppacketsize($opts{s});
-                       $pkt = $res->send($zone, 'RRSIG');
+                       $pkt = $res->send($zone, 'NS');
                        last if $pkt;
                }
-               critical("No response to seed query") unless $pkt;
+               critical("No response to seed query for $zone from $prettyrefs.") unless $pkt;
                critical($pkt->header->rcode . " from " . $pkt->answerfrom)
                        unless ($pkt->header->rcode eq 'NOERROR');
                @refs = ();
-               foreach my $rr ($pkt->authority) {
+               foreach my $rr ($pkt->authority, $pkt->answer) {
                        print STDERR $rr->string, "\n" if $opts{d};
-                       push (@refs, $rr->nsdname);
+                       push (@refs, $rr->nsdname) if $rr->type eq 'NS';
                        next unless lc($rr->name) eq lc($zone);
                        add_nslist_to_data($pkt);
+                       #print STDERR "Adding for $zone: ", $pkt->string, "\n" if $opts{d};
                        $done = 1;
                }
+               critical("No new references after querying for $zone NS from $prettyrefs.  Packet was ".$pkt->string) unless (scalar @refs);
        } while (! $done);
 }
 
@@ -166,11 +171,11 @@ sub do_queries {
                $n = 0;
                foreach my $ns (keys %$data) {
                        next if $data->{$ns}->{done};
-                       print STDERR "\nQUERY $ns\n" if $opts{d};
+                       print STDERR "\nQUERY \@$ns SOA $zone\n" if $opts{d};
 
-                       my $pkt = send_query($zone, 'RRSIG', $ns);
+                       my $pkt = send_query($zone, 'SOA', $ns);
                        add_nslist_to_data($pkt);
-                       $data->{$ns}->{queries}->{RRSIG} = $pkt;
+                       $data->{$ns}->{queries}->{SOA} = $pkt;
 
                        print STDERR "done with $ns\n" if $opts{d};
                        $data->{$ns}->{done} = 1;
@@ -185,7 +190,7 @@ sub do_analyze {
        my %MAX_EXP_BY_TYPE;
        foreach my $ns (keys %$data) {
                print STDERR "\nANALYZE $ns\n" if $opts{d};
-               my $pkt = $data->{$ns}->{queries}->{RRSIG};
+               my $pkt = $data->{$ns}->{queries}->{SOA};
                critical("No response from $ns") unless $pkt;
                print STDERR $pkt->string if $opts{d};
                critical($pkt->header->rcode . " from $ns")
@@ -285,6 +290,7 @@ sub send_query {
        my $res = Net::DNS::Resolver->new;
        $res->nameserver($server) if $server;
        $res->udp_timeout($opts{t});
+       $res->dnssec(1);
        $res->retry(2);
        $res->udppacketsize($opts{s});
        my $pkt = $res->send($qname, $qtype);
@@ -299,9 +305,9 @@ sub send_query {
 sub get_nslist {
        my $pkt = shift;
        return () unless $pkt;
-       return () unless $pkt->authority;
+       return () if (!$pkt->authority && !$pkt->answer);
        my @nslist;
-       foreach my $rr ($pkt->authority) {
+       foreach my $rr ($pkt->authority, $pkt->answer) {
                next unless ($rr->type eq 'NS');
                next unless ($rr->name eq $zone);
                push(@nslist, lc($rr->nsdname));