From 48bb50f972e0b89eb072b0f34ec21a4289ee496d Mon Sep 17 00:00:00 2001
From: Peter Palfrader <peter@palfrader.org>
Date: Mon, 20 May 2019 12:00:45 +0200
Subject: [PATCH] add dsa-check-ucode-intel

---
 .../checks/dsa-check-ucode-intel              | 47 +++++++++++++++++++
 dsa-nagios-checks/debian/changelog            |  1 +
 2 files changed, 48 insertions(+)
 create mode 100755 dsa-nagios-checks/checks/dsa-check-ucode-intel

diff --git a/dsa-nagios-checks/checks/dsa-check-ucode-intel b/dsa-nagios-checks/checks/dsa-check-ucode-intel
new file mode 100755
index 0000000..33f3c88
--- /dev/null
+++ b/dsa-nagios-checks/checks/dsa-check-ucode-intel
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright 2019 Peter Palfrader
+#
+# Permission is hereby granted, free of charge, to any person obtaining
+# a copy of this software and associated documentation files (the
+# "Software"), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish,
+# distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so, subject to
+# the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+cpu_sig="$(iucode_tool --scan-system 2>&1 | sed -e 's/.*with signature //')"
+avail_line="$(iucode_tool -l  -S -tb /lib/firmware/intel-ucode 2>&1 | grep "sig[[:space:]]*$cpu_sig")"
+avail="$(echo "$avail_line" | sed -e 's/.*rev[[:space:]]*//; s/[,[:space:]].*//')"
+
+if [ -z "$avail" ]; then
+  echo "UNKNOWN: did not find available ucode"
+  exit 3
+fi
+
+current=$(awk '$1 == "microcode" {print $3; exit}' < /proc/cpuinfo)
+
+if [ -z "$current" ]; then
+  echo "UNKNOWN: did not learn current ucode"
+  exit 3
+fi
+
+if [ "$(printf "%d" "$avail")" != "$(printf "%d" "$current")" ]; then
+  echo "WARN: current ucode is $current while $avail is available"
+  exit 1
+else
+  echo "OK: current ucode $current matches available $avail"
+  exit 0
+fi
diff --git a/dsa-nagios-checks/debian/changelog b/dsa-nagios-checks/debian/changelog
index 703fece..f49d87d 100644
--- a/dsa-nagios-checks/debian/changelog
+++ b/dsa-nagios-checks/debian/changelog
@@ -8,6 +8,7 @@ dsa-nagios-checks (118) UNRELEASED; urgency=medium
     - in buster, timedatectl no longer considers the ntp status of
       the ntp.service.  So we manually do that now.
     - also switch to parsing the machine readable output in buster.
+  * dsa-check-ucode-intel: add.
 
  -- Aurelien Jarno <aurel32@debian.org>  Mon, 01 Apr 2019 10:09:25 +0200
 
-- 
2.20.1