path: root/contrib/check_nmap.py

#!/usr/bin/python
# Change the above line if python is somewhere else

#
# check_nmap
#  
# Program: nmap plugin for Nagios
# License: GPL
# Copyright (c)  2000 Jacob Lundqvist (jaclu@galdrion.com)
#
_version_ = '1.21'
#
#
# Description:
#
# Does a nmap scan, compares open ports to those given on command-line
# Reports warning for closed that should be open and error for
# open that should be closed.
# If optional ports are given, no warning is given if they are closed
# and they are included in the list of valid ports.
#
#   Requirements:
#     python
#     nmap
#
# History
# -------
# 1.21	 2004-07-23 rippeld@hillsboroughcounty.org Updated parsing of nmap output to correctly identify closed ports
# 1.20   2000-07-15 jaclu Updated params to correctly comply to plugin-standard
#                         moved support classes to utils.py
# 1.16   2000-07-14 jaclu made options and return codes more compatible with 
#                         the plugin developer-guidelines
# 1.15   2000-07-14 jaclu added random string to temp-file name
# 1.14   2000-07-14 jaclu added check for error from subproc
# 1.10   2000-07-14 jaclu converted main part to class
# 1.08   2000-07-13 jaclu better param parsing
# 1.07   2000-07-13 jaclu changed nmap param to -P0
# 1.06   2000-07-13 jaclu make sure tmp file is deleted on errors
# 1.05   2000-07-12 jaclu in debug mode, show exit code
# 1.03   2000-07-12 jaclu error handling on nmap output
# 1.01   2000-07-12 jaclu added license
# 1.00   2000-07-12 jaclu implemented timeout handling
# 0.20   2000-07-10 jaclu Initial release


import sys, os, string, whrandom

import tempfile
from getopt import getopt

#
# import generic Nagios-plugin stuff
#
import utils

# Where temp files should be placed
tempfile.tempdir='/usr/local/nagios/var'

# Base name for tempfile
tempfile.template='check_nmap_tmp.'

# location and possibly params for nmap
nmap_cmd='/usr/bin/nmap -P0'






#
#  the class that does all the real work in this plugin...
#
# 
class CheckNmap:

    # Retcodes, so we are compatible with nagios
    #ERROR=    -1
    UNKNOWN=  -1
    OK=        0
    WARNING=   1
    CRITICAL=  2


    def __init__(self,cmd_line=[]):
        """Constructor.
           arguments:
	     cmd_line: normaly sys.argv[1:] if called as standalone program
	"""
	self.tmp_file=''
	self.host=''       # host to check
	self.timeout=10    
	self.debug=0       # 1= show debug info
	self.ports=[]      # list of mandatory ports
	self.opt_ports=[]  # list of optional ports
	self.ranges=''     # port ranges for nmap
	self.exit_code=0   # numerical exit-code
	self.exit_msg=''   # message to caller
	
	self.ParseCmdLine(cmd_line)
	
    def Run(self):
        """Actually run the process.
           This method should be called exactly once.
	"""
	
	#
	# Only call check_host if cmd line was accepted earlier
	#
	if self.exit_code==0:
	    self.CheckHost()

	self.CleanUp()
	return self.exit_code,self.exit_msg
    
    def Version(self):
	return 'check_nmap %s' % _version_
    
    #-----------------------------------------
    #
    # class internal stuff below...
    #
    #-----------------------------------------
    
    #
    # Param checks
    #
    def param2int_list(self,s):
	lst=string.split(string.replace(s,',',' '))
	try:
	    for i in range(len(lst)):
		lst[i]=int(lst[i])
	except:
	    lst=[]
	return lst
	    
    def ParseCmdLine(self,cmd_line):
	try:
	    opt_list=getopt(cmd_line,'vH:ho:p:r:t:V',['debug','host=','help',
	        'optional=','port=','range=','timeout','version'])
	    for opt in opt_list[0]:
		if opt[0]=='-v' or opt[0]=='--debug':
		    self.debug=1
		elif opt[0]=='-H' or opt[0]=='--host':
		    self.host=opt[1]
		elif opt[0]=='-h' or opt[0]=='--help':
		    doc_help()
		    self.exit_code=1 # request termination
		    break
		elif opt[0]=='-o' or opt[0]=='--optional':
		    self.opt_ports=self.param2int_list(opt[1])
		elif opt[0]=='-p' or opt[0]=='--port':
		    self.ports=self.param2int_list(opt[1])
		elif opt[0]=='-r' or opt[0]=='--range':
		    r=string.replace(opt[1],':','-')
		    self.ranges=r
		elif opt[0]=='-t' or opt[0]=='--timeout':
		    self.timeout=opt[1]
		elif opt[0]=='-V' or opt[0]=='--version':
		    print self.Version()
		    self.exit_code=1 # request termination
		    break
		else:
		    self.host=''
		    break

	except:
	    # unknown param
	    self.host=''
	    
	if self.debug:
	    print 'Params:'
	    print '-------'
	    print 'host             = %s' % self.host
	    print 'timeout          = %s' % self.timeout
	    print 'ports            = %s' % self.ports
	    print 'optional ports   = %s' % self.opt_ports
	    print 'ranges           = %s' % self.ranges
	    print
	
	#
	# a option that wishes us to terminate now has been given...
	# 
	# This way, you can test params in debug mode and see what this 
	# program recognised by suplying a version param at the end of
	# the cmd-line
	#
	if self.exit_code<>0:
	    sys.exit(self.UNKNOWN)
	    
	if self.host=='':
	    doc_syntax()
	    self.exit_code=self.UNKNOWN
	    self.exit_msg='UNKNOWN: bad params, try running without any params for syntax'
	       	

    def CheckHost(self):
	'Check one host using nmap.'
	#
	# Create a tmp file for storing nmap output
	#
	# The tempfile module from python 1.5.2 is stupid
	# two processes runing at aprox the same time gets 
	# the same tempfile...
	# For this reason I use a random suffix for the tmp-file
	# Still not 100% safe, but reduces the risk significally
	# I also inserted checks at various places, so that
	# _if_ two processes in deed get the same tmp-file
	# the only result is a normal error message to nagios
	#
	r=whrandom.whrandom()
	self.tmp_file=tempfile.mktemp('.%s')%r.randint(0,100000)
	if self.debug:
	    print 'Tmpfile is: %s'%self.tmp_file
	#
	# If a range is given, only run nmap on this range
	#
	if self.ranges<>'':
	    global nmap_cmd # needed, to avoid error on next line
	                    # since we assigns to nmap_cmd :)
	    nmap_cmd='%s -p %s' %(nmap_cmd,self.ranges)	
	#
	# Prepare a task
	#
	t=utils.Task('%s %s' %(nmap_cmd,self.host))
	#
	# Configure a time-out handler
	#
	th=utils.TimeoutHandler(t.Kill, time_to_live=self.timeout, 
	                        debug=self.debug)
	#
	#  Fork of nmap cmd
	#
	t.Run(detach=0, stdout=self.tmp_file,stderr='/dev/null')
	#
	# Wait for completition, error or timeout
	#
	nmap_exit_code=t.Wait(idlefunc=th.Check, interval=1)
	#
	# Check for timeout
	#
	if th.WasTimeOut():
	    self.exit_code=self.CRITICAL
	    self.exit_msg='CRITICAL - Plugin timed out after %s seconds' % self.timeout
	    return
	#
	# Check for exit status of subprocess
	# Must do this after check for timeout, since the subprocess
	# also returns error if aborted.
	#
	if nmap_exit_code <> 0:
	    self.exit_code=self.UNKNOWN
	    self.exit_msg='nmap program failed with code %s' % nmap_exit_code
	    return
	#
	# Read output
	#
	try:
	    f = open(self.tmp_file, 'r')
	    output=f.readlines()
	    f.close()
	except:
	    self.exit_code=self.UNKNOWN
            self.exit_msg='Unable to get output from nmap'
	    return

	#
	# Store open ports in list
	#  scans for lines where first word contains '/'
	#  and stores part before '/'
	#
	self.active_ports=[]
	try:
	    for l in output:
		if len(l)<2:
		    continue
		s=string.split(l)[0]
		if string.find(s,'/')<1:
		    continue
		p=string.split(s,'/')[0]
		if string.find(l,'open')>1:
		    self.active_ports.append(int(p))
	except:
	    # failure due to strange output...
	    pass

	if self.debug:
	    print 'Ports found by nmap:   ',self.active_ports
	#
	# Filter out optional ports, we don't check status for them...
	#
	try:
	    for p in self.opt_ports:
		self.active_ports.remove(p)
	    
	    if self.debug and len(self.opt_ports)>0:
		print 'optional ports removed:',self.active_ports
	except:
	    # under extreame loads the remove(p) above failed for me
	    # a few times, this exception hanlder handles
	    # this bug-alike situation...
	    pass

	opened=self.CheckOpen()	
	closed=self.CheckClosed()
	
	if opened <>'':
	    self.exit_code=self.CRITICAL
            self.exit_msg='PORTS CRITICAL - Open:%s Closed:%s'%(opened,closed)
	elif closed <>'':
	    self.exit_code=self.WARNING
	    self.exit_msg='PORTS WARNING - Closed:%s'%closed
	else:
	    self.exit_code=self.OK
	    self.exit_msg='PORTS ok - Only defined ports open'
    
    
    #
    # Compares requested ports on with actually open ports
    # returns all open that should be closed
    #
    def CheckOpen(self):
	opened=''
	for p in self.active_ports:
	    if p not in self.ports:
		opened='%s %s' %(opened,p)
	return opened
	
    #
    # Compares requested ports with actually open ports
    # returns all ports that are should be open
    #
    def CheckClosed(self):
	closed=''
	for p in self.ports:
	    if p not in self.active_ports:
		closed='%s %s' % (closed,p)
	return closed


    def CleanUp(self):
	#
	# If temp file exists, get rid of it
	#
	if self.tmp_file<>'' and os.path.isfile(self.tmp_file):
	    try:
		os.remove(self.tmp_file)
	    except:
		# temp-file colition, some other process already
		# removed the same file... 
		pass	    
    
	#
	# Show numerical exits as string in debug mode
	#
	if self.debug:
	    print 'Exitcode:',self.exit_code,
	    if self.exit_code==self.UNKNOWN:
		print 'UNKNOWN'
	    elif self.exit_code==self.OK:
		print 'OK'
	    elif self.exit_code==self.WARNING:
		print 'WARNING'
	    elif self.exit_code==self.CRITICAL:
		print 'CRITICAL'
	    else:
		print 'undefined'
	#
	# Check if invalid exit code
	#
	if self.exit_code<-1 or self.exit_code>2:
	    self.exit_msg=self.exit_msg+' - undefined exit code (%s)' % self.exit_code
	    self.exit_code=self.UNKNOWN


        


#
# Help texts
#
def doc_head():
    print """
check_nmap plugin for Nagios
Copyright (c) 2000 Jacob Lundqvist (jaclu@galdrion.com)
License: GPL
Version: %s""" % _version_
    

def doc_syntax():
    print """
Usage: check_ports [-v|--debug] [-H|--host host] [-V|--version] [-h|--help]
                   [-o|--optional port1,port2,port3 ...] [-r|--range range]
                   [-p|--port port1,port2,port3 ...] [-t|--timeout timeout]"""
    

def doc_help():
    'Help is displayed if run without params.'
    doc_head()
    doc_syntax()
    print """
Options:
 -h         = help (this screen ;-)
 -v         = debug mode, show some extra output
 -H host    = host to check (name or IP#)
 -o ports   = optional ports that can be open (one or more),
	      no warning is given if optional port is closed
 -p ports   = ports that should be open (one or more)
 -r range   = port range to feed to nmap.  Example: :1024,2049,3000:7000
 -t timeout = timeout in seconds, default 10
 -V         = Version info
 
This plugin attempts to verify open ports on the specified host.

If all specified ports are open, OK is returned.
If any of them are closed, WARNING is returned (except for optional ports)
If other ports are open, CRITICAL is returned

If possible, supply an IP address for the host address, 
as this will bypass the DNS lookup.        
"""


#
# Main
#
if __name__ == '__main__':

    if len (sys.argv) < 2:
	#
	# No params given, show syntax and exit
	#
	doc_syntax()
	sys.exit(-1)
	
    nmap=CheckNmap(sys.argv[1:])
    exit_code,exit_msg=nmap.Run()
    
    #
    # Give Nagios a msg and a code
    #
    print exit_msg
    sys.exit(exit_code)