Fixed SNMPv3 behaviour of check_ifoperstatus. Added -x to define privprotocol (#2343438 - Robin Schroeder)

check_ifoperstatus didn't function correctly with SNMPv3. This is fixed now.
Created argument-hash for SNMP session creation. This removes redundant code.
Session creation was moved out of process_arguments() and now takes place
after setting the timeout handler.

Additionally the -x argument was added to specify the privprotocol.

1 files changed, 39 insertions, 71 deletions

diff --git a/plugins-scripts/check_ifoperstatus.pl b/plugins-scripts/check_ifoperstatus.pl
index d0a1655a..503f1e41 100755
--- a/plugins-scripts/check_ifoperstatus.pl
+++ b/plugins-scripts/check_ifoperstatus.pl
@@ -61,7 +61,7 @@ my $answer = "";
 my $snmpkey = 0;
 my $community = "public";
 my $maxmsgsize = 1472 ; # Net::SNMP default is 1472
-my ($seclevel, $authproto, $secname, $authpass, $privpass, $auth, $priv, $context);
+my ($seclevel, $authproto, $secname, $authpass, $privpass, $privproto, $auth, $priv, $context);
 my $port = 161;
 my @snmpoids;
 my $sysUptime        = '1.3.6.1.2.1.1.3.0';
@@ -89,12 +89,14 @@ my $lastc;
 my $dormantWarn;
 my $adminWarn;
 my $name;
+my %session_opts;
 
 ### Validate Arguments
 
 $status = process_arguments();
 
 
+use Data::Dumper;
 # Just in case of problems, let's not hang Nagios
 $SIG{'ALRM'} = sub {
      print ("ERROR: No snmp response from $hostname (alarm)\n");
@@ -103,6 +105,16 @@ $SIG{'ALRM'} = sub {
 
 alarm($timeout);
 
+print Dumper(\%session_opts);
+($session, $error) = Net::SNMP->session(%session_opts);
+
+		
+if (!defined($session)) {
+			$state='UNKNOWN';
+			$answer=$error;
+			print ("$state: $answer\n");
+			exit $ERRORS{$state};
+}
 
 ## map ifdescr to ifindex - should look at being able to cache this value
 
@@ -293,6 +305,7 @@ sub print_help() {
 	printf "   -X (--privpass)   privacy password (cleartext ascii or localized key\n";
 	printf "                     in hex with 0x prefix generated by using	\"snmpkey\" utility\n"; 
 	printf "                     privacy password and authEngineID\n";
+	printf "   -x (--privproto)  privacy protocol (DES or AES; default: DES)\n";
 	printf "   -k (--key)        SNMP IfIndex value\n";
 	printf "   -d (--descr)      SNMP ifDescr value\n";
 	printf "   -T (--type)       SNMP ifType integer value (see http://www.iana.org/assignments/ianaiftype-mib)\n";
@@ -327,6 +340,7 @@ sub process_arguments() {
 			"U=s" => \$secname,   "secname=s"   => \$secname,
 			"A=s" => \$authpass,  "authpass=s"  => \$authpass,
 			"X=s" => \$privpass,  "privpass=s"  => \$privpass,
+			"x=s" => \$privproto,  "privproto=s"  => \$privproto,
 			"c=s" => \$context,   "context=s"   => \$context,
 			"k=i" => \$snmpkey, "key=i",\$snmpkey,
 			"d=s" => \$ifdescr, "descr=s" => \$ifdescr,
@@ -387,10 +401,27 @@ sub process_arguments() {
 		$timeout = $TIMEOUT;
 	}
 
+		
+	if ($snmp_version !~ /[123]/){
+		$state='UNKNOWN';
+		print ("$state: No support for SNMP v$snmp_version yet\n");
+		exit $ERRORS{$state};
+	}
+
+	%session_opts = (
+		-hostname  => $hostname,
+		-port      => $port,
+		-version	=> $snmp_version,
+		-maxmsgsize => $maxmsgsize
+	);
+
+	$session_opts{'-community'} = $community if (defined $community && $snmp_version =~ /[12]/);
+
 	if ($snmp_version =~ /3/ ) {
 		# Must define a security level even though default is noAuthNoPriv
 		# v3 requires a security username
 		if (defined $seclevel  && defined $secname) {
+			$session_opts{'-username'} = $secname;
 		
 			# Must define a security level even though defualt is noAuthNoPriv
 			unless ( grep /^$seclevel$/, qw(noAuthNoPriv authNoPriv authPriv) ) {
@@ -400,23 +431,22 @@ sub process_arguments() {
 			
 			# Authentication wanted
 			if ( $seclevel eq 'authNoPriv' || $seclevel eq 'authPriv' ) {
-		
 				unless ( $authproto eq 'MD5' || $authproto eq 'SHA1' ) {
 					usage();
 					exit $ERRORS{"UNKNOWN"};
 				}
+				$session_opts{'-authprotocol'} = $authproto if(defined $authproto);
 
 				if ( !defined $authpass) {
 					usage();
 					exit $ERRORS{"UNKNOWN"};
 				}else{
 					if ($authpass =~ /^0x/ ) {
-						$auth = "-authkey => $authpass" ;
+						$session_opts{'-authkey'} = $authpass ;
 					}else{
-						$auth = "-authpassword => $authpass";
+						$session_opts{'-authpassword'} = $authpass ;
 					}
 				}
-					
 			}
 			
 			# Privacy (DES encryption) wanted
@@ -426,21 +456,20 @@ sub process_arguments() {
 					exit $ERRORS{"UNKNOWN"};
 				}else{
 					if ($privpass =~ /^0x/){
-						$priv = "-privkey => $privpass";
+						$session_opts{'-privkey'} = $privpass;
 					}else{
-						$priv = "-privpassword => $privpass";
+						$session_opts{'-privpassword'} = $privpass;
 					}
 				}
+
+				$session_opts{'-privprotocol'} = $privproto if(defined $privproto);
 			}
 
 			# Context name defined or default
-
 			unless ( defined $context) {
 				$context = "";
 			}
 		
-		
-		
 		}else {
 					usage();
 					exit $ERRORS{'UNKNOWN'}; ;
@@ -448,67 +477,6 @@ sub process_arguments() {
 	} # end snmpv3
 
 
-	if ( $snmp_version =~ /[12]/ ) {
-  	($session, $error) = Net::SNMP->session(
-			-hostname  => $hostname,
-			-community => $community,
-			-port      => $port,
-			-version	=> $snmp_version,
-			-maxmsgsize => $maxmsgsize
-		);
-
-		if (!defined($session)) {
-			$state='UNKNOWN';
-			$answer=$error;
-			print ("$state: $answer\n");
-			exit $ERRORS{$state};
-		}
-	
-	}elsif ( $snmp_version =~ /3/ ) {
-
-		if ($seclevel eq 'noAuthNoPriv') {
-			($session, $error) = Net::SNMP->session(
-				-hostname  => $hostname,
-				-port      => $port,
-				-version  => $snmp_version,
-				-username => $secname,
-			);
-
-		}elsif ( $seclevel eq 'authNoPriv' ) {
-			($session, $error) = Net::SNMP->session(
-				-hostname  => $hostname,
-				-port      => $port,
-				-version  => $snmp_version,
-				-username => $secname,
-				$auth,
-				-authprotocol => $authproto,
-			);	
-		}elsif ($seclevel eq 'authPriv' ) {
-			($session, $error) = Net::SNMP->session(
-				-hostname  => $hostname,
-				-port      => $port,
-				-version  => $snmp_version,
-				-username => $secname,
-				$auth,
-				-authprotocol => $authproto,
-				$priv
-			);
-		}
-					
-					
-		if (!defined($session)) {
-					$state='UNKNOWN';
-					$answer=$error;
-					print ("$state: $answer\n");
-					exit $ERRORS{$state};
-		}
-
-	}else{
-		$state='UNKNOWN';
-		print ("$state: No support for SNMP v$snmp_version yet\n");
-		exit $ERRORS{$state};
-	}
-
 }
 ## End validation