369 lines
9.6 KiB
Bash
Executable file
369 lines
9.6 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
# Monitoring script to check the expiration of domain names via RDAP and WHOIS.
|
|
#
|
|
# Copyright: chl-dev@bugness.org 2025 https://code.bugness.org/
|
|
# Licence: WTFPL
|
|
|
|
# Stop at first uncaught error
|
|
set -e
|
|
|
|
PROGPATH=$( echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,' )
|
|
REVISION="0.2"
|
|
|
|
# Default values
|
|
IANA_URL_DOMAINS="https://data.iana.org/rdap/dns.json"
|
|
IANA_CACHE_FILE="/tmp/.check_expiration_domain_name.cache.json"
|
|
IANA_CACHE_DURATION=$(( 86400 * 30 ))
|
|
THRESHOLD_WARNING="2592000" # 30 days
|
|
THRESHOLD_CRITICAL="691200" # 8 days
|
|
TIMESTAMP_NOW="$( date +%s )"
|
|
OPTION_RDAP_QUERYING="yes"
|
|
OPTION_WHOIS_QUERYING="yes"
|
|
|
|
# Include check_range()
|
|
# Not needed at the moment
|
|
#. $PROGPATH/utils.sh
|
|
STATE_OK=0
|
|
STATE_WARNING=1
|
|
STATE_CRITICAL=2
|
|
STATE_UNKNOWN=3
|
|
STATE_DEPENDENT=4
|
|
|
|
# Output
|
|
OUTPUT_EXIT_STATUS=0
|
|
OUTPUT_DETAIL_WARNING=""
|
|
OUTPUT_DETAIL_CRITICAL=""
|
|
OUTPUT_PERFDATA=""
|
|
|
|
#
|
|
# Help function
|
|
#
|
|
usage() {
|
|
cat <<EOF
|
|
Usage :
|
|
$0 [-w warning_threshold] [-c critical_threshold] [-rR] [-wW] domain1 [domain2] ...
|
|
|
|
-r enable RDAP querying $( test -n "$OPTION_RDAP_QUERYING" && echo '(default)' )
|
|
-R disable RDAP querying $( test -z "$OPTION_RDAP_QUERYING" && echo '(default)' )
|
|
-i enable WHOIS querying $( test -n "$OPTION_WHOIS_QUERYING" && echo '(default)' )
|
|
-I disable WHOIS querying $( test -z "$OPTION_WHOIS_QUERYING" && echo '(default)' )
|
|
|
|
Thresholds in seconds (or suffix by 'd' for days).
|
|
|
|
|
|
Default values:
|
|
warning_threshold : $THRESHOLD_WARNING
|
|
critical_threshold : $THRESHOLD_CRITICAL
|
|
IANA URL : $IANA_URL_DOMAINS
|
|
IANA cache file : $IANA_CACHE_FILE
|
|
IANA cache duration : $IANA_CACHE_DURATION second(s)
|
|
EOF
|
|
}
|
|
|
|
#
|
|
# Days/Months/Hours to seconds convert function
|
|
#
|
|
convert_to_seconds() {
|
|
local UNIT VALUE
|
|
UNIT="$( echo "$1" | sed 's/.*\(.\)$/\1/;q' )"
|
|
VALUE="$( echo "$1" | sed 's/^\([0-9]*\).*/\1/;q' )"
|
|
|
|
case "$UNIT" in
|
|
'd')
|
|
# Unit is days
|
|
echo "$( expr "$VALUE" \* 86400 )"
|
|
;;
|
|
|
|
*)
|
|
echo "$1"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
#
|
|
# Wrapper to use whatever is available to make HTTP queries
|
|
#
|
|
fetch_with_curl_wget_or_whatever () {
|
|
if which "wget" >/dev/null 2>&1; then
|
|
wget -q -O - "$1"
|
|
elif which "curl" >/dev/null 2>&1 ; then
|
|
curl -s --fail "$1"
|
|
else
|
|
echo "No wget/curl/whatever available to make HTTP queries." >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
#
|
|
# Echo the root IANA database
|
|
#
|
|
cat_iana_dns() {
|
|
local PREVIOUS_NOCLOBBER_STATE_CMD="$( set +o | grep noclobber )"
|
|
|
|
# Check that our cache file exists, has not been emptily created by mistake,
|
|
# and is sufficiently recent. We'll also check that the file belongs to us
|
|
# afterwards.
|
|
if [ ! -f "$IANA_CACHE_FILE" ] || [ ! -s "$IANA_CACHE_FILE" ] || [ "$( stat -c %Y "$IANA_CACHE_FILE" )" -lt "$(( $( date +%s ) - $IANA_CACHE_DURATION ))" ]; then
|
|
rm -f "$IANA_CACHE_FILE"
|
|
# For security, we activate the 'noclobber' : if a smartass raced us in
|
|
# creating the file (or a symlink to a dangerous file), the '>' will simply
|
|
# fail.
|
|
set -C
|
|
if ! ERROR_FETCH="$( fetch_with_curl_wget_or_whatever "$IANA_URL_DOMAINS" 2>&1 >"$IANA_CACHE_FILE" )"; then
|
|
echo "failed to retrieve IANA database ($ERROR_FETCH)"
|
|
$PREVIOUS_NOCLOBBER_STATE_CMD
|
|
return 1
|
|
fi
|
|
$PREVIOUS_NOCLOBBER_STATE_CMD
|
|
fi
|
|
|
|
# Check that the file belongs to us
|
|
if [ ! -O "$IANA_CACHE_FILE" ]; then
|
|
echo "Cache file ($IANA_CACHE_FILE) belongs to another user: stopping for security risk."
|
|
return 1
|
|
fi
|
|
|
|
# Output
|
|
cat "$IANA_CACHE_FILE"
|
|
}
|
|
|
|
#
|
|
# Get expiration date from RDAP
|
|
# (output the date as seconds since Unix epoch)
|
|
# (error when exit status is != 0 or empty output)
|
|
#
|
|
get_expiration_date_rdap() {
|
|
local DOMAIN="$1"
|
|
local ROOT="$1"
|
|
|
|
# We truncate and loop until we find a suitable RDAP server (wikipedia.co.uk -> co.uk -> uk)
|
|
while true; do
|
|
# Truncate the first part of the domain name
|
|
ROOT="$( echo "$ROOT" | sed 's/[^.]\+.\?//' )"
|
|
test -n "$ROOT" || break
|
|
|
|
# Search for the RDAP servers
|
|
if ! LIST_SERVERS="$( cat_iana_dns )" || ! LIST_SERVERS="$( echo "$LIST_SERVERS" | jq -r ".services[] | select(.[][] == \"$ROOT\") | .[1][]" )"; then
|
|
echo "Error getting server list: $LIST_SERVERS"
|
|
return 1
|
|
fi
|
|
# Try every server (usually only one ?)
|
|
for SERVER in $LIST_SERVERS; do
|
|
# Query the server
|
|
# (small regexp to avoid some double '/' in the URL)
|
|
if OUTPUT="$( fetch_with_curl_wget_or_whatever "$( echo "$SERVER" | sed 's#/$##' )/domain/$DOMAIN" 2>&1 )"; then
|
|
EXPIRATION_DATE="$( echo "$OUTPUT" | jq -r '.events[] | select(."eventAction" == "expiration") | .eventDate' )"
|
|
# Small protection against injection
|
|
if [ -n "$( echo "$EXPIRATION_DATE" | LANG=C sed -n '/^[a-zA-Z0-9:.\-]\{1,64\}$/p' )" ]; then
|
|
# We directly output the date as seconds from epoch.
|
|
date --date="$EXPIRATION_DATE" +%s
|
|
return
|
|
fi
|
|
fi
|
|
done
|
|
# If we have a non-empty list of servers but didn't manage to get an
|
|
# expiration date, we return an error.
|
|
if [ -n "$LIST_SERVERS" ]; then
|
|
echo "All servers ($LIST_SERVERS) failed for $DOMAIN / $ROOT (last output: $OUTPUT)"
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
echo "No RDAP server for $DOMAIN"
|
|
return 1
|
|
}
|
|
|
|
|
|
#
|
|
# Get expiration date from WHOIS
|
|
# (output the date as seconds since Unix epoch)
|
|
# (error when exit status is != 0 or empty output)
|
|
#
|
|
get_expiration_date_whois() {
|
|
local DOMAIN="$1"
|
|
local EXPIRATION_DATE
|
|
|
|
# WHOIS query outside of the sed pipe to catch erroneous exit value.
|
|
if ! WHOIS_OUTPUT="$( whois "$DOMAIN" )"; then
|
|
return 1
|
|
fi
|
|
|
|
# We put each format on a dedicated line
|
|
# + filter only the first line
|
|
# Note : some sed implementations seems not to offer
|
|
# case-insensitive option, so we try not to
|
|
# use it for the moment.
|
|
# 1 - kernel.org, icann.org
|
|
# 2 - coca-cola.com (we try to ignore lines starting with space...)
|
|
# 3 - facebook.com (...but if there's nothing else, take it anyway)
|
|
# 4 - some databases with simple display (.se, .si)
|
|
# 5 - .it
|
|
# 6 - .ru
|
|
# 7 - .jp
|
|
# Add your own filter here :)
|
|
EXPIRATION_DATE="$( echo "$WHOIS_OUTPUT" | sed -n \
|
|
-e 's/^Registry Expiry Date:[[:space:]]\+//p' \
|
|
-e '/^[^[:space:]]/s/.*\(xpiry\|xpiration\) Date:[[:space:]]\+//p' \
|
|
-e 's/.*\(xpiry\|xpiration\) Date:[[:space:]]\+//p' \
|
|
-e 's/^expires\?:[[:space:]]*//p' \
|
|
-e 's/^Expire Date:[[:space:]]*//p' \
|
|
-e 's/^paid-till:[[:space:]]*//p' \
|
|
-e 's/^\[Expires on\][[:space:]]*//p' \
|
|
| sed 'q'
|
|
)"
|
|
|
|
# Small protection against injection
|
|
if [ -n "$( echo "$EXPIRATION_DATE" | LANG=C sed -n '/^[a-zA-Z0-9:.\-]\{1,64\}$/p' )" ]; then
|
|
date --date="$EXPIRATION_DATE" +%s
|
|
fi
|
|
}
|
|
|
|
|
|
#
|
|
# Check if arg is an integer
|
|
# (copied from jilles @ http://stackoverflow.com/questions/806906/how-do-i-test-if-a-variable-is-a-number-in-bash )
|
|
#
|
|
is_int() {
|
|
case "$1" in
|
|
''|*[!0-9]*) return 1;;
|
|
*) return 0;;
|
|
esac
|
|
}
|
|
|
|
|
|
# Some early checks
|
|
#if ! which jq >/dev/null 2>&1; then
|
|
# echo "UNKNOWN: 'jq' command not found."
|
|
# exit 1
|
|
#fi
|
|
|
|
|
|
#
|
|
# Parameters management
|
|
#
|
|
while [ "$#" -gt 0 ]; do
|
|
while getopts hw:c:iIrR f; do
|
|
case "$f" in
|
|
'h')
|
|
usage
|
|
exit
|
|
;;
|
|
|
|
'w')
|
|
THRESHOLD_WARNING="$( convert_to_seconds "$OPTARG" )"
|
|
;;
|
|
|
|
'c')
|
|
THRESHOLD_CRITICAL="$( convert_to_seconds "$OPTARG" )"
|
|
;;
|
|
|
|
'i')
|
|
OPTION_WHOIS_QUERYING="yes"
|
|
;;
|
|
|
|
'I')
|
|
OPTION_WHOIS_QUERYING=""
|
|
;;
|
|
|
|
'r')
|
|
OPTION_RDAP_QUERYING="yes"
|
|
;;
|
|
|
|
'R')
|
|
OPTION_RDAP_QUERYING=""
|
|
;;
|
|
|
|
\?)
|
|
usage
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
shift $( expr $OPTIND - 1 )
|
|
|
|
# Little checks
|
|
if ! is_int "$THRESHOLD_WARNING" || ! is_int "$THRESHOLD_CRITICAL"; then
|
|
echo "UNKNOWN invalid parameter : one of the threshold is not an integer."
|
|
exit $STATE_UNKNOWN
|
|
fi
|
|
|
|
# End of the options, we get the domain name
|
|
if [ -z "$1" ]; then
|
|
# No more options but no domain specified ? Weird but well...
|
|
break
|
|
fi
|
|
DOMAIN="$1"
|
|
shift
|
|
|
|
# Sleeping a bit to add some throttle if we already looped : we try not to
|
|
# flood the rdap/whois servers.
|
|
test -n "$EXPIRATION_DATE" && sleep 2
|
|
EXPIRATION_DATE=""
|
|
|
|
# Get the expiration date via RDAP
|
|
if [ -n "$OPTION_RDAP_QUERYING" ]; then
|
|
if OUTPUT_RDAP="$( get_expiration_date_rdap "$DOMAIN" )" && [ -n "$OUTPUT_RDAP" ]; then
|
|
EXPIRATION_DATE="$OUTPUT_RDAP"
|
|
fi
|
|
fi
|
|
# If RDAP failed to get an expiration date, we try via WHOIS.
|
|
if [ -z "$EXPIRATION_DATE" ] && [ -n "$OPTION_WHOIS_QUERYING" ]; then
|
|
if OUTPUT_WHOIS="$( get_expiration_date_whois "$DOMAIN" )" && [ -n "$OUTPUT_WHOIS" ]; then
|
|
EXPIRATION_DATE="$OUTPUT_WHOIS"
|
|
fi
|
|
fi
|
|
|
|
if [ -z "$EXPIRATION_DATE" ]; then
|
|
# We couldn't get the date :-(
|
|
if [ "$OUTPUT_EXIT_STATUS" -eq "$STATE_OK" ]; then
|
|
OUTPUT_EXIT_STATUS="$STATE_UNKNOWN"
|
|
fi
|
|
OUTPUT_DETAIL_UNKNOWN="$OUTPUT_DETAIL_UNKNOWN $DOMAIN:could_not_get_date (output_rdap: $OUTPUT_RDAP)(output_whois: $OUTPUT_WHOIS)"
|
|
break
|
|
fi
|
|
|
|
# Dispatch in the OK/Warning/Critical boxes
|
|
OUTPUT_DOMAIN_DETAIL="$DOMAIN:$( date --date=@$EXPIRATION_DATE +%FT%T%z)"
|
|
if [ "$EXPIRATION_DATE" -le "$( expr "$TIMESTAMP_NOW" + "$THRESHOLD_CRITICAL" )" ]; then
|
|
# Domain is critical
|
|
OUTPUT_EXIT_STATUS="$STATE_CRITICAL"
|
|
OUTPUT_DETAIL_CRITICAL="$OUTPUT_DETAIL_CRITICAL $OUTPUT_DOMAIN_DETAIL"
|
|
elif [ "$EXPIRATION_DATE" -le "$( expr "$TIMESTAMP_NOW" + "$THRESHOLD_WARNING" )" ]; then
|
|
# Domain is warning
|
|
OUTPUT_DETAIL_WARNING="$OUTPUT_DETAIL_WARNING $OUTPUT_DOMAIN_DETAIL"
|
|
# we don't change if the status is already Critical
|
|
# (but we take precedence over Unknown)
|
|
if [ "$OUTPUT_EXIT_STATUS" -ne "$STATE_CRITICAL" ]; then
|
|
OUTPUT_EXIT_STATUS="$STATE_WARNING"
|
|
fi
|
|
else
|
|
# Domain is Ok
|
|
OUTPUT_DETAIL_OK="$OUTPUT_DETAIL_OK $OUTPUT_DOMAIN_DETAIL"
|
|
fi
|
|
done
|
|
|
|
# final output
|
|
case "$OUTPUT_EXIT_STATUS" in
|
|
"$STATE_OK")
|
|
echo "OK $OUTPUT_DETAIL_OK"
|
|
;;
|
|
|
|
"$STATE_WARNING")
|
|
echo "WARNING $OUTPUT_DETAIL_WARNING"
|
|
;;
|
|
|
|
"$STATE_CRITICAL")
|
|
echo "CRITICAL $OUTPUT_DETAIL_CRITICAL"
|
|
;;
|
|
|
|
"$STATE_UNKNOWN")
|
|
echo "UNKNOWN $OUTPUT_DETAIL_UNKNOWN"
|
|
;;
|
|
|
|
*)
|
|
echo "WTF"
|
|
;;
|
|
esac
|
|
|
|
exit "$OUTPUT_EXIT_STATUS"
|