#!/usr/bin/python
# -*- encoding: utf-8; py-indent-offset: 4 -*-
# +------------------------------------------------------------------+
# |             ____ _               _        __  __ _  __           |
# |            / ___| |__   ___  ___| | __   |  \/  | |/ /           |
# |           | |   | '_ \ / _ \/ __| |/ /   | |\/| | ' /            |
# |           | |___| | | |  __/ (__|   <    | |  | | . \            |
# |            \____|_| |_|\___|\___|_|\_\___|_|  |_|_|\_\           |
# |                                                                  |
# | Copyright Mathias Kettner 2016             mk@mathias-kettner.de |
# +------------------------------------------------------------------+
#
# This file is part of Check_MK.
# The official homepage is at http://mathias-kettner.de/check_mk.
#
# check_mk is free software;  you can redistribute it and/or modify it
# under the  terms of the  GNU General Public License  as published by
# the Free Software Foundation in version 2.  check_mk is  distributed
# in the hope that it will be useful, but WITHOUT ANY WARRANTY;  with-
# out even the implied warranty of  MERCHANTABILITY  or  FITNESS FOR A
# PARTICULAR PURPOSE. See the  GNU General Public License for more de-
# tails. You should have  received  a copy of the  GNU  General Public
# License along with GNU Make; see the file  COPYING.  If  not,  write
# to the Free Software Foundation, Inc., 51 Franklin St,  Fifth Floor,
# Boston, MA 02110-1301 USA.

# .1.3.6.1.4.1.12356.101.4.2.1.0 27.00768(2015-09-01 15:10)
# .1.3.6.1.4.1.12356.101.4.2.2.0 6.00689(2015-09-01 00:15)

# signature ages (defaults are 1/2 days)
factory_settings['fortigate_signature_default_levels'] = {
    'av_age': (86400, 172800),
    'ips_age': (86400, 172800),
}


def parse_fortigate_signatures(info):
    def parse_version(ver):
        # sample: 27.00768(2015-09-01 15:10)
        ver_regex = regex(r"([0-9.]*)\(([0-9-: ]*)\)")
        match = ver_regex.match(ver)
        if match is None:
            return None, None
        # what timezone is this in?
        t = time.strptime(match.group(2), "%Y-%m-%d %H:%S")
        ts = time.mktime(t)
        return match.group(1), time.time() - ts

    parsed = []
    for (key, title), value in zip([("av_age", "AV"), ("ips_age", "IPS"),
                                    ("av_ext_age", "AV extended"), ("ips_ext_age", "IPS extended")],
                                   info[0]):
        version, age = parse_version(value)
        parsed.append((key, title, version, age))
    return parsed


def inventory_fortigate_signatures(parsed):
    if parsed:
        return [(None, {})]


def check_fortigate_signatures(_no_item, params, parsed):
    for key, title, version, age in parsed:
        if age is None:
            continue
        infotext = "[%s] %s age: %s" % (version, title, get_age_human_readable(age))
        state = 0
        levels = params.get(key)
        if levels is not None:
            warn, crit = levels
            if crit is not None and age >= crit:
                state = 2
            elif warn is not None and age >= warn:
                state = 1
            if state:
                infotext += " (warn/crit at %s/%s)" % (get_age_human_readable(warn),
                                                       get_age_human_readable(crit))
        yield state, infotext


check_info['fortigate_signatures'] = {
    'parse_function': parse_fortigate_signatures,
    'inventory_function': inventory_fortigate_signatures,
    'check_function': check_fortigate_signatures,
    'service_description': "Signatures",
    'snmp_scan_function': lambda oid: ".1.3.6.1.4.1.12356.101.1" in oid(".1.3.6.1.2.1.1.2.0"),
    'snmp_info': (
        ".1.3.6.1.4.1.12356.101.4.2",
        [
            "1",  # FORTINET-FORTIGATE-MIB::fgSysVersionAv
            "2",  # FORTINET-FORTIGATE-MIB::fgSysVersionIps
            "3",  # FORTINET-FORTIGATE-MIB::fgSysVersionAvEt
            "4",  # FORTINET-FORTIGATE-MIB::fgSysVersionIpsEt
        ]),
    'default_levels_variable': "fortigate_signature_default_levels",
    'group': 'fortinet_signatures'
}
