check_ipsec

#!/bin/bash
# Check for phase 1 and 2 connection of a specific IPsec tunnel
#
# Author: Dave Simons <dave@simonsd.org>

# helper functions
die () {
  RETVAL=$1
  shift
  echo $@
  exit $RETVAL
}

help () {
cat <<EOF
Usage: $0 -t <TUNNEL_ID> [-n <NUMBER OF CONNECTIONS>]

Options:
 -h   display this help and exit
 -n   set desired number of connections
 -t   set tunnel id

Exit status:
  0   if OK
  1   if minor errors occured
  2   if critical errors occured
  3   if status unknown
EOF

exit 0
}

# Default values
NO_CONN='2'

# Parse command line switches
while getopts "hn:t:" OPTS; do
  case "$OPTS" in
    h) help ;;
    n) NO_CONN="$OPTARG" ;;
    t) TUNN_ID="$OPTARG" ;;
  esac
done

# Validate input
[[ -z "$TUNN_ID" ]] && die 2 "[ERROR] No tunnel id specified"

# Check config files
TUNN_CFG=$(grep -r "conn $TUNN_ID" /etc/ipsec.d/*.conf)
[ -z "$TUNN_CFG" ] && die 1 "[ERROR] No configuration found for tunnel id '${TUNN_ID}'"

# Check connection status
CONNECTIONS=$(ipsec whack --status|awk '/newest IPSEC/{ print $3 }')
CNT_CONN=$(echo -e $CONNECTIONS|grep -o "$TUNN_ID"|wc -l)
[[ "x${CNT_CONN}" != "x${NO_CONN}" ]] && die 2 "[ERROR] Connection with id '${TUNN_ID}' is down"

# exit through the door
die 0 "[OK] Connection with id '${TUNN_ID} is up"