#!/bin/bash

# Check if csf command exists
if ! command -v csf >/dev/null 2>&1; then
    echo "3 Status_CSF - UNKNOWN - CSF command not found"
    exit 0
fi

# Check CSF status by looking for "csf: x active" in the output
# We use 'csf -V' or checking the iptables rules
CSF_STATUS=$(csf -v | grep -i "version")
CSF_TEST_MODE=$(grep "^TESTING =" /etc/csf/csf.conf | awk '{print $3}' | tr -d '"')

# Check if iptables has CSF rules loaded
if iptables -L | grep -q "INVALID"; then
    if [ "$CSF_TEST_MODE" -eq 1 ]; then
        STATE=1
        STATUS_MSG="CSF is Running but in TESTING MODE"
    else
        STATE=0
        STATUS_MSG="CSF Firewall is ACTIVE"
    fi
else
    STATE=2
    STATUS_MSG="CSF Firewall is DOWN (Need: csf -e)"
fi

# Output for CheckMK
echo "$STATE Status_CSF - $STATUS_MSG"