macOS Monitor - DNS Servers Script

#!/bin/bash

# This resource is provided as a convenience for Level users. We cannot 
# guarantee it will work in all environments. Please test before deploying 
# to your production environment. We welcome contributions to our community 
# library

# Level Library
# https://level.io/library/script-macos-monitor-dns-servers

# Configured expected DNS servers (comma-separated list)
expected_dns_servers_string="{{cf_dns}}"

# Convert the comma-separated list into an array
IFS=',' read -r -a expected_dns_servers <<< "$expected_dns_servers_string"

# Function to get current DNS servers
get_dns_servers() {
    scutil --dns | grep 'nameserver\[[0-9]*\]' | awk '{print $NF}'
}

# Function to check DNS servers
check_dns_servers() {
    local current_dns_servers=($(get_dns_servers))
    echo "Allowed DNS servers: ${expected_dns_servers[*]}"
    echo "Current DNS servers: ${current_dns_servers[*]}"

    if [ ${#current_dns_servers[@]} -eq 0 ]; then
        echo "ALERT: No DNS servers configured."
        exit 1
    fi

    local match_found=0
    for dns in "${current_dns_servers[@]}"; do
        if [[ " ${expected_dns_servers[*]} " == *" $dns "* ]]; then
            ((match_found++))
        fi
    done

    if [ $match_found -ne ${#current_dns_servers[@]} ]; then
        echo "ALERT: Not all DNS servers are in the allowed list."
        exit 1
    else
        echo "SUCCESS: DNS servers match the allowed list."
    fi
}

# Check if the DNS servers match the allowed list
check_dns_servers