plugins/check_curl.c

   1 /*****************************************************************************
   2 *
   3 * Monitoring check_curl plugin
   4 *
   5 * License: GPL
   6 * Copyright (c) 1999-2019 Monitoring Plugins Development Team
   7 *
   8 * Description:
   9 *
  10 * This file contains the check_curl plugin
  11 *
  12 * This plugin tests the HTTP service on the specified host. It can test
  13 * normal (http) and secure (https) servers, follow redirects, search for
  14 * strings and regular expressions, check connection times, and report on
  15 * certificate expiration times.
  16 *
  17 * This plugin uses functions from the curl library, see
  18 * http://curl.haxx.se
  19 *
  20 * This program is free software: you can redistribute it and/or modify
  21 * it under the terms of the GNU General Public License as published by
  22 * the Free Software Foundation, either version 3 of the License, or
  23 * (at your option) any later version.
  24 *
  25 * This program is distributed in the hope that it will be useful,
  26 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  27 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28 * GNU General Public License for more details.
  29 *
  30 * You should have received a copy of the GNU General Public License
  31 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  32 *
  33 *
  34 *****************************************************************************/
  35 const char *progname = "check_curl";
  36
  37 const char *copyright = "2006-2019";
  38 const char *email = "devel@monitoring-plugins.org";
  39
  40 #include <ctype.h>
  41
  42 #include "common.h"
  43 #include "utils.h"
  44
  45 #ifndef LIBCURL_PROTOCOL_HTTP
  46 #error libcurl compiled without HTTP support, compiling check_curl plugin does not makes a lot of sense
  47 #endif
  48
  49 #include "curl/curl.h"
  50 #include "curl/easy.h"
  51
  52 #include "picohttpparser.h"
  53
  54 #include "uriparser/Uri.h"
  55
  56 #include <arpa/inet.h>
  57
  58 #if defined(HAVE_SSL) && defined(USE_OPENSSL)
  59 #include <openssl/opensslv.h>
  60 #endif
  61
  62 #include <netdb.h>
  63
  64 #define MAKE_LIBCURL_VERSION(major, minor, patch) ((major)*0x10000 + (minor)*0x100 + (patch))
  65
  66 #define DEFAULT_BUFFER_SIZE 2048
  67 #define DEFAULT_SERVER_URL "/"
  68 #define HTTP_EXPECT "HTTP/"
  69 #define DEFAULT_MAX_REDIRS 15
  70 #define INET_ADDR_MAX_SIZE INET6_ADDRSTRLEN
  71 enum {
  72   MAX_IPV4_HOSTLENGTH = 255,
  73   HTTP_PORT = 80,
  74   HTTPS_PORT = 443,
  75   MAX_PORT = 65535
  76 };
  77
  78 enum {
  79   STICKY_NONE = 0,
  80   STICKY_HOST = 1,
  81   STICKY_PORT = 2
  82 };
  83
  84 enum {
  85   FOLLOW_HTTP_CURL = 0,
  86   FOLLOW_LIBCURL = 1
  87 };
  88
  89 /* for buffers for header and body */
  90 typedef struct {
  91   char *buf;
  92   size_t buflen;
  93   size_t bufsize;
  94 } curlhelp_write_curlbuf;
  95
  96 /* for buffering the data sent in PUT */
  97 typedef struct {
  98   char *buf;
  99   size_t buflen;
 100   off_t pos;
 101 } curlhelp_read_curlbuf;
 102
 103 /* for parsing the HTTP status line */
 104 typedef struct {
 105   int http_major;   /* major version of the protocol, always 1 (HTTP/0.9
 106                      * never reached the big internet most likely) */
 107   int http_minor;   /* minor version of the protocol, usually 0 or 1 */
 108   int http_code;    /* HTTP return code as in RFC 2145 */
 109   int http_subcode; /* Microsoft IIS extension, HTTP subcodes, see
 110                      * http://support.microsoft.com/kb/318380/en-us */
 111   const char *msg;  /* the human readable message */
 112   char *first_line; /* a copy of the first line */
 113 } curlhelp_statusline;
 114
 115 /* to know the underlying SSL library used by libcurl */
 116 typedef enum curlhelp_ssl_library {
 117   CURLHELP_SSL_LIBRARY_UNKNOWN,
 118   CURLHELP_SSL_LIBRARY_OPENSSL,
 119   CURLHELP_SSL_LIBRARY_LIBRESSL,
 120   CURLHELP_SSL_LIBRARY_GNUTLS,
 121   CURLHELP_SSL_LIBRARY_NSS
 122 } curlhelp_ssl_library;
 123
 124 enum {
 125   REGS = 2,
 126   MAX_RE_SIZE = 1024
 127 };
 128 #include "regex.h"
 129 regex_t preg;
 130 regmatch_t pmatch[REGS];
 131 char regexp[MAX_RE_SIZE];
 132 int cflags = REG_NOSUB | REG_EXTENDED | REG_NEWLINE;
 133 int errcode;
 134 int invert_regex = 0;
 135
 136 char *server_address = NULL;
 137 char *host_name = NULL;
 138 char *server_url = 0;
 139 char server_ip[DEFAULT_BUFFER_SIZE];
 140 struct curl_slist *server_ips = NULL;
 141 int specify_port = FALSE;
 142 unsigned short server_port = HTTP_PORT;
 143 unsigned short virtual_port = 0;
 144 int host_name_length;
 145 char output_header_search[30] = "";
 146 char output_string_search[30] = "";
 147 char *warning_thresholds = NULL;
 148 char *critical_thresholds = NULL;
 149 int days_till_exp_warn, days_till_exp_crit;
 150 thresholds *thlds;
 151 char user_agent[DEFAULT_BUFFER_SIZE];
 152 int verbose = 0;
 153 int show_extended_perfdata = FALSE;
 154 int show_body = FALSE;
 155 int min_page_len = 0;
 156 int max_page_len = 0;
 157 int redir_depth = 0;
 158 int max_depth = DEFAULT_MAX_REDIRS;
 159 char *http_method = NULL;
 160 char *http_post_data = NULL;
 161 char *http_content_type = NULL;
 162 CURL *curl;
 163 struct curl_slist *header_list = NULL;
 164 curlhelp_write_curlbuf body_buf;
 165 curlhelp_write_curlbuf header_buf;
 166 curlhelp_statusline status_line;
 167 curlhelp_read_curlbuf put_buf;
 168 char http_header[DEFAULT_BUFFER_SIZE];
 169 long code;
 170 long socket_timeout = DEFAULT_SOCKET_TIMEOUT;
 171 double total_time;
 172 double time_connect;
 173 double time_appconnect;
 174 double time_headers;
 175 double time_firstbyte;
 176 char errbuf[CURL_ERROR_SIZE+1];
 177 CURLcode res;
 178 char url[DEFAULT_BUFFER_SIZE];
 179 char msg[DEFAULT_BUFFER_SIZE];
 180 char perfstring[DEFAULT_BUFFER_SIZE];
 181 char header_expect[MAX_INPUT_BUFFER] = "";
 182 char string_expect[MAX_INPUT_BUFFER] = "";
 183 char server_expect[MAX_INPUT_BUFFER] = HTTP_EXPECT;
 184 int server_expect_yn = 0;
 185 char user_auth[MAX_INPUT_BUFFER] = "";
 186 char proxy_auth[MAX_INPUT_BUFFER] = "";
 187 char **http_opt_headers;
 188 int http_opt_headers_count = 0;
 189 int display_html = FALSE;
 190 int onredirect = STATE_OK;
 191 int followmethod = FOLLOW_HTTP_CURL;
 192 int followsticky = STICKY_NONE;
 193 int use_ssl = FALSE;
 194 int use_sni = TRUE;
 195 int check_cert = FALSE;
 196 typedef union {
 197   struct curl_slist* to_info;
 198   struct curl_certinfo* to_certinfo;
 199 } cert_ptr_union;
 200 cert_ptr_union cert_ptr;
 201 int ssl_version = CURL_SSLVERSION_DEFAULT;
 202 char *client_cert = NULL;
 203 char *client_privkey = NULL;
 204 char *ca_cert = NULL;
 205 int verify_peer_and_host = FALSE;
 206 int is_openssl_callback = FALSE;
 207 #if defined(HAVE_SSL) && defined(USE_OPENSSL)
 208 X509 *cert = NULL;
 209 #endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */
 210 int no_body = FALSE;
 211 int maximum_age = -1;
 212 int address_family = AF_UNSPEC;
 213 curlhelp_ssl_library ssl_library = CURLHELP_SSL_LIBRARY_UNKNOWN;
 214 int curl_http_version = CURL_HTTP_VERSION_NONE;
 215 int automatic_decompression = FALSE;
 216
 217 int process_arguments (int, char**);
 218 void handle_curl_option_return_code (CURLcode res, const char* option);
 219 int check_http (void);
 220 void redir (curlhelp_write_curlbuf*);
 221 char *perfd_time (double microsec);
 222 char *perfd_time_connect (double microsec);
 223 char *perfd_time_ssl (double microsec);
 224 char *perfd_time_firstbyte (double microsec);
 225 char *perfd_time_headers (double microsec);
 226 char *perfd_time_transfer (double microsec);
 227 char *perfd_size (int page_len);
 228 void print_help (void);
 229 void print_usage (void);
 230 void print_curl_version (void);
 231 int curlhelp_initwritebuffer (curlhelp_write_curlbuf*);
 232 int curlhelp_buffer_write_callback (void*, size_t , size_t , void*);
 233 void curlhelp_freewritebuffer (curlhelp_write_curlbuf*);
 234 int curlhelp_initreadbuffer (curlhelp_read_curlbuf *, const char *, size_t);
 235 int curlhelp_buffer_read_callback (void *, size_t , size_t , void *);
 236 void curlhelp_freereadbuffer (curlhelp_read_curlbuf *);
 237 curlhelp_ssl_library curlhelp_get_ssl_library (CURL*);
 238 const char* curlhelp_get_ssl_library_string (curlhelp_ssl_library);
 239 int net_noopenssl_check_certificate (cert_ptr_union*, int, int);
 240
 241 int curlhelp_parse_statusline (const char*, curlhelp_statusline *);
 242 void curlhelp_free_statusline (curlhelp_statusline *);
 243 char *get_header_value (const struct phr_header* headers, const size_t nof_headers, const char* header);
 244 int check_document_dates (const curlhelp_write_curlbuf *, char (*msg)[DEFAULT_BUFFER_SIZE]);
 245 int get_content_length (const curlhelp_write_curlbuf* header_buf, const curlhelp_write_curlbuf* body_buf);
 246
 247 #if defined(HAVE_SSL) && defined(USE_OPENSSL)
 248 int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int days_till_exp_crit);
 249 #endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */
 250
 251 void remove_newlines (char *);
 252 void test_file (char *);
 253
 254 int
 255 main (int argc, char **argv)
 256 {
 257   int result = STATE_UNKNOWN;
 258
 259   setlocale (LC_ALL, "");
 260   bindtextdomain (PACKAGE, LOCALEDIR);
 261   textdomain (PACKAGE);
 262
 263   /* Parse extra opts if any */
 264   argv = np_extra_opts (&argc, argv, progname);
 265
 266   /* set defaults */
 267   snprintf( user_agent, DEFAULT_BUFFER_SIZE, "%s/v%s (monitoring-plugins %s, %s)",
 268     progname, NP_VERSION, VERSION, curl_version());
 269
 270   /* parse arguments */
 271   if (process_arguments (argc, argv) == ERROR)
 272     usage4 (_("Could not parse arguments"));
 273
 274   if (display_html == TRUE)
 275     printf ("<A HREF=\"%s://%s:%d%s\" target=\"_blank\">",
 276       use_ssl ? "https" : "http",
 277       host_name ? host_name : server_address,
 278       virtual_port ? virtual_port : server_port,
 279       server_url);
 280
 281   result = check_http ();
 282   return result;
 283 }
 284
 285 #ifdef HAVE_SSL
 286 #ifdef USE_OPENSSL
 287
 288 int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
 289 {
 290   /* TODO: we get all certificates of the chain, so which ones
 291    * should we test?
 292    * TODO: is the last certificate always the server certificate?
 293    */
 294   cert = X509_STORE_CTX_get_current_cert(x509_ctx);
 295 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
 296   X509_up_ref(cert);
 297 #endif
 298   if (verbose>=2) {
 299     puts("* SSL verify callback with certificate:");
 300     X509_NAME *subject, *issuer;
 301     printf("*   issuer:\n");
 302     issuer = X509_get_issuer_name( cert );
 303     X509_NAME_print_ex_fp(stdout, issuer, 5, XN_FLAG_MULTILINE);
 304     printf("* curl verify_callback:\n*   subject:\n");
 305     subject = X509_get_subject_name( cert );
 306     X509_NAME_print_ex_fp(stdout, subject, 5, XN_FLAG_MULTILINE);
 307     puts("");
 308   }
 309   return 1;
 310 }
 311
 312 CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm)
 313 {
 314   SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER, verify_callback);
 315
 316   return CURLE_OK;
 317 }
 318
 319 #endif /* USE_OPENSSL */
 320 #endif /* HAVE_SSL */
 321
 322 /* returns a string "HTTP/1.x" or "HTTP/2" */
 323 static char *string_statuscode (int major, int minor)
 324 {
 325   static char buf[10];
 326
 327   switch (major) {
 328     case 1:
 329       snprintf (buf, sizeof (buf), "HTTP/%d.%d", major, minor);
 330       break;
 331     case 2:
 332     case 3:
 333       snprintf (buf, sizeof (buf), "HTTP/%d", major);
 334       break;
 335     default:
 336       /* assuming here HTTP/N with N>=4 */
 337       snprintf (buf, sizeof (buf), "HTTP/%d", major);
 338       break;
 339   }
 340
 341   return buf;
 342 }
 343
 344 /* Checks if the server 'reply' is one of the expected 'statuscodes' */
 345 static int
 346 expected_statuscode (const char *reply, const char *statuscodes)
 347 {
 348   char *expected, *code;
 349   int result = 0;
 350
 351   if ((expected = strdup (statuscodes)) == NULL)
 352     die (STATE_UNKNOWN, _("HTTP UNKNOWN - Memory allocation error\n"));
 353
 354   for (code = strtok (expected, ","); code != NULL; code = strtok (NULL, ","))
 355     if (strstr (reply, code) != NULL) {
 356       result = 1;
 357       break;
 358     }
 359
 360   free (expected);
 361   return result;
 362 }
 363
 364 void
 365 handle_curl_option_return_code (CURLcode res, const char* option)
 366 {
 367   if (res != CURLE_OK) {
 368     snprintf (msg, DEFAULT_BUFFER_SIZE, _("Error while setting cURL option '%s': cURL returned %d - %s"),
 369       option, res, curl_easy_strerror(res));
 370     die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
 371   }
 372 }
 373
 374 int
 375 lookup_host (const char *host, char *buf, size_t buflen)
 376 {
 377   struct addrinfo hints, *res, *result;
 378   int errcode;
 379   void *ptr;
 380
 381   memset (&hints, 0, sizeof (hints));
 382   hints.ai_family = address_family;
 383   hints.ai_socktype = SOCK_STREAM;
 384   hints.ai_flags |= AI_CANONNAME;
 385
 386   errcode = getaddrinfo (host, NULL, &hints, &result);
 387   if (errcode != 0)
 388     return errcode;
 389
 390   res = result;
 391
 392   while (res) {
 393   inet_ntop (res->ai_family, res->ai_addr->sa_data, buf, buflen);
 394   switch (res->ai_family) {
 395     case AF_INET:
 396       ptr = &((struct sockaddr_in *) res->ai_addr)->sin_addr;
 397       break;
 398     case AF_INET6:
 399       ptr = &((struct sockaddr_in6 *) res->ai_addr)->sin6_addr;
 400     break;
 401     }
 402     inet_ntop (res->ai_family, ptr, buf, buflen);
 403     if (verbose >= 1)
 404       printf ("* getaddrinfo IPv%d address: %s\n",
 405         res->ai_family == PF_INET6 ? 6 : 4, buf);
 406     res = res->ai_next;
 407   }
 408
 409   freeaddrinfo(result);
 410
 411   return 0;
 412 }
 413
 414 int
 415 check_http (void)
 416 {
 417   int result = STATE_OK;
 418   int page_len = 0;
 419   int i;
 420   char *force_host_header = NULL;
 421   struct curl_slist *host = NULL;
 422   char addrstr[100];
 423   char dnscache[DEFAULT_BUFFER_SIZE];
 424
 425   /* initialize curl */
 426   if (curl_global_init (CURL_GLOBAL_DEFAULT) != CURLE_OK)
 427     die (STATE_UNKNOWN, "HTTP UNKNOWN - curl_global_init failed\n");
 428
 429   if ((curl = curl_easy_init()) == NULL)
 430     die (STATE_UNKNOWN, "HTTP UNKNOWN - curl_easy_init failed\n");
 431
 432   if (verbose >= 1)
 433     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_VERBOSE, TRUE), "CURLOPT_VERBOSE");
 434
 435   /* print everything on stdout like check_http would do */
 436   handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_STDERR, stdout), "CURLOPT_STDERR");
 437
 438   if (automatic_decompression)
 439 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 21, 6)
 440     handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""), "CURLOPT_ACCEPT_ENCODING");
 441 #else
 442     handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_ENCODING, ""), "CURLOPT_ENCODING");
 443 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 21, 6) */
 444
 445   /* initialize buffer for body of the answer */
 446   if (curlhelp_initwritebuffer(&body_buf) < 0)
 447     die (STATE_UNKNOWN, "HTTP CRITICAL - out of memory allocating buffer for body\n");
 448   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)curlhelp_buffer_write_callback), "CURLOPT_WRITEFUNCTION");
 449   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_WRITEDATA, (void *)&body_buf), "CURLOPT_WRITEDATA");
 450
 451   /* initialize buffer for header of the answer */
 452   if (curlhelp_initwritebuffer( &header_buf ) < 0)
 453     die (STATE_UNKNOWN, "HTTP CRITICAL - out of memory allocating buffer for header\n" );
 454   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_HEADERFUNCTION, (curl_write_callback)curlhelp_buffer_write_callback), "CURLOPT_HEADERFUNCTION");
 455   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_WRITEHEADER, (void *)&header_buf), "CURLOPT_WRITEHEADER");
 456
 457   /* set the error buffer */
 458   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_ERRORBUFFER, errbuf), "CURLOPT_ERRORBUFFER");
 459
 460   /* set timeouts */
 461   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CONNECTTIMEOUT, socket_timeout), "CURLOPT_CONNECTTIMEOUT");
 462   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_TIMEOUT, socket_timeout), "CURLOPT_TIMEOUT");
 463
 464   // fill dns resolve cache to make curl connect to the given server_address instead of the host_name, only required for ssl, because we use the host_name later on to make SNI happy
 465   if(use_ssl && host_name != NULL) {
 466       if ( (res=lookup_host (server_address, addrstr, 100)) != 0) {
 467         snprintf (msg, DEFAULT_BUFFER_SIZE, _("Unable to lookup IP address for '%s': getaddrinfo returned %d - %s"),
 468           server_address, res, gai_strerror (res));
 469         die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
 470       }
 471       snprintf (dnscache, DEFAULT_BUFFER_SIZE, "%s:%d:%s", host_name, server_port, addrstr);
 472       host = curl_slist_append(NULL, dnscache);
 473       curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
 474       if (verbose>=1)
 475         printf ("* curl CURLOPT_RESOLVE: %s\n", dnscache);
 476   }
 477
 478   /* compose URL: use the address we want to connect to, set Host: header later */
 479   snprintf (url, DEFAULT_BUFFER_SIZE, "%s://%s:%d%s",
 480       use_ssl ? "https" : "http",
 481       use_ssl & host_name != NULL ? host_name : server_address,
 482       server_port,
 483       server_url
 484   );
 485
 486   if (verbose>=1)
 487     printf ("* curl CURLOPT_URL: %s\n", url);
 488   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_URL, url), "CURLOPT_URL");
 489
 490   /* extract proxy information for legacy proxy https requests */
 491   if (!strcmp(http_method, "CONNECT") || strstr(server_url, "http") == server_url) {
 492     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_PROXY, server_address), "CURLOPT_PROXY");
 493     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_PROXYPORT, (long)server_port), "CURLOPT_PROXYPORT");
 494     if (verbose>=2)
 495       printf ("* curl CURLOPT_PROXY: %s:%d\n", server_address, server_port);
 496     http_method = "GET";
 497     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_URL, server_url), "CURLOPT_URL");
 498   }
 499
 500   /* disable body for HEAD request */
 501   if (http_method && !strcmp (http_method, "HEAD" )) {
 502     no_body = TRUE;
 503   }
 504
 505   /* set HTTP protocol version */
 506   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_HTTP_VERSION, curl_http_version), "CURLOPT_HTTP_VERSION");
 507
 508   /* set HTTP method */
 509   if (http_method) {
 510     if (!strcmp(http_method, "POST"))
 511       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_POST, 1), "CURLOPT_POST");
 512     else if (!strcmp(http_method, "PUT"))
 513       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_UPLOAD, 1), "CURLOPT_UPLOAD");
 514     else
 515       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CUSTOMREQUEST, http_method), "CURLOPT_CUSTOMREQUEST");
 516   }
 517
 518   /* check if Host header is explicitly set in options */
 519   if (http_opt_headers_count) {
 520     for (i = 0; i < http_opt_headers_count ; i++) {
 521       if (strncmp(http_opt_headers[i], "Host:", 5) == 0) {
 522         force_host_header = http_opt_headers[i];
 523       }
 524     }
 525   }
 526
 527   /* set hostname (virtual hosts), not needed if CURLOPT_CONNECT_TO is used, but left in anyway */
 528   if(host_name != NULL && force_host_header == NULL) {
 529     if((virtual_port != HTTP_PORT && !use_ssl) || (virtual_port != HTTPS_PORT && use_ssl)) {
 530       snprintf(http_header, DEFAULT_BUFFER_SIZE, "Host: %s:%d", host_name, virtual_port);
 531     } else {
 532       snprintf(http_header, DEFAULT_BUFFER_SIZE, "Host: %s", host_name);
 533     }
 534     header_list = curl_slist_append (header_list, http_header);
 535   }
 536
 537   /* always close connection, be nice to servers */
 538   snprintf (http_header, DEFAULT_BUFFER_SIZE, "Connection: close");
 539   header_list = curl_slist_append (header_list, http_header);
 540
 541   /* attach additional headers supplied by the user */
 542   /* optionally send any other header tag */
 543   if (http_opt_headers_count) {
 544     for (i = 0; i < http_opt_headers_count ; i++) {
 545       header_list = curl_slist_append (header_list, http_opt_headers[i]);
 546     }
 547     /* This cannot be free'd here because a redirection will then try to access this and segfault */
 548     /* Covered in a testcase in tests/check_http.t */
 549     /* free(http_opt_headers); */
 550   }
 551
 552   /* set HTTP headers */
 553   handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_HTTPHEADER, header_list ), "CURLOPT_HTTPHEADER");
 554
 555 #ifdef LIBCURL_FEATURE_SSL
 556
 557   /* set SSL version, warn about unsecure or unsupported versions */
 558   if (use_ssl) {
 559     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSLVERSION, ssl_version), "CURLOPT_SSLVERSION");
 560   }
 561
 562   /* client certificate and key to present to server (SSL) */
 563   if (client_cert)
 564     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSLCERT, client_cert), "CURLOPT_SSLCERT");
 565   if (client_privkey)
 566     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSLKEY, client_privkey), "CURLOPT_SSLKEY");
 567   if (ca_cert) {
 568     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CAINFO, ca_cert), "CURLOPT_CAINFO");
 569   }
 570   if (ca_cert || verify_peer_and_host) {
 571     /* per default if we have a CA verify both the peer and the
 572      * hostname in the certificate, can be switched off later */
 573     handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_SSL_VERIFYPEER, 1), "CURLOPT_SSL_VERIFYPEER");
 574     handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_SSL_VERIFYHOST, 2), "CURLOPT_SSL_VERIFYHOST");
 575   } else {
 576     /* backward-compatible behaviour, be tolerant in checks
 577      * TODO: depending on more options have aspects we want
 578      * to be less tolerant about ssl verfications
 579      */
 580     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSL_VERIFYPEER, 0), "CURLOPT_SSL_VERIFYPEER");
 581     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSL_VERIFYHOST, 0), "CURLOPT_SSL_VERIFYHOST");
 582   }
 583
 584   /* detect SSL library used by libcurl */
 585   ssl_library = curlhelp_get_ssl_library (curl);
 586
 587   /* try hard to get a stack of certificates to verify against */
 588   if (check_cert) {
 589 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 1)
 590     /* inform curl to report back certificates */
 591     switch (ssl_library) {
 592       case CURLHELP_SSL_LIBRARY_OPENSSL:
 593       case CURLHELP_SSL_LIBRARY_LIBRESSL:
 594         /* set callback to extract certificate with OpenSSL context function (works with
 595          * OpenSSL-style libraries only!) */
 596 #ifdef USE_OPENSSL
 597         /* libcurl and monitoring plugins built with OpenSSL, good */
 598         handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun), "CURLOPT_SSL_CTX_FUNCTION");
 599         is_openssl_callback = TRUE;
 600 #else /* USE_OPENSSL */
 601 #endif /* USE_OPENSSL */
 602         /* libcurl is built with OpenSSL, monitoring plugins, so falling
 603          * back to manually extracting certificate information */
 604         handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CERTINFO, 1L), "CURLOPT_CERTINFO");
 605         break;
 606
 607       case CURLHELP_SSL_LIBRARY_NSS:
 608 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
 609         /* NSS: support for CERTINFO is implemented since 7.34.0 */
 610         handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CERTINFO, 1L), "CURLOPT_CERTINFO");
 611 #else /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
 612         die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (libcurl linked with SSL library '%s' is too old)\n", curlhelp_get_ssl_library_string (ssl_library));
 613 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
 614         break;
 615
 616       case CURLHELP_SSL_LIBRARY_GNUTLS:
 617 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 42, 0)
 618         /* GnuTLS: support for CERTINFO is implemented since 7.42.0 */
 619         handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CERTINFO, 1L), "CURLOPT_CERTINFO");
 620 #else /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 42, 0) */
 621         die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (libcurl linked with SSL library '%s' is too old)\n", curlhelp_get_ssl_library_string (ssl_library));
 622 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 42, 0) */
 623         break;
 624
 625       case CURLHELP_SSL_LIBRARY_UNKNOWN:
 626       default:
 627         die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (unknown SSL library '%s', must implement first)\n", curlhelp_get_ssl_library_string (ssl_library));
 628         break;
 629     }
 630 #else /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 1) */
 631     /* old libcurl, our only hope is OpenSSL, otherwise we are out of luck */
 632     if (ssl_library == CURLHELP_SSL_LIBRARY_OPENSSL || ssl_library == CURLHELP_SSL_LIBRARY_LIBRESSL)
 633       handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun), "CURLOPT_SSL_CTX_FUNCTION");
 634     else
 635       die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (no CURLOPT_SSL_CTX_FUNCTION, no OpenSSL library or libcurl too old and has no CURLOPT_CERTINFO)\n");
 636 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 1) */
 637   }
 638
 639 #endif /* LIBCURL_FEATURE_SSL */
 640
 641   /* set default or user-given user agent identification */
 642   handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_USERAGENT, user_agent), "CURLOPT_USERAGENT");
 643
 644   /* proxy-authentication */
 645   if (strcmp(proxy_auth, ""))
 646     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_PROXYUSERPWD, proxy_auth), "CURLOPT_PROXYUSERPWD");
 647
 648   /* authentication */
 649   if (strcmp(user_auth, ""))
 650     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_USERPWD, user_auth), "CURLOPT_USERPWD");
 651
 652   /* TODO: parameter auth method, bitfield of following methods:
 653    * CURLAUTH_BASIC (default)
 654    * CURLAUTH_DIGEST
 655    * CURLAUTH_DIGEST_IE
 656    * CURLAUTH_NEGOTIATE
 657    * CURLAUTH_NTLM
 658    * CURLAUTH_NTLM_WB
 659    *
 660    * convenience tokens for typical sets of methods:
 661    * CURLAUTH_ANYSAFE: most secure, without BASIC
 662    * or CURLAUTH_ANY: most secure, even BASIC if necessary
 663    *
 664    * handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_DIGEST ), "CURLOPT_HTTPAUTH");
 665    */
 666
 667   /* handle redirections */
 668   if (onredirect == STATE_DEPENDENT) {
 669     if( followmethod == FOLLOW_LIBCURL ) {
 670       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_FOLLOWLOCATION, 1), "CURLOPT_FOLLOWLOCATION");
 671
 672       /* default -1 is infinite, not good, could lead to zombie plugins!
 673          Setting it to one bigger than maximal limit to handle errors nicely below
 674        */
 675       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_MAXREDIRS, max_depth+1), "CURLOPT_MAXREDIRS");
 676
 677       /* for now allow only http and https (we are a http(s) check plugin in the end) */
 678 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 4)
 679       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS), "CURLOPT_REDIRECT_PROTOCOLS");
 680 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 4) */
 681
 682       /* TODO: handle the following aspects of redirection, make them
 683        * command line options too later:
 684         CURLOPT_POSTREDIR: method switch
 685         CURLINFO_REDIRECT_URL: custom redirect option
 686         CURLOPT_REDIRECT_PROTOCOLS: allow people to step outside safe protocols
 687         CURLINFO_REDIRECT_COUNT: get the number of redirects, print it, maybe a range option here is nice like for expected page size?
 688       */
 689     } else {
 690       /* old style redirection is handled below */
 691     }
 692   }
 693
 694   /* no-body */
 695   if (no_body)
 696     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_NOBODY, 1), "CURLOPT_NOBODY");
 697
 698   /* IPv4 or IPv6 forced DNS resolution */
 699   if (address_family == AF_UNSPEC)
 700     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_WHATEVER), "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_WHATEVER)");
 701   else if (address_family == AF_INET)
 702     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4), "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_V4)");
 703 #if defined (USE_IPV6) && defined (LIBCURL_FEATURE_IPV6)
 704   else if (address_family == AF_INET6)
 705     handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6), "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_V6)");
 706 #endif
 707
 708   /* either send http POST data (any data, not only POST)*/
 709   if (!strcmp(http_method, "POST") ||!strcmp(http_method, "PUT")) {
 710     /* set content of payload for POST and PUT */
 711     if (http_content_type) {
 712       snprintf (http_header, DEFAULT_BUFFER_SIZE, "Content-Type: %s", http_content_type);
 713       header_list = curl_slist_append (header_list, http_header);
 714     }
 715     /* NULL indicates "HTTP Continue" in libcurl, provide an empty string
 716      * in case of no POST/PUT data */
 717     if (!http_post_data)
 718       http_post_data = "";
 719     if (!strcmp(http_method, "POST")) {
 720       /* POST method, set payload with CURLOPT_POSTFIELDS */
 721       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_POSTFIELDS, http_post_data), "CURLOPT_POSTFIELDS");
 722     } else if (!strcmp(http_method, "PUT")) {
 723       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_READFUNCTION, (curl_read_callback)curlhelp_buffer_read_callback), "CURLOPT_READFUNCTION");
 724       curlhelp_initreadbuffer (&put_buf, http_post_data, strlen (http_post_data));
 725       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_READDATA, (void *)&put_buf), "CURLOPT_READDATA");
 726       handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_INFILESIZE, (curl_off_t)strlen (http_post_data)), "CURLOPT_INFILESIZE");
 727     }
 728   }
 729
 730   /* do the request */
 731   res = curl_easy_perform(curl);
 732
 733   if (verbose>=2 && http_post_data)
 734     printf ("**** REQUEST CONTENT ****\n%s\n", http_post_data);
 735
 736   /* free header and server IP resolve lists, we don't need it anymore */
 737   curl_slist_free_all (header_list); header_list = NULL;
 738   curl_slist_free_all (server_ips); server_ips = NULL;
 739
 740   /* Curl errors, result in critical Nagios state */
 741   if (res != CURLE_OK) {
 742     snprintf (msg, DEFAULT_BUFFER_SIZE, _("Invalid HTTP response received from host on port %d: cURL returned %d - %s"),
 743       server_port, res, errbuf[0] ? errbuf : curl_easy_strerror(res));
 744     die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
 745   }
 746
 747   /* certificate checks */
 748 #ifdef LIBCURL_FEATURE_SSL
 749   if (use_ssl == TRUE) {
 750     if (check_cert == TRUE) {
 751       if (is_openssl_callback) {
 752 #ifdef USE_OPENSSL
 753         /* check certificate with OpenSSL functions, curl has been built against OpenSSL
 754          * and we actually have OpenSSL in the monitoring tools
 755          */
 756         result = np_net_ssl_check_certificate(cert, days_till_exp_warn, days_till_exp_crit);
 757         return result;
 758 #else /* USE_OPENSSL */
 759         die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates - OpenSSL callback used and not linked against OpenSSL\n");
 760 #endif /* USE_OPENSSL */
 761       } else {
 762         int i;
 763         struct curl_slist *slist;
 764
 765         cert_ptr.to_info = NULL;
 766         res = curl_easy_getinfo (curl, CURLINFO_CERTINFO, &cert_ptr.to_info);
 767         if (!res && cert_ptr.to_info) {
 768 #ifdef USE_OPENSSL
 769           /* We have no OpenSSL in libcurl, but we can use OpenSSL for X509 cert parsing
 770            * We only check the first certificate and assume it's the one of the server
 771            */
 772           const char* raw_cert = NULL;
 773           for (i = 0; i < cert_ptr.to_certinfo->num_of_certs; i++) {
 774             for (slist = cert_ptr.to_certinfo->certinfo[i]; slist; slist = slist->next) {
 775               if (verbose >= 2)
 776                 printf ("%d ** %s\n", i, slist->data);
 777               if (strncmp (slist->data, "Cert:", 5) == 0) {
 778                 raw_cert = &slist->data[5];
 779                 goto GOT_FIRST_CERT;
 780               }
 781             }
 782           }
 783 GOT_FIRST_CERT:
 784           if (!raw_cert) {
 785             snprintf (msg, DEFAULT_BUFFER_SIZE, _("Cannot retrieve certificates from CERTINFO information - certificate data was empty"));
 786             die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
 787           }
 788           BIO* cert_BIO = BIO_new (BIO_s_mem());
 789           BIO_write (cert_BIO, raw_cert, strlen(raw_cert));
 790           cert = PEM_read_bio_X509 (cert_BIO, NULL, NULL, NULL);
 791           if (!cert) {
 792             snprintf (msg, DEFAULT_BUFFER_SIZE, _("Cannot read certificate from CERTINFO information - BIO error"));
 793             die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
 794           }
 795           BIO_free (cert_BIO);
 796           result = np_net_ssl_check_certificate(cert, days_till_exp_warn, days_till_exp_crit);
 797           return result;
 798 #else /* USE_OPENSSL */
 799           /* We assume we don't have OpenSSL and np_net_ssl_check_certificate at our disposal,
 800            * so we use the libcurl CURLINFO data
 801            */
 802           result = net_noopenssl_check_certificate(&cert_ptr, days_till_exp_warn, days_till_exp_crit);
 803           return result;
 804 #endif /* USE_OPENSSL */
 805         } else {
 806           snprintf (msg, DEFAULT_BUFFER_SIZE, _("Cannot retrieve certificates - cURL returned %d - %s"),
 807             res, curl_easy_strerror(res));
 808           die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
 809         }
 810       }
 811     }
 812   }
 813 #endif /* LIBCURL_FEATURE_SSL */
 814
 815   /* we got the data and we executed the request in a given time, so we can append
 816    * performance data to the answer always
 817    */
 818   handle_curl_option_return_code (curl_easy_getinfo (curl, CURLINFO_TOTAL_TIME, &total_time), "CURLINFO_TOTAL_TIME");
 819   page_len = get_content_length(&header_buf, &body_buf);
 820   if(show_extended_perfdata) {
 821     handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &time_connect), "CURLINFO_CONNECT_TIME");
 822     handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME, &time_appconnect), "CURLINFO_APPCONNECT_TIME");
 823     handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME, &time_headers), "CURLINFO_PRETRANSFER_TIME");
 824     handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME, &time_firstbyte), "CURLINFO_STARTTRANSFER_TIME");
 825     snprintf(perfstring, DEFAULT_BUFFER_SIZE, "%s %s %s %s %s %s %s",
 826       perfd_time(total_time),
 827       perfd_size(page_len),
 828       perfd_time_connect(time_connect),
 829       use_ssl == TRUE ? perfd_time_ssl (time_appconnect-time_connect) : "",
 830       perfd_time_headers(time_headers - time_appconnect),
 831       perfd_time_firstbyte(time_firstbyte - time_headers),
 832       perfd_time_transfer(total_time-time_firstbyte)
 833     );
 834   } else {
 835     snprintf(perfstring, DEFAULT_BUFFER_SIZE, "%s %s",
 836       perfd_time(total_time),
 837       perfd_size(page_len)
 838     );
 839   }
 840
 841   /* return a CRITICAL status if we couldn't read any data */
 842   if (strlen(header_buf.buf) == 0 && strlen(body_buf.buf) == 0)
 843     die (STATE_CRITICAL, _("HTTP CRITICAL - No header received from host\n"));
 844
 845   /* get status line of answer, check sanity of HTTP code */
 846   if (curlhelp_parse_statusline (header_buf.buf, &status_line) < 0) {
 847     snprintf (msg, DEFAULT_BUFFER_SIZE, "Unparsable status line in %.3g seconds response time|%s\n",
 848       total_time, perfstring);
 849     /* we cannot know the major/minor version here for sure as we cannot parse the first line */
 850     die (STATE_CRITICAL, "HTTP CRITICAL HTTP/x.x %ld unknown - %s", code, msg);
 851   }
 852
 853   /* get result code from cURL */
 854   handle_curl_option_return_code (curl_easy_getinfo (curl, CURLINFO_RESPONSE_CODE, &code), "CURLINFO_RESPONSE_CODE");
 855   if (verbose>=2)
 856     printf ("* curl CURLINFO_RESPONSE_CODE is %ld\n", code);
 857
 858   /* print status line, header, body if verbose */
 859   if (verbose >= 2) {
 860     printf ("**** HEADER ****\n%s\n**** CONTENT ****\n%s\n", header_buf.buf,
 861                 (no_body ? "  [[ skipped ]]" : body_buf.buf));
 862   }
 863
 864   /* make sure the status line matches the response we are looking for */
 865   if (!expected_statuscode(status_line.first_line, server_expect)) {
 866     if (server_port == HTTP_PORT)
 867       snprintf(msg, DEFAULT_BUFFER_SIZE, _("Invalid HTTP response received from host: %s\n"), status_line.first_line);
 868     else
 869       snprintf(msg, DEFAULT_BUFFER_SIZE, _("Invalid HTTP response received from host on port %d: %s\n"), server_port, status_line.first_line);
 870     die (STATE_CRITICAL, "HTTP CRITICAL - %s%s%s", msg,
 871       show_body ? "\n" : "",
 872       show_body ? body_buf.buf : "");
 873   }
 874
 875   if( server_expect_yn  )  {
 876     snprintf(msg, DEFAULT_BUFFER_SIZE, _("Status line output matched \"%s\" - "), server_expect);
 877     if (verbose)
 878       printf ("%s\n",msg);
 879     result = STATE_OK;
 880   }
 881   else {
 882     /* illegal return codes result in a critical state */
 883     if (code >= 600 || code < 100) {
 884       die (STATE_CRITICAL, _("HTTP CRITICAL: Invalid Status (%d, %.40s)\n"), status_line.http_code, status_line.msg);
 885     /* server errors result in a critical state */
 886         } else if (code >= 500) {
 887       result = STATE_CRITICAL;
 888         /* client errors result in a warning state */
 889     } else if (code >= 400) {
 890       result = STATE_WARNING;
 891     /* check redirected page if specified */
 892     } else if (code >= 300) {
 893       if (onredirect == STATE_DEPENDENT) {
 894         if( followmethod == FOLLOW_LIBCURL ) {
 895           code = status_line.http_code;
 896         } else {
 897           /* old check_http style redirection, if we come
 898            * back here, we are in the same status as with
 899            * the libcurl method
 900            */
 901           redir (&header_buf);
 902         }
 903       } else {
 904         /* this is a specific code in the command line to
 905          * be returned when a redirection is encoutered
 906          */
 907       }
 908       result = max_state_alt (onredirect, result);
 909     /* all other codes are considered ok */
 910     } else {
 911       result = STATE_OK;
 912     }
 913   }
 914
 915   /* libcurl redirection internally, handle error states here */
 916   if( followmethod == FOLLOW_LIBCURL ) {
 917     handle_curl_option_return_code (curl_easy_getinfo (curl, CURLINFO_REDIRECT_COUNT, &redir_depth), "CURLINFO_REDIRECT_COUNT");
 918     if (verbose >= 2)
 919       printf(_("* curl LIBINFO_REDIRECT_COUNT is %d\n"), redir_depth);
 920     if (redir_depth > max_depth) {
 921       snprintf (msg, DEFAULT_BUFFER_SIZE, "maximum redirection depth %d exceeded in libcurl",
 922         max_depth);
 923       die (STATE_WARNING, "HTTP WARNING - %s", msg);
 924     }
 925   }
 926
 927   /* check status codes, set exit status accordingly */
 928   if( status_line.http_code != code ) {
 929     die (STATE_CRITICAL, _("HTTP CRITICAL %s %d %s - different HTTP codes (cUrl has %ld)\n"),
 930       string_statuscode (status_line.http_major, status_line.http_minor),
 931       status_line.http_code, status_line.msg, code);
 932   }
 933
 934   if (maximum_age >= 0) {
 935     result = max_state_alt(check_document_dates(&header_buf, &msg), result);
 936   }
 937
 938   /* Page and Header content checks go here */
 939
 940   if (strlen (header_expect)) {
 941     if (!strstr (header_buf.buf, header_expect)) {
 942       strncpy(&output_header_search[0],header_expect,sizeof(output_header_search));
 943       if(output_header_search[sizeof(output_header_search)-1]!='\0') {
 944         bcopy("...",&output_header_search[sizeof(output_header_search)-4],4);
 945       }
 946       snprintf (msg, DEFAULT_BUFFER_SIZE, _("%sheader '%s' not found on '%s://%s:%d%s', "), msg, output_header_search, use_ssl ? "https" : "http", host_name ? host_name : server_address, server_port, server_url);
 947       result = STATE_CRITICAL;
 948     }
 949   }
 950
 951   if (strlen (string_expect)) {
 952     if (!strstr (body_buf.buf, string_expect)) {
 953       strncpy(&output_string_search[0],string_expect,sizeof(output_string_search));
 954       if(output_string_search[sizeof(output_string_search)-1]!='\0') {
 955         bcopy("...",&output_string_search[sizeof(output_string_search)-4],4);
 956       }
 957       snprintf (msg, DEFAULT_BUFFER_SIZE, _("%sstring '%s' not found on '%s://%s:%d%s', "), msg, output_string_search, use_ssl ? "https" : "http", host_name ? host_name : server_address, server_port, server_url);
 958       result = STATE_CRITICAL;
 959     }
 960   }
 961
 962   if (strlen (regexp)) {
 963     errcode = regexec (&preg, body_buf.buf, REGS, pmatch, 0);
 964     if ((errcode == 0 && invert_regex == 0) || (errcode == REG_NOMATCH && invert_regex == 1)) {
 965       /* OK - No-op to avoid changing the logic around it */
 966       result = max_state_alt(STATE_OK, result);
 967     }
 968     else if ((errcode == REG_NOMATCH && invert_regex == 0) || (errcode == 0 && invert_regex == 1)) {
 969       if (invert_regex == 0)
 970         snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spattern not found, "), msg);
 971       else
 972         snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spattern found, "), msg);
 973       result = STATE_CRITICAL;
 974     }
 975     else {
 976       regerror (errcode, &preg, errbuf, MAX_INPUT_BUFFER);
 977       snprintf (msg, DEFAULT_BUFFER_SIZE, _("%sExecute Error: %s, "), msg, errbuf);
 978       result = STATE_UNKNOWN;
 979     }
 980   }
 981
 982   /* make sure the page is of an appropriate size */
 983   if ((max_page_len > 0) && (page_len > max_page_len)) {
 984     snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spage size %d too large, "), msg, page_len);
 985     result = max_state_alt(STATE_WARNING, result);
 986   } else if ((min_page_len > 0) && (page_len < min_page_len)) {
 987     snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spage size %d too small, "), msg, page_len);
 988     result = max_state_alt(STATE_WARNING, result);
 989   }
 990
 991   /* -w, -c: check warning and critical level */
 992   result = max_state_alt(get_status(total_time, thlds), result);
 993
 994   /* Cut-off trailing characters */
 995   if(msg[strlen(msg)-2] == ',')
 996     msg[strlen(msg)-2] = '\0';
 997   else
 998     msg[strlen(msg)-3] = '\0';
 999
1000   /* TODO: separate _() msg and status code: die (result, "HTTP %s: %s\n", state_text(result), msg); */
1001   die (result, "HTTP %s: %s %d %s%s%s - %d bytes in %.3f second response time %s|%s\n%s%s",
1002     state_text(result), string_statuscode (status_line.http_major, status_line.http_minor),
1003     status_line.http_code, status_line.msg,
1004     strlen(msg) > 0 ? " - " : "",
1005     msg, page_len, total_time,
1006     (display_html ? "</A>" : ""),
1007     perfstring,
1008     (show_body ? body_buf.buf : ""),
1009     (show_body ? "\n" : "") );
1010
1011   /* proper cleanup after die? */
1012   curlhelp_free_statusline(&status_line);
1013   curl_easy_cleanup (curl);
1014   curl_global_cleanup ();
1015   curlhelp_freewritebuffer (&body_buf);
1016   curlhelp_freewritebuffer (&header_buf);
1017   if (!strcmp (http_method, "PUT")) {
1018     curlhelp_freereadbuffer (&put_buf);
1019   }
1020
1021   return result;
1022 }
1023
1024 int
1025 uri_strcmp (const UriTextRangeA range, const char* s)
1026 {
1027   if (!range.first) return -1;
1028   if (range.afterLast - range.first < strlen (s)) return -1;
1029   return strncmp (s, range.first, min( range.afterLast - range.first, strlen (s)));
1030 }
1031
1032 char*
1033 uri_string (const UriTextRangeA range, char* buf, size_t buflen)
1034 {
1035   if (!range.first) return "(null)";
1036   strncpy (buf, range.first, max (buflen-1, range.afterLast - range.first));
1037   buf[max (buflen-1, range.afterLast - range.first)] = '\0';
1038   buf[range.afterLast - range.first] = '\0';
1039   return buf;
1040 }
1041
1042 void
1043 redir (curlhelp_write_curlbuf* header_buf)
1044 {
1045   char *location = NULL;
1046   curlhelp_statusline status_line;
1047   struct phr_header headers[255];
1048   size_t nof_headers = 255;
1049   size_t msglen;
1050   char buf[DEFAULT_BUFFER_SIZE];
1051   char ipstr[INET_ADDR_MAX_SIZE];
1052   int new_port;
1053   char *new_host;
1054   char *new_url;
1055
1056   int res = phr_parse_response (header_buf->buf, header_buf->buflen,
1057     &status_line.http_minor, &status_line.http_code, &status_line.msg, &msglen,
1058     headers, &nof_headers, 0);
1059
1060   location = get_header_value (headers, nof_headers, "location");
1061
1062   if (verbose >= 2)
1063     printf(_("* Seen redirect location %s\n"), location);
1064
1065   if (++redir_depth > max_depth)
1066     die (STATE_WARNING,
1067          _("HTTP WARNING - maximum redirection depth %d exceeded - %s%s\n"),
1068          max_depth, location, (display_html ? "</A>" : ""));
1069
1070   UriParserStateA state;
1071   UriUriA uri;
1072   state.uri = &uri;
1073   if (uriParseUriA (&state, location) != URI_SUCCESS) {
1074     if (state.errorCode == URI_ERROR_SYNTAX) {
1075       die (STATE_UNKNOWN,
1076            _("HTTP UNKNOWN - Could not parse redirect location '%s'%s\n"),
1077            location, (display_html ? "</A>" : ""));
1078     } else if (state.errorCode == URI_ERROR_MALLOC) {
1079       die (STATE_UNKNOWN, _("HTTP UNKNOWN - Could not allocate URL\n"));
1080     }
1081   }
1082
1083   if (verbose >= 2) {
1084     printf (_("** scheme: %s\n"),
1085       uri_string (uri.scheme, buf, DEFAULT_BUFFER_SIZE));
1086     printf (_("** host: %s\n"),
1087       uri_string (uri.hostText, buf, DEFAULT_BUFFER_SIZE));
1088     printf (_("** port: %s\n"),
1089       uri_string (uri.portText, buf, DEFAULT_BUFFER_SIZE));
1090     if (uri.hostData.ip4) {
1091       inet_ntop (AF_INET, uri.hostData.ip4->data, ipstr, sizeof (ipstr));
1092       printf (_("** IPv4: %s\n"), ipstr);
1093     }
1094     if (uri.hostData.ip6) {
1095       inet_ntop (AF_INET, uri.hostData.ip6->data, ipstr, sizeof (ipstr));
1096       printf (_("** IPv6: %s\n"), ipstr);
1097     }
1098     if (uri.pathHead) {
1099       printf (_("** path: "));
1100       const UriPathSegmentA* p = uri.pathHead;
1101       for (; p; p = p->next) {
1102         printf ("/%s", uri_string (p->text, buf, DEFAULT_BUFFER_SIZE));
1103       }
1104       puts ("");
1105     }
1106     if (uri.query.first) {
1107       printf (_("** query: %s\n"),
1108       uri_string (uri.query, buf, DEFAULT_BUFFER_SIZE));
1109     }
1110     if (uri.fragment.first) {
1111       printf (_("** fragment: %s\n"),
1112       uri_string (uri.fragment, buf, DEFAULT_BUFFER_SIZE));
1113     }
1114   }
1115
1116   use_ssl = !uri_strcmp (uri.scheme, "https");
1117
1118   /* we do a sloppy test here only, because uriparser would have failed
1119    * above, if the port would be invalid, we just check for MAX_PORT
1120    */
1121   if (uri.portText.first) {
1122     new_port = atoi (uri_string (uri.portText, buf, DEFAULT_BUFFER_SIZE));
1123   } else {
1124     new_port = HTTP_PORT;
1125     if (use_ssl)
1126       new_port = HTTPS_PORT;
1127   }
1128   if (new_port > MAX_PORT)
1129     die (STATE_UNKNOWN,
1130          _("HTTP UNKNOWN - Redirection to port above %d - %s%s\n"),
1131          MAX_PORT, location, display_html ? "</A>" : "");
1132
1133   /* by RFC 7231 relative URLs in Location should be taken relative to
1134    * the original URL, so wy try to form a new absolute URL here
1135    */
1136   if (!uri.scheme.first && !uri.hostText.first) {
1137     new_host = strdup (host_name ? host_name : server_address);
1138   } else {
1139     new_host = strdup (uri_string (uri.hostText, buf, DEFAULT_BUFFER_SIZE));
1140   }
1141
1142   /* compose new path */
1143   /* TODO: handle fragments and query part of URL */
1144   new_url = (char *)calloc( 1, DEFAULT_BUFFER_SIZE);
1145   if (uri.pathHead) {
1146     const UriPathSegmentA* p = uri.pathHead;
1147     for (; p; p = p->next) {
1148       strncat (new_url, "/", DEFAULT_BUFFER_SIZE);
1149       strncat (new_url, uri_string (p->text, buf, DEFAULT_BUFFER_SIZE), DEFAULT_BUFFER_SIZE-1);
1150     }
1151   }
1152
1153   if (server_port==new_port &&
1154       !strncmp(server_address, new_host, MAX_IPV4_HOSTLENGTH) &&
1155       (host_name && !strncmp(host_name, new_host, MAX_IPV4_HOSTLENGTH)) &&
1156       !strcmp(server_url, new_url))
1157     die (STATE_CRITICAL,
1158          _("HTTP CRITICAL - redirection creates an infinite loop - %s://%s:%d%s%s\n"),
1159          use_ssl ? "https" : "http", new_host, new_port, new_url, (display_html ? "</A>" : ""));
1160
1161   /* set new values for redirected request */
1162
1163   if (!(followsticky & STICKY_HOST)) {
1164     free (server_address);
1165     server_address = strndup (new_host, MAX_IPV4_HOSTLENGTH);
1166   }
1167   if (!(followsticky & STICKY_PORT)) {
1168     server_port = (unsigned short)new_port;
1169   }
1170
1171   free (host_name);
1172   host_name = strndup (new_host, MAX_IPV4_HOSTLENGTH);
1173
1174   /* reset virtual port */
1175   virtual_port = server_port;
1176
1177   free(new_host);
1178   free (server_url);
1179   server_url = new_url;
1180
1181   uriFreeUriMembersA (&uri);
1182
1183   if (verbose)
1184     printf (_("Redirection to %s://%s:%d%s\n"), use_ssl ? "https" : "http",
1185             host_name ? host_name : server_address, server_port, server_url);
1186
1187   /* TODO: the hash component MUST be taken from the original URL and
1188    * attached to the URL in Location
1189    */
1190
1191   check_http ();
1192 }
1193
1194 /* check whether a file exists */
1195 void
1196 test_file (char *path)
1197 {
1198   if (access(path, R_OK) == 0)
1199     return;
1200   usage2 (_("file does not exist or is not readable"), path);
1201 }
1202
1203 int
1204 process_arguments (int argc, char **argv)
1205 {
1206   char *p;
1207   int c = 1;
1208   char *temp;
1209
1210   enum {
1211     INVERT_REGEX = CHAR_MAX + 1,
1212     SNI_OPTION,
1213     CA_CERT_OPTION,
1214     HTTP_VERSION_OPTION,
1215     AUTOMATIC_DECOMPRESSION
1216   };
1217
1218   int option = 0;
1219   int got_plus = 0;
1220   static struct option longopts[] = {
1221     STD_LONG_OPTS,
1222     {"link", no_argument, 0, 'L'},
1223     {"nohtml", no_argument, 0, 'n'},
1224     {"ssl", optional_argument, 0, 'S'},
1225     {"sni", no_argument, 0, SNI_OPTION},
1226     {"post", required_argument, 0, 'P'},
1227     {"method", required_argument, 0, 'j'},
1228     {"IP-address", required_argument, 0, 'I'},
1229     {"url", required_argument, 0, 'u'},
1230     {"port", required_argument, 0, 'p'},
1231     {"authorization", required_argument, 0, 'a'},
1232     {"proxy-authorization", required_argument, 0, 'b'},
1233     {"header-string", required_argument, 0, 'd'},
1234     {"string", required_argument, 0, 's'},
1235     {"expect", required_argument, 0, 'e'},
1236     {"regex", required_argument, 0, 'r'},
1237     {"ereg", required_argument, 0, 'r'},
1238     {"eregi", required_argument, 0, 'R'},
1239     {"linespan", no_argument, 0, 'l'},
1240     {"onredirect", required_argument, 0, 'f'},
1241     {"certificate", required_argument, 0, 'C'},
1242     {"client-cert", required_argument, 0, 'J'},
1243     {"private-key", required_argument, 0, 'K'},
1244     {"ca-cert", required_argument, 0, CA_CERT_OPTION},
1245     {"verify-cert", no_argument, 0, 'D'},
1246     {"useragent", required_argument, 0, 'A'},
1247     {"header", required_argument, 0, 'k'},
1248     {"no-body", no_argument, 0, 'N'},
1249     {"max-age", required_argument, 0, 'M'},
1250     {"content-type", required_argument, 0, 'T'},
1251     {"pagesize", required_argument, 0, 'm'},
1252     {"invert-regex", no_argument, NULL, INVERT_REGEX},
1253     {"use-ipv4", no_argument, 0, '4'},
1254     {"use-ipv6", no_argument, 0, '6'},
1255     {"extended-perfdata", no_argument, 0, 'E'},
1256     {"show-body", no_argument, 0, 'B'},
1257     {"http-version", required_argument, 0, HTTP_VERSION_OPTION},
1258     {"enable-automatic-decompression", no_argument, 0, AUTOMATIC_DECOMPRESSION},
1259     {0, 0, 0, 0}
1260   };
1261
1262   if (argc < 2)
1263     return ERROR;
1264
1265   /* support check_http compatible arguments */
1266   for (c = 1; c < argc; c++) {
1267     if (strcmp ("-to", argv[c]) == 0)
1268       strcpy (argv[c], "-t");
1269     if (strcmp ("-hn", argv[c]) == 0)
1270       strcpy (argv[c], "-H");
1271     if (strcmp ("-wt", argv[c]) == 0)
1272       strcpy (argv[c], "-w");
1273     if (strcmp ("-ct", argv[c]) == 0)
1274       strcpy (argv[c], "-c");
1275     if (strcmp ("-nohtml", argv[c]) == 0)
1276       strcpy (argv[c], "-n");
1277   }
1278
1279   server_url = strdup(DEFAULT_SERVER_URL);
1280
1281   while (1) {
1282     c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:d:e:p:s:R:r:u:f:C:J:K:DnlLS::m:M:NEB", longopts, &option);
1283     if (c == -1 || c == EOF || c == 1)
1284       break;
1285
1286     switch (c) {
1287     case 'h':
1288       print_help();
1289       exit(STATE_UNKNOWN);
1290       break;
1291     case 'V':
1292       print_revision(progname, NP_VERSION);
1293       print_curl_version();
1294       exit(STATE_UNKNOWN);
1295       break;
1296     case 'v':
1297       verbose++;
1298       break;
1299     case 't': /* timeout period */
1300       if (!is_intnonneg (optarg))
1301         usage2 (_("Timeout interval must be a positive integer"), optarg);
1302       else
1303         socket_timeout = (int)strtol (optarg, NULL, 10);
1304       break;
1305     case 'c': /* critical time threshold */
1306       critical_thresholds = optarg;
1307       break;
1308     case 'w': /* warning time threshold */
1309       warning_thresholds = optarg;
1310       break;
1311     case 'H': /* virtual host */
1312       host_name = strdup (optarg);
1313       if (host_name[0] == '[') {
1314         if ((p = strstr (host_name, "]:")) != NULL) { /* [IPv6]:port */
1315           virtual_port = atoi (p + 2);
1316           /* cut off the port */
1317           host_name_length = strlen (host_name) - strlen (p) - 1;
1318           free (host_name);
1319           host_name = strndup (optarg, host_name_length);
1320         }
1321       } else if ((p = strchr (host_name, ':')) != NULL
1322                  && strchr (++p, ':') == NULL) { /* IPv4:port or host:port */
1323           virtual_port = atoi (p);
1324           /* cut off the port */
1325           host_name_length = strlen (host_name) - strlen (p) - 1;
1326           free (host_name);
1327           host_name = strndup (optarg, host_name_length);
1328         }
1329       break;
1330     case 'I': /* internet address */
1331       server_address = strdup (optarg);
1332       break;
1333     case 'u': /* URL path */
1334       server_url = strdup (optarg);
1335       break;
1336     case 'p': /* Server port */
1337       if (!is_intnonneg (optarg))
1338         usage2 (_("Invalid port number, expecting a non-negative number"), optarg);
1339       else {
1340         if( strtol(optarg, NULL, 10) > MAX_PORT)
1341           usage2 (_("Invalid port number, supplied port number is too big"), optarg);
1342         server_port = (unsigned short)strtol(optarg, NULL, 10);
1343         specify_port = TRUE;
1344       }
1345       break;
1346     case 'a': /* authorization info */
1347       strncpy (user_auth, optarg, MAX_INPUT_BUFFER - 1);
1348       user_auth[MAX_INPUT_BUFFER - 1] = 0;
1349       break;
1350     case 'b': /* proxy-authorization info */
1351       strncpy (proxy_auth, optarg, MAX_INPUT_BUFFER - 1);
1352       proxy_auth[MAX_INPUT_BUFFER - 1] = 0;
1353       break;
1354     case 'P': /* HTTP POST data in URL encoded format; ignored if settings already */
1355       if (! http_post_data)
1356         http_post_data = strdup (optarg);
1357       if (! http_method)
1358         http_method = strdup("POST");
1359       break;
1360     case 'j': /* Set HTTP method */
1361       if (http_method)
1362         free(http_method);
1363       http_method = strdup (optarg);
1364       break;
1365     case 'A': /* useragent */
1366       strncpy (user_agent, optarg, DEFAULT_BUFFER_SIZE);
1367       user_agent[DEFAULT_BUFFER_SIZE-1] = '\0';
1368       break;
1369     case 'k': /* Additional headers */
1370       if (http_opt_headers_count == 0)
1371         http_opt_headers = malloc (sizeof (char *) * (++http_opt_headers_count));
1372       else
1373         http_opt_headers = realloc (http_opt_headers, sizeof (char *) * (++http_opt_headers_count));
1374       http_opt_headers[http_opt_headers_count - 1] = optarg;
1375       break;
1376     case 'L': /* show html link */
1377       display_html = TRUE;
1378       break;
1379     case 'n': /* do not show html link */
1380       display_html = FALSE;
1381       break;
1382     case 'C': /* Check SSL cert validity */
1383 #ifdef LIBCURL_FEATURE_SSL
1384       if ((temp=strchr(optarg,','))!=NULL) {
1385         *temp='\0';
1386         if (!is_intnonneg (optarg))
1387           usage2 (_("Invalid certificate expiration period"), optarg);
1388         days_till_exp_warn = atoi(optarg);
1389         *temp=',';
1390         temp++;
1391         if (!is_intnonneg (temp))
1392           usage2 (_("Invalid certificate expiration period"), temp);
1393         days_till_exp_crit = atoi (temp);
1394       }
1395       else {
1396         days_till_exp_crit=0;
1397         if (!is_intnonneg (optarg))
1398           usage2 (_("Invalid certificate expiration period"), optarg);
1399         days_till_exp_warn = atoi (optarg);
1400       }
1401       check_cert = TRUE;
1402       goto enable_ssl;
1403 #endif
1404     case 'J': /* use client certificate */
1405 #ifdef LIBCURL_FEATURE_SSL
1406       test_file(optarg);
1407       client_cert = optarg;
1408       goto enable_ssl;
1409 #endif
1410     case 'K': /* use client private key */
1411 #ifdef LIBCURL_FEATURE_SSL
1412       test_file(optarg);
1413       client_privkey = optarg;
1414       goto enable_ssl;
1415 #endif
1416 #ifdef LIBCURL_FEATURE_SSL
1417     case CA_CERT_OPTION: /* use CA chain file */
1418       test_file(optarg);
1419       ca_cert = optarg;
1420       goto enable_ssl;
1421 #endif
1422 #ifdef LIBCURL_FEATURE_SSL
1423     case 'D': /* verify peer certificate & host */
1424       verify_peer_and_host = TRUE;
1425       break;
1426 #endif
1427     case 'S': /* use SSL */
1428 #ifdef LIBCURL_FEATURE_SSL
1429     enable_ssl:
1430       use_ssl = TRUE;
1431       /* ssl_version initialized to CURL_SSLVERSION_DEFAULT as a default.
1432        * Only set if it's non-zero.  This helps when we include multiple
1433        * parameters, like -S and -C combinations */
1434       ssl_version = CURL_SSLVERSION_DEFAULT;
1435       if (c=='S' && optarg != NULL) {
1436         char *plus_ptr = strchr(optarg, '+');
1437         if (plus_ptr) {
1438           got_plus = 1;
1439           *plus_ptr = '\0';
1440         }
1441
1442         if (optarg[0] == '2')
1443           ssl_version = CURL_SSLVERSION_SSLv2;
1444         else if (optarg[0] == '3')
1445           ssl_version = CURL_SSLVERSION_SSLv3;
1446         else if (!strcmp (optarg, "1") || !strcmp (optarg, "1.0"))
1447 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
1448           ssl_version = CURL_SSLVERSION_TLSv1_0;
1449 #else
1450           ssl_version = CURL_SSLVERSION_DEFAULT;
1451 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
1452         else if (!strcmp (optarg, "1.1"))
1453 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
1454           ssl_version = CURL_SSLVERSION_TLSv1_1;
1455 #else
1456           ssl_version = CURL_SSLVERSION_DEFAULT;
1457 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
1458         else if (!strcmp (optarg, "1.2"))
1459 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
1460           ssl_version = CURL_SSLVERSION_TLSv1_2;
1461 #else
1462           ssl_version = CURL_SSLVERSION_DEFAULT;
1463 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
1464         else if (!strcmp (optarg, "1.3"))
1465 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 52, 0)
1466           ssl_version = CURL_SSLVERSION_TLSv1_3;
1467 #else
1468           ssl_version = CURL_SSLVERSION_DEFAULT;
1469 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 52, 0) */
1470         else
1471           usage4 (_("Invalid option - Valid SSL/TLS versions: 2, 3, 1, 1.1, 1.2, 1.3 (with optional '+' suffix)"));
1472       }
1473 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 54, 0)
1474       if (got_plus) {
1475         switch (ssl_version) {
1476           case CURL_SSLVERSION_TLSv1_3:
1477             ssl_version |= CURL_SSLVERSION_MAX_TLSv1_3;
1478             break;
1479           case CURL_SSLVERSION_TLSv1_2:
1480           case CURL_SSLVERSION_TLSv1_1:
1481           case CURL_SSLVERSION_TLSv1_0:
1482             ssl_version |= CURL_SSLVERSION_MAX_DEFAULT;
1483             break;
1484         }
1485       } else {
1486         switch (ssl_version) {
1487           case CURL_SSLVERSION_TLSv1_3:
1488             ssl_version |= CURL_SSLVERSION_MAX_TLSv1_3;
1489             break;
1490           case CURL_SSLVERSION_TLSv1_2:
1491             ssl_version |= CURL_SSLVERSION_MAX_TLSv1_2;
1492             break;
1493           case CURL_SSLVERSION_TLSv1_1:
1494             ssl_version |= CURL_SSLVERSION_MAX_TLSv1_1;
1495             break;
1496           case CURL_SSLVERSION_TLSv1_0:
1497             ssl_version |= CURL_SSLVERSION_MAX_TLSv1_0;
1498             break;
1499         }
1500       }
1501 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 54, 0) */
1502       if (verbose >= 2)
1503         printf(_("* Set SSL/TLS version to %d\n"), ssl_version);
1504       if (specify_port == FALSE)
1505         server_port = HTTPS_PORT;
1506       break;
1507 #else /* LIBCURL_FEATURE_SSL */
1508       /* -C -J and -K fall through to here without SSL */
1509       usage4 (_("Invalid option - SSL is not available"));
1510       break;
1511     case SNI_OPTION: /* --sni is parsed, but ignored, the default is TRUE with libcurl */
1512       use_sni = TRUE;
1513       break;
1514 #endif /* LIBCURL_FEATURE_SSL */
1515     case 'f': /* onredirect */
1516       if (!strcmp (optarg, "ok"))
1517         onredirect = STATE_OK;
1518       else if (!strcmp (optarg, "warning"))
1519         onredirect = STATE_WARNING;
1520       else if (!strcmp (optarg, "critical"))
1521         onredirect = STATE_CRITICAL;
1522       else if (!strcmp (optarg, "unknown"))
1523         onredirect = STATE_UNKNOWN;
1524       else if (!strcmp (optarg, "follow"))
1525         onredirect = STATE_DEPENDENT;
1526       else if (!strcmp (optarg, "stickyport"))
1527         onredirect = STATE_DEPENDENT, followmethod = FOLLOW_HTTP_CURL, followsticky = STICKY_HOST|STICKY_PORT;
1528       else if (!strcmp (optarg, "sticky"))
1529         onredirect = STATE_DEPENDENT, followmethod = FOLLOW_HTTP_CURL, followsticky = STICKY_HOST;
1530       else if (!strcmp (optarg, "follow"))
1531         onredirect = STATE_DEPENDENT, followmethod = FOLLOW_HTTP_CURL, followsticky = STICKY_NONE;
1532       else if (!strcmp (optarg, "curl"))
1533         onredirect = STATE_DEPENDENT, followmethod = FOLLOW_LIBCURL;
1534       else usage2 (_("Invalid onredirect option"), optarg);
1535       if (verbose >= 2)
1536         printf(_("* Following redirects set to %s\n"), state_text(onredirect));
1537       break;
1538     case 'd': /* string or substring */
1539       strncpy (header_expect, optarg, MAX_INPUT_BUFFER - 1);
1540       header_expect[MAX_INPUT_BUFFER - 1] = 0;
1541       break;
1542     case 's': /* string or substring */
1543       strncpy (string_expect, optarg, MAX_INPUT_BUFFER - 1);
1544       string_expect[MAX_INPUT_BUFFER - 1] = 0;
1545       break;
1546     case 'e': /* string or substring */
1547       strncpy (server_expect, optarg, MAX_INPUT_BUFFER - 1);
1548       server_expect[MAX_INPUT_BUFFER - 1] = 0;
1549       server_expect_yn = 1;
1550       break;
1551     case 'T': /* Content-type */
1552       http_content_type = strdup (optarg);
1553      break;
1554     case 'l': /* linespan */
1555       cflags &= ~REG_NEWLINE;
1556       break;
1557     case 'R': /* regex */
1558       cflags |= REG_ICASE;
1559     case 'r': /* regex */
1560       strncpy (regexp, optarg, MAX_RE_SIZE - 1);
1561       regexp[MAX_RE_SIZE - 1] = 0;
1562       errcode = regcomp (&preg, regexp, cflags);
1563       if (errcode != 0) {
1564         (void) regerror (errcode, &preg, errbuf, MAX_INPUT_BUFFER);
1565         printf (_("Could Not Compile Regular Expression: %s"), errbuf);
1566         return ERROR;
1567       }
1568       break;
1569     case INVERT_REGEX:
1570       invert_regex = 1;
1571       break;
1572     case '4':
1573       address_family = AF_INET;
1574       break;
1575     case '6':
1576 #if defined (USE_IPV6) && defined (LIBCURL_FEATURE_IPV6)
1577       address_family = AF_INET6;
1578 #else
1579       usage4 (_("IPv6 support not available"));
1580 #endif
1581       break;
1582     case 'm': /* min_page_length */
1583       {
1584       char *tmp;
1585       if (strchr(optarg, ':') != (char *)NULL) {
1586         /* range, so get two values, min:max */
1587         tmp = strtok(optarg, ":");
1588         if (tmp == NULL) {
1589           printf("Bad format: try \"-m min:max\"\n");
1590           exit (STATE_WARNING);
1591         } else
1592           min_page_len = atoi(tmp);
1593
1594         tmp = strtok(NULL, ":");
1595         if (tmp == NULL) {
1596           printf("Bad format: try \"-m min:max\"\n");
1597           exit (STATE_WARNING);
1598         } else
1599           max_page_len = atoi(tmp);
1600       } else
1601         min_page_len = atoi (optarg);
1602       break;
1603       }
1604     case 'N': /* no-body */
1605       no_body = TRUE;
1606       break;
1607     case 'M': /* max-age */
1608     {
1609       int L = strlen(optarg);
1610       if (L && optarg[L-1] == 'm')
1611         maximum_age = atoi (optarg) * 60;
1612       else if (L && optarg[L-1] == 'h')
1613         maximum_age = atoi (optarg) * 60 * 60;
1614       else if (L && optarg[L-1] == 'd')
1615         maximum_age = atoi (optarg) * 60 * 60 * 24;
1616       else if (L && (optarg[L-1] == 's' ||
1617                      isdigit (optarg[L-1])))
1618         maximum_age = atoi (optarg);
1619       else {
1620         fprintf (stderr, "unparsable max-age: %s\n", optarg);
1621         exit (STATE_WARNING);
1622       }
1623       if (verbose >= 2)
1624         printf ("* Maximal age of document set to %d seconds\n", maximum_age);
1625     }
1626     break;
1627     case 'E': /* show extended perfdata */
1628       show_extended_perfdata = TRUE;
1629       break;
1630     case 'B': /* print body content after status line */
1631       show_body = TRUE;
1632       break;
1633     case HTTP_VERSION_OPTION:
1634       curl_http_version = CURL_HTTP_VERSION_NONE;
1635       if (strcmp (optarg, "1.0") == 0) {
1636         curl_http_version = CURL_HTTP_VERSION_1_0;
1637       } else if (strcmp (optarg, "1.1") == 0) {
1638         curl_http_version = CURL_HTTP_VERSION_1_1;
1639       } else if ((strcmp (optarg, "2.0") == 0) || (strcmp (optarg, "2") == 0)) {
1640 #if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 33, 0)
1641         curl_http_version = CURL_HTTP_VERSION_2_0;
1642 #else
1643         curl_http_version = CURL_HTTP_VERSION_NONE;
1644 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 33, 0) */
1645       } else {
1646         fprintf (stderr, "unkown http-version parameter: %s\n", optarg);
1647         exit (STATE_WARNING);
1648       }
1649       break;
1650     case AUTOMATIC_DECOMPRESSION:
1651       automatic_decompression = TRUE;
1652       break;
1653     case '?':
1654       /* print short usage statement if args not parsable */
1655       usage5 ();
1656       break;
1657     }
1658   }
1659
1660   c = optind;
1661
1662   if (server_address == NULL && c < argc)
1663     server_address = strdup (argv[c++]);
1664
1665   if (host_name == NULL && c < argc)
1666     host_name = strdup (argv[c++]);
1667
1668   if (server_address == NULL) {
1669     if (host_name == NULL)
1670       usage4 (_("You must specify a server address or host name"));
1671     else
1672       server_address = strdup (host_name);
1673   }
1674
1675   set_thresholds(&thlds, warning_thresholds, critical_thresholds);
1676
1677   if (critical_thresholds && thlds->critical->end>(double)socket_timeout)
1678     socket_timeout = (int)thlds->critical->end + 1;
1679   if (verbose >= 2)
1680     printf ("* Socket timeout set to %ld seconds\n", socket_timeout);
1681
1682   if (http_method == NULL)
1683     http_method = strdup ("GET");
1684
1685   if (client_cert && !client_privkey)
1686     usage4 (_("If you use a client certificate you must also specify a private key file"));
1687
1688   if (virtual_port == 0)
1689     virtual_port = server_port;
1690   else {
1691     if ((use_ssl && server_port == HTTPS_PORT) || (!use_ssl && server_port == HTTP_PORT))
1692       if(specify_port == FALSE)
1693         server_port = virtual_port;
1694   }
1695
1696   return TRUE;
1697 }
1698
1699 char *perfd_time (double elapsed_time)
1700 {
1701   return fperfdata ("time", elapsed_time, "s",
1702             thlds->warning?TRUE:FALSE, thlds->warning?thlds->warning->end:0,
1703             thlds->critical?TRUE:FALSE, thlds->critical?thlds->critical->end:0,
1704                    TRUE, 0, TRUE, socket_timeout);
1705 }
1706
1707 char *perfd_time_connect (double elapsed_time_connect)
1708 {
1709   return fperfdata ("time_connect", elapsed_time_connect, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1710 }
1711
1712 char *perfd_time_ssl (double elapsed_time_ssl)
1713 {
1714   return fperfdata ("time_ssl", elapsed_time_ssl, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1715 }
1716
1717 char *perfd_time_headers (double elapsed_time_headers)
1718 {
1719   return fperfdata ("time_headers", elapsed_time_headers, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1720 }
1721
1722 char *perfd_time_firstbyte (double elapsed_time_firstbyte)
1723 {
1724   return fperfdata ("time_firstbyte", elapsed_time_firstbyte, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1725 }
1726
1727 char *perfd_time_transfer (double elapsed_time_transfer)
1728 {
1729   return fperfdata ("time_transfer", elapsed_time_transfer, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1730 }
1731
1732 char *perfd_size (int page_len)
1733 {
1734   return perfdata ("size", page_len, "B",
1735             (min_page_len>0?TRUE:FALSE), min_page_len,
1736             (min_page_len>0?TRUE:FALSE), 0,
1737             TRUE, 0, FALSE, 0);
1738 }
1739
1740 void
1741 print_help (void)
1742 {
1743   print_revision (progname, NP_VERSION);
1744
1745   printf ("Copyright (c) 1999 Ethan Galstad <nagios@nagios.org>\n");
1746   printf (COPYRIGHT, copyright, email);
1747
1748   printf ("%s\n", _("This plugin tests the HTTP service on the specified host. It can test"));
1749   printf ("%s\n", _("normal (http) and secure (https) servers, follow redirects, search for"));
1750   printf ("%s\n", _("strings and regular expressions, check connection times, and report on"));
1751   printf ("%s\n", _("certificate expiration times."));
1752   printf ("\n");
1753   printf ("%s\n", _("It makes use of libcurl to do so. It tries to be as compatible to check_http"));
1754   printf ("%s\n", _("as possible."));
1755
1756   printf ("\n\n");
1757
1758   print_usage ();
1759
1760   printf (_("NOTE: One or both of -H and -I must be specified"));
1761
1762   printf ("\n");
1763
1764   printf (UT_HELP_VRSN);
1765   printf (UT_EXTRA_OPTS);
1766
1767   printf (" %s\n", "-H, --hostname=ADDRESS");
1768   printf ("    %s\n", _("Host name argument for servers using host headers (virtual host)"));
1769   printf ("    %s\n", _("Append a port to include it in the header (eg: example.com:5000)"));
1770   printf (" %s\n", "-I, --IP-address=ADDRESS");
1771   printf ("    %s\n", _("IP address or name (use numeric address if possible to bypass DNS lookup)."));
1772   printf (" %s\n", "-p, --port=INTEGER");
1773   printf ("    %s", _("Port number (default: "));
1774   printf ("%d)\n", HTTP_PORT);
1775
1776   printf (UT_IPv46);
1777
1778 #ifdef LIBCURL_FEATURE_SSL
1779   printf (" %s\n", "-S, --ssl=VERSION[+]");
1780   printf ("    %s\n", _("Connect via SSL. Port defaults to 443. VERSION is optional, and prevents"));
1781   printf ("    %s\n", _("auto-negotiation (2 = SSLv2, 3 = SSLv3, 1 = TLSv1, 1.1 = TLSv1.1,"));
1782   printf ("    %s\n", _("1.2 = TLSv1.2, 1.3 = TLSv1.3). With a '+' suffix, newer versions are also accepted."));
1783   printf ("    %s\n", _("Note: SSLv2 and SSLv3 are deprecated and are usually disabled in libcurl"));
1784   printf (" %s\n", "--sni");
1785   printf ("    %s\n", _("Enable SSL/TLS hostname extension support (SNI)"));
1786 #if LIBCURL_VERSION_NUM >= 0x071801
1787   printf ("    %s\n", _("Note: --sni is the default in libcurl as SSLv2 and SSLV3 are deprecated and"));
1788   printf ("    %s\n", _("      SNI only really works since TLSv1.0"));
1789 #else
1790   printf ("    %s\n", _("Note: SNI is not supported in libcurl before 7.18.1"));
1791 #endif
1792   printf (" %s\n", "-C, --certificate=INTEGER[,INTEGER]");
1793   printf ("    %s\n", _("Minimum number of days a certificate has to be valid. Port defaults to 443"));
1794   printf ("    %s\n", _("(when this option is used the URL is not checked.)"));
1795   printf (" %s\n", "-J, --client-cert=FILE");
1796   printf ("   %s\n", _("Name of file that contains the client certificate (PEM format)"));
1797   printf ("   %s\n", _("to be used in establishing the SSL session"));
1798   printf (" %s\n", "-K, --private-key=FILE");
1799   printf ("   %s\n", _("Name of file containing the private key (PEM format)"));
1800   printf ("   %s\n", _("matching the client certificate"));
1801   printf (" %s\n", "--ca-cert=FILE");
1802   printf ("   %s\n", _("CA certificate file to verify peer against"));
1803   printf (" %s\n", "-D, --verify-cert");
1804   printf ("   %s\n", _("Verify the peer's SSL certificate and hostname"));
1805 #endif
1806
1807   printf (" %s\n", "-e, --expect=STRING");
1808   printf ("    %s\n", _("Comma-delimited list of strings, at least one of them is expected in"));
1809   printf ("    %s", _("the first (status) line of the server response (default: "));
1810   printf ("%s)\n", HTTP_EXPECT);
1811   printf ("    %s\n", _("If specified skips all other status line logic (ex: 3xx, 4xx, 5xx processing)"));
1812   printf (" %s\n", "-d, --header-string=STRING");
1813   printf ("    %s\n", _("String to expect in the response headers"));
1814   printf (" %s\n", "-s, --string=STRING");
1815   printf ("    %s\n", _("String to expect in the content"));
1816   printf (" %s\n", "-u, --url=PATH");
1817   printf ("    %s\n", _("URL to GET or POST (default: /)"));
1818   printf (" %s\n", "-P, --post=STRING");
1819   printf ("    %s\n", _("URL encoded http POST data"));
1820   printf (" %s\n", "-j, --method=STRING  (for example: HEAD, OPTIONS, TRACE, PUT, DELETE, CONNECT)");
1821   printf ("    %s\n", _("Set HTTP method."));
1822   printf (" %s\n", "-N, --no-body");
1823   printf ("    %s\n", _("Don't wait for document body: stop reading after headers."));
1824   printf ("    %s\n", _("(Note that this still does an HTTP GET or POST, not a HEAD.)"));
1825   printf (" %s\n", "-M, --max-age=SECONDS");
1826   printf ("    %s\n", _("Warn if document is more than SECONDS old. the number can also be of"));
1827   printf ("    %s\n", _("the form \"10m\" for minutes, \"10h\" for hours, or \"10d\" for days."));
1828   printf (" %s\n", "-T, --content-type=STRING");
1829   printf ("    %s\n", _("specify Content-Type header media type when POSTing\n"));
1830   printf (" %s\n", "-l, --linespan");
1831   printf ("    %s\n", _("Allow regex to span newlines (must precede -r or -R)"));
1832   printf (" %s\n", "-r, --regex, --ereg=STRING");
1833   printf ("    %s\n", _("Search page for regex STRING"));
1834   printf (" %s\n", "-R, --eregi=STRING");
1835   printf ("    %s\n", _("Search page for case-insensitive regex STRING"));
1836   printf (" %s\n", "--invert-regex");
1837   printf ("    %s\n", _("Return CRITICAL if found, OK if not\n"));
1838   printf (" %s\n", "-a, --authorization=AUTH_PAIR");
1839   printf ("    %s\n", _("Username:password on sites with basic authentication"));
1840   printf (" %s\n", "-b, --proxy-authorization=AUTH_PAIR");
1841   printf ("    %s\n", _("Username:password on proxy-servers with basic authentication"));
1842   printf (" %s\n", "-A, --useragent=STRING");
1843   printf ("    %s\n", _("String to be sent in http header as \"User Agent\""));
1844   printf (" %s\n", "-k, --header=STRING");
1845   printf ("    %s\n", _("Any other tags to be sent in http header. Use multiple times for additional headers"));
1846   printf (" %s\n", "-E, --extended-perfdata");
1847   printf ("    %s\n", _("Print additional performance data"));
1848   printf (" %s\n", "-B, --show-body");
1849   printf ("    %s\n", _("Print body content below status line"));
1850   printf (" %s\n", "-L, --link");
1851   printf ("    %s\n", _("Wrap output in HTML link (obsoleted by urlize)"));
1852   printf (" %s\n", "-f, --onredirect=<ok|warning|critical|follow|sticky|stickyport|curl>");
1853   printf ("    %s\n", _("How to handle redirected pages. sticky is like follow but stick to the"));
1854   printf ("    %s\n", _("specified IP address. stickyport also ensures port stays the same."));
1855   printf ("    %s\n", _("follow uses the old redirection algorithm of check_http."));
1856   printf ("    %s\n", _("curl uses CURL_FOLLOWLOCATION built into libcurl."));
1857   printf (" %s\n", "-m, --pagesize=INTEGER<:INTEGER>");
1858   printf ("    %s\n", _("Minimum page size required (bytes) : Maximum page size required (bytes)"));
1859   printf ("\n");
1860   printf (" %s\n", "--http-version=VERSION");
1861   printf ("    %s\n", _("Connect via specific HTTP protocol."));
1862   printf ("    %s\n", _("1.0 = HTTP/1.0, 1.1 = HTTP/1.1, 2.0 = HTTP/2 (HTTP/2 will fail without -S)"));
1863   printf (" %s\n", "--enable-automatic-decompression");
1864   printf ("    %s\n", _("Enable automatic decompression of body (CURLOPT_ACCEPT_ENCODING)."));
1865   printf ("\n");
1866
1867   printf (UT_WARN_CRIT);
1868
1869   printf (UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
1870
1871   printf (UT_VERBOSE);
1872
1873   printf ("\n");
1874   printf ("%s\n", _("Notes:"));
1875   printf (" %s\n", _("This plugin will attempt to open an HTTP connection with the host."));
1876   printf (" %s\n", _("Successful connects return STATE_OK, refusals and timeouts return STATE_CRITICAL"));
1877   printf (" %s\n", _("other errors return STATE_UNKNOWN.  Successful connects, but incorrect response"));
1878   printf (" %s\n", _("messages from the host result in STATE_WARNING return values.  If you are"));
1879   printf (" %s\n", _("checking a virtual server that uses 'host headers' you must supply the FQDN"));
1880   printf (" %s\n", _("(fully qualified domain name) as the [host_name] argument."));
1881
1882 #ifdef LIBCURL_FEATURE_SSL
1883   printf ("\n");
1884   printf (" %s\n", _("This plugin can also check whether an SSL enabled web server is able to"));
1885   printf (" %s\n", _("serve content (optionally within a specified time) or whether the X509 "));
1886   printf (" %s\n", _("certificate is still valid for the specified number of days."));
1887   printf ("\n");
1888   printf (" %s\n", _("Please note that this plugin does not check if the presented server"));
1889   printf (" %s\n", _("certificate matches the hostname of the server, or if the certificate"));
1890   printf (" %s\n", _("has a valid chain of trust to one of the locally installed CAs."));
1891   printf ("\n");
1892   printf ("%s\n", _("Examples:"));
1893   printf (" %s\n\n", "CHECK CONTENT: check_curl -w 5 -c 10 --ssl -H www.verisign.com");
1894   printf (" %s\n", _("When the 'www.verisign.com' server returns its content within 5 seconds,"));
1895   printf (" %s\n", _("a STATE_OK will be returned. When the server returns its content but exceeds"));
1896   printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
1897   printf (" %s\n", _("a STATE_CRITICAL will be returned."));
1898   printf ("\n");
1899   printf (" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 14");
1900   printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
1901   printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
1902   printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
1903   printf (" %s\n\n", _("the certificate is expired."));
1904   printf ("\n");
1905   printf (" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 30,14");
1906   printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 30 days,"));
1907   printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
1908   printf (" %s\n", _("30 days, but more than 14 days, a STATE_WARNING is returned."));
1909   printf (" %s\n", _("A STATE_CRITICAL will be returned when certificate expires in less than 14 days"));
1910 #endif
1911
1912   printf ("\n %s\n", "CHECK WEBSERVER CONTENT VIA PROXY:");
1913   printf (" %s\n", _("It is recommended to use an environment proxy like:"));
1914   printf (" %s\n", _("http_proxy=http://192.168.100.35:3128 ./check_curl -H www.monitoring-plugins.org"));
1915   printf (" %s\n", _("legacy proxy requests in check_http style still work:"));
1916   printf (" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u http://www.monitoring-plugins.org/ -H www.monitoring-plugins.org"));
1917
1918 #ifdef LIBCURL_FEATURE_SSL
1919   printf ("\n %s\n", "CHECK SSL WEBSERVER CONTENT VIA PROXY USING HTTP 1.1 CONNECT: ");
1920   printf (" %s\n", _("It is recommended to use an environment proxy like:"));
1921   printf (" %s\n", _("https_proxy=http://192.168.100.35:3128 ./check_curl -H www.verisign.com -S"));
1922   printf (" %s\n", _("legacy proxy requests in check_http style still work:"));
1923   printf (" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u https://www.verisign.com/ -S -j CONNECT -H www.verisign.com "));
1924   printf (" %s\n", _("all these options are needed: -I <proxy> -p <proxy-port> -u <check-url> -S(sl) -j CONNECT -H <webserver>"));
1925   printf (" %s\n", _("a STATE_OK will be returned. When the server returns its content but exceeds"));
1926   printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
1927   printf (" %s\n", _("a STATE_CRITICAL will be returned."));
1928
1929 #endif
1930
1931   printf (UT_SUPPORT);
1932
1933 }
1934
1935
1936
1937 void
1938 print_usage (void)
1939 {
1940   printf ("%s\n", _("Usage:"));
1941   printf (" %s -H <vhost> | -I <IP-address> [-u <uri>] [-p <port>]\n",progname);
1942   printf ("       [-J <client certificate file>] [-K <private key>] [--ca-cert <CA certificate file>] [-D]\n");
1943   printf ("       [-w <warn time>] [-c <critical time>] [-t <timeout>] [-L] [-E] [-a auth]\n");
1944   printf ("       [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport|curl>]\n");
1945   printf ("       [-e <expect>] [-d string] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
1946   printf ("       [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
1947   printf ("       [-A string] [-k string] [-S <version>] [--sni]\n");
1948   printf ("       [-T <content-type>] [-j method]\n");
1949   printf ("       [--http-version=<version>]\n");
1950   printf (" %s -H <vhost> | -I <IP-address> -C <warn_age>[,<crit_age>]\n",progname);
1951   printf ("       [-p <port>] [-t <timeout>] [-4|-6] [--sni]\n");
1952   printf ("\n");
1953 #ifdef LIBCURL_FEATURE_SSL
1954   printf ("%s\n", _("In the first form, make an HTTP request."));
1955   printf ("%s\n\n", _("In the second form, connect to the server and check the TLS certificate."));
1956 #endif
1957   printf ("%s\n", _("WARNING: check_curl is experimental. Please use"));
1958   printf ("%s\n\n", _("check_http if you need a stable version."));
1959 }
1960
1961 void
1962 print_curl_version (void)
1963 {
1964   printf( "%s\n", curl_version());
1965 }
1966
1967 int
1968 curlhelp_initwritebuffer (curlhelp_write_curlbuf *buf)
1969 {
1970   buf->bufsize = DEFAULT_BUFFER_SIZE;
1971   buf->buflen = 0;
1972   buf->buf = (char *)malloc ((size_t)buf->bufsize);
1973   if (buf->buf == NULL) return -1;
1974   return 0;
1975 }
1976
1977 int
1978 curlhelp_buffer_write_callback (void *buffer, size_t size, size_t nmemb, void *stream)
1979 {
1980   curlhelp_write_curlbuf *buf = (curlhelp_write_curlbuf *)stream;
1981
1982   while (buf->bufsize < buf->buflen + size * nmemb + 1) {
1983     buf->bufsize *= buf->bufsize * 2;
1984     buf->buf = (char *)realloc (buf->buf, buf->bufsize);
1985     if (buf->buf == NULL) return -1;
1986   }
1987
1988   memcpy (buf->buf + buf->buflen, buffer, size * nmemb);
1989   buf->buflen += size * nmemb;
1990   buf->buf[buf->buflen] = '\0';
1991
1992   return (int)(size * nmemb);
1993 }
1994
1995 int
1996 curlhelp_buffer_read_callback (void *buffer, size_t size, size_t nmemb, void *stream)
1997 {
1998   curlhelp_read_curlbuf *buf = (curlhelp_read_curlbuf *)stream;
1999
2000   size_t n = min (nmemb * size, buf->buflen - buf->pos);
2001
2002   memcpy (buffer, buf->buf + buf->pos, n);
2003   buf->pos += n;
2004
2005   return (int)n;
2006 }
2007
2008 void
2009 curlhelp_freewritebuffer (curlhelp_write_curlbuf *buf)
2010 {
2011   free (buf->buf);
2012   buf->buf = NULL;
2013 }
2014
2015 int
2016 curlhelp_initreadbuffer (curlhelp_read_curlbuf *buf, const char *data, size_t datalen)
2017 {
2018   buf->buflen = datalen;
2019   buf->buf = (char *)malloc ((size_t)buf->buflen);
2020   if (buf->buf == NULL) return -1;
2021   memcpy (buf->buf, data, datalen);
2022   buf->pos = 0;
2023   return 0;
2024 }
2025
2026 void
2027 curlhelp_freereadbuffer (curlhelp_read_curlbuf *buf)
2028 {
2029   free (buf->buf);
2030   buf->buf = NULL;
2031 }
2032
2033 /* TODO: where to put this, it's actually part of sstrings2 (logically)?
2034  */
2035 const char*
2036 strrstr2(const char *haystack, const char *needle)
2037 {
2038   int counter;
2039   size_t len;
2040   const char *prev_pos;
2041   const char *pos;
2042
2043   if (haystack == NULL || needle == NULL)
2044     return NULL;
2045
2046   if (haystack[0] == '\0' || needle[0] == '\0')
2047     return NULL;
2048
2049   counter = 0;
2050   prev_pos = NULL;
2051   pos = haystack;
2052   len = strlen (needle);
2053   for (;;) {
2054     pos = strstr (pos, needle);
2055     if (pos == NULL) {
2056       if (counter == 0)
2057         return NULL;
2058       else
2059         return prev_pos;
2060     }
2061     counter++;
2062     prev_pos = pos;
2063     pos += len;
2064     if (*pos == '\0') return prev_pos;
2065   }
2066 }
2067
2068 int
2069 curlhelp_parse_statusline (const char *buf, curlhelp_statusline *status_line)
2070 {
2071   char *first_line_end;
2072   char *p;
2073   size_t first_line_len;
2074   char *pp;
2075   const char *start;
2076   char *first_line_buf;
2077
2078   /* find last start of a new header */
2079   start = strrstr2 (buf, "\r\nHTTP/");
2080   if (start != NULL) {
2081     start += 2;
2082     buf = start;
2083   }
2084
2085   first_line_end = strstr(buf, "\r\n");
2086   if (first_line_end == NULL) return -1;
2087
2088   first_line_len = (size_t)(first_line_end - buf);
2089   status_line->first_line = (char *)malloc (first_line_len + 1);
2090   if (status_line->first_line == NULL) return -1;
2091   memcpy (status_line->first_line, buf, first_line_len);
2092   status_line->first_line[first_line_len] = '\0';
2093   first_line_buf = strdup( status_line->first_line );
2094
2095   /* protocol and version: "HTTP/x.x" SP or "HTTP/2" SP */
2096
2097   p = strtok(first_line_buf, "/");
2098   if( p == NULL ) { free( first_line_buf ); return -1; }
2099   if( strcmp( p, "HTTP" ) != 0 ) { free( first_line_buf ); return -1; }
2100
2101   p = strtok( NULL, " " );
2102   if( p == NULL ) { free( first_line_buf ); return -1; }
2103   if( strchr( p, '.' ) != NULL ) {
2104
2105     /* HTTP 1.x case */
2106     char *ppp;
2107     ppp = strtok( p, "." );
2108     status_line->http_major = (int)strtol( p, &pp, 10 );
2109     if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2110     ppp = strtok( NULL, " " );
2111     status_line->http_minor = (int)strtol( p, &pp, 10 );
2112     if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2113     p += 4; /* 1.x SP */
2114   } else {
2115     /* HTTP 2 case */
2116     status_line->http_major = (int)strtol( p, &pp, 10 );
2117     status_line->http_minor = 0;
2118     p += 2; /* 2 SP */
2119   }
2120
2121   /* status code: "404" or "404.1", then SP */
2122
2123   p = strtok( p, " " );
2124   if( p == NULL ) { free( first_line_buf ); return -1; }
2125   if( strchr( p, '.' ) != NULL ) {
2126     char *ppp;
2127     ppp = strtok( p, "." );
2128     status_line->http_code = (int)strtol( ppp, &pp, 10 );
2129     if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2130     ppp = strtok( NULL, "" );
2131     status_line->http_subcode = (int)strtol( ppp, &pp, 10 );
2132     if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2133     p += 6; /* 400.1 SP */
2134   } else {
2135     status_line->http_code = (int)strtol( p, &pp, 10 );
2136     status_line->http_subcode = -1;
2137     if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2138     p += 4; /* 400 SP */
2139   }
2140
2141   /* Human readable message: "Not Found" CRLF */
2142
2143   p = strtok( p, "" );
2144   if( p == NULL ) { status_line->msg = ""; return 0; }
2145   status_line->msg = status_line->first_line + ( p - first_line_buf );
2146   free( first_line_buf );
2147
2148   return 0;
2149 }
2150
2151 void
2152 curlhelp_free_statusline (curlhelp_statusline *status_line)
2153 {
2154   free (status_line->first_line);
2155 }
2156
2157 void
2158 remove_newlines (char *s)
2159 {
2160   char *p;
2161
2162   for (p = s; *p != '\0'; p++)
2163     if (*p == '\r' || *p == '\n')
2164       *p = ' ';
2165 }
2166
2167 char *
2168 get_header_value (const struct phr_header* headers, const size_t nof_headers, const char* header)
2169 {
2170   int i;
2171   for( i = 0; i < nof_headers; i++ ) {
2172     if(headers[i].name != NULL && strncasecmp( header, headers[i].name, max( headers[i].name_len, 4 ) ) == 0 ) {
2173       return strndup( headers[i].value, headers[i].value_len );
2174     }
2175   }
2176   return NULL;
2177 }
2178
2179 int
2180 check_document_dates (const curlhelp_write_curlbuf *header_buf, char (*msg)[DEFAULT_BUFFER_SIZE])
2181 {
2182   char *server_date = NULL;
2183   char *document_date = NULL;
2184   int date_result = STATE_OK;
2185   curlhelp_statusline status_line;
2186   struct phr_header headers[255];
2187   size_t nof_headers = 255;
2188   size_t msglen;
2189
2190   int res = phr_parse_response (header_buf->buf, header_buf->buflen,
2191     &status_line.http_minor, &status_line.http_code, &status_line.msg, &msglen,
2192     headers, &nof_headers, 0);
2193
2194   server_date = get_header_value (headers, nof_headers, "date");
2195   document_date = get_header_value (headers, nof_headers, "last-modified");
2196
2197   if (!server_date || !*server_date) {
2198     snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sServer date unknown, "), *msg);
2199     date_result = max_state_alt(STATE_UNKNOWN, date_result);
2200   } else if (!document_date || !*document_date) {
2201     snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sDocument modification date unknown, "), *msg);
2202     date_result = max_state_alt(STATE_CRITICAL, date_result);
2203   } else {
2204     time_t srv_data = curl_getdate (server_date, NULL);
2205     time_t doc_data = curl_getdate (document_date, NULL);
2206     if (verbose >= 2)
2207       printf ("* server date: '%s' (%d), doc_date: '%s' (%d)\n", server_date, (int)srv_data, document_date, (int)doc_data);
2208     if (srv_data <= 0) {
2209       snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sServer date \"%100s\" unparsable, "), *msg, server_date);
2210       date_result = max_state_alt(STATE_CRITICAL, date_result);
2211     } else if (doc_data <= 0) {
2212       snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sDocument date \"%100s\" unparsable, "), *msg, document_date);
2213       date_result = max_state_alt(STATE_CRITICAL, date_result);
2214     } else if (doc_data > srv_data + 30) {
2215       snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sDocument is %d seconds in the future, "), *msg, (int)doc_data - (int)srv_data);
2216       date_result = max_state_alt(STATE_CRITICAL, date_result);
2217     } else if (doc_data < srv_data - maximum_age) {
2218       int n = (srv_data - doc_data);
2219       if (n > (60 * 60 * 24 * 2)) {
2220         snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sLast modified %.1f days ago, "), *msg, ((float) n) / (60 * 60 * 24));
2221         date_result = max_state_alt(STATE_CRITICAL, date_result);
2222       } else {
2223         snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sLast modified %d:%02d:%02d ago, "), *msg, n / (60 * 60), (n / 60) % 60, n % 60);
2224         date_result = max_state_alt(STATE_CRITICAL, date_result);
2225       }
2226     }
2227   }
2228
2229   if (server_date) free (server_date);
2230   if (document_date) free (document_date);
2231
2232   return date_result;
2233 }
2234
2235
2236 int
2237 get_content_length (const curlhelp_write_curlbuf* header_buf, const curlhelp_write_curlbuf* body_buf)
2238 {
2239   const char *s;
2240   int content_length = 0;
2241   char *copy;
2242   struct phr_header headers[255];
2243   size_t nof_headers = 255;
2244   size_t msglen;
2245   char *content_length_s = NULL;
2246   curlhelp_statusline status_line;
2247
2248   int res = phr_parse_response (header_buf->buf, header_buf->buflen,
2249     &status_line.http_minor, &status_line.http_code, &status_line.msg, &msglen,
2250     headers, &nof_headers, 0);
2251
2252   content_length_s = get_header_value (headers, nof_headers, "content-length");
2253   if (!content_length_s) {
2254     return header_buf->buflen + body_buf->buflen;
2255   }
2256   content_length_s += strspn (content_length_s, " \t");
2257   content_length = atoi (content_length_s);
2258   if (content_length != body_buf->buflen) {
2259     /* TODO: should we warn if the actual and the reported body length don't match? */
2260   }
2261
2262   if (content_length_s) free (content_length_s);
2263
2264   return header_buf->buflen + body_buf->buflen;
2265 }
2266
2267 /* TODO: is there a better way in libcurl to check for the SSL library? */
2268 curlhelp_ssl_library
2269 curlhelp_get_ssl_library (CURL* curl)
2270 {
2271   curl_version_info_data* version_data;
2272   char *ssl_version;
2273   char *library;
2274   curlhelp_ssl_library ssl_library = CURLHELP_SSL_LIBRARY_UNKNOWN;
2275
2276   version_data = curl_version_info (CURLVERSION_NOW);
2277   if (version_data == NULL) return CURLHELP_SSL_LIBRARY_UNKNOWN;
2278
2279   ssl_version = strdup (version_data->ssl_version);
2280   if (ssl_version == NULL ) return CURLHELP_SSL_LIBRARY_UNKNOWN;
2281
2282   library = strtok (ssl_version, "/");
2283   if (library == NULL) return CURLHELP_SSL_LIBRARY_UNKNOWN;
2284
2285   if (strcmp (library, "OpenSSL") == 0)
2286     ssl_library = CURLHELP_SSL_LIBRARY_OPENSSL;
2287   else if (strcmp (library, "LibreSSL") == 0)
2288     ssl_library = CURLHELP_SSL_LIBRARY_LIBRESSL;
2289   else if (strcmp (library, "GnuTLS") == 0)
2290     ssl_library = CURLHELP_SSL_LIBRARY_GNUTLS;
2291   else if (strcmp (library, "NSS") == 0)
2292     ssl_library = CURLHELP_SSL_LIBRARY_NSS;
2293
2294   if (verbose >= 2)
2295     printf ("* SSL library string is : %s %s (%d)\n", version_data->ssl_version, library, ssl_library);
2296
2297   free (ssl_version);
2298
2299   return ssl_library;
2300 }
2301
2302 const char*
2303 curlhelp_get_ssl_library_string (curlhelp_ssl_library ssl_library)
2304 {
2305   switch (ssl_library) {
2306     case CURLHELP_SSL_LIBRARY_OPENSSL:
2307       return "OpenSSL";
2308     case CURLHELP_SSL_LIBRARY_LIBRESSL:
2309       return "LibreSSL";
2310     case CURLHELP_SSL_LIBRARY_GNUTLS:
2311       return "GnuTLS";
2312     case CURLHELP_SSL_LIBRARY_NSS:
2313       return "NSS";
2314     case CURLHELP_SSL_LIBRARY_UNKNOWN:
2315     default:
2316       return "unknown";
2317   }
2318 }
2319
2320 #ifdef LIBCURL_FEATURE_SSL
2321 #ifndef USE_OPENSSL
2322 time_t
2323 parse_cert_date (const char *s)
2324 {
2325   struct tm tm;
2326   time_t date;
2327   char *res;
2328
2329   if (!s) return -1;
2330
2331   /* Jan 17 14:25:12 2020 GMT */
2332   res = strptime (s, "%Y-%m-%d %H:%M:%S GMT", &tm);
2333   /* Sep 11 12:00:00 2020 GMT */
2334   if (res == NULL) strptime (s, "%Y %m %d %H:%M:%S GMT", &tm);
2335   date = mktime (&tm);
2336
2337   return date;
2338 }
2339
2340 /* TODO: this needs cleanup in the sslutils.c, maybe we the #else case to
2341  * OpenSSL could be this function
2342  */
2343 int
2344 net_noopenssl_check_certificate (cert_ptr_union* cert_ptr, int days_till_exp_warn, int days_till_exp_crit)
2345 {
2346   int i;
2347   struct curl_slist* slist;
2348   int cname_found = 0;
2349   char* start_date_str = NULL;
2350   char* end_date_str = NULL;
2351   time_t start_date;
2352   time_t end_date;
2353         char *tz;
2354         float time_left;
2355         int days_left;
2356         int time_remaining;
2357         char timestamp[50] = "";
2358         int status = STATE_UNKNOWN;
2359
2360   if (verbose >= 2)
2361     printf ("**** REQUEST CERTIFICATES ****\n");
2362
2363   for (i = 0; i < cert_ptr->to_certinfo->num_of_certs; i++) {
2364     for (slist = cert_ptr->to_certinfo->certinfo[i]; slist; slist = slist->next) {
2365       /* find first common name in subject,
2366        * TODO: check alternative subjects for
2367        * TODO: have a decent parser here and not a hack
2368        * multi-host certificate, check wildcards
2369        */
2370       if (strncasecmp (slist->data, "Subject:", 8) == 0) {
2371         int d = 3;
2372         char* p = strstr (slist->data, "CN=");
2373         if (p == NULL) {
2374           d = 5;
2375           p = strstr (slist->data, "CN = ");
2376         }
2377         if (p != NULL) {
2378           if (strncmp (host_name, p+d, strlen (host_name)) == 0) {
2379             cname_found = 1;
2380           }
2381         }
2382       } else if (strncasecmp (slist->data, "Start Date:", 11) == 0) {
2383         start_date_str = &slist->data[11];
2384       } else if (strncasecmp (slist->data, "Expire Date:", 12) == 0) {
2385         end_date_str = &slist->data[12];
2386       } else if (strncasecmp (slist->data, "Cert:", 5) == 0) {
2387         goto HAVE_FIRST_CERT;
2388       }
2389       if (verbose >= 2)
2390         printf ("%d ** %s\n", i, slist->data);
2391     }
2392   }
2393 HAVE_FIRST_CERT:
2394
2395   if (verbose >= 2)
2396     printf ("**** REQUEST CERTIFICATES ****\n");
2397
2398   if (!cname_found) {
2399                 printf("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
2400                 return STATE_CRITICAL;
2401   }
2402
2403   start_date = parse_cert_date (start_date_str);
2404   if (start_date <= 0) {
2405     snprintf (msg, DEFAULT_BUFFER_SIZE, _("WARNING - Unparsable 'Start Date' in certificate: '%s'"),
2406       start_date_str);
2407     puts (msg);
2408     return STATE_WARNING;
2409   }
2410
2411   end_date = parse_cert_date (end_date_str);
2412   if (end_date <= 0) {
2413     snprintf (msg, DEFAULT_BUFFER_SIZE, _("WARNING - Unparsable 'Expire Date' in certificate: '%s'"),
2414       start_date_str);
2415     puts (msg);
2416     return STATE_WARNING;
2417   }
2418
2419   time_left = difftime (end_date, time(NULL));
2420         days_left = time_left / 86400;
2421         tz = getenv("TZ");
2422         setenv("TZ", "GMT", 1);
2423         tzset();
2424         strftime(timestamp, 50, "%c %z", localtime(&end_date));
2425         if (tz)
2426                 setenv("TZ", tz, 1);
2427         else
2428                 unsetenv("TZ");
2429         tzset();
2430
2431         if (days_left > 0 && days_left <= days_till_exp_warn) {
2432                 printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", host_name, days_left, timestamp);
2433                 if (days_left > days_till_exp_crit)
2434                         status = STATE_WARNING;
2435                 else
2436                         status = STATE_CRITICAL;
2437         } else if (days_left == 0 && time_left > 0) {
2438                 if (time_left >= 3600)
2439                         time_remaining = (int) time_left / 3600;
2440                 else
2441                         time_remaining = (int) time_left / 60;
2442
2443                 printf (_("%s - Certificate '%s' expires in %u %s (%s)\n"),
2444                         (days_left>days_till_exp_crit) ? "WARNING" : "CRITICAL", host_name, time_remaining,
2445                         time_left >= 3600 ? "hours" : "minutes", timestamp);
2446
2447                 if ( days_left > days_till_exp_crit)
2448                         status = STATE_WARNING;
2449                 else
2450                         status = STATE_CRITICAL;
2451         } else if (time_left < 0) {
2452                 printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), host_name, timestamp);
2453                 status=STATE_CRITICAL;
2454         } else if (days_left == 0) {
2455                 printf (_("%s - Certificate '%s' just expired (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", host_name, timestamp);
2456                 if (days_left > days_till_exp_crit)
2457                         status = STATE_WARNING;
2458                 else
2459                         status = STATE_CRITICAL;
2460         } else {
2461                 printf(_("OK - Certificate '%s' will expire on %s.\n"), host_name, timestamp);
2462                 status = STATE_OK;
2463         }
2464         return status;
2465 }
2466 #endif /* USE_OPENSSL */
2467 #endif /* LIBCURL_FEATURE_SSL */