10 files changed, 173 insertions, 36 deletions

diff --git a/.github/os_detect.sh b/.github/os_detect.sh
index ee9c145d..47c762d3 100644
--- a/.github/os_detect.sh
+++ b/.github/os_detect.sh
@@ -1,10 +1,17 @@
 #!/bin/sh -e
+
+. /etc/os-release
+
 # workaround for really bare-bones Archlinux containers:
 if [ -x "$(command -v pacman)" ]; then
     pacman --noconfirm -Sy
     pacman --noconfirm -S grep gawk sed
 fi
 
+if [ ${ID} == "fedora" -a ${VERSION_ID} -gt 41 ]; then
+    dnf install -y gawk
+fi
+
 os_release_file=
 if [ -s "/etc/os-release" ]; then
   os_release_file="/etc/os-release"
diff --git a/.github/workflows/test-next.yml b/.github/workflows/test-next.yml
index 81240759..fd59e85d 100644
--- a/.github/workflows/test-next.yml
+++ b/.github/workflows/test-next.yml
@@ -38,7 +38,7 @@ jobs:
               ${{ matrix.distro }} \
               /bin/sh -c '${{ matrix.prepare }} && \
                 tools/setup && \
-                ./configure --enable-libtap  --with-ipv6=no && \
+                ./configure --enable-libtap && \
                 make && \
                 make test && \
                 make dist && \
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 77ca6585..ce0ec547 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -35,7 +35,7 @@ jobs:
               ${{ matrix.distro }} \
               /bin/sh -c '${{ matrix.prepare }} && \
                 tools/setup && \
-                ./configure --enable-libtap  --with-ipv6=no && \
+                ./configure --enable-libtap && \
                 make && \
                 make test && \
                 make dist && \
diff --git a/configure.ac b/configure.ac
index fdc9b699..bec50cb4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1519,21 +1519,47 @@ then
 fi
 
 AC_PATH_PROG(PATH_TO_FPING,fping)
-AC_PATH_PROG(PATH_TO_FPING6,fping6)
 
 AC_ARG_WITH(fping_command,
             ACX_HELP_STRING([--with-fping-command=PATH],
                             [Path to fping command]), PATH_TO_FPING=$withval)
-AC_ARG_WITH(fping6_command,
-            ACX_HELP_STRING([--with-fping6-command=PATH],
-                            [Path to fping6 command]), PATH_TO_FPING6=$withval)
-
-if test -n "$PATH_TO_FPING"
-then
+if test -n "$PATH_TO_FPING"; then
         AC_DEFINE_UNQUOTED(PATH_TO_FPING,"$PATH_TO_FPING",[path to fping])
         EXTRAS="$EXTRAS check_fping\$(EXEEXT)"
-        if test x"$with_ipv6" != xno && test -n "$PATH_TO_FPING6"; then
-                AC_DEFINE_UNQUOTED(PATH_TO_FPING6,"$PATH_TO_FPING6",[path to fping6])
+
+        if test -z "$($PATH_TO_FPING --version)"  ; then
+                AC_MSG_NOTICE([failed to get version of fping])
+        else
+                FPING_MAJOR_VERSION="$($PATH_TO_FPING --version | sed 's/.*fping: Version //' | sed 's/\..*//')"
+                FPING_MINOR_VERSION="$($PATH_TO_FPING --version | sed 's/.*fping: Version //' | sed 's/.*\.//')"
+
+                if test $FPING_MAJOR_VERSION -eq 5 ; then
+                        if test $FPING_MINOR_VERSION -ge 3 ; then
+                                AC_DEFINE(FPING_VERSION_5_3_OR_HIGHER, "true", [fping is of version 5.3 or higher])
+                                AC_MSG_NOTICE([fping is of version 5.3 or higher])
+                                AC_DEFINE(FPING_VERSION_5_2_OR_HIGHER, "true", [fping is of version 5.2 or higher])
+                                AC_MSG_NOTICE([fping is of version 5.2 or higher])
+                        elif test $FPING_MINOR_VERSION -ge 2 ; then
+                                AC_DEFINE(FPING_VERSION_5_2_OR_HIGHER, "true", [fping is of version 5.2 or higher])
+                                AC_MSG_NOTICE([fping is of version 5.2 or higher])
+                        else
+                                AC_MSG_NOTICE([fping is of a version lower then 5.2])
+                        fi
+
+                elif $FPING_MAJOR_VERSION > 5 ; then
+                        AC_DEFINE(FPING_VERSION_5_2_OR_HIGHER, "true", [fping is of version 5.2 or higher])
+                        AC_MSG_NOTICE([fping is of version 5.2 or higher])
+                        AC_DEFINE(FPING_VERSION_5_3_OR_HIGHER, "true", [fping is of version 5.2 or higher])
+                        AC_MSG_NOTICE([fping is of version 5.3 or higher])
+                fi
+
+                if test "`fping --version | sed 's/.*fping: Version //'`" =  "5.2" ; then
+                        AC_DEFINE(FPING_VERSION, "5.2", [the version of fping available])
+                        AC_MSG_NOTICE([fping version: 5.2])
+                elif test "`fping --version | sed 's/.*fping: Version //'`" =  "5.3"; then
+                        AC_DEFINE(FPING_VERSION, "5.3", [the version of fping available])
+                        AC_MSG_NOTICE([fping version: 5.3])
+                fi
         fi
 else
         AC_MSG_WARN([Get fping from http://www.fping.com in order to make check_fping plugin])
diff --git a/lib/utils_cmd.c b/lib/utils_cmd.c
index 18350ac0..9b222409 100644
--- a/lib/utils_cmd.c
+++ b/lib/utils_cmd.c
@@ -346,7 +346,7 @@ int cmd_run_array(char *const *argv, output *out, output *err, int flags) {
         return _cmd_close(fd);
 }
 
-int cmd_file_read(char *filename, output *out, int flags) {
+int cmd_file_read(const char *filename, output *out, int flags) {
         int fd;
         if (out)
                 memset(out, 0, sizeof(output));
diff --git a/lib/utils_cmd.h b/lib/utils_cmd.h
index d00069c9..728ece23 100644
--- a/lib/utils_cmd.h
+++ b/lib/utils_cmd.h
@@ -20,7 +20,7 @@ typedef struct output output;
 /** prototypes **/
 int cmd_run(const char *, output *, output *, int);
 int cmd_run_array(char *const *, output *, output *, int);
-int cmd_file_read(char *, output *, int);
+int cmd_file_read(const char *, output *, int);
 
 /* only multi-threaded plugins need to bother with this */
 void cmd_init(void);
diff --git a/plugins/check_fping.c b/plugins/check_fping.c
index ec7abb67..8018e06d 100644
--- a/plugins/check_fping.c
+++ b/plugins/check_fping.c
@@ -79,6 +79,24 @@ int main(int argc, char **argv) {
         server = strscpy(server, config.server_name);
 
         char *option_string = "";
+        char *fping_prog = NULL;
+
+        /* First determine if the target is dualstack or ipv6 only. */
+        bool server_is_inet6_addr = is_inet6_addr(server);
+
+        /*
+         * If the user requested -6 OR the user made no assertion and the address is v6 or dualstack
+         *   -> we use ipv6
+         * If the user requested -4 OR the user made no assertion and the address is v4 ONLY
+         *   -> we use ipv4
+         */
+        if (address_family == AF_INET6 || (address_family == AF_UNSPEC && server_is_inet6_addr)) {
+                xasprintf(&option_string, "%s-6 ", option_string);
+        } else {
+                xasprintf(&option_string, "%s-4 ", option_string);
+        }
+        fping_prog = strdup(PATH_TO_FPING);
+
         /* compose the command */
         if (config.target_timeout) {
                 xasprintf(&option_string, "%s-t %d ", option_string, config.target_timeout);
@@ -99,19 +117,26 @@ int main(int argc, char **argv) {
                 xasprintf(&option_string, "%s-R ", option_string);
         }
 
-        char *fping_prog = NULL;
-#ifdef PATH_TO_FPING6
-        if (address_family != AF_INET && is_inet6_addr(server)) {
-                fping_prog = strdup(PATH_TO_FPING6);
-        } else {
-                fping_prog = strdup(PATH_TO_FPING);
+        if (config.fwmark_set) {
+                xasprintf(&option_string, "%s--fwmark %u ", option_string, config.fwmark);
+        }
+
+        if (config.icmp_timestamp) {
+                xasprintf(&option_string, "%s--icmp-timestamp ", option_string);
+        }
+
+        if (config.check_source) {
+                xasprintf(&option_string, "%s--check-source ", option_string);
         }
-#else
-        fping_prog = strdup(PATH_TO_FPING);
-#endif
 
         char *command_line = NULL;
-        xasprintf(&command_line, "%s %s-b %d -c %d %s", fping_prog, option_string, config.packet_size, config.packet_count, server);
+
+        if (config.icmp_timestamp) {
+                // no packet size settable for ICMP timestamp
+                xasprintf(&command_line, "%s %s -c %d %s", fping_prog, option_string, config.packet_count, server);
+        } else {
+                xasprintf(&command_line, "%s %s-b %d -c %d %s", fping_prog, option_string, config.packet_size, config.packet_count, server);
+        }
 
         if (verbose) {
                 printf("%s\n", command_line);
@@ -268,13 +293,38 @@ mp_state_enum textscan(char *buf, const char *server_name, bool crta_p, double c
 
 /* process command-line arguments */
 check_fping_config_wrapper process_arguments(int argc, char **argv) {
-        static struct option longopts[] = {
-                {"hostname", required_argument, 0, 'H'}, {"sourceip", required_argument, 0, 'S'}, {"sourceif", required_argument, 0, 'I'},
-                {"critical", required_argument, 0, 'c'}, {"warning", required_argument, 0, 'w'},  {"alive", no_argument, 0, 'a'},
-                {"bytes", required_argument, 0, 'b'},    {"number", required_argument, 0, 'n'},   {"target-timeout", required_argument, 0, 'T'},
-                {"interval", required_argument, 0, 'i'}, {"verbose", no_argument, 0, 'v'},        {"version", no_argument, 0, 'V'},
-                {"help", no_argument, 0, 'h'},           {"use-ipv4", no_argument, 0, '4'},       {"use-ipv6", no_argument, 0, '6'},
-                {"dontfrag", no_argument, 0, 'M'},       {"random", no_argument, 0, 'R'},         {0, 0, 0, 0}};
+        enum {
+                FWMARK_OPT = CHAR_MAX + 1,
+                ICMP_TIMESTAMP_OPT,
+                CHECK_SOURCE_OPT,
+        };
+        static struct option longopts[] = {{"hostname", required_argument, 0, 'H'},
+                                                                           {"sourceip", required_argument, 0, 'S'},
+                                                                           {"sourceif", required_argument, 0, 'I'},
+                                                                           {"critical", required_argument, 0, 'c'},
+                                                                           {"warning", required_argument, 0, 'w'},
+                                                                           {"alive", no_argument, 0, 'a'},
+                                                                           {"bytes", required_argument, 0, 'b'},
+                                                                           {"number", required_argument, 0, 'n'},
+                                                                           {"target-timeout", required_argument, 0, 'T'},
+                                                                           {"interval", required_argument, 0, 'i'},
+                                                                           {"verbose", no_argument, 0, 'v'},
+                                                                           {"version", no_argument, 0, 'V'},
+                                                                           {"help", no_argument, 0, 'h'},
+                                                                           {"use-ipv4", no_argument, 0, '4'},
+                                                                           {"use-ipv6", no_argument, 0, '6'},
+                                                                           {"dontfrag", no_argument, 0, 'M'},
+                                                                           {"random", no_argument, 0, 'R'},
+#ifdef FPING_VERSION_5_2_OR_HIGHER
+                                                                           // only available with fping version >= 5.2
+                                                                           {"fwmark", required_argument, NULL, FWMARK_OPT},
+#       ifdef FPING_VERSION_5_3_OR_HIGHER
+                                                                           // only available with fping version >= 5.3
+                                                                           {"icmp-timestamp", no_argument, NULL, ICMP_TIMESTAMP_OPT},
+                                                                           {"check-source", no_argument, NULL, CHECK_SOURCE_OPT},
+#       endif
+#endif
+                                                                           {0, 0, 0, 0}};
 
         char *rv[2];
         rv[PL] = NULL;
@@ -299,7 +349,7 @@ check_fping_config_wrapper process_arguments(int argc, char **argv) {
                 argc--;
         }
 
-        while (1) {
+        while (true) {
                 int option_index = getopt_long(argc, argv, "+hVvaH:S:c:w:b:n:T:i:I:M:R:46", longopts, &option);
 
                 if (option_index == -1 || option_index == EOF || option_index == 1) {
@@ -340,11 +390,7 @@ check_fping_config_wrapper process_arguments(int argc, char **argv) {
                         address_family = AF_INET;
                         break;
                 case '6': /* IPv6 only */
-#ifdef USE_IPV6
                         address_family = AF_INET6;
-#else
-                        usage(_("IPv6 support not available\n"));
-#endif
                         break;
                 case 'c':
                         get_threshold(optarg, rv);
@@ -406,6 +452,20 @@ check_fping_config_wrapper process_arguments(int argc, char **argv) {
                 case 'M':
                         result.config.dontfrag = true;
                         break;
+                case FWMARK_OPT:
+                        if (is_intpos(optarg)) {
+                                result.config.fwmark = (unsigned int)atol(optarg);
+                                result.config.fwmark_set = true;
+                        } else {
+                                usage(_("fwmark must be a positive integer"));
+                        }
+                        break;
+                case ICMP_TIMESTAMP_OPT:
+                        result.config.icmp_timestamp = true;
+                        break;
+                case CHECK_SOURCE_OPT:
+                        result.config.check_source = true;
+                        break;
                 }
         }
 
@@ -493,6 +553,16 @@ void print_help(void) {
         printf("    %s\n", _("set the Don't Fragment flag"));
         printf(" %s\n", "-R, --random");
         printf("    %s\n", _("random packet data (to foil link data compression)"));
+#ifdef FPING_VERSION_5_2_OR_HIGHER
+        printf(" %s\n", "--fwmark=INTEGER");
+        printf("    %s\n", _("set the routing mark to INTEGER (fping option)"));
+#       ifdef FPING_VERSION_5_3_OR_HIGHER
+        printf(" %s\n", "--icmp-timestamp");
+        printf("    %s\n", _("use ICMP Timestamp instead of ICMP Echo (fping option)"));
+        printf(" %s\n", "--check-source");
+        printf("    %s\n", _("discard replies not from target address (fping option)"));
+#       endif
+#endif
         printf(UT_VERBOSE);
         printf("\n");
         printf(" %s\n", _("THRESHOLD is <rta>,<pl>%% where <rta> is the round trip average travel time (ms)"));
diff --git a/plugins/check_fping.d/config.h b/plugins/check_fping.d/config.h
index a0697bf3..d95e9ded 100644
--- a/plugins/check_fping.d/config.h
+++ b/plugins/check_fping.d/config.h
@@ -29,6 +29,21 @@ typedef struct {
         bool cpl_p;
         int wpl;
         bool wpl_p;
+
+        // only available with fping version >= 5.2
+        // for a given uint _fwmark_ fping sets _fwmark_ as a firewall mark
+        // in the packets
+        unsigned int fwmark;
+        bool fwmark_set;
+
+
+        // only available with fping version >= 5.3
+        // Setting icmp_timestamp tells fping to use ICMP Timestamp (ICMP type 13) instead
+        // of ICMP Echo
+        bool icmp_timestamp;
+
+        // Setting check_source lets fping  discard replies which are not from the target address
+        bool check_source;
 } check_fping_config;
 
 check_fping_config check_fping_config_init() {
@@ -53,6 +68,15 @@ check_fping_config check_fping_config_init() {
                 .cpl_p = false,
                 .wpl = 0,
                 .wpl_p = false,
+
+                // only available with fping version >= 5.2
+                .fwmark = 0,
+                .fwmark_set = false, // just to be deterministic
+
+                // only available with fping version >= 5.3
+                .icmp_timestamp = false,
+                .check_source = false,
+
         };
         return tmp;
 }
diff --git a/plugins/check_http.c b/plugins/check_http.c
index baff682a..8e0c15ec 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -1724,6 +1724,16 @@ print_help (void)
   printf ("%s\n", _("strings and regular expressions, check connection times, and report on"));
   printf ("%s\n", _("certificate expiration times."));
 
+  printf ("\n");
+  printf ("%s\n", _("ATTENTION!"));
+  printf ("\n");
+  printf ("%s\n", _("THIS PLUGIN IS DEPRECATED. The functionality was reimplemented by the"));
+  printf ("%s\n", _("check_curl plugin, which can be used as a drop-in replacement. You should"));
+  printf ("%s\n", _("migrate your checks over to check_curl, because check_http is going to be"));
+  printf ("%s\n", _("removed sooner than later. Just replace check_http with check_curl in your"));
+  printf ("%s\n", _("check command definitions."));
+  printf ("%s\n", _("Report issues to: https://github.com/monitoring-plugins/monitoring-plugins/issues"));
+
   printf ("\n\n");
 
   print_usage ();
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index 719de575..96740b3a 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -201,7 +201,7 @@ int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int
         time_t tm_t;
 
         if (!certificate) {
-                printf("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
+                printf("%s\n", _("CRITICAL - No server certificate present to inspect."));
                 return STATE_CRITICAL;
         }