summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--.gitignore7
-rw-r--r--.travis.yml2
-rw-r--r--ACKNOWLEDGEMENTS8
-rw-r--r--REQUIREMENTS16
-rw-r--r--configure.ac39
-rw-r--r--m4/libcurl.m4272
-rw-r--r--m4/uriparser.m4140
-rw-r--r--plugins/Makefile.am9
-rw-r--r--plugins/check_curl.c2335
-rw-r--r--plugins/picohttpparser/Makefile.am3
-rw-r--r--plugins/picohttpparser/picohttpparser.c645
-rw-r--r--plugins/picohttpparser/picohttpparser.h87
-rw-r--r--plugins/sslutils.c33
-rw-r--r--plugins/t/check_curl.t199
-rw-r--r--plugins/t/check_http.t76
-rwxr-xr-xplugins/tests/check_curl.t498
-rwxr-xr-xplugins/tests/check_http.t9
-rw-r--r--po/de.po6
18 files changed, 4325 insertions, 59 deletions
diff --git a/.gitignore b/.gitignore
index 0c16add..c7b668e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -142,6 +142,7 @@ NP-VERSION-FILE
142/plugins/check_by_ssh 142/plugins/check_by_ssh
143/plugins/check_clamd 143/plugins/check_clamd
144/plugins/check_cluster 144/plugins/check_cluster
145/plugins/check_curl
145/plugins/check_dbi 146/plugins/check_dbi
146/plugins/check_dig 147/plugins/check_dig
147/plugins/check_disk 148/plugins/check_disk
@@ -202,6 +203,12 @@ NP-VERSION-FILE
202/plugins/stamp-h* 203/plugins/stamp-h*
203/plugins/urlize 204/plugins/urlize
204 205
206# /plugins/picohttpparser
207/plugins/picohttpparser/Makefile
208/plugins/picohttpparser/Makefile.in
209/plugins/picohttpparser/.deps
210/plugins/picohttpparser/libpicohttpparser.a
211
205# /plugins/t/ 212# /plugins/t/
206/plugins/t/*.tmp 213/plugins/t/*.tmp
207 214
diff --git a/.travis.yml b/.travis.yml
index 946345c..3d9fe64 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -51,6 +51,8 @@ install:
51 - sudo apt-get install -qq --no-install-recommends autoconf automake 51 - sudo apt-get install -qq --no-install-recommends autoconf automake
52 - sudo apt-get install -qq --no-install-recommends faketime 52 - sudo apt-get install -qq --no-install-recommends faketime
53 - sudo apt-get install -qq --no-install-recommends libmonitoring-plugin-perl 53 - sudo apt-get install -qq --no-install-recommends libmonitoring-plugin-perl
54 - sudo apt-get install -qq --no-install-recommends libcurl4-openssl-dev
55 - sudo apt-get install -qq --no-install-recommends liburiparser-dev
54 - sudo apt-get install -qq --no-install-recommends squid 56 - sudo apt-get install -qq --no-install-recommends squid
55 # Trusty related dependencies (not yet provided) 57 # Trusty related dependencies (not yet provided)
56 - test "$(dpkg -l | grep -E "mysql-(client|server)-[0-9].[0-9]" | grep -c ^ii)" -gt 0 || sudo apt-get install -qq --no-install-recommends mariadb-client mariadb-server 58 - test "$(dpkg -l | grep -E "mysql-(client|server)-[0-9].[0-9]" | grep -c ^ii)" -gt 0 || sudo apt-get install -qq --no-install-recommends mariadb-client mariadb-server
diff --git a/ACKNOWLEDGEMENTS b/ACKNOWLEDGEMENTS
index 50c714c..d73be54 100644
--- a/ACKNOWLEDGEMENTS
+++ b/ACKNOWLEDGEMENTS
@@ -20,7 +20,7 @@ Using the DLPI support on SysV systems to get the host MAC address in check_dhcp
20Stenberg, Daniel 20Stenberg, Daniel
21Copyright (c) 1996 - 2004, Daniel Stenberg, <daniel@haxx.se> 21Copyright (c) 1996 - 2004, Daniel Stenberg, <daniel@haxx.se>
22http://curl.haxx.se/ 22http://curl.haxx.se/
23Use of duplication of macros in m4/np_curl.m4 23Use of duplication of macros in m4/np_curl.m4 (slighly adapted for m4/uriparser.m4 too)
24 24
25Coreutils team 25Coreutils team
26Copyright (C) 91, 1995-2004 Free Software Foundation, Inc. 26Copyright (C) 91, 1995-2004 Free Software Foundation, Inc.
@@ -31,3 +31,9 @@ Gnulib team
31Copyright (C) 2001, 2003, 2004, 2006 Free Software Foundation, Inc 31Copyright (C) 2001, 2003, 2004, 2006 Free Software Foundation, Inc
32http://www.gnu.org/software/gnulib/ 32http://www.gnu.org/software/gnulib/
33Use of lib files that originally were used from coreutils 33Use of lib files that originally were used from coreutils
34
35Copyright (c) 2009-2014 Kazuho Oku, Tokuhiro Matsuno, Daisuke Murase,
36 Shigeo Mitsunari
37picohttpparser
38https://github.com/h2o/picohttpparser
39Use of the library for HTTP header parsing in check_curl.
diff --git a/REQUIREMENTS b/REQUIREMENTS
index ac7b593..f3b1c01 100644
--- a/REQUIREMENTS
+++ b/REQUIREMENTS
@@ -11,6 +11,22 @@ check_ldaps, check_http --ssl, check_tcp --ssl, check_smtp --starttls
11 - Requires openssl or gnutls libraries for SSL connections 11 - Requires openssl or gnutls libraries for SSL connections
12 http://www.openssl.org, http://www.gnu.org/software/gnutls 12 http://www.openssl.org, http://www.gnu.org/software/gnutls
13 13
14check_curl:
15 - Requires libcurl 7.15.2 or later
16 http://www.haxx.se
17 - --ssl/-S and -C requires OpenSSL for certificate checks, otherwise
18 libcurl must be quite new to support CURLINFO_CERTINFO with
19 GnuTLS and NSS libraries:
20 - 7.42.0 or newer for GnuTLS
21 - 7.34.0 or newer for NSS
22 GnuTLS is known to create problems on some distributions with
23 self-signed certificate chains
24 http://www.openssl.org, http://www.gnu.org/software/gnutls,
25 http://www.mozilla.org/projects/security/pki/nss/,
26 other SSL implementations are currently not supported
27 - uriparser 0.7.5 or later
28 https://uriparser.github.io/
29
14check_fping: 30check_fping:
15 - Requires the fping utility distributed with SATAN. Either 31 - Requires the fping utility distributed with SATAN. Either
16 download and install SATAN or grab the fping program from 32 download and install SATAN or grab the fping program from
diff --git a/configure.ac b/configure.ac
index 4a9a92a..4aebc2a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -385,6 +385,42 @@ if test "$ac_cv_header_wtsapi32_h" = "yes"; then
385 AC_SUBST(WTSAPI32LIBS) 385 AC_SUBST(WTSAPI32LIBS)
386fi 386fi
387 387
388_can_enable_check_curl=no
389dnl Check for cURL library
390LIBCURL_CHECK_CONFIG(yes, 7.15.2, [
391 _can_enable_check_curl=yes
392 LIBCURLINCLUDE="$LIBCURL_CPPFLAGS"
393 LIBCURLLIBS="$LIBCURL"
394 LIBCURLCFLAGS="$LIBCURL_CPPFLAGS"
395 AC_SUBST(LIBCURLINCLUDE)
396 AC_SUBST(LIBCURLLIBS)
397 AC_SUBST(LIBCURLCFLAGS)
398 ], [
399 _can_enable_check_curl=no
400 AC_MSG_WARN([Skipping curl plugin])
401 AC_MSG_WARN([install libcurl libs to compile this plugin (see REQUIREMENTS).])
402])
403
404dnl Check for uriparser library
405URIPARSER_CHECK(yes, 0.7.5, [
406 URIPARSERINCLUDE="$URIPARSER_CPPFLAGS"
407 URIPARSERLIBS="$URIPARSER"
408 URIPARSERCFLAGS="$URIPARSER_CPPFLAGS"
409 AC_SUBST(URIPARSERINCLUDE)
410 AC_SUBST(URIPARSERLIBS)
411 AC_SUBST(URIPARSERCFLAGS)
412 ], [
413 _can_enable_check_curl=no
414 AC_MSG_WARN([Skipping curl plugin])
415 AC_MSG_WARN([install the uriparser library to compile this plugin (see REQUIREMENTS).])
416])
417
418dnl prerequisites met, enable the plugin
419if test x$_can_enable_check_curl = xyes; then
420 EXTRAS="$EXTRAS check_curl\$(EXEEXT)"
421fi
422AC_CONFIG_FILES([plugins/picohttpparser/Makefile])
423
388dnl Fallback to who(1) if the system doesn't provide an utmpx(5) interface 424dnl Fallback to who(1) if the system doesn't provide an utmpx(5) interface
389if test "$ac_cv_header_utmpx_h" = "no" -a "$ac_cv_header_wtsapi32_h" = "no" 425if test "$ac_cv_header_utmpx_h" = "no" -a "$ac_cv_header_wtsapi32_h" = "no"
390then 426then
@@ -1894,4 +1930,5 @@ ACX_FEATURE([enable],[perl-modules])
1894ACX_FEATURE([with],[cgiurl]) 1930ACX_FEATURE([with],[cgiurl])
1895ACX_FEATURE([with],[trusted-path]) 1931ACX_FEATURE([with],[trusted-path])
1896ACX_FEATURE([enable],[libtap]) 1932ACX_FEATURE([enable],[libtap])
1897 1933ACX_FEATURE([with],[libcurl])
1934ACX_FEATURE([with],[uriparser])
diff --git a/m4/libcurl.m4 b/m4/libcurl.m4
new file mode 100644
index 0000000..53d694d
--- /dev/null
+++ b/m4/libcurl.m4
@@ -0,0 +1,272 @@
1#***************************************************************************
2# _ _ ____ _
3# Project ___| | | | _ \| |
4# / __| | | | |_) | |
5# | (__| |_| | _ <| |___
6# \___|\___/|_| \_\_____|
7#
8# Copyright (C) 2006, David Shaw <dshaw@jabberwocky.com>
9#
10# This software is licensed as described in the file COPYING, which
11# you should have received as part of this distribution. The terms
12# are also available at https://curl.haxx.se/docs/copyright.html.
13#
14# You may opt to use, copy, modify, merge, publish, distribute and/or sell
15# copies of the Software, and permit persons to whom the Software is
16# furnished to do so, under the terms of the COPYING file.
17#
18# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19# KIND, either express or implied.
20#
21###########################################################################
22# LIBCURL_CHECK_CONFIG ([DEFAULT-ACTION], [MINIMUM-VERSION],
23# [ACTION-IF-YES], [ACTION-IF-NO])
24# ----------------------------------------------------------
25# David Shaw <dshaw@jabberwocky.com> May-09-2006
26#
27# Checks for libcurl. DEFAULT-ACTION is the string yes or no to
28# specify whether to default to --with-libcurl or --without-libcurl.
29# If not supplied, DEFAULT-ACTION is yes. MINIMUM-VERSION is the
30# minimum version of libcurl to accept. Pass the version as a regular
31# version number like 7.10.1. If not supplied, any version is
32# accepted. ACTION-IF-YES is a list of shell commands to run if
33# libcurl was successfully found and passed the various tests.
34# ACTION-IF-NO is a list of shell commands that are run otherwise.
35# Note that using --without-libcurl does run ACTION-IF-NO.
36#
37# This macro #defines HAVE_LIBCURL if a working libcurl setup is
38# found, and sets @LIBCURL@ and @LIBCURL_CPPFLAGS@ to the necessary
39# values. Other useful defines are LIBCURL_FEATURE_xxx where xxx are
40# the various features supported by libcurl, and LIBCURL_PROTOCOL_yyy
41# where yyy are the various protocols supported by libcurl. Both xxx
42# and yyy are capitalized. See the list of AH_TEMPLATEs at the top of
43# the macro for the complete list of possible defines. Shell
44# variables $libcurl_feature_xxx and $libcurl_protocol_yyy are also
45# defined to 'yes' for those features and protocols that were found.
46# Note that xxx and yyy keep the same capitalization as in the
47# curl-config list (e.g. it's "HTTP" and not "http").
48#
49# Users may override the detected values by doing something like:
50# LIBCURL="-lcurl" LIBCURL_CPPFLAGS="-I/usr/myinclude" ./configure
51#
52# For the sake of sanity, this macro assumes that any libcurl that is
53# found is after version 7.7.2, the first version that included the
54# curl-config script. Note that it is very important for people
55# packaging binary versions of libcurl to include this script!
56# Without curl-config, we can only guess what protocols are available,
57# or use curl_version_info to figure it out at runtime.
58
59AC_DEFUN([LIBCURL_CHECK_CONFIG],
60[
61 AH_TEMPLATE([LIBCURL_FEATURE_SSL],[Defined if libcurl supports SSL])
62 AH_TEMPLATE([LIBCURL_FEATURE_KRB4],[Defined if libcurl supports KRB4])
63 AH_TEMPLATE([LIBCURL_FEATURE_IPV6],[Defined if libcurl supports IPv6])
64 AH_TEMPLATE([LIBCURL_FEATURE_LIBZ],[Defined if libcurl supports libz])
65 AH_TEMPLATE([LIBCURL_FEATURE_ASYNCHDNS],[Defined if libcurl supports AsynchDNS])
66 AH_TEMPLATE([LIBCURL_FEATURE_IDN],[Defined if libcurl supports IDN])
67 AH_TEMPLATE([LIBCURL_FEATURE_SSPI],[Defined if libcurl supports SSPI])
68 AH_TEMPLATE([LIBCURL_FEATURE_NTLM],[Defined if libcurl supports NTLM])
69
70 AH_TEMPLATE([LIBCURL_PROTOCOL_HTTP],[Defined if libcurl supports HTTP])
71 AH_TEMPLATE([LIBCURL_PROTOCOL_HTTPS],[Defined if libcurl supports HTTPS])
72 AH_TEMPLATE([LIBCURL_PROTOCOL_FTP],[Defined if libcurl supports FTP])
73 AH_TEMPLATE([LIBCURL_PROTOCOL_FTPS],[Defined if libcurl supports FTPS])
74 AH_TEMPLATE([LIBCURL_PROTOCOL_FILE],[Defined if libcurl supports FILE])
75 AH_TEMPLATE([LIBCURL_PROTOCOL_TELNET],[Defined if libcurl supports TELNET])
76 AH_TEMPLATE([LIBCURL_PROTOCOL_LDAP],[Defined if libcurl supports LDAP])
77 AH_TEMPLATE([LIBCURL_PROTOCOL_DICT],[Defined if libcurl supports DICT])
78 AH_TEMPLATE([LIBCURL_PROTOCOL_TFTP],[Defined if libcurl supports TFTP])
79 AH_TEMPLATE([LIBCURL_PROTOCOL_RTSP],[Defined if libcurl supports RTSP])
80 AH_TEMPLATE([LIBCURL_PROTOCOL_POP3],[Defined if libcurl supports POP3])
81 AH_TEMPLATE([LIBCURL_PROTOCOL_IMAP],[Defined if libcurl supports IMAP])
82 AH_TEMPLATE([LIBCURL_PROTOCOL_SMTP],[Defined if libcurl supports SMTP])
83
84 AC_ARG_WITH(libcurl,
85 AS_HELP_STRING([--with-libcurl=PREFIX],[look for the curl library in PREFIX/lib and headers in PREFIX/include]),
86 [_libcurl_with=$withval],[_libcurl_with=ifelse([$1],,[yes],[$1])])
87
88 if test "$_libcurl_with" != "no" ; then
89
90 AC_PROG_AWK
91
92 _libcurl_version_parse="eval $AWK '{split(\$NF,A,\".\"); X=256*256*A[[1]]+256*A[[2]]+A[[3]]; print X;}'"
93
94 _libcurl_try_link=yes
95
96 if test -d "$_libcurl_with" ; then
97 LIBCURL_CPPFLAGS="-I$withval/include"
98 _libcurl_ldflags="-L$withval/lib"
99 AC_PATH_PROG([_libcurl_config],[curl-config],[],
100 ["$withval/bin"])
101 else
102 AC_PATH_PROG([_libcurl_config],[curl-config],[],[$PATH])
103 fi
104
105 if test x$_libcurl_config != "x" ; then
106 AC_CACHE_CHECK([for the version of libcurl],
107 [libcurl_cv_lib_curl_version],
108 [libcurl_cv_lib_curl_version=`$_libcurl_config --version | $AWK '{print $[]2}'`])
109
110 _libcurl_version=`echo $libcurl_cv_lib_curl_version | $_libcurl_version_parse`
111 _libcurl_wanted=`echo ifelse([$2],,[0],[$2]) | $_libcurl_version_parse`
112
113 if test $_libcurl_wanted -gt 0 ; then
114 AC_CACHE_CHECK([for libcurl >= version $2],
115 [libcurl_cv_lib_version_ok],
116 [
117 if test $_libcurl_version -ge $_libcurl_wanted ; then
118 libcurl_cv_lib_version_ok=yes
119 else
120 libcurl_cv_lib_version_ok=no
121 fi
122 ])
123 fi
124
125 if test $_libcurl_wanted -eq 0 || test x$libcurl_cv_lib_version_ok = xyes ; then
126 if test x"$LIBCURL_CPPFLAGS" = "x" ; then
127 LIBCURL_CPPFLAGS=`$_libcurl_config --cflags`
128 fi
129 if test x"$LIBCURL" = "x" ; then
130 LIBCURL=`$_libcurl_config --libs`
131
132 # This is so silly, but Apple actually has a bug in their
133 # curl-config script. Fixed in Tiger, but there are still
134 # lots of Panther installs around.
135 case "${host}" in
136 powerpc-apple-darwin7*)
137 LIBCURL=`echo $LIBCURL | sed -e 's|-arch i386||g'`
138 ;;
139 esac
140 fi
141
142 # All curl-config scripts support --feature
143 _libcurl_features=`$_libcurl_config --feature`
144
145 # Is it modern enough to have --protocols? (7.12.4)
146 if test $_libcurl_version -ge 461828 ; then
147 _libcurl_protocols=`$_libcurl_config --protocols`
148 fi
149 else
150 _libcurl_try_link=no
151 fi
152
153 unset _libcurl_wanted
154 fi
155
156 if test $_libcurl_try_link = yes ; then
157
158 # we didn't find curl-config, so let's see if the user-supplied
159 # link line (or failing that, "-lcurl") is enough.
160 LIBCURL=${LIBCURL-"$_libcurl_ldflags -lcurl"}
161
162 AC_CACHE_CHECK([whether libcurl is usable],
163 [libcurl_cv_lib_curl_usable],
164 [
165 _libcurl_save_cppflags=$CPPFLAGS
166 CPPFLAGS="$LIBCURL_CPPFLAGS $CPPFLAGS"
167 _libcurl_save_libs=$LIBS
168 LIBS="$LIBCURL $LIBS"
169
170 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <curl/curl.h>]],[[
171/* Try and use a few common options to force a failure if we are
172 missing symbols or can't link. */
173int x;
174curl_easy_setopt(NULL,CURLOPT_URL,NULL);
175x=CURL_ERROR_SIZE;
176x=CURLOPT_WRITEFUNCTION;
177x=CURLOPT_WRITEDATA;
178x=CURLOPT_ERRORBUFFER;
179x=CURLOPT_STDERR;
180x=CURLOPT_VERBOSE;
181if (x) {;}
182]])],libcurl_cv_lib_curl_usable=yes,libcurl_cv_lib_curl_usable=no)
183
184 CPPFLAGS=$_libcurl_save_cppflags
185 LIBS=$_libcurl_save_libs
186 unset _libcurl_save_cppflags
187 unset _libcurl_save_libs
188 ])
189
190 if test $libcurl_cv_lib_curl_usable = yes ; then
191
192 # Does curl_free() exist in this version of libcurl?
193 # If not, fake it with free()
194
195 _libcurl_save_cppflags=$CPPFLAGS
196 CPPFLAGS="$CPPFLAGS $LIBCURL_CPPFLAGS"
197 _libcurl_save_libs=$LIBS
198 LIBS="$LIBS $LIBCURL"
199
200 AC_CHECK_FUNC(curl_free,,
201 AC_DEFINE(curl_free,free,
202 [Define curl_free() as free() if our version of curl lacks curl_free.]))
203
204 CPPFLAGS=$_libcurl_save_cppflags
205 LIBS=$_libcurl_save_libs
206 unset _libcurl_save_cppflags
207 unset _libcurl_save_libs
208
209 AC_DEFINE(HAVE_LIBCURL,1,
210 [Define to 1 if you have a functional curl library.])
211 AC_SUBST(LIBCURL_CPPFLAGS)
212 AC_SUBST(LIBCURL)
213
214 for _libcurl_feature in $_libcurl_features ; do
215 AC_DEFINE_UNQUOTED(AS_TR_CPP(libcurl_feature_$_libcurl_feature),[1])
216 eval AS_TR_SH(libcurl_feature_$_libcurl_feature)=yes
217 done
218
219 if test "x$_libcurl_protocols" = "x" ; then
220
221 # We don't have --protocols, so just assume that all
222 # protocols are available
223 _libcurl_protocols="HTTP FTP FILE TELNET LDAP DICT TFTP"
224
225 if test x$libcurl_feature_SSL = xyes ; then
226 _libcurl_protocols="$_libcurl_protocols HTTPS"
227
228 # FTPS wasn't standards-compliant until version
229 # 7.11.0 (0x070b00 == 461568)
230 if test $_libcurl_version -ge 461568; then
231 _libcurl_protocols="$_libcurl_protocols FTPS"
232 fi
233 fi
234
235 # RTSP, IMAP, POP3 and SMTP were added in
236 # 7.20.0 (0x071400 == 463872)
237 if test $_libcurl_version -ge 463872; then
238 _libcurl_protocols="$_libcurl_protocols RTSP IMAP POP3 SMTP"
239 fi
240 fi
241
242 for _libcurl_protocol in $_libcurl_protocols ; do
243 AC_DEFINE_UNQUOTED(AS_TR_CPP(libcurl_protocol_$_libcurl_protocol),[1])
244 eval AS_TR_SH(libcurl_protocol_$_libcurl_protocol)=yes
245 done
246 else
247 unset LIBCURL
248 unset LIBCURL_CPPFLAGS
249 fi
250 fi
251
252 unset _libcurl_try_link
253 unset _libcurl_version_parse
254 unset _libcurl_config
255 unset _libcurl_feature
256 unset _libcurl_features
257 unset _libcurl_protocol
258 unset _libcurl_protocols
259 unset _libcurl_version
260 unset _libcurl_ldflags
261 fi
262
263 if test x$_libcurl_with = xno || test x$libcurl_cv_lib_curl_usable != xyes ; then
264 # This is the IF-NO path
265 ifelse([$4],,:,[$4])
266 else
267 # This is the IF-YES path
268 ifelse([$3],,:,[$3])
269 fi
270
271 unset _libcurl_with
272])dnl
diff --git a/m4/uriparser.m4 b/m4/uriparser.m4
new file mode 100644
index 0000000..dbb8a55
--- /dev/null
+++ b/m4/uriparser.m4
@@ -0,0 +1,140 @@
1# (this check is rougly based on and inspired libcurl.m4)
2# URIPARSER_CHECK ([DEFAULT-ACTION], [MINIMUM-VERSION],
3# [ACTION-IF-YES], [ACTION-IF-NO])
4# Checks for uriparser library. DEFAULT-ACTION is the string yes or no to
5# specify whether to default to --with-uriparser or --without-liburiparser.
6# If not supplied, DEFAULT-ACTION is yes. MINIMUM-VERSION is the
7# minimum version of uriparser to accept. Pass the version as a regular
8# version number like 0.8.5. If not supplied, any version is
9# accepted. ACTION-IF-YES is a list of shell commands to run if
10# uriparser was successfully found and passed the various tests.
11# ACTION-IF-NO is a list of shell commands that are run otherwise.
12# Note that using --without-uriparser does run ACTION-IF-NO.
13#
14# This macro #defines HAVE_URIPARSER if a working uriparser setup is
15# found, and sets @URIPARSER@ and @URIPARSER_CPPFLAGS@ to the necessary
16# values.
17#
18# Users may override the detected values by doing something like:
19# URIPARSER="-luriparser" URIPARSER_CPPFLAGS="-I/usr/myinclude" ./configure
20#
21
22AC_DEFUN([URIPARSER_CHECK],
23[
24 AC_ARG_WITH(uriparser,
25 AS_HELP_STRING([--with-uriparser=PREFIX],[look for the uriparser library in PREFIX/lib and headers in PREFIX/include]),
26 [_uriparser_with=$withval],[_uriparser_with=ifelse([$1],,[yes],[$1])])
27
28 if test "$_uriparser_with" != "no" ; then
29
30 _uriparser_try_link=yes
31
32 AC_CHECK_PROG(PKGCONFIG,pkg-config,pkg-config,no)
33
34 if test "x$URIPARSER" != "x" || test "x$URIPARSER_CPPFLAGS" != "x"; then
35 :
36 elif test -d "$_uriparser_with" ; then
37 URIPARSER_CPPFLAGS="-I$withval/include"
38 _uriparser_ldflags="-L$withval/lib"
39
40 elif test x$PKGCONFIG != xno; then
41
42 AC_CACHE_CHECK([for the version of uriparser],
43 [uriparser_cv_uriparser_version],
44 [uriparser_cv_uriparser_version=`$PKGCONFIG liburiparser --modversion`])
45
46 AC_PROG_AWK
47
48 _uriparser_version_parse="eval $AWK '{split(\$NF,A,\".\"); X=256*256*A[[1]]+256*A[[2]]+A[[3]]; print X;}'"
49
50 _uriparser_version=`echo $uriparser_cv_uriparser_version | $_uriparser_version_parse`
51 _uriparser_wanted=`echo ifelse([$2],,[0],[$2]) | $_uriparser_version_parse`
52
53 if test $_uriparser_wanted -gt 0 ; then
54 AC_CACHE_CHECK([for uriparser >= version $2],
55 [uriparser_cv_lib_version_ok],
56 [
57 if test $_uriparser_version -ge $_uriparser_wanted ; then
58 uriparser_cv_lib_version_ok=yes
59 else
60 uriparser_cv_lib_version_ok=no
61 fi
62 ])
63 fi
64
65 if test $_uriparser_wanted -eq 0 || test x$uriparser_cv_lib_version_ok = xyes ; then
66 if test x"$URIPARSER_CPPFLAGS" = "x" ; then
67 URIPARSER_CPPFLAGS=`$PKGCONFIG liburiparser --cflags`
68 fi
69 if test x"$URIPARSER" = "x" ; then
70 URIPARSER=`$PKGCONFIG liburiparser --libs`
71 fi
72 else
73 _uriparser_try_link=no
74 fi
75
76 unset _uriparser_wanted
77 else
78 dnl no pkg-config, ok, do our best and set some defaults
79 URIPARSER_CPPFLAGS="-I/usr/include"
80 URIPARSER="-luriparser -L/usr/lib -L/usr/lib64 -L/usr/lib/x86_64-linux-gnu -L/usr/lib/i686-linux-gnu"
81 fi
82
83 if test $_uriparser_try_link = yes ; then
84
85 # let's see if the user-supplied
86 # link line (or failing that, "-luriparser") is enough.
87 URIPARSER=${URIPARSER-"$_uriparser_ldflags -luriparser"}
88
89 AC_CACHE_CHECK([whether uriparser is usable],
90 [uriparser_cv_lib_uriparser_usable],
91 [
92 _liburiparser_save_cppflags=$CPPFLAGS
93 CPPFLAGS="$URIPARSER_CPPFLAGS $CPPFLAGS"
94 _liburiparser_save_libs=$LIBS
95 LIBS="$URIPARSER $LIBS"
96
97 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <uriparser/Uri.h>]],[[
98/* Try and use a few common options to force a failure if we are
99 missing symbols or cannot link. */
100UriParserStateA state;
101UriUriA uri;
102state.uri = &uri;
103char *location = "http://test.dom/dir/file.ext";
104int x = uriParseUriA (&state, location);
105if (x == URI_SUCCESS) {;}
106]])],uriparser_cv_lib_uriparser_usable=yes,uriparser_cv_lib_uriparser_usable=no)
107
108 CPPFLAGS=$_liburiparser_save_cppflags
109 LIBS=$_liburiparser_save_libs
110 unset _liburiparser_save_cppflags
111 unset _liburiparser_save_libs
112 ])
113
114 if test $uriparser_cv_lib_uriparser_usable = yes ; then
115 AC_DEFINE(HAVE_URIPARSER,1,
116 [Define to 1 if you have a functional uriparser library.])
117 AC_SUBST(URIPARSER_CPPFLAGS)
118 AC_SUBST(URIPARSER)
119 else
120 unset URIPARSER
121 unset URIPARSER_CPPFLAGS
122 fi
123 fi
124
125 unset _uriparser_try_link
126 unset _uriparser_version_parse
127 unset _uriparser_version
128 unset _uriparser_ldflags
129 fi
130
131 if test x$_uriparser_with = xno || test x$uriparser_cv_lib_uriparser_usable != xyes ; then
132 # This is the IF-NO path
133 ifelse([$4],,:,[$4])
134 else
135 # This is the IF-YES path
136 ifelse([$3],,:,[$3])
137 fi
138
139 unset _uriparser_with
140])dnl
diff --git a/plugins/Makefile.am b/plugins/Makefile.am
index 0ddf9bd..3fde54d 100644
--- a/plugins/Makefile.am
+++ b/plugins/Makefile.am
@@ -38,7 +38,9 @@ check_tcp_programs = check_ftp check_imap check_nntp check_pop \
38EXTRA_PROGRAMS = check_mysql check_radius check_pgsql check_snmp check_hpjd \ 38EXTRA_PROGRAMS = check_mysql check_radius check_pgsql check_snmp check_hpjd \
39 check_swap check_fping check_ldap check_game check_dig \ 39 check_swap check_fping check_ldap check_game check_dig \
40 check_nagios check_by_ssh check_dns check_nt check_ide_smart \ 40 check_nagios check_by_ssh check_dns check_nt check_ide_smart \
41 check_procs check_mysql_query check_apt check_dbi 41 check_procs check_mysql_query check_apt check_dbi check_curl
42
43SUBDIRS = picohttpparser
42 44
43EXTRA_DIST = t tests 45EXTRA_DIST = t tests
44 46
@@ -69,6 +71,9 @@ test-debug:
69 71
70check_apt_LDADD = $(BASEOBJS) 72check_apt_LDADD = $(BASEOBJS)
71check_cluster_LDADD = $(BASEOBJS) 73check_cluster_LDADD = $(BASEOBJS)
74check_curl_CFLAGS = $(AM_CFLAGS) $(LIBCURLCFLAGS) $(URIPARSERCFLAGS) $(LIBCURLINCLUDE) $(URIPARSERINCLUDE) -Ipicohttpparser
75check_curl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCURLCFLAGS) $(URIPARSERCFLAGS) $(LIBCURLINCLUDE) $(URIPARSERINCLUDE) -Ipicohttpparser
76check_curl_LDADD = $(NETLIBS) $(LIBCURLLIBS) $(SSLOBJS) $(URIPARSERLIBS) picohttpparser/libpicohttpparser.a
72check_dbi_LDADD = $(NETLIBS) $(DBILIBS) 77check_dbi_LDADD = $(NETLIBS) $(DBILIBS)
73check_dig_LDADD = $(NETLIBS) 78check_dig_LDADD = $(NETLIBS)
74check_disk_LDADD = $(BASEOBJS) 79check_disk_LDADD = $(BASEOBJS)
@@ -89,7 +94,7 @@ check_mysql_query_CFLAGS = $(AM_CFLAGS) $(MYSQLCFLAGS)
89check_mysql_query_CPPFLAGS = $(AM_CPPFLAGS) $(MYSQLINCLUDE) 94check_mysql_query_CPPFLAGS = $(AM_CPPFLAGS) $(MYSQLINCLUDE)
90check_mysql_query_LDADD = $(NETLIBS) $(MYSQLLIBS) 95check_mysql_query_LDADD = $(NETLIBS) $(MYSQLLIBS)
91check_nagios_LDADD = $(BASEOBJS) 96check_nagios_LDADD = $(BASEOBJS)
92check_nt_LDADD = $(NETLIBS) 97check_nt_LDADD = $(NETLIBS)
93check_ntp_LDADD = $(NETLIBS) $(MATHLIBS) 98check_ntp_LDADD = $(NETLIBS) $(MATHLIBS)
94check_ntp_peer_LDADD = $(NETLIBS) $(MATHLIBS) 99check_ntp_peer_LDADD = $(NETLIBS) $(MATHLIBS)
95check_nwstat_LDADD = $(NETLIBS) 100check_nwstat_LDADD = $(NETLIBS)
diff --git a/plugins/check_curl.c b/plugins/check_curl.c
new file mode 100644
index 0000000..2d69b31
--- /dev/null
+++ b/plugins/check_curl.c
@@ -0,0 +1,2335 @@
1/*****************************************************************************
2*
3* Monitoring check_curl plugin
4*
5* License: GPL
6* Copyright (c) 1999-2019 Monitoring Plugins Development Team
7*
8* Description:
9*
10* This file contains the check_curl plugin
11*
12* This plugin tests the HTTP service on the specified host. It can test
13* normal (http) and secure (https) servers, follow redirects, search for
14* strings and regular expressions, check connection times, and report on
15* certificate expiration times.
16*
17* This plugin uses functions from the curl library, see
18* http://curl.haxx.se
19*
20* This program is free software: you can redistribute it and/or modify
21* it under the terms of the GNU General Public License as published by
22* the Free Software Foundation, either version 3 of the License, or
23* (at your option) any later version.
24*
25* This program is distributed in the hope that it will be useful,
26* but WITHOUT ANY WARRANTY; without even the implied warranty of
27* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
28* GNU General Public License for more details.
29*
30* You should have received a copy of the GNU General Public License
31* along with this program. If not, see <http://www.gnu.org/licenses/>.
32*
33*
34*****************************************************************************/
35const char *progname = "check_curl";
36
37const char *copyright = "2006-2019";
38const char *email = "devel@monitoring-plugins.org";
39
40#include <ctype.h>
41
42#include "common.h"
43#include "utils.h"
44
45#ifndef LIBCURL_PROTOCOL_HTTP
46#error libcurl compiled without HTTP support, compiling check_curl plugin does not makes a lot of sense
47#endif
48
49#include "curl/curl.h"
50#include "curl/easy.h"
51
52#include "picohttpparser.h"
53
54#include "uriparser/Uri.h"
55
56#include <arpa/inet.h>
57
58#define MAKE_LIBCURL_VERSION(major, minor, patch) ((major)*0x10000 + (minor)*0x100 + (patch))
59
60#define DEFAULT_BUFFER_SIZE 2048
61#define DEFAULT_SERVER_URL "/"
62#define HTTP_EXPECT "HTTP/"
63#define DEFAULT_MAX_REDIRS 15
64#define INET_ADDR_MAX_SIZE INET6_ADDRSTRLEN
65enum {
66 MAX_IPV4_HOSTLENGTH = 255,
67 HTTP_PORT = 80,
68 HTTPS_PORT = 443,
69 MAX_PORT = 65535
70};
71
72enum {
73 STICKY_NONE = 0,
74 STICKY_HOST = 1,
75 STICKY_PORT = 2
76};
77
78enum {
79 FOLLOW_HTTP_CURL = 0,
80 FOLLOW_LIBCURL = 1
81};
82
83/* for buffers for header and body */
84typedef struct {
85 char *buf;
86 size_t buflen;
87 size_t bufsize;
88} curlhelp_write_curlbuf;
89
90/* for buffering the data sent in PUT */
91typedef struct {
92 char *buf;
93 size_t buflen;
94 off_t pos;
95} curlhelp_read_curlbuf;
96
97/* for parsing the HTTP status line */
98typedef struct {
99 int http_major; /* major version of the protocol, always 1 (HTTP/0.9
100 * never reached the big internet most likely) */
101 int http_minor; /* minor version of the protocol, usually 0 or 1 */
102 int http_code; /* HTTP return code as in RFC 2145 */
103 int http_subcode; /* Microsoft IIS extension, HTTP subcodes, see
104 * http://support.microsoft.com/kb/318380/en-us */
105 const char *msg; /* the human readable message */
106 char *first_line; /* a copy of the first line */
107} curlhelp_statusline;
108
109/* to know the underlying SSL library used by libcurl */
110typedef enum curlhelp_ssl_library {
111 CURLHELP_SSL_LIBRARY_UNKNOWN,
112 CURLHELP_SSL_LIBRARY_OPENSSL,
113 CURLHELP_SSL_LIBRARY_LIBRESSL,
114 CURLHELP_SSL_LIBRARY_GNUTLS,
115 CURLHELP_SSL_LIBRARY_NSS
116} curlhelp_ssl_library;
117
118enum {
119 REGS = 2,
120 MAX_RE_SIZE = 256
121};
122#include "regex.h"
123regex_t preg;
124regmatch_t pmatch[REGS];
125char regexp[MAX_RE_SIZE];
126int cflags = REG_NOSUB | REG_EXTENDED | REG_NEWLINE;
127int errcode;
128int invert_regex = 0;
129
130char *server_address = NULL;
131char *host_name = NULL;
132char *server_url = 0;
133char server_ip[DEFAULT_BUFFER_SIZE];
134struct curl_slist *server_ips = NULL;
135int specify_port = FALSE;
136unsigned short server_port = HTTP_PORT;
137unsigned short virtual_port = 0;
138int host_name_length;
139char output_header_search[30] = "";
140char output_string_search[30] = "";
141char *warning_thresholds = NULL;
142char *critical_thresholds = NULL;
143int days_till_exp_warn, days_till_exp_crit;
144thresholds *thlds;
145char user_agent[DEFAULT_BUFFER_SIZE];
146int verbose = 0;
147int show_extended_perfdata = FALSE;
148int min_page_len = 0;
149int max_page_len = 0;
150int redir_depth = 0;
151int max_depth = DEFAULT_MAX_REDIRS;
152char *http_method = NULL;
153char *http_post_data = NULL;
154char *http_content_type = NULL;
155CURL *curl;
156struct curl_slist *header_list = NULL;
157curlhelp_write_curlbuf body_buf;
158curlhelp_write_curlbuf header_buf;
159curlhelp_statusline status_line;
160curlhelp_read_curlbuf put_buf;
161char http_header[DEFAULT_BUFFER_SIZE];
162long code;
163long socket_timeout = DEFAULT_SOCKET_TIMEOUT;
164double total_time;
165double time_connect;
166double time_appconnect;
167double time_headers;
168double time_firstbyte;
169char errbuf[CURL_ERROR_SIZE+1];
170CURLcode res;
171char url[DEFAULT_BUFFER_SIZE];
172char msg[DEFAULT_BUFFER_SIZE];
173char perfstring[DEFAULT_BUFFER_SIZE];
174char header_expect[MAX_INPUT_BUFFER] = "";
175char string_expect[MAX_INPUT_BUFFER] = "";
176char server_expect[MAX_INPUT_BUFFER] = HTTP_EXPECT;
177int server_expect_yn = 0;
178char user_auth[MAX_INPUT_BUFFER] = "";
179char proxy_auth[MAX_INPUT_BUFFER] = "";
180char **http_opt_headers;
181int http_opt_headers_count = 0;
182int display_html = FALSE;
183int onredirect = STATE_OK;
184int followmethod = FOLLOW_HTTP_CURL;
185int followsticky = STICKY_NONE;
186int use_ssl = FALSE;
187int use_sni = TRUE;
188int check_cert = FALSE;
189typedef union {
190 struct curl_slist* to_info;
191 struct curl_certinfo* to_certinfo;
192} cert_ptr_union;
193cert_ptr_union cert_ptr;
194int ssl_version = CURL_SSLVERSION_DEFAULT;
195char *client_cert = NULL;
196char *client_privkey = NULL;
197char *ca_cert = NULL;
198int is_openssl_callback = FALSE;
199#if defined(HAVE_SSL) && defined(USE_OPENSSL)
200X509 *cert = NULL;
201#endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */
202int no_body = FALSE;
203int maximum_age = -1;
204int address_family = AF_UNSPEC;
205curlhelp_ssl_library ssl_library = CURLHELP_SSL_LIBRARY_UNKNOWN;
206int curl_http_version = CURL_HTTP_VERSION_NONE;
207
208int process_arguments (int, char**);
209void handle_curl_option_return_code (CURLcode res, const char* option);
210int check_http (void);
211void redir (curlhelp_write_curlbuf*);
212char *perfd_time (double microsec);
213char *perfd_time_connect (double microsec);
214char *perfd_time_ssl (double microsec);
215char *perfd_time_firstbyte (double microsec);
216char *perfd_time_headers (double microsec);
217char *perfd_time_transfer (double microsec);
218char *perfd_size (int page_len);
219void print_help (void);
220void print_usage (void);
221void print_curl_version (void);
222int curlhelp_initwritebuffer (curlhelp_write_curlbuf*);
223int curlhelp_buffer_write_callback (void*, size_t , size_t , void*);
224void curlhelp_freewritebuffer (curlhelp_write_curlbuf*);
225int curlhelp_initreadbuffer (curlhelp_read_curlbuf *, const char *, size_t);
226int curlhelp_buffer_read_callback (void *, size_t , size_t , void *);
227void curlhelp_freereadbuffer (curlhelp_read_curlbuf *);
228curlhelp_ssl_library curlhelp_get_ssl_library (CURL*);
229const char* curlhelp_get_ssl_library_string (curlhelp_ssl_library);
230int net_noopenssl_check_certificate (cert_ptr_union*, int, int);
231
232int curlhelp_parse_statusline (const char*, curlhelp_statusline *);
233void curlhelp_free_statusline (curlhelp_statusline *);
234char *get_header_value (const struct phr_header* headers, const size_t nof_headers, const char* header);
235int check_document_dates (const curlhelp_write_curlbuf *, char (*msg)[DEFAULT_BUFFER_SIZE]);
236int get_content_length (const curlhelp_write_curlbuf* header_buf, const curlhelp_write_curlbuf* body_buf);
237
238#if defined(HAVE_SSL) && defined(USE_OPENSSL)
239int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int days_till_exp_crit);
240#endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */
241
242void remove_newlines (char *);
243void test_file (char *);
244
245int
246main (int argc, char **argv)
247{
248 int result = STATE_UNKNOWN;
249
250 setlocale (LC_ALL, "");
251 bindtextdomain (PACKAGE, LOCALEDIR);
252 textdomain (PACKAGE);
253
254 /* Parse extra opts if any */
255 argv = np_extra_opts (&argc, argv, progname);
256
257 /* set defaults */
258 snprintf( user_agent, DEFAULT_BUFFER_SIZE, "%s/v%s (monitoring-plugins %s, %s)",
259 progname, NP_VERSION, VERSION, curl_version());
260
261 /* parse arguments */
262 if (process_arguments (argc, argv) == ERROR)
263 usage4 (_("Could not parse arguments"));
264
265 if (display_html == TRUE)
266 printf ("<A HREF=\"%s://%s:%d%s\" target=\"_blank\">",
267 use_ssl ? "https" : "http",
268 host_name ? host_name : server_address,
269 virtual_port ? virtual_port : server_port,
270 server_url);
271
272 result = check_http ();
273 return result;
274}
275
276#ifdef HAVE_SSL
277#ifdef USE_OPENSSL
278
279int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
280{
281 /* TODO: we get all certificates of the chain, so which ones
282 * should we test?
283 * TODO: is the last certificate always the server certificate?
284 */
285 cert = X509_STORE_CTX_get_current_cert(x509_ctx);
286 return 1;
287}
288
289CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm)
290{
291 SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER, verify_callback);
292
293 return CURLE_OK;
294}
295
296#endif /* USE_OPENSSL */
297#endif /* HAVE_SSL */
298
299/* Checks if the server 'reply' is one of the expected 'statuscodes' */
300static int
301expected_statuscode (const char *reply, const char *statuscodes)
302{
303 char *expected, *code;
304 int result = 0;
305
306 if ((expected = strdup (statuscodes)) == NULL)
307 die (STATE_UNKNOWN, _("HTTP UNKNOWN - Memory allocation error\n"));
308
309 for (code = strtok (expected, ","); code != NULL; code = strtok (NULL, ","))
310 if (strstr (reply, code) != NULL) {
311 result = 1;
312 break;
313 }
314
315 free (expected);
316 return result;
317}
318
319void
320handle_curl_option_return_code (CURLcode res, const char* option)
321{
322 if (res != CURLE_OK) {
323 snprintf (msg, DEFAULT_BUFFER_SIZE, _("Error while setting cURL option '%s': cURL returned %d - %s"),
324 option, res, curl_easy_strerror(res));
325 die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
326 }
327}
328
329int
330check_http (void)
331{
332 int result = STATE_OK;
333 int page_len = 0;
334 int i;
335 char *force_host_header = NULL;
336
337 /* initialize curl */
338 if (curl_global_init (CURL_GLOBAL_DEFAULT) != CURLE_OK)
339 die (STATE_UNKNOWN, "HTTP UNKNOWN - curl_global_init failed\n");
340
341 if ((curl = curl_easy_init()) == NULL)
342 die (STATE_UNKNOWN, "HTTP UNKNOWN - curl_easy_init failed\n");
343
344 if (verbose >= 1)
345 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_VERBOSE, TRUE), "CURLOPT_VERBOSE");
346
347 /* print everything on stdout like check_http would do */
348 handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_STDERR, stdout), "CURLOPT_STDERR");
349
350 /* initialize buffer for body of the answer */
351 if (curlhelp_initwritebuffer(&body_buf) < 0)
352 die (STATE_UNKNOWN, "HTTP CRITICAL - out of memory allocating buffer for body\n");
353 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)curlhelp_buffer_write_callback), "CURLOPT_WRITEFUNCTION");
354 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_WRITEDATA, (void *)&body_buf), "CURLOPT_WRITEDATA");
355
356 /* initialize buffer for header of the answer */
357 if (curlhelp_initwritebuffer( &header_buf ) < 0)
358 die (STATE_UNKNOWN, "HTTP CRITICAL - out of memory allocating buffer for header\n" );
359 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_HEADERFUNCTION, (curl_write_callback)curlhelp_buffer_write_callback), "CURLOPT_HEADERFUNCTION");
360 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_WRITEHEADER, (void *)&header_buf), "CURLOPT_WRITEHEADER");
361
362 /* set the error buffer */
363 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_ERRORBUFFER, errbuf), "CURLOPT_ERRORBUFFER");
364
365 /* set timeouts */
366 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CONNECTTIMEOUT, socket_timeout), "CURLOPT_CONNECTTIMEOUT");
367 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_TIMEOUT, socket_timeout), "CURLOPT_TIMEOUT");
368
369 // fill dns resolve cache to make curl connect to the given server_address instead of the host_name, only required for ssl, because we use the host_name later on to make SNI happy
370 if(use_ssl && host_name != NULL) {
371 struct curl_slist *host = NULL;
372 char dnscache[DEFAULT_BUFFER_SIZE];
373 snprintf (dnscache, DEFAULT_BUFFER_SIZE, "%s:%d:%s", host_name, server_port, server_address);
374 host = curl_slist_append(NULL, dnscache);
375 curl_easy_setopt(curl, CURLOPT_RESOLVE, host);
376 if (verbose>=1)
377 printf ("* curl CURLOPT_RESOLVE: %s\n", dnscache);
378 }
379
380 /* compose URL: use the address we want to connect to, set Host: header later */
381 snprintf (url, DEFAULT_BUFFER_SIZE, "%s://%s:%d%s",
382 use_ssl ? "https" : "http",
383 use_ssl & host_name != NULL ? host_name : server_address,
384 server_port,
385 server_url
386 );
387
388 if (verbose>=1)
389 printf ("* curl CURLOPT_URL: %s\n", url);
390 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_URL, url), "CURLOPT_URL");
391
392 /* extract proxy information for legacy proxy https requests */
393 if (!strcmp(http_method, "CONNECT") || strstr(server_url, "http") == server_url) {
394 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_PROXY, server_address), "CURLOPT_PROXY");
395 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_PROXYPORT, (long)server_port), "CURLOPT_PROXYPORT");
396 if (verbose>=2)
397 printf ("* curl CURLOPT_PROXY: %s:%d\n", server_address, server_port);
398 http_method = "GET";
399 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_URL, server_url), "CURLOPT_URL");
400 }
401
402 /* disable body for HEAD request */
403 if (http_method && !strcmp (http_method, "HEAD" )) {
404 no_body = TRUE;
405 }
406
407 /* set HTTP protocol version */
408 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_HTTP_VERSION, curl_http_version), "CURLOPT_HTTP_VERSION");
409
410 /* set HTTP method */
411 if (http_method) {
412 if (!strcmp(http_method, "POST"))
413 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_POST, 1), "CURLOPT_POST");
414 else if (!strcmp(http_method, "PUT"))
415 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_UPLOAD, 1), "CURLOPT_UPLOAD");
416 else
417 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CUSTOMREQUEST, http_method), "CURLOPT_CUSTOMREQUEST");
418 }
419
420 /* check if Host header is explicitly set in options */
421 if (http_opt_headers_count) {
422 for (i = 0; i < http_opt_headers_count ; i++) {
423 if (strncmp(http_opt_headers[i], "Host:", 5) == 0) {
424 force_host_header = http_opt_headers[i];
425 }
426 }
427 }
428
429 /* set hostname (virtual hosts), not needed if CURLOPT_CONNECT_TO is used, but left in anyway */
430 if(host_name != NULL && force_host_header == NULL) {
431 if((virtual_port != HTTP_PORT && !use_ssl) || (virtual_port != HTTPS_PORT && use_ssl)) {
432 snprintf(http_header, DEFAULT_BUFFER_SIZE, "Host: %s:%d", host_name, virtual_port);
433 } else {
434 snprintf(http_header, DEFAULT_BUFFER_SIZE, "Host: %s", host_name);
435 }
436 header_list = curl_slist_append (header_list, http_header);
437 }
438
439 /* always close connection, be nice to servers */
440 snprintf (http_header, DEFAULT_BUFFER_SIZE, "Connection: close");
441 header_list = curl_slist_append (header_list, http_header);
442
443 /* attach additional headers supplied by the user */
444 /* optionally send any other header tag */
445 if (http_opt_headers_count) {
446 for (i = 0; i < http_opt_headers_count ; i++) {
447 header_list = curl_slist_append (header_list, http_opt_headers[i]);
448 }
449 /* This cannot be free'd here because a redirection will then try to access this and segfault */
450 /* Covered in a testcase in tests/check_http.t */
451 /* free(http_opt_headers); */
452 }
453
454 /* set HTTP headers */
455 handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_HTTPHEADER, header_list ), "CURLOPT_HTTPHEADER");
456
457#ifdef LIBCURL_FEATURE_SSL
458
459 /* set SSL version, warn about unsecure or unsupported versions */
460 if (use_ssl) {
461 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSLVERSION, ssl_version), "CURLOPT_SSLVERSION");
462 }
463
464 /* client certificate and key to present to server (SSL) */
465 if (client_cert)
466 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSLCERT, client_cert), "CURLOPT_SSLCERT");
467 if (client_privkey)
468 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSLKEY, client_privkey), "CURLOPT_SSLKEY");
469 if (ca_cert) {
470 /* per default if we have a CA verify both the peer and the
471 * hostname in the certificate, can be switched off later */
472 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CAINFO, ca_cert), "CURLOPT_CAINFO");
473 handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_SSL_VERIFYPEER, 1), "CURLOPT_SSL_VERIFYPEER");
474 handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_SSL_VERIFYHOST, 2), "CURLOPT_SSL_VERIFYHOST");
475 } else {
476 /* backward-compatible behaviour, be tolerant in checks
477 * TODO: depending on more options have aspects we want
478 * to be less tolerant about ssl verfications
479 */
480 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSL_VERIFYPEER, 0), "CURLOPT_SSL_VERIFYPEER");
481 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_SSL_VERIFYHOST, 0), "CURLOPT_SSL_VERIFYHOST");
482 }
483
484 /* detect SSL library used by libcurl */
485 ssl_library = curlhelp_get_ssl_library (curl);
486
487 /* try hard to get a stack of certificates to verify against */
488 if (check_cert) {
489#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 1)
490 /* inform curl to report back certificates */
491 switch (ssl_library) {
492 case CURLHELP_SSL_LIBRARY_OPENSSL:
493 case CURLHELP_SSL_LIBRARY_LIBRESSL:
494 /* set callback to extract certificate with OpenSSL context function (works with
495 * OpenSSL-style libraries only!) */
496#ifdef USE_OPENSSL
497 /* libcurl and monitoring plugins built with OpenSSL, good */
498 handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun), "CURLOPT_SSL_CTX_FUNCTION");
499 is_openssl_callback = TRUE;
500#else /* USE_OPENSSL */
501#endif /* USE_OPENSSL */
502 /* libcurl is built with OpenSSL, monitoring plugins, so falling
503 * back to manually extracting certificate information */
504 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CERTINFO, 1L), "CURLOPT_CERTINFO");
505 break;
506
507 case CURLHELP_SSL_LIBRARY_NSS:
508#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
509 /* NSS: support for CERTINFO is implemented since 7.34.0 */
510 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CERTINFO, 1L), "CURLOPT_CERTINFO");
511#else /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
512 die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (libcurl linked with SSL library '%s' is too old)\n", curlhelp_get_ssl_library_string (ssl_library));
513#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
514 break;
515
516 case CURLHELP_SSL_LIBRARY_GNUTLS:
517#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 42, 0)
518 /* GnuTLS: support for CERTINFO is implemented since 7.42.0 */
519 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_CERTINFO, 1L), "CURLOPT_CERTINFO");
520#else /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 42, 0) */
521 die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (libcurl linked with SSL library '%s' is too old)\n", curlhelp_get_ssl_library_string (ssl_library));
522#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 42, 0) */
523 break;
524
525 case CURLHELP_SSL_LIBRARY_UNKNOWN:
526 default:
527 die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (unknown SSL library '%s', must implement first)\n", curlhelp_get_ssl_library_string (ssl_library));
528 break;
529 }
530#else /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 1) */
531 /* old libcurl, our only hope is OpenSSL, otherwise we are out of luck */
532 if (ssl_library == CURLHELP_SSL_LIBRARY_OPENSSL || ssl_library == CURLHELP_SSL_LIBRARY_LIBRESSL)
533 handle_curl_option_return_code (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun), "CURLOPT_SSL_CTX_FUNCTION");
534 else
535 die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates (no CURLOPT_SSL_CTX_FUNCTION, no OpenSSL library or libcurl too old and has no CURLOPT_CERTINFO)\n");
536#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 1) */
537 }
538
539#endif /* LIBCURL_FEATURE_SSL */
540
541 /* set default or user-given user agent identification */
542 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_USERAGENT, user_agent), "CURLOPT_USERAGENT");
543
544 /* proxy-authentication */
545 if (strcmp(proxy_auth, ""))
546 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_PROXYUSERPWD, proxy_auth), "CURLOPT_PROXYUSERPWD");
547
548 /* authentication */
549 if (strcmp(user_auth, ""))
550 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_USERPWD, user_auth), "CURLOPT_USERPWD");
551
552 /* TODO: parameter auth method, bitfield of following methods:
553 * CURLAUTH_BASIC (default)
554 * CURLAUTH_DIGEST
555 * CURLAUTH_DIGEST_IE
556 * CURLAUTH_NEGOTIATE
557 * CURLAUTH_NTLM
558 * CURLAUTH_NTLM_WB
559 *
560 * convenience tokens for typical sets of methods:
561 * CURLAUTH_ANYSAFE: most secure, without BASIC
562 * or CURLAUTH_ANY: most secure, even BASIC if necessary
563 *
564 * handle_curl_option_return_code (curl_easy_setopt( curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_DIGEST ), "CURLOPT_HTTPAUTH");
565 */
566
567 /* handle redirections */
568 if (onredirect == STATE_DEPENDENT) {
569 if( followmethod == FOLLOW_LIBCURL ) {
570 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_FOLLOWLOCATION, 1), "CURLOPT_FOLLOWLOCATION");
571
572 /* default -1 is infinite, not good, could lead to zombie plugins!
573 Setting it to one bigger than maximal limit to handle errors nicely below
574 */
575 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_MAXREDIRS, max_depth+1), "CURLOPT_MAXREDIRS");
576
577 /* for now allow only http and https (we are a http(s) check plugin in the end) */
578#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 4)
579 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS), "CURLOPT_REDIRECT_PROTOCOLS");
580#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 19, 4) */
581
582 /* TODO: handle the following aspects of redirection, make them
583 * command line options too later:
584 CURLOPT_POSTREDIR: method switch
585 CURLINFO_REDIRECT_URL: custom redirect option
586 CURLOPT_REDIRECT_PROTOCOLS: allow people to step outside safe protocols
587 CURLINFO_REDIRECT_COUNT: get the number of redirects, print it, maybe a range option here is nice like for expected page size?
588 */
589 } else {
590 /* old style redirection is handled below */
591 }
592 }
593
594 /* no-body */
595 if (no_body)
596 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_NOBODY, 1), "CURLOPT_NOBODY");
597
598 /* IPv4 or IPv6 forced DNS resolution */
599 if (address_family == AF_UNSPEC)
600 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_WHATEVER), "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_WHATEVER)");
601 else if (address_family == AF_INET)
602 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4), "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_V4)");
603#if defined (USE_IPV6) && defined (LIBCURL_FEATURE_IPV6)
604 else if (address_family == AF_INET6)
605 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6), "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_V6)");
606#endif
607
608 /* either send http POST data (any data, not only POST)*/
609 if (!strcmp(http_method, "POST") ||!strcmp(http_method, "PUT")) {
610 /* set content of payload for POST and PUT */
611 if (http_content_type) {
612 snprintf (http_header, DEFAULT_BUFFER_SIZE, "Content-Type: %s", http_content_type);
613 header_list = curl_slist_append (header_list, http_header);
614 }
615 /* NULL indicates "HTTP Continue" in libcurl, provide an empty string
616 * in case of no POST/PUT data */
617 if (!http_post_data)
618 http_post_data = "";
619 if (!strcmp(http_method, "POST")) {
620 /* POST method, set payload with CURLOPT_POSTFIELDS */
621 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_POSTFIELDS, http_post_data), "CURLOPT_POSTFIELDS");
622 } else if (!strcmp(http_method, "PUT")) {
623 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_READFUNCTION, (curl_read_callback)curlhelp_buffer_read_callback), "CURLOPT_READFUNCTION");
624 curlhelp_initreadbuffer (&put_buf, http_post_data, strlen (http_post_data));
625 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_READDATA, (void *)&put_buf), "CURLOPT_READDATA");
626 handle_curl_option_return_code (curl_easy_setopt (curl, CURLOPT_INFILESIZE, (curl_off_t)strlen (http_post_data)), "CURLOPT_INFILESIZE");
627 }
628 }
629
630 /* do the request */
631 res = curl_easy_perform(curl);
632
633 if (verbose>=2 && http_post_data)
634 printf ("**** REQUEST CONTENT ****\n%s\n", http_post_data);
635
636 /* free header and server IP resolve lists, we don't need it anymore */
637 curl_slist_free_all (header_list); header_list = NULL;
638 curl_slist_free_all (server_ips); server_ips = NULL;
639
640 /* Curl errors, result in critical Nagios state */
641 if (res != CURLE_OK) {
642 snprintf (msg, DEFAULT_BUFFER_SIZE, _("Invalid HTTP response received from host on port %d: cURL returned %d - %s"),
643 server_port, res, curl_easy_strerror(res));
644 die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
645 }
646
647 /* certificate checks */
648#ifdef LIBCURL_FEATURE_SSL
649 if (use_ssl == TRUE) {
650 if (check_cert == TRUE) {
651 if (is_openssl_callback) {
652#ifdef USE_OPENSSL
653 /* check certificate with OpenSSL functions, curl has been built against OpenSSL
654 * and we actually have OpenSSL in the monitoring tools
655 */
656 result = np_net_ssl_check_certificate(cert, days_till_exp_warn, days_till_exp_crit);
657 return result;
658#else /* USE_OPENSSL */
659 die (STATE_CRITICAL, "HTTP CRITICAL - Cannot retrieve certificates - OpenSSL callback used and not linked against OpenSSL\n");
660#endif /* USE_OPENSSL */
661 } else {
662 int i;
663 struct curl_slist *slist;
664
665 cert_ptr.to_info = NULL;
666 res = curl_easy_getinfo (curl, CURLINFO_CERTINFO, &cert_ptr.to_info);
667 if (!res && cert_ptr.to_info) {
668#ifdef USE_OPENSSL
669 /* We have no OpenSSL in libcurl, but we can use OpenSSL for X509 cert parsing
670 * We only check the first certificate and assume it's the one of the server
671 */
672 const char* raw_cert = NULL;
673 for (i = 0; i < cert_ptr.to_certinfo->num_of_certs; i++) {
674 for (slist = cert_ptr.to_certinfo->certinfo[i]; slist; slist = slist->next) {
675 if (verbose >= 2)
676 printf ("%d ** %s\n", i, slist->data);
677 if (strncmp (slist->data, "Cert:", 5) == 0) {
678 raw_cert = &slist->data[5];
679 goto GOT_FIRST_CERT;
680 }
681 }
682 }
683GOT_FIRST_CERT:
684 if (!raw_cert) {
685 snprintf (msg, DEFAULT_BUFFER_SIZE, _("Cannot retrieve certificates from CERTINFO information - certificate data was empty"));
686 die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
687 }
688 BIO* cert_BIO = BIO_new (BIO_s_mem());
689 BIO_write (cert_BIO, raw_cert, strlen(raw_cert));
690 cert = PEM_read_bio_X509 (cert_BIO, NULL, NULL, NULL);
691 if (!cert) {
692 snprintf (msg, DEFAULT_BUFFER_SIZE, _("Cannot read certificate from CERTINFO information - BIO error"));
693 die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
694 }
695 BIO_free (cert_BIO);
696 result = np_net_ssl_check_certificate(cert, days_till_exp_warn, days_till_exp_crit);
697 return result;
698#else /* USE_OPENSSL */
699 /* We assume we don't have OpenSSL and np_net_ssl_check_certificate at our disposal,
700 * so we use the libcurl CURLINFO data
701 */
702 result = net_noopenssl_check_certificate(&cert_ptr, days_till_exp_warn, days_till_exp_crit);
703 return result;
704#endif /* USE_OPENSSL */
705 } else {
706 snprintf (msg, DEFAULT_BUFFER_SIZE, _("Cannot retrieve certificates - cURL returned %d - %s"),
707 res, curl_easy_strerror(res));
708 die (STATE_CRITICAL, "HTTP CRITICAL - %s\n", msg);
709 }
710 }
711 }
712 }
713#endif /* LIBCURL_FEATURE_SSL */
714
715 /* we got the data and we executed the request in a given time, so we can append
716 * performance data to the answer always
717 */
718 handle_curl_option_return_code (curl_easy_getinfo (curl, CURLINFO_TOTAL_TIME, &total_time), "CURLINFO_TOTAL_TIME");
719 page_len = get_content_length(&header_buf, &body_buf);
720 if(show_extended_perfdata) {
721 handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME, &time_connect), "CURLINFO_CONNECT_TIME");
722 handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME, &time_appconnect), "CURLINFO_APPCONNECT_TIME");
723 handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_PRETRANSFER_TIME, &time_headers), "CURLINFO_PRETRANSFER_TIME");
724 handle_curl_option_return_code (curl_easy_getinfo(curl, CURLINFO_STARTTRANSFER_TIME, &time_firstbyte), "CURLINFO_STARTTRANSFER_TIME");
725 snprintf(perfstring, DEFAULT_BUFFER_SIZE, "%s %s %s %s %s %s %s",
726 perfd_time(total_time),
727 perfd_size(page_len),
728 perfd_time_connect(time_connect),
729 use_ssl == TRUE ? perfd_time_ssl (time_appconnect-time_connect) : "",
730 perfd_time_headers(time_headers - time_appconnect),
731 perfd_time_firstbyte(time_firstbyte - time_headers),
732 perfd_time_transfer(total_time-time_firstbyte)
733 );
734 } else {
735 snprintf(perfstring, DEFAULT_BUFFER_SIZE, "%s %s",
736 perfd_time(total_time),
737 perfd_size(page_len)
738 );
739 }
740
741 /* return a CRITICAL status if we couldn't read any data */
742 if (strlen(header_buf.buf) == 0 && strlen(body_buf.buf) == 0)
743 die (STATE_CRITICAL, _("HTTP CRITICAL - No header received from host\n"));
744
745 /* get status line of answer, check sanity of HTTP code */
746 if (curlhelp_parse_statusline (header_buf.buf, &status_line) < 0) {
747 snprintf (msg, DEFAULT_BUFFER_SIZE, "Unparsable status line in %.3g seconds response time|%s\n",
748 total_time, perfstring);
749 die (STATE_CRITICAL, "HTTP CRITICAL HTTP/1.x %ld unknown - %s", code, msg);
750 }
751
752 /* get result code from cURL */
753 handle_curl_option_return_code (curl_easy_getinfo (curl, CURLINFO_RESPONSE_CODE, &code), "CURLINFO_RESPONSE_CODE");
754 if (verbose>=2)
755 printf ("* curl CURLINFO_RESPONSE_CODE is %ld\n", code);
756
757 /* print status line, header, body if verbose */
758 if (verbose >= 2) {
759 printf ("**** HEADER ****\n%s\n**** CONTENT ****\n%s\n", header_buf.buf,
760 (no_body ? " [[ skipped ]]" : body_buf.buf));
761 }
762
763 /* make sure the status line matches the response we are looking for */
764 if (!expected_statuscode(status_line.first_line, server_expect)) {
765 if (server_port == HTTP_PORT)
766 snprintf(msg, DEFAULT_BUFFER_SIZE, _("Invalid HTTP response received from host: %s\n"), status_line.first_line);
767 else
768 snprintf(msg, DEFAULT_BUFFER_SIZE, _("Invalid HTTP response received from host on port %d: %s\n"), server_port, status_line.first_line);
769 die (STATE_CRITICAL, "HTTP CRITICAL - %s", msg);
770 }
771
772 if( server_expect_yn ) {
773 snprintf(msg, DEFAULT_BUFFER_SIZE, _("Status line output matched \"%s\" - "), server_expect);
774 if (verbose)
775 printf ("%s\n",msg);
776 result = STATE_OK;
777 }
778 else {
779 /* illegal return codes result in a critical state */
780 if (code >= 600 || code < 100) {
781 die (STATE_CRITICAL, _("HTTP CRITICAL: Invalid Status (%d, %.40s)\n"), status_line.http_code, status_line.msg);
782 /* server errors result in a critical state */
783 } else if (code >= 500) {
784 result = STATE_CRITICAL;
785 /* client errors result in a warning state */
786 } else if (code >= 400) {
787 result = STATE_WARNING;
788 /* check redirected page if specified */
789 } else if (code >= 300) {
790 if (onredirect == STATE_DEPENDENT) {
791 if( followmethod == FOLLOW_LIBCURL ) {
792 code = status_line.http_code;
793 } else {
794 /* old check_http style redirection, if we come
795 * back here, we are in the same status as with
796 * the libcurl method
797 */
798 redir (&header_buf);
799 }
800 } else {
801 /* this is a specific code in the command line to
802 * be returned when a redirection is encoutered
803 */
804 }
805 result = max_state_alt (onredirect, result);
806 /* all other codes are considered ok */
807 } else {
808 result = STATE_OK;
809 }
810 }
811
812 /* libcurl redirection internally, handle error states here */
813 if( followmethod == FOLLOW_LIBCURL ) {
814 handle_curl_option_return_code (curl_easy_getinfo (curl, CURLINFO_REDIRECT_COUNT, &redir_depth), "CURLINFO_REDIRECT_COUNT");
815 if (verbose >= 2)
816 printf(_("* curl LIBINFO_REDIRECT_COUNT is %d\n"), redir_depth);
817 if (redir_depth > max_depth) {
818 snprintf (msg, DEFAULT_BUFFER_SIZE, "maximum redirection depth %d exceeded in libcurl",
819 max_depth);
820 die (STATE_WARNING, "HTTP WARNING - %s", msg);
821 }
822 }
823
824 /* check status codes, set exit status accordingly */
825 if( status_line.http_code != code ) {
826 die (STATE_CRITICAL, _("HTTP CRITICAL HTTP/%d.%d %d %s - different HTTP codes (cUrl has %ld)\n"),
827 status_line.http_major, status_line.http_minor,
828 status_line.http_code, status_line.msg, code);
829 }
830
831 if (maximum_age >= 0) {
832 result = max_state_alt(check_document_dates(&header_buf, &msg), result);
833 }
834
835 /* Page and Header content checks go here */
836
837 if (strlen (header_expect)) {
838 if (!strstr (header_buf.buf, header_expect)) {
839 strncpy(&output_header_search[0],header_expect,sizeof(output_header_search));
840 if(output_header_search[sizeof(output_header_search)-1]!='\0') {
841 bcopy("...",&output_header_search[sizeof(output_header_search)-4],4);
842 }
843 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%sheader '%s' not found on '%s://%s:%d%s', "), msg, output_header_search, use_ssl ? "https" : "http", host_name ? host_name : server_address, server_port, server_url);
844 result = STATE_CRITICAL;
845 }
846 }
847
848 if (strlen (string_expect)) {
849 if (!strstr (body_buf.buf, string_expect)) {
850 strncpy(&output_string_search[0],string_expect,sizeof(output_string_search));
851 if(output_string_search[sizeof(output_string_search)-1]!='\0') {
852 bcopy("...",&output_string_search[sizeof(output_string_search)-4],4);
853 }
854 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%sstring '%s' not found on '%s://%s:%d%s', "), msg, output_string_search, use_ssl ? "https" : "http", host_name ? host_name : server_address, server_port, server_url);
855 result = STATE_CRITICAL;
856 }
857 }
858
859 if (strlen (regexp)) {
860 errcode = regexec (&preg, body_buf.buf, REGS, pmatch, 0);
861 if ((errcode == 0 && invert_regex == 0) || (errcode == REG_NOMATCH && invert_regex == 1)) {
862 /* OK - No-op to avoid changing the logic around it */
863 result = max_state_alt(STATE_OK, result);
864 }
865 else if ((errcode == REG_NOMATCH && invert_regex == 0) || (errcode == 0 && invert_regex == 1)) {
866 if (invert_regex == 0)
867 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spattern not found, "), msg);
868 else
869 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spattern found, "), msg);
870 result = STATE_CRITICAL;
871 }
872 else {
873 regerror (errcode, &preg, errbuf, MAX_INPUT_BUFFER);
874 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%sExecute Error: %s, "), msg, errbuf);
875 result = STATE_UNKNOWN;
876 }
877 }
878
879 /* make sure the page is of an appropriate size */
880 if ((max_page_len > 0) && (page_len > max_page_len)) {
881 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spage size %d too large, "), msg, page_len);
882 result = max_state_alt(STATE_WARNING, result);
883 } else if ((min_page_len > 0) && (page_len < min_page_len)) {
884 snprintf (msg, DEFAULT_BUFFER_SIZE, _("%spage size %d too small, "), msg, page_len);
885 result = max_state_alt(STATE_WARNING, result);
886 }
887
888 /* -w, -c: check warning and critical level */
889 result = max_state_alt(get_status(total_time, thlds), result);
890
891 /* Cut-off trailing characters */
892 if(msg[strlen(msg)-2] == ',')
893 msg[strlen(msg)-2] = '\0';
894 else
895 msg[strlen(msg)-3] = '\0';
896
897 /* TODO: separate _() msg and status code: die (result, "HTTP %s: %s\n", state_text(result), msg); */
898 die (result, "HTTP %s: HTTP/%d.%d %d %s%s%s - %d bytes in %.3f second response time %s|%s\n",
899 state_text(result), status_line.http_major, status_line.http_minor,
900 status_line.http_code, status_line.msg,
901 strlen(msg) > 0 ? " - " : "",
902 msg, page_len, total_time,
903 (display_html ? "</A>" : ""),
904 perfstring);
905
906 /* proper cleanup after die? */
907 curlhelp_free_statusline(&status_line);
908 curl_easy_cleanup (curl);
909 curl_global_cleanup ();
910 curlhelp_freewritebuffer (&body_buf);
911 curlhelp_freewritebuffer (&header_buf);
912 if (!strcmp (http_method, "PUT")) {
913 curlhelp_freereadbuffer (&put_buf);
914 }
915
916 return result;
917}
918
919int
920uri_strcmp (const UriTextRangeA range, const char* s)
921{
922 if (!range.first) return -1;
923 if (range.afterLast - range.first < strlen (s)) return -1;
924 return strncmp (s, range.first, min( range.afterLast - range.first, strlen (s)));
925}
926
927char*
928uri_string (const UriTextRangeA range, char* buf, size_t buflen)
929{
930 if (!range.first) return "(null)";
931 strncpy (buf, range.first, max (buflen, range.afterLast - range.first));
932 buf[max (buflen, range.afterLast - range.first)] = '\0';
933 buf[range.afterLast - range.first] = '\0';
934 return buf;
935}
936
937void
938redir (curlhelp_write_curlbuf* header_buf)
939{
940 char *location = NULL;
941 curlhelp_statusline status_line;
942 struct phr_header headers[255];
943 size_t nof_headers = 255;
944 size_t msglen;
945 char buf[DEFAULT_BUFFER_SIZE];
946 char ipstr[INET_ADDR_MAX_SIZE];
947 int new_port;
948 char *new_host;
949 char *new_url;
950
951 int res = phr_parse_response (header_buf->buf, header_buf->buflen,
952 &status_line.http_minor, &status_line.http_code, &status_line.msg, &msglen,
953 headers, &nof_headers, 0);
954
955 location = get_header_value (headers, nof_headers, "location");
956
957 if (verbose >= 2)
958 printf(_("* Seen redirect location %s\n"), location);
959
960 if (++redir_depth > max_depth)
961 die (STATE_WARNING,
962 _("HTTP WARNING - maximum redirection depth %d exceeded - %s%s\n"),
963 max_depth, location, (display_html ? "</A>" : ""));
964
965 UriParserStateA state;
966 UriUriA uri;
967 state.uri = &uri;
968 if (uriParseUriA (&state, location) != URI_SUCCESS) {
969 if (state.errorCode == URI_ERROR_SYNTAX) {
970 die (STATE_UNKNOWN,
971 _("HTTP UNKNOWN - Could not parse redirect location '%s'%s\n"),
972 location, (display_html ? "</A>" : ""));
973 } else if (state.errorCode == URI_ERROR_MALLOC) {
974 die (STATE_UNKNOWN, _("HTTP UNKNOWN - Could not allocate URL\n"));
975 }
976 }
977
978 if (verbose >= 2) {
979 printf (_("** scheme: %s\n"),
980 uri_string (uri.scheme, buf, DEFAULT_BUFFER_SIZE));
981 printf (_("** host: %s\n"),
982 uri_string (uri.hostText, buf, DEFAULT_BUFFER_SIZE));
983 printf (_("** port: %s\n"),
984 uri_string (uri.portText, buf, DEFAULT_BUFFER_SIZE));
985 if (uri.hostData.ip4) {
986 inet_ntop (AF_INET, uri.hostData.ip4->data, ipstr, sizeof (ipstr));
987 printf (_("** IPv4: %s\n"), ipstr);
988 }
989 if (uri.hostData.ip6) {
990 inet_ntop (AF_INET, uri.hostData.ip6->data, ipstr, sizeof (ipstr));
991 printf (_("** IPv6: %s\n"), ipstr);
992 }
993 if (uri.pathHead) {
994 printf (_("** path: "));
995 const UriPathSegmentA* p = uri.pathHead;
996 for (; p; p = p->next) {
997 printf ("/%s", uri_string (p->text, buf, DEFAULT_BUFFER_SIZE));
998 }
999 puts ("");
1000 }
1001 if (uri.query.first) {
1002 printf (_("** query: %s\n"),
1003 uri_string (uri.query, buf, DEFAULT_BUFFER_SIZE));
1004 }
1005 if (uri.fragment.first) {
1006 printf (_("** fragment: %s\n"),
1007 uri_string (uri.fragment, buf, DEFAULT_BUFFER_SIZE));
1008 }
1009 }
1010
1011 use_ssl = !uri_strcmp (uri.scheme, "https");
1012
1013 /* we do a sloppy test here only, because uriparser would have failed
1014 * above, if the port would be invalid, we just check for MAX_PORT
1015 */
1016 if (uri.portText.first) {
1017 new_port = atoi (uri_string (uri.portText, buf, DEFAULT_BUFFER_SIZE));
1018 } else {
1019 new_port = HTTP_PORT;
1020 if (use_ssl)
1021 new_port = HTTPS_PORT;
1022 }
1023 if (new_port > MAX_PORT)
1024 die (STATE_UNKNOWN,
1025 _("HTTP UNKNOWN - Redirection to port above %d - %s%s\n"),
1026 MAX_PORT, location, display_html ? "</A>" : "");
1027
1028 /* by RFC 7231 relative URLs in Location should be taken relative to
1029 * the original URL, so wy try to form a new absolute URL here
1030 */
1031 if (!uri.scheme.first && !uri.hostText.first) {
1032 new_host = strdup (host_name ? host_name : server_address);
1033 } else {
1034 new_host = strdup (uri_string (uri.hostText, buf, DEFAULT_BUFFER_SIZE));
1035 }
1036
1037 /* compose new path */
1038 /* TODO: handle fragments and query part of URL */
1039 new_url = (char *)calloc( 1, DEFAULT_BUFFER_SIZE);
1040 if (uri.pathHead) {
1041 const UriPathSegmentA* p = uri.pathHead;
1042 for (; p; p = p->next) {
1043 strncat (new_url, "/", DEFAULT_BUFFER_SIZE);
1044 strncat (new_url, uri_string (p->text, buf, DEFAULT_BUFFER_SIZE), DEFAULT_BUFFER_SIZE);
1045 }
1046 }
1047
1048 if (server_port==new_port &&
1049 !strncmp(server_address, new_host, MAX_IPV4_HOSTLENGTH) &&
1050 (host_name && !strncmp(host_name, new_host, MAX_IPV4_HOSTLENGTH)) &&
1051 !strcmp(server_url, new_url))
1052 die (STATE_WARNING,
1053 _("HTTP WARNING - redirection creates an infinite loop - %s://%s:%d%s%s\n"),
1054 use_ssl ? "https" : "http", new_host, new_port, new_url, (display_html ? "</A>" : ""));
1055
1056 /* set new values for redirected request */
1057
1058 if (!(followsticky & STICKY_HOST)) {
1059 free (server_address);
1060 server_address = strndup (new_host, MAX_IPV4_HOSTLENGTH);
1061 }
1062 if (!(followsticky & STICKY_PORT)) {
1063 server_port = (unsigned short)new_port;
1064 }
1065
1066 free (host_name);
1067 host_name = strndup (new_host, MAX_IPV4_HOSTLENGTH);
1068
1069 /* reset virtual port */
1070 virtual_port = server_port;
1071
1072 free(new_host);
1073 free (server_url);
1074 server_url = new_url;
1075
1076 uriFreeUriMembersA (&uri);
1077
1078 if (verbose)
1079 printf (_("Redirection to %s://%s:%d%s\n"), use_ssl ? "https" : "http",
1080 host_name ? host_name : server_address, server_port, server_url);
1081
1082 /* TODO: the hash component MUST be taken from the original URL and
1083 * attached to the URL in Location
1084 */
1085
1086 check_http ();
1087}
1088
1089/* check whether a file exists */
1090void
1091test_file (char *path)
1092{
1093 if (access(path, R_OK) == 0)
1094 return;
1095 usage2 (_("file does not exist or is not readable"), path);
1096}
1097
1098int
1099process_arguments (int argc, char **argv)
1100{
1101 char *p;
1102 int c = 1;
1103 char *temp;
1104
1105 enum {
1106 INVERT_REGEX = CHAR_MAX + 1,
1107 SNI_OPTION,
1108 CA_CERT_OPTION,
1109 HTTP_VERSION_OPTION
1110 };
1111
1112 int option = 0;
1113 int got_plus = 0;
1114 static struct option longopts[] = {
1115 STD_LONG_OPTS,
1116 {"link", no_argument, 0, 'L'},
1117 {"nohtml", no_argument, 0, 'n'},
1118 {"ssl", optional_argument, 0, 'S'},
1119 {"sni", no_argument, 0, SNI_OPTION},
1120 {"post", required_argument, 0, 'P'},
1121 {"method", required_argument, 0, 'j'},
1122 {"IP-address", required_argument, 0, 'I'},
1123 {"url", required_argument, 0, 'u'},
1124 {"port", required_argument, 0, 'p'},
1125 {"authorization", required_argument, 0, 'a'},
1126 {"proxy-authorization", required_argument, 0, 'b'},
1127 {"header-string", required_argument, 0, 'd'},
1128 {"string", required_argument, 0, 's'},
1129 {"expect", required_argument, 0, 'e'},
1130 {"regex", required_argument, 0, 'r'},
1131 {"ereg", required_argument, 0, 'r'},
1132 {"eregi", required_argument, 0, 'R'},
1133 {"linespan", no_argument, 0, 'l'},
1134 {"onredirect", required_argument, 0, 'f'},
1135 {"certificate", required_argument, 0, 'C'},
1136 {"client-cert", required_argument, 0, 'J'},
1137 {"private-key", required_argument, 0, 'K'},
1138 {"ca-cert", required_argument, 0, CA_CERT_OPTION},
1139 {"useragent", required_argument, 0, 'A'},
1140 {"header", required_argument, 0, 'k'},
1141 {"no-body", no_argument, 0, 'N'},
1142 {"max-age", required_argument, 0, 'M'},
1143 {"content-type", required_argument, 0, 'T'},
1144 {"pagesize", required_argument, 0, 'm'},
1145 {"invert-regex", no_argument, NULL, INVERT_REGEX},
1146 {"use-ipv4", no_argument, 0, '4'},
1147 {"use-ipv6", no_argument, 0, '6'},
1148 {"extended-perfdata", no_argument, 0, 'E'},
1149 {"http-version", required_argument, 0, HTTP_VERSION_OPTION},
1150 {0, 0, 0, 0}
1151 };
1152
1153 if (argc < 2)
1154 return ERROR;
1155
1156 /* support check_http compatible arguments */
1157 for (c = 1; c < argc; c++) {
1158 if (strcmp ("-to", argv[c]) == 0)
1159 strcpy (argv[c], "-t");
1160 if (strcmp ("-hn", argv[c]) == 0)
1161 strcpy (argv[c], "-H");
1162 if (strcmp ("-wt", argv[c]) == 0)
1163 strcpy (argv[c], "-w");
1164 if (strcmp ("-ct", argv[c]) == 0)
1165 strcpy (argv[c], "-c");
1166 if (strcmp ("-nohtml", argv[c]) == 0)
1167 strcpy (argv[c], "-n");
1168 }
1169
1170 server_url = strdup(DEFAULT_SERVER_URL);
1171
1172 while (1) {
1173 c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:d:e:p:s:R:r:u:f:C:J:K:nlLS::m:M:NE", longopts, &option);
1174 if (c == -1 || c == EOF || c == 1)
1175 break;
1176
1177 switch (c) {
1178 case 'h':
1179 print_help();
1180 exit(STATE_UNKNOWN);
1181 break;
1182 case 'V':
1183 print_revision(progname, NP_VERSION);
1184 print_curl_version();
1185 exit(STATE_UNKNOWN);
1186 break;
1187 case 'v':
1188 verbose++;
1189 break;
1190 case 't': /* timeout period */
1191 if (!is_intnonneg (optarg))
1192 usage2 (_("Timeout interval must be a positive integer"), optarg);
1193 else
1194 socket_timeout = (int)strtol (optarg, NULL, 10);
1195 break;
1196 case 'c': /* critical time threshold */
1197 critical_thresholds = optarg;
1198 break;
1199 case 'w': /* warning time threshold */
1200 warning_thresholds = optarg;
1201 break;
1202 case 'H': /* virtual host */
1203 host_name = strdup (optarg);
1204 if (host_name[0] == '[') {
1205 if ((p = strstr (host_name, "]:")) != NULL) { /* [IPv6]:port */
1206 virtual_port = atoi (p + 2);
1207 /* cut off the port */
1208 host_name_length = strlen (host_name) - strlen (p) - 1;
1209 free (host_name);
1210 host_name = strndup (optarg, host_name_length);
1211 }
1212 } else if ((p = strchr (host_name, ':')) != NULL
1213 && strchr (++p, ':') == NULL) { /* IPv4:port or host:port */
1214 virtual_port = atoi (p);
1215 /* cut off the port */
1216 host_name_length = strlen (host_name) - strlen (p) - 1;
1217 free (host_name);
1218 host_name = strndup (optarg, host_name_length);
1219 }
1220 break;
1221 case 'I': /* internet address */
1222 server_address = strdup (optarg);
1223 break;
1224 case 'u': /* URL path */
1225 server_url = strdup (optarg);
1226 break;
1227 case 'p': /* Server port */
1228 if (!is_intnonneg (optarg))
1229 usage2 (_("Invalid port number, expecting a non-negative number"), optarg);
1230 else {
1231 if( strtol(optarg, NULL, 10) > MAX_PORT)
1232 usage2 (_("Invalid port number, supplied port number is too big"), optarg);
1233 server_port = (unsigned short)strtol(optarg, NULL, 10);
1234 specify_port = TRUE;
1235 }
1236 break;
1237 case 'a': /* authorization info */
1238 strncpy (user_auth, optarg, MAX_INPUT_BUFFER - 1);
1239 user_auth[MAX_INPUT_BUFFER - 1] = 0;
1240 break;
1241 case 'b': /* proxy-authorization info */
1242 strncpy (proxy_auth, optarg, MAX_INPUT_BUFFER - 1);
1243 proxy_auth[MAX_INPUT_BUFFER - 1] = 0;
1244 break;
1245 case 'P': /* HTTP POST data in URL encoded format; ignored if settings already */
1246 if (! http_post_data)
1247 http_post_data = strdup (optarg);
1248 if (! http_method)
1249 http_method = strdup("POST");
1250 break;
1251 case 'j': /* Set HTTP method */
1252 if (http_method)
1253 free(http_method);
1254 http_method = strdup (optarg);
1255 break;
1256 case 'A': /* useragent */
1257 strncpy (user_agent, optarg, DEFAULT_BUFFER_SIZE);
1258 user_agent[DEFAULT_BUFFER_SIZE-1] = '\0';
1259 break;
1260 case 'k': /* Additional headers */
1261 if (http_opt_headers_count == 0)
1262 http_opt_headers = malloc (sizeof (char *) * (++http_opt_headers_count));
1263 else
1264 http_opt_headers = realloc (http_opt_headers, sizeof (char *) * (++http_opt_headers_count));
1265 http_opt_headers[http_opt_headers_count - 1] = optarg;
1266 break;
1267 case 'L': /* show html link */
1268 display_html = TRUE;
1269 break;
1270 case 'n': /* do not show html link */
1271 display_html = FALSE;
1272 break;
1273 case 'C': /* Check SSL cert validity */
1274#ifdef LIBCURL_FEATURE_SSL
1275 if ((temp=strchr(optarg,','))!=NULL) {
1276 *temp='\0';
1277 if (!is_intnonneg (optarg))
1278 usage2 (_("Invalid certificate expiration period"), optarg);
1279 days_till_exp_warn = atoi(optarg);
1280 *temp=',';
1281 temp++;
1282 if (!is_intnonneg (temp))
1283 usage2 (_("Invalid certificate expiration period"), temp);
1284 days_till_exp_crit = atoi (temp);
1285 }
1286 else {
1287 days_till_exp_crit=0;
1288 if (!is_intnonneg (optarg))
1289 usage2 (_("Invalid certificate expiration period"), optarg);
1290 days_till_exp_warn = atoi (optarg);
1291 }
1292 check_cert = TRUE;
1293 goto enable_ssl;
1294#endif
1295 case 'J': /* use client certificate */
1296#ifdef LIBCURL_FEATURE_SSL
1297 test_file(optarg);
1298 client_cert = optarg;
1299 goto enable_ssl;
1300#endif
1301 case 'K': /* use client private key */
1302#ifdef LIBCURL_FEATURE_SSL
1303 test_file(optarg);
1304 client_privkey = optarg;
1305 goto enable_ssl;
1306#endif
1307#ifdef LIBCURL_FEATURE_SSL
1308 case CA_CERT_OPTION: /* use CA chain file */
1309 test_file(optarg);
1310 ca_cert = optarg;
1311 goto enable_ssl;
1312#endif
1313 case 'S': /* use SSL */
1314#ifdef LIBCURL_FEATURE_SSL
1315 enable_ssl:
1316 use_ssl = TRUE;
1317 /* ssl_version initialized to CURL_SSLVERSION_DEFAULT as a default.
1318 * Only set if it's non-zero. This helps when we include multiple
1319 * parameters, like -S and -C combinations */
1320 ssl_version = CURL_SSLVERSION_DEFAULT;
1321 if (c=='S' && optarg != NULL) {
1322 char *plus_ptr = strchr(optarg, '+');
1323 if (plus_ptr) {
1324 got_plus = 1;
1325 *plus_ptr = '\0';
1326 }
1327
1328 if (optarg[0] == '2')
1329 ssl_version = CURL_SSLVERSION_SSLv2;
1330 else if (optarg[0] == '3')
1331 ssl_version = CURL_SSLVERSION_SSLv3;
1332 else if (!strcmp (optarg, "1") || !strcmp (optarg, "1.0"))
1333#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
1334 ssl_version = CURL_SSLVERSION_TLSv1_0;
1335#else
1336 ssl_version = CURL_SSLVERSION_DEFAULT;
1337#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
1338 else if (!strcmp (optarg, "1.1"))
1339#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
1340 ssl_version = CURL_SSLVERSION_TLSv1_1;
1341#else
1342 ssl_version = CURL_SSLVERSION_DEFAULT;
1343#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
1344 else if (!strcmp (optarg, "1.2"))
1345#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0)
1346 ssl_version = CURL_SSLVERSION_TLSv1_2;
1347#else
1348 ssl_version = CURL_SSLVERSION_DEFAULT;
1349#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 34, 0) */
1350 else if (!strcmp (optarg, "1.3"))
1351#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 52, 0)
1352 ssl_version = CURL_SSLVERSION_TLSv1_3;
1353#else
1354 ssl_version = CURL_SSLVERSION_DEFAULT;
1355#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 52, 0) */
1356 else
1357 usage4 (_("Invalid option - Valid SSL/TLS versions: 2, 3, 1, 1.1, 1.2 (with optional '+' suffix)"));
1358 }
1359#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 54, 0)
1360 if (got_plus) {
1361 switch (ssl_version) {
1362 case CURL_SSLVERSION_TLSv1_3:
1363 ssl_version |= CURL_SSLVERSION_MAX_TLSv1_3;
1364 break;
1365 case CURL_SSLVERSION_TLSv1_2:
1366 case CURL_SSLVERSION_TLSv1_1:
1367 case CURL_SSLVERSION_TLSv1_0:
1368 ssl_version |= CURL_SSLVERSION_MAX_DEFAULT;
1369 break;
1370 }
1371 } else {
1372 switch (ssl_version) {
1373 case CURL_SSLVERSION_TLSv1_3:
1374 ssl_version |= CURL_SSLVERSION_MAX_TLSv1_3;
1375 break;
1376 case CURL_SSLVERSION_TLSv1_2:
1377 ssl_version |= CURL_SSLVERSION_MAX_TLSv1_2;
1378 break;
1379 case CURL_SSLVERSION_TLSv1_1:
1380 ssl_version |= CURL_SSLVERSION_MAX_TLSv1_1;
1381 break;
1382 case CURL_SSLVERSION_TLSv1_0:
1383 ssl_version |= CURL_SSLVERSION_MAX_TLSv1_0;
1384 break;
1385 }
1386 }
1387#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 54, 0) */
1388 if (verbose >= 2)
1389 printf(_("* Set SSL/TLS version to %d\n"), ssl_version);
1390 if (specify_port == FALSE)
1391 server_port = HTTPS_PORT;
1392 break;
1393#else /* LIBCURL_FEATURE_SSL */
1394 /* -C -J and -K fall through to here without SSL */
1395 usage4 (_("Invalid option - SSL is not available"));
1396 break;
1397 case SNI_OPTION: /* --sni is parsed, but ignored, the default is TRUE with libcurl */
1398 use_sni = TRUE;
1399 break;
1400#endif /* LIBCURL_FEATURE_SSL */
1401 case 'f': /* onredirect */
1402 if (!strcmp (optarg, "ok"))
1403 onredirect = STATE_OK;
1404 else if (!strcmp (optarg, "warning"))
1405 onredirect = STATE_WARNING;
1406 else if (!strcmp (optarg, "critical"))
1407 onredirect = STATE_CRITICAL;
1408 else if (!strcmp (optarg, "unknown"))
1409 onredirect = STATE_UNKNOWN;
1410 else if (!strcmp (optarg, "follow"))
1411 onredirect = STATE_DEPENDENT;
1412 else if (!strcmp (optarg, "stickyport"))
1413 onredirect = STATE_DEPENDENT, followmethod = FOLLOW_HTTP_CURL, followsticky = STICKY_HOST|STICKY_PORT;
1414 else if (!strcmp (optarg, "sticky"))
1415 onredirect = STATE_DEPENDENT, followmethod = FOLLOW_HTTP_CURL, followsticky = STICKY_HOST;
1416 else if (!strcmp (optarg, "follow"))
1417 onredirect = STATE_DEPENDENT, followmethod = FOLLOW_HTTP_CURL, followsticky = STICKY_NONE;
1418 else if (!strcmp (optarg, "curl"))
1419 onredirect = STATE_DEPENDENT, followmethod = FOLLOW_LIBCURL;
1420 else usage2 (_("Invalid onredirect option"), optarg);
1421 if (verbose >= 2)
1422 printf(_("* Following redirects set to %s\n"), state_text(onredirect));
1423 break;
1424 case 'd': /* string or substring */
1425 strncpy (header_expect, optarg, MAX_INPUT_BUFFER - 1);
1426 header_expect[MAX_INPUT_BUFFER - 1] = 0;
1427 break;
1428 case 's': /* string or substring */
1429 strncpy (string_expect, optarg, MAX_INPUT_BUFFER - 1);
1430 string_expect[MAX_INPUT_BUFFER - 1] = 0;
1431 break;
1432 case 'e': /* string or substring */
1433 strncpy (server_expect, optarg, MAX_INPUT_BUFFER - 1);
1434 server_expect[MAX_INPUT_BUFFER - 1] = 0;
1435 server_expect_yn = 1;
1436 break;
1437 case 'T': /* Content-type */
1438 http_content_type = strdup (optarg);
1439 break;
1440 case 'l': /* linespan */
1441 cflags &= ~REG_NEWLINE;
1442 break;
1443 case 'R': /* regex */
1444 cflags |= REG_ICASE;
1445 case 'r': /* regex */
1446 strncpy (regexp, optarg, MAX_RE_SIZE - 1);
1447 regexp[MAX_RE_SIZE - 1] = 0;
1448 errcode = regcomp (&preg, regexp, cflags);
1449 if (errcode != 0) {
1450 (void) regerror (errcode, &preg, errbuf, MAX_INPUT_BUFFER);
1451 printf (_("Could Not Compile Regular Expression: %s"), errbuf);
1452 return ERROR;
1453 }
1454 break;
1455 case INVERT_REGEX:
1456 invert_regex = 1;
1457 break;
1458 case '4':
1459 address_family = AF_INET;
1460 break;
1461 case '6':
1462#if defined (USE_IPV6) && defined (LIBCURL_FEATURE_IPV6)
1463 address_family = AF_INET6;
1464#else
1465 usage4 (_("IPv6 support not available"));
1466#endif
1467 break;
1468 case 'm': /* min_page_length */
1469 {
1470 char *tmp;
1471 if (strchr(optarg, ':') != (char *)NULL) {
1472 /* range, so get two values, min:max */
1473 tmp = strtok(optarg, ":");
1474 if (tmp == NULL) {
1475 printf("Bad format: try \"-m min:max\"\n");
1476 exit (STATE_WARNING);
1477 } else
1478 min_page_len = atoi(tmp);
1479
1480 tmp = strtok(NULL, ":");
1481 if (tmp == NULL) {
1482 printf("Bad format: try \"-m min:max\"\n");
1483 exit (STATE_WARNING);
1484 } else
1485 max_page_len = atoi(tmp);
1486 } else
1487 min_page_len = atoi (optarg);
1488 break;
1489 }
1490 case 'N': /* no-body */
1491 no_body = TRUE;
1492 break;
1493 case 'M': /* max-age */
1494 {
1495 int L = strlen(optarg);
1496 if (L && optarg[L-1] == 'm')
1497 maximum_age = atoi (optarg) * 60;
1498 else if (L && optarg[L-1] == 'h')
1499 maximum_age = atoi (optarg) * 60 * 60;
1500 else if (L && optarg[L-1] == 'd')
1501 maximum_age = atoi (optarg) * 60 * 60 * 24;
1502 else if (L && (optarg[L-1] == 's' ||
1503 isdigit (optarg[L-1])))
1504 maximum_age = atoi (optarg);
1505 else {
1506 fprintf (stderr, "unparsable max-age: %s\n", optarg);
1507 exit (STATE_WARNING);
1508 }
1509 if (verbose >= 2)
1510 printf ("* Maximal age of document set to %d seconds\n", maximum_age);
1511 }
1512 break;
1513 case 'E': /* show extended perfdata */
1514 show_extended_perfdata = TRUE;
1515 break;
1516 case HTTP_VERSION_OPTION:
1517 curl_http_version = CURL_HTTP_VERSION_NONE;
1518 if (strcmp (optarg, "1.0") == 0) {
1519 curl_http_version = CURL_HTTP_VERSION_1_0;
1520 } else if (strcmp (optarg, "1.1") == 0) {
1521 curl_http_version = CURL_HTTP_VERSION_1_1;
1522 } else if ((strcmp (optarg, "2.0") == 0) || (strcmp (optarg, "2") == 0)) {
1523#if LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 33, 0)
1524 curl_http_version = CURL_HTTP_VERSION_2_0;
1525#else
1526 curl_http_version = CURL_HTTP_VERSION_NONE;
1527#endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 33, 0) */
1528 } else {
1529 fprintf (stderr, "unkown http-version parameter: %s\n", optarg);
1530 exit (STATE_WARNING);
1531 }
1532 break;
1533 case '?':
1534 /* print short usage statement if args not parsable */
1535 usage5 ();
1536 break;
1537 }
1538 }
1539
1540 c = optind;
1541
1542 if (server_address == NULL && c < argc)
1543 server_address = strdup (argv[c++]);
1544
1545 if (host_name == NULL && c < argc)
1546 host_name = strdup (argv[c++]);
1547
1548 if (server_address == NULL) {
1549 if (host_name == NULL)
1550 usage4 (_("You must specify a server address or host name"));
1551 else
1552 server_address = strdup (host_name);
1553 }
1554
1555 set_thresholds(&thlds, warning_thresholds, critical_thresholds);
1556
1557 if (critical_thresholds && thlds->critical->end>(double)socket_timeout)
1558 socket_timeout = (int)thlds->critical->end + 1;
1559 if (verbose >= 2)
1560 printf ("* Socket timeout set to %ld seconds\n", socket_timeout);
1561
1562 if (http_method == NULL)
1563 http_method = strdup ("GET");
1564
1565 if (client_cert && !client_privkey)
1566 usage4 (_("If you use a client certificate you must also specify a private key file"));
1567
1568 if (virtual_port == 0)
1569 virtual_port = server_port;
1570 else {
1571 if ((use_ssl && server_port == HTTPS_PORT) || (!use_ssl && server_port == HTTP_PORT))
1572 if(specify_port == FALSE)
1573 server_port = virtual_port;
1574 }
1575
1576 return TRUE;
1577}
1578
1579char *perfd_time (double elapsed_time)
1580{
1581 return fperfdata ("time", elapsed_time, "s",
1582 thlds->warning?TRUE:FALSE, thlds->warning?thlds->warning->end:0,
1583 thlds->critical?TRUE:FALSE, thlds->critical?thlds->critical->end:0,
1584 TRUE, 0, TRUE, socket_timeout);
1585}
1586
1587char *perfd_time_connect (double elapsed_time_connect)
1588{
1589 return fperfdata ("time_connect", elapsed_time_connect, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1590}
1591
1592char *perfd_time_ssl (double elapsed_time_ssl)
1593{
1594 return fperfdata ("time_ssl", elapsed_time_ssl, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1595}
1596
1597char *perfd_time_headers (double elapsed_time_headers)
1598{
1599 return fperfdata ("time_headers", elapsed_time_headers, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1600}
1601
1602char *perfd_time_firstbyte (double elapsed_time_firstbyte)
1603{
1604 return fperfdata ("time_firstbyte", elapsed_time_firstbyte, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1605}
1606
1607char *perfd_time_transfer (double elapsed_time_transfer)
1608{
1609 return fperfdata ("time_transfer", elapsed_time_transfer, "s", FALSE, 0, FALSE, 0, FALSE, 0, TRUE, socket_timeout);
1610}
1611
1612char *perfd_size (int page_len)
1613{
1614 return perfdata ("size", page_len, "B",
1615 (min_page_len>0?TRUE:FALSE), min_page_len,
1616 (min_page_len>0?TRUE:FALSE), 0,
1617 TRUE, 0, FALSE, 0);
1618}
1619
1620void
1621print_help (void)
1622{
1623 print_revision (progname, NP_VERSION);
1624
1625 printf ("Copyright (c) 1999 Ethan Galstad <nagios@nagios.org>\n");
1626 printf (COPYRIGHT, copyright, email);
1627
1628 printf ("%s\n", _("This plugin tests the HTTP service on the specified host. It can test"));
1629 printf ("%s\n", _("normal (http) and secure (https) servers, follow redirects, search for"));
1630 printf ("%s\n", _("strings and regular expressions, check connection times, and report on"));
1631 printf ("%s\n", _("certificate expiration times."));
1632 printf ("\n");
1633 printf ("%s\n", _("It makes use of libcurl to do so. It tries to be as compatible to check_http"));
1634 printf ("%s\n", _("as possible."));
1635
1636 printf ("\n\n");
1637
1638 print_usage ();
1639
1640 printf (_("NOTE: One or both of -H and -I must be specified"));
1641
1642 printf ("\n");
1643
1644 printf (UT_HELP_VRSN);
1645 printf (UT_EXTRA_OPTS);
1646
1647 printf (" %s\n", "-H, --hostname=ADDRESS");
1648 printf (" %s\n", _("Host name argument for servers using host headers (virtual host)"));
1649 printf (" %s\n", _("Append a port to include it in the header (eg: example.com:5000)"));
1650 printf (" %s\n", "-I, --IP-address=ADDRESS");
1651 printf (" %s\n", _("IP address or name (use numeric address if possible to bypass DNS lookup)."));
1652 printf (" %s\n", "-p, --port=INTEGER");
1653 printf (" %s", _("Port number (default: "));
1654 printf ("%d)\n", HTTP_PORT);
1655
1656 printf (UT_IPv46);
1657
1658#ifdef LIBCURL_FEATURE_SSL
1659 printf (" %s\n", "-S, --ssl=VERSION[+]");
1660 printf (" %s\n", _("Connect via SSL. Port defaults to 443. VERSION is optional, and prevents"));
1661 printf (" %s\n", _("auto-negotiation (2 = SSLv2, 3 = SSLv3, 1 = TLSv1, 1.1 = TLSv1.1,"));
1662 printf (" %s\n", _("1.2 = TLSv1.2). With a '+' suffix, newer versions are also accepted."));
1663 printf (" %s\n", _("Note: SSLv2 and SSLv3 are deprecated and are usually disabled in libcurl"));
1664 printf (" %s\n", "--sni");
1665 printf (" %s\n", _("Enable SSL/TLS hostname extension support (SNI)"));
1666#if LIBCURL_VERSION_NUM >= 0x071801
1667 printf (" %s\n", _("Note: --sni is the default in libcurl as SSLv2 and SSLV3 are deprecated and"));
1668 printf (" %s\n", _(" SNI only really works since TLSv1.0"));
1669#else
1670 printf (" %s\n", _("Note: SNI is not supported in libcurl before 7.18.1"));
1671#endif
1672 printf (" %s\n", "-C, --certificate=INTEGER[,INTEGER]");
1673 printf (" %s\n", _("Minimum number of days a certificate has to be valid. Port defaults to 443"));
1674 printf (" %s\n", _("(when this option is used the URL is not checked.)"));
1675 printf (" %s\n", "-J, --client-cert=FILE");
1676 printf (" %s\n", _("Name of file that contains the client certificate (PEM format)"));
1677 printf (" %s\n", _("to be used in establishing the SSL session"));
1678 printf (" %s\n", "-K, --private-key=FILE");
1679 printf (" %s\n", _("Name of file containing the private key (PEM format)"));
1680 printf (" %s\n", _("matching the client certificate"));
1681 printf (" %s\n", "--ca-cert=FILE");
1682 printf (" %s\n", _("CA certificate file to verify peer against"));
1683#endif
1684
1685 printf (" %s\n", "-e, --expect=STRING");
1686 printf (" %s\n", _("Comma-delimited list of strings, at least one of them is expected in"));
1687 printf (" %s", _("the first (status) line of the server response (default: "));
1688 printf ("%s)\n", HTTP_EXPECT);
1689 printf (" %s\n", _("If specified skips all other status line logic (ex: 3xx, 4xx, 5xx processing)"));
1690 printf (" %s\n", "-d, --header-string=STRING");
1691 printf (" %s\n", _("String to expect in the response headers"));
1692 printf (" %s\n", "-s, --string=STRING");
1693 printf (" %s\n", _("String to expect in the content"));
1694 printf (" %s\n", "-u, --url=PATH");
1695 printf (" %s\n", _("URL to GET or POST (default: /)"));
1696 printf (" %s\n", "-P, --post=STRING");
1697 printf (" %s\n", _("URL encoded http POST data"));
1698 printf (" %s\n", "-j, --method=STRING (for example: HEAD, OPTIONS, TRACE, PUT, DELETE, CONNECT)");
1699 printf (" %s\n", _("Set HTTP method."));
1700 printf (" %s\n", "-N, --no-body");
1701 printf (" %s\n", _("Don't wait for document body: stop reading after headers."));
1702 printf (" %s\n", _("(Note that this still does an HTTP GET or POST, not a HEAD.)"));
1703 printf (" %s\n", "-M, --max-age=SECONDS");
1704 printf (" %s\n", _("Warn if document is more than SECONDS old. the number can also be of"));
1705 printf (" %s\n", _("the form \"10m\" for minutes, \"10h\" for hours, or \"10d\" for days."));
1706 printf (" %s\n", "-T, --content-type=STRING");
1707 printf (" %s\n", _("specify Content-Type header media type when POSTing\n"));
1708 printf (" %s\n", "-l, --linespan");
1709 printf (" %s\n", _("Allow regex to span newlines (must precede -r or -R)"));
1710 printf (" %s\n", "-r, --regex, --ereg=STRING");
1711 printf (" %s\n", _("Search page for regex STRING"));
1712 printf (" %s\n", "-R, --eregi=STRING");
1713 printf (" %s\n", _("Search page for case-insensitive regex STRING"));
1714 printf (" %s\n", "--invert-regex");
1715 printf (" %s\n", _("Return CRITICAL if found, OK if not\n"));
1716 printf (" %s\n", "-a, --authorization=AUTH_PAIR");
1717 printf (" %s\n", _("Username:password on sites with basic authentication"));
1718 printf (" %s\n", "-b, --proxy-authorization=AUTH_PAIR");
1719 printf (" %s\n", _("Username:password on proxy-servers with basic authentication"));
1720 printf (" %s\n", "-A, --useragent=STRING");
1721 printf (" %s\n", _("String to be sent in http header as \"User Agent\""));
1722 printf (" %s\n", "-k, --header=STRING");
1723 printf (" %s\n", _("Any other tags to be sent in http header. Use multiple times for additional headers"));
1724 printf (" %s\n", "-E, --extended-perfdata");
1725 printf (" %s\n", _("Print additional performance data"));
1726 printf (" %s\n", "-L, --link");
1727 printf (" %s\n", _("Wrap output in HTML link (obsoleted by urlize)"));
1728 printf (" %s\n", "-f, --onredirect=<ok|warning|critical|follow|sticky|stickyport|curl>");
1729 printf (" %s\n", _("How to handle redirected pages. sticky is like follow but stick to the"));
1730 printf (" %s\n", _("specified IP address. stickyport also ensures port stays the same."));
1731 printf (" %s\n", _("follow uses the old redirection algorithm of check_http."));
1732 printf (" %s\n", _("curl uses CURL_FOLLOWLOCATION built into libcurl."));
1733 printf (" %s\n", "-m, --pagesize=INTEGER<:INTEGER>");
1734 printf (" %s\n", _("Minimum page size required (bytes) : Maximum page size required (bytes)"));
1735 printf ("\n");
1736 printf (" %s\n", "--http-version=VERSION");
1737 printf (" %s\n", _("Connect via specific HTTP protocol."));
1738 printf (" %s\n", _("1.0 = HTTP/1.0, 1.1 = HTTP/1.1, 2.0 = HTTP/2 (HTTP/2 will fail without -S)"));
1739 printf ("\n");
1740
1741 printf (UT_WARN_CRIT);
1742
1743 printf (UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
1744
1745 printf (UT_VERBOSE);
1746
1747 printf ("\n");
1748 printf ("%s\n", _("Notes:"));
1749 printf (" %s\n", _("This plugin will attempt to open an HTTP connection with the host."));
1750 printf (" %s\n", _("Successful connects return STATE_OK, refusals and timeouts return STATE_CRITICAL"));
1751 printf (" %s\n", _("other errors return STATE_UNKNOWN. Successful connects, but incorrect response"));
1752 printf (" %s\n", _("messages from the host result in STATE_WARNING return values. If you are"));
1753 printf (" %s\n", _("checking a virtual server that uses 'host headers' you must supply the FQDN"));
1754 printf (" %s\n", _("(fully qualified domain name) as the [host_name] argument."));
1755
1756#ifdef LIBCURL_FEATURE_SSL
1757 printf ("\n");
1758 printf (" %s\n", _("This plugin can also check whether an SSL enabled web server is able to"));
1759 printf (" %s\n", _("serve content (optionally within a specified time) or whether the X509 "));
1760 printf (" %s\n", _("certificate is still valid for the specified number of days."));
1761 printf ("\n");
1762 printf (" %s\n", _("Please note that this plugin does not check if the presented server"));
1763 printf (" %s\n", _("certificate matches the hostname of the server, or if the certificate"));
1764 printf (" %s\n", _("has a valid chain of trust to one of the locally installed CAs."));
1765 printf ("\n");
1766 printf ("%s\n", _("Examples:"));
1767 printf (" %s\n\n", "CHECK CONTENT: check_curl -w 5 -c 10 --ssl -H www.verisign.com");
1768 printf (" %s\n", _("When the 'www.verisign.com' server returns its content within 5 seconds,"));
1769 printf (" %s\n", _("a STATE_OK will be returned. When the server returns its content but exceeds"));
1770 printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
1771 printf (" %s\n", _("a STATE_CRITICAL will be returned."));
1772 printf ("\n");
1773 printf (" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 14");
1774 printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
1775 printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
1776 printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
1777 printf (" %s\n\n", _("the certificate is expired."));
1778 printf ("\n");
1779 printf (" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 30,14");
1780 printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 30 days,"));
1781 printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
1782 printf (" %s\n", _("30 days, but more than 14 days, a STATE_WARNING is returned."));
1783 printf (" %s\n", _("A STATE_CRITICAL will be returned when certificate expires in less than 14 days"));
1784#endif
1785
1786 printf ("\n %s\n", "CHECK WEBSERVER CONTENT VIA PROXY:");
1787 printf (" %s\n", _("It is recommended to use an environment proxy like:"));
1788 printf (" %s\n", _("http_proxy=http://192.168.100.35:3128 ./check_curl -H www.monitoring-plugins.org"));
1789 printf (" %s\n", _("legacy proxy requests in check_http style still work:"));
1790 printf (" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u http://www.monitoring-plugins.org/ -H www.monitoring-plugins.org"));
1791
1792#ifdef LIBCURL_FEATURE_SSL
1793 printf ("\n %s\n", "CHECK SSL WEBSERVER CONTENT VIA PROXY USING HTTP 1.1 CONNECT: ");
1794 printf (" %s\n", _("It is recommended to use an environment proxy like:"));
1795 printf (" %s\n", _("https_proxy=http://192.168.100.35:3128 ./check_curl -H www.verisign.com -S"));
1796 printf (" %s\n", _("legacy proxy requests in check_http style still work:"));
1797 printf (" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u https://www.verisign.com/ -S -j CONNECT -H www.verisign.com "));
1798 printf (" %s\n", _("all these options are needed: -I <proxy> -p <proxy-port> -u <check-url> -S(sl) -j CONNECT -H <webserver>"));
1799 printf (" %s\n", _("a STATE_OK will be returned. When the server returns its content but exceeds"));
1800 printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
1801 printf (" %s\n", _("a STATE_CRITICAL will be returned."));
1802
1803#endif
1804
1805 printf (UT_SUPPORT);
1806
1807}
1808
1809
1810
1811void
1812print_usage (void)
1813{
1814 printf ("%s\n", _("Usage:"));
1815 printf (" %s -H <vhost> | -I <IP-address> [-u <uri>] [-p <port>]\n",progname);
1816 printf (" [-J <client certificate file>] [-K <private key>] [--ca-cert <CA certificate file>]\n");
1817 printf (" [-w <warn time>] [-c <critical time>] [-t <timeout>] [-L] [-E] [-a auth]\n");
1818 printf (" [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport|curl>]\n");
1819 printf (" [-e <expect>] [-d string] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
1820 printf (" [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
1821 printf (" [-A string] [-k string] [-S <version>] [--sni] [-C <warn_age>[,<crit_age>]]\n");
1822 printf (" [-T <content-type>] [-j method]\n");
1823 printf (" [--http-version=<version>]\n");
1824 printf ("\n");
1825 printf ("%s\n", _("WARNING: check_curl is experimental. Please use"));
1826 printf ("%s\n\n", _("check_http if you need a stable version."));
1827}
1828
1829void
1830print_curl_version (void)
1831{
1832 printf( "%s\n", curl_version());
1833}
1834
1835int
1836curlhelp_initwritebuffer (curlhelp_write_curlbuf *buf)
1837{
1838 buf->bufsize = DEFAULT_BUFFER_SIZE;
1839 buf->buflen = 0;
1840 buf->buf = (char *)malloc ((size_t)buf->bufsize);
1841 if (buf->buf == NULL) return -1;
1842 return 0;
1843}
1844
1845int
1846curlhelp_buffer_write_callback (void *buffer, size_t size, size_t nmemb, void *stream)
1847{
1848 curlhelp_write_curlbuf *buf = (curlhelp_write_curlbuf *)stream;
1849
1850 while (buf->bufsize < buf->buflen + size * nmemb + 1) {
1851 buf->bufsize *= buf->bufsize * 2;
1852 buf->buf = (char *)realloc (buf->buf, buf->bufsize);
1853 if (buf->buf == NULL) return -1;
1854 }
1855
1856 memcpy (buf->buf + buf->buflen, buffer, size * nmemb);
1857 buf->buflen += size * nmemb;
1858 buf->buf[buf->buflen] = '\0';
1859
1860 return (int)(size * nmemb);
1861}
1862
1863int
1864curlhelp_buffer_read_callback (void *buffer, size_t size, size_t nmemb, void *stream)
1865{
1866 curlhelp_read_curlbuf *buf = (curlhelp_read_curlbuf *)stream;
1867
1868 size_t n = min (nmemb * size, buf->buflen - buf->pos);
1869
1870 memcpy (buffer, buf->buf + buf->pos, n);
1871 buf->pos += n;
1872
1873 return (int)n;
1874}
1875
1876void
1877curlhelp_freewritebuffer (curlhelp_write_curlbuf *buf)
1878{
1879 free (buf->buf);
1880 buf->buf = NULL;
1881}
1882
1883int
1884curlhelp_initreadbuffer (curlhelp_read_curlbuf *buf, const char *data, size_t datalen)
1885{
1886 buf->buflen = datalen;
1887 buf->buf = (char *)malloc ((size_t)buf->buflen);
1888 if (buf->buf == NULL) return -1;
1889 memcpy (buf->buf, data, datalen);
1890 buf->pos = 0;
1891 return 0;
1892}
1893
1894void
1895curlhelp_freereadbuffer (curlhelp_read_curlbuf *buf)
1896{
1897 free (buf->buf);
1898 buf->buf = NULL;
1899}
1900
1901/* TODO: where to put this, it's actually part of sstrings2 (logically)?
1902 */
1903const char*
1904strrstr2(const char *haystack, const char *needle)
1905{
1906 int counter;
1907 size_t len;
1908 const char *prev_pos;
1909 const char *pos;
1910
1911 if (haystack == NULL || needle == NULL)
1912 return NULL;
1913
1914 if (haystack[0] == '\0' || needle[0] == '\0')
1915 return NULL;
1916
1917 counter = 0;
1918 prev_pos = NULL;
1919 pos = haystack;
1920 len = strlen (needle);
1921 for (;;) {
1922 pos = strstr (pos, needle);
1923 if (pos == NULL) {
1924 if (counter == 0)
1925 return NULL;
1926 else
1927 return prev_pos;
1928 }
1929 counter++;
1930 prev_pos = pos;
1931 pos += len;
1932 if (*pos == '\0') return prev_pos;
1933 }
1934}
1935
1936int
1937curlhelp_parse_statusline (const char *buf, curlhelp_statusline *status_line)
1938{
1939 char *first_line_end;
1940 char *p;
1941 size_t first_line_len;
1942 char *pp;
1943 const char *start;
1944 char *first_line_buf;
1945
1946 /* find last start of a new header */
1947 start = strrstr2 (buf, "\r\nHTTP");
1948 if (start != NULL) {
1949 start += 2;
1950 buf = start;
1951 }
1952
1953 first_line_end = strstr(buf, "\r\n");
1954 if (first_line_end == NULL) return -1;
1955
1956 first_line_len = (size_t)(first_line_end - buf);
1957 status_line->first_line = (char *)malloc (first_line_len + 1);
1958 if (status_line->first_line == NULL) return -1;
1959 memcpy (status_line->first_line, buf, first_line_len);
1960 status_line->first_line[first_line_len] = '\0';
1961 first_line_buf = strdup( status_line->first_line );
1962
1963 /* protocol and version: "HTTP/x.x" SP or "HTTP/2" SP */
1964
1965 p = strtok(first_line_buf, "/");
1966 if( p == NULL ) { free( first_line_buf ); return -1; }
1967 if( strcmp( p, "HTTP" ) != 0 ) { free( first_line_buf ); return -1; }
1968
1969 p = strtok( NULL, " " );
1970 if( p == NULL ) { free( first_line_buf ); return -1; }
1971 if( strchr( p, '.' ) != NULL ) {
1972
1973 /* HTTP 1.x case */
1974 char *ppp;
1975 ppp = strtok( p, "." );
1976 status_line->http_major = (int)strtol( p, &pp, 10 );
1977 if( *pp != '\0' ) { free( first_line_buf ); return -1; }
1978 ppp = strtok( NULL, " " );
1979 status_line->http_minor = (int)strtol( p, &pp, 10 );
1980 if( *pp != '\0' ) { free( first_line_buf ); return -1; }
1981 p += 4; /* 1.x SP */
1982 } else {
1983 /* HTTP 2 case */
1984 status_line->http_major = (int)strtol( p, &pp, 10 );
1985 status_line->http_minor = 0;
1986 p += 2; /* 2 SP */
1987 }
1988
1989 /* status code: "404" or "404.1", then SP */
1990
1991 p = strtok( p, " " );
1992 if( p == NULL ) { free( first_line_buf ); return -1; }
1993 if( strchr( p, '.' ) != NULL ) {
1994 char *ppp;
1995 ppp = strtok( p, "." );
1996 status_line->http_code = (int)strtol( ppp, &pp, 10 );
1997 if( *pp != '\0' ) { free( first_line_buf ); return -1; }
1998 ppp = strtok( NULL, "" );
1999 status_line->http_subcode = (int)strtol( ppp, &pp, 10 );
2000 if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2001 p += 6; /* 400.1 SP */
2002 } else {
2003 status_line->http_code = (int)strtol( p, &pp, 10 );
2004 status_line->http_subcode = -1;
2005 if( *pp != '\0' ) { free( first_line_buf ); return -1; }
2006 p += 4; /* 400 SP */
2007 }
2008
2009 /* Human readable message: "Not Found" CRLF */
2010
2011 p = strtok( p, "" );
2012 if( p == NULL ) { status_line->msg = ""; return 0; }
2013 status_line->msg = status_line->first_line + ( p - first_line_buf );
2014 free( first_line_buf );
2015
2016 return 0;
2017}
2018
2019void
2020curlhelp_free_statusline (curlhelp_statusline *status_line)
2021{
2022 free (status_line->first_line);
2023}
2024
2025void
2026remove_newlines (char *s)
2027{
2028 char *p;
2029
2030 for (p = s; *p != '\0'; p++)
2031 if (*p == '\r' || *p == '\n')
2032 *p = ' ';
2033}
2034
2035char *
2036get_header_value (const struct phr_header* headers, const size_t nof_headers, const char* header)
2037{
2038 int i;
2039 for( i = 0; i < nof_headers; i++ ) {
2040 if( strncasecmp( header, headers[i].name, max( headers[i].name_len, 4 ) ) == 0 ) {
2041 return strndup( headers[i].value, headers[i].value_len );
2042 }
2043 }
2044 return NULL;
2045}
2046
2047int
2048check_document_dates (const curlhelp_write_curlbuf *header_buf, char (*msg)[DEFAULT_BUFFER_SIZE])
2049{
2050 char *server_date = NULL;
2051 char *document_date = NULL;
2052 int date_result = STATE_OK;
2053 curlhelp_statusline status_line;
2054 struct phr_header headers[255];
2055 size_t nof_headers = 255;
2056 size_t msglen;
2057
2058 int res = phr_parse_response (header_buf->buf, header_buf->buflen,
2059 &status_line.http_minor, &status_line.http_code, &status_line.msg, &msglen,
2060 headers, &nof_headers, 0);
2061
2062 server_date = get_header_value (headers, nof_headers, "date");
2063 document_date = get_header_value (headers, nof_headers, "last-modified");
2064
2065 if (!server_date || !*server_date) {
2066 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sServer date unknown, "), *msg);
2067 date_result = max_state_alt(STATE_UNKNOWN, date_result);
2068 } else if (!document_date || !*document_date) {
2069 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sDocument modification date unknown, "), *msg);
2070 date_result = max_state_alt(STATE_CRITICAL, date_result);
2071 } else {
2072 time_t srv_data = curl_getdate (server_date, NULL);
2073 time_t doc_data = curl_getdate (document_date, NULL);
2074 if (verbose >= 2)
2075 printf ("* server date: '%s' (%d), doc_date: '%s' (%d)\n", server_date, (int)srv_data, document_date, (int)doc_data);
2076 if (srv_data <= 0) {
2077 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sServer date \"%100s\" unparsable, "), *msg, server_date);
2078 date_result = max_state_alt(STATE_CRITICAL, date_result);
2079 } else if (doc_data <= 0) {
2080 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sDocument date \"%100s\" unparsable, "), *msg, document_date);
2081 date_result = max_state_alt(STATE_CRITICAL, date_result);
2082 } else if (doc_data > srv_data + 30) {
2083 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sDocument is %d seconds in the future, "), *msg, (int)doc_data - (int)srv_data);
2084 date_result = max_state_alt(STATE_CRITICAL, date_result);
2085 } else if (doc_data < srv_data - maximum_age) {
2086 int n = (srv_data - doc_data);
2087 if (n > (60 * 60 * 24 * 2)) {
2088 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sLast modified %.1f days ago, "), *msg, ((float) n) / (60 * 60 * 24));
2089 date_result = max_state_alt(STATE_CRITICAL, date_result);
2090 } else {
2091 snprintf (*msg, DEFAULT_BUFFER_SIZE, _("%sLast modified %d:%02d:%02d ago, "), *msg, n / (60 * 60), (n / 60) % 60, n % 60);
2092 date_result = max_state_alt(STATE_CRITICAL, date_result);
2093 }
2094 }
2095 }
2096
2097 if (server_date) free (server_date);
2098 if (document_date) free (document_date);
2099
2100 return date_result;
2101}
2102
2103
2104int
2105get_content_length (const curlhelp_write_curlbuf* header_buf, const curlhelp_write_curlbuf* body_buf)
2106{
2107 const char *s;
2108 int content_length = 0;
2109 char *copy;
2110 struct phr_header headers[255];
2111 size_t nof_headers = 255;
2112 size_t msglen;
2113 char *content_length_s = NULL;
2114 curlhelp_statusline status_line;
2115
2116 int res = phr_parse_response (header_buf->buf, header_buf->buflen,
2117 &status_line.http_minor, &status_line.http_code, &status_line.msg, &msglen,
2118 headers, &nof_headers, 0);
2119
2120 content_length_s = get_header_value (headers, nof_headers, "content-length");
2121 if (!content_length_s) {
2122 return header_buf->buflen + body_buf->buflen;
2123 }
2124 content_length_s += strspn (content_length_s, " \t");
2125 content_length = atoi (content_length_s);
2126 if (content_length != body_buf->buflen) {
2127 /* TODO: should we warn if the actual and the reported body length don't match? */
2128 }
2129
2130 if (content_length_s) free (content_length_s);
2131
2132 return header_buf->buflen + body_buf->buflen;
2133}
2134
2135/* TODO: is there a better way in libcurl to check for the SSL library? */
2136curlhelp_ssl_library
2137curlhelp_get_ssl_library (CURL* curl)
2138{
2139 curl_version_info_data* version_data;
2140 char *ssl_version;
2141 char *library;
2142 curlhelp_ssl_library ssl_library = CURLHELP_SSL_LIBRARY_UNKNOWN;
2143
2144 version_data = curl_version_info (CURLVERSION_NOW);
2145 if (version_data == NULL) return CURLHELP_SSL_LIBRARY_UNKNOWN;
2146
2147 ssl_version = strdup (version_data->ssl_version);
2148 if (ssl_version == NULL ) return CURLHELP_SSL_LIBRARY_UNKNOWN;
2149
2150 library = strtok (ssl_version, "/");
2151 if (library == NULL) return CURLHELP_SSL_LIBRARY_UNKNOWN;
2152
2153 if (strcmp (library, "OpenSSL") == 0)
2154 ssl_library = CURLHELP_SSL_LIBRARY_OPENSSL;
2155 else if (strcmp (library, "LibreSSL") == 0)
2156 ssl_library = CURLHELP_SSL_LIBRARY_LIBRESSL;
2157 else if (strcmp (library, "GnuTLS") == 0)
2158 ssl_library = CURLHELP_SSL_LIBRARY_GNUTLS;
2159 else if (strcmp (library, "NSS") == 0)
2160 ssl_library = CURLHELP_SSL_LIBRARY_NSS;
2161
2162 if (verbose >= 2)
2163 printf ("* SSL library string is : %s %s (%d)\n", version_data->ssl_version, library, ssl_library);
2164
2165 free (ssl_version);
2166
2167 return ssl_library;
2168}
2169
2170const char*
2171curlhelp_get_ssl_library_string (curlhelp_ssl_library ssl_library)
2172{
2173 switch (ssl_library) {
2174 case CURLHELP_SSL_LIBRARY_OPENSSL:
2175 return "OpenSSL";
2176 case CURLHELP_SSL_LIBRARY_LIBRESSL:
2177 return "LibreSSL";
2178 case CURLHELP_SSL_LIBRARY_GNUTLS:
2179 return "GnuTLS";
2180 case CURLHELP_SSL_LIBRARY_NSS:
2181 return "NSS";
2182 case CURLHELP_SSL_LIBRARY_UNKNOWN:
2183 default:
2184 return "unknown";
2185 }
2186}
2187
2188#ifdef LIBCURL_FEATURE_SSL
2189#ifndef USE_OPENSSL
2190time_t
2191parse_cert_date (const char *s)
2192{
2193 struct tm tm;
2194 time_t date;
2195 char *res;
2196
2197 if (!s) return -1;
2198
2199 /* Jan 17 14:25:12 2020 GMT */
2200 res = strptime (s, "%Y-%m-%d %H:%M:%S GMT", &tm);
2201 /* Sep 11 12:00:00 2020 GMT */
2202 if (res == NULL) strptime (s, "%Y %m %d %H:%M:%S GMT", &tm);
2203 date = mktime (&tm);
2204
2205 return date;
2206}
2207
2208/* TODO: this needs cleanup in the sslutils.c, maybe we the #else case to
2209 * OpenSSL could be this function
2210 */
2211int
2212net_noopenssl_check_certificate (cert_ptr_union* cert_ptr, int days_till_exp_warn, int days_till_exp_crit)
2213{
2214 int i;
2215 struct curl_slist* slist;
2216 int cname_found = 0;
2217 char* start_date_str = NULL;
2218 char* end_date_str = NULL;
2219 time_t start_date;
2220 time_t end_date;
2221 char *tz;
2222 float time_left;
2223 int days_left;
2224 int time_remaining;
2225 char timestamp[50] = "";
2226 int status = STATE_UNKNOWN;
2227
2228 if (verbose >= 2)
2229 printf ("**** REQUEST CERTIFICATES ****\n");
2230
2231 for (i = 0; i < cert_ptr->to_certinfo->num_of_certs; i++) {
2232 for (slist = cert_ptr->to_certinfo->certinfo[i]; slist; slist = slist->next) {
2233 /* find first common name in subject,
2234 * TODO: check alternative subjects for
2235 * TODO: have a decent parser here and not a hack
2236 * multi-host certificate, check wildcards
2237 */
2238 if (strncasecmp (slist->data, "Subject:", 8) == 0) {
2239 int d = 3;
2240 char* p = strstr (slist->data, "CN=");
2241 if (p == NULL) {
2242 d = 5;
2243 p = strstr (slist->data, "CN = ");
2244 }
2245 if (p != NULL) {
2246 if (strncmp (host_name, p+d, strlen (host_name)) == 0) {
2247 cname_found = 1;
2248 }
2249 }
2250 } else if (strncasecmp (slist->data, "Start Date:", 11) == 0) {
2251 start_date_str = &slist->data[11];
2252 } else if (strncasecmp (slist->data, "Expire Date:", 12) == 0) {
2253 end_date_str = &slist->data[12];
2254 } else if (strncasecmp (slist->data, "Cert:", 5) == 0) {
2255 goto HAVE_FIRST_CERT;
2256 }
2257 if (verbose >= 2)
2258 printf ("%d ** %s\n", i, slist->data);
2259 }
2260 }
2261HAVE_FIRST_CERT:
2262
2263 if (verbose >= 2)
2264 printf ("**** REQUEST CERTIFICATES ****\n");
2265
2266 if (!cname_found) {
2267 printf("%s\n",_("CRITICAL - Cannot retrieve certificate subject."));
2268 return STATE_CRITICAL;
2269 }
2270
2271 start_date = parse_cert_date (start_date_str);
2272 if (start_date <= 0) {
2273 snprintf (msg, DEFAULT_BUFFER_SIZE, _("WARNING - Unparsable 'Start Date' in certificate: '%s'"),
2274 start_date_str);
2275 puts (msg);
2276 return STATE_WARNING;
2277 }
2278
2279 end_date = parse_cert_date (end_date_str);
2280 if (end_date <= 0) {
2281 snprintf (msg, DEFAULT_BUFFER_SIZE, _("WARNING - Unparsable 'Expire Date' in certificate: '%s'"),
2282 start_date_str);
2283 puts (msg);
2284 return STATE_WARNING;
2285 }
2286
2287 time_left = difftime (end_date, time(NULL));
2288 days_left = time_left / 86400;
2289 tz = getenv("TZ");
2290 setenv("TZ", "GMT", 1);
2291 tzset();
2292 strftime(timestamp, 50, "%c %z", localtime(&end_date));
2293 if (tz)
2294 setenv("TZ", tz, 1);
2295 else
2296 unsetenv("TZ");
2297 tzset();
2298
2299 if (days_left > 0 && days_left <= days_till_exp_warn) {
2300 printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", host_name, days_left, timestamp);
2301 if (days_left > days_till_exp_crit)
2302 status = STATE_WARNING;
2303 else
2304 status = STATE_CRITICAL;
2305 } else if (days_left == 0 && time_left > 0) {
2306 if (time_left >= 3600)
2307 time_remaining = (int) time_left / 3600;
2308 else
2309 time_remaining = (int) time_left / 60;
2310
2311 printf (_("%s - Certificate '%s' expires in %u %s (%s)\n"),
2312 (days_left>days_till_exp_crit) ? "WARNING" : "CRITICAL", host_name, time_remaining,
2313 time_left >= 3600 ? "hours" : "minutes", timestamp);
2314
2315 if ( days_left > days_till_exp_crit)
2316 status = STATE_WARNING;
2317 else
2318 status = STATE_CRITICAL;
2319 } else if (time_left < 0) {
2320 printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), host_name, timestamp);
2321 status=STATE_CRITICAL;
2322 } else if (days_left == 0) {
2323 printf (_("%s - Certificate '%s' just expired (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", host_name, timestamp);
2324 if (days_left > days_till_exp_crit)
2325 status = STATE_WARNING;
2326 else
2327 status = STATE_CRITICAL;
2328 } else {
2329 printf(_("OK - Certificate '%s' will expire on %s.\n"), host_name, timestamp);
2330 status = STATE_OK;
2331 }
2332 return status;
2333}
2334#endif /* USE_OPENSSL */
2335#endif /* LIBCURL_FEATURE_SSL */
diff --git a/plugins/picohttpparser/Makefile.am b/plugins/picohttpparser/Makefile.am
new file mode 100644
index 0000000..87e0531
--- /dev/null
+++ b/plugins/picohttpparser/Makefile.am
@@ -0,0 +1,3 @@
1noinst_LIBRARIES = libpicohttpparser.a
2
3libpicohttpparser_a_SOURCES = picohttpparser.c picohttpparser.h
diff --git a/plugins/picohttpparser/picohttpparser.c b/plugins/picohttpparser/picohttpparser.c
new file mode 100644
index 0000000..74ccc3e
--- /dev/null
+++ b/plugins/picohttpparser/picohttpparser.c
@@ -0,0 +1,645 @@
1/*
2 * Copyright (c) 2009-2014 Kazuho Oku, Tokuhiro Matsuno, Daisuke Murase,
3 * Shigeo Mitsunari
4 *
5 * The software is licensed under either the MIT License (below) or the Perl
6 * license.
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to
10 * deal in the Software without restriction, including without limitation the
11 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
12 * sell copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
23 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
24 * IN THE SOFTWARE.
25 */
26
27#include <assert.h>
28#include <stddef.h>
29#include <string.h>
30#ifdef __SSE4_2__
31#ifdef _MSC_VER
32#include <nmmintrin.h>
33#else
34#include <x86intrin.h>
35#endif
36#endif
37#include "picohttpparser.h"
38
39#if __GNUC__ >= 3
40#define likely(x) __builtin_expect(!!(x), 1)
41#define unlikely(x) __builtin_expect(!!(x), 0)
42#else
43#define likely(x) (x)
44#define unlikely(x) (x)
45#endif
46
47#ifdef _MSC_VER
48#define ALIGNED(n) _declspec(align(n))
49#else
50#define ALIGNED(n) __attribute__((aligned(n)))
51#endif
52
53#define IS_PRINTABLE_ASCII(c) ((unsigned char)(c)-040u < 0137u)
54
55#define CHECK_EOF() \
56 if (buf == buf_end) { \
57 *ret = -2; \
58 return NULL; \
59 }
60
61#define EXPECT_CHAR_NO_CHECK(ch) \
62 if (*buf++ != ch) { \
63 *ret = -1; \
64 return NULL; \
65 }
66
67#define EXPECT_CHAR(ch) \
68 CHECK_EOF(); \
69 EXPECT_CHAR_NO_CHECK(ch);
70
71#define ADVANCE_TOKEN(tok, toklen) \
72 do { \
73 const char *tok_start = buf; \
74 static const char ALIGNED(16) ranges2[16] = "\000\040\177\177"; \
75 int found2; \
76 buf = findchar_fast(buf, buf_end, ranges2, 4, &found2); \
77 if (!found2) { \
78 CHECK_EOF(); \
79 } \
80 while (1) { \
81 if (*buf == ' ') { \
82 break; \
83 } else if (unlikely(!IS_PRINTABLE_ASCII(*buf))) { \
84 if ((unsigned char)*buf < '\040' || *buf == '\177') { \
85 *ret = -1; \
86 return NULL; \
87 } \
88 } \
89 ++buf; \
90 CHECK_EOF(); \
91 } \
92 tok = tok_start; \
93 toklen = buf - tok_start; \
94 } while (0)
95
96static const char *token_char_map = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
97 "\0\1\0\1\1\1\1\1\0\0\1\1\0\1\1\0\1\1\1\1\1\1\1\1\1\1\0\0\0\0\0\0"
98 "\0\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\0\0\0\1\1"
99 "\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\0\1\0\1\0"
100 "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
101 "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
102 "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
103 "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
104
105static const char *findchar_fast(const char *buf, const char *buf_end, const char *ranges, size_t ranges_size, int *found)
106{
107 *found = 0;
108#if __SSE4_2__
109 if (likely(buf_end - buf >= 16)) {
110 __m128i ranges16 = _mm_loadu_si128((const __m128i *)ranges);
111
112 size_t left = (buf_end - buf) & ~15;
113 do {
114 __m128i b16 = _mm_loadu_si128((const __m128i *)buf);
115 int r = _mm_cmpestri(ranges16, ranges_size, b16, 16, _SIDD_LEAST_SIGNIFICANT | _SIDD_CMP_RANGES | _SIDD_UBYTE_OPS);
116 if (unlikely(r != 16)) {
117 buf += r;
118 *found = 1;
119 break;
120 }
121 buf += 16;
122 left -= 16;
123 } while (likely(left != 0));
124 }
125#else
126 /* suppress unused parameter warning */
127 (void)buf_end;
128 (void)ranges;
129 (void)ranges_size;
130#endif
131 return buf;
132}
133
134static const char *get_token_to_eol(const char *buf, const char *buf_end, const char **token, size_t *token_len, int *ret)
135{
136 const char *token_start = buf;
137
138#ifdef __SSE4_2__
139 static const char ALIGNED(16) ranges1[16] = "\0\010" /* allow HT */
140 "\012\037" /* allow SP and up to but not including DEL */
141 "\177\177"; /* allow chars w. MSB set */
142 int found;
143 buf = findchar_fast(buf, buf_end, ranges1, 6, &found);
144 if (found)
145 goto FOUND_CTL;
146#else
147 /* find non-printable char within the next 8 bytes, this is the hottest code; manually inlined */
148 while (likely(buf_end - buf >= 8)) {
149#define DOIT() \
150 do { \
151 if (unlikely(!IS_PRINTABLE_ASCII(*buf))) \
152 goto NonPrintable; \
153 ++buf; \
154 } while (0)
155 DOIT();
156 DOIT();
157 DOIT();
158 DOIT();
159 DOIT();
160 DOIT();
161 DOIT();
162 DOIT();
163#undef DOIT
164 continue;
165 NonPrintable:
166 if ((likely((unsigned char)*buf < '\040') && likely(*buf != '\011')) || unlikely(*buf == '\177')) {
167 goto FOUND_CTL;
168 }
169 ++buf;
170 }
171#endif
172 for (;; ++buf) {
173 CHECK_EOF();
174 if (unlikely(!IS_PRINTABLE_ASCII(*buf))) {
175 if ((likely((unsigned char)*buf < '\040') && likely(*buf != '\011')) || unlikely(*buf == '\177')) {
176 goto FOUND_CTL;
177 }
178 }
179 }
180FOUND_CTL:
181 if (likely(*buf == '\015')) {
182 ++buf;
183 EXPECT_CHAR('\012');
184 *token_len = buf - 2 - token_start;
185 } else if (*buf == '\012') {
186 *token_len = buf - token_start;
187 ++buf;
188 } else {
189 *ret = -1;
190 return NULL;
191 }
192 *token = token_start;
193
194 return buf;
195}
196
197static const char *is_complete(const char *buf, const char *buf_end, size_t last_len, int *ret)
198{
199 int ret_cnt = 0;
200 buf = last_len < 3 ? buf : buf + last_len - 3;
201
202 while (1) {
203 CHECK_EOF();
204 if (*buf == '\015') {
205 ++buf;
206 CHECK_EOF();
207 EXPECT_CHAR('\012');
208 ++ret_cnt;
209 } else if (*buf == '\012') {
210 ++buf;
211 ++ret_cnt;
212 } else {
213 ++buf;
214 ret_cnt = 0;
215 }
216 if (ret_cnt == 2) {
217 return buf;
218 }
219 }
220
221 *ret = -2;
222 return NULL;
223}
224
225#define PARSE_INT(valp_, mul_) \
226 if (*buf < '0' || '9' < *buf) { \
227 buf++; \
228 *ret = -1; \
229 return NULL; \
230 } \
231 *(valp_) = (mul_) * (*buf++ - '0');
232
233#define PARSE_INT_3(valp_) \
234 do { \
235 int res_ = 0; \
236 PARSE_INT(&res_, 100) \
237 *valp_ = res_; \
238 PARSE_INT(&res_, 10) \
239 *valp_ += res_; \
240 PARSE_INT(&res_, 1) \
241 *valp_ += res_; \
242 } while (0)
243
244/* returned pointer is always within [buf, buf_end), or null */
245static const char *parse_http_version(const char *buf, const char *buf_end, int *minor_version, int *ret)
246{
247 /* we want at least [HTTP/1.<two chars>] to try to parse */
248 if (buf_end - buf < 9) {
249 *ret = -2;
250 return NULL;
251 }
252 EXPECT_CHAR_NO_CHECK('H');
253 EXPECT_CHAR_NO_CHECK('T');
254 EXPECT_CHAR_NO_CHECK('T');
255 EXPECT_CHAR_NO_CHECK('P');
256 EXPECT_CHAR_NO_CHECK('/');
257 EXPECT_CHAR_NO_CHECK('1');
258 EXPECT_CHAR_NO_CHECK('.');
259 PARSE_INT(minor_version, 1);
260 return buf;
261}
262
263static const char *parse_headers(const char *buf, const char *buf_end, struct phr_header *headers, size_t *num_headers,
264 size_t max_headers, int *ret)
265{
266 for (;; ++*num_headers) {
267 CHECK_EOF();
268 if (*buf == '\015') {
269 ++buf;
270 EXPECT_CHAR('\012');
271 break;
272 } else if (*buf == '\012') {
273 ++buf;
274 break;
275 }
276 if (*num_headers == max_headers) {
277 *ret = -1;
278 return NULL;
279 }
280 if (!(*num_headers != 0 && (*buf == ' ' || *buf == '\t'))) {
281 /* parsing name, but do not discard SP before colon, see
282 * http://www.mozilla.org/security/announce/2006/mfsa2006-33.html */
283 headers[*num_headers].name = buf;
284 static const char ALIGNED(16) ranges1[] = "\x00 " /* control chars and up to SP */
285 "\"\"" /* 0x22 */
286 "()" /* 0x28,0x29 */
287 ",," /* 0x2c */
288 "//" /* 0x2f */
289 ":@" /* 0x3a-0x40 */
290 "[]" /* 0x5b-0x5d */
291 "{\377"; /* 0x7b-0xff */
292 int found;
293 buf = findchar_fast(buf, buf_end, ranges1, sizeof(ranges1) - 1, &found);
294 if (!found) {
295 CHECK_EOF();
296 }
297 while (1) {
298 if (*buf == ':') {
299 break;
300 } else if (!token_char_map[(unsigned char)*buf]) {
301 *ret = -1;
302 return NULL;
303 }
304 ++buf;
305 CHECK_EOF();
306 }
307 if ((headers[*num_headers].name_len = buf - headers[*num_headers].name) == 0) {
308 *ret = -1;
309 return NULL;
310 }
311 ++buf;
312 for (;; ++buf) {
313 CHECK_EOF();
314 if (!(*buf == ' ' || *buf == '\t')) {
315 break;
316 }
317 }
318 } else {
319 headers[*num_headers].name = NULL;
320 headers[*num_headers].name_len = 0;
321 }
322 const char *value;
323 size_t value_len;
324 if ((buf = get_token_to_eol(buf, buf_end, &value, &value_len, ret)) == NULL) {
325 return NULL;
326 }
327 /* remove trailing SPs and HTABs */
328 const char *value_end = value + value_len;
329 for (; value_end != value; --value_end) {
330 const char c = *(value_end - 1);
331 if (!(c == ' ' || c == '\t')) {
332 break;
333 }
334 }
335 headers[*num_headers].value = value;
336 headers[*num_headers].value_len = value_end - value;
337 }
338 return buf;
339}
340
341static const char *parse_request(const char *buf, const char *buf_end, const char **method, size_t *method_len, const char **path,
342 size_t *path_len, int *minor_version, struct phr_header *headers, size_t *num_headers,
343 size_t max_headers, int *ret)
344{
345 /* skip first empty line (some clients add CRLF after POST content) */
346 CHECK_EOF();
347 if (*buf == '\015') {
348 ++buf;
349 EXPECT_CHAR('\012');
350 } else if (*buf == '\012') {
351 ++buf;
352 }
353
354 /* parse request line */
355 ADVANCE_TOKEN(*method, *method_len);
356 do {
357 ++buf;
358 } while (*buf == ' ');
359 ADVANCE_TOKEN(*path, *path_len);
360 do {
361 ++buf;
362 } while (*buf == ' ');
363 if (*method_len == 0 || *path_len == 0) {
364 *ret = -1;
365 return NULL;
366 }
367 if ((buf = parse_http_version(buf, buf_end, minor_version, ret)) == NULL) {
368 return NULL;
369 }
370 if (*buf == '\015') {
371 ++buf;
372 EXPECT_CHAR('\012');
373 } else if (*buf == '\012') {
374 ++buf;
375 } else {
376 *ret = -1;
377 return NULL;
378 }
379
380 return parse_headers(buf, buf_end, headers, num_headers, max_headers, ret);
381}
382
383int phr_parse_request(const char *buf_start, size_t len, const char **method, size_t *method_len, const char **path,
384 size_t *path_len, int *minor_version, struct phr_header *headers, size_t *num_headers, size_t last_len)
385{
386 const char *buf = buf_start, *buf_end = buf_start + len;
387 size_t max_headers = *num_headers;
388 int r;
389
390 *method = NULL;
391 *method_len = 0;
392 *path = NULL;
393 *path_len = 0;
394 *minor_version = -1;
395 *num_headers = 0;
396
397 /* if last_len != 0, check if the request is complete (a fast countermeasure
398 againt slowloris */
399 if (last_len != 0 && is_complete(buf, buf_end, last_len, &r) == NULL) {
400 return r;
401 }
402
403 if ((buf = parse_request(buf, buf_end, method, method_len, path, path_len, minor_version, headers, num_headers, max_headers,
404 &r)) == NULL) {
405 return r;
406 }
407
408 return (int)(buf - buf_start);
409}
410
411static const char *parse_response(const char *buf, const char *buf_end, int *minor_version, int *status, const char **msg,
412 size_t *msg_len, struct phr_header *headers, size_t *num_headers, size_t max_headers, int *ret)
413{
414 /* parse "HTTP/1.x" */
415 if ((buf = parse_http_version(buf, buf_end, minor_version, ret)) == NULL) {
416 return NULL;
417 }
418 /* skip space */
419 if (*buf != ' ') {
420 *ret = -1;
421 return NULL;
422 }
423 do {
424 ++buf;
425 } while (*buf == ' ');
426 /* parse status code, we want at least [:digit:][:digit:][:digit:]<other char> to try to parse */
427 if (buf_end - buf < 4) {
428 *ret = -2;
429 return NULL;
430 }
431 PARSE_INT_3(status);
432
433 /* get message includig preceding space */
434 if ((buf = get_token_to_eol(buf, buf_end, msg, msg_len, ret)) == NULL) {
435 return NULL;
436 }
437 if (*msg_len == 0) {
438 /* ok */
439 } else if (**msg == ' ') {
440 /* remove preceding space */
441 do {
442 ++*msg;
443 --*msg_len;
444 } while (**msg == ' ');
445 } else {
446 /* garbage found after status code */
447 *ret = -1;
448 return NULL;
449 }
450
451 return parse_headers(buf, buf_end, headers, num_headers, max_headers, ret);
452}
453
454int phr_parse_response(const char *buf_start, size_t len, int *minor_version, int *status, const char **msg, size_t *msg_len,
455 struct phr_header *headers, size_t *num_headers, size_t last_len)
456{
457 const char *buf = buf_start, *buf_end = buf + len;
458 size_t max_headers = *num_headers;
459 int r;
460
461 *minor_version = -1;
462 *status = 0;
463 *msg = NULL;
464 *msg_len = 0;
465 *num_headers = 0;
466
467 /* if last_len != 0, check if the response is complete (a fast countermeasure
468 against slowloris */
469 if (last_len != 0 && is_complete(buf, buf_end, last_len, &r) == NULL) {
470 return r;
471 }
472
473 if ((buf = parse_response(buf, buf_end, minor_version, status, msg, msg_len, headers, num_headers, max_headers, &r)) == NULL) {
474 return r;
475 }
476
477 return (int)(buf - buf_start);
478}
479
480int phr_parse_headers(const char *buf_start, size_t len, struct phr_header *headers, size_t *num_headers, size_t last_len)
481{
482 const char *buf = buf_start, *buf_end = buf + len;
483 size_t max_headers = *num_headers;
484 int r;
485
486 *num_headers = 0;
487
488 /* if last_len != 0, check if the response is complete (a fast countermeasure
489 against slowloris */
490 if (last_len != 0 && is_complete(buf, buf_end, last_len, &r) == NULL) {
491 return r;
492 }
493
494 if ((buf = parse_headers(buf, buf_end, headers, num_headers, max_headers, &r)) == NULL) {
495 return r;
496 }
497
498 return (int)(buf - buf_start);
499}
500
501enum {
502 CHUNKED_IN_CHUNK_SIZE,
503 CHUNKED_IN_CHUNK_EXT,
504 CHUNKED_IN_CHUNK_DATA,
505 CHUNKED_IN_CHUNK_CRLF,
506 CHUNKED_IN_TRAILERS_LINE_HEAD,
507 CHUNKED_IN_TRAILERS_LINE_MIDDLE
508};
509
510static int decode_hex(int ch)
511{
512 if ('0' <= ch && ch <= '9') {
513 return ch - '0';
514 } else if ('A' <= ch && ch <= 'F') {
515 return ch - 'A' + 0xa;
516 } else if ('a' <= ch && ch <= 'f') {
517 return ch - 'a' + 0xa;
518 } else {
519 return -1;
520 }
521}
522
523ssize_t phr_decode_chunked(struct phr_chunked_decoder *decoder, char *buf, size_t *_bufsz)
524{
525 size_t dst = 0, src = 0, bufsz = *_bufsz;
526 ssize_t ret = -2; /* incomplete */
527
528 while (1) {
529 switch (decoder->_state) {
530 case CHUNKED_IN_CHUNK_SIZE:
531 for (;; ++src) {
532 int v;
533 if (src == bufsz)
534 goto Exit;
535 if ((v = decode_hex(buf[src])) == -1) {
536 if (decoder->_hex_count == 0) {
537 ret = -1;
538 goto Exit;
539 }
540 break;
541 }
542 if (decoder->_hex_count == sizeof(size_t) * 2) {
543 ret = -1;
544 goto Exit;
545 }
546 decoder->bytes_left_in_chunk = decoder->bytes_left_in_chunk * 16 + v;
547 ++decoder->_hex_count;
548 }
549 decoder->_hex_count = 0;
550 decoder->_state = CHUNKED_IN_CHUNK_EXT;
551 /* fallthru */
552 case CHUNKED_IN_CHUNK_EXT:
553 /* RFC 7230 A.2 "Line folding in chunk extensions is disallowed" */
554 for (;; ++src) {
555 if (src == bufsz)
556 goto Exit;
557 if (buf[src] == '\012')
558 break;
559 }
560 ++src;
561 if (decoder->bytes_left_in_chunk == 0) {
562 if (decoder->consume_trailer) {
563 decoder->_state = CHUNKED_IN_TRAILERS_LINE_HEAD;
564 break;
565 } else {
566 goto Complete;
567 }
568 }
569 decoder->_state = CHUNKED_IN_CHUNK_DATA;
570 /* fallthru */
571 case CHUNKED_IN_CHUNK_DATA: {
572 size_t avail = bufsz - src;
573 if (avail < decoder->bytes_left_in_chunk) {
574 if (dst != src)
575 memmove(buf + dst, buf + src, avail);
576 src += avail;
577 dst += avail;
578 decoder->bytes_left_in_chunk -= avail;
579 goto Exit;
580 }
581 if (dst != src)
582 memmove(buf + dst, buf + src, decoder->bytes_left_in_chunk);
583 src += decoder->bytes_left_in_chunk;
584 dst += decoder->bytes_left_in_chunk;
585 decoder->bytes_left_in_chunk = 0;
586 decoder->_state = CHUNKED_IN_CHUNK_CRLF;
587 }
588 /* fallthru */
589 case CHUNKED_IN_CHUNK_CRLF:
590 for (;; ++src) {
591 if (src == bufsz)
592 goto Exit;
593 if (buf[src] != '\015')
594 break;
595 }
596 if (buf[src] != '\012') {
597 ret = -1;
598 goto Exit;
599 }
600 ++src;
601 decoder->_state = CHUNKED_IN_CHUNK_SIZE;
602 break;
603 case CHUNKED_IN_TRAILERS_LINE_HEAD:
604 for (;; ++src) {
605 if (src == bufsz)
606 goto Exit;
607 if (buf[src] != '\015')
608 break;
609 }
610 if (buf[src++] == '\012')
611 goto Complete;
612 decoder->_state = CHUNKED_IN_TRAILERS_LINE_MIDDLE;
613 /* fallthru */
614 case CHUNKED_IN_TRAILERS_LINE_MIDDLE:
615 for (;; ++src) {
616 if (src == bufsz)
617 goto Exit;
618 if (buf[src] == '\012')
619 break;
620 }
621 ++src;
622 decoder->_state = CHUNKED_IN_TRAILERS_LINE_HEAD;
623 break;
624 default:
625 assert(!"decoder is corrupt");
626 }
627 }
628
629Complete:
630 ret = bufsz - src;
631Exit:
632 if (dst != src)
633 memmove(buf + dst, buf + src, bufsz - src);
634 *_bufsz = dst;
635 return ret;
636}
637
638int phr_decode_chunked_is_in_data(struct phr_chunked_decoder *decoder)
639{
640 return decoder->_state == CHUNKED_IN_CHUNK_DATA;
641}
642
643#undef CHECK_EOF
644#undef EXPECT_CHAR
645#undef ADVANCE_TOKEN
diff --git a/plugins/picohttpparser/picohttpparser.h b/plugins/picohttpparser/picohttpparser.h
new file mode 100644
index 0000000..0849f84
--- /dev/null
+++ b/plugins/picohttpparser/picohttpparser.h
@@ -0,0 +1,87 @@
1/*
2 * Copyright (c) 2009-2014 Kazuho Oku, Tokuhiro Matsuno, Daisuke Murase,
3 * Shigeo Mitsunari
4 *
5 * The software is licensed under either the MIT License (below) or the Perl
6 * license.
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to
10 * deal in the Software without restriction, including without limitation the
11 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
12 * sell copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
23 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
24 * IN THE SOFTWARE.
25 */
26
27#ifndef picohttpparser_h
28#define picohttpparser_h
29
30#include <sys/types.h>
31
32#ifdef _MSC_VER
33#define ssize_t intptr_t
34#endif
35
36#ifdef __cplusplus
37extern "C" {
38#endif
39
40/* contains name and value of a header (name == NULL if is a continuing line
41 * of a multiline header */
42struct phr_header {
43 const char *name;
44 size_t name_len;
45 const char *value;
46 size_t value_len;
47};
48
49/* returns number of bytes consumed if successful, -2 if request is partial,
50 * -1 if failed */
51int phr_parse_request(const char *buf, size_t len, const char **method, size_t *method_len, const char **path, size_t *path_len,
52 int *minor_version, struct phr_header *headers, size_t *num_headers, size_t last_len);
53
54/* ditto */
55int phr_parse_response(const char *_buf, size_t len, int *minor_version, int *status, const char **msg, size_t *msg_len,
56 struct phr_header *headers, size_t *num_headers, size_t last_len);
57
58/* ditto */
59int phr_parse_headers(const char *buf, size_t len, struct phr_header *headers, size_t *num_headers, size_t last_len);
60
61/* should be zero-filled before start */
62struct phr_chunked_decoder {
63 size_t bytes_left_in_chunk; /* number of bytes left in current chunk */
64 char consume_trailer; /* if trailing headers should be consumed */
65 char _hex_count;
66 char _state;
67};
68
69/* the function rewrites the buffer given as (buf, bufsz) removing the chunked-
70 * encoding headers. When the function returns without an error, bufsz is
71 * updated to the length of the decoded data available. Applications should
72 * repeatedly call the function while it returns -2 (incomplete) every time
73 * supplying newly arrived data. If the end of the chunked-encoded data is
74 * found, the function returns a non-negative number indicating the number of
75 * octets left undecoded at the tail of the supplied buffer. Returns -1 on
76 * error.
77 */
78ssize_t phr_decode_chunked(struct phr_chunked_decoder *decoder, char *buf, size_t *bufsz);
79
80/* returns if the chunked decoder is in middle of chunked data */
81int phr_decode_chunked_is_in_data(struct phr_chunked_decoder *decoder);
82
83#ifdef __cplusplus
84}
85#endif
86
87#endif
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index e38947e..14f6579 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -1,29 +1,29 @@
1/***************************************************************************** 1/*****************************************************************************
2* 2*
3* Monitoring Plugins SSL utilities 3* Monitoring Plugins SSL utilities
4* 4*
5* License: GPL 5* License: GPL
6* Copyright (c) 2005-2010 Monitoring Plugins Development Team 6* Copyright (c) 2005-2010 Monitoring Plugins Development Team
7* 7*
8* Description: 8* Description:
9* 9*
10* This file contains common functions for plugins that require SSL. 10* This file contains common functions for plugins that require SSL.
11* 11*
12* 12*
13* This program is free software: you can redistribute it and/or modify 13* This program is free software: you can redistribute it and/or modify
14* it under the terms of the GNU General Public License as published by 14* it under the terms of the GNU General Public License as published by
15* the Free Software Foundation, either version 3 of the License, or 15* the Free Software Foundation, either version 3 of the License, or
16* (at your option) any later version. 16* (at your option) any later version.
17* 17*
18* This program is distributed in the hope that it will be useful, 18* This program is distributed in the hope that it will be useful,
19* but WITHOUT ANY WARRANTY; without even the implied warranty of 19* but WITHOUT ANY WARRANTY; without even the implied warranty of
20* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 20* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21* GNU General Public License for more details. 21* GNU General Public License for more details.
22* 22*
23* You should have received a copy of the GNU General Public License 23* You should have received a copy of the GNU General Public License
24* along with this program. If not, see <http://www.gnu.org/licenses/>. 24* along with this program. If not, see <http://www.gnu.org/licenses/>.
25* 25*
26* 26*
27*****************************************************************************/ 27*****************************************************************************/
28 28
29#define MAX_CN_LENGTH 256 29#define MAX_CN_LENGTH 256
@@ -193,12 +193,22 @@ int np_net_ssl_read(void *buf, int num) {
193 193
194int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){ 194int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
195# ifdef USE_OPENSSL 195# ifdef USE_OPENSSL
196 X509 *certificate=NULL; 196 X509 *certificate = NULL;
197 certificate=SSL_get_peer_certificate(s);
198 return(np_net_ssl_check_certificate(certificate, days_till_exp_warn, days_till_exp_crit));
199# else /* ifndef USE_OPENSSL */
200 printf("%s\n", _("WARNING - Plugin does not support checking certificates."));
201 return STATE_WARNING;
202# endif /* USE_OPENSSL */
203}
204
205int np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, int days_till_exp_crit){
206# ifdef USE_OPENSSL
197 X509_NAME *subj=NULL; 207 X509_NAME *subj=NULL;
198 char timestamp[50] = ""; 208 char timestamp[50] = "";
199 char cn[MAX_CN_LENGTH]= ""; 209 char cn[MAX_CN_LENGTH]= "";
200 char *tz; 210 char *tz;
201 211
202 int cnlen =-1; 212 int cnlen =-1;
203 int status=STATE_UNKNOWN; 213 int status=STATE_UNKNOWN;
204 214
@@ -210,7 +220,6 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
210 int time_remaining; 220 int time_remaining;
211 time_t tm_t; 221 time_t tm_t;
212 222
213 certificate=SSL_get_peer_certificate(s);
214 if (!certificate) { 223 if (!certificate) {
215 printf("%s\n",_("CRITICAL - Cannot retrieve server certificate.")); 224 printf("%s\n",_("CRITICAL - Cannot retrieve server certificate."));
216 return STATE_CRITICAL; 225 return STATE_CRITICAL;
diff --git a/plugins/t/check_curl.t b/plugins/t/check_curl.t
new file mode 100644
index 0000000..4bff538
--- /dev/null
+++ b/plugins/t/check_curl.t
@@ -0,0 +1,199 @@
1#! /usr/bin/perl -w -I ..
2#
3# HyperText Transfer Protocol (HTTP) Test via check_http
4#
5#
6
7use strict;
8use Test::More;
9use POSIX qw/mktime strftime/;
10use NPTest;
11
12plan tests => 57;
13
14my $successOutput = '/OK.*HTTP.*second/';
15
16my $res;
17my $plugin = 'check_http';
18$plugin = 'check_curl' if $0 =~ m/check_curl/mx;
19
20my $host_tcp_http = getTestParameter("NP_HOST_TCP_HTTP", "A host providing the HTTP Service (a web server)", "localhost");
21my $host_tls_http = getTestParameter("NP_HOST_TLS_HTTP", "A host providing the HTTPS Service (a tls web server)", "localhost");
22my $host_tls_cert = getTestParameter("NP_HOST_TLS_CERT", "the common name of the certificate.", "localhost");
23my $host_nonresponsive = getTestParameter("NP_HOST_NONRESPONSIVE", "The hostname of system not responsive to network requests", "10.0.0.1");
24my $hostname_invalid = getTestParameter("NP_HOSTNAME_INVALID", "An invalid (not known to DNS) hostname", "nosuchhost");
25my $internet_access = getTestParameter("NP_INTERNET_ACCESS", "Is this system directly connected to the internet?", "yes");
26my $host_tcp_http2 = getTestParameter("NP_HOST_TCP_HTTP2", "A host providing an index page containing the string 'monitoring'", "test.monitoring-plugins.org");
27my $host_tcp_proxy = getTestParameter("NP_HOST_TCP_PROXY", "A host providing a HTTP proxy with CONNECT support", "localhost");
28my $port_tcp_proxy = getTestParameter("NP_PORT_TCP_PROXY", "Port of the proxy with HTTP and CONNECT support", "3128");
29
30my $faketime = -x '/usr/bin/faketime' ? 1 : 0;
31
32
33$res = NPTest->testCmd(
34 "./$plugin $host_tcp_http -wt 300 -ct 600"
35 );
36cmp_ok( $res->return_code, '==', 0, "Webserver $host_tcp_http responded" );
37like( $res->output, $successOutput, "Output OK" );
38
39$res = NPTest->testCmd(
40 "./$plugin $host_tcp_http -wt 300 -ct 600 -v -v -v -k 'bob:there' -k 'carl:frown'"
41 );
42like( $res->output, '/bob:there\r\ncarl:frown\r\n/', "Got headers with multiple -k options" );
43
44$res = NPTest->testCmd(
45 "./$plugin $host_nonresponsive -wt 1 -ct 2 -t 3"
46 );
47cmp_ok( $res->return_code, '==', 2, "Webserver $host_nonresponsive not responding" );
48# was CRITICAL only, but both check_curl and check_http print HTTP CRITICAL (puzzle?!)
49cmp_ok( $res->output, 'eq', "HTTP CRITICAL - Invalid HTTP response received from host on port 80: cURL returned 28 - Timeout was reached", "Output OK");
50
51$res = NPTest->testCmd(
52 "./$plugin $hostname_invalid -wt 1 -ct 2"
53 );
54cmp_ok( $res->return_code, '==', 2, "Webserver $hostname_invalid not valid" );
55# The first part of the message comes from the OS catalogue, so cannot check this.
56# On Debian, it is Name or service not known, on Darwin, it is No address associated with nodename
57# Is also possible to get a socket timeout if DNS is not responding fast enough
58# cURL gives us consistent strings from it's own 'lib/strerror.c'
59like( $res->output, "/cURL returned 6 - Couldn't resolve host name/", "Output OK");
60
61# host header checks
62$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http");
63like( $res->output, '/^Host: '.$host_tcp_http.'\s*$/ms', "Host Header OK" );
64like( $res->output, '/CURLOPT_URL: http:\/\/'.$host_tcp_http.':80\//ms', "Url OK" );
65
66$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http -p 80");
67like( $res->output, '/^Host: '.$host_tcp_http.'\s*$/ms', "Host Header OK" );
68like( $res->output, '/CURLOPT_URL: http:\/\/'.$host_tcp_http.':80\//ms', "Url OK" );
69
70$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http:8080 -p 80");
71like( $res->output, '/^Host: '.$host_tcp_http.':8080\s*$/ms', "Host Header OK" );
72like( $res->output, '/CURLOPT_URL: http:\/\/'.$host_tcp_http.':80\//ms', "Url OK" );
73
74$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http:8080 -p 80");
75like( $res->output, '/^Host: '.$host_tcp_http.':8080\s*$/ms', "Host Header OK" );
76like( $res->output, '/CURLOPT_URL: http:\/\/'.$host_tcp_http.':80\//ms', "Url OK" );
77
78$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http:8080 -p 80 -k 'Host: testhost:8001'");
79like( $res->output, '/^Host: testhost:8001\s*$/ms', "Host Header OK" );
80like( $res->output, '/CURLOPT_URL: http:\/\/'.$host_tcp_http.':80\//ms', "Url OK" );
81
82$res = NPTest->testCmd("./$plugin -v -I $host_tcp_http -p 80 -k 'Host: testhost:8001'");
83like( $res->output, '/^Host: testhost:8001\s*$/ms', "Host Header OK" );
84like( $res->output, '/CURLOPT_URL: http:\/\/'.$host_tcp_http.':80\//ms', "Url OK" );
85
86SKIP: {
87 skip "No internet access", 3 if $internet_access eq "no";
88
89 $res = NPTest->testCmd("./$plugin -v -H $host_tls_http -S");
90 like( $res->output, '/^Host: '.$host_tls_http.'\s*$/ms', "Host Header OK" );
91
92 $res = NPTest->testCmd("./$plugin -v -H $host_tls_http:8080 -S -p 443");
93 like( $res->output, '/^Host: '.$host_tls_http.':8080\s*$/ms', "Host Header OK" );
94
95 $res = NPTest->testCmd("./$plugin -v -H $host_tls_http:443 -S -p 443");
96 like( $res->output, '/^Host: '.$host_tls_http.'\s*$/ms', "Host Header OK" );
97};
98
99SKIP: {
100 skip "No host serving monitoring in index file", 7 unless $host_tcp_http2;
101
102 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'monitoring'" );
103 cmp_ok( $res->return_code, "==", 0, "Got a reference to 'monitoring'");
104
105 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'mONiTORing'" );
106 cmp_ok( $res->return_code, "==", 2, "Not got 'mONiTORing'");
107 like ( $res->output, "/pattern not found/", "Error message says 'pattern not found'");
108
109 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -R 'mONiTORing'" );
110 cmp_ok( $res->return_code, "==", 0, "But case insensitive doesn't mind 'mONiTORing'");
111
112 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'monitoring' --invert-regex" );
113 cmp_ok( $res->return_code, "==", 2, "Invert results work when found");
114 like ( $res->output, "/pattern found/", "Error message says 'pattern found'");
115
116 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'mONiTORing' --invert-regex" );
117 cmp_ok( $res->return_code, "==", 0, "And also when not found");
118}
119SKIP: {
120 skip "No internet access", 16 if $internet_access eq "no";
121
122 $res = NPTest->testCmd(
123 "./$plugin --ssl $host_tls_http"
124 );
125 cmp_ok( $res->return_code, '==', 0, "Can read https for $host_tls_http" );
126
127 $res = NPTest->testCmd( "./$plugin -C 1 --ssl $host_tls_http" );
128 cmp_ok( $res->return_code, '==', 0, "Checking certificate for $host_tls_http");
129 like ( $res->output, "/Certificate '$host_tls_cert' will expire on/", "Output OK" );
130 my $saved_cert_output = $res->output;
131
132 $res = NPTest->testCmd( "./$plugin -C 8000,1 --ssl $host_tls_http" );
133 cmp_ok( $res->return_code, '==', 1, "Checking certificate for $host_tls_http");
134 like ( $res->output, qr/WARNING - Certificate '$host_tls_cert' expires in \d+ day/, "Output Warning" );
135
136 $res = NPTest->testCmd( "./$plugin $host_tls_http -C 1" );
137 is( $res->return_code, 0, "Old syntax for cert checking okay" );
138 is( $res->output, $saved_cert_output, "Same output as new syntax" );
139
140 $res = NPTest->testCmd( "./$plugin -H $host_tls_http -C 1" );
141 is( $res->return_code, 0, "Updated syntax for cert checking okay" );
142 is( $res->output, $saved_cert_output, "Same output as new syntax" );
143
144 $res = NPTest->testCmd( "./$plugin -C 1 $host_tls_http" );
145 cmp_ok( $res->output, 'eq', $saved_cert_output, "--ssl option automatically added");
146
147 $res = NPTest->testCmd( "./$plugin $host_tls_http -C 1" );
148 cmp_ok( $res->output, 'eq', $saved_cert_output, "Old syntax for cert checking still works");
149
150 # run some certificate checks with faketime
151 SKIP: {
152 skip "No faketime binary found", 12 if !$faketime;
153 $res = NPTest->testCmd("LC_TIME=C TZ=UTC ./$plugin -C 1 $host_tls_http");
154 like($res->output, qr/OK - Certificate '$host_tls_cert' will expire on/, "Catch cert output");
155 is( $res->return_code, 0, "Catch cert output exit code" );
156 my($mon,$day,$hour,$min,$sec,$year) = ($res->output =~ /(\w+)\s+(\d+)\s+(\d+):(\d+):(\d+)\s+(\d+)/);
157 if(!defined $year) {
158 die("parsing date failed from: ".$res->output);
159 }
160 my $months = {'Jan' => 0, 'Feb' => 1, 'Mar' => 2, 'Apr' => 3, 'May' => 4, 'Jun' => 5, 'Jul' => 6, 'Aug' => 7, 'Sep' => 8, 'Oct' => 9, 'Nov' => 10, 'Dec' => 11};
161 my $ts = mktime($sec, $min, $hour, $day, $months->{$mon}, $year-1900);
162 my $time = strftime("%Y-%m-%d %H:%M:%S", localtime($ts));
163 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts))."' ./$plugin -C 1 $host_tls_http");
164 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' just expired/, "Output on expire date");
165 is( $res->return_code, 2, "Output on expire date" );
166
167 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-1))."' ./$plugin -C 1 $host_tls_http");
168 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 0 minutes/, "cert expires in 1 second output");
169 is( $res->return_code, 2, "cert expires in 1 second exit code" );
170
171 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-120))."' ./$plugin -C 1 $host_tls_http");
172 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 2 minutes/, "cert expires in 2 minutes output");
173 is( $res->return_code, 2, "cert expires in 2 minutes exit code" );
174
175 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-7200))."' ./$plugin -C 1 $host_tls_http");
176 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 2 hours/, "cert expires in 2 hours output");
177 is( $res->return_code, 2, "cert expires in 2 hours exit code" );
178
179 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts+1))."' ./$plugin -C 1 $host_tls_http");
180 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expired on/, "Certificate expired output");
181 is( $res->return_code, 2, "Certificate expired exit code" );
182 };
183
184 $res = NPTest->testCmd( "./$plugin --ssl $host_tls_http -E" );
185 like ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' );
186 like ( $res->output, '/time_ssl=[\d\.]+/', 'Extended Performance Data SSL Output OK' );
187
188 $res = NPTest->testCmd(
189 "./$plugin --ssl -H www.e-paycobalt.com"
190 );
191 cmp_ok( $res->return_code, "==", 0, "Can read https for www.e-paycobalt.com (uses AES certificate)" );
192
193
194 $res = NPTest->testCmd( "./$plugin -H www.mozilla.com -u /firefox -f follow" );
195 is( $res->return_code, 0, "Redirection based on location is okay");
196
197 $res = NPTest->testCmd( "./$plugin -H www.mozilla.com --extended-perfdata" );
198 like ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' );
199}
diff --git a/plugins/t/check_http.t b/plugins/t/check_http.t
index b3760eb..e92681e 100644
--- a/plugins/t/check_http.t
+++ b/plugins/t/check_http.t
@@ -14,6 +14,8 @@ plan tests => 50;
14my $successOutput = '/OK.*HTTP.*second/'; 14my $successOutput = '/OK.*HTTP.*second/';
15 15
16my $res; 16my $res;
17my $plugin = 'check_http';
18$plugin = 'check_curl' if $0 =~ m/check_curl/mx;
17 19
18my $host_tcp_http = getTestParameter("NP_HOST_TCP_HTTP", "A host providing the HTTP Service (a web server)", "localhost"); 20my $host_tcp_http = getTestParameter("NP_HOST_TCP_HTTP", "A host providing the HTTP Service (a web server)", "localhost");
19my $host_tls_http = getTestParameter("NP_HOST_TLS_HTTP", "A host providing the HTTPS Service (a tls web server)", "localhost"); 21my $host_tls_http = getTestParameter("NP_HOST_TLS_HTTP", "A host providing the HTTPS Service (a tls web server)", "localhost");
@@ -29,24 +31,24 @@ my $faketime = -x '/usr/bin/faketime' ? 1 : 0;
29 31
30 32
31$res = NPTest->testCmd( 33$res = NPTest->testCmd(
32 "./check_http $host_tcp_http -wt 300 -ct 600" 34 "./$plugin $host_tcp_http -wt 300 -ct 600"
33 ); 35 );
34cmp_ok( $res->return_code, '==', 0, "Webserver $host_tcp_http responded" ); 36cmp_ok( $res->return_code, '==', 0, "Webserver $host_tcp_http responded" );
35like( $res->output, $successOutput, "Output OK" ); 37like( $res->output, $successOutput, "Output OK" );
36 38
37$res = NPTest->testCmd( 39$res = NPTest->testCmd(
38 "./check_http $host_tcp_http -wt 300 -ct 600 -v -v -v -k 'bob:there' -k 'carl:frown'" 40 "./$plugin $host_tcp_http -wt 300 -ct 600 -v -v -v -k 'bob:there' -k 'carl:frown'"
39 ); 41 );
40like( $res->output, '/bob:there\r\ncarl:frown\r\n/', "Got headers with multiple -k options" ); 42like( $res->output, '/bob:there\r\ncarl:frown\r\n/', "Got headers with multiple -k options" );
41 43
42$res = NPTest->testCmd( 44$res = NPTest->testCmd(
43 "./check_http $host_nonresponsive -wt 1 -ct 2 -t 3" 45 "./$plugin $host_nonresponsive -wt 1 -ct 2 -t 3"
44 ); 46 );
45cmp_ok( $res->return_code, '==', 2, "Webserver $host_nonresponsive not responding" ); 47cmp_ok( $res->return_code, '==', 2, "Webserver $host_nonresponsive not responding" );
46cmp_ok( $res->output, 'eq', "CRITICAL - Socket timeout after 3 seconds", "Output OK"); 48cmp_ok( $res->output, 'eq', "CRITICAL - Socket timeout after 3 seconds", "Output OK");
47 49
48$res = NPTest->testCmd( 50$res = NPTest->testCmd(
49 "./check_http $hostname_invalid -wt 1 -ct 2" 51 "./$plugin $hostname_invalid -wt 1 -ct 2"
50 ); 52 );
51cmp_ok( $res->return_code, '==', 2, "Webserver $hostname_invalid not valid" ); 53cmp_ok( $res->return_code, '==', 2, "Webserver $hostname_invalid not valid" );
52# The first part of the message comes from the OS catalogue, so cannot check this. 54# The first part of the message comes from the OS catalogue, so cannot check this.
@@ -55,86 +57,86 @@ cmp_ok( $res->return_code, '==', 2, "Webserver $hostname_invalid not valid" );
55like( $res->output, "/Unable to open TCP socket|Socket timeout after/", "Output OK"); 57like( $res->output, "/Unable to open TCP socket|Socket timeout after/", "Output OK");
56 58
57# host header checks 59# host header checks
58$res = NPTest->testCmd("./check_http -v -H $host_tcp_http"); 60$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http");
59like( $res->output, '/^Host: '.$host_tcp_http.'\s*$/ms', "Host Header OK" ); 61like( $res->output, '/^Host: '.$host_tcp_http.'\s*$/ms', "Host Header OK" );
60 62
61$res = NPTest->testCmd("./check_http -v -H $host_tcp_http -p 80"); 63$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http -p 80");
62like( $res->output, '/^Host: '.$host_tcp_http.'\s*$/ms', "Host Header OK" ); 64like( $res->output, '/^Host: '.$host_tcp_http.'\s*$/ms', "Host Header OK" );
63 65
64$res = NPTest->testCmd("./check_http -v -H $host_tcp_http:8080 -p 80"); 66$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http:8080 -p 80");
65like( $res->output, '/^Host: '.$host_tcp_http.':8080\s*$/ms', "Host Header OK" ); 67like( $res->output, '/^Host: '.$host_tcp_http.':8080\s*$/ms', "Host Header OK" );
66 68
67$res = NPTest->testCmd("./check_http -v -H $host_tcp_http:8080 -p 80"); 69$res = NPTest->testCmd("./$plugin -v -H $host_tcp_http:8080 -p 80");
68like( $res->output, '/^Host: '.$host_tcp_http.':8080\s*$/ms', "Host Header OK" ); 70like( $res->output, '/^Host: '.$host_tcp_http.':8080\s*$/ms', "Host Header OK" );
69 71
70SKIP: { 72SKIP: {
71 skip "No internet access", 3 if $internet_access eq "no"; 73 skip "No internet access", 3 if $internet_access eq "no";
72 74
73 $res = NPTest->testCmd("./check_http -v -H $host_tls_http -S"); 75 $res = NPTest->testCmd("./$plugin -v -H $host_tls_http -S");
74 like( $res->output, '/^Host: '.$host_tls_http.'\s*$/ms', "Host Header OK" ); 76 like( $res->output, '/^Host: '.$host_tls_http.'\s*$/ms', "Host Header OK" );
75 77
76 $res = NPTest->testCmd("./check_http -v -H $host_tls_http:8080 -S -p 443"); 78 $res = NPTest->testCmd("./$plugin -v -H $host_tls_http:8080 -S -p 443");
77 like( $res->output, '/^Host: '.$host_tls_http.':8080\s*$/ms', "Host Header OK" ); 79 like( $res->output, '/^Host: '.$host_tls_http.':8080\s*$/ms', "Host Header OK" );
78 80
79 $res = NPTest->testCmd("./check_http -v -H $host_tls_http:443 -S -p 443"); 81 $res = NPTest->testCmd("./$plugin -v -H $host_tls_http:443 -S -p 443");
80 like( $res->output, '/^Host: '.$host_tls_http.'\s*$/ms', "Host Header OK" ); 82 like( $res->output, '/^Host: '.$host_tls_http.'\s*$/ms', "Host Header OK" );
81}; 83};
82 84
83SKIP: { 85SKIP: {
84 skip "No host serving monitoring in index file", 7 unless $host_tcp_http2; 86 skip "No host serving monitoring in index file", 7 unless $host_tcp_http2;
85 87
86 $res = NPTest->testCmd( "./check_http -H $host_tcp_http2 -r 'monitoring'" ); 88 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'monitoring'" );
87 cmp_ok( $res->return_code, "==", 0, "Got a reference to 'monitoring'"); 89 cmp_ok( $res->return_code, "==", 0, "Got a reference to 'monitoring'");
88 90
89 $res = NPTest->testCmd( "./check_http -H $host_tcp_http2 -r 'mONiTORing'" ); 91 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'mONiTORing'" );
90 cmp_ok( $res->return_code, "==", 2, "Not got 'mONiTORing'"); 92 cmp_ok( $res->return_code, "==", 2, "Not got 'mONiTORing'");
91 like ( $res->output, "/pattern not found/", "Error message says 'pattern not found'"); 93 like ( $res->output, "/pattern not found/", "Error message says 'pattern not found'");
92 94
93 $res = NPTest->testCmd( "./check_http -H $host_tcp_http2 -R 'mONiTORing'" ); 95 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -R 'mONiTORing'" );
94 cmp_ok( $res->return_code, "==", 0, "But case insensitive doesn't mind 'mONiTORing'"); 96 cmp_ok( $res->return_code, "==", 0, "But case insensitive doesn't mind 'mONiTORing'");
95 97
96 $res = NPTest->testCmd( "./check_http -H $host_tcp_http2 -r 'monitoring' --invert-regex" ); 98 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'monitoring' --invert-regex" );
97 cmp_ok( $res->return_code, "==", 2, "Invert results work when found"); 99 cmp_ok( $res->return_code, "==", 2, "Invert results work when found");
98 like ( $res->output, "/pattern found/", "Error message says 'pattern found'"); 100 like ( $res->output, "/pattern found/", "Error message says 'pattern found'");
99 101
100 $res = NPTest->testCmd( "./check_http -H $host_tcp_http2 -r 'mONiTORing' --invert-regex" ); 102 $res = NPTest->testCmd( "./$plugin -H $host_tcp_http2 -r 'mONiTORing' --invert-regex" );
101 cmp_ok( $res->return_code, "==", 0, "And also when not found"); 103 cmp_ok( $res->return_code, "==", 0, "And also when not found");
102} 104}
103SKIP: { 105SKIP: {
104 skip "No internet access", 16 if $internet_access eq "no"; 106 skip "No internet access", 16 if $internet_access eq "no";
105 107
106 $res = NPTest->testCmd( 108 $res = NPTest->testCmd(
107 "./check_http --ssl $host_tls_http" 109 "./$plugin --ssl $host_tls_http"
108 ); 110 );
109 cmp_ok( $res->return_code, '==', 0, "Can read https for $host_tls_http" ); 111 cmp_ok( $res->return_code, '==', 0, "Can read https for $host_tls_http" );
110 112
111 $res = NPTest->testCmd( "./check_http -C 1 --ssl $host_tls_http" ); 113 $res = NPTest->testCmd( "./$plugin -C 1 --ssl $host_tls_http" );
112 cmp_ok( $res->return_code, '==', 0, "Checking certificate for $host_tls_http"); 114 cmp_ok( $res->return_code, '==', 0, "Checking certificate for $host_tls_http");
113 like ( $res->output, "/Certificate '$host_tls_cert' will expire on/", "Output OK" ); 115 like ( $res->output, "/Certificate '$host_tls_cert' will expire on/", "Output OK" );
114 my $saved_cert_output = $res->output; 116 my $saved_cert_output = $res->output;
115 117
116 $res = NPTest->testCmd( "./check_http -C 8000,1 --ssl $host_tls_http" ); 118 $res = NPTest->testCmd( "./$plugin -C 8000,1 --ssl $host_tls_http" );
117 cmp_ok( $res->return_code, '==', 1, "Checking certificate for $host_tls_http"); 119 cmp_ok( $res->return_code, '==', 1, "Checking certificate for $host_tls_http");
118 like ( $res->output, qr/WARNING - Certificate '$host_tls_cert' expires in \d+ day/, "Output Warning" ); 120 like ( $res->output, qr/WARNING - Certificate '$host_tls_cert' expires in \d+ day/, "Output Warning" );
119 121
120 $res = NPTest->testCmd( "./check_http $host_tls_http -C 1" ); 122 $res = NPTest->testCmd( "./$plugin $host_tls_http -C 1" );
121 is( $res->return_code, 0, "Old syntax for cert checking okay" ); 123 is( $res->return_code, 0, "Old syntax for cert checking okay" );
122 is( $res->output, $saved_cert_output, "Same output as new syntax" ); 124 is( $res->output, $saved_cert_output, "Same output as new syntax" );
123 125
124 $res = NPTest->testCmd( "./check_http -H $host_tls_http -C 1" ); 126 $res = NPTest->testCmd( "./$plugin -H $host_tls_http -C 1" );
125 is( $res->return_code, 0, "Updated syntax for cert checking okay" ); 127 is( $res->return_code, 0, "Updated syntax for cert checking okay" );
126 is( $res->output, $saved_cert_output, "Same output as new syntax" ); 128 is( $res->output, $saved_cert_output, "Same output as new syntax" );
127 129
128 $res = NPTest->testCmd( "./check_http -C 1 $host_tls_http" ); 130 $res = NPTest->testCmd( "./$plugin -C 1 $host_tls_http" );
129 cmp_ok( $res->output, 'eq', $saved_cert_output, "--ssl option automatically added"); 131 cmp_ok( $res->output, 'eq', $saved_cert_output, "--ssl option automatically added");
130 132
131 $res = NPTest->testCmd( "./check_http $host_tls_http -C 1" ); 133 $res = NPTest->testCmd( "./$plugin $host_tls_http -C 1" );
132 cmp_ok( $res->output, 'eq', $saved_cert_output, "Old syntax for cert checking still works"); 134 cmp_ok( $res->output, 'eq', $saved_cert_output, "Old syntax for cert checking still works");
133 135
134 # run some certificate checks with faketime 136 # run some certificate checks with faketime
135 SKIP: { 137 SKIP: {
136 skip "No faketime binary found", 7 if !$faketime; 138 skip "No faketime binary found", 12 if !$faketime;
137 $res = NPTest->testCmd("LC_TIME=C TZ=UTC ./check_http -C 1 $host_tls_http"); 139 $res = NPTest->testCmd("LC_TIME=C TZ=UTC ./$plugin -C 1 $host_tls_http");
138 like($res->output, qr/OK - Certificate '$host_tls_cert' will expire on/, "Catch cert output"); 140 like($res->output, qr/OK - Certificate '$host_tls_cert' will expire on/, "Catch cert output");
139 is( $res->return_code, 0, "Catch cert output exit code" ); 141 is( $res->return_code, 0, "Catch cert output exit code" );
140 my($mon,$day,$hour,$min,$sec,$year) = ($res->output =~ /(\w+)\s+(\d+)\s+(\d+):(\d+):(\d+)\s+(\d+)/); 142 my($mon,$day,$hour,$min,$sec,$year) = ($res->output =~ /(\w+)\s+(\d+)\s+(\d+):(\d+):(\d+)\s+(\d+)/);
@@ -144,51 +146,51 @@ SKIP: {
144 my $months = {'Jan' => 0, 'Feb' => 1, 'Mar' => 2, 'Apr' => 3, 'May' => 4, 'Jun' => 5, 'Jul' => 6, 'Aug' => 7, 'Sep' => 8, 'Oct' => 9, 'Nov' => 10, 'Dec' => 11}; 146 my $months = {'Jan' => 0, 'Feb' => 1, 'Mar' => 2, 'Apr' => 3, 'May' => 4, 'Jun' => 5, 'Jul' => 6, 'Aug' => 7, 'Sep' => 8, 'Oct' => 9, 'Nov' => 10, 'Dec' => 11};
145 my $ts = mktime($sec, $min, $hour, $day, $months->{$mon}, $year-1900); 147 my $ts = mktime($sec, $min, $hour, $day, $months->{$mon}, $year-1900);
146 my $time = strftime("%Y-%m-%d %H:%M:%S", localtime($ts)); 148 my $time = strftime("%Y-%m-%d %H:%M:%S", localtime($ts));
147 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts))."' ./check_http -C 1 $host_tls_http"); 149 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts))."' ./$plugin -C 1 $host_tls_http");
148 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' just expired/, "Output on expire date"); 150 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' just expired/, "Output on expire date");
149 151
150 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-1))."' ./check_http -C 1 $host_tls_http"); 152 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-1))."' ./$plugin -C 1 $host_tls_http");
151 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 0 minutes/, "cert expires in 1 second output"); 153 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 0 minutes/, "cert expires in 1 second output");
152 154
153 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-120))."' ./check_http -C 1 $host_tls_http"); 155 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-120))."' ./$plugin -C 1 $host_tls_http");
154 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 2 minutes/, "cert expires in 2 minutes output"); 156 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 2 minutes/, "cert expires in 2 minutes output");
155 157
156 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-7200))."' ./check_http -C 1 $host_tls_http"); 158 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-7200))."' ./$plugin -C 1 $host_tls_http");
157 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 2 hours/, "cert expires in 2 hours output"); 159 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expires in 2 hours/, "cert expires in 2 hours output");
158 160
159 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts+1))."' ./check_http -C 1 $host_tls_http"); 161 $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts+1))."' ./$plugin -C 1 $host_tls_http");
160 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expired on/, "Certificate expired output"); 162 like($res->output, qr/CRITICAL - Certificate '$host_tls_cert' expired on/, "Certificate expired output");
161 }; 163 };
162 164
163 $res = NPTest->testCmd( "./check_http --ssl $host_tls_http -E" ); 165 $res = NPTest->testCmd( "./$plugin --ssl $host_tls_http -E" );
164 like ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' ); 166 like ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' );
165 like ( $res->output, '/time_ssl=[\d\.]+/', 'Extended Performance Data SSL Output OK' ); 167 like ( $res->output, '/time_ssl=[\d\.]+/', 'Extended Performance Data SSL Output OK' );
166 168
167 $res = NPTest->testCmd( 169 $res = NPTest->testCmd(
168 "./check_http --ssl -H www.e-paycobalt.com" 170 "./$plugin --ssl -H www.e-paycobalt.com"
169 ); 171 );
170 cmp_ok( $res->return_code, "==", 0, "Can read https for www.e-paycobalt.com (uses AES certificate)" ); 172 cmp_ok( $res->return_code, "==", 0, "Can read https for www.e-paycobalt.com (uses AES certificate)" );
171 173
172 174
173 $res = NPTest->testCmd( "./check_http -H www.mozilla.com -u /firefox -f follow" ); 175 $res = NPTest->testCmd( "./$plugin -H www.mozilla.com -u /firefox -f follow" );
174 is( $res->return_code, 0, "Redirection based on location is okay"); 176 is( $res->return_code, 0, "Redirection based on location is okay");
175 177
176 $res = NPTest->testCmd( "./check_http -H www.mozilla.com --extended-perfdata" ); 178 $res = NPTest->testCmd( "./$plugin -H www.mozilla.com --extended-perfdata" );
177 like ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' ); 179 like ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' );
178} 180}
179 181
180SKIP: { 182SKIP: {
181 skip "No internet access or proxy configured", 6 if $internet_access eq "no" or ! $host_tcp_proxy; 183 skip "No internet access or proxy configured", 6 if $internet_access eq "no" or ! $host_tcp_proxy;
182 184
183 $res = NPTest->testCmd( "./check_http -I $host_tcp_proxy -p $port_tcp_proxy -u http://$host_tcp_http -e 200,301,302"); 185 $res = NPTest->testCmd( "./$plugin -I $host_tcp_proxy -p $port_tcp_proxy -u http://$host_tcp_http -e 200,301,302");
184 is( $res->return_code, 0, "Proxy HTTP works"); 186 is( $res->return_code, 0, "Proxy HTTP works");
185 like($res->output, qr/OK: Status line output matched/, "Proxy HTTP Output is sufficent"); 187 like($res->output, qr/OK: Status line output matched/, "Proxy HTTP Output is sufficent");
186 188
187 $res = NPTest->testCmd( "./check_http -I $host_tcp_proxy -p $port_tcp_proxy -H $host_tls_http -S -j CONNECT"); 189 $res = NPTest->testCmd( "./$plugin -I $host_tcp_proxy -p $port_tcp_proxy -H $host_tls_http -S -j CONNECT");
188 is( $res->return_code, 0, "Proxy HTTP CONNECT works"); 190 is( $res->return_code, 0, "Proxy HTTP CONNECT works");
189 like($res->output, qr/HTTP OK:/, "Proxy HTTP CONNECT output sufficent"); 191 like($res->output, qr/HTTP OK:/, "Proxy HTTP CONNECT output sufficent");
190 192
191 $res = NPTest->testCmd( "./check_http -I $host_tcp_proxy -p $port_tcp_proxy -H $host_tls_http -S -j CONNECT:HEAD"); 193 $res = NPTest->testCmd( "./$plugin -I $host_tcp_proxy -p $port_tcp_proxy -H $host_tls_http -S -j CONNECT:HEAD");
192 is( $res->return_code, 0, "Proxy HTTP CONNECT works with override method"); 194 is( $res->return_code, 0, "Proxy HTTP CONNECT works with override method");
193 like($res->output, qr/HTTP OK:/, "Proxy HTTP CONNECT output sufficent"); 195 like($res->output, qr/HTTP OK:/, "Proxy HTTP CONNECT output sufficent");
194} 196}
diff --git a/plugins/tests/check_curl.t b/plugins/tests/check_curl.t
new file mode 100755
index 0000000..1afbe4b
--- /dev/null
+++ b/plugins/tests/check_curl.t
@@ -0,0 +1,498 @@
1#! /usr/bin/perl -w -I ..
2#
3# Test check_http by having an actual HTTP server running
4#
5# To create the https server certificate:
6# openssl req -new -x509 -keyout server-key.pem -out server-cert.pem -days 3650 -nodes
7# to create a new expired certificate:
8# faketime '2008-01-01 12:00:00' openssl req -new -x509 -keyout expired-key.pem -out expired-cert.pem -days 1 -nodes
9# Country Name (2 letter code) [AU]:DE
10# State or Province Name (full name) [Some-State]:Bavaria
11# Locality Name (eg, city) []:Munich
12# Organization Name (eg, company) [Internet Widgits Pty Ltd]:Monitoring Plugins
13# Organizational Unit Name (eg, section) []:
14# Common Name (e.g. server FQDN or YOUR name) []:Monitoring Plugins
15# Email Address []:devel@monitoring-plugins.org
16
17use strict;
18use Test::More;
19use NPTest;
20use FindBin qw($Bin);
21
22$ENV{'LC_TIME'} = "C";
23
24my $common_tests = 70;
25my $ssl_only_tests = 8;
26# Check that all dependent modules are available
27eval "use HTTP::Daemon 6.01;";
28plan skip_all => 'HTTP::Daemon >= 6.01 required' if $@;
29eval {
30 require HTTP::Status;
31 require HTTP::Response;
32};
33
34my $plugin = 'check_http';
35$plugin = 'check_curl' if $0 =~ m/check_curl/mx;
36
37# look for libcurl version to see if some advanced checks are possible (>= 7.49.0)
38my $advanced_checks = 12;
39my $use_advanced_checks = 0;
40my $required_version = '7.49.0';
41my $virtual_host = 'www.somefunnyhost.com';
42my $virtual_port = 42;
43my $curl_version = '';
44open (my $fh, '-|', "./$plugin --version") or die;
45while (<$fh>) {
46 if (m{libcurl/([\d.]+)\s}) {
47 $curl_version = $1;
48 last;
49 }
50}
51close ($fh);
52if ($curl_version) {
53 my ($major, $minor, $release) = split (/\./, $curl_version);
54 my ($req_major, $req_minor, $req_release) = split (/\./, $required_version);
55 my $check = ($major <=> $req_major or $minor <=> $req_minor or $release <=> $req_release);
56 if ($check >= 0) {
57 $use_advanced_checks = 1;
58 print "Found libcurl $major.$minor.$release. Using advanced checks\n";
59 }
60}
61
62if ($@) {
63 plan skip_all => "Missing required module for test: $@";
64} else {
65 if (-x "./$plugin") {
66 plan tests => $common_tests * 2 + $ssl_only_tests + $advanced_checks;
67 } else {
68 plan skip_all => "No $plugin compiled";
69 }
70}
71
72my $servers = { http => 0 }; # HTTP::Daemon should always be available
73eval { require HTTP::Daemon::SSL };
74if ($@) {
75 diag "Cannot load HTTP::Daemon::SSL: $@";
76} else {
77 $servers->{https} = 0;
78}
79
80# set a fixed version, so the header size doesn't vary
81$HTTP::Daemon::VERSION = "1.00";
82
83my $port_http = 50000 + int(rand(1000));
84my $port_https = $port_http + 1;
85my $port_https_expired = $port_http + 2;
86
87# This array keeps sockets around for implementing timeouts
88my @persist;
89
90# Start up all servers
91my @pids;
92my $pid = fork();
93if ($pid) {
94 # Parent
95 push @pids, $pid;
96 if (exists $servers->{https}) {
97 # Fork a normal HTTPS server
98 $pid = fork();
99 if ($pid) {
100 # Parent
101 push @pids, $pid;
102 # Fork an expired cert server
103 $pid = fork();
104 if ($pid) {
105 push @pids, $pid;
106 } else {
107 my $d = HTTP::Daemon::SSL->new(
108 LocalPort => $port_https_expired,
109 LocalAddr => "127.0.0.1",
110 SSL_cert_file => "$Bin/certs/expired-cert.pem",
111 SSL_key_file => "$Bin/certs/expired-key.pem",
112 ) || die;
113 print "Please contact https expired at: <URL:", $d->url, ">\n";
114 run_server( $d );
115 exit;
116 }
117 } else {
118 my $d = HTTP::Daemon::SSL->new(
119 LocalPort => $port_https,
120 LocalAddr => "127.0.0.1",
121 SSL_cert_file => "$Bin/certs/server-cert.pem",
122 SSL_key_file => "$Bin/certs/server-key.pem",
123 ) || die;
124 print "Please contact https at: <URL:", $d->url, ">\n";
125 run_server( $d );
126 exit;
127 }
128 }
129 # give our webservers some time to startup
130 sleep(1);
131} else {
132 # Child
133 #print "child\n";
134 my $d = HTTP::Daemon->new(
135 LocalPort => $port_http,
136 LocalAddr => "127.0.0.1",
137 ) || die;
138 print "Please contact http at: <URL:", $d->url, ">\n";
139 run_server( $d );
140 exit;
141}
142
143# Run the same server on http and https
144sub run_server {
145 my $d = shift;
146 MAINLOOP: while (my $c = $d->accept ) {
147 while (my $r = $c->get_request) {
148 if ($r->method eq "GET" and $r->url->path =~ m^/statuscode/(\d+)^) {
149 $c->send_basic_header($1);
150 $c->send_crlf;
151 } elsif ($r->method eq "GET" and $r->url->path =~ m^/file/(.*)^) {
152 $c->send_basic_header;
153 $c->send_crlf;
154 $c->send_file_response("$Bin/var/$1");
155 } elsif ($r->method eq "GET" and $r->url->path eq "/slow") {
156 $c->send_basic_header;
157 $c->send_crlf;
158 sleep 1;
159 $c->send_response("slow");
160 } elsif ($r->url->path eq "/method") {
161 if ($r->method eq "DELETE") {
162 $c->send_error(HTTP::Status->RC_METHOD_NOT_ALLOWED);
163 } elsif ($r->method eq "foo") {
164 $c->send_error(HTTP::Status->RC_NOT_IMPLEMENTED);
165 } else {
166 $c->send_status_line(200, $r->method);
167 }
168 } elsif ($r->url->path eq "/postdata") {
169 $c->send_basic_header;
170 $c->send_crlf;
171 $c->send_response($r->method.":".$r->content);
172 } elsif ($r->url->path eq "/redirect") {
173 $c->send_redirect( "/redirect2" );
174 } elsif ($r->url->path eq "/redir_external") {
175 $c->send_redirect(($d->isa('HTTP::Daemon::SSL') ? "https" : "http") . "://169.254.169.254/redirect2" );
176 } elsif ($r->url->path eq "/redirect2") {
177 $c->send_basic_header;
178 $c->send_crlf;
179 $c->send_response(HTTP::Response->new( 200, 'OK', undef, 'redirected' ));
180 } elsif ($r->url->path eq "/redir_timeout") {
181 $c->send_redirect( "/timeout" );
182 } elsif ($r->url->path eq "/timeout") {
183 # Keep $c from being destroyed, but prevent severe leaks
184 unshift @persist, $c;
185 delete($persist[1000]);
186 next MAINLOOP;
187 } elsif ($r->url->path eq "/header_check") {
188 $c->send_basic_header;
189 $c->send_header('foo');
190 $c->send_crlf;
191 } elsif ($r->url->path eq "/virtual_port") {
192 # return sent Host header
193 $c->send_basic_header;
194 $c->send_crlf;
195 $c->send_response(HTTP::Response->new( 200, 'OK', undef, $r->header ('Host')));
196 } else {
197 $c->send_error(HTTP::Status->RC_FORBIDDEN);
198 }
199 $c->close;
200 }
201 }
202}
203
204END {
205 foreach my $pid (@pids) {
206 if ($pid) { print "Killing $pid\n"; kill "INT", $pid }
207 }
208};
209
210if ($ARGV[0] && $ARGV[0] eq "-d") {
211 while (1) {
212 sleep 100;
213 }
214}
215
216my $result;
217my $command = "./$plugin -H 127.0.0.1";
218
219run_common_tests( { command => "$command -p $port_http" } );
220SKIP: {
221 skip "HTTP::Daemon::SSL not installed", $common_tests + $ssl_only_tests if ! exists $servers->{https};
222 run_common_tests( { command => "$command -p $port_https", ssl => 1 } );
223
224 $result = NPTest->testCmd( "$command -p $port_https -S -C 14" );
225 is( $result->return_code, 0, "$command -p $port_https -S -C 14" );
226 is( $result->output, "OK - Certificate 'Monitoring Plugins' will expire on Fri Feb 16 15:31:44 2029 +0000.", "output ok" );
227
228 $result = NPTest->testCmd( "$command -p $port_https -S -C 14000" );
229 is( $result->return_code, 1, "$command -p $port_https -S -C 14000" );
230 like( $result->output, '/WARNING - Certificate \'Monitoring Plugins\' expires in \d+ day\(s\) \(Fri Feb 16 15:31:44 2029 \+0000\)./', "output ok" );
231
232 # Expired cert tests
233 $result = NPTest->testCmd( "$command -p $port_https -S -C 13960,14000" );
234 is( $result->return_code, 2, "$command -p $port_https -S -C 13960,14000" );
235 like( $result->output, '/CRITICAL - Certificate \'Monitoring Plugins\' expires in \d+ day\(s\) \(Fri Feb 16 15:31:44 2029 \+0000\)./', "output ok" );
236
237 $result = NPTest->testCmd( "$command -p $port_https_expired -S -C 7" );
238 is( $result->return_code, 2, "$command -p $port_https_expired -S -C 7" );
239 is( $result->output,
240 'CRITICAL - Certificate \'Monitoring Plugins\' expired on Wed Jan 2 11:00:26 2008 +0000.',
241 "output ok" );
242
243}
244
245my $cmd;
246
247# advanced checks with virtual hostname and virtual port
248SKIP: {
249 skip "libcurl version is smaller than $required_version", 6 unless $use_advanced_checks;
250
251 # http without virtual port
252 $cmd = "./$plugin -H $virtual_host -I 127.0.0.1 -p $port_http -u /virtual_port -r ^$virtual_host:$port_http\$";
253 $result = NPTest->testCmd( $cmd );
254 is( $result->return_code, 0, $cmd);
255 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
256
257 # http with virtual port (!= 80)
258 $cmd = "./$plugin -H $virtual_host:$virtual_port -I 127.0.0.1 -p $port_http -u /virtual_port -r ^$virtual_host:$virtual_port\$";
259 $result = NPTest->testCmd( $cmd );
260 is( $result->return_code, 0, $cmd);
261 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
262
263 # http with virtual port (80)
264 $cmd = "./$plugin -H $virtual_host:80 -I 127.0.0.1 -p $port_http -u /virtual_port -r ^$virtual_host\$";
265 $result = NPTest->testCmd( $cmd );
266 is( $result->return_code, 0, $cmd);
267 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
268}
269
270# and the same for SSL
271SKIP: {
272 skip "libcurl version is smaller than $required_version and/or HTTP::Daemon::SSL not installed", 6 if ! exists $servers->{https} or not $use_advanced_checks;
273 # https without virtual port
274 $cmd = "./$plugin -H $virtual_host -I 127.0.0.1 -p $port_https --ssl -u /virtual_port -r ^$virtual_host:$port_https\$";
275 $result = NPTest->testCmd( $cmd );
276 is( $result->return_code, 0, $cmd);
277 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
278
279 # https with virtual port (!= 443)
280 $cmd = "./$plugin -H $virtual_host:$virtual_port -I 127.0.0.1 -p $port_https --ssl -u /virtual_port -r ^$virtual_host:$virtual_port\$";
281 $result = NPTest->testCmd( $cmd );
282 is( $result->return_code, 0, $cmd);
283 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
284
285 # https with virtual port (443)
286 $cmd = "./$plugin -H $virtual_host:443 -I 127.0.0.1 -p $port_https --ssl -u /virtual_port -r ^$virtual_host\$";
287 $result = NPTest->testCmd( $cmd );
288 is( $result->return_code, 0, $cmd);
289 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
290}
291
292
293sub run_common_tests {
294 my ($opts) = @_;
295 my $command = $opts->{command};
296 if ($opts->{ssl}) {
297 $command .= " --ssl";
298 }
299
300 $result = NPTest->testCmd( "$command -u /file/root" );
301 is( $result->return_code, 0, "/file/root");
302 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - 274 bytes in [\d\.]+ second/', "Output correct" );
303
304 $result = NPTest->testCmd( "$command -u /file/root -s Root" );
305 is( $result->return_code, 0, "/file/root search for string");
306 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - 274 bytes in [\d\.]+ second/', "Output correct" );
307
308 $result = NPTest->testCmd( "$command -u /file/root -s NonRoot" );
309 is( $result->return_code, 2, "Missing string check");
310 like( $result->output, qr%^HTTP CRITICAL: HTTP/1\.1 200 OK - string 'NonRoot' not found on 'https?://127\.0\.0\.1:\d+/file/root'%, "Shows search string and location");
311
312 $result = NPTest->testCmd( "$command -u /file/root -s NonRootWithOver30charsAndMoreFunThanAWetFish" );
313 is( $result->return_code, 2, "Missing string check");
314 like( $result->output, qr%HTTP CRITICAL: HTTP/1\.1 200 OK - string 'NonRootWithOver30charsAndM...' not found on 'https?://127\.0\.0\.1:\d+/file/root'%, "Shows search string and location");
315
316 $result = NPTest->testCmd( "$command -u /header_check -d foo" );
317 is( $result->return_code, 0, "header_check search for string");
318 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - 96 bytes in [\d\.]+ second/', "Output correct" );
319
320 $result = NPTest->testCmd( "$command -u /header_check -d bar" );
321 is( $result->return_code, 2, "Missing header string check");
322 like( $result->output, qr%^HTTP CRITICAL: HTTP/1\.1 200 OK - header 'bar' not found on 'https?://127\.0\.0\.1:\d+/header_check'%, "Shows search string and location");
323
324 my $cmd;
325 $cmd = "$command -u /slow";
326 $result = NPTest->testCmd( $cmd );
327 is( $result->return_code, 0, "$cmd");
328 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
329 $result->output =~ /in ([\d\.]+) second/;
330 cmp_ok( $1, ">", 1, "Time is > 1 second" );
331
332 $cmd = "$command -u /statuscode/200";
333 $result = NPTest->testCmd( $cmd );
334 is( $result->return_code, 0, $cmd);
335 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
336
337 $cmd = "$command -u /statuscode/200 -e 200";
338 $result = NPTest->testCmd( $cmd );
339 is( $result->return_code, 0, $cmd);
340 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - Status line output matched "200" - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
341
342 $cmd = "$command -u /statuscode/201";
343 $result = NPTest->testCmd( $cmd );
344 is( $result->return_code, 0, $cmd);
345 like( $result->output, '/^HTTP OK: HTTP/1.1 201 Created - \d+ bytes in [\d\.]+ second /', "Output correct: ".$result->output );
346
347 $cmd = "$command -u /statuscode/201 -e 201";
348 $result = NPTest->testCmd( $cmd );
349 is( $result->return_code, 0, $cmd);
350 like( $result->output, '/^HTTP OK: HTTP/1.1 201 Created - Status line output matched "201" - \d+ bytes in [\d\.]+ second /', "Output correct: ".$result->output );
351
352 $cmd = "$command -u /statuscode/201 -e 200";
353 $result = NPTest->testCmd( $cmd );
354 is( $result->return_code, 2, $cmd);
355 like( $result->output, '/^HTTP CRITICAL - Invalid HTTP response received from host on port \d+: HTTP/1.1 201 Created/', "Output correct: ".$result->output );
356
357 $cmd = "$command -u /statuscode/200 -e 200,201,202";
358 $result = NPTest->testCmd( $cmd );
359 is( $result->return_code, 0, $cmd);
360 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - Status line output matched "200,201,202" - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
361
362 $cmd = "$command -u /statuscode/201 -e 200,201,202";
363 $result = NPTest->testCmd( $cmd );
364 is( $result->return_code, 0, $cmd);
365 like( $result->output, '/^HTTP OK: HTTP/1.1 201 Created - Status line output matched "200,201,202" - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
366
367 $cmd = "$command -u /statuscode/203 -e 200,201,202";
368 $result = NPTest->testCmd( $cmd );
369 is( $result->return_code, 2, $cmd);
370 like( $result->output, '/^HTTP CRITICAL - Invalid HTTP response received from host on port (\d+): HTTP/1.1 203 Non-Authoritative Information/', "Output correct: ".$result->output );
371
372 $cmd = "$command -j HEAD -u /method";
373 $result = NPTest->testCmd( $cmd );
374 is( $result->return_code, 0, $cmd);
375 like( $result->output, '/^HTTP OK: HTTP/1.1 200 HEAD - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
376
377 $cmd = "$command -j POST -u /method";
378 $result = NPTest->testCmd( $cmd );
379 is( $result->return_code, 0, $cmd);
380 like( $result->output, '/^HTTP OK: HTTP/1.1 200 POST - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
381
382 $cmd = "$command -j GET -u /method";
383 $result = NPTest->testCmd( $cmd );
384 is( $result->return_code, 0, $cmd);
385 like( $result->output, '/^HTTP OK: HTTP/1.1 200 GET - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
386
387 $cmd = "$command -u /method";
388 $result = NPTest->testCmd( $cmd );
389 is( $result->return_code, 0, $cmd);
390 like( $result->output, '/^HTTP OK: HTTP/1.1 200 GET - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
391
392 $cmd = "$command -P foo -u /method";
393 $result = NPTest->testCmd( $cmd );
394 is( $result->return_code, 0, $cmd);
395 like( $result->output, '/^HTTP OK: HTTP/1.1 200 POST - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
396
397 $cmd = "$command -j DELETE -u /method";
398 $result = NPTest->testCmd( $cmd );
399 is( $result->return_code, 1, $cmd);
400 like( $result->output, '/^HTTP WARNING: HTTP/1.1 405 Method Not Allowed/', "Output correct: ".$result->output );
401
402 $cmd = "$command -j foo -u /method";
403 $result = NPTest->testCmd( $cmd );
404 is( $result->return_code, 2, $cmd);
405 like( $result->output, '/^HTTP CRITICAL: HTTP/1.1 501 Not Implemented/', "Output correct: ".$result->output );
406
407 $cmd = "$command -P stufftoinclude -u /postdata -s POST:stufftoinclude";
408 $result = NPTest->testCmd( $cmd );
409 is( $result->return_code, 0, $cmd);
410 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
411
412 $cmd = "$command -j PUT -P stufftoinclude -u /postdata -s PUT:stufftoinclude";
413 $result = NPTest->testCmd( $cmd );
414 is( $result->return_code, 0, $cmd);
415 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
416
417 # To confirm that the free doesn't segfault
418 $cmd = "$command -P stufftoinclude -j PUT -u /postdata -s PUT:stufftoinclude";
419 $result = NPTest->testCmd( $cmd );
420 is( $result->return_code, 0, $cmd);
421 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
422
423 $cmd = "$command -u /redirect";
424 $result = NPTest->testCmd( $cmd );
425 is( $result->return_code, 0, $cmd);
426 like( $result->output, '/^HTTP OK: HTTP/1.1 301 Moved Permanently - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
427
428 $cmd = "$command -f follow -u /redirect";
429 $result = NPTest->testCmd( $cmd );
430 is( $result->return_code, 0, $cmd);
431 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
432
433 $cmd = "$command -u /redirect -k 'follow: me'";
434 $result = NPTest->testCmd( $cmd );
435 is( $result->return_code, 0, $cmd);
436 like( $result->output, '/^HTTP OK: HTTP/1.1 301 Moved Permanently - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
437
438 $cmd = "$command -f follow -u /redirect -k 'follow: me'";
439 $result = NPTest->testCmd( $cmd );
440 is( $result->return_code, 0, $cmd);
441 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
442
443 $cmd = "$command -f sticky -u /redirect -k 'follow: me'";
444 $result = NPTest->testCmd( $cmd );
445 is( $result->return_code, 0, $cmd);
446 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
447
448 $cmd = "$command -f stickyport -u /redirect -k 'follow: me'";
449 $result = NPTest->testCmd( $cmd );
450 is( $result->return_code, 0, $cmd);
451 like( $result->output, '/^HTTP OK: HTTP/1.1 200 OK - \d+ bytes in [\d\.]+ second/', "Output correct: ".$result->output );
452
453 # These tests may block
454 print "ALRM\n";
455
456 # stickyport - on full urlS port is set back to 80 otherwise
457 $cmd = "$command -f stickyport -u /redir_external -t 5 -s redirected";
458 eval {
459 local $SIG{ALRM} = sub { die "alarm\n" };
460 alarm(2);
461 $result = NPTest->testCmd( $cmd );
462 alarm(0); };
463 isnt( $@, "alarm\n", $cmd );
464 is( $result->return_code, 0, $cmd );
465
466 # Let's hope there won't be any web server on :80 returning "redirected"!
467 $cmd = "$command -f sticky -u /redir_external -t 5 -s redirected";
468 eval {
469 local $SIG{ALRM} = sub { die "alarm\n" };
470 alarm(2);
471 $result = NPTest->testCmd( $cmd );
472 alarm(0); };
473 isnt( $@, "alarm\n", $cmd );
474 isnt( $result->return_code, 0, $cmd );
475
476 # Test an external address - timeout
477 SKIP: {
478 skip "This doesn't seem to work all the time", 1 unless ($ENV{HTTP_EXTERNAL});
479 $cmd = "$command -f follow -u /redir_external -t 5";
480 eval {
481 $result = NPTest->testCmd( $cmd, 2 );
482 };
483 like( $@, "/timeout in command: $cmd/", $cmd );
484 }
485
486 $cmd = "$command -u /timeout -t 5";
487 eval {
488 $result = NPTest->testCmd( $cmd, 2 );
489 };
490 like( $@, "/timeout in command: $cmd/", $cmd );
491
492 $cmd = "$command -f follow -u /redir_timeout -t 2";
493 eval {
494 $result = NPTest->testCmd( $cmd, 5 );
495 };
496 is( $@, "", $cmd );
497
498}
diff --git a/plugins/tests/check_http.t b/plugins/tests/check_http.t
index bfecff2..2f051fa 100755
--- a/plugins/tests/check_http.t
+++ b/plugins/tests/check_http.t
@@ -32,13 +32,16 @@ eval {
32 require HTTP::Response; 32 require HTTP::Response;
33}; 33};
34 34
35my $plugin = 'check_http';
36$plugin = 'check_curl' if $0 =~ m/check_curl/mx;
37
35if ($@) { 38if ($@) {
36 plan skip_all => "Missing required module for test: $@"; 39 plan skip_all => "Missing required module for test: $@";
37} else { 40} else {
38 if (-x "./check_http") { 41 if (-x "./$plugin") {
39 plan tests => $common_tests * 2 + $ssl_only_tests + $virtual_port_tests; 42 plan tests => $common_tests * 2 + $ssl_only_tests + $virtual_port_tests;
40 } else { 43 } else {
41 plan skip_all => "No check_http compiled"; 44 plan skip_all => "No $plugin compiled";
42 } 45 }
43} 46}
44 47
@@ -187,7 +190,7 @@ if ($ARGV[0] && $ARGV[0] eq "-d") {
187} 190}
188 191
189my $result; 192my $result;
190my $command = "./check_http -H 127.0.0.1"; 193my $command = "./$plugin -H 127.0.0.1";
191 194
192run_common_tests( { command => "$command -p $port_http" } ); 195run_common_tests( { command => "$command -p $port_http" } );
193SKIP: { 196SKIP: {
diff --git a/po/de.po b/po/de.po
index 72694e2..919fae3 100644
--- a/po/de.po
+++ b/po/de.po
@@ -13,10 +13,10 @@ msgstr ""
13"PO-Revision-Date: 2004-12-23 17:46+0100\n" 13"PO-Revision-Date: 2004-12-23 17:46+0100\n"
14"Last-Translator: <>\n" 14"Last-Translator: <>\n"
15"Language-Team: English <en@li.org>\n" 15"Language-Team: English <en@li.org>\n"
16"Language: en\n"
17"MIME-Version: 1.0\n" 16"MIME-Version: 1.0\n"
18"Content-Type: text/plain; charset=iso-8859-1\n" 17"Content-Type: text/plain; charset=iso-8859-1\n"
19"Content-Transfer-Encoding: 8bit\n" 18"Content-Transfer-Encoding: 8bit\n"
19"Language: en\n"
20"Plural-Forms: nplurals=2; plural=(n > 1);X-Generator: KBabel 1.3.1\n" 20"Plural-Forms: nplurals=2; plural=(n > 1);X-Generator: KBabel 1.3.1\n"
21 21
22#: plugins/check_by_ssh.c:86 plugins/check_cluster.c:76 plugins/check_dig.c:88 22#: plugins/check_by_ssh.c:86 plugins/check_cluster.c:76 plugins/check_dig.c:88
@@ -5438,8 +5438,8 @@ msgstr ""
5438 5438
5439#: plugins/negate.c:174 5439#: plugins/negate.c:174
5440msgid "" 5440msgid ""
5441"Ok must be a valid state name (OK, WARNING, CRITICAL, UNKNOWN) or integer " 5441"Ok must be a valid state name (OK, WARNING, CRITICAL, UNKNOWN) or integer (0-"
5442"(0-3)." 5442"3)."
5443msgstr "" 5443msgstr ""
5444 5444
5445#: plugins/negate.c:180 5445#: plugins/negate.c:180