1 files changed, 43 insertions, 20 deletions

diff --git a/plugins/check_curl.c b/plugins/check_curl.c
index bd3f7dce..95e45282 100644
--- a/plugins/check_curl.c
+++ b/plugins/check_curl.c
@@ -92,16 +92,16 @@ typedef struct {
 static check_curl_config_wrapper process_arguments(int /*argc*/, char ** /*argv*/);
 
 static mp_subcheck check_http(check_curl_config /*config*/, check_curl_working_state workingState,
-                                                          int redir_depth);
+                                                          long redir_depth);
 
 typedef struct {
-        int redir_depth;
+        long redir_depth;
         check_curl_working_state working_state;
         int error_code;
         check_curl_global_state curl_state;
 } redir_wrapper;
 static redir_wrapper redir(curlhelp_write_curlbuf * /*header_buf*/, check_curl_config /*config*/,
-                                                   int redir_depth, check_curl_working_state working_state);
+                                                   long redir_depth, check_curl_working_state working_state);
 
 static void print_help(void);
 void print_usage(void);
@@ -120,6 +120,14 @@ mp_state_enum np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_
 #endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */
 
 int main(int argc, char **argv) {
+#ifdef __OpenBSD__
+        /* - rpath is required to read --extra-opts, CA and/or client certs
+         * - wpath is required to write --cookie-jar (possibly given up later)
+         * - inet is required for sockets
+         * - dns is required for name lookups */
+        pledge("stdio rpath wpath inet dns", NULL);
+#endif // __OpenBSD__
+
         setlocale(LC_ALL, "");
         bindtextdomain(PACKAGE, LOCALEDIR);
         textdomain(PACKAGE);
@@ -135,6 +143,15 @@ int main(int argc, char **argv) {
 
         const check_curl_config config = tmp_config.config;
 
+#ifdef __OpenBSD__
+        if (!config.curl_config.cookie_jar_file) {
+                if (verbose >= 2) {
+                        printf(_("* No \"--cookie-jar\" is used, giving up \"wpath\" pledge(2)\n"));
+                }
+                pledge("stdio rpath inet dns", NULL);
+        }
+#endif // __OpenBSD__
+
         if (config.output_format_is_set) {
                 mp_set_format(config.output_format);
         }
@@ -198,7 +215,7 @@ CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm) {
 #endif     /* HAVE_SSL */
 
 mp_subcheck check_http(const check_curl_config config, check_curl_working_state workingState,
-                                           int redir_depth) {
+                                           long redir_depth) {
 
         // =======================
         // Initialisation for curl
@@ -441,19 +458,19 @@ mp_subcheck check_http(const check_curl_config config, check_curl_working_state
                                                 "CURLINFO_REDIRECT_COUNT");
 
                                         if (verbose >= 2) {
-                                                printf(_("* curl LIBINFO_REDIRECT_COUNT is %d\n"), redir_depth);
+                                                printf(_("* curl LIBINFO_REDIRECT_COUNT is %ld\n"), redir_depth);
                                         }
 
                                         mp_subcheck sc_redir_depth = mp_subcheck_init();
                                         if (redir_depth > config.max_depth) {
                                                 xasprintf(&sc_redir_depth.output,
-                                                                  "maximum redirection depth %d exceeded in libcurl",
+                                                                  "maximum redirection depth %ld exceeded in libcurl",
                                                                   config.max_depth);
                                                 sc_redir_depth = mp_set_subcheck_state(sc_redir_depth, STATE_CRITICAL);
                                                 mp_add_subcheck_to_subcheck(&sc_result, sc_redir_depth);
                                                 return sc_result;
                                         }
-                                        xasprintf(&sc_redir_depth.output, "redirection depth %d (of a maximum %d)",
+                                        xasprintf(&sc_redir_depth.output, "redirection depth %ld (of a maximum %ld)",
                                                           redir_depth, config.max_depth);
                                         mp_add_subcheck_to_subcheck(&sc_result, sc_redir_depth);
 
@@ -653,7 +670,7 @@ char *uri_string(const UriTextRangeA range, char *buf, size_t buflen) {
 }
 
 redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config config,
-                                        int redir_depth, check_curl_working_state working_state) {
+                                        long redir_depth, check_curl_working_state working_state) {
         curlhelp_statusline status_line;
         struct phr_header headers[255];
         size_t msglen;
@@ -678,7 +695,7 @@ redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config
         }
 
         if (++redir_depth > config.max_depth) {
-                die(STATE_WARNING, _("HTTP WARNING - maximum redirection depth %d exceeded - %s\n"),
+                die(STATE_WARNING, _("HTTP WARNING - maximum redirection depth %ld exceeded - %s\n"),
                         config.max_depth, location);
         }
 
@@ -775,19 +792,23 @@ redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config
         /* missing components have null,null in their UriTextRangeA
          * add query parameters if they exist.
          */
-        if (uri.query.first && uri.query.afterLast){
-                // Ensure we have space for '?' + query_str + '\0' ahead of time, instead of calling strncat twice
+        if (uri.query.first && uri.query.afterLast) {
+                // Ensure we have space for '?' + query_str + '\0' ahead of time, instead of calling strncat
+                // twice
                 size_t current_len = strlen(new_url);
                 size_t remaining_space = DEFAULT_BUFFER_SIZE - current_len - 1;
 
-                const char* query_str = uri_string(uri.query, buf, DEFAULT_BUFFER_SIZE);
+                const char *query_str = uri_string(uri.query, buf, DEFAULT_BUFFER_SIZE);
                 size_t query_str_len = strlen(query_str);
 
                 if (remaining_space >= query_str_len + 1) {
                         strcat(new_url, "?");
                         strcat(new_url, query_str);
-                }else{
-                        die(STATE_UNKNOWN, _("HTTP UNKNOWN - No space to add query part of size %d to the buffer, buffer has remaining size %d"), query_str_len , current_len );
+                } else {
+                        die(STATE_UNKNOWN,
+                                _("HTTP UNKNOWN - No space to add query part of size %zu to the buffer, buffer has "
+                                  "remaining size %zu"),
+                                query_str_len, current_len);
                 }
         }
 
@@ -1244,7 +1265,7 @@ check_curl_config_wrapper process_arguments(int argc, char **argv) {
                         result.config.curl_config.sin_family = AF_INET;
                         break;
                 case '6':
-#if defined(USE_IPV6) && defined(LIBCURL_FEATURE_IPV6)
+#if defined(LIBCURL_FEATURE_IPV6)
                         result.config.curl_config.sin_family = AF_INET6;
 #else
                         usage4(_("IPv6 support not available"));
@@ -1419,7 +1440,7 @@ check_curl_config_wrapper process_arguments(int argc, char **argv) {
                 }
 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 54, 0) */
                 if (verbose >= 2) {
-                        printf(_("* Set SSL/TLS version to %d\n"), result.config.curl_config.ssl_version);
+                        printf(_("* Set SSL/TLS version to %ld\n"), result.config.curl_config.ssl_version);
                 }
                 if (!specify_port) {
                         result.config.initial_config.serverPort = HTTPS_PORT;
@@ -1501,8 +1522,8 @@ void print_help(void) {
         printf(" %s\n", "-I, --IP-address=ADDRESS");
         printf("    %s\n",
                    "IP address or name (use numeric address if possible to bypass DNS lookup).");
-        printf("    %s\n",
-                     "This overwrites the network address of the target while leaving everything else (HTTP headers) as they are");
+        printf("    %s\n", "This overwrites the network address of the target while leaving everything "
+                                           "else (HTTP headers) as they are");
         printf(" %s\n", "-p, --port=INTEGER");
         printf("    %s", _("Port number (default: "));
         printf("%d)\n", HTTP_PORT);
@@ -1566,7 +1587,8 @@ void print_help(void) {
         printf("    %s\n", _("String to expect in the content"));
         printf(" %s\n", "-u, --url=PATH");
         printf("    %s\n", _("URL to GET or POST (default: /)"));
-        printf("    %s\n", _("This is the part after the address in a URL, so for \"https://example.com/index.html\" it would be '-u /index.html'"));
+        printf("    %s\n", _("This is the part after the address in a URL, so for "
+                                                 "\"https://example.com/index.html\" it would be '-u /index.html'"));
         printf(" %s\n", "-P, --post=STRING");
         printf("    %s\n", _("URL decoded http POST data"));
         printf(" %s\n",
@@ -1712,7 +1734,8 @@ void print_help(void) {
         printf(" %s\n", _("It is recommended to use an environment proxy like:"));
         printf(" %s\n",
                    _("https_proxy=http://192.168.100.35:3128 ./check_curl -H www.verisign.com -S"));
-        printf(" %s\n", _("legacy proxy requests in check_http style might still work, but are frowned upon, so DONT:"));
+        printf(" %s\n", _("legacy proxy requests in check_http style might still work, but are frowned "
+                                          "upon, so DONT:"));
         printf(" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u https://www.verisign.com/ -S -j "
                                           "CONNECT -H www.verisign.com "));
         printf(" %s\n", _("all these options are needed: -I <proxy> -p <proxy-port> -u <check-url> "