diff options
Diffstat (limited to 'plugins/check_curl.c')
| -rw-r--r-- | plugins/check_curl.c | 116 |
1 files changed, 70 insertions, 46 deletions
diff --git a/plugins/check_curl.c b/plugins/check_curl.c index f63cdea2..67d89129 100644 --- a/plugins/check_curl.c +++ b/plugins/check_curl.c | |||
| @@ -62,7 +62,7 @@ const char *email = "devel@monitoring-plugins.org"; | |||
| 62 | #include <arpa/inet.h> | 62 | #include <arpa/inet.h> |
| 63 | #include <netinet/in.h> | 63 | #include <netinet/in.h> |
| 64 | 64 | ||
| 65 | #if defined(HAVE_SSL) && defined(USE_OPENSSL) | 65 | #if defined(HAVE_SSL) && defined(MOPL_USE_OPENSSL) |
| 66 | # include <openssl/opensslv.h> | 66 | # include <openssl/opensslv.h> |
| 67 | #endif | 67 | #endif |
| 68 | 68 | ||
| @@ -81,9 +81,9 @@ extern char errbuf[MAX_INPUT_BUFFER]; | |||
| 81 | extern bool is_openssl_callback; | 81 | extern bool is_openssl_callback; |
| 82 | extern bool add_sslctx_verify_fun; | 82 | extern bool add_sslctx_verify_fun; |
| 83 | 83 | ||
| 84 | #if defined(HAVE_SSL) && defined(USE_OPENSSL) | 84 | #if defined(HAVE_SSL) && defined(MOPL_USE_OPENSSL) |
| 85 | static X509 *cert = NULL; | 85 | static X509 *cert = NULL; |
| 86 | #endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */ | 86 | #endif /* defined(HAVE_SSL) && defined(MOPL_USE_OPENSSL) */ |
| 87 | 87 | ||
| 88 | typedef struct { | 88 | typedef struct { |
| 89 | int errorcode; | 89 | int errorcode; |
| @@ -114,10 +114,10 @@ static void print_curl_version(void); | |||
| 114 | // check_curl_evaluation_wrapper check_curl_evaluate(check_curl_config config, | 114 | // check_curl_evaluation_wrapper check_curl_evaluate(check_curl_config config, |
| 115 | // mp_check overall[static 1]) {} | 115 | // mp_check overall[static 1]) {} |
| 116 | 116 | ||
| 117 | #if defined(HAVE_SSL) && defined(USE_OPENSSL) | 117 | #if defined(HAVE_SSL) && defined(MOPL_USE_OPENSSL) |
| 118 | mp_state_enum np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, | 118 | mp_state_enum np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_warn, |
| 119 | int days_till_exp_crit); | 119 | int days_till_exp_crit); |
| 120 | #endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */ | 120 | #endif /* defined(HAVE_SSL) && defined(MOPL_USE_OPENSSL) */ |
| 121 | 121 | ||
| 122 | int main(int argc, char **argv) { | 122 | int main(int argc, char **argv) { |
| 123 | #ifdef __OpenBSD__ | 123 | #ifdef __OpenBSD__ |
| @@ -167,7 +167,7 @@ int main(int argc, char **argv) { | |||
| 167 | } | 167 | } |
| 168 | 168 | ||
| 169 | #ifdef HAVE_SSL | 169 | #ifdef HAVE_SSL |
| 170 | # ifdef USE_OPENSSL | 170 | # ifdef MOPL_USE_OPENSSL |
| 171 | int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx) { | 171 | int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx) { |
| 172 | (void)preverify_ok; | 172 | (void)preverify_ok; |
| 173 | /* TODO: we get all certificates of the chain, so which ones | 173 | /* TODO: we get all certificates of the chain, so which ones |
| @@ -190,11 +190,11 @@ int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx) { | |||
| 190 | } | 190 | } |
| 191 | return 1; | 191 | return 1; |
| 192 | } | 192 | } |
| 193 | # endif /* USE_OPENSSL */ | 193 | # endif /* MOPL_USE_OPENSSL */ |
| 194 | #endif /* HAVE_SSL */ | 194 | #endif /* HAVE_SSL */ |
| 195 | 195 | ||
| 196 | #ifdef HAVE_SSL | 196 | #ifdef HAVE_SSL |
| 197 | # ifdef USE_OPENSSL | 197 | # ifdef MOPL_USE_OPENSSL |
| 198 | CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm) { | 198 | CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm) { |
| 199 | (void)curl; // ignore unused parameter | 199 | (void)curl; // ignore unused parameter |
| 200 | (void)parm; // ignore unused parameter | 200 | (void)parm; // ignore unused parameter |
| @@ -211,7 +211,7 @@ CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm) { | |||
| 211 | 211 | ||
| 212 | return CURLE_OK; | 212 | return CURLE_OK; |
| 213 | } | 213 | } |
| 214 | # endif /* USE_OPENSSL */ | 214 | # endif /* MOPL_USE_OPENSSL */ |
| 215 | #endif /* HAVE_SSL */ | 215 | #endif /* HAVE_SSL */ |
| 216 | 216 | ||
| 217 | mp_subcheck check_http(const check_curl_config config, check_curl_working_state workingState, | 217 | mp_subcheck check_http(const check_curl_config config, check_curl_working_state workingState, |
| @@ -247,8 +247,9 @@ mp_subcheck check_http(const check_curl_config config, check_curl_working_state | |||
| 247 | printf("**** REQUEST CONTENT ****\n%s\n", workingState.http_post_data); | 247 | printf("**** REQUEST CONTENT ****\n%s\n", workingState.http_post_data); |
| 248 | } | 248 | } |
| 249 | 249 | ||
| 250 | // curl_state is updated after curl_easy_perform, and with updated curl_state certificate checks can be done | 250 | // curl_state is updated after curl_easy_perform, and with updated curl_state certificate checks |
| 251 | // Check_http tries to check certs as early as possible, and exits with certificate check result by default. Behave similarly. | 251 | // can be done Check_http tries to check certs as early as possible, and exits with certificate |
| 252 | // check result by default. Behave similarly. | ||
| 252 | #ifdef LIBCURL_FEATURE_SSL | 253 | #ifdef LIBCURL_FEATURE_SSL |
| 253 | if (workingState.use_ssl && config.check_cert) { | 254 | if (workingState.use_ssl && config.check_cert) { |
| 254 | if (verbose > 1) { | 255 | if (verbose > 1) { |
| @@ -979,7 +980,7 @@ check_curl_config_wrapper process_arguments(int argc, char **argv) { | |||
| 979 | int option_index = getopt_long( | 980 | int option_index = getopt_long( |
| 980 | argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:x:b:d:e:p:s:R:r:u:f:C:J:K:DnlLS::m:M:NEB", | 981 | argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:x:b:d:e:p:s:R:r:u:f:C:J:K:DnlLS::m:M:NEB", |
| 981 | longopts, &option); | 982 | longopts, &option); |
| 982 | if (option_index == -1 || option_index == EOF || option_index == 1) { | 983 | if (CHECK_EOF(option_index) || option_index == 1) { |
| 983 | break; | 984 | break; |
| 984 | } | 985 | } |
| 985 | 986 | ||
| @@ -1546,8 +1547,8 @@ void print_help(void) { | |||
| 1546 | printf(" %s\n", "-I, --IP-address=ADDRESS"); | 1547 | printf(" %s\n", "-I, --IP-address=ADDRESS"); |
| 1547 | printf(" %s\n", | 1548 | printf(" %s\n", |
| 1548 | "IP address or name (use numeric address if possible to bypass DNS lookup)."); | 1549 | "IP address or name (use numeric address if possible to bypass DNS lookup)."); |
| 1549 | printf(" %s\n", | 1550 | printf(" %s\n", "This overwrites the network address of the target while leaving everything " |
| 1550 | "This overwrites the network address of the target while leaving everything else (HTTP headers) as they are"); | 1551 | "else (HTTP headers) as they are"); |
| 1551 | printf(" %s\n", "-p, --port=INTEGER"); | 1552 | printf(" %s\n", "-p, --port=INTEGER"); |
| 1552 | printf(" %s", _("Port number (default: ")); | 1553 | printf(" %s", _("Port number (default: ")); |
| 1553 | printf("%d)\n", HTTP_PORT); | 1554 | printf("%d)\n", HTTP_PORT); |
| @@ -1611,7 +1612,8 @@ void print_help(void) { | |||
| 1611 | printf(" %s\n", _("String to expect in the content")); | 1612 | printf(" %s\n", _("String to expect in the content")); |
| 1612 | printf(" %s\n", "-u, --url=PATH"); | 1613 | printf(" %s\n", "-u, --url=PATH"); |
| 1613 | printf(" %s\n", _("URL to GET or POST (default: /)")); | 1614 | printf(" %s\n", _("URL to GET or POST (default: /)")); |
| 1614 | printf(" %s\n", _("This is the part after the address in a URL, so for \"https://example.com/index.html\" it would be '-u /index.html'")); | 1615 | printf(" %s\n", _("This is the part after the address in a URL, so for " |
| 1616 | "\"https://example.com/index.html\" it would be '-u /index.html'")); | ||
| 1615 | printf(" %s\n", "-P, --post=STRING"); | 1617 | printf(" %s\n", "-P, --post=STRING"); |
| 1616 | printf(" %s\n", _("URL decoded http POST data")); | 1618 | printf(" %s\n", _("URL decoded http POST data")); |
| 1617 | printf(" %s\n", | 1619 | printf(" %s\n", |
| @@ -1643,11 +1645,12 @@ void print_help(void) { | |||
| 1643 | printf(" %s\n", _("If port is not specified, libcurl defaults to 1080")); | 1645 | printf(" %s\n", _("If port is not specified, libcurl defaults to 1080")); |
| 1644 | printf(" %s\n", _("This value will be set as CURLOPT_PROXY")); | 1646 | printf(" %s\n", _("This value will be set as CURLOPT_PROXY")); |
| 1645 | printf(" %s\n", "--noproxy=COMMA_SEPARATED_LIST"); | 1647 | printf(" %s\n", "--noproxy=COMMA_SEPARATED_LIST"); |
| 1646 | printf(" %s\n", _("Specify hostnames, addresses and subnets where proxy should not be used")); | 1648 | printf(" %s\n", |
| 1649 | _("Specify hostnames, addresses and subnets where proxy should not be used")); | ||
| 1647 | printf(" %s\n", _("Example usage: \"example.com,::1,1.1.1.1,localhost,192.168.0.0/16\"")); | 1650 | printf(" %s\n", _("Example usage: \"example.com,::1,1.1.1.1,localhost,192.168.0.0/16\"")); |
| 1648 | printf(" %s\n", _("Do not use brackets when specifying IPv6 addresses")); | 1651 | printf(" %s\n", _("Do not use brackets when specifying IPv6 addresses")); |
| 1649 | printf(" %s\n", _("Special case when an item is '*' : matches all hosts/addresses " | 1652 | printf(" %s\n", _("Special case when an item is '*' : matches all hosts/addresses " |
| 1650 | "and effectively disables proxy.")); | 1653 | "and effectively disables proxy.")); |
| 1651 | printf(" %s\n", _("This value will be set as CURLOPT_NOPROXY")); | 1654 | printf(" %s\n", _("This value will be set as CURLOPT_NOPROXY")); |
| 1652 | printf(" %s\n", "-a, --authorization=AUTH_PAIR"); | 1655 | printf(" %s\n", "-a, --authorization=AUTH_PAIR"); |
| 1653 | printf(" %s\n", _("Username:password on sites with basic authentication")); | 1656 | printf(" %s\n", _("Username:password on sites with basic authentication")); |
| @@ -1757,38 +1760,59 @@ void print_help(void) { | |||
| 1757 | #endif | 1760 | #endif |
| 1758 | 1761 | ||
| 1759 | printf("\n %s\n", "CHECK WEBSERVER CONTENT VIA PROXY:"); | 1762 | printf("\n %s\n", "CHECK WEBSERVER CONTENT VIA PROXY:"); |
| 1760 | printf(" %s\n", _("Proxies are specified or disabled for certain hosts/addresses using environment variables" | 1763 | printf(" %s\n", _("Proxies are specified or disabled for certain hosts/addresses using " |
| 1761 | " or -x/--proxy and --noproxy arguments:")); | 1764 | "environment variables" |
| 1762 | printf(" %s\n", _("Checked environment variables: all_proxy, http_proxy, https_proxy, no_proxy")); | 1765 | " or -x/--proxy and --noproxy arguments:")); |
| 1763 | printf(" %s\n", _("Environment variables can also be given in uppercase, but the lowercase ones will " | 1766 | printf(" %s\n", |
| 1764 | "take predence if both are defined.")); | 1767 | _("Checked environment variables: all_proxy, http_proxy, https_proxy, no_proxy")); |
| 1765 | printf(" %s\n", _("The environment variables are overwritten by -x/--proxy and --noproxy arguments:")); | 1768 | printf(" %s\n", |
| 1769 | _("Environment variables can also be given in uppercase, but the lowercase ones will " | ||
| 1770 | "take predence if both are defined.")); | ||
| 1771 | printf(" %s\n", | ||
| 1772 | _("The environment variables are overwritten by -x/--proxy and --noproxy arguments:")); | ||
| 1766 | printf(" %s\n", _("all_proxy/ALL_PROXY environment variables are read first, but protocol " | 1773 | printf(" %s\n", _("all_proxy/ALL_PROXY environment variables are read first, but protocol " |
| 1767 | "specific environment variables override them.")); | 1774 | "specific environment variables override them.")); |
| 1768 | printf(" %s\n", _("If SSL is enabled and used, https_proxy/HTTPS_PROXY will be checked and overwrite " | 1775 | printf(" %s\n", |
| 1769 | "http_proxy/HTTPS_PROXY.")); | 1776 | _("If SSL is enabled and used, https_proxy/HTTPS_PROXY will be checked and overwrite " |
| 1770 | printf(" %s\n", _("Curl accepts proxies using http, https, socks4, socks4a, socks5 and socks5h schemes.")); | 1777 | "http_proxy/HTTPS_PROXY.")); |
| 1771 | printf(" %s\n", _("http_proxy=http://192.168.100.35:3128 ./check_curl -H www.monitoring-plugins.org")); | 1778 | printf( |
| 1772 | printf(" %s\n", _("http_proxy=http://used.proxy.com HTTP_PROXY=http://ignored.proxy.com ./check_curl -H www.monitoring-plugins.org")); | 1779 | " %s\n", |
| 1780 | _("Curl accepts proxies using http, https, socks4, socks4a, socks5 and socks5h schemes.")); | ||
| 1781 | printf(" %s\n", | ||
| 1782 | _("http_proxy=http://192.168.100.35:3128 ./check_curl -H www.monitoring-plugins.org")); | ||
| 1783 | printf(" %s\n", _("http_proxy=http://used.proxy.com HTTP_PROXY=http://ignored.proxy.com " | ||
| 1784 | "./check_curl -H www.monitoring-plugins.org")); | ||
| 1773 | printf(" %s\n", _(" Lowercase http_proxy takes predence over uppercase HTTP_PROXY")); | 1785 | printf(" %s\n", _(" Lowercase http_proxy takes predence over uppercase HTTP_PROXY")); |
| 1774 | printf(" %s\n", _("./check_curl -H www.monitoring-plugins.org -x http://192.168.100.35:3128")); | 1786 | printf(" %s\n", _("./check_curl -H www.monitoring-plugins.org -x http://192.168.100.35:3128")); |
| 1775 | printf(" %s\n", _("http_proxy=http://unused.proxy1.com HTTP_PROXY=http://unused.proxy2.com ./check_curl " | 1787 | printf(" %s\n", |
| 1776 | "-H www.monitoring-plugins.org --proxy http://used.proxy")); | 1788 | _("http_proxy=http://unused.proxy1.com HTTP_PROXY=http://unused.proxy2.com ./check_curl " |
| 1777 | printf(" %s\n", _(" Proxy specified by --proxy overrides any proxy specified by environment variable.")); | 1789 | "-H www.monitoring-plugins.org --proxy http://used.proxy")); |
| 1790 | printf( | ||
| 1791 | " %s\n", | ||
| 1792 | _(" Proxy specified by --proxy overrides any proxy specified by environment variable.")); | ||
| 1778 | printf(" %s\n", _(" Curl uses port 1080 by default as port is not specified")); | 1793 | printf(" %s\n", _(" Curl uses port 1080 by default as port is not specified")); |
| 1779 | printf(" %s\n", _("HTTPS_PROXY=http://192.168.100.35:3128 ./check_curl -H www.monitoring-plugins.org --ssl")); | 1794 | printf(" %s\n", _("HTTPS_PROXY=http://192.168.100.35:3128 ./check_curl -H " |
| 1795 | "www.monitoring-plugins.org --ssl")); | ||
| 1780 | printf(" %s\n", _(" HTTPS_PROXY is read as --ssl is toggled")); | 1796 | printf(" %s\n", _(" HTTPS_PROXY is read as --ssl is toggled")); |
| 1781 | printf(" %s\n", _("./check_curl -H www.monitoring-plugins.org --proxy socks5h://192.168.122.21")); | 1797 | printf(" %s\n", |
| 1782 | printf(" %s\n", _("./check_curl -H www.monitoring-plugins.org -x http://unused.proxy.com --noproxy '*'")); | 1798 | _("./check_curl -H www.monitoring-plugins.org --proxy socks5h://192.168.122.21")); |
| 1799 | printf( | ||
| 1800 | " %s\n", | ||
| 1801 | _("./check_curl -H www.monitoring-plugins.org -x http://unused.proxy.com --noproxy '*'")); | ||
| 1783 | printf(" %s\n", _(" Disabled proxy for all hosts by using '*' in no_proxy .")); | 1802 | printf(" %s\n", _(" Disabled proxy for all hosts by using '*' in no_proxy .")); |
| 1784 | printf(" %s\n", _("NO_PROXY=www.monitoring-plugins.org ./check_curl -H www.monitoring-plugins.org -x http://unused.proxy.com")); | 1803 | printf(" %s\n", _("NO_PROXY=www.monitoring-plugins.org ./check_curl -H " |
| 1804 | "www.monitoring-plugins.org -x http://unused.proxy.com")); | ||
| 1785 | printf(" %s\n", _(" Exact matches with the hostname/address work.")); | 1805 | printf(" %s\n", _(" Exact matches with the hostname/address work.")); |
| 1786 | printf(" %s\n", _("no_proxy=192.168.178.0/24 ./check_curl -I 192.168.178.10 -x http://proxy.acme.org")); | 1806 | printf(" %s\n", |
| 1787 | printf(" %s\n", _("no_proxy=acme.org ./check_curl -H nonpublic.internalwebapp.acme.org -x http://proxy.acme.org")); | 1807 | _("no_proxy=192.168.178.0/24 ./check_curl -I 192.168.178.10 -x http://proxy.acme.org")); |
| 1788 | printf(" %s\n", _(" Do not use proxy when accessing internal domains/addresses, but use a default proxy when accessing public web.")); | 1808 | printf(" %s\n", _("no_proxy=acme.org ./check_curl -H nonpublic.internalwebapp.acme.org -x " |
| 1789 | printf(" %s\n", _(" IMPORTANT: Check_curl can not always determine whether itself or the proxy will " | 1809 | "http://proxy.acme.org")); |
| 1790 | "resolve a hostname before sending a request and getting an answer." | 1810 | printf(" %s\n", _(" Do not use proxy when accessing internal domains/addresses, but use a " |
| 1791 | "This can lead to DNS resolvation issues if hostname is only resolvable over proxy.")); | 1811 | "default proxy when accessing public web.")); |
| 1812 | printf(" %s\n", | ||
| 1813 | _(" IMPORTANT: Check_curl can not always determine whether itself or the proxy will " | ||
| 1814 | "resolve a hostname before sending a request and getting an answer." | ||
| 1815 | "This can lead to DNS resolvation issues if hostname is only resolvable over proxy.")); | ||
| 1792 | printf(" %s\n", _("Legacy proxy requests in check_http style still work:")); | 1816 | printf(" %s\n", _("Legacy proxy requests in check_http style still work:")); |
| 1793 | printf(" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u http://www.monitoring-plugins.org/ " | 1817 | printf(" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u http://www.monitoring-plugins.org/ " |
| 1794 | "-H www.monitoring-plugins.org")); | 1818 | "-H www.monitoring-plugins.org")); |
| @@ -1843,7 +1867,7 @@ void print_usage(void) { | |||
| 1843 | void print_curl_version(void) { printf("%s\n", curl_version()); } | 1867 | void print_curl_version(void) { printf("%s\n", curl_version()); } |
| 1844 | 1868 | ||
| 1845 | #ifdef LIBCURL_FEATURE_SSL | 1869 | #ifdef LIBCURL_FEATURE_SSL |
| 1846 | # ifndef USE_OPENSSL | 1870 | # ifndef MOPL_USE_OPENSSL |
| 1847 | time_t parse_cert_date(const char *s) { | 1871 | time_t parse_cert_date(const char *s) { |
| 1848 | if (!s) { | 1872 | if (!s) { |
| 1849 | return -1; | 1873 | return -1; |
| @@ -1860,11 +1884,11 @@ time_t parse_cert_date(const char *s) { | |||
| 1860 | 1884 | ||
| 1861 | return date; | 1885 | return date; |
| 1862 | } | 1886 | } |
| 1863 | # endif /* USE_OPENSSL */ | 1887 | # endif /* MOPL_USE_OPENSSL */ |
| 1864 | #endif /* LIBCURL_FEATURE_SSL */ | 1888 | #endif /* LIBCURL_FEATURE_SSL */ |
| 1865 | 1889 | ||
| 1866 | #ifdef LIBCURL_FEATURE_SSL | 1890 | #ifdef LIBCURL_FEATURE_SSL |
| 1867 | # ifndef USE_OPENSSL | 1891 | # ifndef MOPL_USE_OPENSSL |
| 1868 | /* TODO: this needs cleanup in the sslutils.c, maybe we the #else case to | 1892 | /* TODO: this needs cleanup in the sslutils.c, maybe we the #else case to |
| 1869 | * OpenSSL could be this function | 1893 | * OpenSSL could be this function |
| 1870 | */ | 1894 | */ |
| @@ -2001,5 +2025,5 @@ int net_noopenssl_check_certificate(cert_ptr_union *cert_ptr, int days_till_exp_ | |||
| 2001 | } | 2025 | } |
| 2002 | return status; | 2026 | return status; |
| 2003 | } | 2027 | } |
| 2004 | # endif /* USE_OPENSSL */ | 2028 | # endif /* MOPL_USE_OPENSSL */ |
| 2005 | #endif /* LIBCURL_FEATURE_SSL */ | 2029 | #endif /* LIBCURL_FEATURE_SSL */ |
