1 files changed, 47 insertions, 18 deletions

diff --git a/plugins/check_curl.c b/plugins/check_curl.c
index e3e514ff..1dec8a2a 100644
--- a/plugins/check_curl.c
+++ b/plugins/check_curl.c
@@ -92,16 +92,16 @@ typedef struct {
 static check_curl_config_wrapper process_arguments(int /*argc*/, char ** /*argv*/);
 
 static mp_subcheck check_http(check_curl_config /*config*/, check_curl_working_state workingState,
-                                                          int redir_depth);
+                                                          long redir_depth);
 
 typedef struct {
-        int redir_depth;
+        long redir_depth;
         check_curl_working_state working_state;
         int error_code;
         check_curl_global_state curl_state;
 } redir_wrapper;
 static redir_wrapper redir(curlhelp_write_curlbuf * /*header_buf*/, check_curl_config /*config*/,
-                                                   int redir_depth, check_curl_working_state working_state);
+                                                   long redir_depth, check_curl_working_state working_state);
 
 static void print_help(void);
 void print_usage(void);
@@ -198,7 +198,7 @@ CURLcode sslctxfun(CURL *curl, SSL_CTX *sslctx, void *parm) {
 #endif     /* HAVE_SSL */
 
 mp_subcheck check_http(const check_curl_config config, check_curl_working_state workingState,
-                                           int redir_depth) {
+                                           long redir_depth) {
 
         // =======================
         // Initialisation for curl
@@ -441,19 +441,19 @@ mp_subcheck check_http(const check_curl_config config, check_curl_working_state
                                                 "CURLINFO_REDIRECT_COUNT");
 
                                         if (verbose >= 2) {
-                                                printf(_("* curl LIBINFO_REDIRECT_COUNT is %d\n"), redir_depth);
+                                                printf(_("* curl LIBINFO_REDIRECT_COUNT is %ld\n"), redir_depth);
                                         }
 
                                         mp_subcheck sc_redir_depth = mp_subcheck_init();
                                         if (redir_depth > config.max_depth) {
                                                 xasprintf(&sc_redir_depth.output,
-                                                                  "maximum redirection depth %d exceeded in libcurl",
+                                                                  "maximum redirection depth %ld exceeded in libcurl",
                                                                   config.max_depth);
                                                 sc_redir_depth = mp_set_subcheck_state(sc_redir_depth, STATE_CRITICAL);
                                                 mp_add_subcheck_to_subcheck(&sc_result, sc_redir_depth);
                                                 return sc_result;
                                         }
-                                        xasprintf(&sc_redir_depth.output, "redirection depth %d (of a maximum %d)",
+                                        xasprintf(&sc_redir_depth.output, "redirection depth %ld (of a maximum %ld)",
                                                           redir_depth, config.max_depth);
                                         mp_add_subcheck_to_subcheck(&sc_result, sc_redir_depth);
 
@@ -653,7 +653,7 @@ char *uri_string(const UriTextRangeA range, char *buf, size_t buflen) {
 }
 
 redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config config,
-                                        int redir_depth, check_curl_working_state working_state) {
+                                        long redir_depth, check_curl_working_state working_state) {
         curlhelp_statusline status_line;
         struct phr_header headers[255];
         size_t msglen;
@@ -678,7 +678,7 @@ redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config
         }
 
         if (++redir_depth > config.max_depth) {
-                die(STATE_WARNING, _("HTTP WARNING - maximum redirection depth %d exceeded - %s\n"),
+                die(STATE_WARNING, _("HTTP WARNING - maximum redirection depth %ld exceeded - %s\n"),
                         config.max_depth, location);
         }
 
@@ -761,7 +761,7 @@ redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config
         }
 
         /* compose new path */
-        /* TODO: handle fragments and query part of URL */
+        /* TODO: handle fragments of URL */
         char *new_url = (char *)calloc(1, DEFAULT_BUFFER_SIZE);
         if (uri.pathHead) {
                 for (UriPathSegmentA *pathSegment = uri.pathHead; pathSegment;
@@ -772,6 +772,29 @@ redir_wrapper redir(curlhelp_write_curlbuf *header_buf, const check_curl_config
                 }
         }
 
+        /* missing components have null,null in their UriTextRangeA
+         * add query parameters if they exist.
+         */
+        if (uri.query.first && uri.query.afterLast) {
+                // Ensure we have space for '?' + query_str + '\0' ahead of time, instead of calling strncat
+                // twice
+                size_t current_len = strlen(new_url);
+                size_t remaining_space = DEFAULT_BUFFER_SIZE - current_len - 1;
+
+                const char *query_str = uri_string(uri.query, buf, DEFAULT_BUFFER_SIZE);
+                size_t query_str_len = strlen(query_str);
+
+                if (remaining_space >= query_str_len + 1) {
+                        strcat(new_url, "?");
+                        strcat(new_url, query_str);
+                } else {
+                        die(STATE_UNKNOWN,
+                                _("HTTP UNKNOWN - No space to add query part of size %zu to the buffer, buffer has "
+                                  "remaining size %zu"),
+                                query_str_len, current_len);
+                }
+        }
+
         if (working_state.serverPort == new_port &&
                 !strncmp(working_state.server_address, new_host, MAX_IPV4_HOSTLENGTH) &&
                 (working_state.host_name &&
@@ -1400,7 +1423,7 @@ check_curl_config_wrapper process_arguments(int argc, char **argv) {
                 }
 #endif /* LIBCURL_VERSION_NUM >= MAKE_LIBCURL_VERSION(7, 54, 0) */
                 if (verbose >= 2) {
-                        printf(_("* Set SSL/TLS version to %d\n"), result.config.curl_config.ssl_version);
+                        printf(_("* Set SSL/TLS version to %ld\n"), result.config.curl_config.ssl_version);
                 }
                 if (!specify_port) {
                         result.config.initial_config.serverPort = HTTPS_PORT;
@@ -1482,8 +1505,8 @@ void print_help(void) {
         printf(" %s\n", "-I, --IP-address=ADDRESS");
         printf("    %s\n",
                    "IP address or name (use numeric address if possible to bypass DNS lookup).");
-        printf("    %s\n",
-                     "This overwrites the network address of the target while leaving everything else (HTTP headers) as they are");
+        printf("    %s\n", "This overwrites the network address of the target while leaving everything "
+                                           "else (HTTP headers) as they are");
         printf(" %s\n", "-p, --port=INTEGER");
         printf("    %s", _("Port number (default: "));
         printf("%d)\n", HTTP_PORT);
@@ -1547,7 +1570,8 @@ void print_help(void) {
         printf("    %s\n", _("String to expect in the content"));
         printf(" %s\n", "-u, --url=PATH");
         printf("    %s\n", _("URL to GET or POST (default: /)"));
-        printf("    %s\n", _("This is the part after the address in a URL, so for \"https://example.com/index.html\" it would be '-u /index.html'"));
+        printf("    %s\n", _("This is the part after the address in a URL, so for "
+                                                 "\"https://example.com/index.html\" it would be '-u /index.html'"));
         printf(" %s\n", "-P, --post=STRING");
         printf("    %s\n", _("URL decoded http POST data"));
         printf(" %s\n",
@@ -1648,6 +1672,8 @@ void print_help(void) {
         printf(" %s\n", _("certificate matches the hostname of the server, or if the certificate"));
         printf(" %s\n", _("has a valid chain of trust to one of the locally installed CAs."));
         printf("\n");
+        printf(" %s\n", _("To also verify certificates, please set --verify-cert."));
+        printf("\n");
         printf("%s\n", _("Examples:"));
         printf(" %s\n\n", "CHECK CONTENT: check_curl -w 5 -c 10 --ssl -H www.verisign.com");
         printf(" %s\n", _("When the 'www.verisign.com' server returns its content within 5 seconds,"));
@@ -1657,16 +1683,18 @@ void print_help(void) {
                    _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
         printf(" %s\n", _("a STATE_CRITICAL will be returned."));
         printf("\n");
-        printf(" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 14");
+        printf(" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 14 -D");
         printf(" %s\n",
                    _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
         printf(" %s\n",
                    _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
         printf(" %s\n",
                    _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
-        printf(" %s\n\n", _("the certificate is expired."));
+        printf(" %s\n", _("the certificate is expired."));
+        printf("\n");
+        printf(" %s\n", _("The -D flag enforces a certificate validation beyond expiration time."));
         printf("\n");
-        printf(" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 30,14");
+        printf(" %s\n\n", "CHECK CERTIFICATE: check_curl -H www.verisign.com -C 30,14 -D");
         printf(" %s\n",
                    _("When the certificate of 'www.verisign.com' is valid for more than 30 days,"));
         printf(" %s\n",
@@ -1689,7 +1717,8 @@ void print_help(void) {
         printf(" %s\n", _("It is recommended to use an environment proxy like:"));
         printf(" %s\n",
                    _("https_proxy=http://192.168.100.35:3128 ./check_curl -H www.verisign.com -S"));
-        printf(" %s\n", _("legacy proxy requests in check_http style might still work, but are frowned upon, so DONT:"));
+        printf(" %s\n", _("legacy proxy requests in check_http style might still work, but are frowned "
+                                          "upon, so DONT:"));
         printf(" %s\n", _("check_curl -I 192.168.100.35 -p 3128 -u https://www.verisign.com/ -S -j "
                                           "CONNECT -H www.verisign.com "));
         printf(" %s\n", _("all these options are needed: -I <proxy> -p <proxy-port> -u <check-url> "