3 files changed, 489 insertions, 24 deletions

diff --git a/plugins/check_curl.d/check_curl_helpers.c b/plugins/check_curl.d/check_curl_helpers.c
index e4e7bef6..4372dc0b 100644
--- a/plugins/check_curl.d/check_curl_helpers.c
+++ b/plugins/check_curl.d/check_curl_helpers.c
@@ -3,8 +3,11 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <netdb.h>
+#include <stdint.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/socket.h>
 #include "../utils.h"
 #include "check_curl.d/config.h"
 #include "output.h"
@@ -19,7 +22,7 @@ bool add_sslctx_verify_fun = false;
 check_curl_configure_curl_wrapper
 check_curl_configure_curl(const check_curl_static_curl_config config,
                                                   check_curl_working_state working_state, bool check_cert,
-                                                  bool on_redirect_dependent, int follow_method, int max_depth) {
+                                                  bool on_redirect_dependent, int follow_method, long max_depth) {
         check_curl_configure_curl_wrapper result = {
                 .errorcode = OK,
                 .curl_state =
@@ -57,7 +60,7 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
         result.curl_state.curl_easy_initialized = true;
 
         if (verbose >= 1) {
-                handle_curl_option_return_code(curl_easy_setopt(result.curl_state.curl, CURLOPT_VERBOSE, 1),
+                handle_curl_option_return_code(curl_easy_setopt(result.curl_state.curl, CURLOPT_VERBOSE, 1L),
                                                                            "CURLOPT_VERBOSE");
         }
 
@@ -116,6 +119,107 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
                 curl_easy_setopt(result.curl_state.curl, CURLOPT_TIMEOUT, config.socket_timeout),
                 "CURLOPT_TIMEOUT");
 
+        /* set proxy */
+        /* http(s) proxy can either be given from the command line, or taken from environment variables */
+        /* socks4(a) / socks5(h) proxy should be given using the command line */
+
+        /* first source to check is the environment variables */
+        /* lower case proxy environment variables are almost always accepted, while some programs also checking
+        uppercase ones. discover both, but take the lowercase one if both are present */
+
+        /* extra information: libcurl does not discover the uppercase version HTTP_PROXY due to security reasons */
+        /* https://github.com/curl/curl/blob/d445f2d930ae701039518d695481ee53b8490521/lib/url.c#L1987 */
+
+        /* first environment variable to read is all_proxy. it can be overridden by protocol specific environment variables */
+        char *all_proxy_env, *all_proxy_uppercase_env;
+        all_proxy_env = getenv("all_proxy");
+        all_proxy_uppercase_env = getenv("ALL_PROXY");
+        if (all_proxy_env != NULL && strlen(all_proxy_env)){
+                working_state.curlopt_proxy = strdup(all_proxy_env);
+                if (all_proxy_uppercase_env != NULL && verbose >= 1) {
+                        printf("* cURL ignoring environment variable 'ALL_PROXY' as 'all_proxy' is set\n");
+                }
+        } else if (all_proxy_uppercase_env != NULL && strlen(all_proxy_uppercase_env) > 0) {
+                working_state.curlopt_proxy = strdup(all_proxy_uppercase_env);
+        }
+
+        /* second environment variable to read is http_proxy. only set curlopt_proxy if ssl is not toggled */
+        char *http_proxy_env, *http_proxy_uppercase_env;
+        http_proxy_env = getenv("http_proxy");
+        http_proxy_uppercase_env = getenv("HTTP_PROXY");
+        if (!working_state.use_ssl){
+                if (http_proxy_env != NULL && strlen(http_proxy_env) > 0) {
+                        working_state.curlopt_proxy = strdup(http_proxy_env);
+                        if (http_proxy_uppercase_env != NULL && verbose >= 1) {
+                                printf("* cURL ignoring environment variable 'HTTP_PROXY' as 'http_proxy' is set\n");
+                        }
+                } else if (http_proxy_uppercase_env != NULL && strlen(http_proxy_uppercase_env) > 0) {
+                        working_state.curlopt_proxy = strdup(http_proxy_uppercase_env);
+                }
+        }
+#ifdef LIBCURL_FEATURE_SSL
+        /* optionally read https_proxy environment variable and set curlopt_proxy if ssl is toggled */
+        char *https_proxy_env, *https_proxy_uppercase_env;
+        https_proxy_env = getenv("https_proxy");
+        https_proxy_uppercase_env = getenv("HTTPS_PROXY");
+        if (working_state.use_ssl) {
+                if (https_proxy_env != NULL && strlen(https_proxy_env) > 0) {
+                        working_state.curlopt_proxy = strdup(https_proxy_env);
+                        if (https_proxy_uppercase_env != NULL && verbose >= 1) {
+                                printf("* cURL ignoring environment variable 'HTTPS_PROXY' as 'https_proxy' is set\n");
+                        }
+                }
+                else if (https_proxy_uppercase_env != NULL && strlen(https_proxy_uppercase_env) >= 0) {
+                        working_state.curlopt_proxy = strdup(https_proxy_uppercase_env);
+                }
+        }
+#endif /* LIBCURL_FEATURE_SSL */
+
+        /* second source to check for proxies is command line argument, overwriting the environment variables */
+        if (strlen(config.proxy) > 0) {
+                working_state.curlopt_proxy = strdup(config.proxy);
+        }
+
+        if (working_state.curlopt_proxy != NULL && strlen(working_state.curlopt_proxy)){
+                handle_curl_option_return_code(
+                        curl_easy_setopt(result.curl_state.curl, CURLOPT_PROXY, working_state.curlopt_proxy), "CURLOPT_PROXY");
+                if (verbose >= 1) {
+                        printf("* curl CURLOPT_PROXY: %s\n", working_state.curlopt_proxy);
+                }
+        }
+
+        /* set no_proxy */
+        /* first source to check is environment variables */
+        char *no_proxy_env, *no_proxy_uppercase_env;
+        no_proxy_env = getenv("no_proxy");
+        no_proxy_uppercase_env = getenv("NO_PROXY");
+        if (no_proxy_env != NULL && strlen(no_proxy_env)){
+                working_state.curlopt_noproxy = strdup(no_proxy_env);
+                if (no_proxy_uppercase_env != NULL && verbose >= 1){
+                        printf("* cURL ignoring environment variable 'NO_PROXY' as 'no_proxy' is set\n");
+                }
+        }else if (no_proxy_uppercase_env != NULL && strlen(no_proxy_uppercase_env) > 0){
+                working_state.curlopt_noproxy = strdup(no_proxy_uppercase_env);
+        }
+
+        /* second source to check for no_proxy is command line argument, overwriting the environment variables */
+        if (strlen(config.no_proxy) > 0) {
+                working_state.curlopt_noproxy = strdup(config.no_proxy);
+        }
+
+        if ( working_state.curlopt_noproxy != NULL && strlen(working_state.curlopt_noproxy)){
+                handle_curl_option_return_code(
+                        curl_easy_setopt(result.curl_state.curl, CURLOPT_NOPROXY, working_state.curlopt_noproxy), "CURLOPT_NOPROXY");
+                if (verbose >= 1) {
+                        printf("* curl CURLOPT_NOPROXY: %s\n", working_state.curlopt_noproxy);
+                }
+        }
+
+        int proxy_resolves_hostname = determine_hostname_resolver(working_state, config);
+        if (verbose >= 1) {
+                printf("* proxy_resolves_hostname: %d\n", proxy_resolves_hostname);
+        }
+
         /* enable haproxy protocol */
         if (config.haproxy_protocol) {
                 handle_curl_option_return_code(
@@ -123,11 +227,11 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
                         "CURLOPT_HAPROXYPROTOCOL");
         }
 
-        // fill dns resolve cache to make curl connect to the given server_address instead of the
-        // host_name, only required for ssl, because we use the host_name later on to make SNI happy
+        /* fill dns resolve cache to make curl connect to the given server_address instead of the */
+        /* host_name, only required for ssl, because we use the host_name later on to make SNI happy */
         char dnscache[DEFAULT_BUFFER_SIZE];
         char addrstr[DEFAULT_BUFFER_SIZE / 2];
-        if (working_state.use_ssl && working_state.host_name != NULL) {
+        if (working_state.use_ssl && working_state.host_name != NULL && !proxy_resolves_hostname ) {
                 char *tmp_mod_address;
 
                 /* lookup_host() requires an IPv6 address without the brackets. */
@@ -214,10 +318,10 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
         if (working_state.http_method) {
                 if (!strcmp(working_state.http_method, "POST")) {
                         handle_curl_option_return_code(
-                                curl_easy_setopt(result.curl_state.curl, CURLOPT_POST, 1), "CURLOPT_POST");
+                                curl_easy_setopt(result.curl_state.curl, CURLOPT_POST, 1L), "CURLOPT_POST");
                 } else if (!strcmp(working_state.http_method, "PUT")) {
                         handle_curl_option_return_code(
-                                curl_easy_setopt(result.curl_state.curl, CURLOPT_UPLOAD, 1), "CURLOPT_UPLOAD");
+                                curl_easy_setopt(result.curl_state.curl, CURLOPT_UPLOAD, 1L), "CURLOPT_UPLOAD");
                 } else {
                         handle_curl_option_return_code(curl_easy_setopt(result.curl_state.curl,
                                                                                                                         CURLOPT_CUSTOMREQUEST,
@@ -300,10 +404,10 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
                 /* per default if we have a CA verify both the peer and the
                  * hostname in the certificate, can be switched off later */
                 handle_curl_option_return_code(
-                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYPEER, 1),
+                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYPEER, 1L),
                         "CURLOPT_SSL_VERIFYPEER");
                 handle_curl_option_return_code(
-                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYHOST, 2),
+                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYHOST, 2L),
                         "CURLOPT_SSL_VERIFYHOST");
         } else {
                 /* backward-compatible behaviour, be tolerant in checks
@@ -311,10 +415,10 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
                  * to be less tolerant about ssl verfications
                  */
                 handle_curl_option_return_code(
-                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYPEER, 0),
+                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYPEER, 0L),
                         "CURLOPT_SSL_VERIFYPEER");
                 handle_curl_option_return_code(
-                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYHOST, 0),
+                        curl_easy_setopt(result.curl_state.curl, CURLOPT_SSL_VERIFYHOST, 0L),
                         "CURLOPT_SSL_VERIFYHOST");
         }
 
@@ -438,7 +542,7 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
         if (on_redirect_dependent) {
                 if (follow_method == FOLLOW_LIBCURL) {
                         handle_curl_option_return_code(
-                                curl_easy_setopt(result.curl_state.curl, CURLOPT_FOLLOWLOCATION, 1),
+                                curl_easy_setopt(result.curl_state.curl, CURLOPT_FOLLOWLOCATION, 1L),
                                 "CURLOPT_FOLLOWLOCATION");
 
                         /* default -1 is infinite, not good, could lead to zombie plugins!
@@ -474,7 +578,7 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
         }
         /* no-body */
         if (working_state.no_body) {
-                handle_curl_option_return_code(curl_easy_setopt(result.curl_state.curl, CURLOPT_NOBODY, 1),
+                handle_curl_option_return_code(curl_easy_setopt(result.curl_state.curl, CURLOPT_NOBODY, 1L),
                                                                            "CURLOPT_NOBODY");
         }
 
@@ -488,7 +592,7 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
                         curl_easy_setopt(result.curl_state.curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4),
                         "CURLOPT_IPRESOLVE(CURL_IPRESOLVE_V4)");
         }
-#if defined(USE_IPV6) && defined(LIBCURL_FEATURE_IPV6)
+#if defined(LIBCURL_FEATURE_IPV6)
         else if (config.sin_family == AF_INET6) {
                 handle_curl_option_return_code(
                         curl_easy_setopt(result.curl_state.curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6),
@@ -562,7 +666,7 @@ check_curl_configure_curl(const check_curl_static_curl_config config,
 
 void handle_curl_option_return_code(CURLcode res, const char *option) {
         if (res != CURLE_OK) {
-                die(STATE_CRITICAL, _("Error while setting cURL option '%s': cURL returned %d - %s"),
+                die(STATE_CRITICAL, _("Error while setting cURL option '%s': cURL returned %d - %s\n"),
                         option, res, curl_easy_strerror(res));
         }
 }
@@ -589,6 +693,8 @@ check_curl_working_state check_curl_working_state_init() {
                 .serverPort = HTTP_PORT,
                 .use_ssl = false,
                 .no_body = false,
+                .curlopt_proxy = NULL,
+                .curlopt_noproxy = NULL,
         };
         return result;
 }
@@ -612,6 +718,8 @@ check_curl_config check_curl_config_init() {
                                 .ca_cert = NULL,
                                 .verify_peer_and_host = false,
                                 .user_agent = {'\0'},
+                                .proxy = "",
+                                .no_proxy = "",
                                 .proxy_auth = "",
                                 .user_auth = "",
                                 .http_content_type = NULL,
@@ -796,15 +904,17 @@ mp_subcheck check_document_dates(const curlhelp_write_curlbuf *header_buf, const
                                                   ((float)last_modified) / (60 * 60 * 24));
                                 sc_document_dates = mp_set_subcheck_state(sc_document_dates, STATE_CRITICAL);
                         } else {
-                                xasprintf(&sc_document_dates.output, _("Last modified %ld:%02ld:%02ld ago"),
-                                                  last_modified / (60 * 60), (last_modified / 60) % 60, last_modified % 60);
+                                xasprintf(&sc_document_dates.output, _("Last modified %lld:%02d:%02d ago"),
+                                                  (long long)last_modified / (60 * 60), (int)(last_modified / 60) % 60,
+                                                  (int)last_modified % 60);
                                 sc_document_dates = mp_set_subcheck_state(sc_document_dates, STATE_CRITICAL);
                         }
                 } else {
                         // TODO is this the OK case?
                         time_t last_modified = (srv_data - doc_data);
-                        xasprintf(&sc_document_dates.output, _("Last modified %ld:%02ld:%02ld ago"),
-                                          last_modified / (60 * 60), (last_modified / 60) % 60, last_modified % 60);
+                        xasprintf(&sc_document_dates.output, _("Last modified %lld:%02d:%02d ago"),
+                                          (long long)last_modified / (60 * 60), (int)(last_modified / 60) % 60,
+                                          (int)last_modified % 60);
                         sc_document_dates = mp_set_subcheck_state(sc_document_dates, STATE_OK);
                 }
         }
@@ -1212,7 +1322,7 @@ mp_subcheck check_curl_certificate_checks(CURL *curl, X509 *cert, int warn_days_
 
                 cert_ptr_union cert_ptr = {0};
                 cert_ptr.to_info = NULL;
-                CURLcode res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &cert_ptr.to_info);
+                CURLcode res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &cert_ptr.to_certinfo);
                 if (!res && cert_ptr.to_info) {
 #       ifdef USE_OPENSSL
                         /* We have no OpenSSL in libcurl, but we can use OpenSSL for X509 cert
@@ -1293,3 +1403,342 @@ char *fmt_url(check_curl_working_state workingState) {
 
         return url;
 }
+
+int determine_hostname_resolver(const check_curl_working_state working_state, const check_curl_static_curl_config config){
+        char *host_name_display = "NULL";
+        unsigned long host_name_len = 0;
+        if( working_state.host_name){
+                host_name_len = strlen(working_state.host_name);
+                host_name_display = working_state.host_name;
+        }
+
+        /* IPv4 or IPv6 version of the address */
+        char *server_address_clean = strdup(working_state.server_address);
+        /* server address might be a full length ipv6 address encapsulated in square brackets */
+        if ((strnlen(working_state.server_address, MAX_IPV4_HOSTLENGTH) > 2) && (working_state.server_address[0] == '[') && (working_state.server_address[strlen(working_state.server_address)-1] == ']') ) {
+                server_address_clean = strndup( working_state.server_address + 1, strlen(working_state.server_address) - 2);
+        }
+
+        /* check curlopt_noproxy option first */
+        /* https://curl.se/libcurl/c/CURLOPT_NOPROXY.html */
+
+        /* curlopt_noproxy is specified as a comma separated list of
+        direct IPv4 or IPv6 addresses e.g 130.133.8.40, 2001:4860:4802:32::a ,
+        IPv4 or IPv6 CIDR regions e.g 10.241.0.0/16 , abcd:ef01:2345::/48 ,
+        direct hostnames e.g example.com, google.de */
+
+        if (working_state.curlopt_noproxy != NULL){
+                char* curlopt_noproxy_copy = strdup( working_state.curlopt_noproxy);
+                char* noproxy_item = strtok(curlopt_noproxy_copy, ",");
+                while(noproxy_item != NULL){
+                        unsigned long noproxy_item_len = strlen(noproxy_item);
+
+                        /* According to the CURLOPT_NOPROXY documentation: */
+                        /* https://curl.se/libcurl/c/CURLOPT_NOPROXY.html */
+                        /* The only wildcard available is a single * character, which matches all hosts, and effectively disables the proxy. */
+                        if ( strlen(noproxy_item) == 1 && noproxy_item[0] == '*'){
+                                if (verbose >= 1){
+                                        printf("* noproxy includes '*' which disables proxy for all host name incl. : %s / server address incl. : %s\n", host_name_display , server_address_clean);
+                                }
+                                free(curlopt_noproxy_copy);
+                                free(server_address_clean);
+                                return 0;
+                        }
+
+                        /* direct comparison with the server_address */
+                        if( server_address_clean != NULL && strlen(server_address_clean) == strlen(noproxy_item) && strcmp(server_address_clean, noproxy_item) == 0){
+                                if (verbose >= 1){
+                                        printf("* server_address is in the no_proxy list: %s\n", noproxy_item);
+                                }
+                                free(curlopt_noproxy_copy);
+                                free(server_address_clean);
+                                return 0;
+                        }
+
+                        /* direct comparison with the host_name */
+                        if( working_state.host_name != NULL && host_name_len == noproxy_item_len && strcmp(working_state.host_name, noproxy_item) == 0){
+                                if (verbose >= 1){
+                                        printf("* host_name is in the no_proxy list: %s\n", noproxy_item);
+                                }
+                                free(curlopt_noproxy_copy);
+                                free(server_address_clean);
+                                return 0;
+                        }
+
+                        /* check if hostname is a subdomain of the item, e.g www.example.com when token is example.com */
+                        /* subdomain1.acme.com will not will use a proxy if you only specify 'acme' in the noproxy */
+                        /* check if noproxy_item is a suffix */
+                        /* check if the character just before the suffix is '.' */
+                        if( working_state.host_name != NULL && host_name_len > noproxy_item_len){
+                                unsigned long suffix_start_idx = host_name_len - noproxy_item_len;
+                                if (strcmp(working_state.host_name + suffix_start_idx, noproxy_item ) == 0 && working_state.host_name[suffix_start_idx-1] == '.' ){
+                                        if (verbose >= 1){
+                                                printf("* host_name: %s is a subdomain of the no_proxy list item: %s\n", working_state.host_name , noproxy_item);
+                                        }
+                                        free(curlopt_noproxy_copy);
+                                        free(server_address_clean);
+                                        return 0;
+                                }
+                        }
+
+                        // noproxy_item could be a CIDR IP range
+                        if( server_address_clean != NULL && strlen(server_address_clean)){
+
+                                int ip_addr_inside_cidr_ret = ip_addr_inside_cidr(noproxy_item, server_address_clean);
+
+                                switch(ip_addr_inside_cidr_ret){
+                                case 1:
+                                        return 0;
+                                        break;
+                                case 0:
+                                        if(verbose >= 1){
+                                                printf("server address: %s is not inside IP cidr: %s\n", server_address_clean, noproxy_item);
+                                        }
+                                        break;
+                                case -1:
+                                        if(verbose >= 1){
+                                                printf("could not fully determine if server address: %s is inside the IP cidr: %s\n", server_address_clean, noproxy_item);
+                                        }
+                                        break;
+                                }
+                        }
+
+                        noproxy_item = strtok(NULL, ",");
+                }
+
+                free(curlopt_noproxy_copy);
+        }
+
+        if (working_state.curlopt_proxy != NULL){
+                // Libcurl documentation
+                // Setting the proxy string to "" (an empty string) explicitly disables the use of a proxy, even if there is an environment variable set for it.
+                if ( strlen(working_state.curlopt_proxy) == 0){
+                        return 0;
+                }
+
+                if ( strncmp( working_state.curlopt_proxy, "http://", 7) == 0){
+                        if (verbose >= 1){
+                                printf("* proxy scheme is http, proxy: %s resolves host: %s or server_address: %s\n", working_state.curlopt_proxy, host_name_display, server_address_clean);
+                        }
+                        free(server_address_clean);
+                        return 1;
+                }
+
+                if ( strncmp( working_state.curlopt_proxy, "https://", 8) == 0){
+                        if (verbose >= 1){
+                                printf("* proxy scheme is https, proxy: %s resolves host: %s or server_address: %s\n", working_state.curlopt_proxy, host_name_display, server_address_clean);
+                        }
+                        free(server_address_clean);
+                        return 1;
+                }
+
+                if ( strncmp( working_state.curlopt_proxy, "socks4://", 9) == 0){
+                        if (verbose >= 1){
+                                printf("* proxy scheme is socks, proxy: %s does not resolve host: %s or server_address: %s\n", working_state.curlopt_proxy, host_name_display, server_address_clean);
+                        }
+                        free(server_address_clean);
+                        return 0;
+                }
+
+                if ( strncmp( working_state.curlopt_proxy, "socks4a://", 10) == 0){
+                        if (verbose >= 1){
+                                printf("* proxy scheme is socks4a, proxy: %s resolves host: %s or server_address: %s\n", working_state.curlopt_proxy, host_name_display, server_address_clean);
+                        }
+                        free(server_address_clean);
+                        return 1;
+                }
+
+                if ( strncmp( working_state.curlopt_proxy, "socks5://", 9) == 0){
+                        if (verbose >= 1){
+                                printf("* proxy scheme is socks5, proxy: %s does not resolve host: %s or server_address: %s\n", working_state.curlopt_proxy, host_name_display, server_address_clean);
+                        }
+                        free(server_address_clean);
+                        return 0;
+                }
+
+                if ( strncmp( working_state.curlopt_proxy, "socks5h://", 10) == 0){
+                        if (verbose >= 1){
+                                printf("* proxy scheme is socks5h, proxy: %s resolves host: %s or server_address: %s\n", working_state.curlopt_proxy, host_name_display, server_address_clean);
+                        }
+                        free(server_address_clean);
+                        return 1;
+                }
+
+                // Libcurl documentation:
+                // Without a scheme prefix, CURLOPT_PROXYTYPE can be used to specify which kind of proxy the string identifies.
+                // We do not set this value
+                // Without a scheme, it is treated as an http proxy
+
+                return 1;
+        }
+
+        if (verbose >= 1){
+                printf("* proxy scheme is unknown/unavailable, no proxy is assumed for host: %s or server_address: %s\n", host_name_display, server_address_clean);
+        }
+
+        free(server_address_clean);
+        return 0;
+}
+
+int ip_addr_inside_cidr(const char* cidr_region_or_ip_addr, const char* target_ip){
+        unsigned int slash_count = 0;
+        unsigned int last_slash_idx = 0;
+        for(size_t i = 0; i < strlen(cidr_region_or_ip_addr); i++){
+                if(cidr_region_or_ip_addr[i] == '/'){
+                        slash_count++;
+                        last_slash_idx = (unsigned int)i;
+                }
+        }
+
+        char *cidr_ip_part = NULL;
+        int prefix_length = 0;
+
+        if (slash_count == 0) {
+                cidr_ip_part = strdup(cidr_region_or_ip_addr);
+                if (!cidr_ip_part) return -1;
+        } else if (slash_count == 1) {
+                cidr_ip_part = strndup(cidr_region_or_ip_addr, last_slash_idx);
+                if (!cidr_ip_part) return -1;
+
+                errno = 0;
+                long long tmp = strtoll(cidr_region_or_ip_addr + last_slash_idx + 1, NULL, 10);
+                if (errno == ERANGE) {
+                        if (verbose >= 1) {
+                                printf("cidr_region_or_ip: %s , could not parse subnet length\n", cidr_region_or_ip_addr);
+                        }
+                        free(cidr_ip_part);
+                        return -1;
+                }
+                prefix_length = (int)tmp;
+        } else {
+                printf("cidr_region_or_ip: %s , has %d number of '/' characters, is not a valid cidr_region or IP\n", cidr_region_or_ip_addr, slash_count);
+                return -1;
+        }
+
+        int cidr_addr_family, target_addr_family;
+        if (strchr(cidr_ip_part, ':')){
+                cidr_addr_family = AF_INET6;
+        } else {
+                cidr_addr_family = AF_INET;
+        }
+
+        if (strchr(target_ip, ':')){
+                target_addr_family = AF_INET6;
+        } else {
+                target_addr_family = AF_INET;
+        }
+
+        if (cidr_addr_family != target_addr_family){
+                if (verbose >= 1){
+                        printf("cidr address: %s and target ip address: %s have different address families\n", cidr_ip_part, target_ip);
+                }
+                free(cidr_ip_part);
+                return 0;
+        }
+
+        // If no prefix is given, treat the cidr as a single address (full-length prefix)
+        if (slash_count == 0) {
+                prefix_length = (cidr_addr_family == AF_INET) ? 32 : 128;
+        }
+
+        int max_bits = (cidr_addr_family == AF_INET) ? 32u : 128u;
+        if (prefix_length < 0 || prefix_length > max_bits) {
+                if (verbose >= 1) {
+                        printf("cidr_region_or_ip: %s has invalid prefix length: %u\n", cidr_region_or_ip_addr, prefix_length);
+                }
+                free(cidr_ip_part);
+                return -1;
+        }
+
+        if (verbose >= 1){
+                printf("cidr_region_or_ip: %s , has prefix length: %u\n", cidr_region_or_ip_addr, prefix_length);
+        }
+
+        int inet_pton_rc;
+        uint8_t *cidr_bytes = NULL;
+        uint8_t *target_bytes = NULL;
+        uint8_t cidr_buf[16];
+        uint8_t target_buf[16];
+        size_t total_bytes = 0;
+
+        if (cidr_addr_family == AF_INET) {
+                struct in_addr cidr_ipv4;
+                struct in_addr target_ipv4;
+                inet_pton_rc = inet_pton(AF_INET, cidr_ip_part, &cidr_ipv4);
+                if (inet_pton_rc != 1) {
+                        if (verbose >= 1) {
+                                printf("ip string: %s contains characters not valid for its address family: IPv4\n", cidr_ip_part);
+                        }
+                        free(cidr_ip_part);
+                        return -1;
+                }
+                inet_pton_rc = inet_pton(AF_INET, target_ip, &target_ipv4);
+                if (inet_pton_rc != 1) {
+                        if (verbose >= 1) {
+                                printf("ip string: %s contains characters not valid for its address family: IPv4\n", target_ip);
+                        }
+                        free(cidr_ip_part);
+                        return -1;
+                }
+                // copy the addresses in network byte order to a buffer for comparison
+                memcpy(cidr_buf, &cidr_ipv4.s_addr, 4);
+                memcpy(target_buf, &target_ipv4.s_addr, 4);
+                cidr_bytes = cidr_buf;
+                target_bytes = target_buf;
+                total_bytes = 4;
+        } else {
+                struct in6_addr cidr_ipv6;
+                struct in6_addr target_ipv6;
+                inet_pton_rc = inet_pton(AF_INET6, cidr_ip_part, &cidr_ipv6);
+                if (inet_pton_rc != 1) {
+                        if (verbose >= 1) {
+                                printf("ip string: %s contains characters not valid for its address family: IPv6\n", cidr_ip_part);
+                        }
+                        free(cidr_ip_part);
+                        return -1;
+                }
+                inet_pton_rc = inet_pton(AF_INET6, target_ip, &target_ipv6);
+                if (inet_pton_rc != 1) {
+                        if (verbose >= 1) {
+                                printf("ip string: %s contains characters not valid for its address family: IPv6\n", target_ip);
+                        }
+                        free(cidr_ip_part);
+                        return -1;
+                }
+                memcpy(cidr_buf, &cidr_ipv6, 16);
+                memcpy(target_buf, &target_ipv6, 16);
+                cidr_bytes = cidr_buf;
+                target_bytes = target_buf;
+                total_bytes = 16;
+        }
+
+        int prefix_bytes = prefix_length / 8;
+        int prefix_bits = prefix_length % 8;
+
+        if (prefix_bytes > 0) {
+                if (memcmp(cidr_bytes, target_bytes, (size_t)prefix_bytes) != 0) {
+                        if (verbose >= 1) {
+                                printf("the first %d bytes of the cidr_region_or_ip: %s and target_ip: %s are different\n", prefix_bytes, cidr_ip_part, target_ip);
+                        }
+                        free(cidr_ip_part);
+                        return 0;
+                }
+        }
+
+        if (prefix_bits != 0) {
+                uint8_t cidr_oct = cidr_bytes[prefix_bytes];
+                uint8_t target_oct = target_bytes[prefix_bytes];
+                // the mask has first prefix_bits bits 1, the rest as 0
+                uint8_t mask = (uint8_t)(0xFFu << (8 - prefix_bits));
+                if ((cidr_oct & mask) != (target_oct & mask)) {
+                        if (verbose >= 1) {
+                                printf("looking at the last %d bits of the prefix, cidr_region_or_ip(%s) byte is: %u and target_ip byte(%s) is: %u, applying bitmask: %02X returns different results\n", prefix_bits, cidr_ip_part, (unsigned)cidr_oct, target_ip, (unsigned)target_oct, mask);
+                        }
+                        free(cidr_ip_part);
+                        return 0;
+                }
+        }
+
+        free(cidr_ip_part);
+        return 1;
+}
diff --git a/plugins/check_curl.d/check_curl_helpers.h b/plugins/check_curl.d/check_curl_helpers.h
index e7b80f7e..cc47bf9d 100644
--- a/plugins/check_curl.d/check_curl_helpers.h
+++ b/plugins/check_curl.d/check_curl_helpers.h
@@ -80,7 +80,7 @@ check_curl_configure_curl_wrapper check_curl_configure_curl(check_curl_static_cu
                                                                                                                         check_curl_working_state working_state,
                                                                                                                         bool check_cert,
                                                                                                                         bool on_redirect_dependent,
-                                                                                                                        int follow_method, int max_depth);
+                                                                                                                        int follow_method, long max_depth);
 
 void handle_curl_option_return_code(CURLcode res, const char *option);
 
@@ -126,3 +126,12 @@ void test_file(char *path);
 mp_subcheck check_curl_certificate_checks(CURL *curl, X509 *cert, int warn_days_till_exp,
                                                                                   int crit_days_till_exp);
 char *fmt_url(check_curl_working_state workingState);
+
+
+/* function that will determine if the host or the proxy resolves the target hostname
+returns 0 if requester resolves the hostname locally, 1 if proxy resolves the hostname */
+int determine_hostname_resolver(const check_curl_working_state working_state, const check_curl_static_curl_config config);
+
+/* Checks if an IP is inside given CIDR region. Using /protocol_size or not specifying the prefix length performs an equality check. Supports both IPv4 and IPv6
+returns 1 if the target_ip address is inside the given cidr_region_or_ip_addr, 0 if its out. return codes < 0 mean an error has occurred. */
+int ip_addr_inside_cidr(const char* cidr_region_or_ip_addr, const char* target_ip);
diff --git a/plugins/check_curl.d/config.h b/plugins/check_curl.d/config.h
index f51b2ee9..bcdf3010 100644
--- a/plugins/check_curl.d/config.h
+++ b/plugins/check_curl.d/config.h
@@ -48,6 +48,11 @@ typedef struct {
 
         bool use_ssl;
         bool no_body;
+
+        /* curl CURLOPT_PROXY option will be set to this value if not NULL */
+        char *curlopt_proxy;
+        /* curl CURLOPT_NOPROXY option will be set to this value if not NULL */
+        char *curlopt_noproxy;
 } check_curl_working_state;
 
 check_curl_working_state check_curl_working_state_init();
@@ -57,14 +62,16 @@ typedef struct {
         bool haproxy_protocol;
         long socket_timeout;
         sa_family_t sin_family;
-        int curl_http_version;
+        long curl_http_version;
         char **http_opt_headers;
         size_t http_opt_headers_count;
-        int ssl_version;
+        long ssl_version;
         char *client_cert;
         char *client_privkey;
         char *ca_cert;
         bool verify_peer_and_host;
+        char proxy[DEFAULT_BUFFER_SIZE];
+        char no_proxy[DEFAULT_BUFFER_SIZE];
         char user_agent[DEFAULT_BUFFER_SIZE];
         char proxy_auth[MAX_INPUT_BUFFER];
         char user_auth[MAX_INPUT_BUFFER];
@@ -76,7 +83,7 @@ typedef struct {
         check_curl_working_state initial_config;
 
         check_curl_static_curl_config curl_config;
-        int max_depth;
+        long max_depth;
         int followmethod;
         int followsticky;