according to https://curl.se/libcurl/c/curl_easy_setopt.html, parameters
are either a long, a function pointer, an object pointer or a curl_off_t,
depending on what the option expects; curl 8.16 checks and warns about
these.
Include the -D flag for certificate verification in the "CHECK
CERTIFICATE" examples. Otherwise, only the certificate dates are
checked, but not if the certificate matches to the hostname or is signed
by a trusted CA.
Fixes#2146.
previously, the fragment was sent in the request from client, and the
server would parse and increment its value. the incremented value would
be set in the redirected URI.
this does not work as fragments are meaningless to servers and clients
like check_curl strip them in their GET request.
rewrite the fragment handling . if client sends a URI parameter with
'fragment' as its key, the server will set its value for its redirected
URI. it will come up both as a parameter and the fragment at the end.
use this new logic to rewrite the fragment redirection test. remove -p
$http_port argument on tests for this endpoint, which was making https
tests fail. correct the common test count from 75 to 95, as there are 20
total test assertions in the 8 times it uses the new endpoint. remove
unused code on that endpoint as well
If a SSL connection cannot be established, check_http bailed out with a
die function call with a NULL fmt string. This adds a more meaningful
message.
The motivation for this patch was to get everything from the OpenBSD
ports upstream. It seems like in the old days, this would have resulted
in a segfault.
b8a6b3cae5
However, even if "die" now checks for NULL, a human readable error is
nice to have.
On OpenBSD's "stdio.h", stdin, stdout, and stderr are not directly
FILE*, but #defines. Thus, naming the output struct fields stdout and
stderr resulted in compiler errors, after replacing the #define.
a762189c5e/include/stdio.h (L75-L77)
This library is glibc-only and not necessary at this point. The
getopt_long function is provided by "getopt.h", included via "common.h".
Similar to #2159.
use the parameters in the last redirected URI that that server returns
HTTP OK to. matches the incrementation count of redirection_count from 0
to 3, as they also get incremented three times alongside it. add
comments about what is happening in the test cases, no need to
understand the endpoint completely
plugins/tests/check_curl.t forks and runs a http(s) server that responds
to specific uri endpoints. Added another endpoint under
/redirect_with_increment with dynamic redirection points.
This endpoint will parse different parts of the uri that come after the
path: parameters, query and the fragment. If applicable, seperate
elements within each field are parsed into key/value pairs. value is
incremented in redirected URI.
Tests if check_url redirection logic retains different parts of the url
when parsing the uri and building the new redirected URL. Current tests
show that it ignores the fragment part.
Check the UriUriA object, and if query string exists append it to the
new_url. Only appends the query part, fragments are still not appended
Function redir parses the new location header value using the
uriParseUriA function already, which populates the query field. This
field was already being printed, but it was not being appended to the
new_url during its construction.
Redirection chain of check_curl --onredirect=follow now mimics the chain
of check_http --onredirect=follow. Tested on the url:
mail.google.com/chat
In the previous commit I unintentionally introduced an error
through symbol shadowing.
This should fix check_ntp_time when the target address
is a network address.
check_ntp was marked as deprecated for forever (SVN times).
In the spirit of cleaning up and removing the dead bodies, this
commit removes check_ntp and all its connections.
* check_dig: Add feature to require or forbid dig DNS flags -E, -X.
Introduced helper functions for flag parsing.
-E, --require-flags=LIST
Comma-separated dig flags that must be present (e.g. 'aa,qr')
-X, --forbid-flags=LIST
Comma-separated dig flags that must NOT be present
* check_curl: avoid freeing memory when we don't know where it came from
* check_curl: when using -f sticky conserve IPv6 addresses properly
When running the check on an ipv6 address with a sticky onredirect
policy like in this example:
check_curl -6 -H example.com -I ::1 -f sticky
It results in a getaddrinfo error:
HTTP CRITICAL - Unable to lookup IP address for '[::1]': getaddrinfo returned -3 - Temporary failure in name resolution
This happens because in check_http() if the content of server_addr is an
ipv6 address enclosing brackets are added and on redirection a
subsequent call to check_http() will pass this now bracketed value to
getaddrinfo resulting in the error.
To work around this, strip the brackets from the address prior to the
lookup_host() call.
* add Michael Jeanson to thanks
This commit changes the behaviour of check_curl slightly.
Previously when the redirection method was set to the old 'check_http'
style redirection and there was no "location" header in the original
answer 'check_curl' segfaulted.
Now, at least it dies properly with a message.
This commit implements replacement functions for the previous
exec functions.
The replacements are implemented in a more "pure" style, the do no
longer receive pointer arguments which they will write to, but create
the pointers themselves and should therefore be easier to use,
since it is more obvious what goes in and what comes out.
Also a essentialy unused variable was removed with this.
This is a breaking change.
Testing whether a TLS certificate is still valid (expiration wise)
is now the default in check_smtp.
The reasoning is, that in most scenarios an expired certificate
will effectively mean that the service is not working anymore due to
the refusal of other software to talk to it.
There is a new cli parameter though to explicitly ignore that.
If the status line from a server ended with '\n' instead
of '\r\n' (defined by RFC 9112), check_curl failed to parse it
and exited with an alarm.
The RFC recommends to be lenient here and this change follows that
suggestion.
Due to MySQL changing several term in Version 8.0.22 the way to
determine the status of replicas has changed.
To adapt to these changes in a517dc614e
check_mysql was modified to adapt to different versions.
Some parts were missed though which results in failures to detect
the replica status properly.
This parts should be contained in this commit.
In the Debian Bug tracker (and then Github) a person pointed out,
that a MySQL server does not respond with a hint that is indeed the
MySQL software but only with the version string.
Which makes sense if one assumes to be the only implementation.
This commit changes the behaviour of the Replica check to assume
that the counterpart is a MySQL server if there are not hints that
it is a MariaDB server.
