Initial revision

git-svn-id: https://nagiosplug.svn.sourceforge.net/svnroot/nagiosplug/nagiosplug/trunk@2 f882894a-f735-0410-b71e-b25c423dba1c

1 files changed, 1067 insertions, 0 deletions

diff --git a/plugins/check_http.c b/plugins/check_http.c
new file mode 100644
index 00000000..db5d50dd
--- /dev/null
+++ b/plugins/check_http.c
@@ -0,0 +1,1067 @@
+/****************************************************************************
+ *
+ * Program: HTTP plugin for Nagios
+ * License: GPL
+ *
+ * License Information:
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * $Id$
+ *
+ *****************************************************************************/
+
+#define PROGNAME "check_http"
+#define REVISION "$Revision$"
+#define COPYRIGHT "1999-2001"
+#define AUTHORS "Ethan Galstad/Karl DeBisschop"
+#define EMAIL "kdebisschop@users.sourceforge.net"
+
+#include "config.h"
+#include "common.h"
+#include "version.h"
+#include "netutils.h"
+#include "utils.h"
+
+#define SUMMARY "\
+This plugin tests the HTTP service on the specified host. It can test\n\
+normal (http) and secure (https) servers, follow redirects, search for\n\
+strings and regular expressions, check connection times, and report on\n\
+certificate expiration times.\n"
+
+#define OPTIONS "\
+\(-H <vhost> | -I <IP-address>) [-u <uri>] [-p <port>]\n\
+            [-w <warn time>] [-c <critical time>] [-t <timeout>] [-L]\n\
+            [-a auth] [-f <ok | warn | critcal | follow>] [-e <expect>]\n\
+            [-s string] [-r <regex> | -R <case-insensitive regex>]\n\
+            [-P string]"
+
+#define LONGOPTIONS "\
+ -H, --hostname=ADDRESS\n\
+    Host name argument for servers using host headers (virtual host)\n\
+ -I, --IP-address=ADDRESS\n\
+   IP address or name (use numeric address if possible to bypass DNS lookup).\n\
+ -e, --expect=STRING\n\
+   String to expect in first line of server response (default: %s)\n\
+ -s, --string=STRING\n\
+   String to expect in the content\n\
+ -u, --url=PATH\n\
+   URL to GET or POST (default: /)\n\
+ -p, --port=INTEGER\n\
+   Port number (default: %d)\n\
+ -P, --post=STRING\n\
+   URL encoded http POST data\n\
+ -w, --warning=INTEGER\n\
+   Response time to result in warning status (seconds)\n\
+ -c, --critical=INTEGER\n\
+   Response time to result in critical status (seconds)\n\
+ -t, --timeout=INTEGER\n\
+   Seconds before connection times out (default: %d)\n\
+ -a, --authorization=AUTH_PAIR\n\
+   Username:password on sites with basic authentication\n\
+ -L, --link=URL\n\
+   Wrap output in HTML link (obsoleted by urlize)\n\
+ -f, --onredirect=<ok|warning|critical|follow>\n\
+   How to handle redirected pages\n%s\
+ -v, --verbose\n\
+    Show details for command-line debugging (do not use with nagios server)\n\
+ -h, --help\n\
+    Print detailed help screen\n\
+ -V, --version\n\
+    Print version information\n"
+
+#ifdef HAVE_SSL
+#define SSLOPTIONS "\
+ -S, --ssl\n\
+    Connect via SSL\n\
+ -C, --certificate=INTEGER\n\
+    Minimum number of days a certificate has to be valid.\n\
+    (when this option is used the url is not checked.)\n"
+#else
+#define SSLOPTIONS ""
+#endif
+
+#define DESCRIPTION "\
+This plugin will attempt to open an HTTP connection with the host. Successul\n\
+connects return STATE_OK, refusals and timeouts return STATE_CRITICAL, other\n\
+errors return STATE_UNKNOWN.  Successful connects, but incorrect reponse\n\
+messages from the host result in STATE_WARNING return values.  If you are\n\
+checking a virtual server that uses \"host headers\" you must supply the FQDN\n\
+\(fully qualified domain name) as the [host_name] argument.\n"
+
+#define SSLDESCRIPTION "\
+This plugin can also check whether an SSL enabled web server is able to\n\
+serve content (optionally within a specified time) or whether the X509 \n\
+certificate is still valid for the specified number of days.\n\n\
+CHECK CONTENT: check_http -w 5 -c 10 --ssl www.verisign.com\n\n\
+When the 'www.verisign.com' server returns its content within 5 seconds, a\n\
+STATE_OK will be returned. When the server returns its content but exceeds\n\
+the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,\n\
+a STATE_CRITICAL will be returned.\n\n\
+CHECK CERTIFICATE: check_http www.verisign.com -C 14\n\n\
+When the certificate of 'www.verisign.com' is valid for more than 14 days, a\n\
+STATE_OK is returned. When the certificate is still valid, but for less than\n\
+14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when\n\
+the certificate is expired.\n"
+
+#ifdef HAVE_SSL_H
+#include <rsa.h>
+#include <crypto.h>
+#include <x509.h>
+#include <pem.h>
+#include <ssl.h>
+#include <err.h>
+#include <rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/rsa.h>
+#include <openssl/crypto.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_SSL
+int check_cert = FALSE;
+int days_till_exp;
+unsigned char *randbuff;
+SSL_CTX *ctx;
+SSL *ssl;
+X509 *server_cert;
+int connect_SSL (void);
+int check_certificate (X509 **);
+#endif
+
+#ifdef HAVE_REGEX_H
+#define REGS 2
+#define MAX_RE_SIZE 256
+#include <regex.h>
+regex_t preg;
+regmatch_t pmatch[REGS];
+char regexp[MAX_RE_SIZE];
+char errbuf[MAX_INPUT_BUFFER];
+int cflags = REG_NOSUB | REG_EXTENDED | REG_NEWLINE;
+int errcode;
+#endif
+
+#define server_type_check(server_type) \
+(strcmp (server_type, "https") ? FALSE : TRUE)
+
+#define server_port_check(use_ssl) (use_ssl ? HTTPS_PORT : HTTP_PORT)
+
+#define MAX_IPV4_HOSTLENGTH 64
+#define HDR_LOCATION "%*[Ll]%*[Oo]%*[Cc]%*[Aa]%*[Tt]%*[Ii]%*[Oo]%*[Nn]: "
+#define URI_HTTP "%[HTPShtps]://"
+#define URI_HOST "%[a-zA-Z0-9.-]"
+#define URI_PORT ":%[0-9]"
+#define URI_PATH "%[/a-zA-Z0-9._-=@,]"
+
+#define HTTP_PORT 80
+#define HTTPS_PORT 443
+#define HTTP_EXPECT "HTTP/1."
+#define HTTP_URL "/"
+
+time_t start_time, end_time;
+char timestamp[10] = "";
+int specify_port = FALSE;
+int server_port = HTTP_PORT;
+char server_port_text[6] = "";
+char server_type[6] = "http";
+char *server_address = NULL;
+char *host_name = NULL;
+char *server_url = NULL;
+int server_url_length = 0;
+char server_expect[MAX_INPUT_BUFFER] = HTTP_EXPECT;
+char string_expect[MAX_INPUT_BUFFER] = "";
+int warning_time = 0;
+int check_warning_time = FALSE;
+int critical_time = 0;
+int check_critical_time = FALSE;
+char user_auth[MAX_INPUT_BUFFER] = "";
+int display_html = FALSE;
+int onredirect = STATE_OK;
+int use_ssl = FALSE;
+int verbose = FALSE;
+int sd;
+char *http_method = NULL;
+char *http_post_data = NULL;
+char buffer[MAX_INPUT_BUFFER];
+
+void print_usage (void);
+void print_help (void);
+int process_arguments (int, char **);
+int call_getopt (int, char **);
+static char *base64 (char *bin, int len);
+int check_http (void);
+int my_recv (void);
+int my_close (void);
+
+int
+main (int argc, char **argv)
+{
+        int result = STATE_UNKNOWN;
+
+        if (process_arguments (argc, argv) == ERROR)
+                usage ("check_http: could not parse arguments\n");
+
+        if (strstr (timestamp, ":")) {
+                if (strstr (server_url, "?"))
+                        sprintf (server_url, "%s&%s", server_url, timestamp);
+                else
+                        sprintf (server_url, "%s?%s", server_url, timestamp);
+        }
+
+        if (display_html == TRUE)
+                printf ("<A HREF=\"http://%s:%d%s\" target=\"_blank\">",
+                        host_name, server_port, server_url);
+
+        /* initialize alarm signal handling, set socket timeout, start timer */
+        signal (SIGALRM, socket_timeout_alarm_handler);
+        alarm (socket_timeout);
+        time (&start_time);
+
+#ifdef HAVE_SSL
+        if (use_ssl && check_cert == TRUE) {
+                if (connect_SSL () != OK)
+                        terminate (STATE_CRITICAL,
+                                   "HTTP CRITICAL - Could not make SSL connection\n");
+                if ((server_cert = SSL_get_peer_certificate (ssl)) != NULL) {
+                        result = check_certificate (&server_cert);
+                        X509_free (server_cert);
+                }
+                else {
+                        printf ("ERROR: Cannot retrieve server certificate.\n");
+                        result = STATE_CRITICAL;
+                }
+                SSL_shutdown (ssl);
+                SSL_free (ssl);
+                SSL_CTX_free (ctx);
+                close (sd);
+        }
+        else {
+                result = check_http ();
+        }
+#else
+        result = check_http ();
+#endif
+        return result;
+}
+
+
+
+/* process command-line arguments */
+int
+process_arguments (int argc, char **argv)
+{
+        int c, i = 1;
+        char optchars[MAX_INPUT_BUFFER];
+
+#ifdef HAVE_GETOPT_H
+        int option_index = 0;
+        static struct option long_options[] = {
+                STD_OPTS_LONG,
+                {"link", no_argument, 0, 'L'},
+                {"nohtml", no_argument, 0, 'n'},
+                {"ssl", no_argument, 0, 'S'},
+                {"verbose", no_argument, 0, 'v'},
+                {"post", required_argument, 0, 'P'},
+                {"IP-address", required_argument, 0, 'I'},
+                {"string", required_argument, 0, 's'},
+                {"regex", required_argument, 0, 'r'},
+                {"ereg", required_argument, 0, 'r'},
+                {"eregi", required_argument, 0, 'R'},
+                {"onredirect", required_argument, 0, 'f'},
+                {"certificate", required_argument, 0, 'C'},
+                {0, 0, 0, 0}
+        };
+#endif
+
+        if (argc < 2)
+                return ERROR;
+
+        for (c = 1; c < argc; c++) {
+                if (strcmp ("-to", argv[c]) == 0)
+                        strcpy (argv[c], "-t");
+                if (strcmp ("-hn", argv[c]) == 0)
+                        strcpy (argv[c], "-H");
+                if (strcmp ("-wt", argv[c]) == 0)
+                        strcpy (argv[c], "-w");
+                if (strcmp ("-ct", argv[c]) == 0)
+                        strcpy (argv[c], "-c");
+                if (strcmp ("-nohtml", argv[c]) == 0)
+                        strcpy (argv[c], "-n");
+        }
+
+        snprintf (optchars, MAX_INPUT_BUFFER, "%s%s", STD_OPTS,
+                  "P:I:a:e:p:s:R:r:u:f:C:nLS");
+
+        while (1) {
+#ifdef HAVE_GETOPT_H
+                c = getopt_long (argc, argv, optchars, long_options, &option_index);
+#else
+                c = getopt (argc, argv, optchars);
+#endif
+                if (c == -1 || c == EOF)
+                        break;
+
+                switch (c) {
+                case '?': /* usage */
+                        usage2 ("unknown argument", optarg);
+                        break;
+                case 'h': /* help */
+                        print_help ();
+                        exit (STATE_OK);
+                        break;
+                case 'V': /* version */
+                        print_revision (PROGNAME, REVISION);
+                        exit (STATE_OK);
+                        break;
+                case 't': /* timeout period */
+                        if (!is_intnonneg (optarg))
+                                usage2 ("timeout interval must be a non-negative integer", optarg);
+                        socket_timeout = atoi (optarg);
+                        break;
+                case 'c': /* critical time threshold */
+                        if (!is_intnonneg (optarg))
+                                usage2 ("invalid critical threshold", optarg);
+                        critical_time = atoi (optarg);
+                        check_critical_time = TRUE;
+                        break;
+                case 'w': /* warning time threshold */
+                        if (!is_intnonneg (optarg))
+                                usage2 ("invalid warning threshold", optarg);
+                        warning_time = atoi (optarg);
+                        check_warning_time = TRUE;
+                        break;
+                case 'L': /* show html link */
+                        display_html = TRUE;
+                        break;
+                case 'n': /* do not show html link */
+                        display_html = FALSE;
+                        break;
+                case 'S': /* use SSL */
+#ifndef HAVE_SSL
+                        usage ("check_http: invalid option - SSL is not available\n");
+#endif
+                        use_ssl = TRUE;
+                        if (specify_port == FALSE)
+                                server_port = HTTPS_PORT;
+                        break;
+                case 'C': /* warning time threshold */
+#ifdef HAVE_SSL
+                        if (!is_intnonneg (optarg))
+                                usage2 ("invalid certificate expiration period", optarg);
+                        days_till_exp = atoi (optarg);
+                        check_cert = TRUE;
+#else
+                        usage ("check_http: invalid option - SSL is not available\n");
+#endif
+                        break;
+                case 'f': /* onredirect */
+                        if (!strcmp (optarg, "follow"))
+                                onredirect = STATE_DEPENDENT;
+                        if (!strcmp (optarg, "unknown"))
+                                onredirect = STATE_UNKNOWN;
+                        if (!strcmp (optarg, "ok"))
+                                onredirect = STATE_OK;
+                        if (!strcmp (optarg, "warning"))
+                                onredirect = STATE_WARNING;
+                        if (!strcmp (optarg, "critical"))
+                                onredirect = STATE_CRITICAL;
+                        break;
+                /* Note: H, I, and u must be malloc'd or will fail on redirects */
+                case 'H': /* Host Name (virtual host) */
+                        host_name = strscpy (host_name, optarg);
+                        break;
+                case 'I': /* Server IP-address */
+                        server_address = strscpy (server_address, optarg);
+                        break;
+                case 'u': /* Host or server */
+                        server_url = strscpy (server_url, optarg);
+                        server_url_length = strlen (optarg);
+                        break;
+                case 'p': /* Host or server */
+                        if (!is_intnonneg (optarg))
+                                usage2 ("invalid port number", optarg);
+                        server_port = atoi (optarg);
+                        specify_port = TRUE;
+                        break;
+                case 'a': /* authorization info */
+                        strncpy (user_auth, optarg, MAX_INPUT_BUFFER - 1);
+                        user_auth[MAX_INPUT_BUFFER - 1] = 0;
+                        break;
+                case 'P': /* HTTP POST data in URL encoded format */
+                        http_method = strscpy (http_method, "POST");
+                        http_post_data = strscpy (http_post_data, optarg);
+                        break;
+                case 's': /* string or substring */
+                        strncpy (string_expect, optarg, MAX_INPUT_BUFFER - 1);
+                        string_expect[MAX_INPUT_BUFFER - 1] = 0;
+                        break;
+                case 'e': /* string or substring */
+                        strncpy (server_expect, optarg, MAX_INPUT_BUFFER - 1);
+                        server_expect[MAX_INPUT_BUFFER - 1] = 0;
+                        break;
+                case 'R': /* regex */
+#ifdef HAVE_REGEX_H
+                        cflags = REG_ICASE;
+#else
+                        usage ("check_http: call for regex which was not a compiled option\n");
+#endif
+                case 'r': /* regex */
+#ifdef HAVE_REGEX_H
+                        cflags |= REG_EXTENDED | REG_NOSUB | REG_NEWLINE;
+                        strncpy (regexp, optarg, MAX_INPUT_BUFFER - 1);
+                        regexp[MAX_INPUT_BUFFER - 1] = 0;
+                        errcode = regcomp (&preg, regexp, cflags);
+                        if (errcode != 0) {
+                                regerror (errcode, &preg, errbuf, MAX_INPUT_BUFFER);
+                                printf ("Could Not Compile Regular Expression: %s", errbuf);
+                                return ERROR;
+                        }
+#else
+                        usage ("check_http: call for regex which was not a compiled option\n");
+#endif
+                        break;
+                case 'v': /* verbose */
+                        verbose = TRUE;
+                        break;
+                }
+        }
+
+        c = optind;
+
+        if (server_address == NULL && host_name == NULL) {
+                server_address = strscpy (NULL, argv[c]);
+                host_name = strscpy (NULL, argv[c++]);
+        }
+
+        if (server_address == NULL && host_name == NULL)
+                usage ("check_http: you must specify a host name\n");
+
+        if (server_address == NULL)
+                server_address = strscpy (NULL, host_name);
+
+        if (host_name == NULL)
+                host_name = strscpy (NULL, server_address);
+
+        if (http_method == NULL)
+                http_method = strscpy (http_method, "GET");
+
+        if (server_url == NULL) {
+                server_url = strscpy (NULL, "/");
+                server_url_length = strlen(HTTP_URL);
+        }
+
+        return TRUE;
+}
+
+
+
+/* written by lauri alanko */
+static char *
+base64 (char *bin, int len)
+{
+
+        char *buf = (char *) malloc ((len + 2) / 3 * 4 + 1);
+        int i = 0, j = 0;
+
+        char BASE64_END = '=';
+        char base64_table[64] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                "abcdefghijklmnopqrstuvwxyz"
+                "0123456789+/";
+
+        while (j < len - 2) {
+                buf[i++] = base64_table[bin[j] >> 2];
+                buf[i++] = base64_table[((bin[j] & 3) << 4) | (bin[j + 1] >> 4)];
+                buf[i++] = base64_table[((bin[j + 1] & 15) << 2) | (bin[j + 2] >> 6)];
+                buf[i++] = base64_table[bin[j + 2] & 63];
+                j += 3;
+        }
+
+        switch (len - j) {
+        case 1:
+                buf[i++] = base64_table[bin[j] >> 2];
+                buf[i++] = base64_table[(bin[j] & 3) << 4];
+                buf[i++] = BASE64_END;
+                buf[i++] = BASE64_END;
+                break;
+        case 2:
+                buf[i++] = base64_table[bin[j] >> 2];
+                buf[i++] = base64_table[((bin[j] & 3) << 4) | (bin[j + 1] >> 4)];
+                buf[i++] = base64_table[(bin[j + 1] & 15) << 2];
+                buf[i++] = BASE64_END;
+                break;
+        case 0:
+                break;
+        }
+
+        buf[i] = '\0';
+        return buf;
+}
+
+
+
+int
+check_http (void)
+{
+        char *msg = NULL;
+        char *status_line = NULL;
+        char *header = NULL;
+        char *page = NULL;
+        char *auth = NULL;
+        int i = 0;
+        size_t pagesize = 0;
+        char *full_page = NULL;
+        char *pos = NULL;
+
+        /* try to connect to the host at the given port number */
+#ifdef HAVE_SSL
+        if (use_ssl == TRUE) {
+
+                if (connect_SSL () != OK) {
+                        msg = ssprintf (msg, "Unable to open TCP socket");
+                        terminate (STATE_CRITICAL, msg);
+                }
+
+                if ((server_cert = SSL_get_peer_certificate (ssl)) != NULL) {
+                        X509_free (server_cert);
+                }
+                else {
+                        printf ("ERROR: Cannot retrieve server certificate.\n");
+                        return STATE_CRITICAL;
+                }
+
+                sprintf (buffer, "%s %s HTTP/1.0\r\n", http_method, server_url);
+                if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                        ERR_print_errors_fp (stderr);
+                        return STATE_CRITICAL;
+                }
+
+                /* optionally send the host header info (not clear if it's usable) */
+                if (strcmp (host_name, "")) {
+                        sprintf (buffer, "Host: %s\r\n", host_name);
+                        if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                                ERR_print_errors_fp (stderr);
+                                return STATE_CRITICAL;
+                        }
+                }
+
+                /* send user agent */
+                sprintf (buffer, "User-Agent: check_http/%s (nagios-plugins %s)\r\n",
+                         clean_revstring (REVISION), PACKAGE_VERSION);
+                if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                        ERR_print_errors_fp (stderr);
+                        return STATE_CRITICAL;
+                }
+
+                /* optionally send the authentication info */
+                if (strcmp (user_auth, "")) {
+                        auth = base64 (user_auth, strlen (user_auth));
+                        sprintf (buffer, "Authorization: Basic %s\r\n", auth);
+                        if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                                ERR_print_errors_fp (stderr);
+                                return STATE_CRITICAL;
+                        }
+                }
+
+                /* optionally send http POST data */
+                if (http_post_data) {
+                        sprintf (buffer, "Content-Type: application/x-www-form-urlencoded\r\n");
+                        if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                                ERR_print_errors_fp (stderr);
+                                return STATE_CRITICAL;
+                        }
+                        sprintf (buffer, "Content-Length: %i\r\n\r\n", strlen (http_post_data));
+                        if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                                ERR_print_errors_fp (stderr);
+                                return STATE_CRITICAL;
+                        }
+                        http_post_data = strscat (http_post_data, "\r\n");
+                        if (SSL_write (ssl, http_post_data, strlen (http_post_data)) == -1) {
+                                ERR_print_errors_fp (stderr);
+                                return STATE_CRITICAL;
+                        }
+                }
+
+                /* send a newline so the server knows we're done with the request */
+                sprintf (buffer, "\r\n\r\n");
+                if (SSL_write (ssl, buffer, strlen (buffer)) == -1) {
+                        ERR_print_errors_fp (stderr);
+                        return STATE_CRITICAL;
+                }
+
+        }
+        else {
+#endif
+                if (my_tcp_connect (server_address, server_port, &sd) != STATE_OK) {
+                        msg = ssprintf (msg, "Unable to open TCP socket");
+                        terminate (STATE_CRITICAL, msg);
+                }
+                sprintf (buffer, "%s %s HTTP/1.0\r\n", http_method, server_url);
+                send (sd, buffer, strlen (buffer), 0);
+
+                /* optionally send the host header info */
+                if (strcmp (host_name, "")) {
+                        sprintf (buffer, "Host: %s\r\n", host_name);
+                        send (sd, buffer, strlen (buffer), 0);
+                }
+
+                /* send user agent */
+                sprintf (buffer,
+                         "User-Agent: check_http/%s (nagios-plugins %s)\r\n",
+                         clean_revstring (REVISION), PACKAGE_VERSION);
+                send (sd, buffer, strlen (buffer), 0);
+
+                /* optionally send the authentication info */
+                if (strcmp (user_auth, "")) {
+                        auth = base64 (user_auth, strlen (user_auth));
+                        sprintf (buffer, "Authorization: Basic %s\r\n", auth);
+                        send (sd, buffer, strlen (buffer), 0);
+                }
+
+                /* optionally send http POST data */
+                /* written by Chris Henesy <lurker@shadowtech.org> */
+                if (http_post_data) {
+                        sprintf (buffer, "Content-Type: application/x-www-form-urlencoded\r\n");
+                        send (sd, buffer, strlen (buffer), 0);
+                        sprintf (buffer, "Content-Length: %i\r\n\r\n", strlen (http_post_data));
+                        send (sd, buffer, strlen (buffer), 0);
+                        http_post_data = strscat (http_post_data, "\r\n");
+                        send (sd, http_post_data, strlen (http_post_data), 0);
+                }
+
+                /* send a newline so the server knows we're done with the request */
+                sprintf (buffer, "\r\n\r\n");
+                send (sd, buffer, strlen (buffer), 0);
+#ifdef HAVE_SSL
+        }
+#endif
+
+        /* fetch the page */
+        pagesize = (size_t) 0;
+        while ((i = my_recv ()) > 0) {
+                full_page = strscat (full_page, buffer);
+                pagesize += i;
+        }
+
+        if (i < 0)
+                terminate (STATE_CRITICAL, "Error in recv()");
+
+        /* return a CRITICAL status if we couldn't read any data */
+        if (pagesize == (size_t) 0)
+                terminate (STATE_CRITICAL, "No data received %s", timestamp);
+
+        /* close the connection */
+        my_close ();
+
+        /* reset the alarm */
+        alarm (0);
+
+        /* leave full_page untouched so we can free it later */
+        page = full_page;
+
+        if (verbose)
+                printf ("Page is %d characters\n", pagesize);
+
+        /* find status line and null-terminate it */
+        status_line = page;
+        page += (size_t) strcspn (page, "\r\n");
+        pos = page;
+        page += (size_t) strspn (page, "\r\n");
+        status_line[pos - status_line] = 0;
+        strip (status_line);
+        if (verbose)
+                printf ("STATUS: %s\n", status_line);
+
+        /* find header info and null terminate it */
+        header = page;
+        while (strcspn (page, "\r\n") > 0) {
+                page += (size_t) strcspn (page, "\r\n");
+                pos = page;
+                if ((strspn (page, "\r") == 1 && strspn (page, "\r\n") >= 2) ||
+                    (strspn (page, "\n") == 1 && strspn (page, "\r\n") >= 2))
+                        page += (size_t) 2;
+                else
+                        page += (size_t) 1;
+        }
+        page += (size_t) strspn (page, "\r\n");
+        header[pos - header] = 0;
+        if (verbose)
+                printf ("**** HEADER ****\n%s\n**** CONTENT ****\n%s\n", header, page);
+
+        /* make sure the status line matches the response we are looking for */
+        if (!strstr (status_line, server_expect)) {
+                if (server_port == HTTP_PORT)
+                        msg = ssprintf (msg, "Invalid HTTP response received from host\n");
+                else
+                        msg = ssprintf (msg,
+                                        "Invalid HTTP response received from host on port %d\n",
+                                        server_port);
+                terminate (STATE_CRITICAL, msg);
+        }
+
+        /* check the return code */
+        /* server errors result in a critical state */
+        if (strstr (status_line, "500") ||
+            strstr (status_line, "501") ||
+            strstr (status_line, "502") ||
+            strstr (status_line, "503")) {
+                msg = ssprintf (msg, "HTTP CRITICAL: %s\n", status_line);
+                terminate (STATE_CRITICAL, msg);
+        }
+
+        /* client errors result in a warning state */
+        if (strstr (status_line, "400") ||
+            strstr (status_line, "401") ||
+            strstr (status_line, "402") ||
+            strstr (status_line, "403") ||
+            strstr (status_line, "404")) {
+                msg = ssprintf (msg, "HTTP WARNING: %s\n", status_line);
+                terminate (STATE_WARNING, msg);
+        }
+
+        /* check redirected page if specified */
+        if (strstr (status_line, "300") ||
+            strstr (status_line, "301") ||
+            strstr (status_line, "302") ||
+            strstr (status_line, "303") ||
+            strstr (status_line, "304")) {
+                if (onredirect == STATE_DEPENDENT) {
+                        
+                        pos = header;
+                        while (pos) {
+                                server_address = realloc (server_address, MAX_IPV4_HOSTLENGTH);
+                                if (server_address == NULL)
+                                        terminate (STATE_UNKNOWN,
+                                                                                 "HTTP UNKNOWN: could not allocate server_address");
+                                if (strspn (pos, "\r\n") > server_url_length) {
+                                        server_url = realloc (server_url, strspn (pos, "\r\n"));
+                                        if (server_url == NULL)
+                                                terminate (STATE_UNKNOWN,
+                                                                                         "HTTP UNKNOWN: could not allocate server_url");
+                                        server_url_length = strspn (pos, "\r\n");
+                                }
+                                if (sscanf (pos, HDR_LOCATION URI_HTTP URI_HOST URI_PORT URI_PATH, server_type, server_address, server_port_text, server_url) == 4) {
+                                        host_name = strscpy (host_name, server_address);
+                                        use_ssl = server_type_check (server_type);
+                                        server_port = atoi (server_port_text);
+                                        check_http ();
+                                }
+                                else if (sscanf (pos, HDR_LOCATION URI_HTTP URI_HOST URI_PATH, server_type, server_address, server_url) == 3) {
+                                        host_name = strscpy (host_name, server_address);
+                                        use_ssl = server_type_check (server_type);
+                                        server_port = server_port_check (use_ssl);
+                                        check_http ();
+                                }
+                                else if (sscanf (pos, HDR_LOCATION URI_HTTP URI_HOST URI_PORT, server_type, server_address, server_port_text) == 3) {
+                                        host_name = strscpy (host_name, server_address);
+                                        strcpy (server_url, "/");
+                                        use_ssl = server_type_check (server_type);
+                                        server_port = atoi (server_port_text);
+                                        check_http ();
+                                }
+                                else if (sscanf (pos, HDR_LOCATION URI_HTTP URI_HOST, server_type, server_address) == 2) {
+                                        host_name = strscpy (host_name, server_address);
+                                        strcpy (server_url, "/");
+                                        use_ssl = server_type_check (server_type);
+                                        server_port = server_port_check (use_ssl);
+                                        check_http ();
+                                }
+                                else if (sscanf (pos, HDR_LOCATION URI_PATH, server_url) == 1) {
+                                        check_http ();
+                                }
+                                pos += (size_t) strcspn (pos, "\r\n");
+                                pos += (size_t) strspn (pos, "\r\n");
+                        } /* end while (pos) */
+                        printf ("HTTP UNKNOWN: Could not find redirect location - %s%s",
+                                status_line, (display_html ? "</A>" : ""));
+                        exit (STATE_UNKNOWN);
+                } /* end if (onredirect == STATE_DEPENDENT) */
+                else if (onredirect == STATE_UNKNOWN)
+                        printf ("HTTP UNKNOWN");
+                else if (onredirect == STATE_OK)
+                        printf ("HTTP ok");
+                else if (onredirect == STATE_WARNING)
+                        printf ("HTTP WARNING");
+                else if (onredirect == STATE_CRITICAL)
+                        printf ("HTTP CRITICAL");
+                time (&end_time);
+                msg = ssprintf (msg, ": %s - %d second response time %s%s\n",
+                                status_line, (int) (end_time - start_time),
+                                timestamp, (display_html ? "</A>" : ""));
+                terminate (onredirect, msg);
+        } /* end if (strstr (status_line, "30[0-4]") */
+
+        /* check elapsed time */
+        time (&end_time);
+        msg = ssprintf (msg, "HTTP problem: %s - %d second response time %s%s\n",
+                        status_line, (int) (end_time - start_time),
+                        timestamp, (display_html ? "</A>" : ""));
+        if (check_critical_time == TRUE && (end_time - start_time) > critical_time)
+                terminate (STATE_CRITICAL, msg);
+        if (check_warning_time == TRUE && (end_time - start_time) > warning_time)
+                terminate (STATE_WARNING, msg);
+
+        /* Page and Header content checks go here */
+        /* these checks should be last */
+
+        if (strlen (string_expect)) {
+                if (strstr (page, string_expect)) {
+                        printf ("HTTP ok: %s - %d second response time %s%s\n",
+                                status_line, (int) (end_time - start_time),
+                                timestamp, (display_html ? "</A>" : ""));
+                        exit (STATE_OK);
+                }
+                else {
+                        printf ("HTTP CRITICAL: string not found%s\n",
+                                (display_html ? "</A>" : ""));
+                        exit (STATE_CRITICAL);
+                }
+        }
+#ifdef HAVE_REGEX_H
+        if (strlen (regexp)) {
+                errcode = regexec (&preg, page, REGS, pmatch, 0);
+                if (errcode == 0) {
+                        printf ("HTTP ok: %s - %d second response time %s%s\n",
+                                status_line, (int) (end_time - start_time),
+                                timestamp, (display_html ? "</A>" : ""));
+                        exit (STATE_OK);
+                }
+                else {
+                        if (errcode == REG_NOMATCH) {
+                                printf ("HTTP CRITICAL: pattern not found%s\n",
+                                        (display_html ? "</A>" : ""));
+                                exit (STATE_CRITICAL);
+                        }
+                        else {
+                                regerror (errcode, &preg, errbuf, MAX_INPUT_BUFFER);
+                                printf ("Execute Error: %s\n", errbuf);
+                                exit (STATE_CRITICAL);
+                        }
+                }
+        }
+#endif
+
+        /* We only get here if all tests have been passed */
+        msg = ssprintf (msg, "HTTP ok: %s - %d second response time %s%s\n",
+                        status_line, (int) (end_time - start_time),
+                        timestamp, (display_html ? "</A>" : ""));
+        terminate (STATE_OK, msg);
+        return STATE_UNKNOWN;
+}
+
+
+
+#ifdef HAVE_SSL
+int
+connect_SSL (void)
+{
+        SSL_METHOD *meth;
+
+        randbuff = strscpy (NULL, "qwertyuiopasdfghjkl");
+        RAND_seed (randbuff, strlen (randbuff));
+        /* Initialize SSL context */
+        SSLeay_add_ssl_algorithms ();
+        meth = SSLv23_client_method ();
+        SSL_load_error_strings ();
+        if ((ctx = SSL_CTX_new (meth)) == NULL) {
+                printf ("ERROR: Cannot create SSL context.\n");
+                return STATE_CRITICAL;
+        }
+
+        /* Initialize alarm signal handling */
+        signal (SIGALRM, socket_timeout_alarm_handler);
+
+        /* Set socket timeout */
+        alarm (socket_timeout);
+
+        /* Save start time */
+        time (&start_time);
+
+        /* Make TCP connection */
+        if (my_tcp_connect (server_address, server_port, &sd) == STATE_OK) {
+                /* Do the SSL handshake */
+                if ((ssl = SSL_new (ctx)) != NULL) {
+                        SSL_set_cipher_list(ssl, "ALL");
+                        SSL_set_fd (ssl, sd);
+                        if (SSL_connect (ssl) != -1)
+                                return OK;
+                        ERR_print_errors_fp (stderr);
+                }
+                else {
+                        printf ("ERROR: Cannot initiate SSL handshake.\n");
+                }
+                SSL_free (ssl);
+        }
+
+        SSL_CTX_free (ctx);
+        close (sd);
+
+        return STATE_CRITICAL;
+}
+#endif
+
+#ifdef HAVE_SSL
+int
+check_certificate (X509 ** certificate)
+{
+        ASN1_STRING *tm;
+        int offset;
+        struct tm stamp;
+        int days_left;
+        /* int result = STATE_OK; */
+        /* char timestamp[14]; */
+
+
+        /* Retrieve timestamp of certificate */
+        tm = X509_get_notAfter (*certificate);
+
+        /* Generate tm structure to process timestamp */
+        if (tm->type == V_ASN1_UTCTIME) {
+                if (tm->length < 10) {
+                        printf ("ERROR: Wrong time format in certificate.\n");
+                        return STATE_CRITICAL;
+                }
+                else {
+                        stamp.tm_year = (tm->data[0] - '0') * 10 + (tm->data[1] - '0');
+                        if (stamp.tm_year < 50)
+                                stamp.tm_year += 100;
+                        offset = 0;
+                }
+        }
+        else {
+                if (tm->length < 12) {
+                        printf ("ERROR: Wrong time format in certificate.\n");
+                        return STATE_CRITICAL;
+                }
+                else {
+                        stamp.tm_year =
+                                (tm->data[0] - '0') * 1000 + (tm->data[1] - '0') * 100 +
+                                (tm->data[2] - '0') * 10 + (tm->data[3] - '0');
+                        stamp.tm_year -= 1900;
+                        offset = 2;
+                }
+        }
+        stamp.tm_mon =
+                (tm->data[2 + offset] - '0') * 10 + (tm->data[3 + offset] - '0') - 1;
+        stamp.tm_mday =
+                (tm->data[4 + offset] - '0') * 10 + (tm->data[5 + offset] - '0');
+        stamp.tm_hour =
+                (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
+        stamp.tm_min =
+                (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
+        stamp.tm_sec = 0;
+        stamp.tm_isdst = -1;
+
+        days_left = (mktime (&stamp) - time (NULL)) / 86400;
+        sprintf
+                (timestamp, "%02d/%02d/%04d %02d:%02d",
+                 stamp.tm_mon + 1,
+                 stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
+
+        if (days_left > 0 && days_left <= days_till_exp) {
+                printf ("Certificate expires in %d day(s) (%s).\n", days_left, timestamp);
+                return STATE_WARNING;
+        }
+        if (days_left < 0) {
+                printf ("Certificate expired on %s.\n", timestamp);
+                return STATE_CRITICAL;
+        }
+
+        if (days_left == 0) {
+                printf ("Certificate expires today (%s).\n", timestamp);
+                return STATE_WARNING;
+        }
+
+        printf ("Certificate will expire on %s.\n", timestamp);
+
+        return STATE_OK;
+}
+#endif
+
+
+
+int
+my_recv (void)
+{
+        int i;
+#ifdef HAVE_SSL
+        if (use_ssl) {
+                i = SSL_read (ssl, buffer, MAX_INPUT_BUFFER - 1);
+        }
+        else {
+                i = recv (sd, buffer, MAX_INPUT_BUFFER - 1, 0);
+        }
+#else
+        i = recv (sd, buffer, MAX_INPUT_BUFFER - 1, 0);
+#endif
+        return i;
+}
+
+
+int
+my_close (void)
+{
+#ifdef HAVE_SSL
+        if (use_ssl == TRUE) {
+                SSL_shutdown (ssl);
+                SSL_free (ssl);
+                SSL_CTX_free (ctx);
+                return 0;
+        }
+        else {
+#endif
+                return close (sd);
+#ifdef HAVE_SSL
+        }
+#endif
+}
+
+
+
+void
+print_help (void)
+{
+        print_revision (PROGNAME, REVISION);
+        printf
+                ("Copyright (c) %s %s <%s>\n\n%s\n",
+                 COPYRIGHT, AUTHORS, EMAIL, SUMMARY);
+        print_usage ();
+        printf ("NOTE: One or both of -H and -I must be specified\n");
+        printf ("\nOptions:\n" LONGOPTIONS "\n", HTTP_EXPECT, HTTP_PORT,
+                DEFAULT_SOCKET_TIMEOUT, SSLOPTIONS);
+#ifdef HAVE_SSL
+        printf (SSLDESCRIPTION);
+#endif
+}
+
+
+void
+print_usage (void)
+{
+        printf ("Usage:\n" " %s %s\n"
+#ifdef HAVE_GETOPT_H
+                " %s (-h | --help) for detailed help\n"
+                " %s (-V | --version) for version information\n",
+#else
+                " %s -h for detailed help\n"
+                " %s -V for version information\n",
+#endif
+        PROGNAME, OPTIONS, PROGNAME, PROGNAME);
+}