1 /*
2  * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * The config checker checks for syntax and other errors in the unbound.conf
40  * file, and can be used to check for errors before the server is started
41  * or sigHUPped.
42  * Exit status 1 means an error.
43  */
44 
45 #include "config.h"
46 #include <ctype.h>
47 #include "util/log.h"
48 #include "util/config_file.h"
49 #include "util/module.h"
50 #include "util/net_help.h"
51 #include "util/regional.h"
52 #include "iterator/iterator.h"
53 #include "iterator/iter_fwd.h"
54 #include "iterator/iter_hints.h"
55 #include "validator/validator.h"
56 #include "services/localzone.h"
57 #include "services/view.h"
58 #include "services/authzone.h"
59 #include "respip/respip.h"
60 #include "sldns/sbuffer.h"
61 #ifdef HAVE_GETOPT_H
62 #include <getopt.h>
63 #endif
64 #ifdef HAVE_PWD_H
65 #include <pwd.h>
66 #endif
67 #ifdef HAVE_SYS_STAT_H
68 #include <sys/stat.h>
69 #endif
70 #ifdef HAVE_GLOB_H
71 #include <glob.h>
72 #endif
73 #ifdef WITH_PYTHONMODULE
74 #include "pythonmod/pythonmod.h"
75 #endif
76 #ifdef CLIENT_SUBNET
77 #include "edns-subnet/subnet-whitelist.h"
78 #endif
79 
80 /** Give checkconf usage, and exit (1). */
81 static void
82 usage(void)
83 {
84 	printf("Usage:	local-unbound-checkconf [file]\n");
85 	printf("	Checks unbound configuration file for errors.\n");
86 	printf("file	if omitted %s is used.\n", CONFIGFILE);
87 	printf("-o option	print value of option to stdout.\n");
88 	printf("-f 		output full pathname with chroot applied, eg. with -o pidfile.\n");
89 	printf("-h		show this usage help.\n");
90 	printf("Version %s\n", PACKAGE_VERSION);
91 	printf("BSD licensed, see LICENSE in source package for details.\n");
92 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
93 	exit(1);
94 }
95 
96 /**
97  * Print given option to stdout
98  * @param cfg: config
99  * @param opt: option name without trailing :.
100  *	This is different from config_set_option.
101  * @param final: if final pathname with chroot applied has to be printed.
102  */
103 static void
104 print_option(struct config_file* cfg, const char* opt, int final)
105 {
106 	if(strcmp(opt, "pidfile") == 0 && final) {
107 		char *p = fname_after_chroot(cfg->pidfile, cfg, 1);
108 		if(!p) fatal_exit("out of memory");
109 		printf("%s\n", p);
110 		free(p);
111 		return;
112 	}
113 	if(strcmp(opt, "auto-trust-anchor-file") == 0 && final) {
114 		struct config_strlist* s = cfg->auto_trust_anchor_file_list;
115 		for(; s; s=s->next) {
116 			char *p = fname_after_chroot(s->str, cfg, 1);
117 			if(!p) fatal_exit("out of memory");
118 			printf("%s\n", p);
119 			free(p);
120 		}
121 		return;
122 	}
123 	if(!config_get_option(cfg, opt, config_print_func, stdout))
124 		fatal_exit("cannot print option '%s'", opt);
125 }
126 
127 /** check if module works with config */
128 static void
129 check_mod(struct config_file* cfg, struct module_func_block* fb)
130 {
131 	struct module_env env;
132 	memset(&env, 0, sizeof(env));
133 	env.cfg = cfg;
134 	env.scratch = regional_create();
135 	env.scratch_buffer = sldns_buffer_new(BUFSIZ);
136 	if(!env.scratch || !env.scratch_buffer)
137 		fatal_exit("out of memory");
138 	if(!edns_known_options_init(&env))
139 		fatal_exit("out of memory");
140 	if(!(*fb->init)(&env, 0)) {
141 		fatal_exit("bad config for %s module", fb->name);
142 	}
143 	(*fb->deinit)(&env, 0);
144 	sldns_buffer_free(env.scratch_buffer);
145 	regional_destroy(env.scratch);
146 	edns_known_options_delete(&env);
147 }
148 
149 /** true if addr is a localhost address, 127.0.0.1 or ::1 (with maybe "@port"
150  * after it) */
151 static int
152 str_addr_is_localhost(const char* a)
153 {
154 	if(strncmp(a, "127.", 4) == 0) return 1;
155 	if(strncmp(a, "::1", 3) == 0) return 1;
156 	return 0;
157 }
158 
159 /** check do-not-query-localhost */
160 static void
161 donotquerylocalhostcheck(struct config_file* cfg)
162 {
163 	if(cfg->donotquery_localhost) {
164 		struct config_stub* p;
165 		struct config_strlist* s;
166 		for(p=cfg->forwards; p; p=p->next) {
167 			for(s=p->addrs; s; s=s->next) {
168 				if(str_addr_is_localhost(s->str)) {
169 					fprintf(stderr, "unbound-checkconf: warning: forward-addr: '%s' is specified for forward-zone: '%s', but do-not-query-localhost: yes means that the address will not be used for lookups.\n",
170 						s->str, p->name);
171 				}
172 			}
173 		}
174 		for(p=cfg->stubs; p; p=p->next) {
175 			for(s=p->addrs; s; s=s->next) {
176 				if(str_addr_is_localhost(s->str)) {
177 					fprintf(stderr, "unbound-checkconf: warning: stub-addr: '%s' is specified for stub-zone: '%s', but do-not-query-localhost: yes means that the address will not be used for lookups.\n",
178 						s->str, p->name);
179 				}
180 			}
181 		}
182 	}
183 }
184 
185 /** check localzones */
186 static void
187 localzonechecks(struct config_file* cfg)
188 {
189 	struct local_zones* zs;
190 	if(!(zs = local_zones_create()))
191 		fatal_exit("out of memory");
192 	if(!local_zones_apply_cfg(zs, cfg))
193 		fatal_exit("failed local-zone, local-data configuration");
194 	local_zones_delete(zs);
195 }
196 
197 /** check view and response-ip configuration */
198 static void
199 view_and_respipchecks(struct config_file* cfg)
200 {
201 	struct views* views = NULL;
202 	struct respip_set* respip = NULL;
203 	int ignored = 0;
204 	if(!(views = views_create()))
205 		fatal_exit("Could not create views: out of memory");
206 	if(!(respip = respip_set_create()))
207 		fatal_exit("Could not create respip set: out of memory");
208 	if(!views_apply_cfg(views, cfg))
209 		fatal_exit("Could not set up views");
210 	if(!respip_global_apply_cfg(respip, cfg))
211 		fatal_exit("Could not setup respip set");
212 	if(!respip_views_apply_cfg(views, cfg, &ignored))
213 		fatal_exit("Could not setup per-view respip sets");
214 	views_delete(views);
215 	respip_set_delete(respip);
216 }
217 
218 /** emit warnings for IP in hosts */
219 static void
220 warn_hosts(const char* typ, struct config_stub* list)
221 {
222 	struct sockaddr_storage a;
223 	socklen_t alen;
224 	struct config_stub* s;
225 	struct config_strlist* h;
226 	for(s=list; s; s=s->next) {
227 		for(h=s->hosts; h; h=h->next) {
228 			if(extstrtoaddr(h->str, &a, &alen)) {
229 				fprintf(stderr, "unbound-checkconf: warning:"
230 				  " %s %s: \"%s\" is an IP%s address, "
231 				  "and when looked up as a host name "
232 				  "during use may not resolve.\n",
233 				  s->name, typ, h->str,
234 				  addr_is_ip6(&a, alen)?"6":"4");
235 			}
236 		}
237 	}
238 }
239 
240 /** check interface strings */
241 static void
242 interfacechecks(struct config_file* cfg)
243 {
244 	int d;
245 	struct sockaddr_storage a;
246 	socklen_t alen;
247 	int i, j;
248 	for(i=0; i<cfg->num_ifs; i++) {
249 		if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
250 			fatal_exit("cannot parse interface specified as '%s'",
251 				cfg->ifs[i]);
252 		}
253 		for(j=0; j<cfg->num_ifs; j++) {
254 			if(i!=j && strcmp(cfg->ifs[i], cfg->ifs[j])==0)
255 				fatal_exit("interface: %s present twice, "
256 					"cannot bind same ports twice.",
257 					cfg->ifs[i]);
258 		}
259 	}
260 	for(i=0; i<cfg->num_out_ifs; i++) {
261 		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen) &&
262 		   !netblockstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen, &d)) {
263 			fatal_exit("cannot parse outgoing-interface "
264 				"specified as '%s'", cfg->out_ifs[i]);
265 		}
266 		for(j=0; j<cfg->num_out_ifs; j++) {
267 			if(i!=j && strcmp(cfg->out_ifs[i], cfg->out_ifs[j])==0)
268 				fatal_exit("outgoing-interface: %s present "
269 					"twice, cannot bind same ports twice.",
270 					cfg->out_ifs[i]);
271 		}
272 	}
273 }
274 
275 /** check acl ips */
276 static void
277 aclchecks(struct config_file* cfg)
278 {
279 	int d;
280 	struct sockaddr_storage a;
281 	socklen_t alen;
282 	struct config_str2list* acl;
283 	for(acl=cfg->acls; acl; acl = acl->next) {
284 		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
285 			&d)) {
286 			fatal_exit("cannot parse access control address %s %s",
287 				acl->str, acl->str2);
288 		}
289 	}
290 }
291 
292 /** check tcp connection limit ips */
293 static void
294 tcpconnlimitchecks(struct config_file* cfg)
295 {
296 	int d;
297 	struct sockaddr_storage a;
298 	socklen_t alen;
299 	struct config_str2list* tcl;
300 	for(tcl=cfg->tcp_connection_limits; tcl; tcl = tcl->next) {
301 		if(!netblockstrtoaddr(tcl->str, UNBOUND_DNS_PORT, &a, &alen,
302 			&d)) {
303 			fatal_exit("cannot parse tcp connection limit address %s %s",
304 				tcl->str, tcl->str2);
305 		}
306 	}
307 }
308 
309 /** true if fname is a file */
310 static int
311 is_file(const char* fname)
312 {
313 	struct stat buf;
314 	if(stat(fname, &buf) < 0) {
315 		if(errno==EACCES) {
316 			printf("warning: no search permission for one of the directories in path: %s\n", fname);
317 			return 1;
318 		}
319 		perror(fname);
320 		return 0;
321 	}
322 	if(S_ISDIR(buf.st_mode)) {
323 		printf("%s is not a file\n", fname);
324 		return 0;
325 	}
326 	return 1;
327 }
328 
329 /** true if fname is a directory */
330 static int
331 is_dir(const char* fname)
332 {
333 	struct stat buf;
334 	if(stat(fname, &buf) < 0) {
335 		if(errno==EACCES) {
336 			printf("warning: no search permission for one of the directories in path: %s\n", fname);
337 			return 1;
338 		}
339 		perror(fname);
340 		return 0;
341 	}
342 	if(!(S_ISDIR(buf.st_mode))) {
343 		printf("%s is not a directory\n", fname);
344 		return 0;
345 	}
346 	return 1;
347 }
348 
349 /** get base dir of a fname */
350 static char*
351 basedir(char* fname)
352 {
353 	char* rev;
354 	if(!fname) fatal_exit("out of memory");
355 	rev = strrchr(fname, '/');
356 	if(!rev) return NULL;
357 	if(fname == rev) return NULL;
358 	rev[0] = 0;
359 	return fname;
360 }
361 
362 /** check chroot for a file string */
363 static void
364 check_chroot_string(const char* desc, char** ss,
365 	const char* chrootdir, struct config_file* cfg)
366 {
367 	char* str = *ss;
368 	if(str && str[0]) {
369 		*ss = fname_after_chroot(str, cfg, 1);
370 		if(!*ss) fatal_exit("out of memory");
371 		if(!is_file(*ss)) {
372 			if(chrootdir && chrootdir[0])
373 				fatal_exit("%s: \"%s\" does not exist in "
374 					"chrootdir %s", desc, str, chrootdir);
375 			else
376 				fatal_exit("%s: \"%s\" does not exist",
377 					desc, str);
378 		}
379 		/* put in a new full path for continued checking */
380 		free(str);
381 	}
382 }
383 
384 /** check file list, every file must be inside the chroot location */
385 static void
386 check_chroot_filelist(const char* desc, struct config_strlist* list,
387 	const char* chrootdir, struct config_file* cfg)
388 {
389 	struct config_strlist* p;
390 	for(p=list; p; p=p->next) {
391 		check_chroot_string(desc, &p->str, chrootdir, cfg);
392 	}
393 }
394 
395 /** check file list, with wildcard processing */
396 static void
397 check_chroot_filelist_wild(const char* desc, struct config_strlist* list,
398 	const char* chrootdir, struct config_file* cfg)
399 {
400 	struct config_strlist* p;
401 	for(p=list; p; p=p->next) {
402 #ifdef HAVE_GLOB
403 		if(strchr(p->str, '*') || strchr(p->str, '[') ||
404 			strchr(p->str, '?') || strchr(p->str, '{') ||
405 			strchr(p->str, '~')) {
406 			char* s = p->str;
407 			/* adjust whole pattern for chroot and check later */
408 			p->str = fname_after_chroot(p->str, cfg, 1);
409 			free(s);
410 		} else
411 #endif /* HAVE_GLOB */
412 			check_chroot_string(desc, &p->str, chrootdir, cfg);
413 	}
414 }
415 
416 #ifdef CLIENT_SUBNET
417 /** check ECS configuration */
418 static void
419 ecs_conf_checks(struct config_file* cfg)
420 {
421 	struct ecs_whitelist* whitelist = NULL;
422 	if(!(whitelist = ecs_whitelist_create()))
423 		fatal_exit("Could not create ednssubnet whitelist: out of memory");
424         if(!ecs_whitelist_apply_cfg(whitelist, cfg))
425 		fatal_exit("Could not setup ednssubnet whitelist");
426 	ecs_whitelist_delete(whitelist);
427 }
428 #endif /* CLIENT_SUBNET */
429 
430 /** check that the modules exist, are compiled in */
431 static void
432 check_modules_exist(const char* module_conf)
433 {
434 	const char** names = module_list_avail();
435 	const char* s = module_conf;
436 	while(*s) {
437 		int i = 0;
438 		int is_ok = 0;
439 		while(*s && isspace((unsigned char)*s))
440 			s++;
441 		if(!*s) break;
442 		while(names[i]) {
443 			if(strncmp(names[i], s, strlen(names[i])) == 0) {
444 				is_ok = 1;
445 				break;
446 			}
447 			i++;
448 		}
449 		if(is_ok == 0) {
450 			char n[64];
451 			size_t j;
452 			n[0]=0;
453 			n[sizeof(n)-1]=0;
454 			for(j=0; j<sizeof(n)-1; j++) {
455 				if(!s[j] || isspace((unsigned char)s[j])) {
456 					n[j] = 0;
457 					break;
458 				}
459 				n[j] = s[j];
460 			}
461 			fatal_exit("module_conf lists module '%s' but that "
462 				"module is not available.", n);
463 		}
464 		s += strlen(names[i]);
465 	}
466 }
467 
468 /** check configuration for errors */
469 static void
470 morechecks(struct config_file* cfg)
471 {
472 	warn_hosts("stub-host", cfg->stubs);
473 	warn_hosts("forward-host", cfg->forwards);
474 	interfacechecks(cfg);
475 	aclchecks(cfg);
476 	tcpconnlimitchecks(cfg);
477 
478 	if(cfg->verbosity < 0)
479 		fatal_exit("verbosity value < 0");
480 	if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
481 		fatal_exit("num_threads value weird");
482 	if(!cfg->do_ip4 && !cfg->do_ip6)
483 		fatal_exit("ip4 and ip6 are both disabled, pointless");
484 	if(!cfg->do_ip6 && cfg->prefer_ip6)
485 		fatal_exit("cannot prefer and disable ip6, pointless");
486 	if(!cfg->do_udp && !cfg->do_tcp)
487 		fatal_exit("udp and tcp are both disabled, pointless");
488 	if(cfg->edns_buffer_size > cfg->msg_buffer_size)
489 		fatal_exit("edns-buffer-size larger than msg-buffer-size, "
490 			"answers will not fit in processing buffer");
491 #ifdef UB_ON_WINDOWS
492 	w_config_adjust_directory(cfg);
493 #endif
494 	if(cfg->chrootdir && cfg->chrootdir[0] &&
495 		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
496 		fatal_exit("chootdir %s has trailing slash '/' please remove.",
497 			cfg->chrootdir);
498 	if(cfg->chrootdir && cfg->chrootdir[0] &&
499 		!is_dir(cfg->chrootdir)) {
500 		fatal_exit("bad chroot directory");
501 	}
502 	if(cfg->directory && cfg->directory[0]) {
503 		char* ad = fname_after_chroot(cfg->directory, cfg, 0);
504 		if(!ad) fatal_exit("out of memory");
505 		if(!is_dir(ad)) fatal_exit("bad chdir directory");
506 		free(ad);
507 	}
508 	if( (cfg->chrootdir && cfg->chrootdir[0]) ||
509 	    (cfg->directory && cfg->directory[0])) {
510 		if(cfg->pidfile && cfg->pidfile[0]) {
511 			char* ad = (cfg->pidfile[0]=='/')?strdup(cfg->pidfile):
512 				fname_after_chroot(cfg->pidfile, cfg, 1);
513 			char* bd = basedir(ad);
514 			if(bd && !is_dir(bd))
515 				fatal_exit("pidfile directory does not exist");
516 			free(ad);
517 		}
518 		if(cfg->logfile && cfg->logfile[0]) {
519 			char* ad = fname_after_chroot(cfg->logfile, cfg, 1);
520 			char* bd = basedir(ad);
521 			if(bd && !is_dir(bd))
522 				fatal_exit("logfile directory does not exist");
523 			free(ad);
524 		}
525 	}
526 
527 	check_chroot_filelist("file with root-hints",
528 		cfg->root_hints, cfg->chrootdir, cfg);
529 	check_chroot_filelist("trust-anchor-file",
530 		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
531 	check_chroot_filelist("auto-trust-anchor-file",
532 		cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
533 	check_chroot_filelist_wild("trusted-keys-file",
534 		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
535 	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file,
536 		cfg->chrootdir, cfg);
537 #ifdef USE_IPSECMOD
538 	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
539 		/* only check hook if enabled */
540 		check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
541 			cfg->chrootdir, cfg);
542 	}
543 #endif
544 	/* remove chroot setting so that modules are not stripping pathnames*/
545 	free(cfg->chrootdir);
546 	cfg->chrootdir = NULL;
547 
548 	/* check that the modules listed in module_conf exist */
549 	check_modules_exist(cfg->module_conf);
550 
551 	/* Respip is known to *not* work with dns64. */
552 	if(strcmp(cfg->module_conf, "iterator") != 0
553 		&& strcmp(cfg->module_conf, "validator iterator") != 0
554 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
555 		&& strcmp(cfg->module_conf, "dns64 iterator") != 0
556 		&& strcmp(cfg->module_conf, "respip iterator") != 0
557 		&& strcmp(cfg->module_conf, "respip validator iterator") != 0
558 #ifdef WITH_PYTHONMODULE
559 		&& strcmp(cfg->module_conf, "python iterator") != 0
560 		&& strcmp(cfg->module_conf, "python respip iterator") != 0
561 		&& strcmp(cfg->module_conf, "python validator iterator") != 0
562 		&& strcmp(cfg->module_conf, "python respip validator iterator") != 0
563 		&& strcmp(cfg->module_conf, "validator python iterator") != 0
564 		&& strcmp(cfg->module_conf, "dns64 python iterator") != 0
565 		&& strcmp(cfg->module_conf, "dns64 python validator iterator") != 0
566 		&& strcmp(cfg->module_conf, "dns64 validator python iterator") != 0
567 		&& strcmp(cfg->module_conf, "python dns64 iterator") != 0
568 		&& strcmp(cfg->module_conf, "python dns64 validator iterator") != 0
569 #endif
570 #ifdef USE_CACHEDB
571 		&& strcmp(cfg->module_conf, "validator cachedb iterator") != 0
572 		&& strcmp(cfg->module_conf, "respip validator cachedb iterator") != 0
573 		&& strcmp(cfg->module_conf, "cachedb iterator") != 0
574 		&& strcmp(cfg->module_conf, "respip cachedb iterator") != 0
575 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
576 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
577 #endif
578 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
579 		&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
580 		&& strcmp(cfg->module_conf, "python dns64 validator cachedb iterator") != 0
581 		&& strcmp(cfg->module_conf, "dns64 python cachedb iterator") != 0
582 		&& strcmp(cfg->module_conf, "dns64 python validator cachedb iterator") != 0
583 		&& strcmp(cfg->module_conf, "python cachedb iterator") != 0
584 		&& strcmp(cfg->module_conf, "python respip cachedb iterator") != 0
585 		&& strcmp(cfg->module_conf, "python validator cachedb iterator") != 0
586 		&& strcmp(cfg->module_conf, "python respip validator cachedb iterator") != 0
587 		&& strcmp(cfg->module_conf, "cachedb python iterator") != 0
588 		&& strcmp(cfg->module_conf, "respip cachedb python iterator") != 0
589 		&& strcmp(cfg->module_conf, "validator cachedb python iterator") != 0
590 		&& strcmp(cfg->module_conf, "respip validator cachedb python iterator") != 0
591 		&& strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
592 		&& strcmp(cfg->module_conf, "respip validator python cachedb iterator") != 0
593 #endif
594 #ifdef CLIENT_SUBNET
595 		&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
596 		&& strcmp(cfg->module_conf, "respip subnetcache iterator") != 0
597 		&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
598 		&& strcmp(cfg->module_conf, "respip subnetcache validator iterator") != 0
599 		&& strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
600 		&& strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
601 #endif
602 #if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
603 		&& strcmp(cfg->module_conf, "python subnetcache iterator") != 0
604 		&& strcmp(cfg->module_conf, "python respip subnetcache iterator") != 0
605 		&& strcmp(cfg->module_conf, "subnetcache python iterator") != 0
606 		&& strcmp(cfg->module_conf, "respip subnetcache python iterator") != 0
607 		&& strcmp(cfg->module_conf, "python subnetcache validator iterator") != 0
608 		&& strcmp(cfg->module_conf, "python respip subnetcache validator iterator") != 0
609 		&& strcmp(cfg->module_conf, "subnetcache python validator iterator") != 0
610 		&& strcmp(cfg->module_conf, "respip subnetcache python validator iterator") != 0
611 		&& strcmp(cfg->module_conf, "subnetcache validator python iterator") != 0
612 		&& strcmp(cfg->module_conf, "respip subnetcache validator python iterator") != 0
613 #endif
614 #ifdef USE_IPSECMOD
615 		&& strcmp(cfg->module_conf, "ipsecmod iterator") != 0
616 		&& strcmp(cfg->module_conf, "ipsecmod respip iterator") != 0
617 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
618 		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
619 #endif
620 #if defined(WITH_PYTHONMODULE) && defined(USE_IPSECMOD)
621 		&& strcmp(cfg->module_conf, "python ipsecmod iterator") != 0
622 		&& strcmp(cfg->module_conf, "python ipsecmod respip iterator") != 0
623 		&& strcmp(cfg->module_conf, "ipsecmod python iterator") != 0
624 		&& strcmp(cfg->module_conf, "ipsecmod python respip iterator") != 0
625 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
626 		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
627 		&& strcmp(cfg->module_conf, "python ipsecmod validator iterator") != 0
628 		&& strcmp(cfg->module_conf, "python ipsecmod respip validator iterator") != 0
629 		&& strcmp(cfg->module_conf, "ipsecmod python validator iterator") != 0
630 		&& strcmp(cfg->module_conf, "ipsecmod python respip validator iterator") != 0
631 		&& strcmp(cfg->module_conf, "ipsecmod validator python iterator") != 0
632 		&& strcmp(cfg->module_conf, "ipsecmod respip validator python iterator") != 0
633 #endif
634 #ifdef USE_IPSET
635 		&& strcmp(cfg->module_conf, "validator ipset iterator") != 0
636 		&& strcmp(cfg->module_conf, "validator ipset respip iterator") != 0
637 		&& strcmp(cfg->module_conf, "ipset iterator") != 0
638 		&& strcmp(cfg->module_conf, "ipset respip iterator") != 0
639 #endif
640 		) {
641 		fatal_exit("module conf '%s' is not known to work",
642 			cfg->module_conf);
643 	}
644 
645 #ifdef HAVE_GETPWNAM
646 	if(cfg->username && cfg->username[0]) {
647 		if(getpwnam(cfg->username) == NULL)
648 			fatal_exit("user '%s' does not exist.", cfg->username);
649 #  ifdef HAVE_ENDPWENT
650 		endpwent();
651 #  endif
652 	}
653 #endif
654 	if(cfg->remote_control_enable && options_remote_is_address(cfg)
655 		&& cfg->control_use_cert) {
656 		check_chroot_string("server-key-file", &cfg->server_key_file,
657 			cfg->chrootdir, cfg);
658 		check_chroot_string("server-cert-file", &cfg->server_cert_file,
659 			cfg->chrootdir, cfg);
660 		if(!is_file(cfg->control_key_file))
661 			fatal_exit("control-key-file: \"%s\" does not exist",
662 				cfg->control_key_file);
663 		if(!is_file(cfg->control_cert_file))
664 			fatal_exit("control-cert-file: \"%s\" does not exist",
665 				cfg->control_cert_file);
666 	}
667 
668 	donotquerylocalhostcheck(cfg);
669 	localzonechecks(cfg);
670 	view_and_respipchecks(cfg);
671 #ifdef CLIENT_SUBNET
672 	ecs_conf_checks(cfg);
673 #endif
674 }
675 
676 /** check forwards */
677 static void
678 check_fwd(struct config_file* cfg)
679 {
680 	struct iter_forwards* fwd = forwards_create();
681 	if(!fwd || !forwards_apply_cfg(fwd, cfg)) {
682 		fatal_exit("Could not set forward zones");
683 	}
684 	forwards_delete(fwd);
685 }
686 
687 /** check hints */
688 static void
689 check_hints(struct config_file* cfg)
690 {
691 	struct iter_hints* hints = hints_create();
692 	if(!hints || !hints_apply_cfg(hints, cfg)) {
693 		fatal_exit("Could not set root or stub hints");
694 	}
695 	hints_delete(hints);
696 }
697 
698 /** check auth zones */
699 static void
700 check_auth(struct config_file* cfg)
701 {
702 	int is_rpz = 0;
703 	struct auth_zones* az = auth_zones_create();
704 	if(!az || !auth_zones_apply_cfg(az, cfg, 0i, &is_rpz)) {
705 		fatal_exit("Could not setup authority zones");
706 	}
707 	auth_zones_delete(az);
708 }
709 
710 /** check config file */
711 static void
712 checkconf(const char* cfgfile, const char* opt, int final)
713 {
714 	char oldwd[4096];
715 	struct config_file* cfg = config_create();
716 	if(!cfg)
717 		fatal_exit("out of memory");
718 	oldwd[0] = 0;
719 	if(!getcwd(oldwd, sizeof(oldwd))) {
720 		log_err("cannot getcwd: %s", strerror(errno));
721 		oldwd[0] = 0;
722 	}
723 	if(!config_read(cfg, cfgfile, NULL)) {
724 		/* config_read prints messages to stderr */
725 		config_delete(cfg);
726 		exit(1);
727 	}
728 	if(oldwd[0] && chdir(oldwd) == -1)
729 		log_err("cannot chdir(%s): %s", oldwd, strerror(errno));
730 	if(opt) {
731 		print_option(cfg, opt, final);
732 		config_delete(cfg);
733 		return;
734 	}
735 	morechecks(cfg);
736 	check_mod(cfg, iter_get_funcblock());
737 	check_mod(cfg, val_get_funcblock());
738 #ifdef WITH_PYTHONMODULE
739 	if(strstr(cfg->module_conf, "python"))
740 		check_mod(cfg, pythonmod_get_funcblock());
741 #endif
742 	check_fwd(cfg);
743 	check_hints(cfg);
744 	check_auth(cfg);
745 	printf("unbound-checkconf: no errors in %s\n", cfgfile);
746 	config_delete(cfg);
747 }
748 
749 /** getopt global, in case header files fail to declare it. */
750 extern int optind;
751 /** getopt global, in case header files fail to declare it. */
752 extern char* optarg;
753 
754 /** Main routine for checkconf */
755 int main(int argc, char* argv[])
756 {
757 	int c;
758 	int final = 0;
759 	const char* f;
760 	const char* opt = NULL;
761 	const char* cfgfile = CONFIGFILE;
762 	log_ident_set("unbound-checkconf");
763 	log_init(NULL, 0, NULL);
764 	checklock_start();
765 #ifdef USE_WINSOCK
766 	/* use registry config file in preference to compiletime location */
767 	if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
768 		cfgfile = CONFIGFILE;
769 #endif /* USE_WINSOCK */
770 	/* parse the options */
771 	while( (c=getopt(argc, argv, "fho:")) != -1) {
772 		switch(c) {
773 		case 'f':
774 			final = 1;
775 			break;
776 		case 'o':
777 			opt = optarg;
778 			break;
779 		case '?':
780 		case 'h':
781 		default:
782 			usage();
783 		}
784 	}
785 	argc -= optind;
786 	argv += optind;
787 	if(argc != 0 && argc != 1)
788 		usage();
789 	if(argc == 1)
790 		f = argv[0];
791 	else	f = cfgfile;
792 	checkconf(f, opt, final);
793 	checklock_stop();
794 	return 0;
795 }
796