1 /* 2 * checkconf - Read and repeat configuration file to output. 3 * 4 * Copyright (c) 2001-2006, NLnet Labs. All rights reserved. 5 * 6 * See LICENSE for the license. 7 * 8 */ 9 #include "config.h" 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <unistd.h> 13 #include <string.h> 14 #include <limits.h> 15 #include "tsig.h" 16 #include "options.h" 17 #include "util.h" 18 #include "dname.h" 19 #include "rrl.h" 20 21 extern char *optarg; 22 extern int optind; 23 static void usage(void) ATTR_NORETURN; 24 25 #define ZONE_GET_ACL(NAME, VAR, PATTERN) \ 26 if (strcasecmp(#NAME, (VAR)) == 0) { \ 27 quote_acl(PATTERN->NAME); \ 28 return; \ 29 } 30 31 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN) \ 32 if (strcasecmp(#NAME, (VAR)) == 0) { \ 33 acl_options_type* acl; \ 34 for(acl=PATTERN->NAME; acl; acl=acl->next) \ 35 quote(acl->ip_address_spec); \ 36 return; \ 37 } 38 39 #define ZONE_GET_STR(NAME, VAR, PATTERN) \ 40 if (strcasecmp(#NAME, (VAR)) == 0) { \ 41 quote(PATTERN->NAME); \ 42 return; \ 43 } 44 45 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) \ 46 if (strcasecmp(#NAME, (VAR)) == 0) { \ 47 quotepath(opt, FINAL, PATTERN->NAME); \ 48 return; \ 49 } 50 51 #define ZONE_GET_BIN(NAME, VAR, PATTERN) \ 52 if (strcasecmp(#NAME, (VAR)) == 0) { \ 53 printf("%s\n", (PATTERN->NAME)?"yes":"no"); \ 54 return; \ 55 } 56 57 #define ZONE_GET_RRL(NAME, VAR, PATTERN) \ 58 if (strcasecmp(#NAME, (VAR)) == 0) { \ 59 zone_print_rrl_whitelist("", PATTERN->NAME); \ 60 return; \ 61 } 62 63 #define ZONE_GET_INT(NAME, VAR, PATTERN) \ 64 if (strcasecmp(#NAME, (VAR)) == 0) { \ 65 printf("%d\n", (int) PATTERN->NAME); \ 66 return; \ 67 } 68 69 #define SERV_GET_BIN(NAME, VAR) \ 70 if (strcasecmp(#NAME, (VAR)) == 0) { \ 71 printf("%s\n", opt->NAME?"yes":"no"); \ 72 return; \ 73 } 74 75 #define SERV_GET_STR(NAME, VAR) \ 76 if (strcasecmp(#NAME, (VAR)) == 0) { \ 77 quote(opt->NAME); \ 78 return; \ 79 } 80 81 #define SERV_GET_PATH(FINAL, NAME, VAR) \ 82 if (strcasecmp(#NAME, (VAR)) == 0) { \ 83 quotepath(opt, FINAL, opt->NAME); \ 84 return; \ 85 } 86 87 #define SERV_GET_INT(NAME, VAR) \ 88 if (strcasecmp(#NAME, (VAR)) == 0) { \ 89 printf("%d\n", (int) opt->NAME); \ 90 return; \ 91 } 92 93 #define SERV_GET_IP(NAME, MEMBER, VAR) \ 94 if (strcasecmp(#NAME, (VAR)) == 0) { \ 95 for(ip = opt->MEMBER; ip; ip=ip->next) \ 96 { \ 97 quote(ip->address); \ 98 } \ 99 return; \ 100 } 101 102 #ifdef RATELIMIT 103 static void zone_print_rrl_whitelist(const char* s, uint16_t w) 104 { 105 int i; 106 if(w==rrl_type_all) { 107 printf("%sall\n", s); 108 return; 109 } 110 for(i=0x01; i <= 0x80; i<<=1) { 111 if( (w&i) ) 112 printf("%s%s\n", s, rrltype2str(i)); 113 } 114 } 115 #endif /* RATELIMIT */ 116 117 static char buf[BUFSIZ]; 118 119 static char * 120 underscore(const char *s) { 121 const char *j = s; 122 size_t i = 0; 123 124 while(j && *j) { 125 if (*j == '-') { 126 buf[i++] = '_'; 127 } else { 128 buf[i++] = *j; 129 } 130 j++; 131 if (i >= BUFSIZ) { 132 return NULL; 133 } 134 } 135 buf[i] = '\0'; 136 return buf; 137 } 138 139 static void 140 usage(void) 141 { 142 fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n"); 143 fprintf(stderr, " [-s keyname] [-t tlsauthname] <configfilename>\n"); 144 fprintf(stderr, " Checks NSD configuration file for errors.\n"); 145 fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n", 146 PACKAGE_VERSION, PACKAGE_BUGREPORT); 147 fprintf(stderr, "Use with a configfile as argument to check syntax.\n"); 148 fprintf(stderr, "Use with -o, -z, -t or -s options to query the configuration.\n\n"); 149 fprintf(stderr, "-v Verbose, echo settings that take effect to std output.\n"); 150 fprintf(stderr, "-h Print this help information.\n"); 151 fprintf(stderr, "-f Use with -o to print final pathnames, ie. with chroot.\n"); 152 fprintf(stderr, "-o option Print value of the option specified to stdout.\n"); 153 fprintf(stderr, "-p pattern Print option value for the pattern given.\n"); 154 fprintf(stderr, "-z zonename Print option value for the zone given.\n"); 155 fprintf(stderr, "-a keyname Print algorithm name for the TSIG key.\n"); 156 fprintf(stderr, "-s keyname Print base64 secret blob for the TSIG key.\n"); 157 fprintf(stderr, "-t tls-auth-name Print auth domain name for the tls-auth clause.\n"); 158 exit(1); 159 } 160 161 static void 162 print_string_var(const char* varname, const char* value) 163 { 164 if (!value) { 165 printf("\t#%s\n", varname); 166 } else { 167 printf("\t%s \"%s\"\n", varname, value); 168 } 169 } 170 171 static void 172 quote(const char *v) 173 { 174 if(v==NULL) 175 printf("\n"); 176 else 177 printf("%s\n", v); 178 } 179 180 static void 181 quotepath(nsd_options_type* opt, int final, const char *f) 182 { 183 const char* chr = opt->chroot; 184 #ifdef CHROOTDIR 185 if(chr == 0) chr = CHROOTDIR; 186 #endif 187 if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) { 188 quote(f); 189 return; 190 } 191 /* chroot has had trailing slash applied in check part of checkconf */ 192 printf("%s%s\n", chr, f); 193 } 194 195 static void 196 quote_acl(acl_options_type* acl) 197 { 198 while(acl) 199 { 200 if (acl->tls_auth_name) 201 printf("%s %s %s\n", acl->ip_address_spec, 202 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 203 (acl->key_name?acl->key_name:"(null)")), 204 acl->tls_auth_name?acl->tls_auth_name:""); 205 else 206 printf("%s %s\n", acl->ip_address_spec, 207 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 208 (acl->key_name?acl->key_name:"(null)"))); 209 acl=acl->next; 210 } 211 } 212 213 static void 214 print_acl(const char* varname, acl_options_type* acl) 215 { 216 while(acl) 217 { 218 printf("\t%s ", varname); 219 if(acl->use_axfr_only) 220 printf("AXFR "); 221 if(acl->allow_udp) 222 printf("UDP "); 223 if (acl->tls_auth_name) 224 printf("%s %s %s\n", acl->ip_address_spec, 225 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 226 (acl->key_name?acl->key_name:"(null)")), 227 acl->tls_auth_name?acl->tls_auth_name:""); 228 else 229 printf("%s %s\n", acl->ip_address_spec, 230 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 231 (acl->key_name?acl->key_name:"(null)"))); 232 if(verbosity>1) { 233 printf("\t# %s", acl->is_ipv6?"ip6":"ip4"); 234 if(acl->port == 0) printf(" noport"); 235 else printf(" port=%d", acl->port); 236 if(acl->rangetype == acl_range_single) printf(" single"); 237 if(acl->rangetype == acl_range_mask) printf(" masked"); 238 if(acl->rangetype == acl_range_subnet) printf(" subnet"); 239 if(acl->rangetype == acl_range_minmax) printf(" minmax"); 240 if(acl->is_ipv6) { 241 #ifdef INET6 242 char dest[128]; 243 inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest)); 244 printf(" addr=%s", dest); 245 if(acl->rangetype != acl_range_single) { 246 inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest)); 247 printf(" rangemask=%s", dest); 248 } 249 #else 250 printf(" ip6addr-noip6defined"); 251 #endif 252 } else { 253 char dest[128]; 254 inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest)); 255 printf(" addr=%s", dest); 256 if(acl->rangetype != acl_range_single) { 257 inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest)); 258 printf(" rangemask=%s", dest); 259 } 260 } 261 printf("\n"); 262 } 263 acl=acl->next; 264 } 265 } 266 267 static void 268 print_acl_ips(const char* varname, acl_options_type* acl) 269 { 270 while(acl) 271 { 272 printf("\t%s %s\n", varname, acl->ip_address_spec); 273 acl=acl->next; 274 } 275 } 276 277 void 278 config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o, 279 const char *z, const char* pat, const char* tls, int final) 280 { 281 ip_address_option_type* ip; 282 283 if (k) { 284 /* find key */ 285 key_options_type* key = key_options_find(opt, k); 286 if(key) { 287 if (s) { 288 quote(key->secret); 289 } else { 290 quote(key->algorithm); 291 } 292 return; 293 } 294 printf("Could not find key %s\n", k); 295 return; 296 } 297 298 if (tls) { 299 /* find tlsauth */ 300 tls_auth_options_type* tlsauth = tls_auth_options_find(opt, tls); 301 if(tlsauth) { 302 quote(tlsauth->auth_domain_name); 303 return; 304 } 305 printf("Could not find tls-auth %s\n", tls); 306 return; 307 } 308 309 if (!o) { 310 return; 311 } 312 313 if (z) { 314 zone_options_type* zone; 315 const dname_type *dname = dname_parse(opt->region, z); 316 if(!dname) { 317 printf("Could not parse zone name %s\n", z); 318 exit(1); 319 } 320 zone = zone_options_find(opt, dname); 321 if(!zone) { 322 printf("Zone does not exist: %s\n", z); 323 exit(1); 324 } 325 ZONE_GET_STR(name, o, zone); 326 if(strcasecmp("pattern", o)==0) { 327 quote(zone->pattern->pname); 328 return; 329 } 330 ZONE_GET_BIN(part_of_config, o, zone); 331 ZONE_GET_PATH(final, zonefile, o, zone->pattern); 332 ZONE_GET_ACL(allow_query, o, zone->pattern); 333 ZONE_GET_ACL(request_xfr, o, zone->pattern); 334 ZONE_GET_ACL(provide_xfr, o, zone->pattern); 335 ZONE_GET_ACL(allow_notify, o, zone->pattern); 336 ZONE_GET_ACL(notify, o, zone->pattern); 337 ZONE_GET_BIN(notify_retry, o, zone->pattern); 338 ZONE_GET_STR(zonestats, o, zone->pattern); 339 ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern); 340 ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern); 341 ZONE_GET_INT(max_refresh_time, o, zone->pattern); 342 ZONE_GET_INT(min_refresh_time, o, zone->pattern); 343 ZONE_GET_INT(max_retry_time, o, zone->pattern); 344 ZONE_GET_INT(min_retry_time, o, zone->pattern); 345 ZONE_GET_INT(min_expire_time, o, zone->pattern); 346 ZONE_GET_INT(size_limit_xfr, o, zone->pattern); 347 #ifdef RATELIMIT 348 ZONE_GET_RRL(rrl_whitelist, o, zone->pattern); 349 #endif 350 ZONE_GET_BIN(multi_master_check, o, zone->pattern); 351 printf("Zone option not handled: %s %s\n", z, o); 352 exit(1); 353 } else if(pat) { 354 pattern_options_type* p = pattern_options_find(opt, pat); 355 if(!p) { 356 printf("Pattern does not exist: %s\n", pat); 357 exit(1); 358 } 359 if(strcasecmp("name", o)==0) { 360 quote(p->pname); 361 return; 362 } 363 ZONE_GET_STR(zonefile, o, p); 364 ZONE_GET_PATH(final, zonefile, o, p); 365 ZONE_GET_ACL(allow_query, o, p); 366 ZONE_GET_ACL(request_xfr, o, p); 367 ZONE_GET_ACL(provide_xfr, o, p); 368 ZONE_GET_ACL(allow_notify, o, p); 369 ZONE_GET_ACL(notify, o, p); 370 ZONE_GET_BIN(notify_retry, o, p); 371 ZONE_GET_STR(zonestats, o, p); 372 ZONE_GET_OUTGOING(outgoing_interface, o, p); 373 ZONE_GET_BIN(allow_axfr_fallback, o, p); 374 ZONE_GET_INT(max_refresh_time, o, p); 375 ZONE_GET_INT(min_refresh_time, o, p); 376 ZONE_GET_INT(max_retry_time, o, p); 377 ZONE_GET_INT(min_retry_time, o, p); 378 ZONE_GET_INT(min_expire_time, o, p); 379 ZONE_GET_INT(size_limit_xfr, o, p); 380 #ifdef RATELIMIT 381 ZONE_GET_RRL(rrl_whitelist, o, p); 382 #endif 383 ZONE_GET_BIN(multi_master_check, o, p); 384 printf("Pattern option not handled: %s %s\n", pat, o); 385 exit(1); 386 } else { 387 /* look in the server section */ 388 SERV_GET_IP(ip_address, ip_addresses, o); 389 /* bin */ 390 SERV_GET_BIN(ip_transparent, o); 391 SERV_GET_BIN(ip_freebind, o); 392 SERV_GET_BIN(debug_mode, o); 393 SERV_GET_BIN(do_ip4, o); 394 SERV_GET_BIN(do_ip6, o); 395 SERV_GET_BIN(reuseport, o); 396 SERV_GET_BIN(hide_version, o); 397 SERV_GET_BIN(hide_identity, o); 398 SERV_GET_BIN(drop_updates, o); 399 SERV_GET_BIN(zonefiles_check, o); 400 SERV_GET_BIN(log_time_ascii, o); 401 SERV_GET_BIN(round_robin, o); 402 SERV_GET_BIN(minimal_responses, o); 403 SERV_GET_BIN(confine_to_zone, o); 404 SERV_GET_BIN(refuse_any, o); 405 SERV_GET_BIN(tcp_reject_overflow, o); 406 SERV_GET_BIN(log_only_syslog, o); 407 /* str */ 408 SERV_GET_PATH(final, database, o); 409 SERV_GET_STR(identity, o); 410 SERV_GET_STR(version, o); 411 SERV_GET_STR(nsid, o); 412 SERV_GET_PATH(final, logfile, o); 413 SERV_GET_PATH(final, pidfile, o); 414 SERV_GET_STR(chroot, o); 415 SERV_GET_STR(username, o); 416 SERV_GET_PATH(final, zonesdir, o); 417 SERV_GET_PATH(final, xfrdfile, o); 418 SERV_GET_PATH(final, xfrdir, o); 419 SERV_GET_PATH(final, zonelistfile, o); 420 SERV_GET_STR(port, o); 421 SERV_GET_STR(tls_service_key, o); 422 SERV_GET_STR(tls_service_ocsp, o); 423 SERV_GET_STR(tls_service_pem, o); 424 SERV_GET_STR(tls_port, o); 425 SERV_GET_STR(tls_cert_bundle, o); 426 SERV_GET_STR(cookie_secret, o); 427 SERV_GET_STR(cookie_secret_file, o); 428 SERV_GET_BIN(answer_cookie, o); 429 /* int */ 430 SERV_GET_INT(server_count, o); 431 SERV_GET_INT(tcp_count, o); 432 SERV_GET_INT(tcp_query_count, o); 433 SERV_GET_INT(tcp_timeout, o); 434 SERV_GET_INT(tcp_mss, o); 435 SERV_GET_INT(outgoing_tcp_mss, o); 436 SERV_GET_INT(ipv4_edns_size, o); 437 SERV_GET_INT(ipv6_edns_size, o); 438 SERV_GET_INT(statistics, o); 439 SERV_GET_INT(xfrd_reload_timeout, o); 440 SERV_GET_INT(verbosity, o); 441 SERV_GET_INT(send_buffer_size, o); 442 SERV_GET_INT(receive_buffer_size, o); 443 #ifdef RATELIMIT 444 SERV_GET_INT(rrl_size, o); 445 SERV_GET_INT(rrl_ratelimit, o); 446 SERV_GET_INT(rrl_slip, o); 447 SERV_GET_INT(rrl_ipv4_prefix_length, o); 448 SERV_GET_INT(rrl_ipv6_prefix_length, o); 449 SERV_GET_INT(rrl_whitelist_ratelimit, o); 450 #endif 451 #ifdef USE_DNSTAP 452 SERV_GET_BIN(dnstap_enable, o); 453 SERV_GET_STR(dnstap_socket_path, o); 454 SERV_GET_BIN(dnstap_send_identity, o); 455 SERV_GET_BIN(dnstap_send_version, o); 456 SERV_GET_STR(dnstap_identity, o); 457 SERV_GET_STR(dnstap_version, o); 458 SERV_GET_BIN(dnstap_log_auth_query_messages, o); 459 SERV_GET_BIN(dnstap_log_auth_response_messages, o); 460 #endif 461 SERV_GET_INT(zonefiles_write, o); 462 /* remote control */ 463 SERV_GET_BIN(control_enable, o); 464 SERV_GET_IP(control_interface, control_interface, o); 465 SERV_GET_INT(control_port, o); 466 SERV_GET_STR(server_key_file, o); 467 SERV_GET_STR(server_cert_file, o); 468 SERV_GET_STR(control_key_file, o); 469 SERV_GET_STR(control_cert_file, o); 470 471 if(strcasecmp(o, "zones") == 0) { 472 zone_options_type* zone; 473 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 474 quote(zone->name); 475 return; 476 } 477 if(strcasecmp(o, "patterns") == 0) { 478 pattern_options_type* p; 479 RBTREE_FOR(p, pattern_options_type*, opt->patterns) 480 quote(p->pname); 481 return; 482 } 483 printf("Server option not handled: %s\n", o); 484 exit(1); 485 } 486 } 487 488 /* print zone content items */ 489 static void print_zone_content_elems(pattern_options_type* pat) 490 { 491 if(pat->zonefile) 492 print_string_var("zonefile:", pat->zonefile); 493 #ifdef RATELIMIT 494 zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist); 495 #endif 496 print_acl("allow_query:", pat->allow_query); 497 print_acl("allow-notify:", pat->allow_notify); 498 print_acl("request-xfr:", pat->request_xfr); 499 if(pat->multi_master_check) 500 printf("\tmulti-master-check: %s\n", pat->multi_master_check?"yes":"no"); 501 if(!pat->notify_retry_is_default) 502 printf("\tnotify-retry: %d\n", pat->notify_retry); 503 print_acl("notify:", pat->notify); 504 print_acl("provide-xfr:", pat->provide_xfr); 505 if(pat->zonestats) 506 print_string_var("zonestats:", pat->zonestats); 507 print_acl_ips("outgoing-interface:", pat->outgoing_interface); 508 if(!pat->allow_axfr_fallback_is_default) 509 printf("\tallow-axfr-fallback: %s\n", 510 pat->allow_axfr_fallback?"yes":"no"); 511 if(!pat->max_refresh_time_is_default) 512 printf("\tmax-refresh-time: %d\n", pat->max_refresh_time); 513 if(!pat->min_refresh_time_is_default) 514 printf("\tmin-refresh-time: %d\n", pat->min_refresh_time); 515 if(!pat->max_retry_time_is_default) 516 printf("\tmax-retry-time: %d\n", pat->max_retry_time); 517 if(!pat->min_retry_time_is_default) 518 printf("\tmin-retry-time: %d\n", pat->min_retry_time); 519 if(pat->min_expire_time_expr == REFRESHPLUSRETRYPLUS1) 520 printf("\tmin-expire-time: " REFRESHPLUSRETRYPLUS1_STR "\n"); 521 else if(pat->min_expire_time_expr == EXPIRE_TIME_HAS_VALUE) 522 printf("\tmin-expire-time: %d\n", pat->min_expire_time); 523 if(pat->size_limit_xfr != 0) 524 printf("\tsize-limit-xfr: %llu\n", 525 (long long unsigned)pat->size_limit_xfr); 526 } 527 528 void 529 config_test_print_server(nsd_options_type* opt) 530 { 531 ip_address_option_type* ip; 532 key_options_type* key; 533 tls_auth_options_type* tlsauth; 534 zone_options_type* zone; 535 pattern_options_type* pat; 536 537 printf("# Config settings.\n"); 538 printf("server:\n"); 539 printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no"); 540 printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no"); 541 printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no"); 542 printf("\treuseport: %s\n", opt->reuseport?"yes":"no"); 543 printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no"); 544 printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no"); 545 printf("\tsend-buffer-size: %d\n", opt->send_buffer_size); 546 printf("\treceive-buffer-size: %d\n", opt->receive_buffer_size); 547 printf("\thide-version: %s\n", opt->hide_version?"yes":"no"); 548 printf("\thide-identity: %s\n", opt->hide_identity?"yes":"no"); 549 printf("\tdrop-updates: %s\n", opt->drop_updates?"yes":"no"); 550 printf("\ttcp-reject-overflow: %s\n", 551 opt->tcp_reject_overflow ? "yes" : "no"); 552 print_string_var("database:", opt->database); 553 print_string_var("identity:", opt->identity); 554 print_string_var("version:", opt->version); 555 print_string_var("nsid:", opt->nsid); 556 print_string_var("logfile:", opt->logfile); 557 printf("\tlog-only-syslog: %s\n", opt->log_only_syslog?"yes":"no"); 558 printf("\tserver-count: %d\n", opt->server_count); 559 if(opt->cpu_affinity) { 560 cpu_option_type *n; 561 printf("\tcpu-affinity:"); 562 for(n = opt->cpu_affinity; n; n = n->next) { 563 printf(" %d", n->cpu); 564 } 565 printf("\n"); 566 } 567 if(opt->cpu_affinity && opt->service_cpu_affinity) { 568 cpu_map_option_type *n; 569 for(n = opt->service_cpu_affinity; n; n = n->next) { 570 if(n->service > 0) { 571 printf("\tserver-%d-cpu-affinity: %d\n", 572 n->service, n->cpu); 573 } else if(n->service == -1) { 574 printf("\txfrd-cpu-affinity: %d\n", 575 n->cpu); 576 } 577 } 578 } 579 printf("\ttcp-count: %d\n", opt->tcp_count); 580 printf("\ttcp-query-count: %d\n", opt->tcp_query_count); 581 printf("\ttcp-timeout: %d\n", opt->tcp_timeout); 582 printf("\ttcp-mss: %d\n", opt->tcp_mss); 583 printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss); 584 printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size); 585 printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size); 586 print_string_var("pidfile:", opt->pidfile); 587 print_string_var("port:", opt->port); 588 printf("\tstatistics: %d\n", opt->statistics); 589 print_string_var("chroot:", opt->chroot); 590 print_string_var("username:", opt->username); 591 print_string_var("zonesdir:", opt->zonesdir); 592 print_string_var("xfrdfile:", opt->xfrdfile); 593 print_string_var("zonelistfile:", opt->zonelistfile); 594 print_string_var("xfrdir:", opt->xfrdir); 595 printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout); 596 printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no"); 597 printf("\tround-robin: %s\n", opt->round_robin?"yes":"no"); 598 printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no"); 599 printf("\tconfine-to-zone: %s\n", 600 opt->confine_to_zone ? "yes" : "no"); 601 printf("\trefuse-any: %s\n", opt->refuse_any?"yes":"no"); 602 printf("\tverbosity: %d\n", opt->verbosity); 603 for(ip = opt->ip_addresses; ip; ip=ip->next) 604 { 605 printf("\tip-address: %s", ip->address); 606 if(ip->servers) { 607 const char *sep; 608 struct range_option *n; 609 printf(" servers=\""); 610 for(n=ip->servers, sep=""; n; n = n->next, sep=" ") { 611 if(n->first == n->last) { 612 printf("%s%d", sep, n->first); 613 } else { 614 printf("%s%d-%d", sep, n->first, n->last); 615 } 616 } 617 printf("\""); 618 } 619 if(ip->fib != -1) { 620 printf(" setfib=%d", ip->fib); 621 } 622 printf("\n"); 623 } 624 #ifdef RATELIMIT 625 printf("\trrl-size: %d\n", (int)opt->rrl_size); 626 printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit); 627 printf("\trrl-slip: %d\n", (int)opt->rrl_slip); 628 printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length); 629 printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length); 630 printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit); 631 #endif 632 printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no"); 633 printf("\tzonefiles-write: %d\n", opt->zonefiles_write); 634 print_string_var("tls-service-key:", opt->tls_service_key); 635 print_string_var("tls-service-pem:", opt->tls_service_pem); 636 print_string_var("tls-service-ocsp:", opt->tls_service_ocsp); 637 print_string_var("tls-port:", opt->tls_port); 638 print_string_var("tls-cert-bundle:", opt->tls_cert_bundle); 639 printf("\tanswer-cookie: %s\n", opt->answer_cookie?"yes":"no"); 640 if (opt->cookie_secret) 641 print_string_var("cookie-secret:", opt->cookie_secret); 642 if (opt->cookie_secret_file) 643 print_string_var("cookie-secret-file:", opt->cookie_secret_file); 644 645 #ifdef USE_DNSTAP 646 printf("\ndnstap:\n"); 647 printf("\tdnstap-enable: %s\n", opt->dnstap_enable?"yes":"no"); 648 print_string_var("dnstap-socket-path:", opt->dnstap_socket_path); 649 printf("\tdnstap-send-identity: %s\n", opt->dnstap_send_identity?"yes":"no"); 650 printf("\tdnstap-send-version: %s\n", opt->dnstap_send_version?"yes":"no"); 651 print_string_var("dnstap-identity:", opt->dnstap_identity); 652 print_string_var("dnstap-version:", opt->dnstap_version); 653 printf("\tdnstap-log-auth-query-messages: %s\n", opt->dnstap_log_auth_query_messages?"yes":"no"); 654 printf("\tdnstap-log-auth-response-messages: %s\n", opt->dnstap_log_auth_response_messages?"yes":"no"); 655 #endif 656 657 printf("\nremote-control:\n"); 658 printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no"); 659 for(ip = opt->control_interface; ip; ip=ip->next) 660 print_string_var("control-interface:", ip->address); 661 printf("\tcontrol-port: %d\n", opt->control_port); 662 print_string_var("server-key-file:", opt->server_key_file); 663 print_string_var("server-cert-file:", opt->server_cert_file); 664 print_string_var("control-key-file:", opt->control_key_file); 665 print_string_var("control-cert-file:", opt->control_cert_file); 666 667 RBTREE_FOR(key, key_options_type*, opt->keys) 668 { 669 printf("\nkey:\n"); 670 print_string_var("name:", key->name); 671 print_string_var("algorithm:", key->algorithm); 672 print_string_var("secret:", key->secret); 673 } 674 RBTREE_FOR(tlsauth, tls_auth_options_type*, opt->tls_auths) 675 { 676 printf("\ntls-auth:\n"); 677 print_string_var("name:", tlsauth->name); 678 print_string_var("auth-domain-name:", tlsauth->auth_domain_name); 679 } 680 RBTREE_FOR(pat, pattern_options_type*, opt->patterns) 681 { 682 if(pat->implicit) continue; 683 printf("\npattern:\n"); 684 print_string_var("name:", pat->pname); 685 print_zone_content_elems(pat); 686 } 687 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 688 { 689 if(!zone->part_of_config) 690 continue; 691 printf("\nzone:\n"); 692 print_string_var("name:", zone->name); 693 print_zone_content_elems(zone->pattern); 694 } 695 } 696 697 static int 698 additional_checks(nsd_options_type* opt, const char* filename) 699 { 700 zone_options_type* zone; 701 int errors = 0; 702 703 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 704 { 705 const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */ 706 if(!dname) { 707 fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name); 708 errors ++; 709 continue; 710 } 711 #ifndef ROOT_SERVER 712 /* Is it a root zone? Are we a root server then? Idiot proof. */ 713 if(dname->label_count == 1) { 714 fprintf(stderr, "%s: not configured as a root server.\n", filename); 715 errors ++; 716 } 717 #endif 718 if(zone->pattern->allow_notify && !zone->pattern->request_xfr) { 719 fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr" 720 " items. Where can it get a zone transfer when a notify " 721 "is received?\n", filename, zone->name); 722 errors ++; 723 } 724 if(!zone_is_slave(zone) && (!zone->pattern->zonefile || 725 zone->pattern->zonefile[0] == 0)) { 726 fprintf(stderr, "%s: zone %s is a master zone but has " 727 "no zonefile. Where can the data come from?\n", 728 filename, zone->name); 729 errors ++; 730 } 731 } 732 733 #ifndef BIND8_STATS 734 if(opt->statistics > 0) 735 { 736 fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n", 737 filename, opt->statistics); 738 errors ++; 739 } 740 #endif 741 #ifndef HAVE_CHROOT 742 if(opt->chroot != 0) 743 { 744 fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n", 745 filename, opt->chroot); 746 errors ++; 747 } 748 #endif 749 if (opt->identity && strlen(opt->identity) > UCHAR_MAX) { 750 fprintf(stderr, "%s: server identity too long (%u characters)\n", 751 filename, (unsigned) strlen(opt->identity)); 752 errors ++; 753 } 754 if (opt->version && strlen(opt->version) > UCHAR_MAX) { 755 fprintf(stderr, "%s: server version too long (%u characters)\n", 756 filename, (unsigned) strlen(opt->version)); 757 errors ++; 758 } 759 760 /* not done here: parsing of ip-address. parsing of username. */ 761 762 if (opt->chroot && opt->chroot[0]) { 763 /* append trailing slash for strncmp checking */ 764 append_trailing_slash(&opt->chroot, opt->region); 765 append_trailing_slash(&opt->xfrdir, opt->region); 766 append_trailing_slash(&opt->zonesdir, opt->region); 767 768 /* zonesdir must be absolute and within chroot, 769 * all other pathnames may be relative to zonesdir */ 770 if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) { 771 fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n", 772 filename, opt->zonesdir, opt->chroot); 773 errors ++; 774 } 775 if (!file_inside_chroot(opt->pidfile, opt->chroot)) { 776 fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n", 777 filename, opt->pidfile, opt->chroot); 778 errors ++; 779 } 780 if (!file_inside_chroot(opt->database, opt->chroot)) { 781 fprintf(stderr, "%s: database %s is not relative to chroot %s.\n", 782 filename, opt->database, opt->chroot); 783 errors ++; 784 } 785 if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) { 786 fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n", 787 filename, opt->xfrdfile, opt->chroot); 788 errors ++; 789 } 790 if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) { 791 fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n", 792 filename, opt->zonelistfile, opt->chroot); 793 errors ++; 794 } 795 if (!file_inside_chroot(opt->xfrdir, opt->chroot)) { 796 fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n", 797 filename, opt->xfrdir, opt->chroot); 798 errors ++; 799 } 800 } 801 802 if (atoi(opt->port) <= 0) { 803 fprintf(stderr, "%s: port number '%s' is not a positive number.\n", 804 filename, opt->port); 805 errors ++; 806 } 807 if(errors != 0) { 808 fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys, %d tls-auth.\n", 809 filename, errors, (int)nsd_options_num_zones(opt), 810 (int)opt->keys->count, 811 (int)opt->tls_auths->count); 812 } 813 814 return (errors == 0); 815 } 816 817 int 818 main(int argc, char* argv[]) 819 { 820 int c; 821 int verbose = 0; 822 int key_sec = 0; 823 int final = 0; 824 const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */ 825 const char * conf_zone = NULL; /* what zone are we talking about */ 826 const char * conf_key = NULL; /* what key is needed */ 827 const char * conf_tlsauth = NULL; /* what tls-auth is needed */ 828 const char * conf_pat = NULL; /* what pattern is talked about */ 829 const char* configfile; 830 nsd_options_type *options; 831 832 log_init("nsd-checkconf"); 833 834 /* Parse the command line... */ 835 while ((c = getopt(argc, argv, "vfho:a:p:s:z:t:")) != -1) { 836 switch (c) { 837 case 'v': 838 verbose = 1; 839 verbosity++; 840 break; 841 case 'o': 842 conf_opt = optarg; 843 break; 844 case 'f': 845 final = 1; 846 break; 847 case 'p': 848 conf_pat = optarg; 849 break; 850 case 'a': 851 if (conf_key) { 852 fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n"); 853 exit(1); 854 } 855 conf_key = optarg; 856 break; 857 case 's': 858 if (conf_key) { 859 fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n"); 860 exit(1); 861 } 862 conf_key = optarg; 863 key_sec = 1; 864 break; 865 case 't': 866 conf_tlsauth = optarg; 867 break; 868 case 'z': 869 conf_zone = optarg; 870 break; 871 case 'h': 872 default: 873 usage(); 874 }; 875 } 876 argc -= optind; 877 argv += optind; 878 if (argc == 0 || argc>=2) { 879 usage(); 880 } 881 configfile = argv[0]; 882 883 /* read config file */ 884 options = nsd_options_create(region_create(xalloc, free)); 885 tsig_init(options->region); 886 if (!parse_options_file(options, configfile, NULL, NULL) || 887 !additional_checks(options, configfile)) { 888 exit(2); 889 } 890 if (conf_opt || conf_key || conf_tlsauth) { 891 config_print_zone(options, conf_key, key_sec, 892 underscore(conf_opt), conf_zone, conf_pat, conf_tlsauth, final); 893 } else { 894 if (verbose) { 895 printf("# Read file %s: %d patterns, %d fixed-zones, " 896 "%d keys, %d tls-auth.\n", 897 configfile, 898 (int)options->patterns->count, 899 (int)nsd_options_num_zones(options), 900 (int)options->keys->count, 901 (int)options->tls_auths->count); 902 config_test_print_server(options); 903 } 904 } 905 return 0; 906 } 907