xref: /openbsd/usr.sbin/nsd/nsd-checkconf.c (revision 275a8d89) 
1 /*
2  * checkconf - Read and repeat configuration file to output.
3  *
4  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  */
9 #include "config.h"
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <unistd.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "tsig.h"
16 #include "options.h"
17 #include "util.h"
18 #include "dname.h"
19 #include "rrl.h"
20 
21 extern char *optarg;
22 extern int optind;
23 
24 #define ZONE_GET_ACL(NAME, VAR, PATTERN) 		\
25 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
26 		quote_acl(PATTERN->NAME); 	\
27 		return; 			\
28 	}
29 
30 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN)			\
31 	if (strcasecmp(#NAME, (VAR)) == 0) {		\
32 		acl_options_t* acl; 			\
33 		for(acl=PATTERN->NAME; acl; acl=acl->next)	\
34 			quote(acl->ip_address_spec);	\
35 		return; 				\
36 	}
37 
38 #define ZONE_GET_STR(NAME, VAR, PATTERN) 		\
39 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
40 		quote(PATTERN->NAME); 		\
41 		return; 			\
42 	}
43 
44 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) 	\
45 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
46 		quotepath(opt, FINAL, PATTERN->NAME); 	\
47 		return; 				\
48 	}
49 
50 #define ZONE_GET_BIN(NAME, VAR, PATTERN) 			\
51 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
52 		printf("%s\n", (PATTERN->NAME)?"yes":"no"); 	\
53 		return;					\
54 	}
55 
56 #define ZONE_GET_RRL(NAME, VAR, PATTERN) 			\
57 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
58 		zone_print_rrl_whitelist("", PATTERN->NAME);	\
59 		return;					\
60 	}
61 
62 #define SERV_GET_BIN(NAME, VAR) 			\
63 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
64 		printf("%s\n", opt->NAME?"yes":"no"); 	\
65 		return;					\
66 	}
67 
68 #define SERV_GET_STR(NAME, VAR) 		\
69 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
70 		quote(opt->NAME); 		\
71 		return; 			\
72 	}
73 
74 #define SERV_GET_PATH(FINAL, NAME, VAR) 	\
75 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
76 		quotepath(opt, FINAL, opt->NAME); 	\
77 		return; 			\
78 	}
79 
80 #define SERV_GET_INT(NAME, VAR) 		\
81 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
82 		printf("%d\n", (int) opt->NAME); 	\
83 		return; 			\
84 	}
85 
86 #define SERV_GET_IP(NAME, MEMBER, VAR) 				\
87 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
88 		for(ip = opt->MEMBER; ip; ip=ip->next)	\
89 		{						\
90 			quote(ip->address);			\
91 		}						\
92 		return;						\
93 	}
94 
95 #ifdef RATELIMIT
96 static void zone_print_rrl_whitelist(const char* s, uint16_t w)
97 {
98 	int i;
99 	if(w==rrl_type_all) {
100 		printf("%sall\n", s);
101 		return;
102 	}
103 	for(i=0x01; i <= 0x80; i<<=1) {
104 		if( (w&i) )
105 			printf("%s%s\n", s, rrltype2str(i));
106 	}
107 }
108 #endif /* RATELIMIT */
109 
110 static char buf[BUFSIZ];
111 
112 static char *
113 underscore(const char *s) {
114 	const char *j = s;
115 	size_t i = 0;
116 
117 	while(j && *j) {
118 		if (*j == '-') {
119 			buf[i++] = '_';
120 		} else {
121 			buf[i++] = *j;
122 		}
123 		j++;
124 		if (i >= BUFSIZ) {
125 			return NULL;
126 		}
127 	}
128 	buf[i] = '\0';
129 	return buf;
130 }
131 
132 static void
133 usage(void)
134 {
135 	fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n");
136 	fprintf(stderr, "                     [-s keyname] <configfilename>\n");
137 	fprintf(stderr, "       Checks NSD configuration file for errors.\n");
138 	fprintf(stderr, "       Version %s. Report bugs to <%s>.\n\n",
139 		PACKAGE_VERSION, PACKAGE_BUGREPORT);
140 	fprintf(stderr, "Use with a configfile as argument to check syntax.\n");
141 	fprintf(stderr, "Use with -o, -z or -s options to query the configuration.\n\n");
142 	fprintf(stderr, "-v		Verbose, echo settings that take effect to std output.\n");
143 	fprintf(stderr, "-h		Print this help information.\n");
144 	fprintf(stderr, "-f		Use with -o to print final pathnames, ie. with chroot.\n");
145 	fprintf(stderr, "-o option	Print value of the option specified to stdout.\n");
146 	fprintf(stderr, "-p pattern	Print option value for the pattern given.\n");
147 	fprintf(stderr, "-z zonename	Print option value for the zone given.\n");
148 	fprintf(stderr, "-a keyname	Print algorithm name for the TSIG key.\n");
149 	fprintf(stderr, "-s keyname	Print base64 secret blob for the TSIG key.\n");
150 	exit(1);
151 }
152 
153 static void
154 print_string_var(const char* varname, const char* value)
155 {
156 	if (!value) {
157 		printf("\t#%s\n", varname);
158 	} else {
159 		printf("\t%s \"%s\"\n", varname, value);
160 	}
161 }
162 
163 static void
164 quote(const char *v)
165 {
166 	if(v==NULL)
167 		printf("\n");
168 	else
169 		printf("%s\n", v);
170 }
171 
172 static void
173 quotepath(nsd_options_t* opt, int final, const char *f)
174 {
175 	const char* chr = opt->chroot;
176 #ifdef CHROOTDIR
177 	if(chr == 0) chr = CHROOTDIR;
178 #endif
179 	if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) {
180 		quote(f);
181 		return;
182 	}
183 	/* chroot has had trailing slash applied in check part of checkconf */
184 	printf("%s%s\n", chr, f);
185 }
186 
187 static void
188 quote_acl(acl_options_t* acl)
189 {
190 	while(acl)
191 	{
192 		printf("%s %s\n", acl->ip_address_spec,
193 			acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
194 			(acl->key_name?acl->key_name:"(null)")));
195 		acl=acl->next;
196 	}
197 }
198 
199 static void
200 print_acl(const char* varname, acl_options_t* acl)
201 {
202 	while(acl)
203 	{
204 		printf("\t%s ", varname);
205 		if(acl->use_axfr_only)
206 			printf("AXFR ");
207 		if(acl->allow_udp)
208 			printf("UDP ");
209 		printf("%s %s\n", acl->ip_address_spec,
210 			acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
211 			(acl->key_name?acl->key_name:"(null)")));
212 		if(verbosity>1) {
213 			printf("\t# %s", acl->is_ipv6?"ip6":"ip4");
214 			if(acl->port == 0) printf(" noport");
215 			else printf(" port=%d", acl->port);
216 			if(acl->rangetype == acl_range_single) printf(" single");
217 			if(acl->rangetype == acl_range_mask)   printf(" masked");
218 			if(acl->rangetype == acl_range_subnet) printf(" subnet");
219 			if(acl->rangetype == acl_range_minmax) printf(" minmax");
220 			if(acl->is_ipv6) {
221 #ifdef INET6
222 				char dest[128];
223 				inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest));
224 				printf(" addr=%s", dest);
225 				if(acl->rangetype != acl_range_single) {
226 					inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest));
227 					printf(" rangemask=%s", dest);
228 				}
229 #else
230 				printf(" ip6addr-noip6defined");
231 #endif
232 			} else {
233 				char dest[128];
234 				inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest));
235 				printf(" addr=%s", dest);
236 				if(acl->rangetype != acl_range_single) {
237 					inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest));
238 					printf(" rangemask=%s", dest);
239 				}
240 			}
241 			printf("\n");
242 		}
243 		acl=acl->next;
244 	}
245 }
246 
247 static void
248 print_acl_ips(const char* varname, acl_options_t* acl)
249 {
250 	while(acl)
251 	{
252 		printf("\t%s %s\n", varname, acl->ip_address_spec);
253 		acl=acl->next;
254 	}
255 }
256 
257 void
258 config_print_zone(nsd_options_t* opt, const char* k, int s, const char *o,
259 	const char *z, const char* pat, int final)
260 {
261 	ip_address_option_t* ip;
262 
263 	if (k) {
264 		/* find key */
265 		key_options_t* key = key_options_find(opt, k);
266 		if(key) {
267 			if (s) {
268 				quote(key->secret);
269 			} else {
270 				quote(key->algorithm);
271 			}
272 			return;
273 		}
274 		printf("Could not find key %s\n", k);
275 		return;
276 	}
277 
278 	if (!o) {
279 		return;
280 	}
281 
282 	if (z) {
283 		zone_options_t* zone;
284 		const dname_type *dname = dname_parse(opt->region, z);
285 		if(!dname) {
286 			printf("Could not parse zone name %s\n", z);
287 			exit(1);
288 		}
289 		zone = zone_options_find(opt, dname);
290 		if(!zone) {
291 			printf("Zone does not exist: %s\n", z);
292 			exit(1);
293 		}
294 		ZONE_GET_STR(name, o, zone);
295 		if(strcasecmp("pattern", o)==0) {
296 			quote(zone->pattern->pname);
297 			return;
298 		}
299 		ZONE_GET_BIN(part_of_config, o, zone);
300 		ZONE_GET_PATH(final, zonefile, o, zone->pattern);
301 		ZONE_GET_ACL(request_xfr, o, zone->pattern);
302 		ZONE_GET_ACL(provide_xfr, o, zone->pattern);
303 		ZONE_GET_ACL(allow_notify, o, zone->pattern);
304 		ZONE_GET_ACL(notify, o, zone->pattern);
305 		ZONE_GET_BIN(notify_retry, o, zone->pattern);
306 		ZONE_GET_STR(zonestats, o, zone->pattern);
307 		ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern);
308 		ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern);
309 #ifdef RATELIMIT
310 		ZONE_GET_RRL(rrl_whitelist, o, zone->pattern);
311 #endif
312 		printf("Zone option not handled: %s %s\n", z, o);
313 		exit(1);
314 	} else if(pat) {
315 		pattern_options_t* p = pattern_options_find(opt, pat);
316 		if(!p) {
317 			printf("Pattern does not exist: %s\n", pat);
318 			exit(1);
319 		}
320 		if(strcasecmp("name", o)==0) {
321 			quote(p->pname);
322 			return;
323 		}
324 		ZONE_GET_STR(zonefile, o, p);
325 		ZONE_GET_PATH(final, zonefile, o, p);
326 		ZONE_GET_ACL(request_xfr, o, p);
327 		ZONE_GET_ACL(provide_xfr, o, p);
328 		ZONE_GET_ACL(allow_notify, o, p);
329 		ZONE_GET_ACL(notify, o, p);
330 		ZONE_GET_BIN(notify_retry, o, p);
331 		ZONE_GET_STR(zonestats, o, p);
332 		ZONE_GET_OUTGOING(outgoing_interface, o, p);
333 		ZONE_GET_BIN(allow_axfr_fallback, o, p);
334 #ifdef RATELIMIT
335 		ZONE_GET_RRL(rrl_whitelist, o, p);
336 #endif
337 		printf("Pattern option not handled: %s %s\n", pat, o);
338 		exit(1);
339 	} else {
340 		/* look in the server section */
341 		SERV_GET_IP(ip_address, ip_addresses, o);
342 		/* bin */
343 		SERV_GET_BIN(ip_transparent, o);
344 		SERV_GET_BIN(ip_freebind, o);
345 		SERV_GET_BIN(debug_mode, o);
346 		SERV_GET_BIN(do_ip4, o);
347 		SERV_GET_BIN(do_ip6, o);
348 		SERV_GET_BIN(reuseport, o);
349 		SERV_GET_BIN(hide_version, o);
350 		SERV_GET_BIN(zonefiles_check, o);
351 		SERV_GET_BIN(log_time_ascii, o);
352 		SERV_GET_BIN(round_robin, o);
353 		/* str */
354 		SERV_GET_PATH(final, database, o);
355 		SERV_GET_STR(identity, o);
356 		SERV_GET_STR(version, o);
357 		SERV_GET_STR(nsid, o);
358 		SERV_GET_PATH(final, logfile, o);
359 		SERV_GET_PATH(final, pidfile, o);
360 		SERV_GET_STR(chroot, o);
361 		SERV_GET_STR(username, o);
362 		SERV_GET_PATH(final, zonesdir, o);
363 		SERV_GET_PATH(final, xfrdfile, o);
364 		SERV_GET_PATH(final, xfrdir, o);
365 		SERV_GET_PATH(final, zonelistfile, o);
366 		SERV_GET_STR(port, o);
367 		/* int */
368 		SERV_GET_INT(server_count, o);
369 		SERV_GET_INT(tcp_count, o);
370 		SERV_GET_INT(tcp_query_count, o);
371 		SERV_GET_INT(tcp_timeout, o);
372 		SERV_GET_INT(tcp_mss, o);
373 		SERV_GET_INT(outgoing_tcp_mss, o);
374 		SERV_GET_INT(ipv4_edns_size, o);
375 		SERV_GET_INT(ipv6_edns_size, o);
376 		SERV_GET_INT(statistics, o);
377 		SERV_GET_INT(xfrd_reload_timeout, o);
378 		SERV_GET_INT(verbosity, o);
379 #ifdef RATELIMIT
380 		SERV_GET_INT(rrl_size, o);
381 		SERV_GET_INT(rrl_ratelimit, o);
382 		SERV_GET_INT(rrl_slip, o);
383 		SERV_GET_INT(rrl_ipv4_prefix_length, o);
384 		SERV_GET_INT(rrl_ipv6_prefix_length, o);
385 		SERV_GET_INT(rrl_whitelist_ratelimit, o);
386 #endif
387 		SERV_GET_INT(zonefiles_write, o);
388 		/* remote control */
389 		SERV_GET_BIN(control_enable, o);
390 		SERV_GET_IP(control_interface, control_interface, o);
391 		SERV_GET_INT(control_port, o);
392 		SERV_GET_STR(server_key_file, o);
393 		SERV_GET_STR(server_cert_file, o);
394 		SERV_GET_STR(control_key_file, o);
395 		SERV_GET_STR(control_cert_file, o);
396 
397 		if(strcasecmp(o, "zones") == 0) {
398 			zone_options_t* zone;
399 			RBTREE_FOR(zone, zone_options_t*, opt->zone_options)
400 				quote(zone->name);
401 			return;
402 		}
403 		if(strcasecmp(o, "patterns") == 0) {
404 			pattern_options_t* p;
405 			RBTREE_FOR(p, pattern_options_t*, opt->patterns)
406 				quote(p->pname);
407 			return;
408 		}
409 		printf("Server option not handled: %s\n", o);
410 		exit(1);
411 	}
412 }
413 
414 /* print zone content items */
415 static void print_zone_content_elems(pattern_options_t* pat)
416 {
417 	if(pat->zonefile)
418 		print_string_var("zonefile:", pat->zonefile);
419 #ifdef RATELIMIT
420 	zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist);
421 #endif
422 	print_acl("allow-notify:", pat->allow_notify);
423 	print_acl("request-xfr:", pat->request_xfr);
424 	if(!pat->notify_retry_is_default)
425 		printf("\tnotify-retry: %d\n", pat->notify_retry);
426 	print_acl("notify:", pat->notify);
427 	print_acl("provide-xfr:", pat->provide_xfr);
428 	if(pat->zonestats)
429 		print_string_var("zonestats:", pat->zonestats);
430 	print_acl_ips("outgoing-interface:", pat->outgoing_interface);
431 	if(!pat->allow_axfr_fallback_is_default)
432 		printf("\tallow-axfr-fallback: %s\n",
433 			pat->allow_axfr_fallback?"yes":"no");
434 }
435 
436 void
437 config_test_print_server(nsd_options_t* opt)
438 {
439 	ip_address_option_t* ip;
440 	key_options_t* key;
441 	zone_options_t* zone;
442 	pattern_options_t* pat;
443 
444 	printf("# Config settings.\n");
445 	printf("server:\n");
446 	printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no");
447 	printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no");
448 	printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no");
449 	printf("\treuseport: %s\n", opt->reuseport?"yes":"no");
450 	printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no");
451 	printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no");
452 	printf("\thide-version: %s\n", opt->hide_version?"yes":"no");
453 	print_string_var("database:", opt->database);
454 	print_string_var("identity:", opt->identity);
455 	print_string_var("version:", opt->version);
456 	print_string_var("nsid:", opt->nsid);
457 	print_string_var("logfile:", opt->logfile);
458 	printf("\tserver-count: %d\n", opt->server_count);
459 	printf("\ttcp-count: %d\n", opt->tcp_count);
460 	printf("\ttcp-query-count: %d\n", opt->tcp_query_count);
461 	printf("\ttcp-timeout: %d\n", opt->tcp_timeout);
462 	printf("\ttcp-mss: %d\n", opt->tcp_mss);
463 	printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss);
464 	printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size);
465 	printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size);
466 	print_string_var("pidfile:", opt->pidfile);
467 	print_string_var("port:", opt->port);
468 	printf("\tstatistics: %d\n", opt->statistics);
469 	print_string_var("chroot:", opt->chroot);
470 	print_string_var("username:", opt->username);
471 	print_string_var("zonesdir:", opt->zonesdir);
472 	print_string_var("xfrdfile:", opt->xfrdfile);
473 	print_string_var("zonelistfile:", opt->zonelistfile);
474 	print_string_var("xfrdir:", opt->xfrdir);
475 	printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout);
476 	printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no");
477 	printf("\tround-robin: %s\n", opt->round_robin?"yes":"no");
478 	printf("\tverbosity: %d\n", opt->verbosity);
479 	for(ip = opt->ip_addresses; ip; ip=ip->next)
480 	{
481 		print_string_var("ip-address:", ip->address);
482 	}
483 #ifdef RATELIMIT
484 	printf("\trrl-size: %d\n", (int)opt->rrl_size);
485 	printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit);
486 	printf("\trrl-slip: %d\n", (int)opt->rrl_slip);
487 	printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length);
488 	printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length);
489 	printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit);
490 #endif
491 	printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no");
492 	printf("\tzonefiles-write: %d\n", opt->zonefiles_write);
493 
494 	printf("\nremote-control:\n");
495 	printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no");
496 	for(ip = opt->control_interface; ip; ip=ip->next)
497 		print_string_var("control-interface:", ip->address);
498 	printf("\tcontrol-port: %d\n", opt->control_port);
499 	print_string_var("server-key-file:", opt->server_key_file);
500 	print_string_var("server-cert-file:", opt->server_cert_file);
501 	print_string_var("control-key-file:", opt->control_key_file);
502 	print_string_var("control-cert-file:", opt->control_cert_file);
503 
504 	RBTREE_FOR(key, key_options_t*, opt->keys)
505 	{
506 		printf("\nkey:\n");
507 		print_string_var("name:", key->name);
508 		print_string_var("algorithm:", key->algorithm);
509 		print_string_var("secret:", key->secret);
510 	}
511 	RBTREE_FOR(pat, pattern_options_t*, opt->patterns)
512 	{
513 		if(pat->implicit) continue;
514 		printf("\npattern:\n");
515 		print_string_var("name:", pat->pname);
516 		print_zone_content_elems(pat);
517 	}
518 	RBTREE_FOR(zone, zone_options_t*, opt->zone_options)
519 	{
520 		if(!zone->part_of_config)
521 			continue;
522 		printf("\nzone:\n");
523 		print_string_var("name:", zone->name);
524 		print_zone_content_elems(zone->pattern);
525 	}
526 
527 }
528 
529 static void
530 append_trailing_slash(const char** dirname, region_type* region)
531 {
532 	int l = strlen(*dirname);
533 	if (l>0 && (*dirname)[l-1] != '/' && l < 0xffffff) {
534 		char *dirname_slash = region_alloc(region, l+2);
535 		memcpy(dirname_slash, *dirname, l+1);
536 		strlcat(dirname_slash, "/", l+2);
537 		*dirname = dirname_slash;
538 	}
539 }
540 
541 static int
542 file_inside_chroot(const char* fname, const char* chr)
543 {
544 	/* true if filename starts with chroot or is not absolute */
545 	return ((fname && fname[0] && strncmp(fname, chr, strlen(chr)) == 0) ||
546 		(fname && fname[0] != '/'));
547 }
548 
549 static int
550 additional_checks(nsd_options_t* opt, const char* filename)
551 {
552 	zone_options_t* zone;
553 	int errors = 0;
554 
555 	RBTREE_FOR(zone, zone_options_t*, opt->zone_options)
556 	{
557 		const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */
558 		if(!dname) {
559 			fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name);
560 			errors ++;
561 		}
562 		if(zone->pattern->allow_notify && !zone->pattern->request_xfr) {
563 			fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr"
564 				" items. Where can it get a zone transfer when a notify "
565 				"is received?\n", filename, zone->name);
566 			errors ++;
567 		}
568 		if(!zone_is_slave(zone) && (!zone->pattern->zonefile ||
569 			zone->pattern->zonefile[0] == 0)) {
570 			fprintf(stderr, "%s: zone %s is a master zone but has "
571 				"no zonefile. Where can the data come from?\n",
572 				filename, zone->name);
573 			errors ++;
574 		}
575 	}
576 
577 #ifndef BIND8_STATS
578 	if(opt->statistics > 0)
579 	{
580 		fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n",
581 			filename, opt->statistics);
582 		errors ++;
583 	}
584 #endif
585 #ifndef HAVE_CHROOT
586 	if(opt->chroot != 0)
587 	{
588 		fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n",
589 			filename, opt->chroot);
590 		errors ++;
591 	}
592 #endif
593 	if (opt->identity && strlen(opt->identity) > UCHAR_MAX) {
594                 fprintf(stderr, "%s: server identity too long (%u characters)\n",
595                       filename, (unsigned) strlen(opt->identity));
596 		errors ++;
597         }
598 	if (opt->version && strlen(opt->version) > UCHAR_MAX) {
599                 fprintf(stderr, "%s: server version too long (%u characters)\n",
600                       filename, (unsigned) strlen(opt->version));
601 		errors ++;
602         }
603 
604 	/* not done here: parsing of ip-address. parsing of username. */
605 
606         if (opt->chroot && opt->chroot[0]) {
607 		/* append trailing slash for strncmp checking */
608 		append_trailing_slash(&opt->chroot, opt->region);
609 		append_trailing_slash(&opt->xfrdir, opt->region);
610 		append_trailing_slash(&opt->zonesdir, opt->region);
611 
612 		/* zonesdir must be absolute and within chroot,
613 		 * all other pathnames may be relative to zonesdir */
614 		if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) {
615 			fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n",
616 				filename, opt->zonesdir, opt->chroot);
617 			errors ++;
618                 }
619 		if (!file_inside_chroot(opt->pidfile, opt->chroot)) {
620 			fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n",
621 				filename, opt->pidfile, opt->chroot);
622 			errors ++;
623                 }
624 		if (!file_inside_chroot(opt->database, opt->chroot)) {
625 			fprintf(stderr, "%s: database %s is not relative to chroot %s.\n",
626 				filename, opt->database, opt->chroot);
627 			errors ++;
628                 }
629 		if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) {
630 			fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n",
631 				filename, opt->xfrdfile, opt->chroot);
632 			errors ++;
633                 }
634 		if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) {
635 			fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n",
636 				filename, opt->zonelistfile, opt->chroot);
637 			errors ++;
638                 }
639 		if (!file_inside_chroot(opt->xfrdir, opt->chroot)) {
640 			fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n",
641 				filename, opt->xfrdir, opt->chroot);
642 			errors ++;
643                 }
644 	}
645 
646 	if (atoi(opt->port) <= 0) {
647 		fprintf(stderr, "%s: port number '%s' is not a positive number.\n",
648 			filename, opt->port);
649 		errors ++;
650 	}
651 	if(errors != 0) {
652 		fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys.\n",
653 			filename, errors, (int)nsd_options_num_zones(opt),
654 			(int)opt->keys->count);
655 	}
656 
657 	return (errors == 0);
658 }
659 
660 int
661 main(int argc, char* argv[])
662 {
663 	int c;
664 	int verbose = 0;
665 	int key_sec = 0;
666 	int final = 0;
667 	const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */
668 	const char * conf_zone = NULL; /* what zone are we talking about */
669 	const char * conf_key = NULL; /* what key is needed */
670 	const char * conf_pat = NULL; /* what pattern is talked about */
671 	const char* configfile;
672 	nsd_options_t *options;
673 
674 	log_init("nsd-checkconf");
675 
676 	/* Parse the command line... */
677 	while ((c = getopt(argc, argv, "vfo:a:p:s:z:")) != -1) {
678 		switch (c) {
679 		case 'v':
680 			verbose = 1;
681 			verbosity++;
682 			break;
683 		case 'o':
684 			conf_opt = optarg;
685 			break;
686 		case 'f':
687 			final = 1;
688 			break;
689 		case 'p':
690 			conf_pat = optarg;
691 			break;
692 		case 'a':
693 			if (conf_key) {
694 				fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n");
695 				exit(1);
696 			}
697 			conf_key = optarg;
698 			break;
699 		case 's':
700 			if (conf_key) {
701 				fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n");
702 				exit(1);
703 			}
704 			conf_key = optarg;
705 			key_sec = 1;
706 			break;
707 		case 'z':
708 			conf_zone = optarg;
709 			break;
710 		default:
711 			usage();
712 		};
713 	}
714         argc -= optind;
715         argv += optind;
716         if (argc == 0 || argc>=2) {
717 		usage();
718 	}
719 	configfile = argv[0];
720 
721 	/* read config file */
722 	options = nsd_options_create(region_create(xalloc, free));
723 	tsig_init(options->region);
724 	if (!parse_options_file(options, configfile, NULL, NULL) ||
725 	   !additional_checks(options, configfile)) {
726 		exit(2);
727 	}
728 	if (conf_opt || conf_key) {
729 		config_print_zone(options, conf_key, key_sec,
730 			underscore(conf_opt), conf_zone, conf_pat, final);
731 	} else {
732 		if (verbose) {
733 			printf("# Read file %s: %d patterns, %d fixed-zones, "
734 				"%d keys.\n",
735 				configfile,
736 				(int)options->patterns->count,
737 				(int)nsd_options_num_zones(options),
738 				(int)options->keys->count);
739 			config_test_print_server(options);
740 		}
741 	}
742 	return 0;
743 }
744