1 /*
2 * checkconf - Read and repeat configuration file to output.
3 *
4 * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5 *
6 * See LICENSE for the license.
7 *
8 */
9 #include "config.h"
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <unistd.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "tsig.h"
16 #include "options.h"
17 #include "util.h"
18 #include "dname.h"
19 #include "rrl.h"
20
21 extern char *optarg;
22 extern int optind;
23 static void usage(void) ATTR_NORETURN;
zonec_parse_string(region_type * ATTR_UNUSED (region),domain_table_type * ATTR_UNUSED (domains),zone_type * ATTR_UNUSED (zone),char * ATTR_UNUSED (str),domain_type ** ATTR_UNUSED (parsed),int * ATTR_UNUSED (num_rrs))24 int zonec_parse_string(region_type* ATTR_UNUSED(region),
25 domain_table_type* ATTR_UNUSED(domains), zone_type* ATTR_UNUSED(zone),
26 char* ATTR_UNUSED(str), domain_type** ATTR_UNUSED(parsed),
27 int* ATTR_UNUSED(num_rrs))
28 {
29 return 0;
30 }
31
32 #define ZONE_GET_ACL(NAME, VAR, PATTERN) \
33 if (strcasecmp(#NAME, (VAR)) == 0) { \
34 quote_acl(PATTERN->NAME); \
35 return; \
36 }
37
38 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN) \
39 if (strcasecmp(#NAME, (VAR)) == 0) { \
40 acl_options_type* acl; \
41 for(acl=PATTERN->NAME; acl; acl=acl->next) \
42 quote(acl->ip_address_spec); \
43 return; \
44 }
45
46 #define ZONE_GET_STR(NAME, VAR, PATTERN) \
47 if (strcasecmp(#NAME, (VAR)) == 0) { \
48 quote(PATTERN->NAME); \
49 return; \
50 }
51
52 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) \
53 if (strcasecmp(#NAME, (VAR)) == 0) { \
54 quotepath(opt, FINAL, PATTERN->NAME); \
55 return; \
56 }
57
58 #define ZONE_GET_BIN(NAME, VAR, PATTERN) \
59 if (strcasecmp(#NAME, (VAR)) == 0) { \
60 printf("%s\n", (PATTERN->NAME)?"yes":"no"); \
61 return; \
62 }
63
64 #define ZONE_GET_RRL(NAME, VAR, PATTERN) \
65 if (strcasecmp(#NAME, (VAR)) == 0) { \
66 zone_print_rrl_whitelist("", PATTERN->NAME); \
67 return; \
68 }
69
70 #define ZONE_GET_INT(NAME, VAR, PATTERN) \
71 if (strcasecmp(#NAME, (VAR)) == 0) { \
72 printf("%d\n", (int) PATTERN->NAME); \
73 return; \
74 }
75
76 #define SERV_GET_BIN(NAME, VAR) \
77 if (strcasecmp(#NAME, (VAR)) == 0) { \
78 printf("%s\n", opt->NAME?"yes":"no"); \
79 return; \
80 }
81
82 #define SERV_GET_STR(NAME, VAR) \
83 if (strcasecmp(#NAME, (VAR)) == 0) { \
84 quote(opt->NAME); \
85 return; \
86 }
87
88 #define SERV_GET_PATH(FINAL, NAME, VAR) \
89 if (strcasecmp(#NAME, (VAR)) == 0) { \
90 quotepath(opt, FINAL, opt->NAME); \
91 return; \
92 }
93
94 #define SERV_GET_INT(NAME, VAR) \
95 if (strcasecmp(#NAME, (VAR)) == 0) { \
96 printf("%d\n", (int) opt->NAME); \
97 return; \
98 }
99
100 #define SERV_GET_IP(NAME, MEMBER, VAR) \
101 if (strcasecmp(#NAME, (VAR)) == 0) { \
102 for(ip = opt->MEMBER; ip; ip=ip->next) \
103 { \
104 quote(ip->address); \
105 } \
106 return; \
107 }
108
109 #ifdef RATELIMIT
zone_print_rrl_whitelist(const char * s,uint16_t w)110 static void zone_print_rrl_whitelist(const char* s, uint16_t w)
111 {
112 int i;
113 if(w==rrl_type_all) {
114 printf("%sall\n", s);
115 return;
116 }
117 for(i=0x01; i <= 0x80; i<<=1) {
118 if( (w&i) )
119 printf("%s%s\n", s, rrltype2str(i));
120 }
121 }
122 #endif /* RATELIMIT */
123
124 static char buf[BUFSIZ];
125
126 static char *
underscore(const char * s)127 underscore(const char *s) {
128 const char *j = s;
129 size_t i = 0;
130
131 while(j && *j) {
132 if (*j == '-') {
133 buf[i++] = '_';
134 } else {
135 buf[i++] = *j;
136 }
137 j++;
138 if (i >= BUFSIZ) {
139 return NULL;
140 }
141 }
142 buf[i] = '\0';
143 return buf;
144 }
145
146 static void
usage(void)147 usage(void)
148 {
149 fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n");
150 fprintf(stderr, " [-s keyname] [-t tlsauthname] <configfilename>\n");
151 fprintf(stderr, " Checks NSD configuration file for errors.\n");
152 fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n",
153 PACKAGE_VERSION, PACKAGE_BUGREPORT);
154 fprintf(stderr, "Use with a configfile as argument to check syntax.\n");
155 fprintf(stderr, "Use with -o, -z, -t or -s options to query the configuration.\n\n");
156 fprintf(stderr, "-v Verbose, echo settings that take effect to std output.\n");
157 fprintf(stderr, "-h Print this help information.\n");
158 fprintf(stderr, "-f Use with -o to print final pathnames, ie. with chroot.\n");
159 fprintf(stderr, "-o option Print value of the option specified to stdout.\n");
160 fprintf(stderr, "-p pattern Print option value for the pattern given.\n");
161 fprintf(stderr, "-z zonename Print option value for the zone given.\n");
162 fprintf(stderr, "-a keyname Print algorithm name for the TSIG key.\n");
163 fprintf(stderr, "-s keyname Print base64 secret blob for the TSIG key.\n");
164 fprintf(stderr, "-t tls-auth-name Print auth domain name for the tls-auth clause.\n");
165 exit(1);
166 }
167
168 static void
print_string_var(const char * varname,const char * value)169 print_string_var(const char* varname, const char* value)
170 {
171 if (!value) {
172 printf("\t#%s\n", varname);
173 } else {
174 printf("\t%s \"%s\"\n", varname, value);
175 }
176 }
177
178 static void
quote(const char * v)179 quote(const char *v)
180 {
181 if(v==NULL)
182 printf("\n");
183 else
184 printf("%s\n", v);
185 }
186
187 static void
quotepath(nsd_options_type * opt,int final,const char * f)188 quotepath(nsd_options_type* opt, int final, const char *f)
189 {
190 const char* chr = opt->chroot;
191 #ifdef CHROOTDIR
192 if(chr == 0) chr = CHROOTDIR;
193 #endif
194 if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) {
195 quote(f);
196 return;
197 }
198 /* chroot has had trailing slash applied in check part of checkconf */
199 printf("%s%s\n", chr, f);
200 }
201
202 static void
quote_acl(acl_options_type * acl)203 quote_acl(acl_options_type* acl)
204 {
205 while(acl)
206 {
207 if (acl->tls_auth_name)
208 printf("%s %s %s\n", acl->ip_address_spec,
209 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
210 (acl->key_name?acl->key_name:"(null)")),
211 acl->tls_auth_name?acl->tls_auth_name:"");
212 else
213 printf("%s %s\n", acl->ip_address_spec,
214 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
215 (acl->key_name?acl->key_name:"(null)")));
216 acl=acl->next;
217 }
218 }
219
220 static void
print_acl(const char * varname,acl_options_type * acl)221 print_acl(const char* varname, acl_options_type* acl)
222 {
223 while(acl)
224 {
225 printf("\t%s ", varname);
226 if(acl->use_axfr_only)
227 printf("AXFR ");
228 if(acl->allow_udp)
229 printf("UDP ");
230 if (acl->tls_auth_name)
231 printf("%s %s %s\n", acl->ip_address_spec,
232 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
233 (acl->key_name?acl->key_name:"(null)")),
234 acl->tls_auth_name?acl->tls_auth_name:"");
235 else
236 printf("%s %s\n", acl->ip_address_spec,
237 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
238 (acl->key_name?acl->key_name:"(null)")));
239 if(verbosity>1) {
240 printf("\t# %s", acl->is_ipv6?"ip6":"ip4");
241 if(acl->port == 0) printf(" noport");
242 else printf(" port=%d", acl->port);
243 if(acl->rangetype == acl_range_single) printf(" single");
244 if(acl->rangetype == acl_range_mask) printf(" masked");
245 if(acl->rangetype == acl_range_subnet) printf(" subnet");
246 if(acl->rangetype == acl_range_minmax) printf(" minmax");
247 if(acl->is_ipv6) {
248 #ifdef INET6
249 char dest[128];
250 inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest));
251 printf(" addr=%s", dest);
252 if(acl->rangetype != acl_range_single) {
253 inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest));
254 printf(" rangemask=%s", dest);
255 }
256 #else
257 printf(" ip6addr-noip6defined");
258 #endif
259 } else {
260 char dest[128];
261 inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest));
262 printf(" addr=%s", dest);
263 if(acl->rangetype != acl_range_single) {
264 inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest));
265 printf(" rangemask=%s", dest);
266 }
267 }
268 printf("\n");
269 }
270 acl=acl->next;
271 }
272 }
273
274 static void
print_acl_ips(const char * varname,acl_options_type * acl)275 print_acl_ips(const char* varname, acl_options_type* acl)
276 {
277 while(acl)
278 {
279 printf("\t%s %s\n", varname, acl->ip_address_spec);
280 acl=acl->next;
281 }
282 }
283
284 void
config_print_zone(nsd_options_type * opt,const char * k,int s,const char * o,const char * z,const char * pat,const char * tls,int final)285 config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o,
286 const char *z, const char* pat, const char* tls, int final)
287 {
288 ip_address_option_type* ip;
289
290 if (k) {
291 /* find key */
292 key_options_type* key = key_options_find(opt, k);
293 if(key) {
294 if (s) {
295 quote(key->secret);
296 } else {
297 quote(key->algorithm);
298 }
299 return;
300 }
301 printf("Could not find key %s\n", k);
302 return;
303 }
304
305 if (tls) {
306 /* find tlsauth */
307 tls_auth_options_type* tlsauth = tls_auth_options_find(opt, tls);
308 if(tlsauth) {
309 quote(tlsauth->auth_domain_name);
310 return;
311 }
312 printf("Could not find tls-auth %s\n", tls);
313 return;
314 }
315
316 if (!o) {
317 return;
318 }
319
320 if (z) {
321 zone_options_type* zone;
322 const dname_type *dname = dname_parse(opt->region, z);
323 if(!dname) {
324 printf("Could not parse zone name %s\n", z);
325 exit(1);
326 }
327 zone = zone_options_find(opt, dname);
328 if(!zone) {
329 printf("Zone does not exist: %s\n", z);
330 exit(1);
331 }
332 ZONE_GET_STR(name, o, zone);
333 if(strcasecmp("pattern", o)==0) {
334 quote(zone->pattern->pname);
335 return;
336 }
337 ZONE_GET_BIN(part_of_config, o, zone);
338 ZONE_GET_PATH(final, zonefile, o, zone->pattern);
339 ZONE_GET_ACL(allow_query, o, zone->pattern);
340 ZONE_GET_ACL(request_xfr, o, zone->pattern);
341 ZONE_GET_ACL(provide_xfr, o, zone->pattern);
342 ZONE_GET_ACL(allow_notify, o, zone->pattern);
343 ZONE_GET_ACL(notify, o, zone->pattern);
344 ZONE_GET_BIN(notify_retry, o, zone->pattern);
345 ZONE_GET_STR(zonestats, o, zone->pattern);
346 ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern);
347 ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern);
348 ZONE_GET_INT(max_refresh_time, o, zone->pattern);
349 ZONE_GET_INT(min_refresh_time, o, zone->pattern);
350 ZONE_GET_INT(max_retry_time, o, zone->pattern);
351 ZONE_GET_INT(min_retry_time, o, zone->pattern);
352 ZONE_GET_INT(min_expire_time, o, zone->pattern);
353 ZONE_GET_INT(size_limit_xfr, o, zone->pattern);
354 #ifdef RATELIMIT
355 ZONE_GET_RRL(rrl_whitelist, o, zone->pattern);
356 #endif
357 ZONE_GET_BIN(multi_primary_check, o, zone->pattern);
358 ZONE_GET_BIN(store_ixfr, o, zone->pattern);
359 ZONE_GET_INT(ixfr_size, o, zone->pattern);
360 ZONE_GET_INT(ixfr_number, o, zone->pattern);
361 ZONE_GET_BIN(create_ixfr, o, zone->pattern);
362 printf("Zone option not handled: %s %s\n", z, o);
363 exit(1);
364 } else if(pat) {
365 pattern_options_type* p = pattern_options_find(opt, pat);
366 if(!p) {
367 printf("Pattern does not exist: %s\n", pat);
368 exit(1);
369 }
370 if(strcasecmp("name", o)==0) {
371 quote(p->pname);
372 return;
373 }
374 ZONE_GET_STR(zonefile, o, p);
375 ZONE_GET_PATH(final, zonefile, o, p);
376 ZONE_GET_ACL(allow_query, o, p);
377 ZONE_GET_ACL(request_xfr, o, p);
378 ZONE_GET_ACL(provide_xfr, o, p);
379 ZONE_GET_ACL(allow_notify, o, p);
380 ZONE_GET_ACL(notify, o, p);
381 ZONE_GET_BIN(notify_retry, o, p);
382 ZONE_GET_STR(zonestats, o, p);
383 ZONE_GET_OUTGOING(outgoing_interface, o, p);
384 ZONE_GET_BIN(allow_axfr_fallback, o, p);
385 ZONE_GET_INT(max_refresh_time, o, p);
386 ZONE_GET_INT(min_refresh_time, o, p);
387 ZONE_GET_INT(max_retry_time, o, p);
388 ZONE_GET_INT(min_retry_time, o, p);
389 ZONE_GET_INT(min_expire_time, o, p);
390 ZONE_GET_INT(size_limit_xfr, o, p);
391 #ifdef RATELIMIT
392 ZONE_GET_RRL(rrl_whitelist, o, p);
393 #endif
394 ZONE_GET_BIN(multi_primary_check, o, p);
395 ZONE_GET_BIN(store_ixfr, o, p);
396 ZONE_GET_INT(ixfr_size, o, p);
397 ZONE_GET_INT(ixfr_number, o, p);
398 ZONE_GET_BIN(create_ixfr, o, p);
399 printf("Pattern option not handled: %s %s\n", pat, o);
400 exit(1);
401 } else {
402 /* look in the server section */
403 SERV_GET_IP(ip_address, ip_addresses, o);
404 /* bin */
405 SERV_GET_BIN(ip_transparent, o);
406 SERV_GET_BIN(ip_freebind, o);
407 SERV_GET_BIN(debug_mode, o);
408 SERV_GET_BIN(do_ip4, o);
409 SERV_GET_BIN(do_ip6, o);
410 SERV_GET_BIN(reuseport, o);
411 SERV_GET_BIN(hide_version, o);
412 SERV_GET_BIN(hide_identity, o);
413 SERV_GET_BIN(drop_updates, o);
414 SERV_GET_BIN(zonefiles_check, o);
415 SERV_GET_BIN(log_time_ascii, o);
416 SERV_GET_BIN(round_robin, o);
417 SERV_GET_BIN(minimal_responses, o);
418 SERV_GET_BIN(confine_to_zone, o);
419 SERV_GET_BIN(refuse_any, o);
420 SERV_GET_BIN(tcp_reject_overflow, o);
421 SERV_GET_BIN(log_only_syslog, o);
422 /* str */
423 SERV_GET_STR(identity, o);
424 SERV_GET_STR(version, o);
425 SERV_GET_STR(nsid, o);
426 SERV_GET_PATH(final, logfile, o);
427 SERV_GET_PATH(final, pidfile, o);
428 SERV_GET_STR(chroot, o);
429 SERV_GET_STR(username, o);
430 SERV_GET_PATH(final, zonesdir, o);
431 SERV_GET_PATH(final, xfrdfile, o);
432 SERV_GET_PATH(final, xfrdir, o);
433 SERV_GET_PATH(final, zonelistfile, o);
434 SERV_GET_STR(port, o);
435 SERV_GET_STR(tls_service_key, o);
436 SERV_GET_STR(tls_service_ocsp, o);
437 SERV_GET_STR(tls_service_pem, o);
438 SERV_GET_STR(tls_port, o);
439 SERV_GET_STR(tls_cert_bundle, o);
440 SERV_GET_STR(cookie_secret, o);
441 SERV_GET_STR(cookie_secret_file, o);
442 SERV_GET_BIN(answer_cookie, o);
443 /* int */
444 SERV_GET_INT(server_count, o);
445 SERV_GET_INT(tcp_count, o);
446 SERV_GET_INT(tcp_query_count, o);
447 SERV_GET_INT(tcp_timeout, o);
448 SERV_GET_INT(tcp_mss, o);
449 SERV_GET_INT(outgoing_tcp_mss, o);
450 SERV_GET_INT(xfrd_tcp_max, o);
451 SERV_GET_INT(xfrd_tcp_pipeline, o);
452 SERV_GET_INT(ipv4_edns_size, o);
453 SERV_GET_INT(ipv6_edns_size, o);
454 SERV_GET_INT(statistics, o);
455 SERV_GET_INT(xfrd_reload_timeout, o);
456 SERV_GET_INT(verbosity, o);
457 SERV_GET_INT(send_buffer_size, o);
458 SERV_GET_INT(receive_buffer_size, o);
459 #ifdef RATELIMIT
460 SERV_GET_INT(rrl_size, o);
461 SERV_GET_INT(rrl_ratelimit, o);
462 SERV_GET_INT(rrl_slip, o);
463 SERV_GET_INT(rrl_ipv4_prefix_length, o);
464 SERV_GET_INT(rrl_ipv6_prefix_length, o);
465 SERV_GET_INT(rrl_whitelist_ratelimit, o);
466 #endif
467 #ifdef USE_DNSTAP
468 SERV_GET_BIN(dnstap_enable, o);
469 SERV_GET_STR(dnstap_socket_path, o);
470 SERV_GET_STR(dnstap_ip, o);
471 SERV_GET_BIN(dnstap_tls, o);
472 SERV_GET_STR(dnstap_tls_server_name, o);
473 SERV_GET_STR(dnstap_tls_cert_bundle, o);
474 SERV_GET_STR(dnstap_tls_client_key_file, o);
475 SERV_GET_STR(dnstap_tls_client_cert_file, o);
476 SERV_GET_BIN(dnstap_send_identity, o);
477 SERV_GET_BIN(dnstap_send_version, o);
478 SERV_GET_STR(dnstap_identity, o);
479 SERV_GET_STR(dnstap_version, o);
480 SERV_GET_BIN(dnstap_log_auth_query_messages, o);
481 SERV_GET_BIN(dnstap_log_auth_response_messages, o);
482 #endif
483 SERV_GET_INT(zonefiles_write, o);
484 /* remote control */
485 SERV_GET_BIN(control_enable, o);
486 SERV_GET_IP(control_interface, control_interface, o);
487 SERV_GET_INT(control_port, o);
488 SERV_GET_STR(server_key_file, o);
489 SERV_GET_STR(server_cert_file, o);
490 SERV_GET_STR(control_key_file, o);
491 SERV_GET_STR(control_cert_file, o);
492
493 if(strcasecmp(o, "zones") == 0) {
494 zone_options_type* zone;
495 RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
496 quote(zone->name);
497 return;
498 }
499 if(strcasecmp(o, "patterns") == 0) {
500 pattern_options_type* p;
501 RBTREE_FOR(p, pattern_options_type*, opt->patterns)
502 quote(p->pname);
503 return;
504 }
505 if(strcasecmp(o, "proxy_protocol_port") == 0) {
506 struct proxy_protocol_port_list* p;
507 for(p = opt->proxy_protocol_port; p; p = p->next)
508 printf("%d\n", p->port);
509 return;
510 }
511 printf("Server option not handled: %s\n", o);
512 exit(1);
513 }
514 }
515
516 /* print zone content items */
print_zone_content_elems(pattern_options_type * pat)517 static void print_zone_content_elems(pattern_options_type* pat)
518 {
519 if(pat->zonefile)
520 print_string_var("zonefile:", pat->zonefile);
521 #ifdef RATELIMIT
522 zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist);
523 #endif
524 print_acl("allow_query:", pat->allow_query);
525 print_acl("allow-notify:", pat->allow_notify);
526 print_acl("request-xfr:", pat->request_xfr);
527 if(pat->multi_primary_check)
528 printf("\tmulti-primary-check: %s\n", pat->multi_primary_check?"yes":"no");
529 if(!pat->notify_retry_is_default)
530 printf("\tnotify-retry: %d\n", pat->notify_retry);
531 print_acl("notify:", pat->notify);
532 print_acl("provide-xfr:", pat->provide_xfr);
533 if(pat->zonestats)
534 print_string_var("zonestats:", pat->zonestats);
535 print_acl_ips("outgoing-interface:", pat->outgoing_interface);
536 if(!pat->allow_axfr_fallback_is_default)
537 printf("\tallow-axfr-fallback: %s\n",
538 pat->allow_axfr_fallback?"yes":"no");
539 if(!pat->max_refresh_time_is_default)
540 printf("\tmax-refresh-time: %d\n", pat->max_refresh_time);
541 if(!pat->min_refresh_time_is_default)
542 printf("\tmin-refresh-time: %d\n", pat->min_refresh_time);
543 if(!pat->max_retry_time_is_default)
544 printf("\tmax-retry-time: %d\n", pat->max_retry_time);
545 if(!pat->min_retry_time_is_default)
546 printf("\tmin-retry-time: %d\n", pat->min_retry_time);
547 if(pat->min_expire_time_expr == REFRESHPLUSRETRYPLUS1)
548 printf("\tmin-expire-time: " REFRESHPLUSRETRYPLUS1_STR "\n");
549 else if(pat->min_expire_time_expr == EXPIRE_TIME_HAS_VALUE)
550 printf("\tmin-expire-time: %d\n", pat->min_expire_time);
551 if(pat->size_limit_xfr != 0)
552 printf("\tsize-limit-xfr: %llu\n",
553 (long long unsigned)pat->size_limit_xfr);
554 if(!pat->store_ixfr_is_default)
555 printf("\tstore-ixfr: %s\n", pat->store_ixfr?"yes":"no");
556 if(!pat->ixfr_number_is_default)
557 printf("\tixfr-number: %u\n", (unsigned)pat->ixfr_number);
558 if(!pat->ixfr_size_is_default)
559 printf("\tixfr-size: %u\n", (unsigned)pat->ixfr_size);
560 if(!pat->create_ixfr_is_default)
561 printf("\tcreate-ixfr: %s\n", pat->create_ixfr?"yes":"no");
562 if(pat->verify_zone != VERIFY_ZONE_INHERIT) {
563 printf("\tverify-zone: ");
564 if(pat->verify_zone) {
565 printf("yes\n");
566 } else {
567 printf("no\n");
568 }
569 }
570 if(pat->verifier) {
571 printf("\tverifier:");
572 for(char *const *s = pat->verifier; *s; s++) {
573 printf(" \"%s\"", *s);
574 }
575 printf("\n");
576 }
577 if(pat->verifier_feed_zone != VERIFIER_FEED_ZONE_INHERIT) {
578 printf("\tverifier-feed-zone: ");
579 if(pat->verifier_feed_zone) {
580 printf("yes\n");
581 } else {
582 printf("no\n");
583 }
584 }
585 if(pat->verifier_timeout != VERIFIER_TIMEOUT_INHERIT) {
586 printf("\tverifier-timeout: %d\n", pat->verifier_timeout);
587 }
588
589 if(!pat->catalog_role_is_default)
590 switch(pat->catalog_role) {
591 case CATALOG_ROLE_CONSUMER: printf("\tcatalog: consumer\n");
592 break;
593 case CATALOG_ROLE_PRODUCER: printf("\tcatalog: producer\n");
594 break;
595 default : break;
596 }
597
598 if(pat->catalog_member_pattern)
599 print_string_var("catalog-member-pattern:", pat->catalog_member_pattern);
600 if(pat->catalog_producer_zone)
601 print_string_var("catalog-producer-zone:", pat->catalog_producer_zone);
602 }
603
604 void
config_test_print_server(nsd_options_type * opt)605 config_test_print_server(nsd_options_type* opt)
606 {
607 ip_address_option_type* ip;
608 key_options_type* key;
609 tls_auth_options_type* tlsauth;
610 zone_options_type* zone;
611 pattern_options_type* pat;
612
613 printf("# Config settings.\n");
614 printf("server:\n");
615 printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no");
616 printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no");
617 printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no");
618 printf("\treuseport: %s\n", opt->reuseport?"yes":"no");
619 printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no");
620 printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no");
621 printf("\tsend-buffer-size: %d\n", opt->send_buffer_size);
622 printf("\treceive-buffer-size: %d\n", opt->receive_buffer_size);
623 printf("\thide-version: %s\n", opt->hide_version?"yes":"no");
624 printf("\thide-identity: %s\n", opt->hide_identity?"yes":"no");
625 printf("\tdrop-updates: %s\n", opt->drop_updates?"yes":"no");
626 printf("\ttcp-reject-overflow: %s\n",
627 opt->tcp_reject_overflow ? "yes" : "no");
628 print_string_var("identity:", opt->identity);
629 print_string_var("version:", opt->version);
630 print_string_var("nsid:", opt->nsid);
631 print_string_var("logfile:", opt->logfile);
632 printf("\tlog-only-syslog: %s\n", opt->log_only_syslog?"yes":"no");
633 printf("\tserver-count: %d\n", opt->server_count);
634 if(opt->cpu_affinity) {
635 cpu_option_type *n;
636 printf("\tcpu-affinity:");
637 for(n = opt->cpu_affinity; n; n = n->next) {
638 printf(" %d", n->cpu);
639 }
640 printf("\n");
641 }
642 if(opt->cpu_affinity && opt->service_cpu_affinity) {
643 cpu_map_option_type *n;
644 for(n = opt->service_cpu_affinity; n; n = n->next) {
645 if(n->service > 0) {
646 printf("\tserver-%d-cpu-affinity: %d\n",
647 n->service, n->cpu);
648 } else if(n->service == -1) {
649 printf("\txfrd-cpu-affinity: %d\n",
650 n->cpu);
651 }
652 }
653 }
654 printf("\ttcp-count: %d\n", opt->tcp_count);
655 printf("\ttcp-query-count: %d\n", opt->tcp_query_count);
656 printf("\ttcp-timeout: %d\n", opt->tcp_timeout);
657 printf("\ttcp-mss: %d\n", opt->tcp_mss);
658 printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss);
659 printf("\txfrd-tcp-max: %d\n", opt->xfrd_tcp_max);
660 printf("\txfrd-tcp-pipeline: %d\n", opt->xfrd_tcp_pipeline);
661 printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size);
662 printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size);
663 print_string_var("pidfile:", opt->pidfile);
664 print_string_var("port:", opt->port);
665 printf("\tstatistics: %d\n", opt->statistics);
666 print_string_var("chroot:", opt->chroot);
667 print_string_var("username:", opt->username);
668 print_string_var("zonesdir:", opt->zonesdir);
669 print_string_var("xfrdfile:", opt->xfrdfile);
670 print_string_var("zonelistfile:", opt->zonelistfile);
671 print_string_var("xfrdir:", opt->xfrdir);
672 printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout);
673 printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no");
674 printf("\tround-robin: %s\n", opt->round_robin?"yes":"no");
675 printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no");
676 printf("\tconfine-to-zone: %s\n",
677 opt->confine_to_zone ? "yes" : "no");
678 printf("\trefuse-any: %s\n", opt->refuse_any?"yes":"no");
679 printf("\tverbosity: %d\n", opt->verbosity);
680 for(ip = opt->ip_addresses; ip; ip=ip->next)
681 {
682 printf("\tip-address: %s", ip->address);
683 if(ip->servers) {
684 const char *sep;
685 struct range_option *n;
686 printf(" servers=\"");
687 for(n=ip->servers, sep=""; n; n = n->next, sep=" ") {
688 if(n->first == n->last) {
689 printf("%s%d", sep, n->first);
690 } else {
691 printf("%s%d-%d", sep, n->first, n->last);
692 }
693 }
694 printf("\"");
695 }
696 if(ip->fib != -1) {
697 printf(" setfib=%d", ip->fib);
698 }
699 printf("\n");
700 }
701 #ifdef RATELIMIT
702 printf("\trrl-size: %d\n", (int)opt->rrl_size);
703 printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit);
704 printf("\trrl-slip: %d\n", (int)opt->rrl_slip);
705 printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length);
706 printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length);
707 printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit);
708 #endif
709 printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no");
710 printf("\tzonefiles-write: %d\n", opt->zonefiles_write);
711 print_string_var("tls-service-key:", opt->tls_service_key);
712 print_string_var("tls-service-pem:", opt->tls_service_pem);
713 print_string_var("tls-service-ocsp:", opt->tls_service_ocsp);
714 print_string_var("tls-port:", opt->tls_port);
715 print_string_var("tls-cert-bundle:", opt->tls_cert_bundle);
716 printf("\tanswer-cookie: %s\n", opt->answer_cookie?"yes":"no");
717 if (opt->cookie_secret)
718 print_string_var("cookie-secret:", opt->cookie_secret);
719 if (opt->cookie_secret_file)
720 print_string_var("cookie-secret-file:", opt->cookie_secret_file);
721 if(opt->proxy_protocol_port) {
722 struct proxy_protocol_port_list* p;
723 for(p = opt->proxy_protocol_port; p; p = p->next)
724 printf("\tproxy-protocol-port: %d\n", p->port);
725 }
726
727 #ifdef USE_DNSTAP
728 printf("\ndnstap:\n");
729 printf("\tdnstap-enable: %s\n", opt->dnstap_enable?"yes":"no");
730 print_string_var("dnstap-socket-path:", opt->dnstap_socket_path);
731 print_string_var("dnstap-ip:", opt->dnstap_ip);
732 printf("\tdnstap-tls: %s\n", opt->dnstap_tls?"yes":"no");
733 print_string_var("dnstap-tls-server-name:", opt->dnstap_tls_server_name);
734 print_string_var("dnstap-tls-cert-bundle:", opt->dnstap_tls_cert_bundle);
735 print_string_var("dnstap-tls-client-key-file:", opt->dnstap_tls_client_key_file);
736 print_string_var("dnstap-tls-client-cert-file:", opt->dnstap_tls_client_cert_file);
737 printf("\tdnstap-send-identity: %s\n", opt->dnstap_send_identity?"yes":"no");
738 printf("\tdnstap-send-version: %s\n", opt->dnstap_send_version?"yes":"no");
739 print_string_var("dnstap-identity:", opt->dnstap_identity);
740 print_string_var("dnstap-version:", opt->dnstap_version);
741 printf("\tdnstap-log-auth-query-messages: %s\n", opt->dnstap_log_auth_query_messages?"yes":"no");
742 printf("\tdnstap-log-auth-response-messages: %s\n", opt->dnstap_log_auth_response_messages?"yes":"no");
743 #endif
744
745 printf("\nremote-control:\n");
746 printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no");
747 for(ip = opt->control_interface; ip; ip=ip->next)
748 print_string_var("control-interface:", ip->address);
749 printf("\tcontrol-port: %d\n", opt->control_port);
750 print_string_var("server-key-file:", opt->server_key_file);
751 print_string_var("server-cert-file:", opt->server_cert_file);
752 print_string_var("control-key-file:", opt->control_key_file);
753 print_string_var("control-cert-file:", opt->control_cert_file);
754
755 printf("\nverify:\n");
756 printf("\tenable: %s\n", opt->verify_enable?"yes":"no");
757 for(ip = opt->verify_ip_addresses; ip; ip=ip->next) {
758 print_string_var("ip-address:", ip->address);
759 }
760 printf("\tport: %s\n", opt->verify_port);
761 printf("\tverify-zones: %s\n", opt->verify_zones?"yes":"no");
762 if(opt->verifier) {
763 printf("\tverifier:");
764 for(char **s = opt->verifier; *s; s++) {
765 printf(" \"%s\"", *s);
766 }
767 printf("\n");
768 }
769 printf("\tverifier-count: %d\n", opt->verifier_count);
770 printf("\tverifier-feed-zone: %s\n", opt->verifier_feed_zone?"yes":"no");
771 printf("\tverifier-timeout: %d\n", opt->verifier_timeout);
772
773 RBTREE_FOR(key, key_options_type*, opt->keys)
774 {
775 printf("\nkey:\n");
776 print_string_var("name:", key->name);
777 print_string_var("algorithm:", key->algorithm);
778 print_string_var("secret:", key->secret);
779 }
780 RBTREE_FOR(tlsauth, tls_auth_options_type*, opt->tls_auths)
781 {
782 printf("\ntls-auth:\n");
783 print_string_var("name:", tlsauth->name);
784 print_string_var("auth-domain-name:", tlsauth->auth_domain_name);
785 }
786 RBTREE_FOR(pat, pattern_options_type*, opt->patterns)
787 {
788 if(pat->implicit) continue;
789 printf("\npattern:\n");
790 print_string_var("name:", pat->pname);
791 print_zone_content_elems(pat);
792 }
793 RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
794 {
795 if(!zone->part_of_config)
796 continue;
797 printf("\nzone:\n");
798 print_string_var("name:", zone->name);
799 print_zone_content_elems(zone->pattern);
800 }
801 }
802
803 static int
additional_checks(nsd_options_type * opt,const char * filename)804 additional_checks(nsd_options_type* opt, const char* filename)
805 {
806 zone_options_type* zone;
807 int errors = 0;
808
809 RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
810 {
811 const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */
812 if(!dname) {
813 fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name);
814 errors ++;
815 continue;
816 }
817 if(zone->pattern->allow_notify && !zone->pattern->request_xfr) {
818 fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr"
819 " items. Where can it get a zone transfer when a notify "
820 "is received?\n", filename, zone->name);
821 errors ++;
822 }
823 if(!zone_is_slave(zone) && !zone_is_catalog_producer(zone)
824 && (!zone->pattern->zonefile || zone->pattern->zonefile[0] == 0)) {
825 fprintf(stderr, "%s: zone %s is a primary zone but has "
826 "no zonefile. Where can the data come from?\n",
827 filename, zone->name);
828 errors ++;
829 }
830 }
831
832 #ifndef BIND8_STATS
833 if(opt->statistics > 0)
834 {
835 fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n",
836 filename, opt->statistics);
837 errors ++;
838 }
839 #endif
840 #ifndef HAVE_CHROOT
841 if(opt->chroot != 0)
842 {
843 fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n",
844 filename, opt->chroot);
845 errors ++;
846 }
847 #endif
848 if (opt->identity && strlen(opt->identity) > UCHAR_MAX) {
849 fprintf(stderr, "%s: server identity too long (%u characters)\n",
850 filename, (unsigned) strlen(opt->identity));
851 errors ++;
852 }
853 if (opt->version && strlen(opt->version) > UCHAR_MAX) {
854 fprintf(stderr, "%s: server version too long (%u characters)\n",
855 filename, (unsigned) strlen(opt->version));
856 errors ++;
857 }
858
859 /* not done here: parsing of ip-address. parsing of username. */
860
861 if (opt->chroot && opt->chroot[0]) {
862 /* append trailing slash for strncmp checking */
863 append_trailing_slash(&opt->chroot, opt->region);
864 append_trailing_slash(&opt->xfrdir, opt->region);
865 append_trailing_slash(&opt->zonesdir, opt->region);
866
867 /* zonesdir must be absolute and within chroot,
868 * all other pathnames may be relative to zonesdir */
869 if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) {
870 fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n",
871 filename, opt->zonesdir, opt->chroot);
872 errors ++;
873 }
874 if (!file_inside_chroot(opt->pidfile, opt->chroot)) {
875 fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n",
876 filename, opt->pidfile, opt->chroot);
877 errors ++;
878 }
879 if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) {
880 fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n",
881 filename, opt->xfrdfile, opt->chroot);
882 errors ++;
883 }
884 if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) {
885 fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n",
886 filename, opt->zonelistfile, opt->chroot);
887 errors ++;
888 }
889 if (!file_inside_chroot(opt->xfrdir, opt->chroot)) {
890 fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n",
891 filename, opt->xfrdir, opt->chroot);
892 errors ++;
893 }
894 }
895
896 if (atoi(opt->port) <= 0) {
897 fprintf(stderr, "%s: port number '%s' is not a positive number.\n",
898 filename, opt->port);
899 errors ++;
900 }
901 if(errors != 0) {
902 fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys, %d tls-auth.\n",
903 filename, errors, (int)nsd_options_num_zones(opt),
904 (int)opt->keys->count,
905 (int)opt->tls_auths->count);
906 }
907
908 return (errors == 0);
909 }
910
911 int
main(int argc,char * argv[])912 main(int argc, char* argv[])
913 {
914 int c;
915 int verbose = 0;
916 int key_sec = 0;
917 int final = 0;
918 const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */
919 const char * conf_zone = NULL; /* what zone are we talking about */
920 const char * conf_key = NULL; /* what key is needed */
921 const char * conf_tlsauth = NULL; /* what tls-auth is needed */
922 const char * conf_pat = NULL; /* what pattern is talked about */
923 const char* configfile;
924 nsd_options_type *options;
925
926 log_init("nsd-checkconf");
927
928 /* Parse the command line... */
929 while ((c = getopt(argc, argv, "vfho:a:p:s:z:t:")) != -1) {
930 switch (c) {
931 case 'v':
932 verbose = 1;
933 verbosity++;
934 break;
935 case 'o':
936 conf_opt = optarg;
937 break;
938 case 'f':
939 final = 1;
940 break;
941 case 'p':
942 conf_pat = optarg;
943 break;
944 case 'a':
945 if (conf_key) {
946 fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n");
947 exit(1);
948 }
949 conf_key = optarg;
950 break;
951 case 's':
952 if (conf_key) {
953 fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n");
954 exit(1);
955 }
956 conf_key = optarg;
957 key_sec = 1;
958 break;
959 case 't':
960 conf_tlsauth = optarg;
961 break;
962 case 'z':
963 conf_zone = optarg;
964 break;
965 case 'h':
966 default:
967 usage();
968 };
969 }
970 argc -= optind;
971 argv += optind;
972 if (argc == 0 || argc>=2) {
973 usage();
974 }
975 configfile = argv[0];
976
977 /* read config file */
978 options = nsd_options_create(region_create(xalloc, free));
979 tsig_init(options->region);
980 if (!parse_options_file(options, configfile, NULL, NULL, NULL) ||
981 !additional_checks(options, configfile)) {
982 exit(2);
983 }
984 if (conf_opt || conf_key || conf_tlsauth) {
985 config_print_zone(options, conf_key, key_sec,
986 underscore(conf_opt), conf_zone, conf_pat, conf_tlsauth, final);
987 } else {
988 if (verbose) {
989 printf("# Read file %s: %d patterns, %d fixed-zones, "
990 "%d keys, %d tls-auth.\n",
991 configfile,
992 (int)options->patterns->count,
993 (int)nsd_options_num_zones(options),
994 (int)options->keys->count,
995 (int)options->tls_auths->count);
996 config_test_print_server(options);
997 }
998 }
999 return 0;
1000 }
1001