xref: /openbsd/usr.sbin/nsd/nsd-checkconf.c (revision db7d0d02) 
1 /*
2  * checkconf - Read and repeat configuration file to output.
3  *
4  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  */
9 #include "config.h"
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <unistd.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "tsig.h"
16 #include "options.h"
17 #include "util.h"
18 #include "dname.h"
19 #include "rrl.h"
20 
21 extern char *optarg;
22 extern int optind;
23 
24 #define ZONE_GET_ACL(NAME, VAR, PATTERN) 		\
25 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
26 		quote_acl(PATTERN->NAME); 	\
27 		return; 			\
28 	}
29 
30 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN)			\
31 	if (strcasecmp(#NAME, (VAR)) == 0) {		\
32 		acl_options_type* acl; 			\
33 		for(acl=PATTERN->NAME; acl; acl=acl->next)	\
34 			quote(acl->ip_address_spec);	\
35 		return; 				\
36 	}
37 
38 #define ZONE_GET_STR(NAME, VAR, PATTERN) 		\
39 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
40 		quote(PATTERN->NAME); 		\
41 		return; 			\
42 	}
43 
44 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) 	\
45 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
46 		quotepath(opt, FINAL, PATTERN->NAME); 	\
47 		return; 				\
48 	}
49 
50 #define ZONE_GET_BIN(NAME, VAR, PATTERN) 			\
51 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
52 		printf("%s\n", (PATTERN->NAME)?"yes":"no"); 	\
53 		return;					\
54 	}
55 
56 #define ZONE_GET_RRL(NAME, VAR, PATTERN) 			\
57 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
58 		zone_print_rrl_whitelist("", PATTERN->NAME);	\
59 		return;					\
60 	}
61 
62 #define ZONE_GET_INT(NAME, VAR, PATTERN) 		\
63 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
64 		printf("%d\n", (int) PATTERN->NAME); 	\
65 		return; 			\
66 	}
67 
68 #define SERV_GET_BIN(NAME, VAR) 			\
69 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
70 		printf("%s\n", opt->NAME?"yes":"no"); 	\
71 		return;					\
72 	}
73 
74 #define SERV_GET_STR(NAME, VAR) 		\
75 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
76 		quote(opt->NAME); 		\
77 		return; 			\
78 	}
79 
80 #define SERV_GET_PATH(FINAL, NAME, VAR) 	\
81 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
82 		quotepath(opt, FINAL, opt->NAME); 	\
83 		return; 			\
84 	}
85 
86 #define SERV_GET_INT(NAME, VAR) 		\
87 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
88 		printf("%d\n", (int) opt->NAME); 	\
89 		return; 			\
90 	}
91 
92 #define SERV_GET_IP(NAME, MEMBER, VAR) 				\
93 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
94 		for(ip = opt->MEMBER; ip; ip=ip->next)	\
95 		{						\
96 			quote(ip->address);			\
97 		}						\
98 		return;						\
99 	}
100 
101 #ifdef RATELIMIT
102 static void zone_print_rrl_whitelist(const char* s, uint16_t w)
103 {
104 	int i;
105 	if(w==rrl_type_all) {
106 		printf("%sall\n", s);
107 		return;
108 	}
109 	for(i=0x01; i <= 0x80; i<<=1) {
110 		if( (w&i) )
111 			printf("%s%s\n", s, rrltype2str(i));
112 	}
113 }
114 #endif /* RATELIMIT */
115 
116 static char buf[BUFSIZ];
117 
118 static char *
119 underscore(const char *s) {
120 	const char *j = s;
121 	size_t i = 0;
122 
123 	while(j && *j) {
124 		if (*j == '-') {
125 			buf[i++] = '_';
126 		} else {
127 			buf[i++] = *j;
128 		}
129 		j++;
130 		if (i >= BUFSIZ) {
131 			return NULL;
132 		}
133 	}
134 	buf[i] = '\0';
135 	return buf;
136 }
137 
138 static void
139 usage(void)
140 {
141 	fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n");
142 	fprintf(stderr, "                     [-s keyname] <configfilename>\n");
143 	fprintf(stderr, "       Checks NSD configuration file for errors.\n");
144 	fprintf(stderr, "       Version %s. Report bugs to <%s>.\n\n",
145 		PACKAGE_VERSION, PACKAGE_BUGREPORT);
146 	fprintf(stderr, "Use with a configfile as argument to check syntax.\n");
147 	fprintf(stderr, "Use with -o, -z or -s options to query the configuration.\n\n");
148 	fprintf(stderr, "-v		Verbose, echo settings that take effect to std output.\n");
149 	fprintf(stderr, "-h		Print this help information.\n");
150 	fprintf(stderr, "-f		Use with -o to print final pathnames, ie. with chroot.\n");
151 	fprintf(stderr, "-o option	Print value of the option specified to stdout.\n");
152 	fprintf(stderr, "-p pattern	Print option value for the pattern given.\n");
153 	fprintf(stderr, "-z zonename	Print option value for the zone given.\n");
154 	fprintf(stderr, "-a keyname	Print algorithm name for the TSIG key.\n");
155 	fprintf(stderr, "-s keyname	Print base64 secret blob for the TSIG key.\n");
156 	exit(1);
157 }
158 
159 static void
160 print_string_var(const char* varname, const char* value)
161 {
162 	if (!value) {
163 		printf("\t#%s\n", varname);
164 	} else {
165 		printf("\t%s \"%s\"\n", varname, value);
166 	}
167 }
168 
169 static void
170 quote(const char *v)
171 {
172 	if(v==NULL)
173 		printf("\n");
174 	else
175 		printf("%s\n", v);
176 }
177 
178 static void
179 quotepath(nsd_options_type* opt, int final, const char *f)
180 {
181 	const char* chr = opt->chroot;
182 #ifdef CHROOTDIR
183 	if(chr == 0) chr = CHROOTDIR;
184 #endif
185 	if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) {
186 		quote(f);
187 		return;
188 	}
189 	/* chroot has had trailing slash applied in check part of checkconf */
190 	printf("%s%s\n", chr, f);
191 }
192 
193 static void
194 quote_acl(acl_options_type* acl)
195 {
196 	while(acl)
197 	{
198 		printf("%s %s\n", acl->ip_address_spec,
199 			acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
200 			(acl->key_name?acl->key_name:"(null)")));
201 		acl=acl->next;
202 	}
203 }
204 
205 static void
206 print_acl(const char* varname, acl_options_type* acl)
207 {
208 	while(acl)
209 	{
210 		printf("\t%s ", varname);
211 		if(acl->use_axfr_only)
212 			printf("AXFR ");
213 		if(acl->allow_udp)
214 			printf("UDP ");
215 		printf("%s %s\n", acl->ip_address_spec,
216 			acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
217 			(acl->key_name?acl->key_name:"(null)")));
218 		if(verbosity>1) {
219 			printf("\t# %s", acl->is_ipv6?"ip6":"ip4");
220 			if(acl->port == 0) printf(" noport");
221 			else printf(" port=%d", acl->port);
222 			if(acl->rangetype == acl_range_single) printf(" single");
223 			if(acl->rangetype == acl_range_mask)   printf(" masked");
224 			if(acl->rangetype == acl_range_subnet) printf(" subnet");
225 			if(acl->rangetype == acl_range_minmax) printf(" minmax");
226 			if(acl->is_ipv6) {
227 #ifdef INET6
228 				char dest[128];
229 				inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest));
230 				printf(" addr=%s", dest);
231 				if(acl->rangetype != acl_range_single) {
232 					inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest));
233 					printf(" rangemask=%s", dest);
234 				}
235 #else
236 				printf(" ip6addr-noip6defined");
237 #endif
238 			} else {
239 				char dest[128];
240 				inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest));
241 				printf(" addr=%s", dest);
242 				if(acl->rangetype != acl_range_single) {
243 					inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest));
244 					printf(" rangemask=%s", dest);
245 				}
246 			}
247 			printf("\n");
248 		}
249 		acl=acl->next;
250 	}
251 }
252 
253 static void
254 print_acl_ips(const char* varname, acl_options_type* acl)
255 {
256 	while(acl)
257 	{
258 		printf("\t%s %s\n", varname, acl->ip_address_spec);
259 		acl=acl->next;
260 	}
261 }
262 
263 void
264 config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o,
265 	const char *z, const char* pat, int final)
266 {
267 	ip_address_option_type* ip;
268 
269 	if (k) {
270 		/* find key */
271 		key_options_type* key = key_options_find(opt, k);
272 		if(key) {
273 			if (s) {
274 				quote(key->secret);
275 			} else {
276 				quote(key->algorithm);
277 			}
278 			return;
279 		}
280 		printf("Could not find key %s\n", k);
281 		return;
282 	}
283 
284 	if (!o) {
285 		return;
286 	}
287 
288 	if (z) {
289 		zone_options_type* zone;
290 		const dname_type *dname = dname_parse(opt->region, z);
291 		if(!dname) {
292 			printf("Could not parse zone name %s\n", z);
293 			exit(1);
294 		}
295 		zone = zone_options_find(opt, dname);
296 		if(!zone) {
297 			printf("Zone does not exist: %s\n", z);
298 			exit(1);
299 		}
300 		ZONE_GET_STR(name, o, zone);
301 		if(strcasecmp("pattern", o)==0) {
302 			quote(zone->pattern->pname);
303 			return;
304 		}
305 		ZONE_GET_BIN(part_of_config, o, zone);
306 		ZONE_GET_PATH(final, zonefile, o, zone->pattern);
307 		ZONE_GET_ACL(request_xfr, o, zone->pattern);
308 		ZONE_GET_ACL(provide_xfr, o, zone->pattern);
309 		ZONE_GET_ACL(allow_notify, o, zone->pattern);
310 		ZONE_GET_ACL(notify, o, zone->pattern);
311 		ZONE_GET_BIN(notify_retry, o, zone->pattern);
312 		ZONE_GET_STR(zonestats, o, zone->pattern);
313 		ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern);
314 		ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern);
315 		ZONE_GET_INT(max_refresh_time, o, zone->pattern);
316 		ZONE_GET_INT(min_refresh_time, o, zone->pattern);
317 		ZONE_GET_INT(max_retry_time, o, zone->pattern);
318 		ZONE_GET_INT(min_retry_time, o, zone->pattern);
319 		ZONE_GET_INT(size_limit_xfr, o, zone->pattern);
320 #ifdef RATELIMIT
321 		ZONE_GET_RRL(rrl_whitelist, o, zone->pattern);
322 #endif
323 		ZONE_GET_BIN(multi_master_check, o, zone->pattern);
324 		printf("Zone option not handled: %s %s\n", z, o);
325 		exit(1);
326 	} else if(pat) {
327 		pattern_options_type* p = pattern_options_find(opt, pat);
328 		if(!p) {
329 			printf("Pattern does not exist: %s\n", pat);
330 			exit(1);
331 		}
332 		if(strcasecmp("name", o)==0) {
333 			quote(p->pname);
334 			return;
335 		}
336 		ZONE_GET_STR(zonefile, o, p);
337 		ZONE_GET_PATH(final, zonefile, o, p);
338 		ZONE_GET_ACL(request_xfr, o, p);
339 		ZONE_GET_ACL(provide_xfr, o, p);
340 		ZONE_GET_ACL(allow_notify, o, p);
341 		ZONE_GET_ACL(notify, o, p);
342 		ZONE_GET_BIN(notify_retry, o, p);
343 		ZONE_GET_STR(zonestats, o, p);
344 		ZONE_GET_OUTGOING(outgoing_interface, o, p);
345 		ZONE_GET_BIN(allow_axfr_fallback, o, p);
346 		ZONE_GET_INT(max_refresh_time, o, p);
347 		ZONE_GET_INT(min_refresh_time, o, p);
348 		ZONE_GET_INT(max_retry_time, o, p);
349 		ZONE_GET_INT(min_retry_time, o, p);
350 		ZONE_GET_INT(size_limit_xfr, o, p);
351 #ifdef RATELIMIT
352 		ZONE_GET_RRL(rrl_whitelist, o, p);
353 #endif
354 		ZONE_GET_BIN(multi_master_check, o, p);
355 		printf("Pattern option not handled: %s %s\n", pat, o);
356 		exit(1);
357 	} else {
358 		/* look in the server section */
359 		SERV_GET_IP(ip_address, ip_addresses, o);
360 		/* bin */
361 		SERV_GET_BIN(ip_transparent, o);
362 		SERV_GET_BIN(ip_freebind, o);
363 		SERV_GET_BIN(debug_mode, o);
364 		SERV_GET_BIN(do_ip4, o);
365 		SERV_GET_BIN(do_ip6, o);
366 		SERV_GET_BIN(reuseport, o);
367 		SERV_GET_BIN(hide_version, o);
368 		SERV_GET_BIN(zonefiles_check, o);
369 		SERV_GET_BIN(log_time_ascii, o);
370 		SERV_GET_BIN(round_robin, o);
371 		SERV_GET_BIN(minimal_responses, o);
372 		/* str */
373 		SERV_GET_PATH(final, database, o);
374 		SERV_GET_STR(identity, o);
375 		SERV_GET_STR(version, o);
376 		SERV_GET_STR(nsid, o);
377 		SERV_GET_PATH(final, logfile, o);
378 		SERV_GET_PATH(final, pidfile, o);
379 		SERV_GET_STR(chroot, o);
380 		SERV_GET_STR(username, o);
381 		SERV_GET_PATH(final, zonesdir, o);
382 		SERV_GET_PATH(final, xfrdfile, o);
383 		SERV_GET_PATH(final, xfrdir, o);
384 		SERV_GET_PATH(final, zonelistfile, o);
385 		SERV_GET_STR(port, o);
386 		/* int */
387 		SERV_GET_INT(server_count, o);
388 		SERV_GET_INT(tcp_count, o);
389 		SERV_GET_INT(tcp_query_count, o);
390 		SERV_GET_INT(tcp_timeout, o);
391 		SERV_GET_INT(tcp_mss, o);
392 		SERV_GET_INT(outgoing_tcp_mss, o);
393 		SERV_GET_INT(ipv4_edns_size, o);
394 		SERV_GET_INT(ipv6_edns_size, o);
395 		SERV_GET_INT(statistics, o);
396 		SERV_GET_INT(xfrd_reload_timeout, o);
397 		SERV_GET_INT(verbosity, o);
398 #ifdef RATELIMIT
399 		SERV_GET_INT(rrl_size, o);
400 		SERV_GET_INT(rrl_ratelimit, o);
401 		SERV_GET_INT(rrl_slip, o);
402 		SERV_GET_INT(rrl_ipv4_prefix_length, o);
403 		SERV_GET_INT(rrl_ipv6_prefix_length, o);
404 		SERV_GET_INT(rrl_whitelist_ratelimit, o);
405 #endif
406 		SERV_GET_INT(zonefiles_write, o);
407 		/* remote control */
408 		SERV_GET_BIN(control_enable, o);
409 		SERV_GET_IP(control_interface, control_interface, o);
410 		SERV_GET_INT(control_port, o);
411 		SERV_GET_STR(server_key_file, o);
412 		SERV_GET_STR(server_cert_file, o);
413 		SERV_GET_STR(control_key_file, o);
414 		SERV_GET_STR(control_cert_file, o);
415 
416 		if(strcasecmp(o, "zones") == 0) {
417 			zone_options_type* zone;
418 			RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
419 				quote(zone->name);
420 			return;
421 		}
422 		if(strcasecmp(o, "patterns") == 0) {
423 			pattern_options_type* p;
424 			RBTREE_FOR(p, pattern_options_type*, opt->patterns)
425 				quote(p->pname);
426 			return;
427 		}
428 		printf("Server option not handled: %s\n", o);
429 		exit(1);
430 	}
431 }
432 
433 /* print zone content items */
434 static void print_zone_content_elems(pattern_options_type* pat)
435 {
436 	if(pat->zonefile)
437 		print_string_var("zonefile:", pat->zonefile);
438 #ifdef RATELIMIT
439 	zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist);
440 #endif
441 	print_acl("allow-notify:", pat->allow_notify);
442 	print_acl("request-xfr:", pat->request_xfr);
443 	if(pat->multi_master_check)
444 		printf("\tmulti-master-check: %s\n", pat->multi_master_check?"yes":"no");
445 	if(!pat->notify_retry_is_default)
446 		printf("\tnotify-retry: %d\n", pat->notify_retry);
447 	print_acl("notify:", pat->notify);
448 	print_acl("provide-xfr:", pat->provide_xfr);
449 	if(pat->zonestats)
450 		print_string_var("zonestats:", pat->zonestats);
451 	print_acl_ips("outgoing-interface:", pat->outgoing_interface);
452 	if(!pat->allow_axfr_fallback_is_default)
453 		printf("\tallow-axfr-fallback: %s\n",
454 			pat->allow_axfr_fallback?"yes":"no");
455 	if(!pat->max_refresh_time_is_default)
456 		printf("\tmax-refresh-time: %d\n", pat->max_refresh_time);
457 	if(!pat->min_refresh_time_is_default)
458 		printf("\tmin-refresh-time: %d\n", pat->min_refresh_time);
459 	if(!pat->max_retry_time_is_default)
460 		printf("\tmax-retry-time: %d\n", pat->max_retry_time);
461 	if(!pat->min_retry_time_is_default)
462 		printf("\tmin-retry-time: %d\n", pat->min_retry_time);
463 	if(pat->size_limit_xfr != 0)
464 		printf("\tsize-limit-xfr: %llu\n",
465 			(long long unsigned)pat->size_limit_xfr);
466 }
467 
468 void
469 config_test_print_server(nsd_options_type* opt)
470 {
471 	ip_address_option_type* ip;
472 	key_options_type* key;
473 	zone_options_type* zone;
474 	pattern_options_type* pat;
475 
476 	printf("# Config settings.\n");
477 	printf("server:\n");
478 	printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no");
479 	printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no");
480 	printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no");
481 	printf("\treuseport: %s\n", opt->reuseport?"yes":"no");
482 	printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no");
483 	printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no");
484 	printf("\thide-version: %s\n", opt->hide_version?"yes":"no");
485 	print_string_var("database:", opt->database);
486 	print_string_var("identity:", opt->identity);
487 	print_string_var("version:", opt->version);
488 	print_string_var("nsid:", opt->nsid);
489 	print_string_var("logfile:", opt->logfile);
490 	printf("\tserver-count: %d\n", opt->server_count);
491 	printf("\ttcp-count: %d\n", opt->tcp_count);
492 	printf("\ttcp-query-count: %d\n", opt->tcp_query_count);
493 	printf("\ttcp-timeout: %d\n", opt->tcp_timeout);
494 	printf("\ttcp-mss: %d\n", opt->tcp_mss);
495 	printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss);
496 	printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size);
497 	printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size);
498 	print_string_var("pidfile:", opt->pidfile);
499 	print_string_var("port:", opt->port);
500 	printf("\tstatistics: %d\n", opt->statistics);
501 	print_string_var("chroot:", opt->chroot);
502 	print_string_var("username:", opt->username);
503 	print_string_var("zonesdir:", opt->zonesdir);
504 	print_string_var("xfrdfile:", opt->xfrdfile);
505 	print_string_var("zonelistfile:", opt->zonelistfile);
506 	print_string_var("xfrdir:", opt->xfrdir);
507 	printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout);
508 	printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no");
509 	printf("\tround-robin: %s\n", opt->round_robin?"yes":"no");
510 	printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no");
511 	printf("\tverbosity: %d\n", opt->verbosity);
512 	for(ip = opt->ip_addresses; ip; ip=ip->next)
513 	{
514 		print_string_var("ip-address:", ip->address);
515 	}
516 #ifdef RATELIMIT
517 	printf("\trrl-size: %d\n", (int)opt->rrl_size);
518 	printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit);
519 	printf("\trrl-slip: %d\n", (int)opt->rrl_slip);
520 	printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length);
521 	printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length);
522 	printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit);
523 #endif
524 	printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no");
525 	printf("\tzonefiles-write: %d\n", opt->zonefiles_write);
526 
527 	printf("\nremote-control:\n");
528 	printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no");
529 	for(ip = opt->control_interface; ip; ip=ip->next)
530 		print_string_var("control-interface:", ip->address);
531 	printf("\tcontrol-port: %d\n", opt->control_port);
532 	print_string_var("server-key-file:", opt->server_key_file);
533 	print_string_var("server-cert-file:", opt->server_cert_file);
534 	print_string_var("control-key-file:", opt->control_key_file);
535 	print_string_var("control-cert-file:", opt->control_cert_file);
536 
537 	RBTREE_FOR(key, key_options_type*, opt->keys)
538 	{
539 		printf("\nkey:\n");
540 		print_string_var("name:", key->name);
541 		print_string_var("algorithm:", key->algorithm);
542 		print_string_var("secret:", key->secret);
543 	}
544 	RBTREE_FOR(pat, pattern_options_type*, opt->patterns)
545 	{
546 		if(pat->implicit) continue;
547 		printf("\npattern:\n");
548 		print_string_var("name:", pat->pname);
549 		print_zone_content_elems(pat);
550 	}
551 	RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
552 	{
553 		if(!zone->part_of_config)
554 			continue;
555 		printf("\nzone:\n");
556 		print_string_var("name:", zone->name);
557 		print_zone_content_elems(zone->pattern);
558 	}
559 
560 }
561 
562 static void
563 append_trailing_slash(const char** dirname, region_type* region)
564 {
565 	int l = strlen(*dirname);
566 	if (l>0 && (*dirname)[l-1] != '/' && l < 0xffffff) {
567 		char *dirname_slash = region_alloc(region, l+2);
568 		memcpy(dirname_slash, *dirname, l+1);
569 		strlcat(dirname_slash, "/", l+2);
570 		*dirname = dirname_slash;
571 	}
572 }
573 
574 static int
575 file_inside_chroot(const char* fname, const char* chr)
576 {
577 	/* true if filename starts with chroot or is not absolute */
578 	return ((fname && fname[0] && strncmp(fname, chr, strlen(chr)) == 0) ||
579 		(fname && fname[0] != '/'));
580 }
581 
582 static int
583 additional_checks(nsd_options_type* opt, const char* filename)
584 {
585 	zone_options_type* zone;
586 	int errors = 0;
587 
588 	RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
589 	{
590 		const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */
591 		if(!dname) {
592 			fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name);
593 			errors ++;
594 		}
595 #ifndef ROOT_SERVER
596 		/* Is it a root zone? Are we a root server then? Idiot proof. */
597 		if(dname->label_count == 1) {
598 			fprintf(stderr, "%s: not configured as a root server.\n", filename);
599 			errors ++;
600 		}
601 #endif
602 		if(zone->pattern->allow_notify && !zone->pattern->request_xfr) {
603 			fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr"
604 				" items. Where can it get a zone transfer when a notify "
605 				"is received?\n", filename, zone->name);
606 			errors ++;
607 		}
608 		if(!zone_is_slave(zone) && (!zone->pattern->zonefile ||
609 			zone->pattern->zonefile[0] == 0)) {
610 			fprintf(stderr, "%s: zone %s is a master zone but has "
611 				"no zonefile. Where can the data come from?\n",
612 				filename, zone->name);
613 			errors ++;
614 		}
615 	}
616 
617 #ifndef BIND8_STATS
618 	if(opt->statistics > 0)
619 	{
620 		fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n",
621 			filename, opt->statistics);
622 		errors ++;
623 	}
624 #endif
625 #ifndef HAVE_CHROOT
626 	if(opt->chroot != 0)
627 	{
628 		fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n",
629 			filename, opt->chroot);
630 		errors ++;
631 	}
632 #endif
633 	if (opt->identity && strlen(opt->identity) > UCHAR_MAX) {
634                 fprintf(stderr, "%s: server identity too long (%u characters)\n",
635                       filename, (unsigned) strlen(opt->identity));
636 		errors ++;
637         }
638 	if (opt->version && strlen(opt->version) > UCHAR_MAX) {
639                 fprintf(stderr, "%s: server version too long (%u characters)\n",
640                       filename, (unsigned) strlen(opt->version));
641 		errors ++;
642         }
643 
644 	/* not done here: parsing of ip-address. parsing of username. */
645 
646         if (opt->chroot && opt->chroot[0]) {
647 		/* append trailing slash for strncmp checking */
648 		append_trailing_slash(&opt->chroot, opt->region);
649 		append_trailing_slash(&opt->xfrdir, opt->region);
650 		append_trailing_slash(&opt->zonesdir, opt->region);
651 
652 		/* zonesdir must be absolute and within chroot,
653 		 * all other pathnames may be relative to zonesdir */
654 		if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) {
655 			fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n",
656 				filename, opt->zonesdir, opt->chroot);
657 			errors ++;
658                 }
659 		if (!file_inside_chroot(opt->pidfile, opt->chroot)) {
660 			fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n",
661 				filename, opt->pidfile, opt->chroot);
662 			errors ++;
663                 }
664 		if (!file_inside_chroot(opt->database, opt->chroot)) {
665 			fprintf(stderr, "%s: database %s is not relative to chroot %s.\n",
666 				filename, opt->database, opt->chroot);
667 			errors ++;
668                 }
669 		if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) {
670 			fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n",
671 				filename, opt->xfrdfile, opt->chroot);
672 			errors ++;
673                 }
674 		if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) {
675 			fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n",
676 				filename, opt->zonelistfile, opt->chroot);
677 			errors ++;
678                 }
679 		if (!file_inside_chroot(opt->xfrdir, opt->chroot)) {
680 			fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n",
681 				filename, opt->xfrdir, opt->chroot);
682 			errors ++;
683                 }
684 	}
685 
686 	if (atoi(opt->port) <= 0) {
687 		fprintf(stderr, "%s: port number '%s' is not a positive number.\n",
688 			filename, opt->port);
689 		errors ++;
690 	}
691 	if(errors != 0) {
692 		fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys.\n",
693 			filename, errors, (int)nsd_options_num_zones(opt),
694 			(int)opt->keys->count);
695 	}
696 
697 	return (errors == 0);
698 }
699 
700 int
701 main(int argc, char* argv[])
702 {
703 	int c;
704 	int verbose = 0;
705 	int key_sec = 0;
706 	int final = 0;
707 	const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */
708 	const char * conf_zone = NULL; /* what zone are we talking about */
709 	const char * conf_key = NULL; /* what key is needed */
710 	const char * conf_pat = NULL; /* what pattern is talked about */
711 	const char* configfile;
712 	nsd_options_type *options;
713 
714 	log_init("nsd-checkconf");
715 
716 	/* Parse the command line... */
717 	while ((c = getopt(argc, argv, "vfo:a:p:s:z:")) != -1) {
718 		switch (c) {
719 		case 'v':
720 			verbose = 1;
721 			verbosity++;
722 			break;
723 		case 'o':
724 			conf_opt = optarg;
725 			break;
726 		case 'f':
727 			final = 1;
728 			break;
729 		case 'p':
730 			conf_pat = optarg;
731 			break;
732 		case 'a':
733 			if (conf_key) {
734 				fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n");
735 				exit(1);
736 			}
737 			conf_key = optarg;
738 			break;
739 		case 's':
740 			if (conf_key) {
741 				fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n");
742 				exit(1);
743 			}
744 			conf_key = optarg;
745 			key_sec = 1;
746 			break;
747 		case 'z':
748 			conf_zone = optarg;
749 			break;
750 		default:
751 			usage();
752 		};
753 	}
754         argc -= optind;
755         argv += optind;
756         if (argc == 0 || argc>=2) {
757 		usage();
758 	}
759 	configfile = argv[0];
760 
761 	/* read config file */
762 	options = nsd_options_create(region_create(xalloc, free));
763 	tsig_init(options->region);
764 	if (!parse_options_file(options, configfile, NULL, NULL) ||
765 	   !additional_checks(options, configfile)) {
766 		exit(2);
767 	}
768 	if (conf_opt || conf_key) {
769 		config_print_zone(options, conf_key, key_sec,
770 			underscore(conf_opt), conf_zone, conf_pat, final);
771 	} else {
772 		if (verbose) {
773 			printf("# Read file %s: %d patterns, %d fixed-zones, "
774 				"%d keys.\n",
775 				configfile,
776 				(int)options->patterns->count,
777 				(int)nsd_options_num_zones(options),
778 				(int)options->keys->count);
779 			config_test_print_server(options);
780 		}
781 	}
782 	return 0;
783 }
784