1 /* 2 * checkconf - Read and repeat configuration file to output. 3 * 4 * Copyright (c) 2001-2006, NLnet Labs. All rights reserved. 5 * 6 * See LICENSE for the license. 7 * 8 */ 9 #include "config.h" 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <unistd.h> 13 #include <string.h> 14 #include <limits.h> 15 #include "tsig.h" 16 #include "options.h" 17 #include "util.h" 18 #include "dname.h" 19 #include "rrl.h" 20 21 extern char *optarg; 22 extern int optind; 23 static void usage(void) ATTR_NORETURN; 24 25 #define ZONE_GET_ACL(NAME, VAR, PATTERN) \ 26 if (strcasecmp(#NAME, (VAR)) == 0) { \ 27 quote_acl(PATTERN->NAME); \ 28 return; \ 29 } 30 31 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN) \ 32 if (strcasecmp(#NAME, (VAR)) == 0) { \ 33 acl_options_type* acl; \ 34 for(acl=PATTERN->NAME; acl; acl=acl->next) \ 35 quote(acl->ip_address_spec); \ 36 return; \ 37 } 38 39 #define ZONE_GET_STR(NAME, VAR, PATTERN) \ 40 if (strcasecmp(#NAME, (VAR)) == 0) { \ 41 quote(PATTERN->NAME); \ 42 return; \ 43 } 44 45 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) \ 46 if (strcasecmp(#NAME, (VAR)) == 0) { \ 47 quotepath(opt, FINAL, PATTERN->NAME); \ 48 return; \ 49 } 50 51 #define ZONE_GET_BIN(NAME, VAR, PATTERN) \ 52 if (strcasecmp(#NAME, (VAR)) == 0) { \ 53 printf("%s\n", (PATTERN->NAME)?"yes":"no"); \ 54 return; \ 55 } 56 57 #define ZONE_GET_RRL(NAME, VAR, PATTERN) \ 58 if (strcasecmp(#NAME, (VAR)) == 0) { \ 59 zone_print_rrl_whitelist("", PATTERN->NAME); \ 60 return; \ 61 } 62 63 #define ZONE_GET_INT(NAME, VAR, PATTERN) \ 64 if (strcasecmp(#NAME, (VAR)) == 0) { \ 65 printf("%d\n", (int) PATTERN->NAME); \ 66 return; \ 67 } 68 69 #define SERV_GET_BIN(NAME, VAR) \ 70 if (strcasecmp(#NAME, (VAR)) == 0) { \ 71 printf("%s\n", opt->NAME?"yes":"no"); \ 72 return; \ 73 } 74 75 #define SERV_GET_STR(NAME, VAR) \ 76 if (strcasecmp(#NAME, (VAR)) == 0) { \ 77 quote(opt->NAME); \ 78 return; \ 79 } 80 81 #define SERV_GET_PATH(FINAL, NAME, VAR) \ 82 if (strcasecmp(#NAME, (VAR)) == 0) { \ 83 quotepath(opt, FINAL, opt->NAME); \ 84 return; \ 85 } 86 87 #define SERV_GET_INT(NAME, VAR) \ 88 if (strcasecmp(#NAME, (VAR)) == 0) { \ 89 printf("%d\n", (int) opt->NAME); \ 90 return; \ 91 } 92 93 #define SERV_GET_IP(NAME, MEMBER, VAR) \ 94 if (strcasecmp(#NAME, (VAR)) == 0) { \ 95 for(ip = opt->MEMBER; ip; ip=ip->next) \ 96 { \ 97 quote(ip->address); \ 98 } \ 99 return; \ 100 } 101 102 #ifdef RATELIMIT 103 static void zone_print_rrl_whitelist(const char* s, uint16_t w) 104 { 105 int i; 106 if(w==rrl_type_all) { 107 printf("%sall\n", s); 108 return; 109 } 110 for(i=0x01; i <= 0x80; i<<=1) { 111 if( (w&i) ) 112 printf("%s%s\n", s, rrltype2str(i)); 113 } 114 } 115 #endif /* RATELIMIT */ 116 117 static char buf[BUFSIZ]; 118 119 static char * 120 underscore(const char *s) { 121 const char *j = s; 122 size_t i = 0; 123 124 while(j && *j) { 125 if (*j == '-') { 126 buf[i++] = '_'; 127 } else { 128 buf[i++] = *j; 129 } 130 j++; 131 if (i >= BUFSIZ) { 132 return NULL; 133 } 134 } 135 buf[i] = '\0'; 136 return buf; 137 } 138 139 static void 140 usage(void) 141 { 142 fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n"); 143 fprintf(stderr, " [-s keyname] <configfilename>\n"); 144 fprintf(stderr, " Checks NSD configuration file for errors.\n"); 145 fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n", 146 PACKAGE_VERSION, PACKAGE_BUGREPORT); 147 fprintf(stderr, "Use with a configfile as argument to check syntax.\n"); 148 fprintf(stderr, "Use with -o, -z or -s options to query the configuration.\n\n"); 149 fprintf(stderr, "-v Verbose, echo settings that take effect to std output.\n"); 150 fprintf(stderr, "-h Print this help information.\n"); 151 fprintf(stderr, "-f Use with -o to print final pathnames, ie. with chroot.\n"); 152 fprintf(stderr, "-o option Print value of the option specified to stdout.\n"); 153 fprintf(stderr, "-p pattern Print option value for the pattern given.\n"); 154 fprintf(stderr, "-z zonename Print option value for the zone given.\n"); 155 fprintf(stderr, "-a keyname Print algorithm name for the TSIG key.\n"); 156 fprintf(stderr, "-s keyname Print base64 secret blob for the TSIG key.\n"); 157 exit(1); 158 } 159 160 static void 161 print_string_var(const char* varname, const char* value) 162 { 163 if (!value) { 164 printf("\t#%s\n", varname); 165 } else { 166 printf("\t%s \"%s\"\n", varname, value); 167 } 168 } 169 170 static void 171 quote(const char *v) 172 { 173 if(v==NULL) 174 printf("\n"); 175 else 176 printf("%s\n", v); 177 } 178 179 static void 180 quotepath(nsd_options_type* opt, int final, const char *f) 181 { 182 const char* chr = opt->chroot; 183 #ifdef CHROOTDIR 184 if(chr == 0) chr = CHROOTDIR; 185 #endif 186 if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) { 187 quote(f); 188 return; 189 } 190 /* chroot has had trailing slash applied in check part of checkconf */ 191 printf("%s%s\n", chr, f); 192 } 193 194 static void 195 quote_acl(acl_options_type* acl) 196 { 197 while(acl) 198 { 199 printf("%s %s\n", acl->ip_address_spec, 200 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 201 (acl->key_name?acl->key_name:"(null)"))); 202 acl=acl->next; 203 } 204 } 205 206 static void 207 print_acl(const char* varname, acl_options_type* acl) 208 { 209 while(acl) 210 { 211 printf("\t%s ", varname); 212 if(acl->use_axfr_only) 213 printf("AXFR "); 214 if(acl->allow_udp) 215 printf("UDP "); 216 printf("%s %s\n", acl->ip_address_spec, 217 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 218 (acl->key_name?acl->key_name:"(null)"))); 219 if(verbosity>1) { 220 printf("\t# %s", acl->is_ipv6?"ip6":"ip4"); 221 if(acl->port == 0) printf(" noport"); 222 else printf(" port=%d", acl->port); 223 if(acl->rangetype == acl_range_single) printf(" single"); 224 if(acl->rangetype == acl_range_mask) printf(" masked"); 225 if(acl->rangetype == acl_range_subnet) printf(" subnet"); 226 if(acl->rangetype == acl_range_minmax) printf(" minmax"); 227 if(acl->is_ipv6) { 228 #ifdef INET6 229 char dest[128]; 230 inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest)); 231 printf(" addr=%s", dest); 232 if(acl->rangetype != acl_range_single) { 233 inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest)); 234 printf(" rangemask=%s", dest); 235 } 236 #else 237 printf(" ip6addr-noip6defined"); 238 #endif 239 } else { 240 char dest[128]; 241 inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest)); 242 printf(" addr=%s", dest); 243 if(acl->rangetype != acl_range_single) { 244 inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest)); 245 printf(" rangemask=%s", dest); 246 } 247 } 248 printf("\n"); 249 } 250 acl=acl->next; 251 } 252 } 253 254 static void 255 print_acl_ips(const char* varname, acl_options_type* acl) 256 { 257 while(acl) 258 { 259 printf("\t%s %s\n", varname, acl->ip_address_spec); 260 acl=acl->next; 261 } 262 } 263 264 void 265 config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o, 266 const char *z, const char* pat, int final) 267 { 268 ip_address_option_type* ip; 269 270 if (k) { 271 /* find key */ 272 key_options_type* key = key_options_find(opt, k); 273 if(key) { 274 if (s) { 275 quote(key->secret); 276 } else { 277 quote(key->algorithm); 278 } 279 return; 280 } 281 printf("Could not find key %s\n", k); 282 return; 283 } 284 285 if (!o) { 286 return; 287 } 288 289 if (z) { 290 zone_options_type* zone; 291 const dname_type *dname = dname_parse(opt->region, z); 292 if(!dname) { 293 printf("Could not parse zone name %s\n", z); 294 exit(1); 295 } 296 zone = zone_options_find(opt, dname); 297 if(!zone) { 298 printf("Zone does not exist: %s\n", z); 299 exit(1); 300 } 301 ZONE_GET_STR(name, o, zone); 302 if(strcasecmp("pattern", o)==0) { 303 quote(zone->pattern->pname); 304 return; 305 } 306 ZONE_GET_BIN(part_of_config, o, zone); 307 ZONE_GET_PATH(final, zonefile, o, zone->pattern); 308 ZONE_GET_ACL(request_xfr, o, zone->pattern); 309 ZONE_GET_ACL(provide_xfr, o, zone->pattern); 310 ZONE_GET_ACL(allow_notify, o, zone->pattern); 311 ZONE_GET_ACL(notify, o, zone->pattern); 312 ZONE_GET_BIN(notify_retry, o, zone->pattern); 313 ZONE_GET_STR(zonestats, o, zone->pattern); 314 ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern); 315 ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern); 316 ZONE_GET_INT(max_refresh_time, o, zone->pattern); 317 ZONE_GET_INT(min_refresh_time, o, zone->pattern); 318 ZONE_GET_INT(max_retry_time, o, zone->pattern); 319 ZONE_GET_INT(min_retry_time, o, zone->pattern); 320 ZONE_GET_INT(size_limit_xfr, o, zone->pattern); 321 #ifdef RATELIMIT 322 ZONE_GET_RRL(rrl_whitelist, o, zone->pattern); 323 #endif 324 ZONE_GET_BIN(multi_master_check, o, zone->pattern); 325 printf("Zone option not handled: %s %s\n", z, o); 326 exit(1); 327 } else if(pat) { 328 pattern_options_type* p = pattern_options_find(opt, pat); 329 if(!p) { 330 printf("Pattern does not exist: %s\n", pat); 331 exit(1); 332 } 333 if(strcasecmp("name", o)==0) { 334 quote(p->pname); 335 return; 336 } 337 ZONE_GET_STR(zonefile, o, p); 338 ZONE_GET_PATH(final, zonefile, o, p); 339 ZONE_GET_ACL(request_xfr, o, p); 340 ZONE_GET_ACL(provide_xfr, o, p); 341 ZONE_GET_ACL(allow_notify, o, p); 342 ZONE_GET_ACL(notify, o, p); 343 ZONE_GET_BIN(notify_retry, o, p); 344 ZONE_GET_STR(zonestats, o, p); 345 ZONE_GET_OUTGOING(outgoing_interface, o, p); 346 ZONE_GET_BIN(allow_axfr_fallback, o, p); 347 ZONE_GET_INT(max_refresh_time, o, p); 348 ZONE_GET_INT(min_refresh_time, o, p); 349 ZONE_GET_INT(max_retry_time, o, p); 350 ZONE_GET_INT(min_retry_time, o, p); 351 ZONE_GET_INT(size_limit_xfr, o, p); 352 #ifdef RATELIMIT 353 ZONE_GET_RRL(rrl_whitelist, o, p); 354 #endif 355 ZONE_GET_BIN(multi_master_check, o, p); 356 printf("Pattern option not handled: %s %s\n", pat, o); 357 exit(1); 358 } else { 359 /* look in the server section */ 360 SERV_GET_IP(ip_address, ip_addresses, o); 361 /* bin */ 362 SERV_GET_BIN(ip_transparent, o); 363 SERV_GET_BIN(ip_freebind, o); 364 SERV_GET_BIN(debug_mode, o); 365 SERV_GET_BIN(do_ip4, o); 366 SERV_GET_BIN(do_ip6, o); 367 SERV_GET_BIN(reuseport, o); 368 SERV_GET_BIN(hide_version, o); 369 SERV_GET_BIN(zonefiles_check, o); 370 SERV_GET_BIN(log_time_ascii, o); 371 SERV_GET_BIN(round_robin, o); 372 SERV_GET_BIN(minimal_responses, o); 373 SERV_GET_BIN(refuse_any, o); 374 /* str */ 375 SERV_GET_PATH(final, database, o); 376 SERV_GET_STR(identity, o); 377 SERV_GET_STR(version, o); 378 SERV_GET_STR(nsid, o); 379 SERV_GET_PATH(final, logfile, o); 380 SERV_GET_PATH(final, pidfile, o); 381 SERV_GET_STR(chroot, o); 382 SERV_GET_STR(username, o); 383 SERV_GET_PATH(final, zonesdir, o); 384 SERV_GET_PATH(final, xfrdfile, o); 385 SERV_GET_PATH(final, xfrdir, o); 386 SERV_GET_PATH(final, zonelistfile, o); 387 SERV_GET_STR(port, o); 388 /* int */ 389 SERV_GET_INT(server_count, o); 390 SERV_GET_INT(tcp_count, o); 391 SERV_GET_INT(tcp_query_count, o); 392 SERV_GET_INT(tcp_timeout, o); 393 SERV_GET_INT(tcp_mss, o); 394 SERV_GET_INT(outgoing_tcp_mss, o); 395 SERV_GET_INT(ipv4_edns_size, o); 396 SERV_GET_INT(ipv6_edns_size, o); 397 SERV_GET_INT(statistics, o); 398 SERV_GET_INT(xfrd_reload_timeout, o); 399 SERV_GET_INT(verbosity, o); 400 #ifdef RATELIMIT 401 SERV_GET_INT(rrl_size, o); 402 SERV_GET_INT(rrl_ratelimit, o); 403 SERV_GET_INT(rrl_slip, o); 404 SERV_GET_INT(rrl_ipv4_prefix_length, o); 405 SERV_GET_INT(rrl_ipv6_prefix_length, o); 406 SERV_GET_INT(rrl_whitelist_ratelimit, o); 407 #endif 408 #ifdef USE_DNSTAP 409 SERV_GET_BIN(dnstap_enable, o); 410 SERV_GET_STR(dnstap_socket_path, o); 411 SERV_GET_BIN(dnstap_send_identity, o); 412 SERV_GET_BIN(dnstap_send_version, o); 413 SERV_GET_STR(dnstap_identity, o); 414 SERV_GET_STR(dnstap_version, o); 415 SERV_GET_BIN(dnstap_log_auth_query_messages, o); 416 SERV_GET_BIN(dnstap_log_auth_response_messages, o); 417 #endif 418 SERV_GET_INT(zonefiles_write, o); 419 /* remote control */ 420 SERV_GET_BIN(control_enable, o); 421 SERV_GET_IP(control_interface, control_interface, o); 422 SERV_GET_INT(control_port, o); 423 SERV_GET_STR(server_key_file, o); 424 SERV_GET_STR(server_cert_file, o); 425 SERV_GET_STR(control_key_file, o); 426 SERV_GET_STR(control_cert_file, o); 427 428 if(strcasecmp(o, "zones") == 0) { 429 zone_options_type* zone; 430 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 431 quote(zone->name); 432 return; 433 } 434 if(strcasecmp(o, "patterns") == 0) { 435 pattern_options_type* p; 436 RBTREE_FOR(p, pattern_options_type*, opt->patterns) 437 quote(p->pname); 438 return; 439 } 440 printf("Server option not handled: %s\n", o); 441 exit(1); 442 } 443 } 444 445 /* print zone content items */ 446 static void print_zone_content_elems(pattern_options_type* pat) 447 { 448 if(pat->zonefile) 449 print_string_var("zonefile:", pat->zonefile); 450 #ifdef RATELIMIT 451 zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist); 452 #endif 453 print_acl("allow-notify:", pat->allow_notify); 454 print_acl("request-xfr:", pat->request_xfr); 455 if(pat->multi_master_check) 456 printf("\tmulti-master-check: %s\n", pat->multi_master_check?"yes":"no"); 457 if(!pat->notify_retry_is_default) 458 printf("\tnotify-retry: %d\n", pat->notify_retry); 459 print_acl("notify:", pat->notify); 460 print_acl("provide-xfr:", pat->provide_xfr); 461 if(pat->zonestats) 462 print_string_var("zonestats:", pat->zonestats); 463 print_acl_ips("outgoing-interface:", pat->outgoing_interface); 464 if(!pat->allow_axfr_fallback_is_default) 465 printf("\tallow-axfr-fallback: %s\n", 466 pat->allow_axfr_fallback?"yes":"no"); 467 if(!pat->max_refresh_time_is_default) 468 printf("\tmax-refresh-time: %d\n", pat->max_refresh_time); 469 if(!pat->min_refresh_time_is_default) 470 printf("\tmin-refresh-time: %d\n", pat->min_refresh_time); 471 if(!pat->max_retry_time_is_default) 472 printf("\tmax-retry-time: %d\n", pat->max_retry_time); 473 if(!pat->min_retry_time_is_default) 474 printf("\tmin-retry-time: %d\n", pat->min_retry_time); 475 if(pat->size_limit_xfr != 0) 476 printf("\tsize-limit-xfr: %llu\n", 477 (long long unsigned)pat->size_limit_xfr); 478 } 479 480 void 481 config_test_print_server(nsd_options_type* opt) 482 { 483 ip_address_option_type* ip; 484 key_options_type* key; 485 zone_options_type* zone; 486 pattern_options_type* pat; 487 488 printf("# Config settings.\n"); 489 printf("server:\n"); 490 printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no"); 491 printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no"); 492 printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no"); 493 printf("\treuseport: %s\n", opt->reuseport?"yes":"no"); 494 printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no"); 495 printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no"); 496 printf("\thide-version: %s\n", opt->hide_version?"yes":"no"); 497 print_string_var("database:", opt->database); 498 print_string_var("identity:", opt->identity); 499 print_string_var("version:", opt->version); 500 print_string_var("nsid:", opt->nsid); 501 print_string_var("logfile:", opt->logfile); 502 printf("\tserver-count: %d\n", opt->server_count); 503 printf("\ttcp-count: %d\n", opt->tcp_count); 504 printf("\ttcp-query-count: %d\n", opt->tcp_query_count); 505 printf("\ttcp-timeout: %d\n", opt->tcp_timeout); 506 printf("\ttcp-mss: %d\n", opt->tcp_mss); 507 printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss); 508 printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size); 509 printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size); 510 print_string_var("pidfile:", opt->pidfile); 511 print_string_var("port:", opt->port); 512 printf("\tstatistics: %d\n", opt->statistics); 513 print_string_var("chroot:", opt->chroot); 514 print_string_var("username:", opt->username); 515 print_string_var("zonesdir:", opt->zonesdir); 516 print_string_var("xfrdfile:", opt->xfrdfile); 517 print_string_var("zonelistfile:", opt->zonelistfile); 518 print_string_var("xfrdir:", opt->xfrdir); 519 printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout); 520 printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no"); 521 printf("\tround-robin: %s\n", opt->round_robin?"yes":"no"); 522 printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no"); 523 printf("\trefuse-any: %s\n", opt->refuse_any?"yes":"no"); 524 printf("\tverbosity: %d\n", opt->verbosity); 525 for(ip = opt->ip_addresses; ip; ip=ip->next) 526 { 527 print_string_var("ip-address:", ip->address); 528 } 529 #ifdef RATELIMIT 530 printf("\trrl-size: %d\n", (int)opt->rrl_size); 531 printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit); 532 printf("\trrl-slip: %d\n", (int)opt->rrl_slip); 533 printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length); 534 printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length); 535 printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit); 536 #endif 537 printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no"); 538 printf("\tzonefiles-write: %d\n", opt->zonefiles_write); 539 540 #ifdef USE_DNSTAP 541 printf("\ndnstap:\n"); 542 printf("\tdnstap-enable: %s\n", opt->dnstap_enable?"yes":"no"); 543 print_string_var("dnstap-socket-path:", opt->dnstap_socket_path); 544 printf("\tdnstap-send-identity: %s\n", opt->dnstap_send_identity?"yes":"no"); 545 printf("\tdnstap-send-version: %s\n", opt->dnstap_send_version?"yes":"no"); 546 print_string_var("dnstap-identity:", opt->dnstap_identity); 547 print_string_var("dnstap-version:", opt->dnstap_version); 548 printf("\tdnstap-log-auth-query-messages: %s\n", opt->dnstap_log_auth_query_messages?"yes":"no"); 549 printf("\tdnstap-log-auth-response-messages: %s\n", opt->dnstap_log_auth_response_messages?"yes":"no"); 550 #endif 551 552 printf("\nremote-control:\n"); 553 printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no"); 554 for(ip = opt->control_interface; ip; ip=ip->next) 555 print_string_var("control-interface:", ip->address); 556 printf("\tcontrol-port: %d\n", opt->control_port); 557 print_string_var("server-key-file:", opt->server_key_file); 558 print_string_var("server-cert-file:", opt->server_cert_file); 559 print_string_var("control-key-file:", opt->control_key_file); 560 print_string_var("control-cert-file:", opt->control_cert_file); 561 562 RBTREE_FOR(key, key_options_type*, opt->keys) 563 { 564 printf("\nkey:\n"); 565 print_string_var("name:", key->name); 566 print_string_var("algorithm:", key->algorithm); 567 print_string_var("secret:", key->secret); 568 } 569 RBTREE_FOR(pat, pattern_options_type*, opt->patterns) 570 { 571 if(pat->implicit) continue; 572 printf("\npattern:\n"); 573 print_string_var("name:", pat->pname); 574 print_zone_content_elems(pat); 575 } 576 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 577 { 578 if(!zone->part_of_config) 579 continue; 580 printf("\nzone:\n"); 581 print_string_var("name:", zone->name); 582 print_zone_content_elems(zone->pattern); 583 } 584 585 } 586 587 static int 588 additional_checks(nsd_options_type* opt, const char* filename) 589 { 590 zone_options_type* zone; 591 int errors = 0; 592 593 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 594 { 595 const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */ 596 if(!dname) { 597 fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name); 598 errors ++; 599 continue; 600 } 601 #ifndef ROOT_SERVER 602 /* Is it a root zone? Are we a root server then? Idiot proof. */ 603 if(dname->label_count == 1) { 604 fprintf(stderr, "%s: not configured as a root server.\n", filename); 605 errors ++; 606 } 607 #endif 608 if(zone->pattern->allow_notify && !zone->pattern->request_xfr) { 609 fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr" 610 " items. Where can it get a zone transfer when a notify " 611 "is received?\n", filename, zone->name); 612 errors ++; 613 } 614 if(!zone_is_slave(zone) && (!zone->pattern->zonefile || 615 zone->pattern->zonefile[0] == 0)) { 616 fprintf(stderr, "%s: zone %s is a master zone but has " 617 "no zonefile. Where can the data come from?\n", 618 filename, zone->name); 619 errors ++; 620 } 621 } 622 623 #ifndef BIND8_STATS 624 if(opt->statistics > 0) 625 { 626 fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n", 627 filename, opt->statistics); 628 errors ++; 629 } 630 #endif 631 #ifndef HAVE_CHROOT 632 if(opt->chroot != 0) 633 { 634 fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n", 635 filename, opt->chroot); 636 errors ++; 637 } 638 #endif 639 if (opt->identity && strlen(opt->identity) > UCHAR_MAX) { 640 fprintf(stderr, "%s: server identity too long (%u characters)\n", 641 filename, (unsigned) strlen(opt->identity)); 642 errors ++; 643 } 644 if (opt->version && strlen(opt->version) > UCHAR_MAX) { 645 fprintf(stderr, "%s: server version too long (%u characters)\n", 646 filename, (unsigned) strlen(opt->version)); 647 errors ++; 648 } 649 650 /* not done here: parsing of ip-address. parsing of username. */ 651 652 if (opt->chroot && opt->chroot[0]) { 653 /* append trailing slash for strncmp checking */ 654 append_trailing_slash(&opt->chroot, opt->region); 655 append_trailing_slash(&opt->xfrdir, opt->region); 656 append_trailing_slash(&opt->zonesdir, opt->region); 657 658 /* zonesdir must be absolute and within chroot, 659 * all other pathnames may be relative to zonesdir */ 660 if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) { 661 fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n", 662 filename, opt->zonesdir, opt->chroot); 663 errors ++; 664 } 665 if (!file_inside_chroot(opt->pidfile, opt->chroot)) { 666 fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n", 667 filename, opt->pidfile, opt->chroot); 668 errors ++; 669 } 670 if (!file_inside_chroot(opt->database, opt->chroot)) { 671 fprintf(stderr, "%s: database %s is not relative to chroot %s.\n", 672 filename, opt->database, opt->chroot); 673 errors ++; 674 } 675 if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) { 676 fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n", 677 filename, opt->xfrdfile, opt->chroot); 678 errors ++; 679 } 680 if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) { 681 fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n", 682 filename, opt->zonelistfile, opt->chroot); 683 errors ++; 684 } 685 if (!file_inside_chroot(opt->xfrdir, opt->chroot)) { 686 fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n", 687 filename, opt->xfrdir, opt->chroot); 688 errors ++; 689 } 690 } 691 692 if (atoi(opt->port) <= 0) { 693 fprintf(stderr, "%s: port number '%s' is not a positive number.\n", 694 filename, opt->port); 695 errors ++; 696 } 697 if(errors != 0) { 698 fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys.\n", 699 filename, errors, (int)nsd_options_num_zones(opt), 700 (int)opt->keys->count); 701 } 702 703 return (errors == 0); 704 } 705 706 int 707 main(int argc, char* argv[]) 708 { 709 int c; 710 int verbose = 0; 711 int key_sec = 0; 712 int final = 0; 713 const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */ 714 const char * conf_zone = NULL; /* what zone are we talking about */ 715 const char * conf_key = NULL; /* what key is needed */ 716 const char * conf_pat = NULL; /* what pattern is talked about */ 717 const char* configfile; 718 nsd_options_type *options; 719 720 log_init("nsd-checkconf"); 721 722 /* Parse the command line... */ 723 while ((c = getopt(argc, argv, "vfo:a:p:s:z:")) != -1) { 724 switch (c) { 725 case 'v': 726 verbose = 1; 727 verbosity++; 728 break; 729 case 'o': 730 conf_opt = optarg; 731 break; 732 case 'f': 733 final = 1; 734 break; 735 case 'p': 736 conf_pat = optarg; 737 break; 738 case 'a': 739 if (conf_key) { 740 fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n"); 741 exit(1); 742 } 743 conf_key = optarg; 744 break; 745 case 's': 746 if (conf_key) { 747 fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n"); 748 exit(1); 749 } 750 conf_key = optarg; 751 key_sec = 1; 752 break; 753 case 'z': 754 conf_zone = optarg; 755 break; 756 default: 757 usage(); 758 }; 759 } 760 argc -= optind; 761 argv += optind; 762 if (argc == 0 || argc>=2) { 763 usage(); 764 } 765 configfile = argv[0]; 766 767 /* read config file */ 768 options = nsd_options_create(region_create(xalloc, free)); 769 tsig_init(options->region); 770 if (!parse_options_file(options, configfile, NULL, NULL) || 771 !additional_checks(options, configfile)) { 772 exit(2); 773 } 774 if (conf_opt || conf_key) { 775 config_print_zone(options, conf_key, key_sec, 776 underscore(conf_opt), conf_zone, conf_pat, final); 777 } else { 778 if (verbose) { 779 printf("# Read file %s: %d patterns, %d fixed-zones, " 780 "%d keys.\n", 781 configfile, 782 (int)options->patterns->count, 783 (int)nsd_options_num_zones(options), 784 (int)options->keys->count); 785 config_test_print_server(options); 786 } 787 } 788 return 0; 789 } 790