xref: /openbsd/usr.sbin/nsd/nsd-checkconf.c (revision e3d8a0a5) 
1 /*
2  * checkconf - Read and repeat configuration file to output.
3  *
4  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  */
9 #include "config.h"
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <unistd.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "tsig.h"
16 #include "options.h"
17 #include "util.h"
18 #include "dname.h"
19 #include "rrl.h"
20 
21 extern char *optarg;
22 extern int optind;
23 
24 #define ZONE_GET_ACL(NAME, VAR, PATTERN) 		\
25 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
26 		quote_acl(PATTERN->NAME); 	\
27 		return; 			\
28 	}
29 
30 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN)			\
31 	if (strcasecmp(#NAME, (VAR)) == 0) {		\
32 		acl_options_t* acl; 			\
33 		for(acl=PATTERN->NAME; acl; acl=acl->next)	\
34 			quote(acl->ip_address_spec);	\
35 		return; 				\
36 	}
37 
38 #define ZONE_GET_STR(NAME, VAR, PATTERN) 		\
39 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
40 		quote(PATTERN->NAME); 		\
41 		return; 			\
42 	}
43 
44 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) 	\
45 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
46 		quotepath(opt, FINAL, PATTERN->NAME); 	\
47 		return; 				\
48 	}
49 
50 #define ZONE_GET_BIN(NAME, VAR, PATTERN) 			\
51 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
52 		printf("%s\n", (PATTERN->NAME)?"yes":"no"); 	\
53 		return;					\
54 	}
55 
56 #define ZONE_GET_RRL(NAME, VAR, PATTERN) 			\
57 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
58 		zone_print_rrl_whitelist("", PATTERN->NAME);	\
59 		return;					\
60 	}
61 
62 #define SERV_GET_BIN(NAME, VAR) 			\
63 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
64 		printf("%s\n", opt->NAME?"yes":"no"); 	\
65 		return;					\
66 	}
67 
68 #define SERV_GET_STR(NAME, VAR) 		\
69 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
70 		quote(opt->NAME); 		\
71 		return; 			\
72 	}
73 
74 #define SERV_GET_PATH(FINAL, NAME, VAR) 	\
75 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
76 		quotepath(opt, FINAL, opt->NAME); 	\
77 		return; 			\
78 	}
79 
80 #define SERV_GET_INT(NAME, VAR) 		\
81 	if (strcasecmp(#NAME, (VAR)) == 0) { 	\
82 		printf("%d\n", (int) opt->NAME); 	\
83 		return; 			\
84 	}
85 
86 #define SERV_GET_IP(NAME, MEMBER, VAR) 				\
87 	if (strcasecmp(#NAME, (VAR)) == 0) { 		\
88 		for(ip = opt->MEMBER; ip; ip=ip->next)	\
89 		{						\
90 			quote(ip->address);			\
91 		}						\
92 		return;						\
93 	}
94 
95 #ifdef RATELIMIT
96 static void zone_print_rrl_whitelist(const char* s, uint16_t w)
97 {
98 	int i;
99 	if(w==rrl_type_all) {
100 		printf("%sall\n", s);
101 		return;
102 	}
103 	for(i=0x01; i <= 0x80; i<<=1) {
104 		if( (w&i) )
105 			printf("%s%s\n", s, rrltype2str(i));
106 	}
107 }
108 #endif /* RATELIMIT */
109 
110 static char buf[BUFSIZ];
111 
112 static char *
113 underscore(const char *s) {
114 	const char *j = s;
115 	size_t i = 0;
116 
117 	while(j && *j) {
118 		if (*j == '-') {
119 			buf[i++] = '_';
120 		} else {
121 			buf[i++] = *j;
122 		}
123 		j++;
124 		if (i >= BUFSIZ) {
125 			return NULL;
126 		}
127 	}
128 	buf[i] = '\0';
129 	return buf;
130 }
131 
132 static void
133 usage(void)
134 {
135 	fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n");
136 	fprintf(stderr, "                     [-s keyname] <configfilename>\n");
137 	fprintf(stderr, "       Checks NSD configuration file for errors.\n");
138 	fprintf(stderr, "       Version %s. Report bugs to <%s>.\n\n",
139 		PACKAGE_VERSION, PACKAGE_BUGREPORT);
140 	fprintf(stderr, "Use with a configfile as argument to check syntax.\n");
141 	fprintf(stderr, "Use with -o, -z or -s options to query the configuration.\n\n");
142 	fprintf(stderr, "-v		Verbose, echo settings that take effect to std output.\n");
143 	fprintf(stderr, "-h		Print this help information.\n");
144 	fprintf(stderr, "-f		Use with -o to print final pathnames, ie. with chroot.\n");
145 	fprintf(stderr, "-o option	Print value of the option specified to stdout.\n");
146 	fprintf(stderr, "-p pattern	Print option value for the pattern given.\n");
147 	fprintf(stderr, "-z zonename	Print option value for the zone given.\n");
148 	fprintf(stderr, "-a keyname	Print algorithm name for the TSIG key.\n");
149 	fprintf(stderr, "-s keyname	Print base64 secret blob for the TSIG key.\n");
150 	exit(1);
151 }
152 
153 static void
154 print_string_var(const char* varname, const char* value)
155 {
156 	if (!value) {
157 		printf("\t#%s\n", varname);
158 	} else {
159 		printf("\t%s \"%s\"\n", varname, value);
160 	}
161 }
162 
163 static void
164 quote(const char *v)
165 {
166 	if(v==NULL)
167 		printf("\n");
168 	else
169 		printf("%s\n", v);
170 }
171 
172 static void
173 quotepath(nsd_options_t* opt, int final, const char *f)
174 {
175 	const char* chr = opt->chroot;
176 #ifdef CHROOTDIR
177 	if(chr == 0) chr = CHROOTDIR;
178 #endif
179 	if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) {
180 		quote(f);
181 		return;
182 	}
183 	/* chroot has had trailing slash applied in check part of checkconf */
184 	printf("%s%s\n", chr, f);
185 }
186 
187 static void
188 quote_acl(acl_options_t* acl)
189 {
190 	while(acl)
191 	{
192 		printf("%s %s\n", acl->ip_address_spec,
193 			acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
194 			(acl->key_name?acl->key_name:"(null)")));
195 		acl=acl->next;
196 	}
197 }
198 
199 static void
200 print_acl(const char* varname, acl_options_t* acl)
201 {
202 	while(acl)
203 	{
204 		printf("\t%s ", varname);
205 		if(acl->use_axfr_only)
206 			printf("AXFR ");
207 		if(acl->allow_udp)
208 			printf("UDP ");
209 		printf("%s %s\n", acl->ip_address_spec,
210 			acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
211 			(acl->key_name?acl->key_name:"(null)")));
212 		if(verbosity>1) {
213 			printf("\t# %s", acl->is_ipv6?"ip6":"ip4");
214 			if(acl->port == 0) printf(" noport");
215 			else printf(" port=%d", acl->port);
216 			if(acl->rangetype == acl_range_single) printf(" single");
217 			if(acl->rangetype == acl_range_mask)   printf(" masked");
218 			if(acl->rangetype == acl_range_subnet) printf(" subnet");
219 			if(acl->rangetype == acl_range_minmax) printf(" minmax");
220 			if(acl->is_ipv6) {
221 #ifdef INET6
222 				char dest[128];
223 				inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest));
224 				printf(" addr=%s", dest);
225 				if(acl->rangetype != acl_range_single) {
226 					inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest));
227 					printf(" rangemask=%s", dest);
228 				}
229 #else
230 				printf(" ip6addr-noip6defined");
231 #endif
232 			} else {
233 				char dest[128];
234 				inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest));
235 				printf(" addr=%s", dest);
236 				if(acl->rangetype != acl_range_single) {
237 					inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest));
238 					printf(" rangemask=%s", dest);
239 				}
240 			}
241 			printf("\n");
242 		}
243 		acl=acl->next;
244 	}
245 }
246 
247 static void
248 print_acl_ips(const char* varname, acl_options_t* acl)
249 {
250 	while(acl)
251 	{
252 		printf("\t%s %s\n", varname, acl->ip_address_spec);
253 		acl=acl->next;
254 	}
255 }
256 
257 void
258 config_print_zone(nsd_options_t* opt, const char* k, int s, const char *o,
259 	const char *z, const char* pat, int final)
260 {
261 	ip_address_option_t* ip;
262 
263 	if (k) {
264 		/* find key */
265 		key_options_t* key = key_options_find(opt, k);
266 		if(key) {
267 			if (s) {
268 				quote(key->secret);
269 			} else {
270 				quote(key->algorithm);
271 			}
272 			return;
273 		}
274 		printf("Could not find key %s\n", k);
275 		return;
276 	}
277 
278 	if (!o) {
279 		return;
280 	}
281 
282 	if (z) {
283 		zone_options_t* zone;
284 		const dname_type *dname = dname_parse(opt->region, z);
285 		if(!dname) {
286 			printf("Could not parse zone name %s\n", z);
287 			exit(1);
288 		}
289 		zone = zone_options_find(opt, dname);
290 		if(!zone) {
291 			printf("Zone does not exist: %s\n", z);
292 			exit(1);
293 		}
294 		ZONE_GET_STR(name, o, zone);
295 		if(strcasecmp("pattern", o)==0) {
296 			quote(zone->pattern->pname);
297 			return;
298 		}
299 		ZONE_GET_BIN(part_of_config, o, zone);
300 		ZONE_GET_PATH(final, zonefile, o, zone->pattern);
301 		ZONE_GET_ACL(request_xfr, o, zone->pattern);
302 		ZONE_GET_ACL(provide_xfr, o, zone->pattern);
303 		ZONE_GET_ACL(allow_notify, o, zone->pattern);
304 		ZONE_GET_ACL(notify, o, zone->pattern);
305 		ZONE_GET_BIN(notify_retry, o, zone->pattern);
306 		ZONE_GET_STR(zonestats, o, zone->pattern);
307 		ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern);
308 		ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern);
309 #ifdef RATELIMIT
310 		ZONE_GET_RRL(rrl_whitelist, o, zone->pattern);
311 #endif
312 		printf("Zone option not handled: %s %s\n", z, o);
313 		exit(1);
314 	} else if(pat) {
315 		pattern_options_t* p = pattern_options_find(opt, pat);
316 		if(!p) {
317 			printf("Pattern does not exist: %s\n", pat);
318 			exit(1);
319 		}
320 		if(strcasecmp("name", o)==0) {
321 			quote(p->pname);
322 			return;
323 		}
324 		ZONE_GET_STR(zonefile, o, p);
325 		ZONE_GET_PATH(final, zonefile, o, p);
326 		ZONE_GET_ACL(request_xfr, o, p);
327 		ZONE_GET_ACL(provide_xfr, o, p);
328 		ZONE_GET_ACL(allow_notify, o, p);
329 		ZONE_GET_ACL(notify, o, p);
330 		ZONE_GET_BIN(notify_retry, o, p);
331 		ZONE_GET_STR(zonestats, o, p);
332 		ZONE_GET_OUTGOING(outgoing_interface, o, p);
333 		ZONE_GET_BIN(allow_axfr_fallback, o, p);
334 #ifdef RATELIMIT
335 		ZONE_GET_RRL(rrl_whitelist, o, p);
336 #endif
337 		printf("Pattern option not handled: %s %s\n", pat, o);
338 		exit(1);
339 	} else {
340 		/* look in the server section */
341 		SERV_GET_IP(ip_address, ip_addresses, o);
342 		/* bin */
343 		SERV_GET_BIN(ip_transparent, o);
344 		SERV_GET_BIN(debug_mode, o);
345 		SERV_GET_BIN(do_ip4, o);
346 		SERV_GET_BIN(do_ip6, o);
347 		SERV_GET_BIN(reuseport, o);
348 		SERV_GET_BIN(hide_version, o);
349 		SERV_GET_BIN(zonefiles_check, o);
350 		SERV_GET_BIN(log_time_ascii, o);
351 		SERV_GET_BIN(round_robin, o);
352 		/* str */
353 		SERV_GET_PATH(final, database, o);
354 		SERV_GET_STR(identity, o);
355 		SERV_GET_STR(nsid, o);
356 		SERV_GET_PATH(final, logfile, o);
357 		SERV_GET_PATH(final, pidfile, o);
358 		SERV_GET_STR(chroot, o);
359 		SERV_GET_STR(username, o);
360 		SERV_GET_PATH(final, zonesdir, o);
361 		SERV_GET_PATH(final, xfrdfile, o);
362 		SERV_GET_PATH(final, xfrdir, o);
363 		SERV_GET_PATH(final, zonelistfile, o);
364 		SERV_GET_STR(port, o);
365 		/* int */
366 		SERV_GET_INT(server_count, o);
367 		SERV_GET_INT(tcp_count, o);
368 		SERV_GET_INT(tcp_query_count, o);
369 		SERV_GET_INT(tcp_timeout, o);
370 		SERV_GET_INT(ipv4_edns_size, o);
371 		SERV_GET_INT(ipv6_edns_size, o);
372 		SERV_GET_INT(statistics, o);
373 		SERV_GET_INT(xfrd_reload_timeout, o);
374 		SERV_GET_INT(verbosity, o);
375 #ifdef RATELIMIT
376 		SERV_GET_INT(rrl_size, o);
377 		SERV_GET_INT(rrl_ratelimit, o);
378 		SERV_GET_INT(rrl_slip, o);
379 		SERV_GET_INT(rrl_ipv4_prefix_length, o);
380 		SERV_GET_INT(rrl_ipv6_prefix_length, o);
381 		SERV_GET_INT(rrl_whitelist_ratelimit, o);
382 #endif
383 		SERV_GET_INT(zonefiles_write, o);
384 		/* remote control */
385 		SERV_GET_BIN(control_enable, o);
386 		SERV_GET_IP(control_interface, control_interface, o);
387 		SERV_GET_INT(control_port, o);
388 		SERV_GET_STR(server_key_file, o);
389 		SERV_GET_STR(server_cert_file, o);
390 		SERV_GET_STR(control_key_file, o);
391 		SERV_GET_STR(control_cert_file, o);
392 
393 		if(strcasecmp(o, "zones") == 0) {
394 			zone_options_t* zone;
395 			RBTREE_FOR(zone, zone_options_t*, opt->zone_options)
396 				quote(zone->name);
397 			return;
398 		}
399 		if(strcasecmp(o, "patterns") == 0) {
400 			pattern_options_t* p;
401 			RBTREE_FOR(p, pattern_options_t*, opt->patterns)
402 				quote(p->pname);
403 			return;
404 		}
405 		printf("Server option not handled: %s\n", o);
406 		exit(1);
407 	}
408 }
409 
410 /* print zone content items */
411 static void print_zone_content_elems(pattern_options_t* pat)
412 {
413 	if(pat->zonefile)
414 		print_string_var("zonefile:", pat->zonefile);
415 #ifdef RATELIMIT
416 	zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist);
417 #endif
418 	print_acl("allow-notify:", pat->allow_notify);
419 	print_acl("request-xfr:", pat->request_xfr);
420 	if(!pat->notify_retry_is_default)
421 		printf("\tnotify-retry: %d\n", pat->notify_retry);
422 	print_acl("notify:", pat->notify);
423 	print_acl("provide-xfr:", pat->provide_xfr);
424 	if(pat->zonestats)
425 		print_string_var("zonestats:", pat->zonestats);
426 	print_acl_ips("outgoing-interface:", pat->outgoing_interface);
427 	if(!pat->allow_axfr_fallback_is_default)
428 		printf("\tallow-axfr-fallback: %s\n",
429 			pat->allow_axfr_fallback?"yes":"no");
430 }
431 
432 void
433 config_test_print_server(nsd_options_t* opt)
434 {
435 	ip_address_option_t* ip;
436 	key_options_t* key;
437 	zone_options_t* zone;
438 	pattern_options_t* pat;
439 
440 	printf("# Config settings.\n");
441 	printf("server:\n");
442 	printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no");
443 	printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no");
444 	printf("\treuseport: %s\n", opt->reuseport?"yes":"no");
445 	printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no");
446 	printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no");
447 	printf("\thide-version: %s\n", opt->hide_version?"yes":"no");
448 	print_string_var("database:", opt->database);
449 	print_string_var("identity:", opt->identity);
450 	print_string_var("nsid:", opt->nsid);
451 	print_string_var("logfile:", opt->logfile);
452 	printf("\tserver_count: %d\n", opt->server_count);
453 	printf("\ttcp_count: %d\n", opt->tcp_count);
454 	printf("\ttcp_query_count: %d\n", opt->tcp_query_count);
455 	printf("\ttcp_timeout: %d\n", opt->tcp_timeout);
456 	printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size);
457 	printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size);
458 	print_string_var("pidfile:", opt->pidfile);
459 	print_string_var("port:", opt->port);
460 	printf("\tstatistics: %d\n", opt->statistics);
461 	print_string_var("chroot:", opt->chroot);
462 	print_string_var("username:", opt->username);
463 	print_string_var("zonesdir:", opt->zonesdir);
464 	print_string_var("xfrdfile:", opt->xfrdfile);
465 	print_string_var("zonelistfile:", opt->zonelistfile);
466 	print_string_var("xfrdir:", opt->xfrdir);
467 	printf("\txfrd_reload_timeout: %d\n", opt->xfrd_reload_timeout);
468 	printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no");
469 	printf("\tround-robin: %s\n", opt->round_robin?"yes":"no");
470 	printf("\tverbosity: %d\n", opt->verbosity);
471 	for(ip = opt->ip_addresses; ip; ip=ip->next)
472 	{
473 		print_string_var("ip-address:", ip->address);
474 	}
475 #ifdef RATELIMIT
476 	printf("\trrl-size: %d\n", (int)opt->rrl_size);
477 	printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit);
478 	printf("\trrl-slip: %d\n", (int)opt->rrl_slip);
479 	printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length);
480 	printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length);
481 	printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit);
482 #endif
483 	printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no");
484 	printf("\tzonefiles-write: %d\n", opt->zonefiles_write);
485 
486 	printf("\nremote-control:\n");
487 	printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no");
488 	for(ip = opt->control_interface; ip; ip=ip->next)
489 		print_string_var("control-interface:", ip->address);
490 	printf("\tcontrol-port: %d\n", opt->control_port);
491 	print_string_var("server-key-file:", opt->server_key_file);
492 	print_string_var("server-cert-file:", opt->server_cert_file);
493 	print_string_var("control-key-file:", opt->control_key_file);
494 	print_string_var("control-cert-file:", opt->control_cert_file);
495 
496 	RBTREE_FOR(key, key_options_t*, opt->keys)
497 	{
498 		printf("\nkey:\n");
499 		print_string_var("name:", key->name);
500 		print_string_var("algorithm:", key->algorithm);
501 		print_string_var("secret:", key->secret);
502 	}
503 	RBTREE_FOR(pat, pattern_options_t*, opt->patterns)
504 	{
505 		if(pat->implicit) continue;
506 		printf("\npattern:\n");
507 		print_string_var("name:", pat->pname);
508 		print_zone_content_elems(pat);
509 	}
510 	RBTREE_FOR(zone, zone_options_t*, opt->zone_options)
511 	{
512 		if(!zone->part_of_config)
513 			continue;
514 		printf("\nzone:\n");
515 		print_string_var("name:", zone->name);
516 		print_zone_content_elems(zone->pattern);
517 	}
518 
519 }
520 
521 static void
522 append_trailing_slash(const char** dirname, region_type* region)
523 {
524 	int l = strlen(*dirname);
525 	if (l>0 && (*dirname)[l-1] != '/' && l < 0xffffff) {
526 		char *dirname_slash = region_alloc(region, l+2);
527 		memcpy(dirname_slash, *dirname, l+1);
528 		strlcat(dirname_slash, "/", l+2);
529 		*dirname = dirname_slash;
530 	}
531 }
532 
533 static int
534 file_inside_chroot(const char* fname, const char* chr)
535 {
536 	/* true if filename starts with chroot or is not absolute */
537 	return ((fname && fname[0] && strncmp(fname, chr, strlen(chr)) == 0) ||
538 		(fname && fname[0] != '/'));
539 }
540 
541 static int
542 additional_checks(nsd_options_t* opt, const char* filename)
543 {
544 	zone_options_t* zone;
545 	int errors = 0;
546 
547 	RBTREE_FOR(zone, zone_options_t*, opt->zone_options)
548 	{
549 		const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */
550 		if(!dname) {
551 			fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name);
552 			errors ++;
553 		}
554 		if(zone->pattern->allow_notify && !zone->pattern->request_xfr) {
555 			fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr"
556 				" items. Where can it get a zone transfer when a notify "
557 				"is received?\n", filename, zone->name);
558 			errors ++;
559 		}
560 		if(!zone_is_slave(zone) && (!zone->pattern->zonefile ||
561 			zone->pattern->zonefile[0] == 0)) {
562 			fprintf(stderr, "%s: zone %s is a master zone but has "
563 				"no zonefile. Where can the data come from?\n",
564 				filename, zone->name);
565 			errors ++;
566 		}
567 	}
568 
569 #ifndef BIND8_STATS
570 	if(opt->statistics > 0)
571 	{
572 		fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n",
573 			filename, opt->statistics);
574 		errors ++;
575 	}
576 #endif
577 #ifndef HAVE_CHROOT
578 	if(opt->chroot != 0)
579 	{
580 		fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n",
581 			filename, opt->chroot);
582 		errors ++;
583 	}
584 #endif
585 	if (opt->identity && strlen(opt->identity) > UCHAR_MAX) {
586                 fprintf(stderr, "%s: server identity too long (%u characters)\n",
587                       filename, (unsigned) strlen(opt->identity));
588 		errors ++;
589         }
590 
591 	/* not done here: parsing of ip-address. parsing of username. */
592 
593         if (opt->chroot && opt->chroot[0]) {
594 		/* append trailing slash for strncmp checking */
595 		append_trailing_slash(&opt->chroot, opt->region);
596 		append_trailing_slash(&opt->xfrdir, opt->region);
597 		append_trailing_slash(&opt->zonesdir, opt->region);
598 
599 		/* zonesdir must be absolute and within chroot,
600 		 * all other pathnames may be relative to zonesdir */
601 		if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) {
602 			fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n",
603 				filename, opt->zonesdir, opt->chroot);
604 			errors ++;
605                 }
606 		if (!file_inside_chroot(opt->pidfile, opt->chroot)) {
607 			fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n",
608 				filename, opt->pidfile, opt->chroot);
609 			errors ++;
610                 }
611 		if (!file_inside_chroot(opt->database, opt->chroot)) {
612 			fprintf(stderr, "%s: database %s is not relative to chroot %s.\n",
613 				filename, opt->database, opt->chroot);
614 			errors ++;
615                 }
616 		if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) {
617 			fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n",
618 				filename, opt->xfrdfile, opt->chroot);
619 			errors ++;
620                 }
621 		if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) {
622 			fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n",
623 				filename, opt->zonelistfile, opt->chroot);
624 			errors ++;
625                 }
626 		if (!file_inside_chroot(opt->xfrdir, opt->chroot)) {
627 			fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n",
628 				filename, opt->xfrdir, opt->chroot);
629 			errors ++;
630                 }
631 	}
632 
633 	if (atoi(opt->port) <= 0) {
634 		fprintf(stderr, "%s: port number '%s' is not a positive number.\n",
635 			filename, opt->port);
636 		errors ++;
637 	}
638 	if(errors != 0) {
639 		fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys.\n",
640 			filename, errors, (int)nsd_options_num_zones(opt),
641 			(int)opt->keys->count);
642 	}
643 
644 	return (errors == 0);
645 }
646 
647 int
648 main(int argc, char* argv[])
649 {
650 	int c;
651 	int verbose = 0;
652 	int key_sec = 0;
653 	int final = 0;
654 	const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */
655 	const char * conf_zone = NULL; /* what zone are we talking about */
656 	const char * conf_key = NULL; /* what key is needed */
657 	const char * conf_pat = NULL; /* what pattern is talked about */
658 	const char* configfile;
659 	nsd_options_t *options;
660 
661 	log_init("nsd-checkconf");
662 
663 	/* Parse the command line... */
664 	while ((c = getopt(argc, argv, "vfo:a:p:s:z:")) != -1) {
665 		switch (c) {
666 		case 'v':
667 			verbose = 1;
668 			verbosity++;
669 			break;
670 		case 'o':
671 			conf_opt = optarg;
672 			break;
673 		case 'f':
674 			final = 1;
675 			break;
676 		case 'p':
677 			conf_pat = optarg;
678 			break;
679 		case 'a':
680 			if (conf_key) {
681 				fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n");
682 				exit(1);
683 			}
684 			conf_key = optarg;
685 			break;
686 		case 's':
687 			if (conf_key) {
688 				fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n");
689 				exit(1);
690 			}
691 			conf_key = optarg;
692 			key_sec = 1;
693 			break;
694 		case 'z':
695 			conf_zone = optarg;
696 			break;
697 		default:
698 			usage();
699 		};
700 	}
701         argc -= optind;
702         argv += optind;
703         if (argc == 0 || argc>=2) {
704 		usage();
705 	}
706 	configfile = argv[0];
707 
708 	/* read config file */
709 	options = nsd_options_create(region_create(xalloc, free));
710 	tsig_init(options->region);
711 	if (!parse_options_file(options, configfile, NULL, NULL) ||
712 	   !additional_checks(options, configfile)) {
713 		exit(2);
714 	}
715 	if (conf_opt || conf_key) {
716 		config_print_zone(options, conf_key, key_sec,
717 			underscore(conf_opt), conf_zone, conf_pat, final);
718 	} else {
719 		if (verbose) {
720 			printf("# Read file %s: %d patterns, %d fixed-zones, "
721 				"%d keys.\n",
722 				configfile,
723 				(int)options->patterns->count,
724 				(int)nsd_options_num_zones(options),
725 				(int)options->keys->count);
726 			config_test_print_server(options);
727 		}
728 	}
729 	return 0;
730 }
731