1 /*
2 * checkconf - Read and repeat configuration file to output.
3 *
4 * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5 *
6 * See LICENSE for the license.
7 *
8 */
9 #include "config.h"
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <unistd.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "tsig.h"
16 #include "options.h"
17 #include "util.h"
18 #include "dname.h"
19 #include "rrl.h"
20
21 extern char *optarg;
22 extern int optind;
23 static void usage(void) ATTR_NORETURN;
zonec_parse_string(region_type * ATTR_UNUSED (region),domain_table_type * ATTR_UNUSED (domains),zone_type * ATTR_UNUSED (zone),char * ATTR_UNUSED (str),domain_type ** ATTR_UNUSED (parsed),int * ATTR_UNUSED (num_rrs))24 int zonec_parse_string(region_type* ATTR_UNUSED(region),
25 domain_table_type* ATTR_UNUSED(domains), zone_type* ATTR_UNUSED(zone),
26 char* ATTR_UNUSED(str), domain_type** ATTR_UNUSED(parsed),
27 int* ATTR_UNUSED(num_rrs))
28 {
29 return 0;
30 }
31
32 #define ZONE_GET_ACL(NAME, VAR, PATTERN) \
33 if (strcasecmp(#NAME, (VAR)) == 0) { \
34 quote_acl(PATTERN->NAME); \
35 return; \
36 }
37
38 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN) \
39 if (strcasecmp(#NAME, (VAR)) == 0) { \
40 acl_options_type* acl; \
41 for(acl=PATTERN->NAME; acl; acl=acl->next) \
42 quote(acl->ip_address_spec); \
43 return; \
44 }
45
46 #define ZONE_GET_STR(NAME, VAR, PATTERN) \
47 if (strcasecmp(#NAME, (VAR)) == 0) { \
48 quote(PATTERN->NAME); \
49 return; \
50 }
51
52 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) \
53 if (strcasecmp(#NAME, (VAR)) == 0) { \
54 quotepath(opt, FINAL, PATTERN->NAME); \
55 return; \
56 }
57
58 #define ZONE_GET_BIN(NAME, VAR, PATTERN) \
59 if (strcasecmp(#NAME, (VAR)) == 0) { \
60 printf("%s\n", (PATTERN->NAME)?"yes":"no"); \
61 return; \
62 }
63
64 #define ZONE_GET_RRL(NAME, VAR, PATTERN) \
65 if (strcasecmp(#NAME, (VAR)) == 0) { \
66 zone_print_rrl_whitelist("", PATTERN->NAME); \
67 return; \
68 }
69
70 #define ZONE_GET_INT(NAME, VAR, PATTERN) \
71 if (strcasecmp(#NAME, (VAR)) == 0) { \
72 printf("%d\n", (int) PATTERN->NAME); \
73 return; \
74 }
75
76 #define SERV_GET_BIN(NAME, VAR) \
77 if (strcasecmp(#NAME, (VAR)) == 0) { \
78 printf("%s\n", opt->NAME?"yes":"no"); \
79 return; \
80 }
81
82 #define SERV_GET_STR(NAME, VAR) \
83 if (strcasecmp(#NAME, (VAR)) == 0) { \
84 quote(opt->NAME); \
85 return; \
86 }
87
88 #define SERV_GET_PATH(FINAL, NAME, VAR) \
89 if (strcasecmp(#NAME, (VAR)) == 0) { \
90 quotepath(opt, FINAL, opt->NAME); \
91 return; \
92 }
93
94 #define SERV_GET_INT(NAME, VAR) \
95 if (strcasecmp(#NAME, (VAR)) == 0) { \
96 printf("%d\n", (int) opt->NAME); \
97 return; \
98 }
99
100 #define SERV_GET_IP(NAME, MEMBER, VAR) \
101 if (strcasecmp(#NAME, (VAR)) == 0) { \
102 for(ip = opt->MEMBER; ip; ip=ip->next) \
103 { \
104 quote(ip->address); \
105 } \
106 return; \
107 }
108
109 #ifdef RATELIMIT
zone_print_rrl_whitelist(const char * s,uint16_t w)110 static void zone_print_rrl_whitelist(const char* s, uint16_t w)
111 {
112 int i;
113 if(w==rrl_type_all) {
114 printf("%sall\n", s);
115 return;
116 }
117 for(i=0x01; i <= 0x80; i<<=1) {
118 if( (w&i) )
119 printf("%s%s\n", s, rrltype2str(i));
120 }
121 }
122 #endif /* RATELIMIT */
123
124 static char buf[BUFSIZ];
125
126 static char *
underscore(const char * s)127 underscore(const char *s) {
128 const char *j = s;
129 size_t i = 0;
130
131 while(j && *j) {
132 if (*j == '-') {
133 buf[i++] = '_';
134 } else {
135 buf[i++] = *j;
136 }
137 j++;
138 if (i >= BUFSIZ) {
139 return NULL;
140 }
141 }
142 buf[i] = '\0';
143 return buf;
144 }
145
146 static void
usage(void)147 usage(void)
148 {
149 fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n");
150 fprintf(stderr, " [-s keyname] [-t tlsauthname] <configfilename>\n");
151 fprintf(stderr, " Checks NSD configuration file for errors.\n");
152 fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n",
153 PACKAGE_VERSION, PACKAGE_BUGREPORT);
154 fprintf(stderr, "Use with a configfile as argument to check syntax.\n");
155 fprintf(stderr, "Use with -o, -z, -t or -s options to query the configuration.\n\n");
156 fprintf(stderr, "-v Verbose, echo settings that take effect to std output.\n");
157 fprintf(stderr, "-h Print this help information.\n");
158 fprintf(stderr, "-f Use with -o to print final pathnames, ie. with chroot.\n");
159 fprintf(stderr, "-o option Print value of the option specified to stdout.\n");
160 fprintf(stderr, "-p pattern Print option value for the pattern given.\n");
161 fprintf(stderr, "-z zonename Print option value for the zone given.\n");
162 fprintf(stderr, "-a keyname Print algorithm name for the TSIG key.\n");
163 fprintf(stderr, "-s keyname Print base64 secret blob for the TSIG key.\n");
164 fprintf(stderr, "-t tls-auth-name Print auth domain name for the tls-auth clause.\n");
165 exit(1);
166 }
167
168 static void
print_string_var(const char * varname,const char * value)169 print_string_var(const char* varname, const char* value)
170 {
171 if (!value) {
172 printf("\t#%s\n", varname);
173 } else {
174 printf("\t%s \"%s\"\n", varname, value);
175 }
176 }
177
178 static void
quote(const char * v)179 quote(const char *v)
180 {
181 if(v==NULL)
182 printf("\n");
183 else
184 printf("%s\n", v);
185 }
186
187 static void
quotepath(nsd_options_type * opt,int final,const char * f)188 quotepath(nsd_options_type* opt, int final, const char *f)
189 {
190 const char* chr = opt->chroot;
191 #ifdef CHROOTDIR
192 if(chr == 0) chr = CHROOTDIR;
193 #endif
194 if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) {
195 quote(f);
196 return;
197 }
198 /* chroot has had trailing slash applied in check part of checkconf */
199 printf("%s%s\n", chr, f);
200 }
201
202 static void
quote_acl(acl_options_type * acl)203 quote_acl(acl_options_type* acl)
204 {
205 while(acl)
206 {
207 if (acl->tls_auth_name)
208 printf("%s %s %s\n", acl->ip_address_spec,
209 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
210 (acl->key_name?acl->key_name:"(null)")),
211 acl->tls_auth_name?acl->tls_auth_name:"");
212 else
213 printf("%s %s\n", acl->ip_address_spec,
214 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
215 (acl->key_name?acl->key_name:"(null)")));
216 acl=acl->next;
217 }
218 }
219
220 static void
print_acl(const char * varname,acl_options_type * acl)221 print_acl(const char* varname, acl_options_type* acl)
222 {
223 while(acl)
224 {
225 printf("\t%s ", varname);
226 if(acl->use_axfr_only)
227 printf("AXFR ");
228 if(acl->allow_udp)
229 printf("UDP ");
230 if (acl->tls_auth_name)
231 printf("%s %s %s\n", acl->ip_address_spec,
232 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
233 (acl->key_name?acl->key_name:"(null)")),
234 acl->tls_auth_name?acl->tls_auth_name:"");
235 else
236 printf("%s %s\n", acl->ip_address_spec,
237 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED":
238 (acl->key_name?acl->key_name:"(null)")));
239 if(verbosity>1) {
240 printf("\t# %s", acl->is_ipv6?"ip6":"ip4");
241 if(acl->port == 0) printf(" noport");
242 else printf(" port=%d", acl->port);
243 if(acl->rangetype == acl_range_single) printf(" single");
244 if(acl->rangetype == acl_range_mask) printf(" masked");
245 if(acl->rangetype == acl_range_subnet) printf(" subnet");
246 if(acl->rangetype == acl_range_minmax) printf(" minmax");
247 if(acl->is_ipv6) {
248 #ifdef INET6
249 char dest[128];
250 inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest));
251 printf(" addr=%s", dest);
252 if(acl->rangetype != acl_range_single) {
253 inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest));
254 printf(" rangemask=%s", dest);
255 }
256 #else
257 printf(" ip6addr-noip6defined");
258 #endif
259 } else {
260 char dest[128];
261 inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest));
262 printf(" addr=%s", dest);
263 if(acl->rangetype != acl_range_single) {
264 inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest));
265 printf(" rangemask=%s", dest);
266 }
267 }
268 printf("\n");
269 }
270 acl=acl->next;
271 }
272 }
273
274 static void
print_acl_ips(const char * varname,acl_options_type * acl)275 print_acl_ips(const char* varname, acl_options_type* acl)
276 {
277 while(acl)
278 {
279 printf("\t%s %s\n", varname, acl->ip_address_spec);
280 acl=acl->next;
281 }
282 }
283
284 void
config_print_zone(nsd_options_type * opt,const char * k,int s,const char * o,const char * z,const char * pat,const char * tls,int final)285 config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o,
286 const char *z, const char* pat, const char* tls, int final)
287 {
288 ip_address_option_type* ip;
289
290 if (k) {
291 /* find key */
292 key_options_type* key = key_options_find(opt, k);
293 if(key) {
294 if (s) {
295 quote(key->secret);
296 } else {
297 quote(key->algorithm);
298 }
299 return;
300 }
301 printf("Could not find key %s\n", k);
302 return;
303 }
304
305 if (tls) {
306 /* find tlsauth */
307 tls_auth_options_type* tlsauth = tls_auth_options_find(opt, tls);
308 if(tlsauth) {
309 quote(tlsauth->auth_domain_name);
310 return;
311 }
312 printf("Could not find tls-auth %s\n", tls);
313 return;
314 }
315
316 if (!o) {
317 return;
318 }
319
320 if (z) {
321 zone_options_type* zone;
322 const dname_type *dname = dname_parse(opt->region, z);
323 if(!dname) {
324 printf("Could not parse zone name %s\n", z);
325 exit(1);
326 }
327 zone = zone_options_find(opt, dname);
328 if(!zone) {
329 printf("Zone does not exist: %s\n", z);
330 exit(1);
331 }
332 ZONE_GET_STR(name, o, zone);
333 if(strcasecmp("pattern", o)==0) {
334 quote(zone->pattern->pname);
335 return;
336 }
337 ZONE_GET_BIN(part_of_config, o, zone);
338 ZONE_GET_PATH(final, zonefile, o, zone->pattern);
339 ZONE_GET_ACL(allow_query, o, zone->pattern);
340 ZONE_GET_ACL(request_xfr, o, zone->pattern);
341 ZONE_GET_ACL(provide_xfr, o, zone->pattern);
342 ZONE_GET_ACL(allow_notify, o, zone->pattern);
343 ZONE_GET_ACL(notify, o, zone->pattern);
344 ZONE_GET_BIN(notify_retry, o, zone->pattern);
345 ZONE_GET_STR(zonestats, o, zone->pattern);
346 ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern);
347 ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern);
348 ZONE_GET_INT(max_refresh_time, o, zone->pattern);
349 ZONE_GET_INT(min_refresh_time, o, zone->pattern);
350 ZONE_GET_INT(max_retry_time, o, zone->pattern);
351 ZONE_GET_INT(min_retry_time, o, zone->pattern);
352 ZONE_GET_INT(min_expire_time, o, zone->pattern);
353 ZONE_GET_INT(size_limit_xfr, o, zone->pattern);
354 #ifdef RATELIMIT
355 ZONE_GET_RRL(rrl_whitelist, o, zone->pattern);
356 #endif
357 ZONE_GET_BIN(multi_master_check, o, zone->pattern);
358 ZONE_GET_BIN(store_ixfr, o, zone->pattern);
359 ZONE_GET_INT(ixfr_size, o, zone->pattern);
360 ZONE_GET_INT(ixfr_number, o, zone->pattern);
361 ZONE_GET_BIN(create_ixfr, o, zone->pattern);
362 printf("Zone option not handled: %s %s\n", z, o);
363 exit(1);
364 } else if(pat) {
365 pattern_options_type* p = pattern_options_find(opt, pat);
366 if(!p) {
367 printf("Pattern does not exist: %s\n", pat);
368 exit(1);
369 }
370 if(strcasecmp("name", o)==0) {
371 quote(p->pname);
372 return;
373 }
374 ZONE_GET_STR(zonefile, o, p);
375 ZONE_GET_PATH(final, zonefile, o, p);
376 ZONE_GET_ACL(allow_query, o, p);
377 ZONE_GET_ACL(request_xfr, o, p);
378 ZONE_GET_ACL(provide_xfr, o, p);
379 ZONE_GET_ACL(allow_notify, o, p);
380 ZONE_GET_ACL(notify, o, p);
381 ZONE_GET_BIN(notify_retry, o, p);
382 ZONE_GET_STR(zonestats, o, p);
383 ZONE_GET_OUTGOING(outgoing_interface, o, p);
384 ZONE_GET_BIN(allow_axfr_fallback, o, p);
385 ZONE_GET_INT(max_refresh_time, o, p);
386 ZONE_GET_INT(min_refresh_time, o, p);
387 ZONE_GET_INT(max_retry_time, o, p);
388 ZONE_GET_INT(min_retry_time, o, p);
389 ZONE_GET_INT(min_expire_time, o, p);
390 ZONE_GET_INT(size_limit_xfr, o, p);
391 #ifdef RATELIMIT
392 ZONE_GET_RRL(rrl_whitelist, o, p);
393 #endif
394 ZONE_GET_BIN(multi_master_check, o, p);
395 ZONE_GET_BIN(store_ixfr, o, p);
396 ZONE_GET_INT(ixfr_size, o, p);
397 ZONE_GET_INT(ixfr_number, o, p);
398 ZONE_GET_BIN(create_ixfr, o, p);
399 printf("Pattern option not handled: %s %s\n", pat, o);
400 exit(1);
401 } else {
402 /* look in the server section */
403 SERV_GET_IP(ip_address, ip_addresses, o);
404 /* bin */
405 SERV_GET_BIN(ip_transparent, o);
406 SERV_GET_BIN(ip_freebind, o);
407 SERV_GET_BIN(debug_mode, o);
408 SERV_GET_BIN(do_ip4, o);
409 SERV_GET_BIN(do_ip6, o);
410 SERV_GET_BIN(reuseport, o);
411 SERV_GET_BIN(hide_version, o);
412 SERV_GET_BIN(hide_identity, o);
413 SERV_GET_BIN(drop_updates, o);
414 SERV_GET_BIN(zonefiles_check, o);
415 SERV_GET_BIN(log_time_ascii, o);
416 SERV_GET_BIN(round_robin, o);
417 SERV_GET_BIN(minimal_responses, o);
418 SERV_GET_BIN(confine_to_zone, o);
419 SERV_GET_BIN(refuse_any, o);
420 SERV_GET_BIN(tcp_reject_overflow, o);
421 SERV_GET_BIN(log_only_syslog, o);
422 /* str */
423 SERV_GET_STR(identity, o);
424 SERV_GET_STR(version, o);
425 SERV_GET_STR(nsid, o);
426 SERV_GET_PATH(final, logfile, o);
427 SERV_GET_PATH(final, pidfile, o);
428 SERV_GET_STR(chroot, o);
429 SERV_GET_STR(username, o);
430 SERV_GET_PATH(final, zonesdir, o);
431 SERV_GET_PATH(final, xfrdfile, o);
432 SERV_GET_PATH(final, xfrdir, o);
433 SERV_GET_PATH(final, zonelistfile, o);
434 SERV_GET_STR(port, o);
435 SERV_GET_STR(tls_service_key, o);
436 SERV_GET_STR(tls_service_ocsp, o);
437 SERV_GET_STR(tls_service_pem, o);
438 SERV_GET_STR(tls_port, o);
439 SERV_GET_STR(tls_cert_bundle, o);
440 SERV_GET_STR(cookie_secret, o);
441 SERV_GET_STR(cookie_secret_file, o);
442 SERV_GET_BIN(answer_cookie, o);
443 /* int */
444 SERV_GET_INT(server_count, o);
445 SERV_GET_INT(tcp_count, o);
446 SERV_GET_INT(tcp_query_count, o);
447 SERV_GET_INT(tcp_timeout, o);
448 SERV_GET_INT(tcp_mss, o);
449 SERV_GET_INT(outgoing_tcp_mss, o);
450 SERV_GET_INT(xfrd_tcp_max, o);
451 SERV_GET_INT(xfrd_tcp_pipeline, o);
452 SERV_GET_INT(ipv4_edns_size, o);
453 SERV_GET_INT(ipv6_edns_size, o);
454 SERV_GET_INT(statistics, o);
455 SERV_GET_INT(xfrd_reload_timeout, o);
456 SERV_GET_INT(verbosity, o);
457 SERV_GET_INT(send_buffer_size, o);
458 SERV_GET_INT(receive_buffer_size, o);
459 #ifdef RATELIMIT
460 SERV_GET_INT(rrl_size, o);
461 SERV_GET_INT(rrl_ratelimit, o);
462 SERV_GET_INT(rrl_slip, o);
463 SERV_GET_INT(rrl_ipv4_prefix_length, o);
464 SERV_GET_INT(rrl_ipv6_prefix_length, o);
465 SERV_GET_INT(rrl_whitelist_ratelimit, o);
466 #endif
467 #ifdef USE_DNSTAP
468 SERV_GET_BIN(dnstap_enable, o);
469 SERV_GET_STR(dnstap_socket_path, o);
470 SERV_GET_STR(dnstap_ip, o);
471 SERV_GET_BIN(dnstap_tls, o);
472 SERV_GET_STR(dnstap_tls_server_name, o);
473 SERV_GET_STR(dnstap_tls_cert_bundle, o);
474 SERV_GET_STR(dnstap_tls_client_key_file, o);
475 SERV_GET_STR(dnstap_tls_client_cert_file, o);
476 SERV_GET_BIN(dnstap_send_identity, o);
477 SERV_GET_BIN(dnstap_send_version, o);
478 SERV_GET_STR(dnstap_identity, o);
479 SERV_GET_STR(dnstap_version, o);
480 SERV_GET_BIN(dnstap_log_auth_query_messages, o);
481 SERV_GET_BIN(dnstap_log_auth_response_messages, o);
482 #endif
483 SERV_GET_INT(zonefiles_write, o);
484 /* remote control */
485 SERV_GET_BIN(control_enable, o);
486 SERV_GET_IP(control_interface, control_interface, o);
487 SERV_GET_INT(control_port, o);
488 SERV_GET_STR(server_key_file, o);
489 SERV_GET_STR(server_cert_file, o);
490 SERV_GET_STR(control_key_file, o);
491 SERV_GET_STR(control_cert_file, o);
492
493 if(strcasecmp(o, "zones") == 0) {
494 zone_options_type* zone;
495 RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
496 quote(zone->name);
497 return;
498 }
499 if(strcasecmp(o, "patterns") == 0) {
500 pattern_options_type* p;
501 RBTREE_FOR(p, pattern_options_type*, opt->patterns)
502 quote(p->pname);
503 return;
504 }
505 if(strcasecmp(o, "proxy_protocol_port") == 0) {
506 struct proxy_protocol_port_list* p;
507 for(p = opt->proxy_protocol_port; p; p = p->next)
508 printf("%d\n", p->port);
509 return;
510 }
511 printf("Server option not handled: %s\n", o);
512 exit(1);
513 }
514 }
515
516 /* print zone content items */
print_zone_content_elems(pattern_options_type * pat)517 static void print_zone_content_elems(pattern_options_type* pat)
518 {
519 if(pat->zonefile)
520 print_string_var("zonefile:", pat->zonefile);
521 #ifdef RATELIMIT
522 zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist);
523 #endif
524 print_acl("allow_query:", pat->allow_query);
525 print_acl("allow-notify:", pat->allow_notify);
526 print_acl("request-xfr:", pat->request_xfr);
527 if(pat->multi_master_check)
528 printf("\tmulti-master-check: %s\n", pat->multi_master_check?"yes":"no");
529 if(!pat->notify_retry_is_default)
530 printf("\tnotify-retry: %d\n", pat->notify_retry);
531 print_acl("notify:", pat->notify);
532 print_acl("provide-xfr:", pat->provide_xfr);
533 if(pat->zonestats)
534 print_string_var("zonestats:", pat->zonestats);
535 print_acl_ips("outgoing-interface:", pat->outgoing_interface);
536 if(!pat->allow_axfr_fallback_is_default)
537 printf("\tallow-axfr-fallback: %s\n",
538 pat->allow_axfr_fallback?"yes":"no");
539 if(!pat->max_refresh_time_is_default)
540 printf("\tmax-refresh-time: %d\n", pat->max_refresh_time);
541 if(!pat->min_refresh_time_is_default)
542 printf("\tmin-refresh-time: %d\n", pat->min_refresh_time);
543 if(!pat->max_retry_time_is_default)
544 printf("\tmax-retry-time: %d\n", pat->max_retry_time);
545 if(!pat->min_retry_time_is_default)
546 printf("\tmin-retry-time: %d\n", pat->min_retry_time);
547 if(pat->min_expire_time_expr == REFRESHPLUSRETRYPLUS1)
548 printf("\tmin-expire-time: " REFRESHPLUSRETRYPLUS1_STR "\n");
549 else if(pat->min_expire_time_expr == EXPIRE_TIME_HAS_VALUE)
550 printf("\tmin-expire-time: %d\n", pat->min_expire_time);
551 if(pat->size_limit_xfr != 0)
552 printf("\tsize-limit-xfr: %llu\n",
553 (long long unsigned)pat->size_limit_xfr);
554 if(!pat->store_ixfr_is_default)
555 printf("\tstore-ixfr: %s\n", pat->store_ixfr?"yes":"no");
556 if(!pat->ixfr_number_is_default)
557 printf("\tixfr-number: %u\n", (unsigned)pat->ixfr_number);
558 if(!pat->ixfr_size_is_default)
559 printf("\tixfr-size: %u\n", (unsigned)pat->ixfr_size);
560 if(!pat->create_ixfr_is_default)
561 printf("\tcreate-ixfr: %s\n", pat->create_ixfr?"yes":"no");
562 if(pat->verify_zone != VERIFY_ZONE_INHERIT) {
563 printf("\tverify-zone: ");
564 if(pat->verify_zone) {
565 printf("yes\n");
566 } else {
567 printf("no\n");
568 }
569 }
570 if(pat->verifier) {
571 printf("\tverifier:");
572 for(char *const *s = pat->verifier; *s; s++) {
573 printf(" \"%s\"", *s);
574 }
575 printf("\n");
576 }
577 if(pat->verifier_feed_zone != VERIFIER_FEED_ZONE_INHERIT) {
578 printf("\tverifier-feed-zone: ");
579 if(pat->verifier_feed_zone) {
580 printf("yes\n");
581 } else {
582 printf("no\n");
583 }
584 }
585 if(pat->verifier_timeout != VERIFIER_TIMEOUT_INHERIT) {
586 printf("\tverifier-timeout: %d\n", pat->verifier_timeout);
587 }
588 }
589
590 void
config_test_print_server(nsd_options_type * opt)591 config_test_print_server(nsd_options_type* opt)
592 {
593 ip_address_option_type* ip;
594 key_options_type* key;
595 tls_auth_options_type* tlsauth;
596 zone_options_type* zone;
597 pattern_options_type* pat;
598
599 printf("# Config settings.\n");
600 printf("server:\n");
601 printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no");
602 printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no");
603 printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no");
604 printf("\treuseport: %s\n", opt->reuseport?"yes":"no");
605 printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no");
606 printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no");
607 printf("\tsend-buffer-size: %d\n", opt->send_buffer_size);
608 printf("\treceive-buffer-size: %d\n", opt->receive_buffer_size);
609 printf("\thide-version: %s\n", opt->hide_version?"yes":"no");
610 printf("\thide-identity: %s\n", opt->hide_identity?"yes":"no");
611 printf("\tdrop-updates: %s\n", opt->drop_updates?"yes":"no");
612 printf("\ttcp-reject-overflow: %s\n",
613 opt->tcp_reject_overflow ? "yes" : "no");
614 print_string_var("identity:", opt->identity);
615 print_string_var("version:", opt->version);
616 print_string_var("nsid:", opt->nsid);
617 print_string_var("logfile:", opt->logfile);
618 printf("\tlog-only-syslog: %s\n", opt->log_only_syslog?"yes":"no");
619 printf("\tserver-count: %d\n", opt->server_count);
620 if(opt->cpu_affinity) {
621 cpu_option_type *n;
622 printf("\tcpu-affinity:");
623 for(n = opt->cpu_affinity; n; n = n->next) {
624 printf(" %d", n->cpu);
625 }
626 printf("\n");
627 }
628 if(opt->cpu_affinity && opt->service_cpu_affinity) {
629 cpu_map_option_type *n;
630 for(n = opt->service_cpu_affinity; n; n = n->next) {
631 if(n->service > 0) {
632 printf("\tserver-%d-cpu-affinity: %d\n",
633 n->service, n->cpu);
634 } else if(n->service == -1) {
635 printf("\txfrd-cpu-affinity: %d\n",
636 n->cpu);
637 }
638 }
639 }
640 printf("\ttcp-count: %d\n", opt->tcp_count);
641 printf("\ttcp-query-count: %d\n", opt->tcp_query_count);
642 printf("\ttcp-timeout: %d\n", opt->tcp_timeout);
643 printf("\ttcp-mss: %d\n", opt->tcp_mss);
644 printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss);
645 printf("\txfrd-tcp-max: %d\n", opt->xfrd_tcp_max);
646 printf("\txfrd-tcp-pipeline: %d\n", opt->xfrd_tcp_pipeline);
647 printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size);
648 printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size);
649 print_string_var("pidfile:", opt->pidfile);
650 print_string_var("port:", opt->port);
651 printf("\tstatistics: %d\n", opt->statistics);
652 print_string_var("chroot:", opt->chroot);
653 print_string_var("username:", opt->username);
654 print_string_var("zonesdir:", opt->zonesdir);
655 print_string_var("xfrdfile:", opt->xfrdfile);
656 print_string_var("zonelistfile:", opt->zonelistfile);
657 print_string_var("xfrdir:", opt->xfrdir);
658 printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout);
659 printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no");
660 printf("\tround-robin: %s\n", opt->round_robin?"yes":"no");
661 printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no");
662 printf("\tconfine-to-zone: %s\n",
663 opt->confine_to_zone ? "yes" : "no");
664 printf("\trefuse-any: %s\n", opt->refuse_any?"yes":"no");
665 printf("\tverbosity: %d\n", opt->verbosity);
666 for(ip = opt->ip_addresses; ip; ip=ip->next)
667 {
668 printf("\tip-address: %s", ip->address);
669 if(ip->servers) {
670 const char *sep;
671 struct range_option *n;
672 printf(" servers=\"");
673 for(n=ip->servers, sep=""; n; n = n->next, sep=" ") {
674 if(n->first == n->last) {
675 printf("%s%d", sep, n->first);
676 } else {
677 printf("%s%d-%d", sep, n->first, n->last);
678 }
679 }
680 printf("\"");
681 }
682 if(ip->fib != -1) {
683 printf(" setfib=%d", ip->fib);
684 }
685 printf("\n");
686 }
687 #ifdef RATELIMIT
688 printf("\trrl-size: %d\n", (int)opt->rrl_size);
689 printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit);
690 printf("\trrl-slip: %d\n", (int)opt->rrl_slip);
691 printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length);
692 printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length);
693 printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit);
694 #endif
695 printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no");
696 printf("\tzonefiles-write: %d\n", opt->zonefiles_write);
697 print_string_var("tls-service-key:", opt->tls_service_key);
698 print_string_var("tls-service-pem:", opt->tls_service_pem);
699 print_string_var("tls-service-ocsp:", opt->tls_service_ocsp);
700 print_string_var("tls-port:", opt->tls_port);
701 print_string_var("tls-cert-bundle:", opt->tls_cert_bundle);
702 printf("\tanswer-cookie: %s\n", opt->answer_cookie?"yes":"no");
703 if (opt->cookie_secret)
704 print_string_var("cookie-secret:", opt->cookie_secret);
705 if (opt->cookie_secret_file)
706 print_string_var("cookie-secret-file:", opt->cookie_secret_file);
707 if(opt->proxy_protocol_port) {
708 struct proxy_protocol_port_list* p;
709 for(p = opt->proxy_protocol_port; p; p = p->next)
710 printf("\tproxy-protocol-port: %d\n", p->port);
711 }
712
713 #ifdef USE_DNSTAP
714 printf("\ndnstap:\n");
715 printf("\tdnstap-enable: %s\n", opt->dnstap_enable?"yes":"no");
716 print_string_var("dnstap-socket-path:", opt->dnstap_socket_path);
717 print_string_var("dnstap-ip:", opt->dnstap_ip);
718 printf("\tdnstap-tls: %s\n", opt->dnstap_tls?"yes":"no");
719 print_string_var("dnstap-tls-server-name:", opt->dnstap_tls_server_name);
720 print_string_var("dnstap-tls-cert-bundle:", opt->dnstap_tls_cert_bundle);
721 print_string_var("dnstap-tls-client-key-file:", opt->dnstap_tls_client_key_file);
722 print_string_var("dnstap-tls-client-cert-file:", opt->dnstap_tls_client_cert_file);
723 printf("\tdnstap-send-identity: %s\n", opt->dnstap_send_identity?"yes":"no");
724 printf("\tdnstap-send-version: %s\n", opt->dnstap_send_version?"yes":"no");
725 print_string_var("dnstap-identity:", opt->dnstap_identity);
726 print_string_var("dnstap-version:", opt->dnstap_version);
727 printf("\tdnstap-log-auth-query-messages: %s\n", opt->dnstap_log_auth_query_messages?"yes":"no");
728 printf("\tdnstap-log-auth-response-messages: %s\n", opt->dnstap_log_auth_response_messages?"yes":"no");
729 #endif
730
731 printf("\nremote-control:\n");
732 printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no");
733 for(ip = opt->control_interface; ip; ip=ip->next)
734 print_string_var("control-interface:", ip->address);
735 printf("\tcontrol-port: %d\n", opt->control_port);
736 print_string_var("server-key-file:", opt->server_key_file);
737 print_string_var("server-cert-file:", opt->server_cert_file);
738 print_string_var("control-key-file:", opt->control_key_file);
739 print_string_var("control-cert-file:", opt->control_cert_file);
740
741 printf("\nverify:\n");
742 printf("\tenable: %s\n", opt->verify_enable?"yes":"no");
743 for(ip = opt->verify_ip_addresses; ip; ip=ip->next) {
744 print_string_var("ip-address:", ip->address);
745 }
746 printf("\tport: %s\n", opt->verify_port);
747 printf("\tverify-zones: %s\n", opt->verify_zones?"yes":"no");
748 if(opt->verifier) {
749 printf("\tverifier:");
750 for(char **s = opt->verifier; *s; s++) {
751 printf(" \"%s\"", *s);
752 }
753 printf("\n");
754 }
755 printf("\tverifier-count: %d\n", opt->verifier_count);
756 printf("\tverifier-feed-zone: %s\n", opt->verifier_feed_zone?"yes":"no");
757 printf("\tverifier-timeout: %d\n", opt->verifier_timeout);
758
759 RBTREE_FOR(key, key_options_type*, opt->keys)
760 {
761 printf("\nkey:\n");
762 print_string_var("name:", key->name);
763 print_string_var("algorithm:", key->algorithm);
764 print_string_var("secret:", key->secret);
765 }
766 RBTREE_FOR(tlsauth, tls_auth_options_type*, opt->tls_auths)
767 {
768 printf("\ntls-auth:\n");
769 print_string_var("name:", tlsauth->name);
770 print_string_var("auth-domain-name:", tlsauth->auth_domain_name);
771 }
772 RBTREE_FOR(pat, pattern_options_type*, opt->patterns)
773 {
774 if(pat->implicit) continue;
775 printf("\npattern:\n");
776 print_string_var("name:", pat->pname);
777 print_zone_content_elems(pat);
778 }
779 RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
780 {
781 if(!zone->part_of_config)
782 continue;
783 printf("\nzone:\n");
784 print_string_var("name:", zone->name);
785 print_zone_content_elems(zone->pattern);
786 }
787 }
788
789 static int
additional_checks(nsd_options_type * opt,const char * filename)790 additional_checks(nsd_options_type* opt, const char* filename)
791 {
792 zone_options_type* zone;
793 int errors = 0;
794
795 RBTREE_FOR(zone, zone_options_type*, opt->zone_options)
796 {
797 const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */
798 if(!dname) {
799 fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name);
800 errors ++;
801 continue;
802 }
803 if(zone->pattern->allow_notify && !zone->pattern->request_xfr) {
804 fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr"
805 " items. Where can it get a zone transfer when a notify "
806 "is received?\n", filename, zone->name);
807 errors ++;
808 }
809 if(!zone_is_slave(zone) && (!zone->pattern->zonefile ||
810 zone->pattern->zonefile[0] == 0)) {
811 fprintf(stderr, "%s: zone %s is a master zone but has "
812 "no zonefile. Where can the data come from?\n",
813 filename, zone->name);
814 errors ++;
815 }
816 }
817
818 #ifndef BIND8_STATS
819 if(opt->statistics > 0)
820 {
821 fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n",
822 filename, opt->statistics);
823 errors ++;
824 }
825 #endif
826 #ifndef HAVE_CHROOT
827 if(opt->chroot != 0)
828 {
829 fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n",
830 filename, opt->chroot);
831 errors ++;
832 }
833 #endif
834 if (opt->identity && strlen(opt->identity) > UCHAR_MAX) {
835 fprintf(stderr, "%s: server identity too long (%u characters)\n",
836 filename, (unsigned) strlen(opt->identity));
837 errors ++;
838 }
839 if (opt->version && strlen(opt->version) > UCHAR_MAX) {
840 fprintf(stderr, "%s: server version too long (%u characters)\n",
841 filename, (unsigned) strlen(opt->version));
842 errors ++;
843 }
844
845 /* not done here: parsing of ip-address. parsing of username. */
846
847 if (opt->chroot && opt->chroot[0]) {
848 /* append trailing slash for strncmp checking */
849 append_trailing_slash(&opt->chroot, opt->region);
850 append_trailing_slash(&opt->xfrdir, opt->region);
851 append_trailing_slash(&opt->zonesdir, opt->region);
852
853 /* zonesdir must be absolute and within chroot,
854 * all other pathnames may be relative to zonesdir */
855 if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) {
856 fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n",
857 filename, opt->zonesdir, opt->chroot);
858 errors ++;
859 }
860 if (!file_inside_chroot(opt->pidfile, opt->chroot)) {
861 fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n",
862 filename, opt->pidfile, opt->chroot);
863 errors ++;
864 }
865 if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) {
866 fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n",
867 filename, opt->xfrdfile, opt->chroot);
868 errors ++;
869 }
870 if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) {
871 fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n",
872 filename, opt->zonelistfile, opt->chroot);
873 errors ++;
874 }
875 if (!file_inside_chroot(opt->xfrdir, opt->chroot)) {
876 fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n",
877 filename, opt->xfrdir, opt->chroot);
878 errors ++;
879 }
880 }
881
882 if (atoi(opt->port) <= 0) {
883 fprintf(stderr, "%s: port number '%s' is not a positive number.\n",
884 filename, opt->port);
885 errors ++;
886 }
887 if(errors != 0) {
888 fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys, %d tls-auth.\n",
889 filename, errors, (int)nsd_options_num_zones(opt),
890 (int)opt->keys->count,
891 (int)opt->tls_auths->count);
892 }
893
894 return (errors == 0);
895 }
896
897 int
main(int argc,char * argv[])898 main(int argc, char* argv[])
899 {
900 int c;
901 int verbose = 0;
902 int key_sec = 0;
903 int final = 0;
904 const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */
905 const char * conf_zone = NULL; /* what zone are we talking about */
906 const char * conf_key = NULL; /* what key is needed */
907 const char * conf_tlsauth = NULL; /* what tls-auth is needed */
908 const char * conf_pat = NULL; /* what pattern is talked about */
909 const char* configfile;
910 nsd_options_type *options;
911
912 log_init("nsd-checkconf");
913
914 /* Parse the command line... */
915 while ((c = getopt(argc, argv, "vfho:a:p:s:z:t:")) != -1) {
916 switch (c) {
917 case 'v':
918 verbose = 1;
919 verbosity++;
920 break;
921 case 'o':
922 conf_opt = optarg;
923 break;
924 case 'f':
925 final = 1;
926 break;
927 case 'p':
928 conf_pat = optarg;
929 break;
930 case 'a':
931 if (conf_key) {
932 fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n");
933 exit(1);
934 }
935 conf_key = optarg;
936 break;
937 case 's':
938 if (conf_key) {
939 fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n");
940 exit(1);
941 }
942 conf_key = optarg;
943 key_sec = 1;
944 break;
945 case 't':
946 conf_tlsauth = optarg;
947 break;
948 case 'z':
949 conf_zone = optarg;
950 break;
951 case 'h':
952 default:
953 usage();
954 };
955 }
956 argc -= optind;
957 argv += optind;
958 if (argc == 0 || argc>=2) {
959 usage();
960 }
961 configfile = argv[0];
962
963 /* read config file */
964 options = nsd_options_create(region_create(xalloc, free));
965 tsig_init(options->region);
966 if (!parse_options_file(options, configfile, NULL, NULL) ||
967 !additional_checks(options, configfile)) {
968 exit(2);
969 }
970 if (conf_opt || conf_key || conf_tlsauth) {
971 config_print_zone(options, conf_key, key_sec,
972 underscore(conf_opt), conf_zone, conf_pat, conf_tlsauth, final);
973 } else {
974 if (verbose) {
975 printf("# Read file %s: %d patterns, %d fixed-zones, "
976 "%d keys, %d tls-auth.\n",
977 configfile,
978 (int)options->patterns->count,
979 (int)nsd_options_num_zones(options),
980 (int)options->keys->count,
981 (int)options->tls_auths->count);
982 config_test_print_server(options);
983 }
984 }
985 return 0;
986 }
987