1 /* 2 * checkconf - Read and repeat configuration file to output. 3 * 4 * Copyright (c) 2001-2006, NLnet Labs. All rights reserved. 5 * 6 * See LICENSE for the license. 7 * 8 */ 9 #include "config.h" 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <unistd.h> 13 #include <string.h> 14 #include <limits.h> 15 #include "tsig.h" 16 #include "options.h" 17 #include "util.h" 18 #include "dname.h" 19 #include "rrl.h" 20 21 extern char *optarg; 22 extern int optind; 23 static void usage(void) ATTR_NORETURN; 24 int zonec_parse_string(region_type* ATTR_UNUSED(region), 25 domain_table_type* ATTR_UNUSED(domains), zone_type* ATTR_UNUSED(zone), 26 char* ATTR_UNUSED(str), domain_type** ATTR_UNUSED(parsed), 27 int* ATTR_UNUSED(num_rrs)) 28 { 29 return 0; 30 } 31 32 #define ZONE_GET_ACL(NAME, VAR, PATTERN) \ 33 if (strcasecmp(#NAME, (VAR)) == 0) { \ 34 quote_acl(PATTERN->NAME); \ 35 return; \ 36 } 37 38 #define ZONE_GET_OUTGOING(NAME, VAR, PATTERN) \ 39 if (strcasecmp(#NAME, (VAR)) == 0) { \ 40 acl_options_type* acl; \ 41 for(acl=PATTERN->NAME; acl; acl=acl->next) \ 42 quote(acl->ip_address_spec); \ 43 return; \ 44 } 45 46 #define ZONE_GET_STR(NAME, VAR, PATTERN) \ 47 if (strcasecmp(#NAME, (VAR)) == 0) { \ 48 quote(PATTERN->NAME); \ 49 return; \ 50 } 51 52 #define ZONE_GET_PATH(FINAL, NAME, VAR, PATTERN) \ 53 if (strcasecmp(#NAME, (VAR)) == 0) { \ 54 quotepath(opt, FINAL, PATTERN->NAME); \ 55 return; \ 56 } 57 58 #define ZONE_GET_BIN(NAME, VAR, PATTERN) \ 59 if (strcasecmp(#NAME, (VAR)) == 0) { \ 60 printf("%s\n", (PATTERN->NAME)?"yes":"no"); \ 61 return; \ 62 } 63 64 #define ZONE_GET_RRL(NAME, VAR, PATTERN) \ 65 if (strcasecmp(#NAME, (VAR)) == 0) { \ 66 zone_print_rrl_whitelist("", PATTERN->NAME); \ 67 return; \ 68 } 69 70 #define ZONE_GET_INT(NAME, VAR, PATTERN) \ 71 if (strcasecmp(#NAME, (VAR)) == 0) { \ 72 printf("%d\n", (int) PATTERN->NAME); \ 73 return; \ 74 } 75 76 #define SERV_GET_BIN(NAME, VAR) \ 77 if (strcasecmp(#NAME, (VAR)) == 0) { \ 78 printf("%s\n", opt->NAME?"yes":"no"); \ 79 return; \ 80 } 81 82 #define SERV_GET_STR(NAME, VAR) \ 83 if (strcasecmp(#NAME, (VAR)) == 0) { \ 84 quote(opt->NAME); \ 85 return; \ 86 } 87 88 #define SERV_GET_PATH(FINAL, NAME, VAR) \ 89 if (strcasecmp(#NAME, (VAR)) == 0) { \ 90 quotepath(opt, FINAL, opt->NAME); \ 91 return; \ 92 } 93 94 #define SERV_GET_INT(NAME, VAR) \ 95 if (strcasecmp(#NAME, (VAR)) == 0) { \ 96 printf("%d\n", (int) opt->NAME); \ 97 return; \ 98 } 99 100 #define SERV_GET_IP(NAME, MEMBER, VAR) \ 101 if (strcasecmp(#NAME, (VAR)) == 0) { \ 102 for(ip = opt->MEMBER; ip; ip=ip->next) \ 103 { \ 104 quote(ip->address); \ 105 } \ 106 return; \ 107 } 108 109 #ifdef RATELIMIT 110 static void zone_print_rrl_whitelist(const char* s, uint16_t w) 111 { 112 int i; 113 if(w==rrl_type_all) { 114 printf("%sall\n", s); 115 return; 116 } 117 for(i=0x01; i <= 0x80; i<<=1) { 118 if( (w&i) ) 119 printf("%s%s\n", s, rrltype2str(i)); 120 } 121 } 122 #endif /* RATELIMIT */ 123 124 static char buf[BUFSIZ]; 125 126 static char * 127 underscore(const char *s) { 128 const char *j = s; 129 size_t i = 0; 130 131 while(j && *j) { 132 if (*j == '-') { 133 buf[i++] = '_'; 134 } else { 135 buf[i++] = *j; 136 } 137 j++; 138 if (i >= BUFSIZ) { 139 return NULL; 140 } 141 } 142 buf[i] = '\0'; 143 return buf; 144 } 145 146 static void 147 usage(void) 148 { 149 fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n"); 150 fprintf(stderr, " [-s keyname] [-t tlsauthname] <configfilename>\n"); 151 fprintf(stderr, " Checks NSD configuration file for errors.\n"); 152 fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n", 153 PACKAGE_VERSION, PACKAGE_BUGREPORT); 154 fprintf(stderr, "Use with a configfile as argument to check syntax.\n"); 155 fprintf(stderr, "Use with -o, -z, -t or -s options to query the configuration.\n\n"); 156 fprintf(stderr, "-v Verbose, echo settings that take effect to std output.\n"); 157 fprintf(stderr, "-h Print this help information.\n"); 158 fprintf(stderr, "-f Use with -o to print final pathnames, ie. with chroot.\n"); 159 fprintf(stderr, "-o option Print value of the option specified to stdout.\n"); 160 fprintf(stderr, "-p pattern Print option value for the pattern given.\n"); 161 fprintf(stderr, "-z zonename Print option value for the zone given.\n"); 162 fprintf(stderr, "-a keyname Print algorithm name for the TSIG key.\n"); 163 fprintf(stderr, "-s keyname Print base64 secret blob for the TSIG key.\n"); 164 fprintf(stderr, "-t tls-auth-name Print auth domain name for the tls-auth clause.\n"); 165 exit(1); 166 } 167 168 static void 169 print_string_var(const char* varname, const char* value) 170 { 171 if (!value) { 172 printf("\t#%s\n", varname); 173 } else { 174 printf("\t%s \"%s\"\n", varname, value); 175 } 176 } 177 178 static void 179 quote(const char *v) 180 { 181 if(v==NULL) 182 printf("\n"); 183 else 184 printf("%s\n", v); 185 } 186 187 static void 188 quotepath(nsd_options_type* opt, int final, const char *f) 189 { 190 const char* chr = opt->chroot; 191 #ifdef CHROOTDIR 192 if(chr == 0) chr = CHROOTDIR; 193 #endif 194 if(f == 0 || f[0] == '/' || !final || !chr || chr[0]==0) { 195 quote(f); 196 return; 197 } 198 /* chroot has had trailing slash applied in check part of checkconf */ 199 printf("%s%s\n", chr, f); 200 } 201 202 static void 203 quote_acl(acl_options_type* acl) 204 { 205 while(acl) 206 { 207 if (acl->tls_auth_name) 208 printf("%s %s %s\n", acl->ip_address_spec, 209 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 210 (acl->key_name?acl->key_name:"(null)")), 211 acl->tls_auth_name?acl->tls_auth_name:""); 212 else 213 printf("%s %s\n", acl->ip_address_spec, 214 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 215 (acl->key_name?acl->key_name:"(null)"))); 216 acl=acl->next; 217 } 218 } 219 220 static void 221 print_acl(const char* varname, acl_options_type* acl) 222 { 223 while(acl) 224 { 225 printf("\t%s ", varname); 226 if(acl->use_axfr_only) 227 printf("AXFR "); 228 if(acl->allow_udp) 229 printf("UDP "); 230 if (acl->tls_auth_name) 231 printf("%s %s %s\n", acl->ip_address_spec, 232 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 233 (acl->key_name?acl->key_name:"(null)")), 234 acl->tls_auth_name?acl->tls_auth_name:""); 235 else 236 printf("%s %s\n", acl->ip_address_spec, 237 acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": 238 (acl->key_name?acl->key_name:"(null)"))); 239 if(verbosity>1) { 240 printf("\t# %s", acl->is_ipv6?"ip6":"ip4"); 241 if(acl->port == 0) printf(" noport"); 242 else printf(" port=%d", acl->port); 243 if(acl->rangetype == acl_range_single) printf(" single"); 244 if(acl->rangetype == acl_range_mask) printf(" masked"); 245 if(acl->rangetype == acl_range_subnet) printf(" subnet"); 246 if(acl->rangetype == acl_range_minmax) printf(" minmax"); 247 if(acl->is_ipv6) { 248 #ifdef INET6 249 char dest[128]; 250 inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest)); 251 printf(" addr=%s", dest); 252 if(acl->rangetype != acl_range_single) { 253 inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest)); 254 printf(" rangemask=%s", dest); 255 } 256 #else 257 printf(" ip6addr-noip6defined"); 258 #endif 259 } else { 260 char dest[128]; 261 inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest)); 262 printf(" addr=%s", dest); 263 if(acl->rangetype != acl_range_single) { 264 inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest)); 265 printf(" rangemask=%s", dest); 266 } 267 } 268 printf("\n"); 269 } 270 acl=acl->next; 271 } 272 } 273 274 static void 275 print_acl_ips(const char* varname, acl_options_type* acl) 276 { 277 while(acl) 278 { 279 printf("\t%s %s\n", varname, acl->ip_address_spec); 280 acl=acl->next; 281 } 282 } 283 284 void 285 config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o, 286 const char *z, const char* pat, const char* tls, int final) 287 { 288 ip_address_option_type* ip; 289 290 if (k) { 291 /* find key */ 292 key_options_type* key = key_options_find(opt, k); 293 if(key) { 294 if (s) { 295 quote(key->secret); 296 } else { 297 quote(key->algorithm); 298 } 299 return; 300 } 301 printf("Could not find key %s\n", k); 302 return; 303 } 304 305 if (tls) { 306 /* find tlsauth */ 307 tls_auth_options_type* tlsauth = tls_auth_options_find(opt, tls); 308 if(tlsauth) { 309 quote(tlsauth->auth_domain_name); 310 return; 311 } 312 printf("Could not find tls-auth %s\n", tls); 313 return; 314 } 315 316 if (!o) { 317 return; 318 } 319 320 if (z) { 321 zone_options_type* zone; 322 const dname_type *dname = dname_parse(opt->region, z); 323 if(!dname) { 324 printf("Could not parse zone name %s\n", z); 325 exit(1); 326 } 327 zone = zone_options_find(opt, dname); 328 if(!zone) { 329 printf("Zone does not exist: %s\n", z); 330 exit(1); 331 } 332 ZONE_GET_STR(name, o, zone); 333 if(strcasecmp("pattern", o)==0) { 334 quote(zone->pattern->pname); 335 return; 336 } 337 ZONE_GET_BIN(part_of_config, o, zone); 338 ZONE_GET_PATH(final, zonefile, o, zone->pattern); 339 ZONE_GET_ACL(allow_query, o, zone->pattern); 340 ZONE_GET_ACL(request_xfr, o, zone->pattern); 341 ZONE_GET_ACL(provide_xfr, o, zone->pattern); 342 ZONE_GET_ACL(allow_notify, o, zone->pattern); 343 ZONE_GET_ACL(notify, o, zone->pattern); 344 ZONE_GET_BIN(notify_retry, o, zone->pattern); 345 ZONE_GET_STR(zonestats, o, zone->pattern); 346 ZONE_GET_OUTGOING(outgoing_interface, o, zone->pattern); 347 ZONE_GET_BIN(allow_axfr_fallback, o, zone->pattern); 348 ZONE_GET_INT(max_refresh_time, o, zone->pattern); 349 ZONE_GET_INT(min_refresh_time, o, zone->pattern); 350 ZONE_GET_INT(max_retry_time, o, zone->pattern); 351 ZONE_GET_INT(min_retry_time, o, zone->pattern); 352 ZONE_GET_INT(min_expire_time, o, zone->pattern); 353 ZONE_GET_INT(size_limit_xfr, o, zone->pattern); 354 #ifdef RATELIMIT 355 ZONE_GET_RRL(rrl_whitelist, o, zone->pattern); 356 #endif 357 ZONE_GET_BIN(multi_primary_check, o, zone->pattern); 358 ZONE_GET_BIN(store_ixfr, o, zone->pattern); 359 ZONE_GET_INT(ixfr_size, o, zone->pattern); 360 ZONE_GET_INT(ixfr_number, o, zone->pattern); 361 ZONE_GET_BIN(create_ixfr, o, zone->pattern); 362 printf("Zone option not handled: %s %s\n", z, o); 363 exit(1); 364 } else if(pat) { 365 pattern_options_type* p = pattern_options_find(opt, pat); 366 if(!p) { 367 printf("Pattern does not exist: %s\n", pat); 368 exit(1); 369 } 370 if(strcasecmp("name", o)==0) { 371 quote(p->pname); 372 return; 373 } 374 ZONE_GET_STR(zonefile, o, p); 375 ZONE_GET_PATH(final, zonefile, o, p); 376 ZONE_GET_ACL(allow_query, o, p); 377 ZONE_GET_ACL(request_xfr, o, p); 378 ZONE_GET_ACL(provide_xfr, o, p); 379 ZONE_GET_ACL(allow_notify, o, p); 380 ZONE_GET_ACL(notify, o, p); 381 ZONE_GET_BIN(notify_retry, o, p); 382 ZONE_GET_STR(zonestats, o, p); 383 ZONE_GET_OUTGOING(outgoing_interface, o, p); 384 ZONE_GET_BIN(allow_axfr_fallback, o, p); 385 ZONE_GET_INT(max_refresh_time, o, p); 386 ZONE_GET_INT(min_refresh_time, o, p); 387 ZONE_GET_INT(max_retry_time, o, p); 388 ZONE_GET_INT(min_retry_time, o, p); 389 ZONE_GET_INT(min_expire_time, o, p); 390 ZONE_GET_INT(size_limit_xfr, o, p); 391 #ifdef RATELIMIT 392 ZONE_GET_RRL(rrl_whitelist, o, p); 393 #endif 394 ZONE_GET_BIN(multi_primary_check, o, p); 395 ZONE_GET_BIN(store_ixfr, o, p); 396 ZONE_GET_INT(ixfr_size, o, p); 397 ZONE_GET_INT(ixfr_number, o, p); 398 ZONE_GET_BIN(create_ixfr, o, p); 399 printf("Pattern option not handled: %s %s\n", pat, o); 400 exit(1); 401 } else { 402 /* look in the server section */ 403 SERV_GET_IP(ip_address, ip_addresses, o); 404 /* bin */ 405 SERV_GET_BIN(ip_transparent, o); 406 SERV_GET_BIN(ip_freebind, o); 407 SERV_GET_BIN(debug_mode, o); 408 SERV_GET_BIN(do_ip4, o); 409 SERV_GET_BIN(do_ip6, o); 410 SERV_GET_BIN(reuseport, o); 411 SERV_GET_BIN(hide_version, o); 412 SERV_GET_BIN(hide_identity, o); 413 SERV_GET_BIN(drop_updates, o); 414 SERV_GET_BIN(zonefiles_check, o); 415 SERV_GET_BIN(log_time_ascii, o); 416 SERV_GET_BIN(round_robin, o); 417 SERV_GET_BIN(minimal_responses, o); 418 SERV_GET_BIN(confine_to_zone, o); 419 SERV_GET_BIN(refuse_any, o); 420 SERV_GET_BIN(tcp_reject_overflow, o); 421 SERV_GET_BIN(log_only_syslog, o); 422 /* str */ 423 SERV_GET_STR(identity, o); 424 SERV_GET_STR(version, o); 425 SERV_GET_STR(nsid, o); 426 SERV_GET_PATH(final, logfile, o); 427 SERV_GET_PATH(final, pidfile, o); 428 SERV_GET_STR(chroot, o); 429 SERV_GET_STR(username, o); 430 SERV_GET_PATH(final, zonesdir, o); 431 SERV_GET_PATH(final, xfrdfile, o); 432 SERV_GET_PATH(final, xfrdir, o); 433 SERV_GET_PATH(final, zonelistfile, o); 434 SERV_GET_STR(port, o); 435 SERV_GET_STR(tls_service_key, o); 436 SERV_GET_STR(tls_service_ocsp, o); 437 SERV_GET_STR(tls_service_pem, o); 438 SERV_GET_STR(tls_port, o); 439 SERV_GET_STR(tls_cert_bundle, o); 440 SERV_GET_STR(cookie_secret, o); 441 SERV_GET_STR(cookie_secret_file, o); 442 SERV_GET_BIN(answer_cookie, o); 443 /* int */ 444 SERV_GET_INT(server_count, o); 445 SERV_GET_INT(tcp_count, o); 446 SERV_GET_INT(tcp_query_count, o); 447 SERV_GET_INT(tcp_timeout, o); 448 SERV_GET_INT(tcp_mss, o); 449 SERV_GET_INT(outgoing_tcp_mss, o); 450 SERV_GET_INT(xfrd_tcp_max, o); 451 SERV_GET_INT(xfrd_tcp_pipeline, o); 452 SERV_GET_INT(ipv4_edns_size, o); 453 SERV_GET_INT(ipv6_edns_size, o); 454 SERV_GET_INT(statistics, o); 455 SERV_GET_INT(xfrd_reload_timeout, o); 456 SERV_GET_INT(verbosity, o); 457 SERV_GET_INT(send_buffer_size, o); 458 SERV_GET_INT(receive_buffer_size, o); 459 #ifdef RATELIMIT 460 SERV_GET_INT(rrl_size, o); 461 SERV_GET_INT(rrl_ratelimit, o); 462 SERV_GET_INT(rrl_slip, o); 463 SERV_GET_INT(rrl_ipv4_prefix_length, o); 464 SERV_GET_INT(rrl_ipv6_prefix_length, o); 465 SERV_GET_INT(rrl_whitelist_ratelimit, o); 466 #endif 467 #ifdef USE_DNSTAP 468 SERV_GET_BIN(dnstap_enable, o); 469 SERV_GET_STR(dnstap_socket_path, o); 470 SERV_GET_STR(dnstap_ip, o); 471 SERV_GET_BIN(dnstap_tls, o); 472 SERV_GET_STR(dnstap_tls_server_name, o); 473 SERV_GET_STR(dnstap_tls_cert_bundle, o); 474 SERV_GET_STR(dnstap_tls_client_key_file, o); 475 SERV_GET_STR(dnstap_tls_client_cert_file, o); 476 SERV_GET_BIN(dnstap_send_identity, o); 477 SERV_GET_BIN(dnstap_send_version, o); 478 SERV_GET_STR(dnstap_identity, o); 479 SERV_GET_STR(dnstap_version, o); 480 SERV_GET_BIN(dnstap_log_auth_query_messages, o); 481 SERV_GET_BIN(dnstap_log_auth_response_messages, o); 482 #endif 483 SERV_GET_INT(zonefiles_write, o); 484 /* remote control */ 485 SERV_GET_BIN(control_enable, o); 486 SERV_GET_IP(control_interface, control_interface, o); 487 SERV_GET_INT(control_port, o); 488 SERV_GET_STR(server_key_file, o); 489 SERV_GET_STR(server_cert_file, o); 490 SERV_GET_STR(control_key_file, o); 491 SERV_GET_STR(control_cert_file, o); 492 493 if(strcasecmp(o, "zones") == 0) { 494 zone_options_type* zone; 495 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 496 quote(zone->name); 497 return; 498 } 499 if(strcasecmp(o, "patterns") == 0) { 500 pattern_options_type* p; 501 RBTREE_FOR(p, pattern_options_type*, opt->patterns) 502 quote(p->pname); 503 return; 504 } 505 if(strcasecmp(o, "proxy_protocol_port") == 0) { 506 struct proxy_protocol_port_list* p; 507 for(p = opt->proxy_protocol_port; p; p = p->next) 508 printf("%d\n", p->port); 509 return; 510 } 511 printf("Server option not handled: %s\n", o); 512 exit(1); 513 } 514 } 515 516 /* print zone content items */ 517 static void print_zone_content_elems(pattern_options_type* pat) 518 { 519 if(pat->zonefile) 520 print_string_var("zonefile:", pat->zonefile); 521 #ifdef RATELIMIT 522 zone_print_rrl_whitelist("\trrl-whitelist: ", pat->rrl_whitelist); 523 #endif 524 print_acl("allow_query:", pat->allow_query); 525 print_acl("allow-notify:", pat->allow_notify); 526 print_acl("request-xfr:", pat->request_xfr); 527 if(pat->multi_primary_check) 528 printf("\tmulti-primary-check: %s\n", pat->multi_primary_check?"yes":"no"); 529 if(!pat->notify_retry_is_default) 530 printf("\tnotify-retry: %d\n", pat->notify_retry); 531 print_acl("notify:", pat->notify); 532 print_acl("provide-xfr:", pat->provide_xfr); 533 if(pat->zonestats) 534 print_string_var("zonestats:", pat->zonestats); 535 print_acl_ips("outgoing-interface:", pat->outgoing_interface); 536 if(!pat->allow_axfr_fallback_is_default) 537 printf("\tallow-axfr-fallback: %s\n", 538 pat->allow_axfr_fallback?"yes":"no"); 539 if(!pat->max_refresh_time_is_default) 540 printf("\tmax-refresh-time: %d\n", pat->max_refresh_time); 541 if(!pat->min_refresh_time_is_default) 542 printf("\tmin-refresh-time: %d\n", pat->min_refresh_time); 543 if(!pat->max_retry_time_is_default) 544 printf("\tmax-retry-time: %d\n", pat->max_retry_time); 545 if(!pat->min_retry_time_is_default) 546 printf("\tmin-retry-time: %d\n", pat->min_retry_time); 547 if(pat->min_expire_time_expr == REFRESHPLUSRETRYPLUS1) 548 printf("\tmin-expire-time: " REFRESHPLUSRETRYPLUS1_STR "\n"); 549 else if(pat->min_expire_time_expr == EXPIRE_TIME_HAS_VALUE) 550 printf("\tmin-expire-time: %d\n", pat->min_expire_time); 551 if(pat->size_limit_xfr != 0) 552 printf("\tsize-limit-xfr: %llu\n", 553 (long long unsigned)pat->size_limit_xfr); 554 if(!pat->store_ixfr_is_default) 555 printf("\tstore-ixfr: %s\n", pat->store_ixfr?"yes":"no"); 556 if(!pat->ixfr_number_is_default) 557 printf("\tixfr-number: %u\n", (unsigned)pat->ixfr_number); 558 if(!pat->ixfr_size_is_default) 559 printf("\tixfr-size: %u\n", (unsigned)pat->ixfr_size); 560 if(!pat->create_ixfr_is_default) 561 printf("\tcreate-ixfr: %s\n", pat->create_ixfr?"yes":"no"); 562 if(pat->verify_zone != VERIFY_ZONE_INHERIT) { 563 printf("\tverify-zone: "); 564 if(pat->verify_zone) { 565 printf("yes\n"); 566 } else { 567 printf("no\n"); 568 } 569 } 570 if(pat->verifier) { 571 printf("\tverifier:"); 572 for(char *const *s = pat->verifier; *s; s++) { 573 printf(" \"%s\"", *s); 574 } 575 printf("\n"); 576 } 577 if(pat->verifier_feed_zone != VERIFIER_FEED_ZONE_INHERIT) { 578 printf("\tverifier-feed-zone: "); 579 if(pat->verifier_feed_zone) { 580 printf("yes\n"); 581 } else { 582 printf("no\n"); 583 } 584 } 585 if(pat->verifier_timeout != VERIFIER_TIMEOUT_INHERIT) { 586 printf("\tverifier-timeout: %d\n", pat->verifier_timeout); 587 } 588 589 if(!pat->catalog_role_is_default) 590 switch(pat->catalog_role) { 591 case CATALOG_ROLE_CONSUMER: printf("\tcatalog: consumer\n"); 592 break; 593 case CATALOG_ROLE_PRODUCER: printf("\tcatalog: producer\n"); 594 break; 595 default : break; 596 } 597 598 if(pat->catalog_member_pattern) 599 print_string_var("catalog-member-pattern:", pat->catalog_member_pattern); 600 if(pat->catalog_producer_zone) 601 print_string_var("catalog-producer-zone:", pat->catalog_producer_zone); 602 } 603 604 void 605 config_test_print_server(nsd_options_type* opt) 606 { 607 ip_address_option_type* ip; 608 key_options_type* key; 609 tls_auth_options_type* tlsauth; 610 zone_options_type* zone; 611 pattern_options_type* pat; 612 613 printf("# Config settings.\n"); 614 printf("server:\n"); 615 printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no"); 616 printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no"); 617 printf("\tip-freebind: %s\n", opt->ip_freebind?"yes":"no"); 618 printf("\treuseport: %s\n", opt->reuseport?"yes":"no"); 619 printf("\tdo-ip4: %s\n", opt->do_ip4?"yes":"no"); 620 printf("\tdo-ip6: %s\n", opt->do_ip6?"yes":"no"); 621 printf("\tsend-buffer-size: %d\n", opt->send_buffer_size); 622 printf("\treceive-buffer-size: %d\n", opt->receive_buffer_size); 623 printf("\thide-version: %s\n", opt->hide_version?"yes":"no"); 624 printf("\thide-identity: %s\n", opt->hide_identity?"yes":"no"); 625 printf("\tdrop-updates: %s\n", opt->drop_updates?"yes":"no"); 626 printf("\ttcp-reject-overflow: %s\n", 627 opt->tcp_reject_overflow ? "yes" : "no"); 628 print_string_var("identity:", opt->identity); 629 print_string_var("version:", opt->version); 630 print_string_var("nsid:", opt->nsid); 631 print_string_var("logfile:", opt->logfile); 632 printf("\tlog-only-syslog: %s\n", opt->log_only_syslog?"yes":"no"); 633 printf("\tserver-count: %d\n", opt->server_count); 634 if(opt->cpu_affinity) { 635 cpu_option_type *n; 636 printf("\tcpu-affinity:"); 637 for(n = opt->cpu_affinity; n; n = n->next) { 638 printf(" %d", n->cpu); 639 } 640 printf("\n"); 641 } 642 if(opt->cpu_affinity && opt->service_cpu_affinity) { 643 cpu_map_option_type *n; 644 for(n = opt->service_cpu_affinity; n; n = n->next) { 645 if(n->service > 0) { 646 printf("\tserver-%d-cpu-affinity: %d\n", 647 n->service, n->cpu); 648 } else if(n->service == -1) { 649 printf("\txfrd-cpu-affinity: %d\n", 650 n->cpu); 651 } 652 } 653 } 654 printf("\ttcp-count: %d\n", opt->tcp_count); 655 printf("\ttcp-query-count: %d\n", opt->tcp_query_count); 656 printf("\ttcp-timeout: %d\n", opt->tcp_timeout); 657 printf("\ttcp-mss: %d\n", opt->tcp_mss); 658 printf("\toutgoing-tcp-mss: %d\n", opt->outgoing_tcp_mss); 659 printf("\txfrd-tcp-max: %d\n", opt->xfrd_tcp_max); 660 printf("\txfrd-tcp-pipeline: %d\n", opt->xfrd_tcp_pipeline); 661 printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size); 662 printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size); 663 print_string_var("pidfile:", opt->pidfile); 664 print_string_var("port:", opt->port); 665 printf("\tstatistics: %d\n", opt->statistics); 666 print_string_var("chroot:", opt->chroot); 667 print_string_var("username:", opt->username); 668 print_string_var("zonesdir:", opt->zonesdir); 669 print_string_var("xfrdfile:", opt->xfrdfile); 670 print_string_var("zonelistfile:", opt->zonelistfile); 671 print_string_var("xfrdir:", opt->xfrdir); 672 printf("\txfrd-reload-timeout: %d\n", opt->xfrd_reload_timeout); 673 printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no"); 674 printf("\tround-robin: %s\n", opt->round_robin?"yes":"no"); 675 printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no"); 676 printf("\tconfine-to-zone: %s\n", 677 opt->confine_to_zone ? "yes" : "no"); 678 printf("\trefuse-any: %s\n", opt->refuse_any?"yes":"no"); 679 printf("\tverbosity: %d\n", opt->verbosity); 680 for(ip = opt->ip_addresses; ip; ip=ip->next) 681 { 682 printf("\tip-address: %s", ip->address); 683 if(ip->servers) { 684 const char *sep; 685 struct range_option *n; 686 printf(" servers=\""); 687 for(n=ip->servers, sep=""; n; n = n->next, sep=" ") { 688 if(n->first == n->last) { 689 printf("%s%d", sep, n->first); 690 } else { 691 printf("%s%d-%d", sep, n->first, n->last); 692 } 693 } 694 printf("\""); 695 } 696 if(ip->fib != -1) { 697 printf(" setfib=%d", ip->fib); 698 } 699 printf("\n"); 700 } 701 #ifdef RATELIMIT 702 printf("\trrl-size: %d\n", (int)opt->rrl_size); 703 printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit); 704 printf("\trrl-slip: %d\n", (int)opt->rrl_slip); 705 printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length); 706 printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length); 707 printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit); 708 #endif 709 printf("\tzonefiles-check: %s\n", opt->zonefiles_check?"yes":"no"); 710 printf("\tzonefiles-write: %d\n", opt->zonefiles_write); 711 print_string_var("tls-service-key:", opt->tls_service_key); 712 print_string_var("tls-service-pem:", opt->tls_service_pem); 713 print_string_var("tls-service-ocsp:", opt->tls_service_ocsp); 714 print_string_var("tls-port:", opt->tls_port); 715 print_string_var("tls-cert-bundle:", opt->tls_cert_bundle); 716 printf("\tanswer-cookie: %s\n", opt->answer_cookie?"yes":"no"); 717 if (opt->cookie_secret) 718 print_string_var("cookie-secret:", opt->cookie_secret); 719 if (opt->cookie_secret_file) 720 print_string_var("cookie-secret-file:", opt->cookie_secret_file); 721 if(opt->proxy_protocol_port) { 722 struct proxy_protocol_port_list* p; 723 for(p = opt->proxy_protocol_port; p; p = p->next) 724 printf("\tproxy-protocol-port: %d\n", p->port); 725 } 726 727 #ifdef USE_DNSTAP 728 printf("\ndnstap:\n"); 729 printf("\tdnstap-enable: %s\n", opt->dnstap_enable?"yes":"no"); 730 print_string_var("dnstap-socket-path:", opt->dnstap_socket_path); 731 print_string_var("dnstap-ip:", opt->dnstap_ip); 732 printf("\tdnstap-tls: %s\n", opt->dnstap_tls?"yes":"no"); 733 print_string_var("dnstap-tls-server-name:", opt->dnstap_tls_server_name); 734 print_string_var("dnstap-tls-cert-bundle:", opt->dnstap_tls_cert_bundle); 735 print_string_var("dnstap-tls-client-key-file:", opt->dnstap_tls_client_key_file); 736 print_string_var("dnstap-tls-client-cert-file:", opt->dnstap_tls_client_cert_file); 737 printf("\tdnstap-send-identity: %s\n", opt->dnstap_send_identity?"yes":"no"); 738 printf("\tdnstap-send-version: %s\n", opt->dnstap_send_version?"yes":"no"); 739 print_string_var("dnstap-identity:", opt->dnstap_identity); 740 print_string_var("dnstap-version:", opt->dnstap_version); 741 printf("\tdnstap-log-auth-query-messages: %s\n", opt->dnstap_log_auth_query_messages?"yes":"no"); 742 printf("\tdnstap-log-auth-response-messages: %s\n", opt->dnstap_log_auth_response_messages?"yes":"no"); 743 #endif 744 745 printf("\nremote-control:\n"); 746 printf("\tcontrol-enable: %s\n", opt->control_enable?"yes":"no"); 747 for(ip = opt->control_interface; ip; ip=ip->next) 748 print_string_var("control-interface:", ip->address); 749 printf("\tcontrol-port: %d\n", opt->control_port); 750 print_string_var("server-key-file:", opt->server_key_file); 751 print_string_var("server-cert-file:", opt->server_cert_file); 752 print_string_var("control-key-file:", opt->control_key_file); 753 print_string_var("control-cert-file:", opt->control_cert_file); 754 755 printf("\nverify:\n"); 756 printf("\tenable: %s\n", opt->verify_enable?"yes":"no"); 757 for(ip = opt->verify_ip_addresses; ip; ip=ip->next) { 758 print_string_var("ip-address:", ip->address); 759 } 760 printf("\tport: %s\n", opt->verify_port); 761 printf("\tverify-zones: %s\n", opt->verify_zones?"yes":"no"); 762 if(opt->verifier) { 763 printf("\tverifier:"); 764 for(char **s = opt->verifier; *s; s++) { 765 printf(" \"%s\"", *s); 766 } 767 printf("\n"); 768 } 769 printf("\tverifier-count: %d\n", opt->verifier_count); 770 printf("\tverifier-feed-zone: %s\n", opt->verifier_feed_zone?"yes":"no"); 771 printf("\tverifier-timeout: %d\n", opt->verifier_timeout); 772 773 RBTREE_FOR(key, key_options_type*, opt->keys) 774 { 775 printf("\nkey:\n"); 776 print_string_var("name:", key->name); 777 print_string_var("algorithm:", key->algorithm); 778 print_string_var("secret:", key->secret); 779 } 780 RBTREE_FOR(tlsauth, tls_auth_options_type*, opt->tls_auths) 781 { 782 printf("\ntls-auth:\n"); 783 print_string_var("name:", tlsauth->name); 784 print_string_var("auth-domain-name:", tlsauth->auth_domain_name); 785 } 786 RBTREE_FOR(pat, pattern_options_type*, opt->patterns) 787 { 788 if(pat->implicit) continue; 789 printf("\npattern:\n"); 790 print_string_var("name:", pat->pname); 791 print_zone_content_elems(pat); 792 } 793 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 794 { 795 if(!zone->part_of_config) 796 continue; 797 printf("\nzone:\n"); 798 print_string_var("name:", zone->name); 799 print_zone_content_elems(zone->pattern); 800 } 801 } 802 803 static int 804 additional_checks(nsd_options_type* opt, const char* filename) 805 { 806 zone_options_type* zone; 807 int errors = 0; 808 809 RBTREE_FOR(zone, zone_options_type*, opt->zone_options) 810 { 811 const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */ 812 if(!dname) { 813 fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name); 814 errors ++; 815 continue; 816 } 817 if(zone->pattern->allow_notify && !zone->pattern->request_xfr) { 818 fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr" 819 " items. Where can it get a zone transfer when a notify " 820 "is received?\n", filename, zone->name); 821 errors ++; 822 } 823 if(!zone_is_slave(zone) && !zone_is_catalog_producer(zone) 824 && (!zone->pattern->zonefile || zone->pattern->zonefile[0] == 0)) { 825 fprintf(stderr, "%s: zone %s is a primary zone but has " 826 "no zonefile. Where can the data come from?\n", 827 filename, zone->name); 828 errors ++; 829 } 830 } 831 832 #ifndef BIND8_STATS 833 if(opt->statistics > 0) 834 { 835 fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n", 836 filename, opt->statistics); 837 errors ++; 838 } 839 #endif 840 #ifndef HAVE_CHROOT 841 if(opt->chroot != 0) 842 { 843 fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n", 844 filename, opt->chroot); 845 errors ++; 846 } 847 #endif 848 if (opt->identity && strlen(opt->identity) > UCHAR_MAX) { 849 fprintf(stderr, "%s: server identity too long (%u characters)\n", 850 filename, (unsigned) strlen(opt->identity)); 851 errors ++; 852 } 853 if (opt->version && strlen(opt->version) > UCHAR_MAX) { 854 fprintf(stderr, "%s: server version too long (%u characters)\n", 855 filename, (unsigned) strlen(opt->version)); 856 errors ++; 857 } 858 859 /* not done here: parsing of ip-address. parsing of username. */ 860 861 if (opt->chroot && opt->chroot[0]) { 862 /* append trailing slash for strncmp checking */ 863 append_trailing_slash(&opt->chroot, opt->region); 864 append_trailing_slash(&opt->xfrdir, opt->region); 865 append_trailing_slash(&opt->zonesdir, opt->region); 866 867 /* zonesdir must be absolute and within chroot, 868 * all other pathnames may be relative to zonesdir */ 869 if (strncmp(opt->zonesdir, opt->chroot, strlen(opt->chroot)) != 0) { 870 fprintf(stderr, "%s: zonesdir %s has to be an absolute path that starts with the chroot path %s\n", 871 filename, opt->zonesdir, opt->chroot); 872 errors ++; 873 } 874 if (!file_inside_chroot(opt->pidfile, opt->chroot)) { 875 fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n", 876 filename, opt->pidfile, opt->chroot); 877 errors ++; 878 } 879 if (!file_inside_chroot(opt->xfrdfile, opt->chroot)) { 880 fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n", 881 filename, opt->xfrdfile, opt->chroot); 882 errors ++; 883 } 884 if (!file_inside_chroot(opt->zonelistfile, opt->chroot)) { 885 fprintf(stderr, "%s: zonelistfile %s is not relative to chroot %s.\n", 886 filename, opt->zonelistfile, opt->chroot); 887 errors ++; 888 } 889 if (!file_inside_chroot(opt->xfrdir, opt->chroot)) { 890 fprintf(stderr, "%s: xfrdir %s is not relative to chroot %s.\n", 891 filename, opt->xfrdir, opt->chroot); 892 errors ++; 893 } 894 } 895 896 if (atoi(opt->port) <= 0) { 897 fprintf(stderr, "%s: port number '%s' is not a positive number.\n", 898 filename, opt->port); 899 errors ++; 900 } 901 if(errors != 0) { 902 fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys, %d tls-auth.\n", 903 filename, errors, (int)nsd_options_num_zones(opt), 904 (int)opt->keys->count, 905 (int)opt->tls_auths->count); 906 } 907 908 return (errors == 0); 909 } 910 911 int 912 main(int argc, char* argv[]) 913 { 914 int c; 915 int verbose = 0; 916 int key_sec = 0; 917 int final = 0; 918 const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */ 919 const char * conf_zone = NULL; /* what zone are we talking about */ 920 const char * conf_key = NULL; /* what key is needed */ 921 const char * conf_tlsauth = NULL; /* what tls-auth is needed */ 922 const char * conf_pat = NULL; /* what pattern is talked about */ 923 const char* configfile; 924 nsd_options_type *options; 925 926 log_init("nsd-checkconf"); 927 928 /* Parse the command line... */ 929 while ((c = getopt(argc, argv, "vfho:a:p:s:z:t:")) != -1) { 930 switch (c) { 931 case 'v': 932 verbose = 1; 933 verbosity++; 934 break; 935 case 'o': 936 conf_opt = optarg; 937 break; 938 case 'f': 939 final = 1; 940 break; 941 case 'p': 942 conf_pat = optarg; 943 break; 944 case 'a': 945 if (conf_key) { 946 fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n"); 947 exit(1); 948 } 949 conf_key = optarg; 950 break; 951 case 's': 952 if (conf_key) { 953 fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n"); 954 exit(1); 955 } 956 conf_key = optarg; 957 key_sec = 1; 958 break; 959 case 't': 960 conf_tlsauth = optarg; 961 break; 962 case 'z': 963 conf_zone = optarg; 964 break; 965 case 'h': 966 default: 967 usage(); 968 }; 969 } 970 argc -= optind; 971 argv += optind; 972 if (argc == 0 || argc>=2) { 973 usage(); 974 } 975 configfile = argv[0]; 976 977 /* read config file */ 978 options = nsd_options_create(region_create(xalloc, free)); 979 tsig_init(options->region); 980 if (!parse_options_file(options, configfile, NULL, NULL, NULL) || 981 !additional_checks(options, configfile)) { 982 exit(2); 983 } 984 if (conf_opt || conf_key || conf_tlsauth) { 985 config_print_zone(options, conf_key, key_sec, 986 underscore(conf_opt), conf_zone, conf_pat, conf_tlsauth, final); 987 } else { 988 if (verbose) { 989 printf("# Read file %s: %d patterns, %d fixed-zones, " 990 "%d keys, %d tls-auth.\n", 991 configfile, 992 (int)options->patterns->count, 993 (int)nsd_options_num_zones(options), 994 (int)options->keys->count, 995 (int)options->tls_auths->count); 996 config_test_print_server(options); 997 } 998 } 999 return 0; 1000 } 1001