xref: /freebsd/contrib/unbound/smallapp/unbound-checkconf.c (revision b2efd602aea8b3cbc3fb215b9611946d04fceb10) 
1 /*
2  * smallapp/unbound-checkconf.c - config file checker for unbound.conf file.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * The config checker checks for syntax and other errors in the unbound.conf
40  * file, and can be used to check for errors before the server is started
41  * or sigHUPped.
42  * Exit status 1 means an error.
43  */
44 
45 #include "config.h"
46 #include <ctype.h>
47 #include "util/log.h"
48 #include "util/config_file.h"
49 #include "util/module.h"
50 #include "util/net_help.h"
51 #include "util/regional.h"
52 #include "iterator/iterator.h"
53 #include "iterator/iter_fwd.h"
54 #include "iterator/iter_hints.h"
55 #include "validator/validator.h"
56 #include "services/localzone.h"
57 #include "services/listen_dnsport.h"
58 #include "services/view.h"
59 #include "services/authzone.h"
60 #include "respip/respip.h"
61 #include "sldns/sbuffer.h"
62 #include "sldns/str2wire.h"
63 #ifdef HAVE_GETOPT_H
64 #include <getopt.h>
65 #endif
66 #ifdef HAVE_PWD_H
67 #include <pwd.h>
68 #endif
69 #ifdef HAVE_SYS_STAT_H
70 #include <sys/stat.h>
71 #endif
72 #ifdef HAVE_GLOB_H
73 #include <glob.h>
74 #endif
75 #ifdef WITH_PYTHONMODULE
76 #include "pythonmod/pythonmod.h"
77 #endif
78 #ifdef CLIENT_SUBNET
79 #include "edns-subnet/subnet-whitelist.h"
80 #endif
81 
82 /** Give checkconf usage, and exit (1). */
83 static void
usage(void)84 usage(void)
85 {
86 	printf("Usage:	local-unbound-checkconf [file]\n");
87 	printf("	Checks unbound configuration file for errors.\n");
88 	printf("file	if omitted %s is used.\n", CONFIGFILE);
89 	printf("-o option	print value of option to stdout.\n");
90 	printf("-f 		output full pathname with chroot applied, eg. with -o pidfile.\n");
91 	printf("-q 		quiet (suppress output on success).\n");
92 	printf("-h		show this usage help.\n");
93 	printf("Version %s\n", PACKAGE_VERSION);
94 	printf("BSD licensed, see LICENSE in source package for details.\n");
95 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
96 	exit(1);
97 }
98 
99 /**
100  * Print given option to stdout
101  * @param cfg: config
102  * @param opt: option name without trailing :.
103  *	This is different from config_set_option.
104  * @param final: if final pathname with chroot applied has to be printed.
105  */
106 static void
print_option(struct config_file * cfg,const char * opt,int final)107 print_option(struct config_file* cfg, const char* opt, int final)
108 {
109 	if(strcmp(opt, "pidfile") == 0 && final) {
110 		char *p = fname_after_chroot(cfg->pidfile, cfg, 1);
111 		if(!p) fatal_exit("out of memory");
112 		printf("%s\n", p);
113 		free(p);
114 		return;
115 	}
116 	if(strcmp(opt, "auto-trust-anchor-file") == 0 && final) {
117 		struct config_strlist* s = cfg->auto_trust_anchor_file_list;
118 		for(; s; s=s->next) {
119 			char *p = fname_after_chroot(s->str, cfg, 1);
120 			if(!p) fatal_exit("out of memory");
121 			printf("%s\n", p);
122 			free(p);
123 		}
124 		return;
125 	}
126 	if(!config_get_option(cfg, opt, config_print_func, stdout))
127 		fatal_exit("cannot print option '%s'", opt);
128 }
129 
130 /** check if module works with config */
131 static void
check_mod(struct config_file * cfg,struct module_func_block * fb)132 check_mod(struct config_file* cfg, struct module_func_block* fb)
133 {
134 	struct module_env env;
135 	memset(&env, 0, sizeof(env));
136 	env.cfg = cfg;
137 	env.scratch = regional_create();
138 	env.scratch_buffer = sldns_buffer_new(BUFSIZ);
139 	if(!env.scratch || !env.scratch_buffer)
140 		fatal_exit("out of memory");
141 	if(!edns_known_options_init(&env))
142 		fatal_exit("out of memory");
143 	if(fb->startup && !(*fb->startup)(&env, 0))
144 		fatal_exit("bad config during startup for %s module", fb->name);
145 	if(!(*fb->init)(&env, 0))
146 		fatal_exit("bad config during init for %s module", fb->name);
147 	(*fb->deinit)(&env, 0);
148 	if(fb->destartup)
149 		(*fb->destartup)(&env, 0);
150 	sldns_buffer_free(env.scratch_buffer);
151 	regional_destroy(env.scratch);
152 	edns_known_options_delete(&env);
153 }
154 
155 /** true if addr is a localhost address, 127.0.0.1 or ::1 (with maybe "@port"
156  * after it) */
157 static int
str_addr_is_localhost(const char * a)158 str_addr_is_localhost(const char* a)
159 {
160 	if(strncmp(a, "127.", 4) == 0) return 1;
161 	if(strncmp(a, "::1", 3) == 0) return 1;
162 	return 0;
163 }
164 
165 /** check do-not-query-localhost */
166 static void
donotquerylocalhostcheck(struct config_file * cfg)167 donotquerylocalhostcheck(struct config_file* cfg)
168 {
169 	if(cfg->donotquery_localhost) {
170 		struct config_stub* p;
171 		struct config_strlist* s;
172 		for(p=cfg->forwards; p; p=p->next) {
173 			for(s=p->addrs; s; s=s->next) {
174 				if(str_addr_is_localhost(s->str)) {
175 					fprintf(stderr, "unbound-checkconf: warning: forward-addr: '%s' is specified for forward-zone: '%s', but do-not-query-localhost: yes means that the address will not be used for lookups.\n",
176 						s->str, p->name);
177 				}
178 			}
179 		}
180 		for(p=cfg->stubs; p; p=p->next) {
181 			for(s=p->addrs; s; s=s->next) {
182 				if(str_addr_is_localhost(s->str)) {
183 					fprintf(stderr, "unbound-checkconf: warning: stub-addr: '%s' is specified for stub-zone: '%s', but do-not-query-localhost: yes means that the address will not be used for lookups.\n",
184 						s->str, p->name);
185 				}
186 			}
187 		}
188 	}
189 }
190 
191 /** check localzones */
192 static void
localzonechecks(struct config_file * cfg)193 localzonechecks(struct config_file* cfg)
194 {
195 	struct local_zones* zs;
196 	if(!(zs = local_zones_create()))
197 		fatal_exit("out of memory");
198 	if(!local_zones_apply_cfg(zs, cfg))
199 		fatal_exit("failed local-zone, local-data configuration");
200 	local_zones_delete(zs);
201 }
202 
203 /** checks for acl and views */
204 static void
acl_view_tag_checks(struct config_file * cfg,struct views * views)205 acl_view_tag_checks(struct config_file* cfg, struct views* views)
206 {
207 	int d;
208 	struct sockaddr_storage a;
209 	socklen_t alen;
210 	struct config_str2list* acl;
211 	struct config_str3list* s3;
212 	struct config_strbytelist* sb;
213 
214 	/* acl_view */
215 	for(acl=cfg->acl_view; acl; acl = acl->next) {
216 		struct view* v;
217 		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
218 			&d)) {
219 			fatal_exit("cannot parse access-control-view "
220 				"address %s %s", acl->str, acl->str2);
221 		}
222 		v = views_find_view(views, acl->str2, 0);
223 		if(!v) {
224 			fatal_exit("cannot find view for "
225 				"access-control-view: %s %s",
226 				acl->str, acl->str2);
227 		}
228 		lock_rw_unlock(&v->lock);
229 	}
230 
231 	/* acl_tags */
232 	for(sb=cfg->acl_tags; sb; sb = sb->next) {
233 		if(!netblockstrtoaddr(sb->str, UNBOUND_DNS_PORT, &a, &alen,
234 			&d)) {
235 			fatal_exit("cannot parse access-control-tags "
236 				"address %s", sb->str);
237 		}
238 	}
239 
240 	/* acl_tag_actions */
241 	for(s3=cfg->acl_tag_actions; s3; s3 = s3->next) {
242 		enum localzone_type t;
243 		if(!netblockstrtoaddr(s3->str, UNBOUND_DNS_PORT, &a, &alen,
244 			&d)) {
245 			fatal_exit("cannot parse access-control-tag-actions "
246 				"address %s %s %s",
247 				s3->str, s3->str2, s3->str3);
248 		}
249 		if(find_tag_id(cfg, s3->str2) == -1) {
250 			fatal_exit("cannot parse tag %s (define-tag it), "
251 				"for access-control-tag-actions: %s %s %s",
252 				s3->str2, s3->str, s3->str2, s3->str3);
253 		}
254 		if(!local_zone_str2type(s3->str3, &t)) {
255 			fatal_exit("cannot parse access control action type %s"
256 				" for access-control-tag-actions: %s %s %s",
257 				s3->str3, s3->str, s3->str2, s3->str3);
258 		}
259 	}
260 
261 	/* acl_tag_datas */
262 	for(s3=cfg->acl_tag_datas; s3; s3 = s3->next) {
263 		char buf[65536];
264 		uint8_t rr[LDNS_RR_BUF_SIZE];
265 		size_t len = sizeof(rr);
266 		int res;
267 		if(!netblockstrtoaddr(s3->str, UNBOUND_DNS_PORT, &a, &alen,
268 			&d)) {
269 			fatal_exit("cannot parse access-control-tag-datas address %s %s '%s'",
270 				s3->str, s3->str2, s3->str3);
271 		}
272 		if(find_tag_id(cfg, s3->str2) == -1) {
273 			fatal_exit("cannot parse tag %s (define-tag it), "
274 				"for access-control-tag-datas: %s %s '%s'",
275 				s3->str2, s3->str, s3->str2, s3->str3);
276 		}
277 		/* '.' is sufficient for validation, and it makes the call to
278 		 * sldns_wirerr_get_type() simpler below. */
279 		snprintf(buf, sizeof(buf), "%s %s", ".", s3->str3);
280 		res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL,
281 			0, NULL, 0);
282 		if(res != 0) {
283 			fatal_exit("cannot parse rr data [char %d] parse error %s, for access-control-tag-datas: %s %s '%s'",
284 				(int)LDNS_WIREPARSE_OFFSET(res)-2,
285 				sldns_get_errorstr_parse(res),
286 				s3->str, s3->str2, s3->str3);
287 		}
288 	}
289 }
290 
291 /** check view and response-ip configuration */
292 static void
view_and_respipchecks(struct config_file * cfg)293 view_and_respipchecks(struct config_file* cfg)
294 {
295 	struct views* views = NULL;
296 	struct respip_set* respip = NULL;
297 	int have_view_respip_cfg = 0;
298 	int use_response_ip = 0;
299 	if(!(views = views_create()))
300 		fatal_exit("Could not create views: out of memory");
301 	if(!(respip = respip_set_create()))
302 		fatal_exit("Could not create respip set: out of memory");
303 	if(!views_apply_cfg(views, cfg))
304 		fatal_exit("Could not set up views");
305 	if(!respip_global_apply_cfg(respip, cfg))
306 		fatal_exit("Could not setup respip set");
307 	if(!respip_views_apply_cfg(views, cfg, &have_view_respip_cfg))
308 		fatal_exit("Could not setup per-view respip sets");
309 	use_response_ip = !respip_set_is_empty(respip) || have_view_respip_cfg;
310 	if(use_response_ip && !strstr(cfg->module_conf, "respip"))
311 		fatal_exit("response-ip options require respip module");
312 	acl_view_tag_checks(cfg, views);
313 	views_delete(views);
314 	respip_set_delete(respip);
315 }
316 
317 /** emit warnings for IP in hosts */
318 static void
warn_hosts(const char * typ,struct config_stub * list)319 warn_hosts(const char* typ, struct config_stub* list)
320 {
321 	struct sockaddr_storage a;
322 	socklen_t alen;
323 	struct config_stub* s;
324 	struct config_strlist* h;
325 	for(s=list; s; s=s->next) {
326 		for(h=s->hosts; h; h=h->next) {
327 			if(extstrtoaddr(h->str, &a, &alen, UNBOUND_DNS_PORT)) {
328 				fprintf(stderr, "unbound-checkconf: warning:"
329 				  " %s %s: \"%s\" is an IP%s address, "
330 				  "and when looked up as a host name "
331 				  "during use may not resolve.\n",
332 				  s->name, typ, h->str,
333 				  addr_is_ip6(&a, alen)?"6":"4");
334 			}
335 		}
336 	}
337 }
338 
339 /** check interface strings */
340 static void
interfacechecks(struct config_file * cfg)341 interfacechecks(struct config_file* cfg)
342 {
343 	int d;
344 	struct sockaddr_storage a;
345 	socklen_t alen;
346 	int i, j, i2, j2;
347 	char*** resif = NULL;
348 	int* num_resif = NULL;
349 
350 	if(cfg->num_ifs != 0) {
351 		resif = (char***)calloc(cfg->num_ifs, sizeof(char**));
352 		if(!resif) fatal_exit("malloc failure");
353 		num_resif = (int*)calloc(cfg->num_ifs, sizeof(int));
354 		if(!num_resif) fatal_exit("malloc failure");
355 	}
356 	for(i=0; i<cfg->num_ifs; i++) {
357 		/* search for duplicates in IP or ifname arguments */
358 		for(i2=0; i2<i; i2++) {
359 			if(strcmp(cfg->ifs[i], cfg->ifs[i2]) == 0) {
360 				fatal_exit("interface: %s present twice, "
361 					"cannot bind same ports twice.",
362 					cfg->ifs[i]);
363 			}
364 		}
365 		if(!resolve_interface_names(&cfg->ifs[i], 1, NULL, &resif[i],
366 			&num_resif[i])) {
367 			fatal_exit("could not resolve interface names, for %s",
368 				cfg->ifs[i]);
369 		}
370 		/* check for port combinations that are not supported */
371 		if(if_is_pp2(resif[i][0], cfg->port, cfg->proxy_protocol_port)) {
372 			if(if_is_dnscrypt(resif[i][0], cfg->port,
373 				cfg->dnscrypt_port)) {
374 				fatal_exit("PROXYv2 and DNSCrypt combination not "
375 					"supported!");
376 			} else if(if_is_https(resif[i][0], cfg->port,
377 				cfg->https_port)) {
378 				fatal_exit("PROXYv2 and DoH combination not "
379 					"supported!");
380 			} else if(if_is_quic(resif[i][0], cfg->port,
381 				cfg->quic_port)) {
382 				fatal_exit("PROXYv2 and DoQ combination not "
383 					"supported!");
384 			}
385 		}
386 		/* search for duplicates in the returned addresses */
387 		for(j=0; j<num_resif[i]; j++) {
388 			if(!extstrtoaddr(resif[i][j], &a, &alen, cfg->port)) {
389 				if(strcmp(cfg->ifs[i], resif[i][j]) != 0)
390 					fatal_exit("cannot parse interface address '%s' from the interface specified as '%s'",
391 						resif[i][j], cfg->ifs[i]);
392 				else
393 					fatal_exit("cannot parse interface specified as '%s'",
394 						cfg->ifs[i]);
395 			}
396 			for(i2=0; i2<i; i2++) {
397 				for(j2=0; j2<num_resif[i2]; j2++) {
398 					if(strcmp(resif[i][j], resif[i2][j2])
399 						== 0) {
400 						char info1[1024], info2[1024];
401 						if(strcmp(cfg->ifs[i], resif[i][j]) != 0)
402 							snprintf(info1, sizeof(info1), "address %s from interface: %s", resif[i][j], cfg->ifs[i]);
403 						else	snprintf(info1, sizeof(info1), "interface: %s", cfg->ifs[i]);
404 						if(strcmp(cfg->ifs[i2], resif[i2][j2]) != 0)
405 							snprintf(info2, sizeof(info2), "address %s from interface: %s", resif[i2][j2], cfg->ifs[i2]);
406 						else	snprintf(info2, sizeof(info2), "interface: %s", cfg->ifs[i2]);
407 						fatal_exit("%s present twice, cannot bind the same ports twice. The first entry is %s and the second is %s", resif[i][j], info2, info1);
408 					}
409 				}
410 			}
411 		}
412 	}
413 
414 	for(i=0; i<cfg->num_ifs; i++) {
415 		config_del_strarray(resif[i], num_resif[i]);
416 	}
417 	free(resif);
418 	free(num_resif);
419 
420 	for(i=0; i<cfg->num_out_ifs; i++) {
421 		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen) &&
422 		   !netblockstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen, &d)) {
423 			fatal_exit("cannot parse outgoing-interface "
424 				"specified as '%s'", cfg->out_ifs[i]);
425 		}
426 		for(j=0; j<cfg->num_out_ifs; j++) {
427 			if(i!=j && strcmp(cfg->out_ifs[i], cfg->out_ifs[j])==0)
428 				fatal_exit("outgoing-interface: %s present "
429 					"twice, cannot bind same ports twice.",
430 					cfg->out_ifs[i]);
431 		}
432 	}
433 }
434 
435 /** check interface-automatic-ports */
436 static void
ifautomaticportschecks(char * ifautomaticports)437 ifautomaticportschecks(char* ifautomaticports)
438 {
439 	char* now = ifautomaticports;
440 	while(now && *now) {
441 		char* after;
442 		int extraport;
443 		while(isspace((unsigned char)*now))
444 			now++;
445 		if(!*now)
446 			break;
447 		after = now;
448 		extraport = (int)strtol(now, &after, 10);
449 		if(extraport < 0 || extraport > 65535)
450 			fatal_exit("interface-automatic-ports: port out of range at position %d in '%s'", (int)(now-ifautomaticports)+1, ifautomaticports);
451 		if(extraport == 0 && now == after)
452 			fatal_exit("interface-automatic-ports: parse error at position %d in '%s'", (int)(now-ifautomaticports)+1, ifautomaticports);
453 		now = after;
454 	}
455 }
456 
457 /** check control interface strings */
458 static void
controlinterfacechecks(struct config_file * cfg)459 controlinterfacechecks(struct config_file* cfg)
460 {
461 	struct config_strlist* p;
462 	for(p = cfg->control_ifs.first; p; p = p->next) {
463 		struct sockaddr_storage a;
464 		socklen_t alen;
465 		char** rcif = NULL;
466 		int i, num_rcif = 0;
467 		/* See if it is a local socket, starts with a '/'. */
468 		if(p->str && p->str[0] == '/')
469 			continue;
470 		if(!resolve_interface_names(&p->str, 1, NULL, &rcif,
471 			&num_rcif)) {
472 			fatal_exit("could not resolve interface names, for control-interface: %s",
473 				p->str);
474 		}
475 		for(i=0; i<num_rcif; i++) {
476 			if(!extstrtoaddr(rcif[i], &a, &alen,
477 				cfg->control_port)) {
478 				if(strcmp(p->str, rcif[i])!=0)
479 					fatal_exit("cannot parse control-interface address '%s' from the control-interface specified as '%s'",
480 						rcif[i], p->str);
481 				else
482 					fatal_exit("cannot parse control-interface specified as '%s'",
483 						p->str);
484 			}
485 		}
486 		config_del_strarray(rcif, num_rcif);
487 	}
488 }
489 
490 /** check acl ips */
491 static void
aclchecks(struct config_file * cfg)492 aclchecks(struct config_file* cfg)
493 {
494 	int d;
495 	struct sockaddr_storage a;
496 	socklen_t alen;
497 	struct config_str2list* acl;
498 	for(acl=cfg->acls; acl; acl = acl->next) {
499 		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
500 			&d)) {
501 			fatal_exit("cannot parse access control address %s %s",
502 				acl->str, acl->str2);
503 		}
504 	}
505 }
506 
507 /** check tcp connection limit ips */
508 static void
tcpconnlimitchecks(struct config_file * cfg)509 tcpconnlimitchecks(struct config_file* cfg)
510 {
511 	int d;
512 	struct sockaddr_storage a;
513 	socklen_t alen;
514 	struct config_str2list* tcl;
515 	for(tcl=cfg->tcp_connection_limits; tcl; tcl = tcl->next) {
516 		if(!netblockstrtoaddr(tcl->str, UNBOUND_DNS_PORT, &a, &alen,
517 			&d)) {
518 			fatal_exit("cannot parse tcp connection limit address %s %s",
519 				tcl->str, tcl->str2);
520 		}
521 	}
522 }
523 
524 /** true if fname is a file */
525 static int
is_file(const char * fname)526 is_file(const char* fname)
527 {
528 	struct stat buf;
529 	if(stat(fname, &buf) < 0) {
530 		if(errno==EACCES) {
531 			printf("warning: no search permission for one of the directories in path: %s\n", fname);
532 			return 1;
533 		}
534 		perror(fname);
535 		return 0;
536 	}
537 	if(S_ISDIR(buf.st_mode)) {
538 		printf("%s is not a file\n", fname);
539 		return 0;
540 	}
541 	return 1;
542 }
543 
544 /** true if fname is a directory */
545 static int
is_dir(const char * fname)546 is_dir(const char* fname)
547 {
548 	struct stat buf;
549 	if(stat(fname, &buf) < 0) {
550 		if(errno==EACCES) {
551 			printf("warning: no search permission for one of the directories in path: %s\n", fname);
552 			return 1;
553 		}
554 		perror(fname);
555 		return 0;
556 	}
557 	if(!(S_ISDIR(buf.st_mode))) {
558 		printf("%s is not a directory\n", fname);
559 		return 0;
560 	}
561 	return 1;
562 }
563 
564 /** get base dir of a fname */
565 static char*
basedir(char * fname)566 basedir(char* fname)
567 {
568 	char* rev;
569 	if(!fname) fatal_exit("out of memory");
570 	rev = strrchr(fname, '/');
571 	if(!rev) return NULL;
572 	if(fname == rev) return NULL;
573 	rev[0] = 0;
574 	return fname;
575 }
576 
577 /** check chroot for a file string */
578 static void
check_chroot_string(const char * desc,char ** ss,const char * chrootdir,struct config_file * cfg)579 check_chroot_string(const char* desc, char** ss,
580 	const char* chrootdir, struct config_file* cfg)
581 {
582 	char* str = *ss;
583 	if(str && str[0]) {
584 		*ss = fname_after_chroot(str, cfg, 1);
585 		if(!*ss) fatal_exit("out of memory");
586 		if(!is_file(*ss)) {
587 			if(chrootdir && chrootdir[0])
588 				fatal_exit("%s: \"%s\" does not exist in "
589 					"chrootdir %s", desc, str, chrootdir);
590 			else
591 				fatal_exit("%s: \"%s\" does not exist",
592 					desc, str);
593 		}
594 		/* put in a new full path for continued checking */
595 		free(str);
596 	}
597 }
598 
599 /** check file list, every file must be inside the chroot location */
600 static void
check_chroot_filelist(const char * desc,struct config_strlist * list,const char * chrootdir,struct config_file * cfg)601 check_chroot_filelist(const char* desc, struct config_strlist* list,
602 	const char* chrootdir, struct config_file* cfg)
603 {
604 	struct config_strlist* p;
605 	for(p=list; p; p=p->next) {
606 		check_chroot_string(desc, &p->str, chrootdir, cfg);
607 	}
608 }
609 
610 /** check file list, with wildcard processing */
611 static void
check_chroot_filelist_wild(const char * desc,struct config_strlist * list,const char * chrootdir,struct config_file * cfg)612 check_chroot_filelist_wild(const char* desc, struct config_strlist* list,
613 	const char* chrootdir, struct config_file* cfg)
614 {
615 	struct config_strlist* p;
616 	for(p=list; p; p=p->next) {
617 #ifdef HAVE_GLOB
618 		if(strchr(p->str, '*') || strchr(p->str, '[') ||
619 			strchr(p->str, '?') || strchr(p->str, '{') ||
620 			strchr(p->str, '~')) {
621 			char* s = p->str;
622 			/* adjust whole pattern for chroot and check later */
623 			p->str = fname_after_chroot(p->str, cfg, 1);
624 			free(s);
625 		} else
626 #endif /* HAVE_GLOB */
627 			check_chroot_string(desc, &p->str, chrootdir, cfg);
628 	}
629 }
630 
631 #ifdef CLIENT_SUBNET
632 /** check ECS configuration */
633 static void
ecs_conf_checks(struct config_file * cfg)634 ecs_conf_checks(struct config_file* cfg)
635 {
636 	struct ecs_whitelist* whitelist = NULL;
637 	if(!(whitelist = ecs_whitelist_create()))
638 		fatal_exit("Could not create ednssubnet whitelist: out of memory");
639         if(!ecs_whitelist_apply_cfg(whitelist, cfg))
640 		fatal_exit("Could not setup ednssubnet whitelist");
641 	ecs_whitelist_delete(whitelist);
642 }
643 #endif /* CLIENT_SUBNET */
644 
645 /** check that the modules exist, are compiled in */
646 static void
check_modules_exist(const char * module_conf)647 check_modules_exist(const char* module_conf)
648 {
649 	const char** names = module_list_avail();
650 	const char* s = module_conf;
651 	while(*s) {
652 		int i = 0;
653 		int is_ok = 0;
654 		while(*s && isspace((unsigned char)*s))
655 			s++;
656 		if(!*s) break;
657 		while(names[i]) {
658 			if(strncmp(names[i], s, strlen(names[i])) == 0) {
659 				is_ok = 1;
660 				break;
661 			}
662 			i++;
663 		}
664 		if(is_ok == 0) {
665 			char n[64];
666 			size_t j;
667 			n[0]=0;
668 			n[sizeof(n)-1]=0;
669 			for(j=0; j<sizeof(n)-1; j++) {
670 				if(!s[j] || isspace((unsigned char)s[j])) {
671 					n[j] = 0;
672 					break;
673 				}
674 				n[j] = s[j];
675 			}
676 			fatal_exit("Unknown value in module-config, module: "
677 				"'%s'. This module is not present (not "
678 				"compiled in); see the list of linked modules "
679 				"with unbound -V", n);
680 		}
681 		s += strlen(names[i]);
682 	}
683 }
684 
685 /** check configuration for errors */
686 static void
morechecks(struct config_file * cfg)687 morechecks(struct config_file* cfg)
688 {
689 	warn_hosts("stub-host", cfg->stubs);
690 	warn_hosts("forward-host", cfg->forwards);
691 	interfacechecks(cfg);
692 	ifautomaticportschecks(cfg->if_automatic_ports);
693 	aclchecks(cfg);
694 	tcpconnlimitchecks(cfg);
695 
696 	if(cfg->verbosity < 0)
697 		fatal_exit("verbosity value < 0");
698 	if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
699 		fatal_exit("num_threads value weird");
700 	if(!cfg->do_ip4 && !cfg->do_ip6)
701 		fatal_exit("ip4 and ip6 are both disabled, pointless");
702 	if(!cfg->do_ip4 && cfg->prefer_ip4)
703 		fatal_exit("cannot prefer and disable ip4, pointless");
704 	if(!cfg->do_ip6 && cfg->prefer_ip6)
705 		fatal_exit("cannot prefer and disable ip6, pointless");
706 	if(!cfg->do_udp && !cfg->do_tcp)
707 		fatal_exit("udp and tcp are both disabled, pointless");
708 	if(cfg->edns_buffer_size > cfg->msg_buffer_size)
709 		fatal_exit("edns-buffer-size larger than msg-buffer-size, "
710 			"answers will not fit in processing buffer");
711 #ifdef UB_ON_WINDOWS
712 	w_config_adjust_directory(cfg);
713 #endif
714 	if(cfg->chrootdir && cfg->chrootdir[0] &&
715 		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
716 		fatal_exit("chootdir %s has trailing slash '/' please remove.",
717 			cfg->chrootdir);
718 	if(cfg->chrootdir && cfg->chrootdir[0] &&
719 		!is_dir(cfg->chrootdir)) {
720 		fatal_exit("bad chroot directory");
721 	}
722 	if(cfg->directory && cfg->directory[0]) {
723 		char* ad = fname_after_chroot(cfg->directory, cfg, 0);
724 		if(!ad) fatal_exit("out of memory");
725 		if(!is_dir(ad)) fatal_exit("bad chdir directory");
726 		free(ad);
727 	}
728 	if( (cfg->chrootdir && cfg->chrootdir[0]) ||
729 	    (cfg->directory && cfg->directory[0])) {
730 		if(cfg->pidfile && cfg->pidfile[0]) {
731 			char* ad = (cfg->pidfile[0]=='/')?strdup(cfg->pidfile):
732 				fname_after_chroot(cfg->pidfile, cfg, 1);
733 			char* bd = basedir(ad);
734 			if(bd && !is_dir(bd))
735 				fatal_exit("pidfile directory does not exist");
736 			free(ad);
737 		}
738 		if(cfg->logfile && cfg->logfile[0]) {
739 			char* ad = fname_after_chroot(cfg->logfile, cfg, 1);
740 			char* bd = basedir(ad);
741 			if(bd && !is_dir(bd))
742 				fatal_exit("logfile directory does not exist");
743 			free(ad);
744 		}
745 	}
746 
747 	check_chroot_filelist("file with root-hints",
748 		cfg->root_hints, cfg->chrootdir, cfg);
749 	check_chroot_filelist("trust-anchor-file",
750 		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
751 	check_chroot_filelist("auto-trust-anchor-file",
752 		cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
753 	check_chroot_filelist_wild("trusted-keys-file",
754 		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
755 	if(cfg->disable_edns_do && strstr(cfg->module_conf, "validator")
756 		&& (cfg->trust_anchor_file_list
757 		|| cfg->trust_anchor_list
758 		|| cfg->auto_trust_anchor_file_list
759 		|| cfg->trusted_keys_file_list)) {
760 		char* key = NULL;
761 		if(cfg->auto_trust_anchor_file_list)
762 			key = cfg->auto_trust_anchor_file_list->str;
763 		if(!key && cfg->trust_anchor_file_list)
764 			key = cfg->trust_anchor_file_list->str;
765 		if(!key && cfg->trust_anchor_list)
766 			key = cfg->trust_anchor_list->str;
767 		if(!key && cfg->trusted_keys_file_list)
768 			key = cfg->trusted_keys_file_list->str;
769 		if(!key) key = "";
770 		fatal_exit("disable-edns-do does not allow DNSSEC to work, but the validator module uses a trust anchor %s, turn off disable-edns-do or disable validation", key);
771 	}
772 #ifdef USE_IPSECMOD
773 	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
774 		/* only check hook if enabled */
775 		check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
776 			cfg->chrootdir, cfg);
777 	}
778 #endif
779 	/* remove chroot setting so that modules are not stripping pathnames */
780 	free(cfg->chrootdir);
781 	cfg->chrootdir = NULL;
782 
783 	/* check that the modules listed in module_conf exist */
784 	check_modules_exist(cfg->module_conf);
785 
786 	/* Respip is known to *not* work with dns64. */
787 	if(strcmp(cfg->module_conf, "iterator") != 0
788 		&& strcmp(cfg->module_conf, "validator iterator") != 0
789 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
790 		&& strcmp(cfg->module_conf, "dns64 iterator") != 0
791 		&& strcmp(cfg->module_conf, "respip iterator") != 0
792 		&& strcmp(cfg->module_conf, "respip validator iterator") != 0
793 		&& strcmp(cfg->module_conf, "respip dns64 validator iterator") != 0
794 		&& strcmp(cfg->module_conf, "respip dns64 iterator") != 0
795 #ifdef WITH_PYTHONMODULE
796 		&& strcmp(cfg->module_conf, "python iterator") != 0
797 		&& strcmp(cfg->module_conf, "python respip iterator") != 0
798 		&& strcmp(cfg->module_conf, "python validator iterator") != 0
799 		&& strcmp(cfg->module_conf, "python respip validator iterator") != 0
800 		&& strcmp(cfg->module_conf, "validator python iterator") != 0
801 		&& strcmp(cfg->module_conf, "dns64 python iterator") != 0
802 		&& strcmp(cfg->module_conf, "dns64 python validator iterator") != 0
803 		&& strcmp(cfg->module_conf, "dns64 validator python iterator") != 0
804 		&& strcmp(cfg->module_conf, "python dns64 iterator") != 0
805 		&& strcmp(cfg->module_conf, "python dns64 validator iterator") != 0
806 #endif
807 #ifdef WITH_DYNLIBMODULE
808 		&& strcmp(cfg->module_conf, "dynlib iterator") != 0
809 		&& strcmp(cfg->module_conf, "dynlib dynlib iterator") != 0
810 		&& strcmp(cfg->module_conf, "dynlib dynlib dynlib iterator") != 0
811 		&& strcmp(cfg->module_conf, "python dynlib iterator") != 0
812 		&& strcmp(cfg->module_conf, "python dynlib dynlib iterator") != 0
813 		&& strcmp(cfg->module_conf, "python dynlib dynlib dynlib iterator") != 0
814 		&& strcmp(cfg->module_conf, "dynlib respip iterator") != 0
815 		&& strcmp(cfg->module_conf, "dynlib validator iterator") != 0
816 		&& strcmp(cfg->module_conf, "dynlib dynlib validator iterator") != 0
817 		&& strcmp(cfg->module_conf, "dynlib dynlib dynlib validator iterator") != 0
818 		&& strcmp(cfg->module_conf, "python dynlib validator iterator") != 0
819 		&& strcmp(cfg->module_conf, "python dynlib dynlib validator iterator") != 0
820 		&& strcmp(cfg->module_conf, "python dynlib dynlib dynlib validator iterator") != 0
821 		&& strcmp(cfg->module_conf, "dynlib respip validator iterator") != 0
822 		&& strcmp(cfg->module_conf, "validator dynlib iterator") != 0
823 		&& strcmp(cfg->module_conf, "dns64 dynlib iterator") != 0
824 		&& strcmp(cfg->module_conf, "dns64 dynlib validator iterator") != 0
825 		&& strcmp(cfg->module_conf, "dns64 validator dynlib iterator") != 0
826 		&& strcmp(cfg->module_conf, "dynlib dns64 iterator") != 0
827 		&& strcmp(cfg->module_conf, "dynlib dns64 validator iterator") != 0
828 		&& strcmp(cfg->module_conf, "dynlib dns64 cachedb iterator") != 0
829 		&& strcmp(cfg->module_conf, "dynlib dns64 validator cachedb iterator") != 0
830 		&& strcmp(cfg->module_conf, "dns64 dynlib cachedb iterator") != 0
831 		&& strcmp(cfg->module_conf, "dns64 dynlib validator cachedb iterator") != 0
832 		&& strcmp(cfg->module_conf, "dynlib cachedb iterator") != 0
833 		&& strcmp(cfg->module_conf, "dynlib respip cachedb iterator") != 0
834 		&& strcmp(cfg->module_conf, "dynlib validator cachedb iterator") != 0
835 		&& strcmp(cfg->module_conf, "dynlib respip validator cachedb iterator") != 0
836 		&& strcmp(cfg->module_conf, "cachedb dynlib iterator") != 0
837 		&& strcmp(cfg->module_conf, "respip cachedb dynlib iterator") != 0
838 		&& strcmp(cfg->module_conf, "validator cachedb dynlib iterator") != 0
839 		&& strcmp(cfg->module_conf, "respip validator cachedb dynlib iterator") != 0
840 		&& strcmp(cfg->module_conf, "validator dynlib cachedb iterator") != 0
841 		&& strcmp(cfg->module_conf, "respip validator dynlib cachedb iterator") != 0
842 		&& strcmp(cfg->module_conf, "dynlib subnetcache iterator") != 0
843 		&& strcmp(cfg->module_conf, "dynlib respip subnetcache iterator") != 0
844 		&& strcmp(cfg->module_conf, "subnetcache dynlib iterator") != 0
845 		&& strcmp(cfg->module_conf, "respip subnetcache dynlib iterator") != 0
846 		&& strcmp(cfg->module_conf, "dynlib subnetcache validator iterator") != 0
847 		&& strcmp(cfg->module_conf, "dynlib respip subnetcache validator iterator") != 0
848 		&& strcmp(cfg->module_conf, "subnetcache dynlib validator iterator") != 0
849 		&& strcmp(cfg->module_conf, "respip subnetcache dynlib validator iterator") != 0
850 		&& strcmp(cfg->module_conf, "subnetcache validator dynlib iterator") != 0
851 		&& strcmp(cfg->module_conf, "respip subnetcache validator dynlib iterator") != 0
852 		&& strcmp(cfg->module_conf, "dynlib ipsecmod iterator") != 0
853 		&& strcmp(cfg->module_conf, "dynlib ipsecmod respip iterator") != 0
854 		&& strcmp(cfg->module_conf, "ipsecmod dynlib iterator") != 0
855 		&& strcmp(cfg->module_conf, "ipsecmod dynlib respip iterator") != 0
856 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
857 		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
858 		&& strcmp(cfg->module_conf, "dynlib ipsecmod validator iterator") != 0
859 		&& strcmp(cfg->module_conf, "dynlib ipsecmod respip validator iterator") != 0
860 		&& strcmp(cfg->module_conf, "ipsecmod dynlib validator iterator") != 0
861 		&& strcmp(cfg->module_conf, "ipsecmod dynlib respip validator iterator") != 0
862 		&& strcmp(cfg->module_conf, "ipsecmod validator dynlib iterator") != 0
863 		&& strcmp(cfg->module_conf, "ipsecmod respip validator dynlib iterator") != 0
864 #endif
865 #ifdef USE_CACHEDB
866 		&& strcmp(cfg->module_conf, "validator cachedb iterator") != 0
867 		&& strcmp(cfg->module_conf, "respip validator cachedb iterator") != 0
868 		&& strcmp(cfg->module_conf, "cachedb iterator") != 0
869 		&& strcmp(cfg->module_conf, "respip cachedb iterator") != 0
870 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
871 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
872 #endif
873 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
874 		&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
875 		&& strcmp(cfg->module_conf, "python dns64 validator cachedb iterator") != 0
876 		&& strcmp(cfg->module_conf, "dns64 python cachedb iterator") != 0
877 		&& strcmp(cfg->module_conf, "dns64 python validator cachedb iterator") != 0
878 		&& strcmp(cfg->module_conf, "python cachedb iterator") != 0
879 		&& strcmp(cfg->module_conf, "python respip cachedb iterator") != 0
880 		&& strcmp(cfg->module_conf, "python validator cachedb iterator") != 0
881 		&& strcmp(cfg->module_conf, "python respip validator cachedb iterator") != 0
882 		&& strcmp(cfg->module_conf, "cachedb python iterator") != 0
883 		&& strcmp(cfg->module_conf, "respip cachedb python iterator") != 0
884 		&& strcmp(cfg->module_conf, "validator cachedb python iterator") != 0
885 		&& strcmp(cfg->module_conf, "respip validator cachedb python iterator") != 0
886 		&& strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
887 		&& strcmp(cfg->module_conf, "respip validator python cachedb iterator") != 0
888 #endif
889 #if defined(CLIENT_SUBNET) && defined(USE_CACHEDB)
890 		&& strcmp(cfg->module_conf, "respip subnetcache validator cachedb iterator") != 0
891 		&& strcmp(cfg->module_conf, "subnetcache validator cachedb iterator") != 0
892 #endif
893 #ifdef CLIENT_SUBNET
894 		&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
895 		&& strcmp(cfg->module_conf, "respip subnetcache iterator") != 0
896 		&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
897 		&& strcmp(cfg->module_conf, "respip subnetcache validator iterator") != 0
898 		&& strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
899 		&& strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
900 		&& strcmp(cfg->module_conf, "dns64 subnetcache respip iterator") != 0
901 		&& strcmp(cfg->module_conf, "dns64 subnetcache respip validator iterator") != 0
902 #endif
903 #if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
904 		&& strcmp(cfg->module_conf, "python subnetcache iterator") != 0
905 		&& strcmp(cfg->module_conf, "python respip subnetcache iterator") != 0
906 		&& strcmp(cfg->module_conf, "subnetcache python iterator") != 0
907 		&& strcmp(cfg->module_conf, "respip subnetcache python iterator") != 0
908 		&& strcmp(cfg->module_conf, "python subnetcache validator iterator") != 0
909 		&& strcmp(cfg->module_conf, "python respip subnetcache validator iterator") != 0
910 		&& strcmp(cfg->module_conf, "subnetcache python validator iterator") != 0
911 		&& strcmp(cfg->module_conf, "respip subnetcache python validator iterator") != 0
912 		&& strcmp(cfg->module_conf, "subnetcache validator python iterator") != 0
913 		&& strcmp(cfg->module_conf, "respip subnetcache validator python iterator") != 0
914 #endif
915 #ifdef USE_IPSECMOD
916 		&& strcmp(cfg->module_conf, "ipsecmod iterator") != 0
917 		&& strcmp(cfg->module_conf, "ipsecmod respip iterator") != 0
918 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
919 		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
920 #endif
921 #if defined(WITH_PYTHONMODULE) && defined(USE_IPSECMOD)
922 		&& strcmp(cfg->module_conf, "python ipsecmod iterator") != 0
923 		&& strcmp(cfg->module_conf, "python ipsecmod respip iterator") != 0
924 		&& strcmp(cfg->module_conf, "ipsecmod python iterator") != 0
925 		&& strcmp(cfg->module_conf, "ipsecmod python respip iterator") != 0
926 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
927 		&& strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
928 		&& strcmp(cfg->module_conf, "python ipsecmod validator iterator") != 0
929 		&& strcmp(cfg->module_conf, "python ipsecmod respip validator iterator") != 0
930 		&& strcmp(cfg->module_conf, "ipsecmod python validator iterator") != 0
931 		&& strcmp(cfg->module_conf, "ipsecmod python respip validator iterator") != 0
932 		&& strcmp(cfg->module_conf, "ipsecmod validator python iterator") != 0
933 		&& strcmp(cfg->module_conf, "ipsecmod respip validator python iterator") != 0
934 #endif
935 #ifdef USE_IPSET
936 		&& strcmp(cfg->module_conf, "validator ipset iterator") != 0
937 		&& strcmp(cfg->module_conf, "validator ipset respip iterator") != 0
938 		&& strcmp(cfg->module_conf, "ipset iterator") != 0
939 		&& strcmp(cfg->module_conf, "ipset respip iterator") != 0
940 #endif
941 		) {
942 		fatal_exit("module conf '%s' is not known to work",
943 			cfg->module_conf);
944 	}
945 
946 #ifdef HAVE_GETPWNAM
947 	if(cfg->username && cfg->username[0]) {
948 		if(getpwnam(cfg->username) == NULL)
949 			fatal_exit("user '%s' does not exist.", cfg->username);
950 #  ifdef HAVE_ENDPWENT
951 		endpwent();
952 #  endif
953 	}
954 #endif
955 	if(cfg->remote_control_enable && options_remote_is_address(cfg)
956 		&& cfg->control_use_cert) {
957 		check_chroot_string("server-key-file", &cfg->server_key_file,
958 			cfg->chrootdir, cfg);
959 		check_chroot_string("server-cert-file", &cfg->server_cert_file,
960 			cfg->chrootdir, cfg);
961 		if(!is_file(cfg->control_key_file))
962 			fatal_exit("control-key-file: \"%s\" does not exist",
963 				cfg->control_key_file);
964 		if(!is_file(cfg->control_cert_file))
965 			fatal_exit("control-cert-file: \"%s\" does not exist",
966 				cfg->control_cert_file);
967 	}
968 	if(cfg->remote_control_enable)
969 		controlinterfacechecks(cfg);
970 
971 	donotquerylocalhostcheck(cfg);
972 	localzonechecks(cfg);
973 	view_and_respipchecks(cfg);
974 #ifdef CLIENT_SUBNET
975 	ecs_conf_checks(cfg);
976 #endif
977 }
978 
979 /** check forwards */
980 static void
check_fwd(struct config_file * cfg)981 check_fwd(struct config_file* cfg)
982 {
983 	struct iter_forwards* fwd = forwards_create();
984 	if(!fwd || !forwards_apply_cfg(fwd, cfg)) {
985 		fatal_exit("Could not set forward zones");
986 	}
987 	forwards_delete(fwd);
988 }
989 
990 /** check hints */
991 static void
check_hints(struct config_file * cfg)992 check_hints(struct config_file* cfg)
993 {
994 	struct iter_hints* hints = hints_create();
995 	if(!hints || !hints_apply_cfg(hints, cfg)) {
996 		fatal_exit("Could not set root or stub hints");
997 	}
998 	hints_delete(hints);
999 }
1000 
1001 /** check auth zones */
1002 static void
check_auth(struct config_file * cfg)1003 check_auth(struct config_file* cfg)
1004 {
1005 	int is_rpz = 0;
1006 	struct auth_zones* az = auth_zones_create();
1007 	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL)) {
1008 		fatal_exit("Could not setup authority zones");
1009 	}
1010 	if(is_rpz && !strstr(cfg->module_conf, "respip"))
1011 		fatal_exit("RPZ requires the respip module");
1012 	auth_zones_delete(az);
1013 }
1014 
1015 /** check config file */
1016 static void
checkconf(const char * cfgfile,const char * opt,int final,int quiet)1017 checkconf(const char* cfgfile, const char* opt, int final, int quiet)
1018 {
1019 	char oldwd[4096];
1020 	struct config_file* cfg = config_create();
1021 	if(!cfg)
1022 		fatal_exit("out of memory");
1023 	oldwd[0] = 0;
1024 	if(!getcwd(oldwd, sizeof(oldwd))) {
1025 		log_err("cannot getcwd: %s", strerror(errno));
1026 		oldwd[0] = 0;
1027 	}
1028 	if(!config_read(cfg, cfgfile, NULL)) {
1029 		/* config_read prints messages to stderr */
1030 		config_delete(cfg);
1031 		exit(1);
1032 	}
1033 	if(oldwd[0] && chdir(oldwd) == -1)
1034 		log_err("cannot chdir(%s): %s", oldwd, strerror(errno));
1035 	if(opt) {
1036 		print_option(cfg, opt, final);
1037 		config_delete(cfg);
1038 		return;
1039 	}
1040 	morechecks(cfg);
1041 	check_mod(cfg, iter_get_funcblock());
1042 	check_mod(cfg, val_get_funcblock());
1043 #ifdef WITH_PYTHONMODULE
1044 	if(strstr(cfg->module_conf, "python"))
1045 		check_mod(cfg, pythonmod_get_funcblock());
1046 #endif
1047 	check_fwd(cfg);
1048 	check_hints(cfg);
1049 	check_auth(cfg);
1050 	if(!quiet) { printf("unbound-checkconf: no errors in %s\n", cfgfile); }
1051 	config_delete(cfg);
1052 }
1053 
1054 /** getopt global, in case header files fail to declare it. */
1055 extern int optind;
1056 /** getopt global, in case header files fail to declare it. */
1057 extern char* optarg;
1058 
1059 /** Main routine for checkconf */
main(int argc,char * argv[])1060 int main(int argc, char* argv[])
1061 {
1062 	int c;
1063 	int final = 0;
1064 	int quiet = 0;
1065 	const char* f;
1066 	const char* opt = NULL;
1067 	const char* cfgfile = CONFIGFILE;
1068 	checklock_start();
1069 	log_ident_set("unbound-checkconf");
1070 	log_init(NULL, 0, NULL);
1071 #ifdef USE_WINSOCK
1072 	/* use registry config file in preference to compiletime location */
1073 	if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
1074 		cfgfile = CONFIGFILE;
1075 #endif /* USE_WINSOCK */
1076 	/* parse the options */
1077 	while( (c=getopt(argc, argv, "fhqo:")) != -1) {
1078 		switch(c) {
1079 		case 'f':
1080 			final = 1;
1081 			break;
1082 		case 'o':
1083 			opt = optarg;
1084 			break;
1085 		case 'q':
1086 			quiet = 1;
1087 			break;
1088 		case '?':
1089 		case 'h':
1090 		default:
1091 			usage();
1092 		}
1093 	}
1094 	argc -= optind;
1095 	argv += optind;
1096 	if(argc != 0 && argc != 1)
1097 		usage();
1098 	if(argc == 1)
1099 		f = argv[0];
1100 	else	f = cfgfile;
1101 	checkconf(f, opt, final, quiet);
1102 	checklock_stop();
1103 	return 0;
1104 }
1105