xref: /freebsd/contrib/unbound/smallapp/unbound-checkconf.c (revision 190cef3d52236565eb22e18b33e9e865ec634aa3)
1 /*
2  * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * The config checker checks for syntax and other errors in the unbound.conf
40  * file, and can be used to check for errors before the server is started
41  * or sigHUPped.
42  * Exit status 1 means an error.
43  */
44 
45 #include "config.h"
46 #include "util/log.h"
47 #include "util/config_file.h"
48 #include "util/module.h"
49 #include "util/net_help.h"
50 #include "util/regional.h"
51 #include "iterator/iterator.h"
52 #include "iterator/iter_fwd.h"
53 #include "iterator/iter_hints.h"
54 #include "validator/validator.h"
55 #include "services/localzone.h"
56 #include "services/view.h"
57 #include "services/authzone.h"
58 #include "respip/respip.h"
59 #include "sldns/sbuffer.h"
60 #ifdef HAVE_GETOPT_H
61 #include <getopt.h>
62 #endif
63 #ifdef HAVE_PWD_H
64 #include <pwd.h>
65 #endif
66 #ifdef HAVE_SYS_STAT_H
67 #include <sys/stat.h>
68 #endif
69 #ifdef HAVE_GLOB_H
70 #include <glob.h>
71 #endif
72 #ifdef WITH_PYTHONMODULE
73 #include "pythonmod/pythonmod.h"
74 #endif
75 #ifdef CLIENT_SUBNET
76 #include "edns-subnet/subnet-whitelist.h"
77 #endif
78 
79 /** Give checkconf usage, and exit (1). */
80 static void
81 usage(void)
82 {
83 	printf("Usage:	local-unbound-checkconf [file]\n");
84 	printf("	Checks unbound configuration file for errors.\n");
85 	printf("file	if omitted %s is used.\n", CONFIGFILE);
86 	printf("-o option	print value of option to stdout.\n");
87 	printf("-f 		output full pathname with chroot applied, eg. with -o pidfile.\n");
88 	printf("-h		show this usage help.\n");
89 	printf("Version %s\n", PACKAGE_VERSION);
90 	printf("BSD licensed, see LICENSE in source package for details.\n");
91 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
92 	exit(1);
93 }
94 
95 /**
96  * Print given option to stdout
97  * @param cfg: config
98  * @param opt: option name without trailing :.
99  *	This is different from config_set_option.
100  * @param final: if final pathname with chroot applied has to be printed.
101  */
102 static void
103 print_option(struct config_file* cfg, const char* opt, int final)
104 {
105 	if(strcmp(opt, "pidfile") == 0 && final) {
106 		char *p = fname_after_chroot(cfg->pidfile, cfg, 1);
107 		if(!p) fatal_exit("out of memory");
108 		printf("%s\n", p);
109 		free(p);
110 		return;
111 	}
112 	if(strcmp(opt, "auto-trust-anchor-file") == 0 && final) {
113 		struct config_strlist* s = cfg->auto_trust_anchor_file_list;
114 		for(; s; s=s->next) {
115 			char *p = fname_after_chroot(s->str, cfg, 1);
116 			if(!p) fatal_exit("out of memory");
117 			printf("%s\n", p);
118 			free(p);
119 		}
120 		return;
121 	}
122 	if(!config_get_option(cfg, opt, config_print_func, stdout))
123 		fatal_exit("cannot print option '%s'", opt);
124 }
125 
126 /** check if module works with config */
127 static void
128 check_mod(struct config_file* cfg, struct module_func_block* fb)
129 {
130 	struct module_env env;
131 	memset(&env, 0, sizeof(env));
132 	env.cfg = cfg;
133 	env.scratch = regional_create();
134 	env.scratch_buffer = sldns_buffer_new(BUFSIZ);
135 	if(!env.scratch || !env.scratch_buffer)
136 		fatal_exit("out of memory");
137 	if(!edns_known_options_init(&env))
138 		fatal_exit("out of memory");
139 	if(!(*fb->init)(&env, 0)) {
140 		fatal_exit("bad config for %s module", fb->name);
141 	}
142 	(*fb->deinit)(&env, 0);
143 	sldns_buffer_free(env.scratch_buffer);
144 	regional_destroy(env.scratch);
145 	edns_known_options_delete(&env);
146 }
147 
148 /** check localzones */
149 static void
150 localzonechecks(struct config_file* cfg)
151 {
152 	struct local_zones* zs;
153 	if(!(zs = local_zones_create()))
154 		fatal_exit("out of memory");
155 	if(!local_zones_apply_cfg(zs, cfg))
156 		fatal_exit("failed local-zone, local-data configuration");
157 	local_zones_delete(zs);
158 }
159 
160 /** check view and response-ip configuration */
161 static void
162 view_and_respipchecks(struct config_file* cfg)
163 {
164 	struct views* views = NULL;
165 	struct respip_set* respip = NULL;
166 	int ignored = 0;
167 	if(!(views = views_create()))
168 		fatal_exit("Could not create views: out of memory");
169 	if(!(respip = respip_set_create()))
170 		fatal_exit("Could not create respip set: out of memory");
171 	if(!views_apply_cfg(views, cfg))
172 		fatal_exit("Could not set up views");
173 	if(!respip_global_apply_cfg(respip, cfg))
174 		fatal_exit("Could not setup respip set");
175 	if(!respip_views_apply_cfg(views, cfg, &ignored))
176 		fatal_exit("Could not setup per-view respip sets");
177 	views_delete(views);
178 	respip_set_delete(respip);
179 }
180 
181 /** emit warnings for IP in hosts */
182 static void
183 warn_hosts(const char* typ, struct config_stub* list)
184 {
185 	struct sockaddr_storage a;
186 	socklen_t alen;
187 	struct config_stub* s;
188 	struct config_strlist* h;
189 	for(s=list; s; s=s->next) {
190 		for(h=s->hosts; h; h=h->next) {
191 			if(extstrtoaddr(h->str, &a, &alen)) {
192 				fprintf(stderr, "unbound-checkconf: warning:"
193 				  " %s %s: \"%s\" is an IP%s address, "
194 				  "and when looked up as a host name "
195 				  "during use may not resolve.\n",
196 				  s->name, typ, h->str,
197 				  addr_is_ip6(&a, alen)?"6":"4");
198 			}
199 		}
200 	}
201 }
202 
203 /** check interface strings */
204 static void
205 interfacechecks(struct config_file* cfg)
206 {
207 	int d;
208 	struct sockaddr_storage a;
209 	socklen_t alen;
210 	int i, j;
211 	for(i=0; i<cfg->num_ifs; i++) {
212 		if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
213 			fatal_exit("cannot parse interface specified as '%s'",
214 				cfg->ifs[i]);
215 		}
216 		for(j=0; j<cfg->num_ifs; j++) {
217 			if(i!=j && strcmp(cfg->ifs[i], cfg->ifs[j])==0)
218 				fatal_exit("interface: %s present twice, "
219 					"cannot bind same ports twice.",
220 					cfg->ifs[i]);
221 		}
222 	}
223 	for(i=0; i<cfg->num_out_ifs; i++) {
224 		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen) &&
225 		   !netblockstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen, &d)) {
226 			fatal_exit("cannot parse outgoing-interface "
227 				"specified as '%s'", cfg->out_ifs[i]);
228 		}
229 		for(j=0; j<cfg->num_out_ifs; j++) {
230 			if(i!=j && strcmp(cfg->out_ifs[i], cfg->out_ifs[j])==0)
231 				fatal_exit("outgoing-interface: %s present "
232 					"twice, cannot bind same ports twice.",
233 					cfg->out_ifs[i]);
234 		}
235 	}
236 }
237 
238 /** check acl ips */
239 static void
240 aclchecks(struct config_file* cfg)
241 {
242 	int d;
243 	struct sockaddr_storage a;
244 	socklen_t alen;
245 	struct config_str2list* acl;
246 	for(acl=cfg->acls; acl; acl = acl->next) {
247 		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
248 			&d)) {
249 			fatal_exit("cannot parse access control address %s %s",
250 				acl->str, acl->str2);
251 		}
252 	}
253 }
254 
255 /** true if fname is a file */
256 static int
257 is_file(const char* fname)
258 {
259 	struct stat buf;
260 	if(stat(fname, &buf) < 0) {
261 		if(errno==EACCES) {
262 			printf("warning: no search permission for one of the directories in path: %s\n", fname);
263 			return 1;
264 		}
265 		perror(fname);
266 		return 0;
267 	}
268 	if(S_ISDIR(buf.st_mode)) {
269 		printf("%s is not a file\n", fname);
270 		return 0;
271 	}
272 	return 1;
273 }
274 
275 /** true if fname is a directory */
276 static int
277 is_dir(const char* fname)
278 {
279 	struct stat buf;
280 	if(stat(fname, &buf) < 0) {
281 		if(errno==EACCES) {
282 			printf("warning: no search permission for one of the directories in path: %s\n", fname);
283 			return 1;
284 		}
285 		perror(fname);
286 		return 0;
287 	}
288 	if(!(S_ISDIR(buf.st_mode))) {
289 		printf("%s is not a directory\n", fname);
290 		return 0;
291 	}
292 	return 1;
293 }
294 
295 /** get base dir of a fname */
296 static char*
297 basedir(char* fname)
298 {
299 	char* rev;
300 	if(!fname) fatal_exit("out of memory");
301 	rev = strrchr(fname, '/');
302 	if(!rev) return NULL;
303 	if(fname == rev) return NULL;
304 	rev[0] = 0;
305 	return fname;
306 }
307 
308 /** check chroot for a file string */
309 static void
310 check_chroot_string(const char* desc, char** ss,
311 	const char* chrootdir, struct config_file* cfg)
312 {
313 	char* str = *ss;
314 	if(str && str[0]) {
315 		*ss = fname_after_chroot(str, cfg, 1);
316 		if(!*ss) fatal_exit("out of memory");
317 		if(!is_file(*ss)) {
318 			if(chrootdir && chrootdir[0])
319 				fatal_exit("%s: \"%s\" does not exist in "
320 					"chrootdir %s", desc, str, chrootdir);
321 			else
322 				fatal_exit("%s: \"%s\" does not exist",
323 					desc, str);
324 		}
325 		/* put in a new full path for continued checking */
326 		free(str);
327 	}
328 }
329 
330 /** check file list, every file must be inside the chroot location */
331 static void
332 check_chroot_filelist(const char* desc, struct config_strlist* list,
333 	const char* chrootdir, struct config_file* cfg)
334 {
335 	struct config_strlist* p;
336 	for(p=list; p; p=p->next) {
337 		check_chroot_string(desc, &p->str, chrootdir, cfg);
338 	}
339 }
340 
341 /** check file list, with wildcard processing */
342 static void
343 check_chroot_filelist_wild(const char* desc, struct config_strlist* list,
344 	const char* chrootdir, struct config_file* cfg)
345 {
346 	struct config_strlist* p;
347 	for(p=list; p; p=p->next) {
348 #ifdef HAVE_GLOB
349 		if(strchr(p->str, '*') || strchr(p->str, '[') ||
350 			strchr(p->str, '?') || strchr(p->str, '{') ||
351 			strchr(p->str, '~')) {
352 			char* s = p->str;
353 			/* adjust whole pattern for chroot and check later */
354 			p->str = fname_after_chroot(p->str, cfg, 1);
355 			free(s);
356 		} else
357 #endif /* HAVE_GLOB */
358 			check_chroot_string(desc, &p->str, chrootdir, cfg);
359 	}
360 }
361 
362 #ifdef CLIENT_SUBNET
363 /** check ECS configuration */
364 static void
365 ecs_conf_checks(struct config_file* cfg)
366 {
367 	struct ecs_whitelist* whitelist = NULL;
368 	if(!(whitelist = ecs_whitelist_create()))
369 		fatal_exit("Could not create ednssubnet whitelist: out of memory");
370         if(!ecs_whitelist_apply_cfg(whitelist, cfg))
371 		fatal_exit("Could not setup ednssubnet whitelist");
372 	ecs_whitelist_delete(whitelist);
373 }
374 #endif /* CLIENT_SUBNET */
375 
376 /** check configuration for errors */
377 static void
378 morechecks(struct config_file* cfg, const char* fname)
379 {
380 	warn_hosts("stub-host", cfg->stubs);
381 	warn_hosts("forward-host", cfg->forwards);
382 	interfacechecks(cfg);
383 	aclchecks(cfg);
384 
385 	if(cfg->verbosity < 0)
386 		fatal_exit("verbosity value < 0");
387 	if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
388 		fatal_exit("num_threads value weird");
389 	if(!cfg->do_ip4 && !cfg->do_ip6)
390 		fatal_exit("ip4 and ip6 are both disabled, pointless");
391 	if(!cfg->do_ip6 && cfg->prefer_ip6)
392 		fatal_exit("cannot prefer and disable ip6, pointless");
393 	if(!cfg->do_udp && !cfg->do_tcp)
394 		fatal_exit("udp and tcp are both disabled, pointless");
395 	if(cfg->edns_buffer_size > cfg->msg_buffer_size)
396 		fatal_exit("edns-buffer-size larger than msg-buffer-size, "
397 			"answers will not fit in processing buffer");
398 #ifdef UB_ON_WINDOWS
399 	w_config_adjust_directory(cfg);
400 #endif
401 	if(cfg->chrootdir && cfg->chrootdir[0] &&
402 		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
403 		fatal_exit("chootdir %s has trailing slash '/' please remove.",
404 			cfg->chrootdir);
405 	if(cfg->chrootdir && cfg->chrootdir[0] &&
406 		!is_dir(cfg->chrootdir)) {
407 		fatal_exit("bad chroot directory");
408 	}
409 	if(cfg->chrootdir && cfg->chrootdir[0]) {
410 		char buf[10240];
411 		buf[0] = 0;
412 		if(fname[0] != '/') {
413 			if(getcwd(buf, sizeof(buf)) == NULL)
414 				fatal_exit("getcwd: %s", strerror(errno));
415 			(void)strlcat(buf, "/", sizeof(buf));
416 		}
417 		(void)strlcat(buf, fname, sizeof(buf));
418 		if(strncmp(buf, cfg->chrootdir, strlen(cfg->chrootdir)) != 0)
419 			fatal_exit("config file %s is not inside chroot %s",
420 				buf, cfg->chrootdir);
421 	}
422 	if(cfg->directory && cfg->directory[0]) {
423 		char* ad = fname_after_chroot(cfg->directory, cfg, 0);
424 		if(!ad) fatal_exit("out of memory");
425 		if(!is_dir(ad)) fatal_exit("bad chdir directory");
426 		free(ad);
427 	}
428 	if( (cfg->chrootdir && cfg->chrootdir[0]) ||
429 	    (cfg->directory && cfg->directory[0])) {
430 		if(cfg->pidfile && cfg->pidfile[0]) {
431 			char* ad = (cfg->pidfile[0]=='/')?strdup(cfg->pidfile):
432 				fname_after_chroot(cfg->pidfile, cfg, 1);
433 			char* bd = basedir(ad);
434 			if(bd && !is_dir(bd))
435 				fatal_exit("pidfile directory does not exist");
436 			free(ad);
437 		}
438 		if(cfg->logfile && cfg->logfile[0]) {
439 			char* ad = fname_after_chroot(cfg->logfile, cfg, 1);
440 			char* bd = basedir(ad);
441 			if(bd && !is_dir(bd))
442 				fatal_exit("logfile directory does not exist");
443 			free(ad);
444 		}
445 	}
446 
447 	check_chroot_filelist("file with root-hints",
448 		cfg->root_hints, cfg->chrootdir, cfg);
449 	check_chroot_filelist("trust-anchor-file",
450 		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
451 	check_chroot_filelist("auto-trust-anchor-file",
452 		cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
453 	check_chroot_filelist_wild("trusted-keys-file",
454 		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
455 	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file,
456 		cfg->chrootdir, cfg);
457 #ifdef USE_IPSECMOD
458 	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
459 		/* only check hook if enabled */
460 		check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
461 			cfg->chrootdir, cfg);
462 	}
463 #endif
464 	/* remove chroot setting so that modules are not stripping pathnames*/
465 	free(cfg->chrootdir);
466 	cfg->chrootdir = NULL;
467 
468 	/* There should be no reason for 'respip' module not to work with
469 	 * dns64, but it's not explicitly confirmed,  so the combination is
470 	 * excluded below.   It's simply unknown yet for the combination of
471 	 * respip and other modules. */
472 	if(strcmp(cfg->module_conf, "iterator") != 0
473 		&& strcmp(cfg->module_conf, "validator iterator") != 0
474 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
475 		&& strcmp(cfg->module_conf, "dns64 iterator") != 0
476 		&& strcmp(cfg->module_conf, "respip iterator") != 0
477 		&& strcmp(cfg->module_conf, "respip validator iterator") != 0
478 #ifdef WITH_PYTHONMODULE
479 		&& strcmp(cfg->module_conf, "python iterator") != 0
480 		&& strcmp(cfg->module_conf, "python validator iterator") != 0
481 		&& strcmp(cfg->module_conf, "validator python iterator") != 0
482 		&& strcmp(cfg->module_conf, "dns64 python iterator") != 0
483 		&& strcmp(cfg->module_conf, "dns64 python validator iterator") != 0
484 		&& strcmp(cfg->module_conf, "dns64 validator python iterator") != 0
485 		&& strcmp(cfg->module_conf, "python dns64 iterator") != 0
486 		&& strcmp(cfg->module_conf, "python dns64 validator iterator") != 0
487 #endif
488 #ifdef USE_CACHEDB
489 		&& strcmp(cfg->module_conf, "validator cachedb iterator") != 0
490 		&& strcmp(cfg->module_conf, "cachedb iterator") != 0
491 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
492 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
493 #endif
494 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
495 		&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
496 		&& strcmp(cfg->module_conf, "python dns64 validator cachedb iterator") != 0
497 		&& strcmp(cfg->module_conf, "dns64 python cachedb iterator") != 0
498 		&& strcmp(cfg->module_conf, "dns64 python validator cachedb iterator") != 0
499 		&& strcmp(cfg->module_conf, "python cachedb iterator") != 0
500 		&& strcmp(cfg->module_conf, "python validator cachedb iterator") != 0
501 		&& strcmp(cfg->module_conf, "cachedb python iterator") != 0
502 		&& strcmp(cfg->module_conf, "validator cachedb python iterator") != 0
503 		&& strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
504 #endif
505 #ifdef CLIENT_SUBNET
506 		&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
507 		&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
508 		&& strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
509 		&& strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
510 #endif
511 #if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
512 		&& strcmp(cfg->module_conf, "python subnetcache iterator") != 0
513 		&& strcmp(cfg->module_conf, "subnetcache python iterator") != 0
514 		&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
515 		&& strcmp(cfg->module_conf, "python subnetcache validator iterator") != 0
516 		&& strcmp(cfg->module_conf, "subnetcache python validator iterator") != 0
517 		&& strcmp(cfg->module_conf, "subnetcache validator python iterator") != 0
518 #endif
519 #ifdef USE_IPSECMOD
520 		&& strcmp(cfg->module_conf, "ipsecmod iterator") != 0
521 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
522 #endif
523 #if defined(WITH_PYTHONMODULE) && defined(USE_IPSECMOD)
524 		&& strcmp(cfg->module_conf, "python ipsecmod iterator") != 0
525 		&& strcmp(cfg->module_conf, "ipsecmod python iterator") != 0
526 		&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
527 		&& strcmp(cfg->module_conf, "python ipsecmod validator iterator") != 0
528 		&& strcmp(cfg->module_conf, "ipsecmod python validator iterator") != 0
529 		&& strcmp(cfg->module_conf, "ipsecmod validator python iterator") != 0
530 #endif
531 		) {
532 		fatal_exit("module conf '%s' is not known to work",
533 			cfg->module_conf);
534 	}
535 
536 #ifdef HAVE_GETPWNAM
537 	if(cfg->username && cfg->username[0]) {
538 		if(getpwnam(cfg->username) == NULL)
539 			fatal_exit("user '%s' does not exist.", cfg->username);
540 #  ifdef HAVE_ENDPWENT
541 		endpwent();
542 #  endif
543 	}
544 #endif
545 	if(cfg->remote_control_enable && cfg->remote_control_use_cert) {
546 		check_chroot_string("server-key-file", &cfg->server_key_file,
547 			cfg->chrootdir, cfg);
548 		check_chroot_string("server-cert-file", &cfg->server_cert_file,
549 			cfg->chrootdir, cfg);
550 		if(!is_file(cfg->control_key_file))
551 			fatal_exit("control-key-file: \"%s\" does not exist",
552 				cfg->control_key_file);
553 		if(!is_file(cfg->control_cert_file))
554 			fatal_exit("control-cert-file: \"%s\" does not exist",
555 				cfg->control_cert_file);
556 	}
557 
558 	localzonechecks(cfg);
559 	view_and_respipchecks(cfg);
560 #ifdef CLIENT_SUBNET
561 	ecs_conf_checks(cfg);
562 #endif
563 }
564 
565 /** check forwards */
566 static void
567 check_fwd(struct config_file* cfg)
568 {
569 	struct iter_forwards* fwd = forwards_create();
570 	if(!fwd || !forwards_apply_cfg(fwd, cfg)) {
571 		fatal_exit("Could not set forward zones");
572 	}
573 	forwards_delete(fwd);
574 }
575 
576 /** check hints */
577 static void
578 check_hints(struct config_file* cfg)
579 {
580 	struct iter_hints* hints = hints_create();
581 	if(!hints || !hints_apply_cfg(hints, cfg)) {
582 		fatal_exit("Could not set root or stub hints");
583 	}
584 	hints_delete(hints);
585 }
586 
587 /** check auth zones */
588 static void
589 check_auth(struct config_file* cfg)
590 {
591 	struct auth_zones* az = auth_zones_create();
592 	if(!az || !auth_zones_apply_cfg(az, cfg, 0)) {
593 		fatal_exit("Could not setup authority zones");
594 	}
595 	auth_zones_delete(az);
596 }
597 
598 /** check config file */
599 static void
600 checkconf(const char* cfgfile, const char* opt, int final)
601 {
602 	char oldwd[4096];
603 	struct config_file* cfg = config_create();
604 	if(!cfg)
605 		fatal_exit("out of memory");
606 	oldwd[0] = 0;
607 	if(!getcwd(oldwd, sizeof(oldwd))) {
608 		log_err("cannot getcwd: %s", strerror(errno));
609 		oldwd[0] = 0;
610 	}
611 	if(!config_read(cfg, cfgfile, NULL)) {
612 		/* config_read prints messages to stderr */
613 		config_delete(cfg);
614 		exit(1);
615 	}
616 	if(oldwd[0] && chdir(oldwd) == -1)
617 		log_err("cannot chdir(%s): %s", oldwd, strerror(errno));
618 	if(opt) {
619 		print_option(cfg, opt, final);
620 		config_delete(cfg);
621 		return;
622 	}
623 	morechecks(cfg, cfgfile);
624 	check_mod(cfg, iter_get_funcblock());
625 	check_mod(cfg, val_get_funcblock());
626 #ifdef WITH_PYTHONMODULE
627 	if(strstr(cfg->module_conf, "python"))
628 		check_mod(cfg, pythonmod_get_funcblock());
629 #endif
630 	check_fwd(cfg);
631 	check_hints(cfg);
632 	check_auth(cfg);
633 	printf("unbound-checkconf: no errors in %s\n", cfgfile);
634 	config_delete(cfg);
635 }
636 
637 /** getopt global, in case header files fail to declare it. */
638 extern int optind;
639 /** getopt global, in case header files fail to declare it. */
640 extern char* optarg;
641 
642 /** Main routine for checkconf */
643 int main(int argc, char* argv[])
644 {
645 	int c;
646 	int final = 0;
647 	const char* f;
648 	const char* opt = NULL;
649 	const char* cfgfile = CONFIGFILE;
650 	log_ident_set("unbound-checkconf");
651 	log_init(NULL, 0, NULL);
652 	checklock_start();
653 #ifdef USE_WINSOCK
654 	/* use registry config file in preference to compiletime location */
655 	if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
656 		cfgfile = CONFIGFILE;
657 #endif /* USE_WINSOCK */
658 	/* parse the options */
659 	while( (c=getopt(argc, argv, "fho:")) != -1) {
660 		switch(c) {
661 		case 'f':
662 			final = 1;
663 			break;
664 		case 'o':
665 			opt = optarg;
666 			break;
667 		case '?':
668 		case 'h':
669 		default:
670 			usage();
671 		}
672 	}
673 	argc -= optind;
674 	argv += optind;
675 	if(argc != 0 && argc != 1)
676 		usage();
677 	if(argc == 1)
678 		f = argv[0];
679 	else	f = cfgfile;
680 	checkconf(f, opt, final);
681 	checklock_stop();
682 	return 0;
683 }
684