xref: /freebsd/contrib/unbound/smallapp/unbound-control.c (revision 190cef3d52236565eb22e18b33e9e865ec634aa3)
1 /*
2  * checkconf/unbound-control.c - remote control utility for unbound.
3  *
4  * Copyright (c) 2008, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * The remote control utility contacts the unbound server over ssl and
40  * sends the command, receives the answer, and displays the result
41  * from the commandline.
42  */
43 
44 #include "config.h"
45 #ifdef HAVE_GETOPT_H
46 #include <getopt.h>
47 #endif
48 #ifdef HAVE_OPENSSL_SSL_H
49 #include <openssl/ssl.h>
50 #endif
51 #ifdef HAVE_OPENSSL_ERR_H
52 #include <openssl/err.h>
53 #endif
54 #ifdef HAVE_OPENSSL_RAND_H
55 #include <openssl/rand.h>
56 #endif
57 #include "util/log.h"
58 #include "util/config_file.h"
59 #include "util/locks.h"
60 #include "util/net_help.h"
61 #include "util/shm_side/shm_main.h"
62 #include "daemon/stats.h"
63 #include "sldns/wire2str.h"
64 #include "sldns/pkthdr.h"
65 
66 #ifdef HAVE_SYS_IPC_H
67 #include "sys/ipc.h"
68 #endif
69 #ifdef HAVE_SYS_SHM_H
70 #include "sys/shm.h"
71 #endif
72 #ifdef HAVE_SYS_UN_H
73 #include <sys/un.h>
74 #endif
75 
76 /** Give unbound-control usage, and exit (1). */
77 static void
78 usage(void)
79 {
80 	printf("Usage:	local-unbound-control [options] command\n");
81 	printf("	Remote control utility for unbound server.\n");
82 	printf("Options:\n");
83 	printf("  -c file	config file, default is %s\n", CONFIGFILE);
84 	printf("  -s ip[@port]	server address, if omitted config is used.\n");
85 	printf("  -q		quiet (don't print anything if it works ok).\n");
86 	printf("  -h		show this usage help.\n");
87 	printf("Commands:\n");
88 	printf("  start				start server; runs unbound(8)\n");
89 	printf("  stop				stops the server\n");
90 	printf("  reload			reloads the server\n");
91 	printf("  				(this flushes data, stats, requestlist)\n");
92 	printf("  stats				print statistics\n");
93 	printf("  stats_noreset			peek at statistics\n");
94 #ifdef HAVE_SHMGET
95 	printf("  stats_shm			print statistics using shm\n");
96 #endif
97 	printf("  status			display status of server\n");
98 	printf("  verbosity <number>		change logging detail\n");
99 	printf("  log_reopen			close and open the logfile\n");
100 	printf("  local_zone <name> <type>	add new local zone\n");
101 	printf("  local_zone_remove <name>	remove local zone and its contents\n");
102 	printf("  local_data <RR data...>	add local data, for example\n");
103 	printf("				local_data www.example.com A 192.0.2.1\n");
104 	printf("  local_data_remove <name>	remove local RR data from name\n");
105 	printf("  local_zones, local_zones_remove, local_datas, local_datas_remove\n");
106 	printf("  				same, but read list from stdin\n");
107 	printf("  				(one entry per line).\n");
108 	printf("  dump_cache			print cache to stdout\n");
109 	printf("  load_cache			load cache from stdin\n");
110 	printf("  lookup <name>			print nameservers for name\n");
111 	printf("  flush <name>			flushes common types for name from cache\n");
112 	printf("  				types:  A, AAAA, MX, PTR, NS,\n");
113 	printf("					SOA, CNAME, DNAME, SRV, NAPTR\n");
114 	printf("  flush_type <name> <type>	flush name, type from cache\n");
115 	printf("  flush_zone <name>		flush everything at or under name\n");
116 	printf("  				from rr and dnssec caches\n");
117 	printf("  flush_bogus			flush all bogus data\n");
118 	printf("  flush_negative		flush all negative data\n");
119 	printf("  flush_stats 			flush statistics, make zero\n");
120 	printf("  flush_requestlist 		drop queries that are worked on\n");
121 	printf("  dump_requestlist		show what is worked on by first thread\n");
122 	printf("  flush_infra [all | ip] 	remove ping, edns for one IP or all\n");
123 	printf("  dump_infra			show ping and edns entries\n");
124 	printf("  set_option opt: val		set option to value, no reload\n");
125 	printf("  get_option opt		get option value\n");
126 	printf("  list_stubs			list stub-zones and root hints in use\n");
127 	printf("  list_forwards			list forward-zones in use\n");
128 	printf("  list_insecure			list domain-insecure zones\n");
129 	printf("  list_local_zones		list local-zones in use\n");
130 	printf("  list_local_data		list local-data RRs in use\n");
131 	printf("  insecure_add zone 		add domain-insecure zone\n");
132 	printf("  insecure_remove zone		remove domain-insecure zone\n");
133 	printf("  forward_add [+i] zone addr..	add forward-zone with servers\n");
134 	printf("  forward_remove [+i] zone	remove forward zone\n");
135 	printf("  stub_add [+ip] zone addr..	add stub-zone with servers\n");
136 	printf("  stub_remove [+i] zone		remove stub zone\n");
137 	printf("		+i		also do dnssec insecure point\n");
138 	printf("		+p		set stub to use priming\n");
139 	printf("  forward [off | addr ...]	without arg show forward setup\n");
140 	printf("				or off to turn off root forwarding\n");
141 	printf("				or give list of ip addresses\n");
142 	printf("  ratelimit_list [+a]		list ratelimited domains\n");
143 	printf("  ip_ratelimit_list [+a]	list ratelimited ip addresses\n");
144 	printf("		+a		list all, also not ratelimited\n");
145 	printf("  list_auth_zones		list auth zones\n");
146 	printf("  view_list_local_zones	view	list local-zones in view\n");
147 	printf("  view_list_local_data	view	list local-data RRs in view\n");
148 	printf("  view_local_zone view name type  	add local-zone in view\n");
149 	printf("  view_local_zone_remove view name  	remove local-zone in view\n");
150 	printf("  view_local_data view RR...		add local-data in view\n");
151 	printf("  view_local_data_remove view name  	remove local-data in view\n");
152 	printf("Version %s\n", PACKAGE_VERSION);
153 	printf("BSD licensed, see LICENSE in source package for details.\n");
154 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
155 	exit(1);
156 }
157 
158 #ifdef HAVE_SHMGET
159 /** what to put on statistics lines between var and value, ": " or "=" */
160 #define SQ "="
161 /** if true, inhibits a lot of =0 lines from the stats output */
162 static const int inhibit_zero = 1;
163 /** divide sum of timers to get average */
164 static void
165 timeval_divide(struct timeval* avg, const struct timeval* sum, long long d)
166 {
167 #ifndef S_SPLINT_S
168 	size_t leftover;
169 	if(d == 0) {
170 		avg->tv_sec = 0;
171 		avg->tv_usec = 0;
172 		return;
173 	}
174 	avg->tv_sec = sum->tv_sec / d;
175 	avg->tv_usec = sum->tv_usec / d;
176 	/* handle fraction from seconds divide */
177 	leftover = sum->tv_sec - avg->tv_sec*d;
178 	avg->tv_usec += (leftover*1000000)/d;
179 #endif
180 }
181 
182 /** print unsigned long stats value */
183 #define PR_UL_NM(str, var) printf("%s."str SQ"%lu\n", nm, (unsigned long)(var));
184 #define PR_UL(str, var) printf(str SQ"%lu\n", (unsigned long)(var));
185 #define PR_UL_SUB(str, nm, var) printf(str".%s"SQ"%lu\n", nm, (unsigned long)(var));
186 #define PR_TIMEVAL(str, var) printf(str SQ ARG_LL "d.%6.6d\n", \
187 	(long long)var.tv_sec, (int)var.tv_usec);
188 #define PR_STATSTIME(str, var) printf(str SQ ARG_LL "d.%6.6d\n", \
189 	(long long)var ## _sec, (int)var ## _usec);
190 #define PR_LL(str, var) printf(str SQ ARG_LL"d\n", (long long)(var));
191 
192 /** print stat block */
193 static void pr_stats(const char* nm, struct ub_stats_info* s)
194 {
195 	struct timeval sumwait, avg;
196 	PR_UL_NM("num.queries", s->svr.num_queries);
197 	PR_UL_NM("num.queries_ip_ratelimited",
198 		s->svr.num_queries_ip_ratelimited);
199 	PR_UL_NM("num.cachehits",
200 		s->svr.num_queries - s->svr.num_queries_missed_cache);
201 	PR_UL_NM("num.cachemiss", s->svr.num_queries_missed_cache);
202 	PR_UL_NM("num.prefetch", s->svr.num_queries_prefetch);
203 	PR_UL_NM("num.zero_ttl", s->svr.zero_ttl_responses);
204 	PR_UL_NM("num.recursivereplies", s->mesh_replies_sent);
205 #ifdef USE_DNSCRYPT
206     PR_UL_NM("num.dnscrypt.crypted", s->svr.num_query_dnscrypt_crypted);
207     PR_UL_NM("num.dnscrypt.cert", s->svr.num_query_dnscrypt_cert);
208     PR_UL_NM("num.dnscrypt.cleartext", s->svr.num_query_dnscrypt_cleartext);
209     PR_UL_NM("num.dnscrypt.malformed",
210              s->svr.num_query_dnscrypt_crypted_malformed);
211 #endif /* USE_DNSCRYPT */
212 	printf("%s.requestlist.avg"SQ"%g\n", nm,
213 		(s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)?
214 			(double)s->svr.sum_query_list_size/
215 			(double)(s->svr.num_queries_missed_cache+
216 			s->svr.num_queries_prefetch) : 0.0);
217 	PR_UL_NM("requestlist.max", s->svr.max_query_list_size);
218 	PR_UL_NM("requestlist.overwritten", s->mesh_jostled);
219 	PR_UL_NM("requestlist.exceeded", s->mesh_dropped);
220 	PR_UL_NM("requestlist.current.all", s->mesh_num_states);
221 	PR_UL_NM("requestlist.current.user", s->mesh_num_reply_states);
222 #ifndef S_SPLINT_S
223 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
224 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
225 #endif
226 	timeval_divide(&avg, &sumwait, s->mesh_replies_sent);
227 	printf("%s.", nm);
228 	PR_TIMEVAL("recursion.time.avg", avg);
229 	printf("%s.recursion.time.median"SQ"%g\n", nm, s->mesh_time_median);
230 	PR_UL_NM("tcpusage", s->svr.tcp_accept_usage);
231 }
232 
233 /** print uptime */
234 static void print_uptime(struct ub_shm_stat_info* shm_stat)
235 {
236 	PR_STATSTIME("time.now", shm_stat->time.now);
237 	PR_STATSTIME("time.up", shm_stat->time.up);
238 	PR_STATSTIME("time.elapsed", shm_stat->time.elapsed);
239 }
240 
241 /** print memory usage */
242 static void print_mem(struct ub_shm_stat_info* shm_stat)
243 {
244 	PR_LL("mem.cache.rrset", shm_stat->mem.rrset);
245 	PR_LL("mem.cache.message", shm_stat->mem.msg);
246 	PR_LL("mem.mod.iterator", shm_stat->mem.iter);
247 	PR_LL("mem.mod.validator", shm_stat->mem.val);
248 	PR_LL("mem.mod.respip", shm_stat->mem.respip);
249 #ifdef CLIENT_SUBNET
250 	PR_LL("mem.mod.subnet", shm_stat->mem.subnet);
251 #endif
252 #ifdef USE_IPSECMOD
253 	PR_LL("mem.mod.ipsecmod", shm_stat->mem.ipsecmod);
254 #endif
255 #ifdef USE_DNSCRYPT
256 	PR_LL("mem.cache.dnscrypt_shared_secret",
257 		shm_stat->mem.dnscrypt_shared_secret);
258 	PR_LL("mem.cache.dnscrypt_nonce",
259 		shm_stat->mem.dnscrypt_nonce);
260 #endif
261 }
262 
263 /** print histogram */
264 static void print_hist(struct ub_stats_info* s)
265 {
266 	struct timehist* hist;
267 	size_t i;
268 	hist = timehist_setup();
269 	if(!hist)
270 		fatal_exit("out of memory");
271 	timehist_import(hist, s->svr.hist, NUM_BUCKETS_HIST);
272 	for(i=0; i<hist->num; i++) {
273 		printf("histogram.%6.6d.%6.6d.to.%6.6d.%6.6d=%lu\n",
274 			(int)hist->buckets[i].lower.tv_sec,
275 			(int)hist->buckets[i].lower.tv_usec,
276 			(int)hist->buckets[i].upper.tv_sec,
277 			(int)hist->buckets[i].upper.tv_usec,
278 			(unsigned long)hist->buckets[i].count);
279 	}
280 	timehist_delete(hist);
281 }
282 
283 /** print extended */
284 static void print_extended(struct ub_stats_info* s)
285 {
286 	int i;
287 	char nm[16];
288 
289 	/* TYPE */
290 	for(i=0; i<UB_STATS_QTYPE_NUM; i++) {
291 		if(inhibit_zero && s->svr.qtype[i] == 0)
292 			continue;
293 		sldns_wire2str_type_buf((uint16_t)i, nm, sizeof(nm));
294 		PR_UL_SUB("num.query.type", nm, s->svr.qtype[i]);
295 	}
296 	if(!inhibit_zero || s->svr.qtype_big) {
297 		PR_UL("num.query.type.other", s->svr.qtype_big);
298 	}
299 
300 	/* CLASS */
301 	for(i=0; i<UB_STATS_QCLASS_NUM; i++) {
302 		if(inhibit_zero && s->svr.qclass[i] == 0)
303 			continue;
304 		sldns_wire2str_class_buf((uint16_t)i, nm, sizeof(nm));
305 		PR_UL_SUB("num.query.class", nm, s->svr.qclass[i]);
306 	}
307 	if(!inhibit_zero || s->svr.qclass_big) {
308 		PR_UL("num.query.class.other", s->svr.qclass_big);
309 	}
310 
311 	/* OPCODE */
312 	for(i=0; i<UB_STATS_OPCODE_NUM; i++) {
313 		if(inhibit_zero && s->svr.qopcode[i] == 0)
314 			continue;
315 		sldns_wire2str_opcode_buf(i, nm, sizeof(nm));
316 		PR_UL_SUB("num.query.opcode", nm, s->svr.qopcode[i]);
317 	}
318 
319 	/* transport */
320 	PR_UL("num.query.tcp", s->svr.qtcp);
321 	PR_UL("num.query.tcpout", s->svr.qtcp_outgoing);
322 	PR_UL("num.query.ipv6", s->svr.qipv6);
323 
324 	/* flags */
325 	PR_UL("num.query.flags.QR", s->svr.qbit_QR);
326 	PR_UL("num.query.flags.AA", s->svr.qbit_AA);
327 	PR_UL("num.query.flags.TC", s->svr.qbit_TC);
328 	PR_UL("num.query.flags.RD", s->svr.qbit_RD);
329 	PR_UL("num.query.flags.RA", s->svr.qbit_RA);
330 	PR_UL("num.query.flags.Z", s->svr.qbit_Z);
331 	PR_UL("num.query.flags.AD", s->svr.qbit_AD);
332 	PR_UL("num.query.flags.CD", s->svr.qbit_CD);
333 	PR_UL("num.query.edns.present", s->svr.qEDNS);
334 	PR_UL("num.query.edns.DO", s->svr.qEDNS_DO);
335 
336 	/* RCODE */
337 	for(i=0; i<UB_STATS_RCODE_NUM; i++) {
338 		/* Always include RCODEs 0-5 */
339 		if(inhibit_zero && i > LDNS_RCODE_REFUSED && s->svr.ans_rcode[i] == 0)
340 			continue;
341 		sldns_wire2str_rcode_buf(i, nm, sizeof(nm));
342 		PR_UL_SUB("num.answer.rcode", nm, s->svr.ans_rcode[i]);
343 	}
344 	if(!inhibit_zero || s->svr.ans_rcode_nodata) {
345 		PR_UL("num.answer.rcode.nodata", s->svr.ans_rcode_nodata);
346 	}
347 	/* iteration */
348 	PR_UL("num.query.ratelimited", s->svr.queries_ratelimited);
349 	/* validation */
350 	PR_UL("num.answer.secure", s->svr.ans_secure);
351 	PR_UL("num.answer.bogus", s->svr.ans_bogus);
352 	PR_UL("num.rrset.bogus", s->svr.rrset_bogus);
353 	PR_UL("num.query.aggressive.NOERROR", s->svr.num_neg_cache_noerror);
354 	PR_UL("num.query.aggressive.NXDOMAIN", s->svr.num_neg_cache_nxdomain);
355 	/* threat detection */
356 	PR_UL("unwanted.queries", s->svr.unwanted_queries);
357 	PR_UL("unwanted.replies", s->svr.unwanted_replies);
358 	/* cache counts */
359 	PR_UL("msg.cache.count", s->svr.msg_cache_count);
360 	PR_UL("rrset.cache.count", s->svr.rrset_cache_count);
361 	PR_UL("infra.cache.count", s->svr.infra_cache_count);
362 	PR_UL("key.cache.count", s->svr.key_cache_count);
363 #ifdef USE_DNSCRYPT
364 	PR_UL("dnscrypt_shared_secret.cache.count",
365 			 s->svr.shared_secret_cache_count);
366 	PR_UL("num.query.dnscrypt.shared_secret.cachemiss",
367 			 s->svr.num_query_dnscrypt_secret_missed_cache);
368 	PR_UL("dnscrypt_nonce.cache.count", s->svr.nonce_cache_count);
369 	PR_UL("num.query.dnscrypt.replay",
370 			 s->svr.num_query_dnscrypt_replay);
371 #endif /* USE_DNSCRYPT */
372 	PR_UL("num.query.authzone.up", s->svr.num_query_authzone_up);
373 	PR_UL("num.query.authzone.down", s->svr.num_query_authzone_down);
374 }
375 
376 /** print statistics out of memory structures */
377 static void do_stats_shm(struct config_file* cfg, struct ub_stats_info* stats,
378 	struct ub_shm_stat_info* shm_stat)
379 {
380 	int i;
381 	char nm[32];
382 	for(i=0; i<cfg->num_threads; i++) {
383 		snprintf(nm, sizeof(nm), "thread%d", i);
384 		pr_stats(nm, &stats[i+1]);
385 	}
386 	pr_stats("total", &stats[0]);
387 	print_uptime(shm_stat);
388 	if(cfg->stat_extended) {
389 		print_mem(shm_stat);
390 		print_hist(stats);
391 		print_extended(stats);
392 	}
393 }
394 #endif /* HAVE_SHMGET */
395 
396 /** print statistics from shm memory segment */
397 static void print_stats_shm(const char* cfgfile)
398 {
399 #ifdef HAVE_SHMGET
400 	struct config_file* cfg;
401 	struct ub_stats_info* stats;
402 	struct ub_shm_stat_info* shm_stat;
403 	int id_ctl, id_arr;
404 	/* read config */
405 	if(!(cfg = config_create()))
406 		fatal_exit("out of memory");
407 	if(!config_read(cfg, cfgfile, NULL))
408 		fatal_exit("could not read config file");
409 	/* get shm segments */
410 	id_ctl = shmget(cfg->shm_key, sizeof(int), SHM_R|SHM_W);
411 	if(id_ctl == -1) {
412 		fatal_exit("shmget(%d): %s", cfg->shm_key, strerror(errno));
413 	}
414 	id_arr = shmget(cfg->shm_key+1, sizeof(int), SHM_R|SHM_W);
415 	if(id_arr == -1) {
416 		fatal_exit("shmget(%d): %s", cfg->shm_key+1, strerror(errno));
417 	}
418 	shm_stat = (struct ub_shm_stat_info*)shmat(id_ctl, NULL, 0);
419 	if(shm_stat == (void*)-1) {
420 		fatal_exit("shmat(%d): %s", id_ctl, strerror(errno));
421 	}
422 	stats = (struct ub_stats_info*)shmat(id_arr, NULL, 0);
423 	if(stats == (void*)-1) {
424 		fatal_exit("shmat(%d): %s", id_arr, strerror(errno));
425 	}
426 
427 	/* print the stats */
428 	do_stats_shm(cfg, stats, shm_stat);
429 
430 	/* shutdown */
431 	shmdt(shm_stat);
432 	shmdt(stats);
433 	config_delete(cfg);
434 #else
435 	(void)cfgfile;
436 #endif /* HAVE_SHMGET */
437 }
438 
439 /** exit with ssl error */
440 static void ssl_err(const char* s)
441 {
442 	fprintf(stderr, "error: %s\n", s);
443 	ERR_print_errors_fp(stderr);
444 	exit(1);
445 }
446 
447 /** setup SSL context */
448 static SSL_CTX*
449 setup_ctx(struct config_file* cfg)
450 {
451 	char* s_cert=NULL, *c_key=NULL, *c_cert=NULL;
452 	SSL_CTX* ctx;
453 
454 	if(cfg->remote_control_use_cert) {
455 		s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
456 		c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
457 		c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
458 		if(!s_cert || !c_key || !c_cert)
459 			fatal_exit("out of memory");
460 	}
461 	ctx = SSL_CTX_new(SSLv23_client_method());
462 	if(!ctx)
463 		ssl_err("could not allocate SSL_CTX pointer");
464 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
465 		!= SSL_OP_NO_SSLv2)
466 		ssl_err("could not set SSL_OP_NO_SSLv2");
467 	if(cfg->remote_control_use_cert) {
468 		if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
469 			!= SSL_OP_NO_SSLv3)
470 			ssl_err("could not set SSL_OP_NO_SSLv3");
471 		if(!SSL_CTX_use_certificate_chain_file(ctx,c_cert) ||
472 		    !SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)
473 		    || !SSL_CTX_check_private_key(ctx))
474 			ssl_err("Error setting up SSL_CTX client key and cert");
475 		if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
476 			ssl_err("Error setting up SSL_CTX verify, server cert");
477 		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
478 
479 		free(s_cert);
480 		free(c_key);
481 		free(c_cert);
482 	} else {
483 		/* Use ciphers that don't require authentication  */
484 #if defined(SSL_OP_NO_TLSv1_3)
485 		/* in openssl 1.1.1, negotiation code for tls 1.3 does
486 		 * not allow the unauthenticated aNULL and eNULL ciphers */
487 		SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_3);
488 #endif
489 #ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL
490 		SSL_CTX_set_security_level(ctx, 0);
491 #endif
492 		if(!SSL_CTX_set_cipher_list(ctx, "aNULL:eNULL"))
493 			ssl_err("Error setting NULL cipher!");
494 	}
495 	return ctx;
496 }
497 
498 /** contact the server with TCP connect */
499 static int
500 contact_server(const char* svr, struct config_file* cfg, int statuscmd)
501 {
502 	struct sockaddr_storage addr;
503 	socklen_t addrlen;
504 	int addrfamily = 0;
505 	int fd;
506 	/* use svr or the first config entry */
507 	if(!svr) {
508 		if(cfg->control_ifs) {
509 			svr = cfg->control_ifs->str;
510 		} else if(cfg->do_ip4) {
511 			svr = "127.0.0.1";
512 		} else {
513 			svr = "::1";
514 		}
515 		/* config 0 addr (everything), means ask localhost */
516 		if(strcmp(svr, "0.0.0.0") == 0)
517 			svr = "127.0.0.1";
518 		else if(strcmp(svr, "::0") == 0 ||
519 			strcmp(svr, "0::0") == 0 ||
520 			strcmp(svr, "0::") == 0 ||
521 			strcmp(svr, "::") == 0)
522 			svr = "::1";
523 	}
524 	if(strchr(svr, '@')) {
525 		if(!extstrtoaddr(svr, &addr, &addrlen))
526 			fatal_exit("could not parse IP@port: %s", svr);
527 #ifdef HAVE_SYS_UN_H
528 	} else if(svr[0] == '/') {
529 		struct sockaddr_un* usock = (struct sockaddr_un *) &addr;
530 		usock->sun_family = AF_LOCAL;
531 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
532 		usock->sun_len = (unsigned)sizeof(usock);
533 #endif
534 		(void)strlcpy(usock->sun_path, svr, sizeof(usock->sun_path));
535 		addrlen = (socklen_t)sizeof(struct sockaddr_un);
536 		addrfamily = AF_LOCAL;
537 #endif
538 	} else {
539 		if(!ipstrtoaddr(svr, cfg->control_port, &addr, &addrlen))
540 			fatal_exit("could not parse IP: %s", svr);
541 	}
542 
543 	if(addrfamily == 0)
544 		addrfamily = addr_is_ip6(&addr, addrlen)?AF_INET6:AF_INET;
545 	fd = socket(addrfamily, SOCK_STREAM, 0);
546 	if(fd == -1) {
547 #ifndef USE_WINSOCK
548 		fatal_exit("socket: %s", strerror(errno));
549 #else
550 		fatal_exit("socket: %s", wsa_strerror(WSAGetLastError()));
551 #endif
552 	}
553 	if(connect(fd, (struct sockaddr*)&addr, addrlen) < 0) {
554 #ifndef USE_WINSOCK
555 		log_err_addr("connect", strerror(errno), &addr, addrlen);
556 		if(errno == ECONNREFUSED && statuscmd) {
557 			printf("unbound is stopped\n");
558 			exit(3);
559 		}
560 #else
561 		log_err_addr("connect", wsa_strerror(WSAGetLastError()), &addr, addrlen);
562 		if(WSAGetLastError() == WSAECONNREFUSED && statuscmd) {
563 			printf("unbound is stopped\n");
564 			exit(3);
565 		}
566 #endif
567 		exit(1);
568 	}
569 	return fd;
570 }
571 
572 /** setup SSL on the connection */
573 static SSL*
574 setup_ssl(SSL_CTX* ctx, int fd, struct config_file* cfg)
575 {
576 	SSL* ssl;
577 	X509* x;
578 	int r;
579 
580 	ssl = SSL_new(ctx);
581 	if(!ssl)
582 		ssl_err("could not SSL_new");
583 	SSL_set_connect_state(ssl);
584 	(void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
585 	if(!SSL_set_fd(ssl, fd))
586 		ssl_err("could not SSL_set_fd");
587 	while(1) {
588 		ERR_clear_error();
589 		if( (r=SSL_do_handshake(ssl)) == 1)
590 			break;
591 		r = SSL_get_error(ssl, r);
592 		if(r != SSL_ERROR_WANT_READ && r != SSL_ERROR_WANT_WRITE)
593 			ssl_err("SSL handshake failed");
594 		/* wants to be called again */
595 	}
596 
597 	/* check authenticity of server */
598 	if(SSL_get_verify_result(ssl) != X509_V_OK)
599 		ssl_err("SSL verification failed");
600 	if(cfg->remote_control_use_cert) {
601 		x = SSL_get_peer_certificate(ssl);
602 		if(!x)
603 			ssl_err("Server presented no peer certificate");
604 		X509_free(x);
605 	}
606 
607 	return ssl;
608 }
609 
610 /** send stdin to server */
611 static void
612 send_file(SSL* ssl, FILE* in, char* buf, size_t sz)
613 {
614 	while(fgets(buf, (int)sz, in)) {
615 		if(SSL_write(ssl, buf, (int)strlen(buf)) <= 0)
616 			ssl_err("could not SSL_write contents");
617 	}
618 }
619 
620 /** send end-of-file marker to server */
621 static void
622 send_eof(SSL* ssl)
623 {
624 	char e[] = {0x04, 0x0a};
625 	if(SSL_write(ssl, e, (int)sizeof(e)) <= 0)
626 		ssl_err("could not SSL_write end-of-file marker");
627 }
628 
629 /** send command and display result */
630 static int
631 go_cmd(SSL* ssl, int quiet, int argc, char* argv[])
632 {
633 	char pre[10];
634 	const char* space=" ";
635 	const char* newline="\n";
636 	int was_error = 0, first_line = 1;
637 	int r, i;
638 	char buf[1024];
639 	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
640 	if(SSL_write(ssl, pre, (int)strlen(pre)) <= 0)
641 		ssl_err("could not SSL_write");
642 	for(i=0; i<argc; i++) {
643 		if(SSL_write(ssl, space, (int)strlen(space)) <= 0)
644 			ssl_err("could not SSL_write");
645 		if(SSL_write(ssl, argv[i], (int)strlen(argv[i])) <= 0)
646 			ssl_err("could not SSL_write");
647 	}
648 	if(SSL_write(ssl, newline, (int)strlen(newline)) <= 0)
649 		ssl_err("could not SSL_write");
650 
651 	if(argc == 1 && strcmp(argv[0], "load_cache") == 0) {
652 		send_file(ssl, stdin, buf, sizeof(buf));
653 	}
654 	else if(argc == 1 && (strcmp(argv[0], "local_zones") == 0 ||
655 		strcmp(argv[0], "local_zones_remove") == 0 ||
656 		strcmp(argv[0], "local_datas") == 0 ||
657 		strcmp(argv[0], "local_datas_remove") == 0)) {
658 		send_file(ssl, stdin, buf, sizeof(buf));
659 		send_eof(ssl);
660 	}
661 
662 	while(1) {
663 		ERR_clear_error();
664 		if((r = SSL_read(ssl, buf, (int)sizeof(buf)-1)) <= 0) {
665 			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
666 				/* EOF */
667 				break;
668 			}
669 			ssl_err("could not SSL_read");
670 		}
671 		buf[r] = 0;
672 		if(first_line && strncmp(buf, "error", 5) == 0) {
673 			printf("%s", buf);
674 			was_error = 1;
675 		} else if (!quiet)
676 			printf("%s", buf);
677 
678 		first_line = 0;
679 	}
680 	return was_error;
681 }
682 
683 /** go ahead and read config, contact server and perform command and display */
684 static int
685 go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
686 {
687 	struct config_file* cfg;
688 	int fd, ret;
689 	SSL_CTX* ctx;
690 	SSL* ssl;
691 
692 	/* read config */
693 	if(!(cfg = config_create()))
694 		fatal_exit("out of memory");
695 	if(!config_read(cfg, cfgfile, NULL))
696 		fatal_exit("could not read config file");
697 	if(!cfg->remote_control_enable)
698 		log_warn("control-enable is 'no' in the config file.");
699 #ifdef UB_ON_WINDOWS
700 	w_config_adjust_directory(cfg);
701 #endif
702 	ctx = setup_ctx(cfg);
703 
704 	/* contact server */
705 	fd = contact_server(svr, cfg, argc>0&&strcmp(argv[0],"status")==0);
706 	ssl = setup_ssl(ctx, fd, cfg);
707 
708 	/* send command */
709 	ret = go_cmd(ssl, quiet, argc, argv);
710 
711 	SSL_free(ssl);
712 #ifndef USE_WINSOCK
713 	close(fd);
714 #else
715 	closesocket(fd);
716 #endif
717 	SSL_CTX_free(ctx);
718 	config_delete(cfg);
719 	return ret;
720 }
721 
722 /** getopt global, in case header files fail to declare it. */
723 extern int optind;
724 /** getopt global, in case header files fail to declare it. */
725 extern char* optarg;
726 
727 /** Main routine for unbound-control */
728 int main(int argc, char* argv[])
729 {
730 	int c, ret;
731 	int quiet = 0;
732 	const char* cfgfile = CONFIGFILE;
733 	char* svr = NULL;
734 #ifdef USE_WINSOCK
735 	int r;
736 	WSADATA wsa_data;
737 #endif
738 #ifdef USE_THREAD_DEBUG
739 	/* stop the file output from unbound-control, overwrites the servers */
740 	extern int check_locking_order;
741 	check_locking_order = 0;
742 #endif /* USE_THREAD_DEBUG */
743 	log_ident_set("unbound-control");
744 	log_init(NULL, 0, NULL);
745 	checklock_start();
746 #ifdef USE_WINSOCK
747 	/* use registry config file in preference to compiletime location */
748 	if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
749 		cfgfile = CONFIGFILE;
750 #endif
751 	/* parse the options */
752 	while( (c=getopt(argc, argv, "c:s:qh")) != -1) {
753 		switch(c) {
754 		case 'c':
755 			cfgfile = optarg;
756 			break;
757 		case 's':
758 			svr = optarg;
759 			break;
760 		case 'q':
761 			quiet = 1;
762 			break;
763 		case '?':
764 		case 'h':
765 		default:
766 			usage();
767 		}
768 	}
769 	argc -= optind;
770 	argv += optind;
771 	if(argc == 0)
772 		usage();
773 	if(argc >= 1 && strcmp(argv[0], "start")==0) {
774 		if(execlp("unbound", "unbound", "-c", cfgfile,
775 			(char*)NULL) < 0) {
776 			fatal_exit("could not exec unbound: %s",
777 				strerror(errno));
778 		}
779 	}
780 	if(argc >= 1 && strcmp(argv[0], "stats_shm")==0) {
781 		print_stats_shm(cfgfile);
782 		return 0;
783 	}
784 
785 #ifdef USE_WINSOCK
786 	if((r = WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0)
787 		fatal_exit("WSAStartup failed: %s", wsa_strerror(r));
788 #endif
789 
790 #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
791 	ERR_load_crypto_strings();
792 #endif
793 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
794 	ERR_load_SSL_strings();
795 #endif
796 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
797 	OpenSSL_add_all_algorithms();
798 #else
799 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
800 		| OPENSSL_INIT_ADD_ALL_DIGESTS
801 		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
802 #endif
803 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
804 	(void)SSL_library_init();
805 #else
806 	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
807 #endif
808 
809 	if(!RAND_status()) {
810 		/* try to seed it */
811 		unsigned char buf[256];
812 		unsigned int seed=(unsigned)time(NULL) ^ (unsigned)getpid();
813 		unsigned int v = seed;
814 		size_t i;
815 		for(i=0; i<256/sizeof(v); i++) {
816 			memmove(buf+i*sizeof(v), &v, sizeof(v));
817 			v = v*seed + (unsigned int)i;
818 		}
819 		RAND_seed(buf, 256);
820 		log_warn("no entropy, seeding openssl PRNG with time\n");
821 	}
822 
823 	ret = go(cfgfile, svr, quiet, argc, argv);
824 
825 #ifdef USE_WINSOCK
826 	WSACleanup();
827 #endif
828 	checklock_stop();
829 	return ret;
830 }
831