xref: /freebsd/contrib/unbound/util/config_file.h (revision 1323ec571215a77ddd21294f0871979d5ad6b992)
1 /*
2  * util/config_file.h - reads and stores the config file for unbound.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains functions for the config file.
40  */
41 
42 #ifndef UTIL_CONFIG_FILE_H
43 #define UTIL_CONFIG_FILE_H
44 struct config_stub;
45 struct config_auth;
46 struct config_view;
47 struct config_strlist;
48 struct config_str2list;
49 struct config_str3list;
50 struct config_strbytelist;
51 struct module_qstate;
52 struct sock_list;
53 struct ub_packed_rrset_key;
54 struct regional;
55 
56 /** List head for strlist processing, used for append operation. */
57 struct config_strlist_head {
58 	/** first in list of text items */
59 	struct config_strlist* first;
60 	/** last in list of text items */
61 	struct config_strlist* last;
62 };
63 
64 /**
65  * The configuration options.
66  * Strings are malloced.
67  */
68 struct config_file {
69 	/** verbosity level as specified in the config file */
70 	int verbosity;
71 
72 	/** statistics interval (in seconds) */
73 	int stat_interval;
74 	/** if false, statistics values are reset after printing them */
75 	int stat_cumulative;
76 	/** if true, the statistics are kept in greater detail */
77 	int stat_extended;
78 
79 	/** number of threads to create */
80 	int num_threads;
81 
82 	/** port on which queries are answered. */
83 	int port;
84 	/** do ip4 query support. */
85 	int do_ip4;
86 	/** do ip6 query support. */
87 	int do_ip6;
88 	/** prefer ip4 upstream queries. */
89 	int prefer_ip4;
90 	/** prefer ip6 upstream queries. */
91 	int prefer_ip6;
92 	/** do udp query support. */
93 	int do_udp;
94 	/** do tcp query support. */
95 	int do_tcp;
96 	/** max number of queries on a reuse connection. */
97 	size_t max_reuse_tcp_queries;
98 	/** timeout for REUSE entries in milliseconds. */
99 	int tcp_reuse_timeout;
100 	/** timeout in milliseconds for TCP queries to auth servers. */
101 	int tcp_auth_query_timeout;
102 	/** tcp upstream queries (no UDP upstream queries) */
103 	int tcp_upstream;
104 	/** udp upstream enabled when no UDP downstream is enabled (do_udp no)*/
105 	int udp_upstream_without_downstream;
106 	/** maximum segment size of tcp socket which queries are answered */
107 	int tcp_mss;
108 	/** maximum segment size of tcp socket for outgoing queries */
109 	int outgoing_tcp_mss;
110 	/** tcp idle timeout, in msec */
111 	int tcp_idle_timeout;
112 	/** do edns tcp keepalive */
113 	int do_tcp_keepalive;
114 	/** tcp keepalive timeout, in msec */
115 	int tcp_keepalive_timeout;
116 
117 	/** private key file for dnstcp-ssl service (enabled if not NULL) */
118 	char* ssl_service_key;
119 	/** public key file for dnstcp-ssl service */
120 	char* ssl_service_pem;
121 	/** port on which to provide ssl service */
122 	int ssl_port;
123 	/** if outgoing tcp connections use SSL */
124 	int ssl_upstream;
125 	/** cert bundle for outgoing connections */
126 	char* tls_cert_bundle;
127 	/** should the system certificate store get added to the cert bundle */
128 	int tls_win_cert;
129 	/** additional tls ports */
130 	struct config_strlist* tls_additional_port;
131 	/** secret key used to encrypt and decrypt TLS session ticket */
132 	struct config_strlist_head tls_session_ticket_keys;
133 	/** TLS ciphers */
134 	char* tls_ciphers;
135 	/** TLS chiphersuites (TLSv1.3) */
136 	char* tls_ciphersuites;
137 	/** if SNI is to be used */
138 	int tls_use_sni;
139 
140 	/** port on which to provide DNS over HTTPS service */
141 	int https_port;
142 	/** endpoint for HTTP service */
143 	char* http_endpoint;
144 	/** MAX_CONCURRENT_STREAMS HTTP/2 setting */
145 	uint32_t http_max_streams;
146 	/** maximum size of all HTTP2 query buffers combined. */
147 	size_t http_query_buffer_size;
148 	/** maximum size of all HTTP2 response buffers combined. */
149 	size_t http_response_buffer_size;
150 	/** set TCP_NODELAY option for http sockets */
151 	int http_nodelay;
152 	/** Disable TLS for http sockets downstream */
153 	int http_notls_downstream;
154 
155 	/** outgoing port range number of ports (per thread) */
156 	int outgoing_num_ports;
157 	/** number of outgoing tcp buffers per (per thread) */
158 	size_t outgoing_num_tcp;
159 	/** number of incoming tcp buffers per (per thread) */
160 	size_t incoming_num_tcp;
161 	/** allowed udp port numbers, array with 0 if not allowed */
162 	int* outgoing_avail_ports;
163 
164 	/** EDNS buffer size to use */
165 	size_t edns_buffer_size;
166 	/** size of the stream wait buffers, max */
167 	size_t stream_wait_size;
168 	/** number of bytes buffer size for DNS messages */
169 	size_t msg_buffer_size;
170 	/** size of the message cache */
171 	size_t msg_cache_size;
172 	/** slabs in the message cache. */
173 	size_t msg_cache_slabs;
174 	/** number of queries every thread can service */
175 	size_t num_queries_per_thread;
176 	/** number of msec to wait before items can be jostled out */
177 	size_t jostle_time;
178 	/** size of the rrset cache */
179 	size_t rrset_cache_size;
180 	/** slabs in the rrset cache */
181 	size_t rrset_cache_slabs;
182 	/** host cache ttl in seconds */
183 	int host_ttl;
184 	/** number of slabs in the infra host cache */
185 	size_t infra_cache_slabs;
186 	/** max number of hosts in the infra cache */
187 	size_t infra_cache_numhosts;
188 	/** min value for infra cache rtt */
189 	int infra_cache_min_rtt;
190 	/** keep probing hosts that are down */
191 	int infra_keep_probing;
192 	/** delay close of udp-timeouted ports, if 0 no delayclose. in msec */
193 	int delay_close;
194 	/** udp_connect enable uses UDP connect to mitigate ICMP side channel */
195 	int udp_connect;
196 
197 	/** the target fetch policy for the iterator */
198 	char* target_fetch_policy;
199 	/** percent*10, how many times in 1000 to pick from the fastest
200 	 * destinations */
201 	int fast_server_permil;
202 	/** number of fastest server to select from */
203 	size_t fast_server_num;
204 
205 	/** automatic interface for incoming messages. Uses ipv6 remapping,
206 	 * and recvmsg/sendmsg ancillary data to detect interfaces, boolean */
207 	int if_automatic;
208 	/** SO_RCVBUF size to set on port 53 UDP socket */
209 	size_t so_rcvbuf;
210 	/** SO_SNDBUF size to set on port 53 UDP socket */
211 	size_t so_sndbuf;
212 	/** SO_REUSEPORT requested on port 53 sockets */
213 	int so_reuseport;
214 	/** IP_TRANSPARENT socket option requested on port 53 sockets */
215 	int ip_transparent;
216 	/** IP_FREEBIND socket option request on port 53 sockets */
217 	int ip_freebind;
218 	/** IP_TOS socket option requested on port 53 sockets */
219 	int ip_dscp;
220 
221 	/** number of interfaces to open. If 0 default all interfaces. */
222 	int num_ifs;
223 	/** interface description strings (IP addresses) */
224 	char **ifs;
225 
226 	/** number of outgoing interfaces to open.
227 	 * If 0 default all interfaces. */
228 	int num_out_ifs;
229 	/** outgoing interface description strings (IP addresses) */
230 	char **out_ifs;
231 
232 	/** the root hints */
233 	struct config_strlist* root_hints;
234 	/** the stub definitions, linked list */
235 	struct config_stub* stubs;
236 	/** the forward zone definitions, linked list */
237 	struct config_stub* forwards;
238 	/** the auth zone definitions, linked list */
239 	struct config_auth* auths;
240 	/** the views definitions, linked list */
241 	struct config_view* views;
242 	/** list of donotquery addresses, linked list */
243 	struct config_strlist* donotqueryaddrs;
244 #ifdef CLIENT_SUBNET
245 	/** list of servers we send edns-client-subnet option to and
246 	 * accept option from, linked list */
247 	struct config_strlist* client_subnet;
248 	/** list of zones we send edns-client-subnet option for */
249 	struct config_strlist* client_subnet_zone;
250 	/** opcode assigned by IANA for edns0-client-subnet option */
251 	uint16_t client_subnet_opcode;
252 	/** Do not check whitelist if incoming query contains an ECS record */
253 	int client_subnet_always_forward;
254 	/** Subnet length we are willing to give up privacy for */
255 	uint8_t max_client_subnet_ipv4;
256 	uint8_t max_client_subnet_ipv6;
257 	/** Minimum subnet length we are willing to answer */
258 	uint8_t min_client_subnet_ipv4;
259 	uint8_t min_client_subnet_ipv6;
260 	/** Max number of nodes in the ECS radix tree */
261 	uint32_t max_ecs_tree_size_ipv4;
262 	uint32_t max_ecs_tree_size_ipv6;
263 #endif
264 	/** list of access control entries, linked list */
265 	struct config_str2list* acls;
266 	/** use default localhost donotqueryaddr entries */
267 	int donotquery_localhost;
268 
269 	/** list of tcp connection limitss, linked list */
270 	struct config_str2list* tcp_connection_limits;
271 
272 	/** harden against very small edns buffer sizes */
273 	int harden_short_bufsize;
274 	/** harden against very large query sizes */
275 	int harden_large_queries;
276 	/** harden against spoofed glue (out of zone data) */
277 	int harden_glue;
278 	/** harden against receiving no DNSSEC data for trust anchor */
279 	int harden_dnssec_stripped;
280 	/** harden against queries that fall under known nxdomain names */
281 	int harden_below_nxdomain;
282 	/** harden the referral path, query for NS,A,AAAA and validate */
283 	int harden_referral_path;
284 	/** harden against algorithm downgrade */
285 	int harden_algo_downgrade;
286 	/** use 0x20 bits in query as random ID bits */
287 	int use_caps_bits_for_id;
288 	/** 0x20 whitelist, domains that do not use capsforid */
289 	struct config_strlist* caps_whitelist;
290 	/** strip away these private addrs from answers, no DNS Rebinding */
291 	struct config_strlist* private_address;
292 	/** allow domain (and subdomains) to use private address space */
293 	struct config_strlist* private_domain;
294 	/** what threshold for unwanted action. */
295 	size_t unwanted_threshold;
296 	/** the number of seconds maximal TTL used for RRsets and messages */
297 	int max_ttl;
298 	/** the number of seconds minimum TTL used for RRsets and messages */
299 	int min_ttl;
300 	/** the number of seconds maximal negative TTL for SOA in auth */
301 	int max_negative_ttl;
302 	/** if prefetching of messages should be performed. */
303 	int prefetch;
304 	/** if prefetching of DNSKEYs should be performed. */
305 	int prefetch_key;
306 	/** deny queries of type ANY with an empty answer */
307 	int deny_any;
308 
309 	/** chrootdir, if not "" or chroot will be done */
310 	char* chrootdir;
311 	/** username to change to, if not "". */
312 	char* username;
313 	/** working directory */
314 	char* directory;
315 	/** filename to log to. */
316 	char* logfile;
317 	/** pidfile to write pid to. */
318 	char* pidfile;
319 
320 	/** should log messages be sent to syslogd */
321 	int use_syslog;
322 	/** log timestamp in ascii UTC */
323 	int log_time_ascii;
324 	/** log queries with one line per query */
325 	int log_queries;
326 	/** log replies with one line per reply */
327 	int log_replies;
328 	/** tag log_queries and log_replies for filtering */
329 	int log_tag_queryreply;
330 	/** log every local-zone hit **/
331 	int log_local_actions;
332 	/** log servfails with a reason */
333 	int log_servfail;
334 	/** log identity to report */
335 	char* log_identity;
336 
337 	/** do not report identity (id.server, hostname.bind) */
338 	int hide_identity;
339 	/** do not report version (version.server, version.bind) */
340 	int hide_version;
341 	/** do not report trustanchor (trustanchor.unbound) */
342 	int hide_trustanchor;
343 	/** do not report the User-Agent HTTP header */
344 	int hide_http_user_agent;
345 	/** identity, hostname is returned if "". */
346 	char* identity;
347 	/** version, package version returned if "". */
348 	char* version;
349 	/** User-Agent for HTTP header */
350 	char* http_user_agent;
351 	/** nsid */
352 	char *nsid_cfg_str;
353 	uint8_t *nsid;
354 	uint16_t nsid_len;
355 
356 	/** the module configuration string */
357 	char* module_conf;
358 
359 	/** files with trusted DS and DNSKEYs in zonefile format, list */
360 	struct config_strlist* trust_anchor_file_list;
361 	/** list of trustanchor keys, linked list */
362 	struct config_strlist* trust_anchor_list;
363 	/** files with 5011 autotrust tracked keys */
364 	struct config_strlist* auto_trust_anchor_file_list;
365 	/** files with trusted DNSKEYs in named.conf format, list */
366 	struct config_strlist* trusted_keys_file_list;
367 	/** insecure domain list */
368 	struct config_strlist* domain_insecure;
369 	/** send key tag query */
370 	int trust_anchor_signaling;
371 	/** enable root key sentinel */
372 	int root_key_sentinel;
373 
374 	/** if not 0, this value is the validation date for RRSIGs */
375 	int32_t val_date_override;
376 	/** the minimum for signature clock skew */
377 	int32_t val_sig_skew_min;
378 	/** the maximum for signature clock skew */
379 	int32_t val_sig_skew_max;
380 	/** max number of query restarts, number of IPs to probe */
381 	int32_t val_max_restart;
382 	/** this value sets the number of seconds before revalidating bogus */
383 	int bogus_ttl;
384 	/** should validator clean additional section for secure msgs */
385 	int val_clean_additional;
386 	/** log bogus messages by the validator */
387 	int val_log_level;
388 	/** squelch val_log_level to log - this is library goes to callback */
389 	int val_log_squelch;
390 	/** should validator allow bogus messages to go through */
391 	int val_permissive_mode;
392 	/** use cached NSEC records to synthesise (negative) answers */
393 	int aggressive_nsec;
394 	/** ignore the CD flag in incoming queries and refuse them bogus data */
395 	int ignore_cd;
396 	/** serve expired entries and prefetch them */
397 	int serve_expired;
398 	/** serve expired entries until TTL after expiration */
399 	int serve_expired_ttl;
400 	/** reset serve expired TTL after failed update attempt */
401 	int serve_expired_ttl_reset;
402 	/** TTL for the serve expired replies */
403 	int serve_expired_reply_ttl;
404 	/** serve expired entries only after trying to update the entries and this
405 	 *  timeout (in milliseconds) is reached */
406 	int serve_expired_client_timeout;
407 	/** serve original TTLs rather than decrementing ones */
408 	int serve_original_ttl;
409 	/** nsec3 maximum iterations per key size, string */
410 	char* val_nsec3_key_iterations;
411 	/** if zonemd failures are permitted, only logged */
412 	int zonemd_permissive_mode;
413 	/** autotrust add holddown time, in seconds */
414 	unsigned int add_holddown;
415 	/** autotrust del holddown time, in seconds */
416 	unsigned int del_holddown;
417 	/** autotrust keep_missing time, in seconds. 0 is forever. */
418 	unsigned int keep_missing;
419 	/** permit small holddown values, allowing 5011 rollover very fast */
420 	int permit_small_holddown;
421 
422 	/** size of the key cache */
423 	size_t key_cache_size;
424 	/** slabs in the key cache. */
425 	size_t key_cache_slabs;
426 	/** size of the neg cache */
427 	size_t neg_cache_size;
428 
429 	/** local zones config */
430 	struct config_str2list* local_zones;
431 	/** local zones nodefault list */
432 	struct config_strlist* local_zones_nodefault;
433 #ifdef USE_IPSET
434 	/** local zones ipset list */
435 	struct config_strlist* local_zones_ipset;
436 #endif
437 	/** do not add any default local zone */
438 	int local_zones_disable_default;
439 	/** local data RRs configured */
440 	struct config_strlist* local_data;
441 	/** local zone override types per netblock */
442 	struct config_str3list* local_zone_overrides;
443 	/** unblock lan zones (reverse lookups for AS112 zones) */
444 	int unblock_lan_zones;
445 	/** insecure lan zones (don't validate AS112 zones) */
446 	int insecure_lan_zones;
447 	/** list of zonename, tagbitlist */
448 	struct config_strbytelist* local_zone_tags;
449 	/** list of aclname, tagbitlist */
450 	struct config_strbytelist* acl_tags;
451 	/** list of aclname, tagname, localzonetype */
452 	struct config_str3list* acl_tag_actions;
453 	/** list of aclname, tagname, redirectdata */
454 	struct config_str3list* acl_tag_datas;
455 	/** list of aclname, view*/
456 	struct config_str2list* acl_view;
457 	/** list of IP-netblock, tagbitlist */
458 	struct config_strbytelist* respip_tags;
459 	/** list of response-driven access control entries, linked list */
460 	struct config_str2list* respip_actions;
461 	/** RRs configured for response-driven access controls */
462 	struct config_str2list* respip_data;
463 	/** tag list, array with tagname[i] is malloced string */
464 	char** tagname;
465 	/** number of items in the taglist */
466 	int num_tags;
467 
468 	/** remote control section. enable toggle. */
469 	int remote_control_enable;
470 	/** the interfaces the remote control should listen on */
471 	struct config_strlist_head control_ifs;
472 	/** if the use-cert option is set */
473 	int control_use_cert;
474 	/** port number for the control port */
475 	int control_port;
476 	/** private key file for server */
477 	char* server_key_file;
478 	/** certificate file for server */
479 	char* server_cert_file;
480 	/** private key file for unbound-control */
481 	char* control_key_file;
482 	/** certificate file for unbound-control */
483 	char* control_cert_file;
484 
485 	/** Python script file */
486 	struct config_strlist* python_script;
487 
488 	/** Dynamic library file */
489 	struct config_strlist* dynlib_file;
490 
491 	/** Use systemd socket activation. */
492 	int use_systemd;
493 
494 	/** daemonize, i.e. fork into the background. */
495 	int do_daemonize;
496 
497 	/* minimal response when positive answer */
498 	int minimal_responses;
499 
500 	/* RRSet roundrobin */
501 	int rrset_roundrobin;
502 
503 	/* wait time for unknown server in msec */
504 	int unknown_server_time_limit;
505 
506 	/* maximum UDP response size */
507 	size_t max_udp_size;
508 
509 	/* DNS64 prefix */
510 	char* dns64_prefix;
511 
512 	/* Synthetize all AAAA record despite the presence of an authoritative one */
513 	int dns64_synthall;
514 	/** ignore AAAAs for these domain names and use A record anyway */
515 	struct config_strlist* dns64_ignore_aaaa;
516 
517 	/** true to enable dnstap support */
518 	int dnstap;
519 	/** using bidirectional frame streams if true */
520 	int dnstap_bidirectional;
521 	/** dnstap socket path */
522 	char* dnstap_socket_path;
523 	/** dnstap IP */
524 	char* dnstap_ip;
525 	/** dnstap TLS enable */
526 	int dnstap_tls;
527 	/** dnstap tls server authentication name */
528 	char* dnstap_tls_server_name;
529 	/** dnstap server cert bundle */
530 	char* dnstap_tls_cert_bundle;
531 	/** dnstap client key for client authentication */
532 	char* dnstap_tls_client_key_file;
533 	/** dnstap client cert for client authentication */
534 	char* dnstap_tls_client_cert_file;
535 	/** true to send "identity" via dnstap */
536 	int dnstap_send_identity;
537 	/** true to send "version" via dnstap */
538 	int dnstap_send_version;
539 	/** dnstap "identity", hostname is used if "". */
540 	char* dnstap_identity;
541 	/** dnstap "version", package version is used if "". */
542 	char* dnstap_version;
543 
544 	/** true to log dnstap RESOLVER_QUERY message events */
545 	int dnstap_log_resolver_query_messages;
546 	/** true to log dnstap RESOLVER_RESPONSE message events */
547 	int dnstap_log_resolver_response_messages;
548 	/** true to log dnstap CLIENT_QUERY message events */
549 	int dnstap_log_client_query_messages;
550 	/** true to log dnstap CLIENT_RESPONSE message events */
551 	int dnstap_log_client_response_messages;
552 	/** true to log dnstap FORWARDER_QUERY message events */
553 	int dnstap_log_forwarder_query_messages;
554 	/** true to log dnstap FORWARDER_RESPONSE message events */
555 	int dnstap_log_forwarder_response_messages;
556 
557 	/** true to disable DNSSEC lameness check in iterator */
558 	int disable_dnssec_lame_check;
559 
560 	/** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */
561 	int ip_ratelimit;
562 	/** number of slabs for ip_ratelimit cache */
563 	size_t ip_ratelimit_slabs;
564 	/** memory size in bytes for ip_ratelimit cache */
565 	size_t ip_ratelimit_size;
566 	/** ip_ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
567 	int ip_ratelimit_factor;
568 	/** ratelimit backoff, when on, if the limit is reached it is
569 	 *  considered an attack and it backs off until 'demand' decreases over
570 	 *  the RATE_WINDOW. */
571 	int ip_ratelimit_backoff;
572 
573 	/** ratelimit for domains. 0 is off, otherwise qps (unless overridden) */
574 	int ratelimit;
575 	/** number of slabs for ratelimit cache */
576 	size_t ratelimit_slabs;
577 	/** memory size in bytes for ratelimit cache */
578 	size_t ratelimit_size;
579 	/** ratelimits for domain (exact match) */
580 	struct config_str2list* ratelimit_for_domain;
581 	/** ratelimits below domain */
582 	struct config_str2list* ratelimit_below_domain;
583 	/** ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
584 	int ratelimit_factor;
585 	/** ratelimit backoff, when on, if the limit is reached it is
586 	 *  considered an attack and it backs off until 'demand' decreases over
587 	 *  the RATE_WINDOW. */
588 	int ratelimit_backoff;
589 
590 	/** number of retries on outgoing queries */
591 	int outbound_msg_retry;
592 	/** minimise outgoing QNAME and hide original QTYPE if possible */
593 	int qname_minimisation;
594 	/** minimise QNAME in strict mode, minimise according to RFC.
595 	 *  Do not apply fallback */
596 	int qname_minimisation_strict;
597 	/** SHM data - true if shm is enabled */
598 	int shm_enable;
599 	/** SHM data - key for the shm */
600 	int shm_key;
601 
602 	/** list of EDNS client string entries, linked list */
603 	struct config_str2list* edns_client_strings;
604 	/** EDNS opcode to use for EDNS client strings */
605 	uint16_t edns_client_string_opcode;
606 
607 	/** DNSCrypt */
608 	/** true to enable dnscrypt */
609 	int dnscrypt;
610 	/** port on which to provide dnscrypt service */
611 	int dnscrypt_port;
612 	/** provider name 2.dnscrypt-cert.example.com */
613 	char* dnscrypt_provider;
614 	/** dnscrypt secret keys 1.key */
615 	struct config_strlist* dnscrypt_secret_key;
616 	/** dnscrypt provider certs 1.cert */
617 	struct config_strlist* dnscrypt_provider_cert;
618 	/** dnscrypt provider certs 1.cert which have been rotated and should not be
619 	* advertised through DNS's providername TXT record but are required to be
620 	* able to handle existing traffic using the old cert. */
621 	struct config_strlist* dnscrypt_provider_cert_rotated;
622 	/** memory size in bytes for dnscrypt shared secrets cache */
623 	size_t dnscrypt_shared_secret_cache_size;
624 	/** number of slabs for dnscrypt shared secrets cache */
625 	size_t dnscrypt_shared_secret_cache_slabs;
626 	/** memory size in bytes for dnscrypt nonces cache */
627 	size_t dnscrypt_nonce_cache_size;
628 	/** number of slabs for dnscrypt nonces cache */
629 	size_t dnscrypt_nonce_cache_slabs;
630 
631 	/** EDNS padding according to RFC7830 and RFC8467 */
632 	/** true to enable padding of responses (default: on) */
633 	int pad_responses;
634 	/** block size with which to pad encrypted responses (default: 468) */
635 	size_t pad_responses_block_size;
636 	/** true to enable padding of queries (default: on) */
637 	int pad_queries;
638 	/** block size with which to pad encrypted queries (default: 128) */
639 	size_t pad_queries_block_size;
640 
641 	/** IPsec module */
642 #ifdef USE_IPSECMOD
643 	/** false to bypass the IPsec module */
644 	int ipsecmod_enabled;
645 	/** whitelisted domains for ipsecmod */
646 	struct config_strlist* ipsecmod_whitelist;
647 	/** path to external hook */
648 	char* ipsecmod_hook;
649 	/** true to proceed even with a bogus IPSECKEY */
650 	int ipsecmod_ignore_bogus;
651 	/** max TTL for the A/AAAA records that call the hook */
652 	int ipsecmod_max_ttl;
653 	/** false to proceed even when ipsecmod_hook fails */
654 	int ipsecmod_strict;
655 #endif
656 
657 	/* cachedb module */
658 #ifdef USE_CACHEDB
659 	/** backend DB name */
660 	char* cachedb_backend;
661 	/** secret seed for hash key calculation */
662 	char* cachedb_secret;
663 #ifdef USE_REDIS
664 	/** redis server's IP address or host name */
665 	char* redis_server_host;
666 	/** redis server's TCP port */
667 	int redis_server_port;
668 	/** timeout (in ms) for communication with the redis server */
669 	int redis_timeout;
670 	/** set timeout on redis records based on DNS response ttl */
671 	int redis_expire_records;
672 #endif
673 #endif
674 
675 	/* ipset module */
676 #ifdef USE_IPSET
677 	char* ipset_name_v4;
678 	char* ipset_name_v6;
679 #endif
680 };
681 
682 /** from cfg username, after daemonize setup performed */
683 extern uid_t cfg_uid;
684 /** from cfg username, after daemonize setup performed */
685 extern gid_t cfg_gid;
686 /** debug and enable small timeouts */
687 extern int autr_permit_small_holddown;
688 /** size (in bytes) of stream wait buffers max */
689 extern size_t stream_wait_max;
690 /** size (in bytes) of all total HTTP2 query buffers max */
691 extern size_t http2_query_buffer_max;
692 /** size (in bytes) of all total HTTP2 response buffers max */
693 extern size_t http2_response_buffer_max;
694 
695 /**
696  * Stub config options
697  */
698 struct config_stub {
699 	/** next in list */
700 	struct config_stub* next;
701 	/** domain name (in text) of the stub apex domain */
702 	char* name;
703 	/** list of stub nameserver hosts (domain name) */
704 	struct config_strlist* hosts;
705 	/** list of stub nameserver addresses (IP address) */
706 	struct config_strlist* addrs;
707 	/** if stub-prime is set */
708 	int isprime;
709 	/** if forward-first is set (failover to without if fails) */
710 	int isfirst;
711 	/** use tcp for queries to this stub */
712 	int tcp_upstream;
713 	/** use SSL for queries to this stub */
714 	int ssl_upstream;
715 	/*** no cache */
716 	int no_cache;
717 };
718 
719 /**
720  * Auth config options
721  */
722 struct config_auth {
723 	/** next in list */
724 	struct config_auth* next;
725 	/** domain name (in text) of the auth apex domain */
726 	char* name;
727 	/** list of masters */
728 	struct config_strlist* masters;
729 	/** list of urls */
730 	struct config_strlist* urls;
731 	/** list of allow-notify */
732 	struct config_strlist* allow_notify;
733 	/** zonefile (or NULL) */
734 	char* zonefile;
735 	/** provide downstream answers */
736 	int for_downstream;
737 	/** provide upstream answers */
738 	int for_upstream;
739 	/** fallback to recursion to authorities if zone expired and other
740 	 * reasons perhaps (like, query bogus) */
741 	int fallback_enabled;
742 	/** this zone is used to create local-zone policies */
743 	int isrpz;
744 	/** rpz tags (or NULL) */
745 	uint8_t* rpz_taglist;
746 	/** length of the taglist (in bytes) */
747 	size_t rpz_taglistlen;
748 	/** Override RPZ action for this zone, regardless of zone content */
749 	char* rpz_action_override;
750 	/** Log when this RPZ policy is applied */
751 	int rpz_log;
752 	/** Display this name in the log when RPZ policy is applied */
753 	char* rpz_log_name;
754 	/** Always reply with this CNAME target if the cname override action is
755 	 * used */
756 	char* rpz_cname;
757 	/** signal nxdomain block with unset RA */
758 	int rpz_signal_nxdomain_ra;
759 	/** Check ZONEMD records for this zone */
760 	int zonemd_check;
761 	/** Reject absence of ZONEMD records, zone must have one */
762 	int zonemd_reject_absence;
763 };
764 
765 /**
766  * View config options
767  */
768 struct config_view {
769 	/** next in list */
770 	struct config_view* next;
771 	/** view name */
772 	char* name;
773 	/** local zones */
774 	struct config_str2list* local_zones;
775 	/** local data RRs */
776 	struct config_strlist* local_data;
777 	/** local zones nodefault list */
778 	struct config_strlist* local_zones_nodefault;
779 #ifdef USE_IPSET
780 	/** local zones ipset list */
781 	struct config_strlist* local_zones_ipset;
782 #endif
783 	/** Fallback to global local_zones when there is no match in the view
784 	 * view specific tree. 1 for yes, 0 for no */
785 	int isfirst;
786 	/** predefined actions for particular IP address responses */
787 	struct config_str2list* respip_actions;
788 	/** data complementing the 'redirect' response IP actions */
789 	struct config_str2list* respip_data;
790 };
791 
792 /**
793  * List of strings for config options
794  */
795 struct config_strlist {
796 	/** next item in list */
797 	struct config_strlist* next;
798 	/** config option string */
799 	char* str;
800 };
801 
802 /**
803  * List of two strings for config options
804  */
805 struct config_str2list {
806 	/** next item in list */
807 	struct config_str2list* next;
808 	/** first string */
809 	char* str;
810 	/** second string */
811 	char* str2;
812 };
813 
814 /**
815  * List of three strings for config options
816  */
817 struct config_str3list {
818 	/** next item in list */
819 	struct config_str3list* next;
820 	/** first string */
821 	char* str;
822 	/** second string */
823 	char* str2;
824 	/** third string */
825 	char* str3;
826 };
827 
828 
829 /**
830  * List of string, bytestring for config options
831  */
832 struct config_strbytelist {
833 	/** next item in list */
834 	struct config_strbytelist* next;
835 	/** first string */
836 	char* str;
837 	/** second bytestring */
838 	uint8_t* str2;
839 	size_t str2len;
840 };
841 
842 /**
843  * Create config file structure. Filled with default values.
844  * @return: the new structure or NULL on memory error.
845  */
846 struct config_file* config_create(void);
847 
848 /**
849  * Create config file structure for library use. Filled with default values.
850  * @return: the new structure or NULL on memory error.
851  */
852 struct config_file* config_create_forlib(void);
853 
854 /**
855  * Read the config file from the specified filename.
856  * @param config: where options are stored into, must be freshly created.
857  * @param filename: name of configfile. If NULL nothing is done.
858  * @param chroot: if not NULL, the chroot dir currently in use (for include).
859  * @return: false on error. In that case errno is set, ENOENT means
860  * 	file not found.
861  */
862 int config_read(struct config_file* config, const char* filename,
863 	const char* chroot);
864 
865 /**
866  * Destroy the config file structure.
867  * @param config: to delete.
868  */
869 void config_delete(struct config_file* config);
870 
871 /**
872  * Apply config to global constants; this routine is called in single thread.
873  * @param config: to apply. Side effect: global constants change.
874  */
875 void config_apply(struct config_file* config);
876 
877 /**
878  * Find username, sets cfg_uid and cfg_gid.
879  * @param config: the config structure.
880  */
881 void config_lookup_uid(struct config_file* config);
882 
883 /**
884  * Set the given keyword to the given value.
885  * @param config: where to store config
886  * @param option: option name, including the ':' character.
887  * @param value: value, this string is copied if needed, or parsed.
888  * 	The caller owns the value string.
889  * @return 0 on error (malloc or syntax error).
890  */
891 int config_set_option(struct config_file* config, const char* option,
892 	const char* value);
893 
894 /**
895  * Call print routine for the given option.
896  * @param cfg: config.
897  * @param opt: option name without trailing :.
898  *	This is different from config_set_option.
899  * @param func: print func, called as (str, arg) for every data element.
900  * @param arg: user argument for print func.
901  * @return false if the option name is not supported (syntax error).
902  */
903 int config_get_option(struct config_file* cfg, const char* opt,
904 	void (*func)(char*,void*), void* arg);
905 
906 /**
907  * Get an option and return strlist
908  * @param cfg: config file
909  * @param opt: option name.
910  * @param list: list is returned here. malloced, caller must free it.
911  * @return 0=OK, 1=syntax error, 2=malloc failed.
912  */
913 int config_get_option_list(struct config_file* cfg, const char* opt,
914 	struct config_strlist** list);
915 
916 /**
917  * Get an option and collate results into string
918  * @param cfg: config file
919  * @param opt: option name.
920  * @param str: string. malloced, caller must free it.
921  * @return 0=OK, 1=syntax error, 2=malloc failed.
922  */
923 int config_get_option_collate(struct config_file* cfg, const char* opt,
924 	char** str);
925 
926 /**
927  * function to print to a file, use as func with config_get_option.
928  * @param line: text to print. \n appended.
929  * @param arg: pass a FILE*, like stdout.
930  */
931 void config_print_func(char* line, void* arg);
932 
933 /**
934  * function to collate the text strings into a strlist_head.
935  * @param line: text to append.
936  * @param arg: pass a strlist_head structure. zeroed on start.
937  */
938 void config_collate_func(char* line, void* arg);
939 
940 /**
941  * take a strlist_head list and return a malloc string. separated with newline.
942  * @param list: strlist first to collate. zeroes return "".
943  * @return NULL on malloc failure. Or if malloc failure happened in strlist.
944  */
945 char* config_collate_cat(struct config_strlist* list);
946 
947 /**
948  * Append text at end of list.
949  * @param list: list head. zeroed at start.
950  * @param item: new item. malloced by caller. if NULL the insertion fails.
951  * @return true on success.
952  * on fail the item is free()ed.
953  */
954 int cfg_strlist_append(struct config_strlist_head* list, char* item);
955 
956 /**
957  * Searches the end of a string list and appends the given text.
958  * @param head: pointer to strlist head variable.
959  * @param item: new item. malloced by caller. if NULL the insertion fails.
960  * @return true on success.
961  */
962 int cfg_strlist_append_ex(struct config_strlist** head, char* item);
963 
964 /**
965  * Find string in strlist.
966  * @param head: pointer to strlist head variable.
967  * @param item: the item to search for.
968  * @return: the element in the list when found, NULL otherwise.
969  */
970 struct config_strlist* cfg_strlist_find(struct config_strlist* head,
971 	const char* item);
972 
973 /**
974  * Insert string into strlist.
975  * @param head: pointer to strlist head variable.
976  * @param item: new item. malloced by caller. If NULL the insertion fails.
977  * @return: true on success.
978  * on fail, the item is free()d.
979  */
980 int cfg_strlist_insert(struct config_strlist** head, char* item);
981 
982 /** insert with region for allocation. */
983 int cfg_region_strlist_insert(struct regional* region,
984 	struct config_strlist** head, char* item);
985 
986 /**
987  * Insert string into str2list.
988  * @param head: pointer to str2list head variable.
989  * @param item: new item. malloced by caller. If NULL the insertion fails.
990  * @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
991  * @return: true on success.
992  * on fail, the item and i2 are free()d.
993  */
994 int cfg_str2list_insert(struct config_str2list** head, char* item, char* i2);
995 
996 /**
997  * Insert string into str3list.
998  * @param head: pointer to str3list head variable.
999  * @param item: new item. malloced by caller. If NULL the insertion fails.
1000  * @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
1001  * @param i3: 3rd string, malloced by caller. If NULL the insertion fails.
1002  * @return: true on success.
1003  */
1004 int cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
1005 	char* i3);
1006 
1007 /**
1008  * Insert string into strbytelist.
1009  * @param head: pointer to strbytelist head variable.
1010  * @param item: new item. malloced by caller. If NULL the insertion fails.
1011  * @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
1012  * @param i2len: length of the i2 bytestring.
1013  * @return: true on success.
1014  */
1015 int cfg_strbytelist_insert(struct config_strbytelist** head, char* item,
1016 	uint8_t* i2, size_t i2len);
1017 
1018 /**
1019  * Find stub in config list, also returns prevptr (for deletion).
1020  * @param pp: call routine with pointer to a pointer to the start of the list,
1021  * 	if the stub is found, on exit, the value contains a pointer to the
1022  * 	next pointer that points to the found element (or to the list start
1023  * 	pointer if it is the first element).
1024  * @param nm: name of stub to find.
1025  * @return: pointer to config_stub if found, or NULL if not found.
1026  */
1027 struct config_stub* cfg_stub_find(struct config_stub*** pp, const char* nm);
1028 
1029 /**
1030  * Delete items in config string list.
1031  * @param list: list.
1032  */
1033 void config_delstrlist(struct config_strlist* list);
1034 
1035 /**
1036  * Delete items in config double string list.
1037  * @param list: list.
1038  */
1039 void config_deldblstrlist(struct config_str2list* list);
1040 
1041 /**
1042  * Delete items in config triple string list.
1043  * @param list: list.
1044  */
1045 void config_deltrplstrlist(struct config_str3list* list);
1046 
1047 /** delete string array */
1048 void config_del_strarray(char** array, int num);
1049 
1050 /** delete stringbytelist */
1051 void config_del_strbytelist(struct config_strbytelist* list);
1052 
1053 /**
1054  * Delete a stub item
1055  * @param p: stub item
1056  */
1057 void config_delstub(struct config_stub* p);
1058 
1059 /**
1060  * Delete items in config stub list.
1061  * @param list: list.
1062  */
1063 void config_delstubs(struct config_stub* list);
1064 
1065 /**
1066  * Delete an auth item
1067  * @param p: auth item
1068  */
1069 void config_delauth(struct config_auth* p);
1070 
1071 /**
1072  * Delete items in config auth list.
1073  * @param list: list.
1074  */
1075 void config_delauths(struct config_auth* list);
1076 
1077 /**
1078  * Delete a view item
1079  * @param p: view item
1080  */
1081 void config_delview(struct config_view* p);
1082 
1083 /**
1084  * Delete items in config view list.
1085  * @param list: list.
1086  */
1087 void config_delviews(struct config_view* list);
1088 
1089 /** check if config for remote control turns on IP-address interface
1090  * with certificates or a named pipe without certificates. */
1091 int options_remote_is_address(struct config_file* cfg);
1092 
1093 /**
1094  * Convert 14digit to time value
1095  * @param str: string of 14 digits
1096  * @return time value or 0 for error.
1097  */
1098 time_t cfg_convert_timeval(const char* str);
1099 
1100 /**
1101  * Count number of values in the string.
1102  * format ::= (sp num)+ sp
1103  * num ::= [-](0-9)+
1104  * sp ::= (space|tab)*
1105  *
1106  * @param str: string
1107  * @return: 0 on parse error, or empty string, else
1108  *	number of integer values in the string.
1109  */
1110 int cfg_count_numbers(const char* str);
1111 
1112 /**
1113  * Convert a 'nice' memory or file size into a bytecount
1114  * From '100k' to 102400. and so on. Understands kKmMgG.
1115  * k=1024, m=1024*1024, g=1024*1024*1024.
1116  * @param str: string
1117  * @param res: result is stored here, size in bytes.
1118  * @return: true if parsed correctly, or 0 on a parse error (and an error
1119  * is logged).
1120  */
1121 int cfg_parse_memsize(const char* str, size_t* res);
1122 
1123 /**
1124  * Parse nsid from string into binary nsid. nsid is either a hexadecimal
1125  * string or an ascii string prepended with ascii_ in which case the
1126  * characters after ascii_ are simply copied.
1127  * @param str: the string to parse.
1128  * @param nsid_len: returns length of nsid in bytes.
1129  * @return malloced bytes or NULL on parse error or malloc failure.
1130  */
1131 uint8_t* cfg_parse_nsid(const char* str, uint16_t* nsid_len);
1132 
1133 /**
1134  * Add a tag name to the config.  It is added at the end with a new ID value.
1135  * @param cfg: the config structure.
1136  * @param tag: string (which is copied) with the name.
1137  * @return: false on alloc failure.
1138  */
1139 int config_add_tag(struct config_file* cfg, const char* tag);
1140 
1141 /**
1142  * Find tag ID in the tag list.
1143  * @param cfg: the config structure.
1144  * @param tag: string with tag name to search for.
1145  * @return: 0..(num_tags-1) with tag ID, or -1 if tagname is not found.
1146  */
1147 int find_tag_id(struct config_file* cfg, const char* tag);
1148 
1149 /**
1150  * parse taglist from string into bytestring with bitlist.
1151  * @param cfg: the config structure (with tagnames)
1152  * @param str: the string to parse.  Parse puts 0 bytes in string.
1153  * @param listlen: returns length of in bytes.
1154  * @return malloced bytes with a bitlist of the tags.  or NULL on parse error
1155  * or malloc failure.
1156  */
1157 uint8_t* config_parse_taglist(struct config_file* cfg, char* str,
1158 	size_t* listlen);
1159 
1160 /**
1161  * convert tag bitlist to a malloced string with tag names.  For debug output.
1162  * @param cfg: the config structure (with tagnames)
1163  * @param taglist: the tag bitlist.
1164  * @param len: length of the tag bitlist.
1165  * @return malloced string or NULL.
1166  */
1167 char* config_taglist2str(struct config_file* cfg, uint8_t* taglist,
1168 	size_t len);
1169 
1170 /**
1171  * see if two taglists intersect (have tags in common).
1172  * @param list1: first tag bitlist.
1173  * @param list1len: length in bytes of first list.
1174  * @param list2: second tag bitlist.
1175  * @param list2len: length in bytes of second list.
1176  * @return true if there are tags in common, 0 if not.
1177  */
1178 int taglist_intersect(uint8_t* list1, size_t list1len, const uint8_t* list2,
1179 	size_t list2len);
1180 
1181 /**
1182  * Parse local-zone directive into two strings and register it in the config.
1183  * @param cfg: to put it in.
1184  * @param val: argument strings to local-zone, "example.com nodefault".
1185  * @return: false on failure
1186  */
1187 int cfg_parse_local_zone(struct config_file* cfg, const char* val);
1188 
1189 /**
1190  * Mark "number" or "low-high" as available or not in ports array.
1191  * @param str: string in input
1192  * @param allow: give true if this range is permitted.
1193  * @param avail: the array from cfg.
1194  * @param num: size of the array (65536).
1195  * @return: true if parsed correctly, or 0 on a parse error (and an error
1196  * is logged).
1197  */
1198 int cfg_mark_ports(const char* str, int allow, int* avail, int num);
1199 
1200 /**
1201  * Get a condensed list of ports returned. allocated.
1202  * @param cfg: config file.
1203  * @param avail: the available ports array is returned here.
1204  * @return: number of ports in array or 0 on error.
1205  */
1206 int cfg_condense_ports(struct config_file* cfg, int** avail);
1207 
1208 /**
1209  * Apply system specific port range policy.
1210  * @param cfg: config file.
1211  * @param num: size of the array (65536).
1212  */
1213 void cfg_apply_local_port_policy(struct config_file* cfg, int num);
1214 
1215 /**
1216  * Scan ports available
1217  * @param avail: the array from cfg.
1218  * @param num: size of the array (65536).
1219  * @return the number of ports available for use.
1220  */
1221 int cfg_scan_ports(int* avail, int num);
1222 
1223 /**
1224  * Convert a filename to full pathname in original filesys
1225  * @param fname: the path name to convert.
1226  *      Must not be null or empty.
1227  * @param cfg: config struct for chroot and chdir (if set).
1228  * @param use_chdir: if false, only chroot is applied.
1229  * @return pointer to malloced buffer which is: [chroot][chdir]fname
1230  *      or NULL on malloc failure.
1231  */
1232 char* fname_after_chroot(const char* fname, struct config_file* cfg,
1233 	int use_chdir);
1234 
1235 /**
1236  * Convert a ptr shorthand into a full reverse-notation PTR record.
1237  * @param str: input string, "IP name"
1238  * @return: malloced string "reversed-ip-name PTR name"
1239  */
1240 char* cfg_ptr_reverse(char* str);
1241 
1242 /**
1243  * Append text to the error info for validation.
1244  * @param qstate: query state.
1245  * @param str: copied into query region and appended.
1246  * Failures to allocate are logged.
1247  */
1248 void errinf(struct module_qstate* qstate, const char* str);
1249 
1250 /**
1251  * Append text to error info:  from 1.2.3.4
1252  * @param qstate: query state.
1253  * @param origin: sock list with origin of trouble.
1254  *	Every element added.
1255  *	If NULL: nothing is added.
1256  *	if 0len element: 'from cache' is added.
1257  */
1258 void errinf_origin(struct module_qstate* qstate, struct sock_list *origin);
1259 
1260 /**
1261  * Append text to error info:  for RRset name type class
1262  * @param qstate: query state.
1263  * @param rr: rrset_key.
1264  */
1265 void errinf_rrset(struct module_qstate* qstate, struct ub_packed_rrset_key *rr);
1266 
1267 /**
1268  * Append text to error info:  str dname
1269  * @param qstate: query state.
1270  * @param str: explanation string
1271  * @param dname: the dname.
1272  */
1273 void errinf_dname(struct module_qstate* qstate, const char* str,
1274 	uint8_t* dname);
1275 
1276 /**
1277  * Create error info in string.  For validation failures.
1278  * @param qstate: query state.
1279  * @return string or NULL on malloc failure (already logged).
1280  *    This string is malloced and has to be freed by caller.
1281  */
1282 char* errinf_to_str_bogus(struct module_qstate* qstate);
1283 
1284 /**
1285  * Create error info in string.  For other servfails.
1286  * @param qstate: query state.
1287  * @return string or NULL on malloc failure (already logged).
1288  *    This string is malloced and has to be freed by caller.
1289  */
1290 char* errinf_to_str_servfail(struct module_qstate* qstate);
1291 
1292 /**
1293  * Used during options parsing
1294  */
1295 struct config_parser_state {
1296 	/** name of file being parser */
1297 	char* filename;
1298 	/** line number in the file, starts at 1 */
1299 	int line;
1300 	/** number of errors encountered */
1301 	int errors;
1302 	/** the result of parsing is stored here. */
1303 	struct config_file* cfg;
1304 	/** the current chroot dir (or NULL if none) */
1305 	const char* chroot;
1306 };
1307 
1308 /** global config parser object used during config parsing */
1309 extern struct config_parser_state* cfg_parser;
1310 /** init lex state */
1311 void init_cfg_parse(void);
1312 /** lex in file */
1313 extern FILE* ub_c_in;
1314 /** lex out file */
1315 extern FILE* ub_c_out;
1316 /** the yacc lex generated parse function */
1317 int ub_c_parse(void);
1318 /** the lexer function */
1319 int ub_c_lex(void);
1320 /** wrap function */
1321 int ub_c_wrap(void);
1322 /** parsing helpers: print error with file and line numbers */
1323 void ub_c_error(const char* msg);
1324 /** parsing helpers: print error with file and line numbers */
1325 void ub_c_error_msg(const char* fmt, ...) ATTR_FORMAT(printf, 1, 2);
1326 
1327 #ifdef UB_ON_WINDOWS
1328 /**
1329  * Obtain registry string (if it exists).
1330  * @param key: key string
1331  * @param name: name of value to fetch.
1332  * @return malloced string with the result or NULL if it did not
1333  * 	exist on an error (logged with log_err) was encountered.
1334  */
1335 char* w_lookup_reg_str(const char* key, const char* name);
1336 
1337 /** Modify directory in options for module file name */
1338 void w_config_adjust_directory(struct config_file* cfg);
1339 #endif /* UB_ON_WINDOWS */
1340 
1341 /** debug option for unit tests. */
1342 extern int fake_dsa, fake_sha1;
1343 
1344 /** see if interface is https, its port number == the https port number */
1345 int if_is_https(const char* ifname, const char* port, int https_port);
1346 
1347 /**
1348  * Return true if the config contains settings that enable https.
1349  * @param cfg: config information.
1350  * @return true if https ports are used for server.
1351  */
1352 int cfg_has_https(struct config_file* cfg);
1353 
1354 #ifdef USE_LINUX_IP_LOCAL_PORT_RANGE
1355 #define LINUX_IP_LOCAL_PORT_RANGE_PATH "/proc/sys/net/ipv4/ip_local_port_range"
1356 #endif
1357 
1358 #endif /* UTIL_CONFIG_FILE_H */
1359 
1360