2 * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * The config checker checks for syntax and other errors in the unbound.conf
40 * file, and can be used to check for errors before the server is started
42 * Exit status 1 means an error.
48 #include "util/config_file.h"
49 #include "util/module.h"
50 #include "util/net_help.h"
51 #include "util/regional.h"
52 #include "iterator/iterator.h"
53 #include "iterator/iter_fwd.h"
54 #include "iterator/iter_hints.h"
55 #include "validator/validator.h"
56 #include "services/localzone.h"
57 #include "services/view.h"
58 #include "services/authzone.h"
59 #include "respip/respip.h"
60 #include "sldns/sbuffer.h"
61 #include "sldns/str2wire.h"
68 #ifdef HAVE_SYS_STAT_H
74 #ifdef WITH_PYTHONMODULE
75 #include "pythonmod/pythonmod.h"
78 #include "edns-subnet/subnet-whitelist.h"
81 /** Give checkconf usage, and exit (1). */
85 printf("Usage: local-unbound-checkconf [file]\n");
86 printf(" Checks unbound configuration file for errors.\n");
87 printf("file if omitted %s is used.\n", CONFIGFILE);
88 printf("-o option print value of option to stdout.\n");
89 printf("-f output full pathname with chroot applied, eg. with -o pidfile.\n");
90 printf("-h show this usage help.\n");
91 printf("Version %s\n", PACKAGE_VERSION);
92 printf("BSD licensed, see LICENSE in source package for details.\n");
93 printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
98 * Print given option to stdout
100 * @param opt: option name without trailing :.
101 * This is different from config_set_option.
102 * @param final: if final pathname with chroot applied has to be printed.
105 print_option(struct config_file* cfg, const char* opt, int final)
107 if(strcmp(opt, "pidfile") == 0 && final) {
108 char *p = fname_after_chroot(cfg->pidfile, cfg, 1);
109 if(!p) fatal_exit("out of memory");
114 if(strcmp(opt, "auto-trust-anchor-file") == 0 && final) {
115 struct config_strlist* s = cfg->auto_trust_anchor_file_list;
116 for(; s; s=s->next) {
117 char *p = fname_after_chroot(s->str, cfg, 1);
118 if(!p) fatal_exit("out of memory");
124 if(!config_get_option(cfg, opt, config_print_func, stdout))
125 fatal_exit("cannot print option '%s'", opt);
128 /** check if module works with config */
130 check_mod(struct config_file* cfg, struct module_func_block* fb)
132 struct module_env env;
133 memset(&env, 0, sizeof(env));
135 env.scratch = regional_create();
136 env.scratch_buffer = sldns_buffer_new(BUFSIZ);
137 if(!env.scratch || !env.scratch_buffer)
138 fatal_exit("out of memory");
139 if(!edns_known_options_init(&env))
140 fatal_exit("out of memory");
141 if(!(*fb->init)(&env, 0)) {
142 fatal_exit("bad config for %s module", fb->name);
144 (*fb->deinit)(&env, 0);
145 sldns_buffer_free(env.scratch_buffer);
146 regional_destroy(env.scratch);
147 edns_known_options_delete(&env);
150 /** true if addr is a localhost address, 127.0.0.1 or ::1 (with maybe "@port"
153 str_addr_is_localhost(const char* a)
155 if(strncmp(a, "127.", 4) == 0) return 1;
156 if(strncmp(a, "::1", 3) == 0) return 1;
160 /** check do-not-query-localhost */
162 donotquerylocalhostcheck(struct config_file* cfg)
164 if(cfg->donotquery_localhost) {
165 struct config_stub* p;
166 struct config_strlist* s;
167 for(p=cfg->forwards; p; p=p->next) {
168 for(s=p->addrs; s; s=s->next) {
169 if(str_addr_is_localhost(s->str)) {
170 fprintf(stderr, "unbound-checkconf: warning: forward-addr: '%s' is specified for forward-zone: '%s', but do-not-query-localhost: yes means that the address will not be used for lookups.\n",
175 for(p=cfg->stubs; p; p=p->next) {
176 for(s=p->addrs; s; s=s->next) {
177 if(str_addr_is_localhost(s->str)) {
178 fprintf(stderr, "unbound-checkconf: warning: stub-addr: '%s' is specified for stub-zone: '%s', but do-not-query-localhost: yes means that the address will not be used for lookups.\n",
186 /** check localzones */
188 localzonechecks(struct config_file* cfg)
190 struct local_zones* zs;
191 if(!(zs = local_zones_create()))
192 fatal_exit("out of memory");
193 if(!local_zones_apply_cfg(zs, cfg))
194 fatal_exit("failed local-zone, local-data configuration");
195 local_zones_delete(zs);
198 /** checks for acl and views */
200 acl_view_tag_checks(struct config_file* cfg, struct views* views)
203 struct sockaddr_storage a;
205 struct config_str2list* acl;
206 struct config_str3list* s3;
207 struct config_strbytelist* sb;
210 for(acl=cfg->acl_view; acl; acl = acl->next) {
212 if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
214 fatal_exit("cannot parse access-control-view "
215 "address %s %s", acl->str, acl->str2);
217 v = views_find_view(views, acl->str2, 0);
219 fatal_exit("cannot find view for "
220 "access-control-view: %s %s",
221 acl->str, acl->str2);
223 lock_rw_unlock(&v->lock);
227 for(sb=cfg->acl_tags; sb; sb = sb->next) {
228 if(!netblockstrtoaddr(sb->str, UNBOUND_DNS_PORT, &a, &alen,
230 fatal_exit("cannot parse access-control-tags "
231 "address %s", sb->str);
235 /* acl_tag_actions */
236 for(s3=cfg->acl_tag_actions; s3; s3 = s3->next) {
237 enum localzone_type t;
238 if(!netblockstrtoaddr(s3->str, UNBOUND_DNS_PORT, &a, &alen,
240 fatal_exit("cannot parse access-control-tag-actions "
242 s3->str, s3->str2, s3->str3);
244 if(find_tag_id(cfg, s3->str2) == -1) {
245 fatal_exit("cannot parse tag %s (define-tag it), "
246 "for access-control-tag-actions: %s %s %s",
247 s3->str2, s3->str, s3->str2, s3->str3);
249 if(!local_zone_str2type(s3->str3, &t)) {
250 fatal_exit("cannot parse access control action type %s"
251 " for access-control-tag-actions: %s %s %s",
252 s3->str3, s3->str, s3->str2, s3->str3);
257 for(s3=cfg->acl_tag_datas; s3; s3 = s3->next) {
259 uint8_t rr[LDNS_RR_BUF_SIZE];
260 size_t len = sizeof(rr);
262 if(!netblockstrtoaddr(s3->str, UNBOUND_DNS_PORT, &a, &alen,
264 fatal_exit("cannot parse access-control-tag-datas address %s %s '%s'",
265 s3->str, s3->str2, s3->str3);
267 if(find_tag_id(cfg, s3->str2) == -1) {
268 fatal_exit("cannot parse tag %s (define-tag it), "
269 "for access-control-tag-datas: %s %s '%s'",
270 s3->str2, s3->str, s3->str2, s3->str3);
272 /* '.' is sufficient for validation, and it makes the call to
273 * sldns_wirerr_get_type() simpler below. */
274 snprintf(buf, sizeof(buf), "%s %s", ".", s3->str3);
275 res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600, NULL,
278 fatal_exit("cannot parse rr data [char %d] parse error %s, for access-control-tag-datas: %s %s '%s'",
279 (int)LDNS_WIREPARSE_OFFSET(res)-2,
280 sldns_get_errorstr_parse(res),
281 s3->str, s3->str2, s3->str3);
286 /** check view and response-ip configuration */
288 view_and_respipchecks(struct config_file* cfg)
290 struct views* views = NULL;
291 struct respip_set* respip = NULL;
293 if(!(views = views_create()))
294 fatal_exit("Could not create views: out of memory");
295 if(!(respip = respip_set_create()))
296 fatal_exit("Could not create respip set: out of memory");
297 if(!views_apply_cfg(views, cfg))
298 fatal_exit("Could not set up views");
299 if(!respip_global_apply_cfg(respip, cfg))
300 fatal_exit("Could not setup respip set");
301 if(!respip_views_apply_cfg(views, cfg, &ignored))
302 fatal_exit("Could not setup per-view respip sets");
303 acl_view_tag_checks(cfg, views);
305 respip_set_delete(respip);
308 /** emit warnings for IP in hosts */
310 warn_hosts(const char* typ, struct config_stub* list)
312 struct sockaddr_storage a;
314 struct config_stub* s;
315 struct config_strlist* h;
316 for(s=list; s; s=s->next) {
317 for(h=s->hosts; h; h=h->next) {
318 if(extstrtoaddr(h->str, &a, &alen)) {
319 fprintf(stderr, "unbound-checkconf: warning:"
320 " %s %s: \"%s\" is an IP%s address, "
321 "and when looked up as a host name "
322 "during use may not resolve.\n",
323 s->name, typ, h->str,
324 addr_is_ip6(&a, alen)?"6":"4");
330 /** check interface strings */
332 interfacechecks(struct config_file* cfg)
335 struct sockaddr_storage a;
338 for(i=0; i<cfg->num_ifs; i++) {
339 if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
340 fatal_exit("cannot parse interface specified as '%s'",
343 for(j=0; j<cfg->num_ifs; j++) {
344 if(i!=j && strcmp(cfg->ifs[i], cfg->ifs[j])==0)
345 fatal_exit("interface: %s present twice, "
346 "cannot bind same ports twice.",
350 for(i=0; i<cfg->num_out_ifs; i++) {
351 if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen) &&
352 !netblockstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen, &d)) {
353 fatal_exit("cannot parse outgoing-interface "
354 "specified as '%s'", cfg->out_ifs[i]);
356 for(j=0; j<cfg->num_out_ifs; j++) {
357 if(i!=j && strcmp(cfg->out_ifs[i], cfg->out_ifs[j])==0)
358 fatal_exit("outgoing-interface: %s present "
359 "twice, cannot bind same ports twice.",
367 aclchecks(struct config_file* cfg)
370 struct sockaddr_storage a;
372 struct config_str2list* acl;
373 for(acl=cfg->acls; acl; acl = acl->next) {
374 if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
376 fatal_exit("cannot parse access control address %s %s",
377 acl->str, acl->str2);
382 /** check tcp connection limit ips */
384 tcpconnlimitchecks(struct config_file* cfg)
387 struct sockaddr_storage a;
389 struct config_str2list* tcl;
390 for(tcl=cfg->tcp_connection_limits; tcl; tcl = tcl->next) {
391 if(!netblockstrtoaddr(tcl->str, UNBOUND_DNS_PORT, &a, &alen,
393 fatal_exit("cannot parse tcp connection limit address %s %s",
394 tcl->str, tcl->str2);
399 /** true if fname is a file */
401 is_file(const char* fname)
404 if(stat(fname, &buf) < 0) {
406 printf("warning: no search permission for one of the directories in path: %s\n", fname);
412 if(S_ISDIR(buf.st_mode)) {
413 printf("%s is not a file\n", fname);
419 /** true if fname is a directory */
421 is_dir(const char* fname)
424 if(stat(fname, &buf) < 0) {
426 printf("warning: no search permission for one of the directories in path: %s\n", fname);
432 if(!(S_ISDIR(buf.st_mode))) {
433 printf("%s is not a directory\n", fname);
439 /** get base dir of a fname */
444 if(!fname) fatal_exit("out of memory");
445 rev = strrchr(fname, '/');
446 if(!rev) return NULL;
447 if(fname == rev) return NULL;
452 /** check chroot for a file string */
454 check_chroot_string(const char* desc, char** ss,
455 const char* chrootdir, struct config_file* cfg)
459 *ss = fname_after_chroot(str, cfg, 1);
460 if(!*ss) fatal_exit("out of memory");
462 if(chrootdir && chrootdir[0])
463 fatal_exit("%s: \"%s\" does not exist in "
464 "chrootdir %s", desc, str, chrootdir);
466 fatal_exit("%s: \"%s\" does not exist",
469 /* put in a new full path for continued checking */
474 /** check file list, every file must be inside the chroot location */
476 check_chroot_filelist(const char* desc, struct config_strlist* list,
477 const char* chrootdir, struct config_file* cfg)
479 struct config_strlist* p;
480 for(p=list; p; p=p->next) {
481 check_chroot_string(desc, &p->str, chrootdir, cfg);
485 /** check file list, with wildcard processing */
487 check_chroot_filelist_wild(const char* desc, struct config_strlist* list,
488 const char* chrootdir, struct config_file* cfg)
490 struct config_strlist* p;
491 for(p=list; p; p=p->next) {
493 if(strchr(p->str, '*') || strchr(p->str, '[') ||
494 strchr(p->str, '?') || strchr(p->str, '{') ||
495 strchr(p->str, '~')) {
497 /* adjust whole pattern for chroot and check later */
498 p->str = fname_after_chroot(p->str, cfg, 1);
501 #endif /* HAVE_GLOB */
502 check_chroot_string(desc, &p->str, chrootdir, cfg);
507 /** check ECS configuration */
509 ecs_conf_checks(struct config_file* cfg)
511 struct ecs_whitelist* whitelist = NULL;
512 if(!(whitelist = ecs_whitelist_create()))
513 fatal_exit("Could not create ednssubnet whitelist: out of memory");
514 if(!ecs_whitelist_apply_cfg(whitelist, cfg))
515 fatal_exit("Could not setup ednssubnet whitelist");
516 ecs_whitelist_delete(whitelist);
518 #endif /* CLIENT_SUBNET */
520 /** check that the modules exist, are compiled in */
522 check_modules_exist(const char* module_conf)
524 const char** names = module_list_avail();
525 const char* s = module_conf;
529 while(*s && isspace((unsigned char)*s))
533 if(strncmp(names[i], s, strlen(names[i])) == 0) {
544 for(j=0; j<sizeof(n)-1; j++) {
545 if(!s[j] || isspace((unsigned char)s[j])) {
551 fatal_exit("module_conf lists module '%s' but that "
552 "module is not available.", n);
554 s += strlen(names[i]);
558 /** check configuration for errors */
560 morechecks(struct config_file* cfg)
562 warn_hosts("stub-host", cfg->stubs);
563 warn_hosts("forward-host", cfg->forwards);
564 interfacechecks(cfg);
566 tcpconnlimitchecks(cfg);
568 if(cfg->verbosity < 0)
569 fatal_exit("verbosity value < 0");
570 if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
571 fatal_exit("num_threads value weird");
572 if(!cfg->do_ip4 && !cfg->do_ip6)
573 fatal_exit("ip4 and ip6 are both disabled, pointless");
574 if(!cfg->do_ip4 && cfg->prefer_ip4)
575 fatal_exit("cannot prefer and disable ip4, pointless");
576 if(!cfg->do_ip6 && cfg->prefer_ip6)
577 fatal_exit("cannot prefer and disable ip6, pointless");
578 if(!cfg->do_udp && !cfg->do_tcp)
579 fatal_exit("udp and tcp are both disabled, pointless");
580 if(cfg->edns_buffer_size > cfg->msg_buffer_size)
581 fatal_exit("edns-buffer-size larger than msg-buffer-size, "
582 "answers will not fit in processing buffer");
584 w_config_adjust_directory(cfg);
586 if(cfg->chrootdir && cfg->chrootdir[0] &&
587 cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
588 fatal_exit("chootdir %s has trailing slash '/' please remove.",
590 if(cfg->chrootdir && cfg->chrootdir[0] &&
591 !is_dir(cfg->chrootdir)) {
592 fatal_exit("bad chroot directory");
594 if(cfg->directory && cfg->directory[0]) {
595 char* ad = fname_after_chroot(cfg->directory, cfg, 0);
596 if(!ad) fatal_exit("out of memory");
597 if(!is_dir(ad)) fatal_exit("bad chdir directory");
600 if( (cfg->chrootdir && cfg->chrootdir[0]) ||
601 (cfg->directory && cfg->directory[0])) {
602 if(cfg->pidfile && cfg->pidfile[0]) {
603 char* ad = (cfg->pidfile[0]=='/')?strdup(cfg->pidfile):
604 fname_after_chroot(cfg->pidfile, cfg, 1);
605 char* bd = basedir(ad);
606 if(bd && !is_dir(bd))
607 fatal_exit("pidfile directory does not exist");
610 if(cfg->logfile && cfg->logfile[0]) {
611 char* ad = fname_after_chroot(cfg->logfile, cfg, 1);
612 char* bd = basedir(ad);
613 if(bd && !is_dir(bd))
614 fatal_exit("logfile directory does not exist");
619 check_chroot_filelist("file with root-hints",
620 cfg->root_hints, cfg->chrootdir, cfg);
621 check_chroot_filelist("trust-anchor-file",
622 cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
623 check_chroot_filelist("auto-trust-anchor-file",
624 cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
625 check_chroot_filelist_wild("trusted-keys-file",
626 cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
628 if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
629 /* only check hook if enabled */
630 check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
631 cfg->chrootdir, cfg);
634 /* remove chroot setting so that modules are not stripping pathnames*/
635 free(cfg->chrootdir);
636 cfg->chrootdir = NULL;
638 /* check that the modules listed in module_conf exist */
639 check_modules_exist(cfg->module_conf);
641 /* Respip is known to *not* work with dns64. */
642 if(strcmp(cfg->module_conf, "iterator") != 0
643 && strcmp(cfg->module_conf, "validator iterator") != 0
644 && strcmp(cfg->module_conf, "dns64 validator iterator") != 0
645 && strcmp(cfg->module_conf, "dns64 iterator") != 0
646 && strcmp(cfg->module_conf, "respip iterator") != 0
647 && strcmp(cfg->module_conf, "respip validator iterator") != 0
648 #ifdef WITH_PYTHONMODULE
649 && strcmp(cfg->module_conf, "python iterator") != 0
650 && strcmp(cfg->module_conf, "python respip iterator") != 0
651 && strcmp(cfg->module_conf, "python validator iterator") != 0
652 && strcmp(cfg->module_conf, "python respip validator iterator") != 0
653 && strcmp(cfg->module_conf, "validator python iterator") != 0
654 && strcmp(cfg->module_conf, "dns64 python iterator") != 0
655 && strcmp(cfg->module_conf, "dns64 python validator iterator") != 0
656 && strcmp(cfg->module_conf, "dns64 validator python iterator") != 0
657 && strcmp(cfg->module_conf, "python dns64 iterator") != 0
658 && strcmp(cfg->module_conf, "python dns64 validator iterator") != 0
660 #ifdef WITH_DYNLIBMODULE
661 && strcmp(cfg->module_conf, "dynlib iterator") != 0
662 && strcmp(cfg->module_conf, "dynlib dynlib iterator") != 0
663 && strcmp(cfg->module_conf, "dynlib dynlib dynlib iterator") != 0
664 && strcmp(cfg->module_conf, "python dynlib iterator") != 0
665 && strcmp(cfg->module_conf, "python dynlib dynlib iterator") != 0
666 && strcmp(cfg->module_conf, "python dynlib dynlib dynlib iterator") != 0
667 && strcmp(cfg->module_conf, "dynlib respip iterator") != 0
668 && strcmp(cfg->module_conf, "dynlib validator iterator") != 0
669 && strcmp(cfg->module_conf, "dynlib dynlib validator iterator") != 0
670 && strcmp(cfg->module_conf, "dynlib dynlib dynlib validator iterator") != 0
671 && strcmp(cfg->module_conf, "python dynlib validator iterator") != 0
672 && strcmp(cfg->module_conf, "python dynlib dynlib validator iterator") != 0
673 && strcmp(cfg->module_conf, "python dynlib dynlib dynlib validator iterator") != 0
674 && strcmp(cfg->module_conf, "dynlib respip validator iterator") != 0
675 && strcmp(cfg->module_conf, "validator dynlib iterator") != 0
676 && strcmp(cfg->module_conf, "dns64 dynlib iterator") != 0
677 && strcmp(cfg->module_conf, "dns64 dynlib validator iterator") != 0
678 && strcmp(cfg->module_conf, "dns64 validator dynlib iterator") != 0
679 && strcmp(cfg->module_conf, "dynlib dns64 iterator") != 0
680 && strcmp(cfg->module_conf, "dynlib dns64 validator iterator") != 0
681 && strcmp(cfg->module_conf, "dynlib dns64 cachedb iterator") != 0
682 && strcmp(cfg->module_conf, "dynlib dns64 validator cachedb iterator") != 0
683 && strcmp(cfg->module_conf, "dns64 dynlib cachedb iterator") != 0
684 && strcmp(cfg->module_conf, "dns64 dynlib validator cachedb iterator") != 0
685 && strcmp(cfg->module_conf, "dynlib cachedb iterator") != 0
686 && strcmp(cfg->module_conf, "dynlib respip cachedb iterator") != 0
687 && strcmp(cfg->module_conf, "dynlib validator cachedb iterator") != 0
688 && strcmp(cfg->module_conf, "dynlib respip validator cachedb iterator") != 0
689 && strcmp(cfg->module_conf, "cachedb dynlib iterator") != 0
690 && strcmp(cfg->module_conf, "respip cachedb dynlib iterator") != 0
691 && strcmp(cfg->module_conf, "validator cachedb dynlib iterator") != 0
692 && strcmp(cfg->module_conf, "respip validator cachedb dynlib iterator") != 0
693 && strcmp(cfg->module_conf, "validator dynlib cachedb iterator") != 0
694 && strcmp(cfg->module_conf, "respip validator dynlib cachedb iterator") != 0
695 && strcmp(cfg->module_conf, "dynlib subnetcache iterator") != 0
696 && strcmp(cfg->module_conf, "dynlib respip subnetcache iterator") != 0
697 && strcmp(cfg->module_conf, "subnetcache dynlib iterator") != 0
698 && strcmp(cfg->module_conf, "respip subnetcache dynlib iterator") != 0
699 && strcmp(cfg->module_conf, "dynlib subnetcache validator iterator") != 0
700 && strcmp(cfg->module_conf, "dynlib respip subnetcache validator iterator") != 0
701 && strcmp(cfg->module_conf, "subnetcache dynlib validator iterator") != 0
702 && strcmp(cfg->module_conf, "respip subnetcache dynlib validator iterator") != 0
703 && strcmp(cfg->module_conf, "subnetcache validator dynlib iterator") != 0
704 && strcmp(cfg->module_conf, "respip subnetcache validator dynlib iterator") != 0
705 && strcmp(cfg->module_conf, "dynlib ipsecmod iterator") != 0
706 && strcmp(cfg->module_conf, "dynlib ipsecmod respip iterator") != 0
707 && strcmp(cfg->module_conf, "ipsecmod dynlib iterator") != 0
708 && strcmp(cfg->module_conf, "ipsecmod dynlib respip iterator") != 0
709 && strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
710 && strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
711 && strcmp(cfg->module_conf, "dynlib ipsecmod validator iterator") != 0
712 && strcmp(cfg->module_conf, "dynlib ipsecmod respip validator iterator") != 0
713 && strcmp(cfg->module_conf, "ipsecmod dynlib validator iterator") != 0
714 && strcmp(cfg->module_conf, "ipsecmod dynlib respip validator iterator") != 0
715 && strcmp(cfg->module_conf, "ipsecmod validator dynlib iterator") != 0
716 && strcmp(cfg->module_conf, "ipsecmod respip validator dynlib iterator") != 0
719 && strcmp(cfg->module_conf, "validator cachedb iterator") != 0
720 && strcmp(cfg->module_conf, "respip validator cachedb iterator") != 0
721 && strcmp(cfg->module_conf, "cachedb iterator") != 0
722 && strcmp(cfg->module_conf, "respip cachedb iterator") != 0
723 && strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
724 && strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
726 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
727 && strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
728 && strcmp(cfg->module_conf, "python dns64 validator cachedb iterator") != 0
729 && strcmp(cfg->module_conf, "dns64 python cachedb iterator") != 0
730 && strcmp(cfg->module_conf, "dns64 python validator cachedb iterator") != 0
731 && strcmp(cfg->module_conf, "python cachedb iterator") != 0
732 && strcmp(cfg->module_conf, "python respip cachedb iterator") != 0
733 && strcmp(cfg->module_conf, "python validator cachedb iterator") != 0
734 && strcmp(cfg->module_conf, "python respip validator cachedb iterator") != 0
735 && strcmp(cfg->module_conf, "cachedb python iterator") != 0
736 && strcmp(cfg->module_conf, "respip cachedb python iterator") != 0
737 && strcmp(cfg->module_conf, "validator cachedb python iterator") != 0
738 && strcmp(cfg->module_conf, "respip validator cachedb python iterator") != 0
739 && strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
740 && strcmp(cfg->module_conf, "respip validator python cachedb iterator") != 0
743 && strcmp(cfg->module_conf, "subnetcache iterator") != 0
744 && strcmp(cfg->module_conf, "respip subnetcache iterator") != 0
745 && strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
746 && strcmp(cfg->module_conf, "respip subnetcache validator iterator") != 0
747 && strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
748 && strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
749 && strcmp(cfg->module_conf, "dns64 subnetcache respip iterator") != 0
750 && strcmp(cfg->module_conf, "dns64 subnetcache respip validator iterator") != 0
752 #if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
753 && strcmp(cfg->module_conf, "python subnetcache iterator") != 0
754 && strcmp(cfg->module_conf, "python respip subnetcache iterator") != 0
755 && strcmp(cfg->module_conf, "subnetcache python iterator") != 0
756 && strcmp(cfg->module_conf, "respip subnetcache python iterator") != 0
757 && strcmp(cfg->module_conf, "python subnetcache validator iterator") != 0
758 && strcmp(cfg->module_conf, "python respip subnetcache validator iterator") != 0
759 && strcmp(cfg->module_conf, "subnetcache python validator iterator") != 0
760 && strcmp(cfg->module_conf, "respip subnetcache python validator iterator") != 0
761 && strcmp(cfg->module_conf, "subnetcache validator python iterator") != 0
762 && strcmp(cfg->module_conf, "respip subnetcache validator python iterator") != 0
765 && strcmp(cfg->module_conf, "ipsecmod iterator") != 0
766 && strcmp(cfg->module_conf, "ipsecmod respip iterator") != 0
767 && strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
768 && strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
770 #if defined(WITH_PYTHONMODULE) && defined(USE_IPSECMOD)
771 && strcmp(cfg->module_conf, "python ipsecmod iterator") != 0
772 && strcmp(cfg->module_conf, "python ipsecmod respip iterator") != 0
773 && strcmp(cfg->module_conf, "ipsecmod python iterator") != 0
774 && strcmp(cfg->module_conf, "ipsecmod python respip iterator") != 0
775 && strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
776 && strcmp(cfg->module_conf, "ipsecmod respip validator iterator") != 0
777 && strcmp(cfg->module_conf, "python ipsecmod validator iterator") != 0
778 && strcmp(cfg->module_conf, "python ipsecmod respip validator iterator") != 0
779 && strcmp(cfg->module_conf, "ipsecmod python validator iterator") != 0
780 && strcmp(cfg->module_conf, "ipsecmod python respip validator iterator") != 0
781 && strcmp(cfg->module_conf, "ipsecmod validator python iterator") != 0
782 && strcmp(cfg->module_conf, "ipsecmod respip validator python iterator") != 0
785 && strcmp(cfg->module_conf, "validator ipset iterator") != 0
786 && strcmp(cfg->module_conf, "validator ipset respip iterator") != 0
787 && strcmp(cfg->module_conf, "ipset iterator") != 0
788 && strcmp(cfg->module_conf, "ipset respip iterator") != 0
791 fatal_exit("module conf '%s' is not known to work",
796 if(cfg->username && cfg->username[0]) {
797 if(getpwnam(cfg->username) == NULL)
798 fatal_exit("user '%s' does not exist.", cfg->username);
799 # ifdef HAVE_ENDPWENT
804 if(cfg->remote_control_enable && options_remote_is_address(cfg)
805 && cfg->control_use_cert) {
806 check_chroot_string("server-key-file", &cfg->server_key_file,
807 cfg->chrootdir, cfg);
808 check_chroot_string("server-cert-file", &cfg->server_cert_file,
809 cfg->chrootdir, cfg);
810 if(!is_file(cfg->control_key_file))
811 fatal_exit("control-key-file: \"%s\" does not exist",
812 cfg->control_key_file);
813 if(!is_file(cfg->control_cert_file))
814 fatal_exit("control-cert-file: \"%s\" does not exist",
815 cfg->control_cert_file);
818 donotquerylocalhostcheck(cfg);
819 localzonechecks(cfg);
820 view_and_respipchecks(cfg);
822 ecs_conf_checks(cfg);
826 /** check forwards */
828 check_fwd(struct config_file* cfg)
830 struct iter_forwards* fwd = forwards_create();
831 if(!fwd || !forwards_apply_cfg(fwd, cfg)) {
832 fatal_exit("Could not set forward zones");
834 forwards_delete(fwd);
839 check_hints(struct config_file* cfg)
841 struct iter_hints* hints = hints_create();
842 if(!hints || !hints_apply_cfg(hints, cfg)) {
843 fatal_exit("Could not set root or stub hints");
848 /** check auth zones */
850 check_auth(struct config_file* cfg)
853 struct auth_zones* az = auth_zones_create();
854 if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz)) {
855 fatal_exit("Could not setup authority zones");
857 auth_zones_delete(az);
860 /** check config file */
862 checkconf(const char* cfgfile, const char* opt, int final)
865 struct config_file* cfg = config_create();
867 fatal_exit("out of memory");
869 if(!getcwd(oldwd, sizeof(oldwd))) {
870 log_err("cannot getcwd: %s", strerror(errno));
873 if(!config_read(cfg, cfgfile, NULL)) {
874 /* config_read prints messages to stderr */
878 if(oldwd[0] && chdir(oldwd) == -1)
879 log_err("cannot chdir(%s): %s", oldwd, strerror(errno));
881 print_option(cfg, opt, final);
886 check_mod(cfg, iter_get_funcblock());
887 check_mod(cfg, val_get_funcblock());
888 #ifdef WITH_PYTHONMODULE
889 if(strstr(cfg->module_conf, "python"))
890 check_mod(cfg, pythonmod_get_funcblock());
895 printf("unbound-checkconf: no errors in %s\n", cfgfile);
899 /** getopt global, in case header files fail to declare it. */
901 /** getopt global, in case header files fail to declare it. */
904 /** Main routine for checkconf */
905 int main(int argc, char* argv[])
910 const char* opt = NULL;
911 const char* cfgfile = CONFIGFILE;
912 log_ident_set("unbound-checkconf");
913 log_init(NULL, 0, NULL);
916 /* use registry config file in preference to compiletime location */
917 if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
918 cfgfile = CONFIGFILE;
919 #endif /* USE_WINSOCK */
920 /* parse the options */
921 while( (c=getopt(argc, argv, "fho:")) != -1) {
937 if(argc != 0 && argc != 1)
942 checkconf(f, opt, final);