X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?a=blobdiff_plain;f=scripts%2Fnamed-conf;h=3c92ecec5dd099c491a1e95aa2264d250307fd6f;hb=78086a25d2ae3bd77a6e85ded828349ebac10a83;hp=1f964edc7ebfb25843c396d4baa116f79c1e4ecd;hpb=0de595b9761e31d9275129ea5ab7504d0681f5ab;p=chiark-utils.git

diff --git a/scripts/named-conf b/scripts/named-conf
index 1f964ed..3c92ece 100755
--- a/scripts/named-conf
+++ b/scripts/named-conf
@@ -19,7 +19,7 @@ $where= '<built-in>';
 $debug= 0;
 $needglue= 1;
 $localonly= 0;
-$verbosity= 1;
+$verbosity= 2;
 $repeat= 0;
 
 use vars qw($dig_owner $dig_type $dig_rdata);
@@ -33,9 +33,9 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) {
 	elsif (m/^config$/) { $etcfile= loarg(); $where= '--config option'; }
 	elsif (m/^glueless$/) { $needglue=0; }
 	elsif (m/^localonly$/) { $localonly=1; }
-	elsif (m/^quiet$/) { $verbosity=0; }
+	elsif (m/^quiet$/) { $verbosity--; }
 	elsif (m/^repeat$/) { $repeat=1; }
-	elsif (m/^verbose$/) { $verbosity=2; }
+	elsif (m/^verbose$/) { $verbosity++; }
 	else { usageerr("unknown option --$_"); }
     } else {
 	s/^\-//;
@@ -47,9 +47,9 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) {
 	    elsif (s/^D//) { $debug++; }
 	    elsif (s/^g//) { $needglue=0; }
 	    elsif (s/^l//) { $localonly=1; }
-	    elsif (s/^q//) { $verbosity=0; }
+	    elsif (s/^q//) { $verbosity--; }
 	    elsif (s/^r//) { $repeat=1; }
-	    elsif (s/^v//) { $verbosity=2; }
+	    elsif (s/^v//) { $verbosity++; }
 	    else { usageerr("unknown option -$&"); }
 	}
     }
@@ -58,6 +58,8 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) {
 sub loarg() { usageerr("missing option value") if !@ARGV; return shift @ARGV; }
 sub soarg() { my ($rv); $rv=$_; $_=''; return length $rv ? $rv : loarg(); }
 
+usageerr("-q may be specified at most twice") if $verbosity<0;
+usageerr("-v may be specified at most once") if $verbosity>3;
 usageerr("-D may be specified at most twice") if $debug>2;
 usageerr("must specify either -f|-y|-n or zones (and not both)")
     if !!$mode == !!@ARGV;
@@ -231,7 +233,7 @@ sub zone_conf ($$$$$@) {
     $zone_cfg{$zone}{'style_p'}= $style.$mod;
     $zone_cfg{$zone}{'s'}= $sabbr.$mod; # p)rimary s)econdary u)npub f)oreign
     $zone_cfg{$zone}{'servers'}= [ @servers ];
-    foreach $sfx (qw(self_soa self_ns self_addr forbid_addr)) {
+    foreach $sfx (qw(self_soa self_ns self_addr forbid_addr conv_glueless)) {
 	{ no strict 'refs'; $aref= [ @$sfx ]; }
 	@$aref or cfg_fail("failed to specify $sfx before zone")
 	    if $sfx =~ m/^self/;
@@ -250,18 +252,16 @@ sub set_output($) {
 
 #-------------------- checking
 
-use vars qw($zone $cfg $warnings);
+use vars qw($zone $cfg $warnings %zone_warnings);
 $warnings= 0;
 
-sub progress ($) {
-    return if !$verbosity;
-    print "$_[0]\n";
+sub progress ($$) {
+    my ($minv,$m) = @_;
+    return if $verbosity < $minv;
+    print "$m\n";
 }
 
-sub verbose ($) {
-    return if $verbosity<2;
-    print "    $_[0]\n";
-}
+sub verbose ($) { progress(3, '    ' . $_[0]); }
 
 sub process_zones (@) {
     my (@zones) = @_;
@@ -274,7 +274,7 @@ sub process_zones (@) {
 	    's' => 'f',
 	    'servers' => [ ],
 	    };
-	progress(sprintf "%-40s %s", $zone, $$cfg{'style_p'});
+	progress(1, sprintf "%-20s %s", $zone, $$cfg{'style_p'});
 	if ($check && ($doall || $cfg->{'s'} !~ m/\?/)) {
 	    eval {
 		if ($localonly && $cfg->{'s'} =~ m/f/) {
@@ -291,8 +291,16 @@ sub process_zones (@) {
 	$output_contents{$$cfg{'output'}} .= zone_output()
 	    if $install;
     }
-    print STDERR "$quis: $warnings warnings\n" or die $!
-	if $warnings;
+    if ($warnings) {
+	printf STDERR ("%s: %d warning(s) in %d zone(s);".
+		       " %d zone(s) checked ok.\n",
+		       $quis,
+		       $warnings,
+		       scalar(keys %zone_warnings),
+		       scalar(@zones - keys %zone_warnings));
+    } else {
+	progress(1, sprintf "%d zone(s) checked ok", scalar @zones);
+    }
 }
 
 use vars qw(%delgs); # $delgs{$nameserver_list} = [ $whosaidandwhy ]
@@ -301,8 +309,8 @@ use vars qw(%glue);  # $glue{$name}{$addr_list} = [ $whosaidandwhy ]
 use vars qw(%soas);  # $soa{"$serial $origin"} = [ $whosaidandwhy ]
 use vars qw(%addr_is_ok %warned);
 use vars qw($delg_to_us);
-use vars qw(@to_check); # ($addr,$whyask,$is_auth,$glueless_ok, ...)
-use vars qw(@to_check_soa); # ($addr,$whyask, ...)
+use vars qw(@to_check); # ($addr,$whyask,$name_if_auth,$glueless_ok, ...)
+use vars qw(@to_check_soa); # ($addr,$whyask,$name,$is_ns, ...)
 
 sub zone_warning ($$) {
     my ($w,$o) = @_;
@@ -316,6 +324,7 @@ sub zone_warning ($$) {
     $w .= " ($o)" if length $o;
     print STDERR "$zone: warning: $w\n" or die $!;
     $warnings++;
+    $zone_warnings{$zone}++;
     return 1;
 }
 
@@ -337,8 +346,9 @@ sub zone_reset() {
 
 sub zone_investigate() {
     my ($super_zone, @super_nsnames,
-	$super_ns, @super_ns_addrs, $s, $wa, $is_auth,
-	%nsrrset_checked, %soa_checked, $addr, $glueless_ok, $rcode);
+	$super_ns, @super_ns_addrs, $s, $wa, $name_if_auth,
+	%nsrrset_checked, %soa_checked, $addr, $glueless_ok,
+	$rcode, $name, $is_ns);
 
     $super_zone= $zone;
     for (;;) {
@@ -356,7 +366,7 @@ sub zone_investigate() {
 	    push @to_check,
 	         $addr,
 		 "$super_ns, server for $super_zone",
-		 0, 0;
+		 undef, 0;
 	}
     }
     for (;;) {
@@ -365,13 +375,14 @@ sub zone_investigate() {
 	# we might set nsrrset_checked due to a glueless_ok check,
 	# and then not check for gluefulness later.
 	debug_dump('@to_check @to_check_soa');
-	if (($addr,$wa,$is_auth,$glueless_ok,@to_check) = @to_check) {
-	    push @to_check_soa, $addr, $wa if $is_auth;
+	if (($addr,$wa,$name_if_auth,$glueless_ok,@to_check) = @to_check) {
+	    push @to_check_soa, $addr, $wa, $name_if_auth, 1,
+		if defined $name_if_auth;
 	    next if $nsrrset_checked{$addr}++;
-	    zone_check_nsrrset($addr, $wa, $is_auth, $glueless_ok);
-	} elsif (($addr,$wa,@to_check_soa) = @to_check_soa) {
+	    zone_check_nsrrset($addr, $wa, $name_if_auth, $glueless_ok);
+	} elsif (($addr,$wa,$name,$is_ns,@to_check_soa) = @to_check_soa) {
 	    next if $soa_checked{$addr}++;
-	    zone_check_soa($addr, $wa, "NS [$addr]");
+	    zone_check_soa($addr,$wa,$name,$is_ns);
 	} else {
 	    last;
 	}
@@ -379,8 +390,9 @@ sub zone_investigate() {
 }
 
 sub zone_check_nsrrset ($$$$) {
-    my ($uaddr,$wa, $is_auth, $glueless_ok) = @_;
-    my (@s, $s, %s2g, @glue, $glue, $delgs_or_auths, $wwn, $ww);
+    my ($uaddr,$wa, $name_if_auth, $glueless_ok) = @_;
+    my (@s, $s, $a, %s2g, @glue, $glue, $delgs_or_auths, $wwn, $ww);
+    my ($rcode);
     $ww= "[$uaddr] $wa";
     verbose("checking delegation by $ww");
     dig(sub {
@@ -388,7 +400,7 @@ sub zone_check_nsrrset ($$$$) {
 	    $s2g{lc $dig_rdata} = [ ];
 	} elsif ($dig_type eq 'a' && exists $s2g{$dig_owner}) {
 	    $wwn= "in glue from $ww";
-	    push @to_check, $dig_rdata, "$dig_owner, $wwn", 1, 0;
+	    push @to_check, $dig_rdata, "$dig_owner, $wwn", $dig_owner, 0;
 	    zone_server_addr($dig_rdata,$dig_owner,$wwn,"NS [$uaddr]",0);
 	    push @{ $s2g{$dig_owner} }, $dig_rdata;
 	}
@@ -403,37 +415,50 @@ sub zone_check_nsrrset ($$$$) {
     }
     @s= sort keys %s2g;
     foreach $s (@s) {
-	$delg_to_us=1 if grep { $s eq $_ } @{ $cfg->{'self_ns'} };
+	zone_ns_name($s,$ww);
 	@glue= @{ $s2g{$s} };
 	if (!@glue) {
 	    zone_warning("glueless NS $s", $ww)
 		unless $glueless_ok || !$needglue ||
-		       grep { has_suffix_of($s,".$_"); } @conv_glueless;
-	    next;
+		       grep { has_suffix_of($s,".$_"); }
+			   @{ $cfg->{'conv_glueless'} };
+	    ($rcode,@glue)= lookup($s,'a','0',"glueless NS from $ww");
+	    foreach $a (@glue) {
+		$wwn= "glueless NS from $ww";
+		push @to_check, $a, "$s, $wwn", $s, 0;
+		zone_server_addr($a,$s,$wwn,"NS [$uaddr]",0);
+	    }
 	}
 	$glue= join ' ', sort @glue;
 	push @{ $glue{$s}{$glue} }, $ww;
     }
     $s= join ' ', @s;
-    $delgs_or_auths= $is_auth ? \%auths : \%delgs;
+    $delgs_or_auths= defined($name_if_auth) ? \%auths : \%delgs;
     push @{ $delgs_or_auths->{$s} }, $ww;
 }
 
+sub zone_ns_name ($$) {
+    my ($name,$ww) = @_;
+    my ($cg);
+    $delg_to_us=1 if grep { $name eq $_ } @{ $cfg->{'self_ns'} };
+    foreach $cg (@{ $cfg->{'conv_glueless'} }) {
+	zone_warning("nameserver $name in serverless-glueless".
+		     " namespace area $cg",
+		     $ww)
+	    if has_suffix_of(".$name",".$cg");
+    }
+    zone_warning("published server, as $name, but configured as stealth",
+		 $ww)
+	if $cfg->{'s'} =~ m/u/ &&
+	   grep { $_ eq $name }
+               @{ $cfg->{'self_ns'} }, @{ $cfg->{'self_soa'} };
+}
+
 sub zone_server_addr ($$$$$) {
     my ($addr,$name,$ww,$wwq,$is_soa) = @_;
-    my ($cg);
     debug_trace("zone_server_addr ".join '|',@_);
     $addr_is_ok{$addr}= "$name ($wwq)"
 	if $is_soa || $cfg->{'s'} =~ m/u/;
-    foreach $cg (@conv_glueless) {
-	next unless has_suffix_of(".$name",".$cg");
-	zone_warning("nameserver [$addr] $name in serverless-glueless".
-		     " namespace area $cg",
-		     $ww);
-    }
-    zone_warning("configured as stealth but we [$addr] $name are published",
-		 $ww)
-	if $cfg->{'s'} =~ m/u/ && grep { $_ eq $addr } @self_addr;
     zone_warning("forbidden nameserver address [$addr] $name",$ww)
 	if grep { $_ eq $addr } @{ $cfg->{'forbid_addr'} };
 
@@ -459,10 +484,10 @@ sub zone_server_addr ($$$$$) {
     $delg_to_us=1 if $addr_is_self && !$is_soa;
 }
 
-sub zone_check_soa ($$$) {
-    my ($uaddr,$wa,$waq) = @_;
-    my ($lame,$origin,$got,$rcode,@soa_addrs,$soa_addr,$ww,$wwn);
-    verbose("checking service at [$uaddr] $waq");
+sub zone_check_soa ($$$$) {
+    my ($uaddr,$wa,$name,$is_ns) = @_;
+    my ($lame,$serial,$origin,$got,$rcode,@soa_addrs,$soa_addr,$ww,$wwn);
+    verbose("checking service at [$uaddr] $name");
     $lame= 'dead or lame';
     $ww= "[$uaddr] $wa";
     dig(sub {
@@ -471,19 +496,21 @@ sub zone_check_soa ($$$) {
 	} elsif ($dig_type eq 'soa' && $dig_owner eq $zone && !$lame) {
 	    die "several SOAs ? $ww" if defined $origin;
 	    $got= $dig_rdata;
-	    $got =~ m/^\d+ (\S+)$/ or die "$got ?";
-	    $origin= $1;
+	    $got =~ m/^(\d+) (\S+)$/ or die "$got ?";
+	    ($serial,$origin) = ($1,$2);
 	}
     },
 	     $zone,'soa',$uaddr);
     $lame= 'broken' if !$lame && !defined $origin;
     if ($lame) { zone_warning("$lame server [$uaddr]",$wa); return; }
+    progress(2, sprintf "%-16s %46s has %s%s",
+	     $zone, "$name [$uaddr]", $serial, $is_ns ? '' : '*');
     push @{ $soas{$got} }, $ww;
     ($rcode,@soa_addrs)= lookup($origin,'a','0',"SOA ORIGIN");
     $wwn= "SOA ORIGIN from $ww";
     foreach $soa_addr (@soa_addrs) {
 	zone_server_addr($soa_addr,$origin,$wwn,"SOA [$uaddr]",1);
-	push @to_check, $soa_addr, "$origin, $wwn";
+	push @to_check, $soa_addr, "$origin, $wwn", $origin, 1;
     }
 }
 
@@ -542,7 +569,10 @@ sub zone_servers_simplefind () {
     my ($rcode,@nsnames,$ns,@soas,$origin);
 
     ($rcode,@nsnames)= lookup($zone,'ns-','0',"zone's servers");
-    foreach $ns (@nsnames) { zone_server_simple($ns,'NS',0); }
+    foreach $ns (@nsnames) {
+	zone_ns_name($ns,"NS");
+	zone_server_simple($ns,'NS',0);
+    }
 
     ($rcode,@soas)= lookup($zone,'soa','0',"SOA ORIGIN");
     die "multiple SOA RRs in set!  @soas ?" if @soas!=1;
@@ -638,8 +668,10 @@ sub debug_trace ($) {
 
 sub has_suffix_of ($$) {
     my ($whole,$suffix) = @_;
+    debug_trace("has_suffix_of $whole $suffix");
     return 0 if length $whole < length $suffix;
     return 0 if substr($whole, length($whole) - length($suffix)) ne $suffix;
+    debug_trace("has_suffix_of $whole $suffix YES");
     return 1;
 }
 
@@ -665,7 +697,6 @@ sub lookup ($$$$) {
     return ($?,@result);
 }
 
-
 sub dig (&$$$) {
     my ($eachrr, $qowner,$qtype,$qaddr) = @_;
     # also pseudo-rr with type `flags:'