X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=chiark-utils.git;a=blobdiff_plain;f=scripts%2Fnamed-conf;h=24f99068e4ee1ee95835b2a660714955f52876e0;hp=d863dfc545f404833004f16cb6ed24a1a4625897;hb=c0437873780b3bbd8ba98c5d5c4ecc5d7c688fce;hpb=c8b816f71486a089933290816c15317b5d5db8cb diff --git a/scripts/named-conf b/scripts/named-conf index d863dfc..24f9906 100755 --- a/scripts/named-conf +++ b/scripts/named-conf @@ -4,13 +4,15 @@ use strict; use IO::File; use Data::Dumper; -use vars qw($quis $mode +use vars qw($quis + $mode $doall $etcfile $where $debug $needglue $localonly $verbosity); $quis= $0; $quis =~ s,.*/,,; $mode= ''; +$doall= 0; $etcfile= "/etc/bind/chiark-conf-gen.zones"; $where= ''; $debug= 0; @@ -25,6 +27,7 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { if (s/^\-\-//) { last if m/^$/; if (m/^(yes|no|force)$/) { m/^./; $mode= $&; } + elsif (m/^all$/) { $doall=1; } elsif (m/^config$/) { $etcfile= loarg(); $where= '--config option'; } elsif (m/^glueless$/) { $needglue--; } elsif (m/^localonly$/) { $localonly=1; } @@ -36,6 +39,7 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { last if m/^$/; while (m/^./) { if (s/^[ynf]//) { $mode=$&; } + elsif (s/^A//) { $doall=1; } elsif (s/^C//) { $etcfile= soarg(); $where= '-C option'; } elsif (s/^D//) { $debug++; } elsif (s/^g//) { $needglue--; } @@ -80,8 +84,8 @@ $slave_dir= 'slave'; $slave_prefix= ''; $slave_suffix= ''; -use vars qw(@self_ns @self_soa); -@self_ns= @self_soa= (); +use vars qw(@self_ns @self_soa @self_addr); +@self_ns= @self_soa= @self_addr= (); use vars qw(%zone_cfg @zone_cfg_list); %zone_cfg= (); @@ -109,17 +113,22 @@ sub cfg_fail ($) { die "$quis: $where:\n $_[0]\n"; } sub read_config ($) { my ($if) = @_; - my ($fh,$z,@self, $dir,$prefix,$suffix,$lprefix,$lsuffix); + my ($fh,$z,@self,$before, $mod,$dir,$prefix,$suffix,$lprefix,$lsuffix); local ($_); $fh= new IO::File $if,'r' or cfg_fail("open $if:\n $!"); + $before= ''; for (;;) { if (!defined($_= <$fh>)) { cfg_fail("read config file $if:\n $!") if $fh->error(); last; } + chomp; s/\s+$//; + if (m/\\$/) { $before.= $_; next; } + $_= $before.$_; + $before= ''; + s/^\s+//; $where= "$if:$."; - s/^\s+//; chomp; s/\s+$//; next if m/^\#/; last if m/^end$/; next unless m/\S/; @@ -127,28 +136,30 @@ sub read_config ($) { @self= split /\s+/, $2; @self_ns= @self if $1 ne '-soa'; @self_soa= @self if $1 ne '-ns'; - } elsif (m/^primary\-dir\s+(\S+)((?:\s+(\S+))??:\s+(\S+))?$/) { - ($dir, $prefix, $suffix) = (qualify($1),$2,$3); - $suffix= '_db' if !length $suffix; + } elsif (m/^self\-addr\s+([0-9. \t]+)/) { + @self_addr= split /\s+/, $1; + } elsif (m/^primary\-dir([*?]?)\s+(\S+)((?:\s+(\S+))?:\s+(\S+))?$/) { + ($mod, $dir, $prefix, $suffix) = ($1,qualify($2),$3,$4); + $suffix= '_db' if !defined $suffix; + $prefix= '' if !defined $prefix; opendir D, $dir or cfg_fail("open primary-dir $dir:\n $!"); $lprefix= length $prefix; $lsuffix= length $suffix; - while ($!=0, $_= readdir D) { + while (defined($_= readdir D)) { next if m/^\./ && !$lprefix; next unless length > $lprefix+$lsuffix; next unless substr($_,0,$lprefix) eq $prefix; next unless substr($_,length($_)-$lsuffix) eq $suffix; $z= substr($_,$lprefix,length($_)-($lprefix+$lsuffix)); - zone_conf($z,'primary',"$dir/$_"); + zone_conf($z,'primary','p',$mod,"$dir/$_"); } - $! and cfg_fail("read primary-dir $dir:\n $!"); closedir D or cfg_fail("close primary-dir $dir:\n $!"); - } elsif (m/^primary\s+(\S+)\s+(\S+)$/) { - zone_conf($1,'primary',qualify($2)); - } elsif (m/^secondary\s+(\S+)\s+([0-9.\t]+)$/) { - zone_conf($1,'secondary','',$2); - } elsif (m/^stealth\s+(\S+)\s+([0-9. \t]+)$/) { - zone_conf($1,'stealth','',split /\s+/, $2); - } elsif (m/^slave\-dir\s+(\S+)((?:\s+(\S+))??:\s+(\S+))?$/) { + } elsif (m/^primary([*?]?)\s+(\S+)\s+(\S+)$/) { + zone_conf($2,'primary','p',$1,qualify($3)); + } elsif (m/^published([*?]?)\s+(\S+)\s+([0-9.\t]+)$/) { + zone_conf($2,'published','s',$1,'',$3); + } elsif (m/^stealth([*?]?)\s+(\S+)\s+([0-9. \t]+)$/) { + zone_conf($2,'stealth','u',$1,'',split /\s+/, $3); + } elsif (m/^slave\-dir\s+(\S+)((?:\s+(\S+))?:\s+(\S+))?$/) { ($slave_dir, $slave_prefix, $slave_suffix) = (qualify($1),$2,$3); } elsif (m/^output\s+bind8\+(\S+)$/) { cfg_fail("default output may not apply to only some zones") @@ -167,10 +178,12 @@ sub read_config ($) { sub qualify ($) { my ($i) = @_; $i= "$default_dir/$i" unless $i =~ m,^/,; + return $i; } -sub zone_conf ($$@) { - my ($zone,$style,$file,@servers) = @_; +sub zone_conf ($$$$$@) { + my ($zone,$style,$sabbr,$mod,$file,@servers) = @_; + my ($sfx,$aref); $file= qualify("$slave_dir/$slave_prefix".$zone.$slave_suffix) unless length $file; if (!length $output) { @@ -180,10 +193,14 @@ sub zone_conf ($$@) { } cfg_fail("redefined zone $zone") if exists $zone_cfg{$zone}; $zone_cfg{$zone}{'file'}= $file; - $zone_cfg{$zone}{'style'}= $style; + $zone_cfg{$zone}{'style_p'}= $style.$mod; + $zone_cfg{$zone}{'s'}= $sabbr.$mod; # p)rimary s)econdary u)npub f)oreign $zone_cfg{$zone}{'servers'}= [ @servers ]; - $zone_cfg{$zone}{'self_soa'}= [ @self_soa ]; - $zone_cfg{$zone}{'self_ns'}= [ @self_ns ]; + foreach $sfx (qw(soa ns addr)) { + { no strict 'refs'; $aref= [ @{ "self_$sfx" } ]; } + @$aref or cfg_fail("failed to specify self-$sfx before zone"); + $zone_cfg{$zone}{"self_$sfx"}= $aref; + } $zone_cfg{$zone}{'output'}= $output; push @zone_cfg_list, $zone; } @@ -216,15 +233,17 @@ sub process_zones (@) { foreach $zone (@zones) { $cfg= $zone_cfg{$zone} || { - 'style' => 'foreign', + 'style_p' => 'foreign', + 's' => 'f', 'servers' => [ ], }; - progress(sprintf "%-40s %s", $zone, $$cfg{'style'}); - if ($check) { + progress(sprintf "%-40s %s", $zone, $$cfg{'style_p'}); + if ($check && ($doall || $cfg->{'s'} !~ m/\?/)) { eval { - if ($localonly && $cfg->{'style'} eq 'foreign') { + if ($localonly && $cfg->{'s'} =~ m/f/) { zone_warning("foreign zone specified with -l"); - } elsif ($localonly && $cfg->{'style'} ne 'primary') { + } elsif ($cfg->{'s'} =~ m/\*/ || + ($localonly && $cfg->{'s'} !~ m/p/)) { zone_check_local(); } else { zone_check_full(); @@ -247,14 +266,15 @@ sub zone_warning ($) { } sub zone_warnmore ($) { - print STDERR " $_[0]\n" or die $!; + print STDERR "$zone: $_[0]\n" or die $!; } use vars qw(%delgs); # $delgs{$nameserver_list} = [ $whosaidandwhy ] use vars qw(%auths); # $auths{$nameserver_list} = [ $whosaidandwhy ] use vars qw(%glue); # $glue{$name}{$addr_list} = [ $whosaidandwhy ] use vars qw(%soas); # $soa{"$origin $serial"} = [ $whosaidandwhy ] -use vars qw(%addr_is_ok %gluelesswarned); +use vars qw(%addr_is_ok %warned_glueless %warned_mynameaddr); +use vars qw($delg_to_us); use vars qw(@to_check); # ($addr,$whyask,$is_auth,$glueless_ok, ...) use vars qw(@to_check_soa); # ($addr,$whyask, ...) @@ -266,7 +286,10 @@ sub zone_check_full () { } sub zone_reset() { - %delgs= %auths= %glue= %soas= %gluelesswarned= %addr_is_ok= (); + %delgs= %auths= %glue= %soas= + %warned_glueless= %warned_mynameaddr= + %addr_is_ok= (); + $delg_to_us= 0; @to_check= @to_check_soa= (); } @@ -305,7 +328,7 @@ sub zone_investigate() { $is_auth, $glueless_ok); } elsif (($addr,$wa,@to_check_soa) = @to_check_soa) { next if $soa_checked{$addr}++; - zone_check_soa($addr,"[$addr] $wa"); + zone_check_soa($addr,"[$addr] $wa","[$addr] NS"); } else { last; } @@ -314,18 +337,15 @@ sub zone_investigate() { sub zone_check_nsrrset ($$$$) { my ($uaddr,$ww, $is_auth, $glueless_ok) = @_; - my (@s, $s, %s2g, @glue, $glue, $delgs_or_auths); + my (@s, $s, %s2g, @glue, $glue, $delgs_or_auths, $wwn); verbose("checking delegation by $ww"); dig(sub { if ($dig_type eq 'ns' && $dig_owner eq $zone) { $s2g{lc $dig_rdata} = [ ]; } elsif ($dig_type eq 'a' && exists $s2g{$dig_owner}) { - push @to_check, - $dig_rdata, - "$dig_owner, in glue from $ww", - 1, 0; - $addr_is_ok{$dig_rdata}= "$dig_owner (NS [$uaddr])" - if $cfg->{'style'} eq 'stealth'; + $wwn= "in glue from $ww"; + push @to_check, $dig_rdata, "$dig_owner, $wwn", 1, 0; + zone_server_addr($dig_rdata,$dig_owner,$wwn,"NS [$uaddr]",0); push @{ $s2g{$dig_owner} }, $dig_rdata; } }, @@ -336,9 +356,11 @@ sub zone_check_nsrrset ($$$$) { foreach $s (@s) { @glue= @{ $s2g{$s} }; if (!@glue) { - zone_warning("glueless NS $s, from $ww") + zone_warning("glueless NS $s,". + ($needglue<=1 ? " (eg)" : ""). + " from $ww") unless $glueless_ok || !$needglue || - ($needglue<=1 && $gluelesswarned{$s}++); + ($needglue<=1 && $warned_glueless{$s}++); next; } $glue= join ' ', sort @glue; @@ -349,10 +371,34 @@ sub zone_check_nsrrset ($$$$) { push @{ $delgs_or_auths->{$s} }, $ww; } -sub zone_check_soa ($$) { - my ($uaddr,$ww) = @_; - my ($lame,$origin,$got,$rcode,@soa_addrs,$soa_addr); - verbose("checking service at $ww"); +sub zone_server_addr ($$$$$) { + my ($addr,$name,$ww,$wwq,$is_soa) = @_; + $addr_is_ok{$addr}= "$name ($wwq)" + if $is_soa || $cfg->{'s'} =~ m/u/; + zone_warning("configured as stealth but we [$addr]". + " are published ($name $wwq)") + if $cfg->{'s'} =~ m/u/ && grep { $_ eq $addr } @self_addr; + + my ($name_is_self, $addr_is_self); + $name_is_self= grep { $_ eq $name } + @{ $cfg->{$is_soa ? 'self_soa' : 'self_ns'} }; + $addr_is_self= grep { $_ eq $addr } + @{ $cfg->{'self_addr'} }; + if ($name_is_self && !$addr_is_self) { + zone_warning("our name $name with wrong address [$addr], (eg) $ww") + unless $warned_mynameaddr{$name}{$addr}++; + } elsif (!$name_is_self && $addr_is_self) { + zone_warning(($is_soa ? "SOA ORIGIN maps to" : "allegedly served by"). + " us [$addr] with wrong name $name, (eg) $ww") + unless $warned_mynameaddr{$name}{$addr}++; + } + $delg_to_us=1 if $name_is_self; +} + +sub zone_check_soa ($$$) { + my ($uaddr,$ww,$wwq) = @_; + my ($lame,$origin,$got,$rcode,@soa_addrs,$soa_addr,$wwn); + verbose("checking service at $wwq"); $lame= 'dead or lame'; dig(sub { if ($dig_type eq 'flags:') { @@ -370,15 +416,14 @@ sub zone_check_soa ($$) { push @{ $soas{$got} }, $ww; ($rcode,@soa_addrs)= lookup($origin,'a','0'); foreach $soa_addr (@soa_addrs) { - $addr_is_ok{$soa_addr}= "$origin (SOA [$uaddr])"; - push @to_check, - $soa_addr, - "$origin, SOA ORIGIN from $ww"; + $wwn= "SOA ORIGIN from $ww"; + zone_server_addr($soa_addr,$origin,$wwn,"SOA [$uaddr]",1); + push @to_check, $soa_addr, "$origin, $wwn"; } } sub zone_consistency() { - my ($d, $org_ser, $origin, $a, $h); + my ($d, $org_ser, $origin, $a, $h, $self_soa); zone_consistency_set('delegations',\%delgs); foreach $d (keys %delgs) { delete $auths{$d}; } zone_consistency_set('zone nameserver rrset',\%auths); @@ -386,13 +431,14 @@ sub zone_consistency() { zone_consistency_set("glue for $h", $glue{$h}); } zone_consistency_set("SOA ORIGIN and SERIAL",\%soas); - if ($cfg->{'style'} eq 'primary') { + $self_soa= $cfg->{'self_soa'}; + if ($cfg->{'s'} =~ m/p/) { foreach $org_ser (keys %soas) { $org_ser =~ m/^(\S+) \d+$/ or die "$org_ser ?"; $origin= $1; - next if grep { $_ eq $origin } @self_soa; - zone_warning("our name(s) @self_soa not in SOA ORIGIN $origin,". - " eg from ".((values %{ $soas{$org_ser} })[1])); + next if grep { $_ eq $origin } @$self_soa; + zone_warning("SOA ORIGIN $origin is not our name (@$self_soa),". + " eg from ".($soas{$org_ser}[0])); } } } @@ -411,6 +457,10 @@ sub zone_servers_ok () { } } } + if ($cfg->{'s'} =~ m/s/ && !$delg_to_us) { + zone_warnmore("we are supposedly published secondary,". + " but not listed as a nameserver"); + } } sub zone_consistency_set ($%) { @@ -432,21 +482,21 @@ sub zone_check_local () { sub zone_servers_simplefind () { my ($rcode,@nsnames,$ns,@soas,$origin); - if ($cfg->{'style'} eq 'stealth') { - ($rcode,@nsnames)= lookup($zone,'ns-','0'); - foreach $ns (@nsnames) { zone_server_simple($ns,'NS'); } - } + + ($rcode,@nsnames)= lookup($zone,'ns-','0'); + foreach $ns (@nsnames) { zone_server_simple($ns,'NS',0); } + ($rcode,@soas)= lookup($zone,'soa','0'); die "multiple SOA RRs in set! @soas ?" if @soas!=1; $soas[0] =~ m/^(\S+)\s/ or die "SOA ? $_"; - zone_server_simple(domain_canon($1),'SOA'); + zone_server_simple(domain_canon($1),'SOA',1); } -sub zone_server_simple ($$) { - my ($name,$why) = @_; +sub zone_server_simple ($$$) { + my ($name,$ww,$is_soa) = @_; my ($rcode,@addrs,$addr); ($rcode,@addrs)= lookup($name,'a','0'); - foreach $addr (@addrs) { $addr_is_ok{$addr}= "$name ($why)"; } + foreach $addr (@addrs) { zone_server_addr($addr,$name,$ww,$ww,$is_soa); } } #-------------------- outputting @@ -460,7 +510,7 @@ zone "%s" { }; END $zone, - $$cfg{'style'} eq 'primary' ? 'master' : 'slave', + $$cfg{'s'} =~ m/p/ ? 'master' : 'slave', $$cfg{'file'}); } @@ -497,7 +547,7 @@ sub lookup ($$$) { $h->error and die "$quis: read from adnshost:\n $!\n"; chomp @result; $!=0; $h->close; - die "$quis: lookup -t$type $domain $okrcodes failed $? $!\n" + die "$quis: lookup -t$type $domain $okrcodes failed $? $! @result\n" if $! or $?>6 or index($okrcodes,$?)<0; debug_trace("lookup <== $? @result"); return ($?,@result); @@ -574,214 +624,3 @@ sub domain_canon ($) { die "domain $_ ?" unless m/^[0-9a-z]/i; return lc $_; } - -__DATA__ - - - - -sub lookup1 ($$) { - my ($type,$domain) = @_; - my (@result)= lookup($type,$domain); - @result==1 or die "$quis: lookup -t$type $domain gave more than one RR\n"; - return $result[0]; -} - -sub check () { - return unless $check; - eval { - $soa= lookup1('soa',$zone); - $soa_origin=$soa; $soa_origin =~ s/ .*//; - $soa_origin_addr= lookup1('a',$soa_origin); - - @zone_ns= lookup('ns-',$zone); - - @ok_sources= ($soa_origin_addr); - $ok_sources_descr= "SOA ORIGIN $soa_origin [$soa_origin_addr]"; - - if ($style eq 'unoff' || $style eq 'backup') { - for $zone_ns (@zone_ns) { - @zone_ns_addrs= lookup('a',$zone_ns); - push @ok_sources, @zone_ns_addrs; - $ok_sources_descr.= ", NS $zone_ns [@zone_ns_addrs]"; - } - } - - for $server (@servers) { - grep { $server eq $_ } @ok_sources - or warn "secondarying from $server which is not ". - "$ok_sources_desc\n"; - } - - if ($style eq 'secondary') { - grep { $zone_ns=$_, grep { $myname eq $_ } @mynames } @zone_n - or warn "supposedly published secondary but we ". - "(@mynames) are not published ($@zone_ns)\n"; - } - } - check_after_eval(); - - - -# $superzone= $zone; $superzone =~ s/^[^\.]+\.//; -# @super_ns= lookup('ns-',$zone); - } - - eval { - - for $super_ns (@super_ns) { - @deleg_ns= (); - open DIG, "dig @$super_ns. -t ns +norecurse $zone." - or die "$quis: fork for dig:\n $!\n"; - while () { - - - split /\n/, lookup(" - - case "$style" in - secondary|backup) - if [ $meadvert = 0 ] - then - warning "$myname unlisted NS $nsnames" - fi - ;; - unoff) - if $meadvert = 0 - then - warning "$myname advertised NS $nsnames" - fi - ;; - esac - - addrs='' - for ns in $names - do - set -e; a="`host -t a \"$ns\".`"; set +e - taddrs="`echo \" $a\" | expand | sed -n ' - 1s/^ // - s/^[^ ][^ ]* *A *\([0-9][.0-9]*\)/\1/p - '`" - equlines "A $ns" "$a" "$taddrs" - addrs="$addrs $taddrs" - done - fi - - cat <) { - $zone= $f; $zone =~ s/_db$//; - - -for f in $zones -do - zone="`echo $f | sed -e 's/_db$//'`" -END -done -endfile - - - -sub beginfile ($) { - $currentfile= $_[0]; - $currentfile_opened= $install ? "$conf/$currentfile.new" : "/dev/null"; - open CFF, "> $toopen" or die "$quis: begin $currentfile_opened:\n $!\n"; -} - -endfile () { - close CFF or die "$quis: close $currentfile_opened:\n $!\n"; - push @files, $currentfile; -} - -sub installfiles () { - return unless $install; - chdir $conf or die "$quis: chdir $conf:\n $!\n"; - for $f (@files) { - rename "$f.new", $f or die "$quis: install new $f:\n $!\n"; - } -} - -warning () { - echo >&2 "$zone $style: $*" - warnings=$[$warnings+1] -} - -equlines () { - if [ "x`echo \" $2\" | wc -l`" != "x`echo \" $3\" | wc -l`" ] - then - warning "$1 >$2|$3<" - fi -} - -checkhostout () { - set +e - hostout="`host $1 \"$zone\" 2>&1 >/dev/null $2 | egrep -v \ -'^ \!\!\! .* SOA primary .* is not advertised via NS$'`" - set -e - if [ "x$hostout" = x ]; then return; fi - if $hostfirstwarn - then - warning "warnings from host:" - hostfirstwarn=0 - fi - echo >&2 "$hostout" -} - -progress () { - if $progress - then - echo -n "$zone $style " >&2 - echo -ne '\r' >&2 - fi -} - -myname='' - -if [ $warnings != 0 ] -then - echo >&2 "$warnings warnings " -fi - -installfiles