X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=chiark-utils.git;a=blobdiff_plain;f=scripts%2Fnamed-conf;h=a222db0bab52ca5853035853abc89c1a606a3a2f;hp=5fafeece465470b48af67a2ebb356396a7a65dfb;hb=02b64fd81edc8a7cd109eb9cdecc41eb48501735;hpb=9f017b56e9651ad24e3d16c8c769a10560857310 diff --git a/scripts/named-conf b/scripts/named-conf index 5fafeec..a222db0 100755 --- a/scripts/named-conf +++ b/scripts/named-conf @@ -4,15 +4,19 @@ use strict; use IO::File; use Data::Dumper; -use vars qw($mode +use vars qw($quis + $mode $doall $etcfile $where $debug $needglue $localonly $verbosity); +$quis= $0; $quis =~ s,.*/,,; + $mode= ''; +$doall= 0; $etcfile= "/etc/bind/chiark-conf-gen.zones"; $where= ''; $debug= 0; -$needglue= 1; +$needglue= 2; $localonly= 0; $verbosity= 1; @@ -23,8 +27,9 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { if (s/^\-\-//) { last if m/^$/; if (m/^(yes|no|force)$/) { m/^./; $mode= $&; } + elsif (m/^all$/) { $doall=1; } elsif (m/^config$/) { $etcfile= loarg(); $where= '--config option'; } - elsif (m/^glueless$/) { $needglue=0; } + elsif (m/^glueless$/) { $needglue--; } elsif (m/^localonly$/) { $localonly=1; } elsif (m/^quiet$/) { $verbosity=0; } elsif (m/^verbose$/) { $verbosity=2; } @@ -34,9 +39,10 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { last if m/^$/; while (m/^./) { if (s/^[ynf]//) { $mode=$&; } + elsif (s/^A//) { $doall=1; } elsif (s/^C//) { $etcfile= soarg(); $where= '-C option'; } elsif (s/^D//) { $debug++; } - elsif (s/^g//) { $needglue=0; } + elsif (s/^g//) { $needglue--; } elsif (s/^l//) { $localonly=1; } elsif (s/^q//) { $verbosity=0; } elsif (s/^v//) { $verbosity=2; } @@ -48,6 +54,8 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { sub loarg() { usageerr("missing option value") if !@ARGV; return shift @ARGV; } sub soarg() { my ($rv); $rv=$_; $_=''; return length $rv ? $rv : loarg(); } +usageerr("-g may be specified at most twice") if $needglue<0; +usageerr("-D may be specified at most twice") if $debug>2; usageerr("must specify either -f|-y|-n or zones (and not both)") if !!$mode == !!@ARGV; @@ -97,10 +105,11 @@ debug_dump('@zone_cfg_list %zone_cfg'); process_zones($mode ? @zone_cfg_list : @ARGV); debug_dump('%output_contents'); +exit 0; #-------------------- configuration reading -sub cfg_fail ($) { die "$0: $where:\n $_[0]\n"; } +sub cfg_fail ($) { die "$quis: $where:\n $_[0]\n"; } sub read_config ($) { my ($if) = @_; @@ -122,28 +131,30 @@ sub read_config ($) { @self= split /\s+/, $2; @self_ns= @self if $1 ne '-soa'; @self_soa= @self if $1 ne '-ns'; - } elsif (m/^primary\-dir\s+(\S+)((?:\s+(\S+))??:\s+(\S+))?$/) { - ($dir, $prefix, $suffix) = (qualify($1),$2,$3); - $suffix= '_db' if !length $suffix; + } elsif (m/^self\-addr\s+([0-9. \t]+)/) { + @self_addr= split /\s+/, $2; + } elsif (m/^primary\-dir([*?]?)\s+(\S+)((?:\s+(\S+))?:\s+(\S+))?$/) { + ($mod, $dir, $prefix, $suffix) = ($1,qualify($2),$3,$4); + $suffix= '_db' if !defined $suffix; + $prefix= '' if !defined $prefix; opendir D, $dir or cfg_fail("open primary-dir $dir:\n $!"); $lprefix= length $prefix; $lsuffix= length $suffix; - while ($!=0, $_= readdir D) { + while (defined($_= readdir D)) { next if m/^\./ && !$lprefix; next unless length > $lprefix+$lsuffix; next unless substr($_,0,$lprefix) eq $prefix; next unless substr($_,length($_)-$lsuffix) eq $suffix; $z= substr($_,$lprefix,length($_)-($lprefix+$lsuffix)); - zone_conf($z,'primary',"$dir/$_"); + zone_conf($z,'primary',"p$mod","$dir/$_"); } - $! and cfg_fail("read primary-dir $dir:\n $!"); closedir D or cfg_fail("close primary-dir $dir:\n $!"); - } elsif (m/^primary\s+(\S+)\s+(\S+)$/) { - zone_conf($1,'primary',qualify($2)); - } elsif (m/^secondary\s+(\S+)\s+([0-9.\t]+)$/) { - zone_conf($1,'secondary','',$2); - } elsif (m/^stealth\s+(\S+)\s+([0-9. \t]+)$/) { - zone_conf($1,'stealth','',split /\s+/, $2); - } elsif (m/^slave\-dir\s+(\S+)((?:\s+(\S+))??:\s+(\S+))?$/) { + } elsif (m/^primary([*?]?)\s+(\S+)\s+(\S+)$/) { + zone_conf($2,'primary',"p$1",qualify($3)); + } elsif (m/^published([*?]?)\s+(\S+)\s+([0-9.\t]+)$/) { + zone_conf($2,'published',"s$1",'',$3); + } elsif (m/^stealth([*?]?)\s+(\S+)\s+([0-9. \t]+)$/) { + zone_conf($2,'stealth',"u$1",'',split /\s+/, $3); + } elsif (m/^slave\-dir\s+(\S+)((?:\s+(\S+))?:\s+(\S+))?$/) { ($slave_dir, $slave_prefix, $slave_suffix) = (qualify($1),$2,$3); } elsif (m/^output\s+bind8\+(\S+)$/) { cfg_fail("default output may not apply to only some zones") @@ -162,10 +173,11 @@ sub read_config ($) { sub qualify ($) { my ($i) = @_; $i= "$default_dir/$i" unless $i =~ m,^/,; + return $i; } -sub zone_conf ($$@) { - my ($zone,$style,$file,@servers) = @_; +sub zone_conf ($$$@) { + my ($zone,$style,$s,$file,@servers) = @_; $file= qualify("$slave_dir/$slave_prefix".$zone.$slave_suffix) unless length $file; if (!length $output) { @@ -175,7 +187,8 @@ sub zone_conf ($$@) { } cfg_fail("redefined zone $zone") if exists $zone_cfg{$zone}; $zone_cfg{$zone}{'file'}= $file; - $zone_cfg{$zone}{'style'}= $style; + $zone_cfg{$zone}{'style_p'}= $style.$mod; + $zone_cfg{$zone}{'s'}= $s; # p)rimary s)econdary u)npublished f)oreign $zone_cfg{$zone}{'servers'}= [ @servers ]; $zone_cfg{$zone}{'self_soa'}= [ @self_soa ]; $zone_cfg{$zone}{'self_ns'}= [ @self_ns ]; @@ -211,15 +224,17 @@ sub process_zones (@) { foreach $zone (@zones) { $cfg= $zone_cfg{$zone} || { - 'style' => 'foreign', + 'style_p' => 'foreign', + 's' => 'f', 'servers' => [ ], }; - progress(sprintf "%-40s %s", $zone, $$cfg{'style'}); - if ($check) { + progress(sprintf "%-40s %s", $zone, $$cfg{'style_p'}); + if ($check && ($doall || $cfg{'s'} !~ m/\?/)) { eval { - if ($localonly && $cfg->{'style'} eq 'foreign') { + if ($localonly && $cfg->{'s'} =~ m/f/) { zone_warning("foreign zone specified with -l"); - } elsif ($localonly && $cfg->{'style'} ne 'primary') { + } elsif ($cfg->{'s'} =~ m/\*/ || + ($localonly && $cfg->{'s'} !~ m/p/)) { zone_check_local(); } else { zone_check_full(); @@ -229,6 +244,8 @@ sub process_zones (@) { } zone_output() if $install; } + print STDERR "$quis: $warnings warnings\n" or die $! + if $warnings; } sub zone_warning ($) { @@ -247,7 +264,7 @@ use vars qw(%delgs); # $delgs{$nameserver_list} = [ $whosaidandwhy ] use vars qw(%auths); # $auths{$nameserver_list} = [ $whosaidandwhy ] use vars qw(%glue); # $glue{$name}{$addr_list} = [ $whosaidandwhy ] use vars qw(%soas); # $soa{"$origin $serial"} = [ $whosaidandwhy ] -use vars qw(%addr_is_ok); +use vars qw(%addr_is_ok %gluelesswarned); use vars qw(@to_check); # ($addr,$whyask,$is_auth,$glueless_ok, ...) use vars qw(@to_check_soa); # ($addr,$whyask, ...) @@ -259,7 +276,7 @@ sub zone_check_full () { } sub zone_reset() { - %delgs= %auths= %glue= %soas= %addr_is_ok= (); + %delgs= %auths= %glue= %soas= %gluelesswarned= %addr_is_ok= (); @to_check= @to_check_soa= (); } @@ -317,8 +334,7 @@ sub zone_check_nsrrset ($$$$) { $dig_rdata, "$dig_owner, in glue from $ww", 1, 0; - $addr_is_ok{$dig_rdata}= "$dig_owner (NS [$uaddr])" - if $cfg->{'style'} eq 'stealth'; + zone_server_addr($dig_rdata,$dig_owner,"NS [$uaddr]"); push @{ $s2g{$dig_owner} }, $dig_rdata; } }, @@ -329,8 +345,11 @@ sub zone_check_nsrrset ($$$$) { foreach $s (@s) { @glue= @{ $s2g{$s} }; if (!@glue) { - zone_warning("glueless NS $s, from $ww") - unless $glueless_ok || !$needglue; + zone_warning("glueless NS $s,". + ($needglue<=1 ? " (eg)" : ""). + " from $ww") + unless $glueless_ok || !$needglue || + ($needglue<=1 && $gluelesswarned{$s}++); next; } $glue= join ' ', sort @glue; @@ -341,6 +360,15 @@ sub zone_check_nsrrset ($$$$) { push @{ $delgs_or_auths->{$s} }, $ww; } +sub zone_server_addr ($$$$) { + my ($addr,$name,$ww,$is_soa) = @_; + $addr_is_ok{$addr}= "$name ($ww)" + if $is_soa || $cfg{'s'} =~ m/u/; + zone_warning("configured as stealth but we [$addr]". + " are published ($name $ww)") + if $cfg->{'s'} =~ m/u/ && grep { $_ eq $addr } @self_addr; +} + sub zone_check_soa ($$) { my ($uaddr,$ww) = @_; my ($lame,$origin,$got,$rcode,@soa_addrs,$soa_addr); @@ -362,7 +390,7 @@ sub zone_check_soa ($$) { push @{ $soas{$got} }, $ww; ($rcode,@soa_addrs)= lookup($origin,'a','0'); foreach $soa_addr (@soa_addrs) { - $addr_is_ok{$soa_addr}= "$origin (SOA [$uaddr])"; + zone_server_addr($addr,$origin,"SOA [$uaddr]" push @to_check, $soa_addr, "$origin, SOA ORIGIN from $ww"; @@ -378,12 +406,12 @@ sub zone_consistency() { zone_consistency_set("glue for $h", $glue{$h}); } zone_consistency_set("SOA ORIGIN and SERIAL",\%soas); - if ($cfg->{'style'} eq 'primary') { + if ($cfg->{'s'} =~ m/p/) { foreach $org_ser (keys %soas) { $org_ser =~ m/^(\S+) \d+$/ or die "$org_ser ?"; $origin= $1; next if grep { $_ eq $origin } @self_soa; - zone_warning("our name(s) @self_soa not in SOA ORIGIN $origin,". + zone_warning("our name (@self_soa) not in SOA ORIGIN $origin,". " eg from ".((values %{ $soas{$org_ser} })[1])); } } @@ -424,10 +452,10 @@ sub zone_check_local () { sub zone_servers_simplefind () { my ($rcode,@nsnames,$ns,@soas,$origin); - if ($cfg->{'style'} eq 'stealth') { - ($rcode,@nsnames)= lookup($zone,'ns-','0'); - foreach $ns (@nsnames) { zone_server_simple($ns,'NS'); } - } + + ($rcode,@nsnames)= lookup($zone,'ns-','0'); + foreach $ns (@nsnames) { zone_server_simple($ns,'NS'); } + ($rcode,@soas)= lookup($zone,'soa','0'); die "multiple SOA RRs in set! @soas ?" if @soas!=1; $soas[0] =~ m/^(\S+)\s/ or die "SOA ? $_"; @@ -438,7 +466,7 @@ sub zone_server_simple ($$) { my ($name,$why) = @_; my ($rcode,@addrs,$addr); ($rcode,@addrs)= lookup($name,'a','0'); - foreach $addr (@addrs) { $addr_is_ok{$addr}= "$name ($why)"; } + foreach $addr (@addrs) { zone_server_addr($addr,$name,$why); } } #-------------------- outputting @@ -452,7 +480,7 @@ zone "%s" { }; END $zone, - $$cfg{'style'} eq 'primary' ? 'master' : 'slave', + $$cfg{'s'} =~ m/p/ ? 'master' : 'slave', $$cfg{'file'}); } @@ -479,17 +507,17 @@ sub lookup ($$$) { debug_trace("lookup ==> (->$okrcodes) $domain $type"); $h= new IO::Handle; - defined($c= open $h, "-|") or die "$0: fork adnshost:\n $!\n"; + defined($c= open $h, "-|") or die "$quis: fork adnshost:\n $!\n"; if (!$c) { exec 'adnshost','-Fi','+Do','+Dt','+Dc','-Cf',"-t$type", '-',"$domain."; - die "$0: exec adnshost:\n $!\n"; + die "$quis: exec adnshost:\n $!\n"; } @result= $h->getlines(); - $h->error and die "$0: read from adnshost:\n $!\n"; + $h->error and die "$quis: read from adnshost:\n $!\n"; chomp @result; $!=0; $h->close; - die "$0: lookup -t$type $domain $okrcodes failed $? $!\n" + die "$quis: lookup -t$type $domain $okrcodes failed $? $!\n" if $! or $?>6 or index($okrcodes,$?)<0; debug_trace("lookup <== $? @result"); return ($?,@result); @@ -505,18 +533,18 @@ sub dig (&$$$) { debug_trace("dig ==> \@$qaddr $qowner $qtype"); $h= new IO::Handle; - defined($c= open $h, "-|") or die "$0: fork dig:\n $!\n"; + defined($c= open $h, "-|") or die "$quis: fork dig:\n $!\n"; if (!$c) { open STDERR, ">&STDOUT" or die $!; exec ('dig', '+nodef','+nosea','+nodebug','+norecurse', "\@$qaddr",'-t',$qtype,$qowner); - die "$0: exec dig:\n $!\n"; + die "$quis: exec dig:\n $!\n"; } $inmid=''; for (;;) { if (!defined($_= $h->getline())) { - $h->error() and die "$0: read from dig:\n $!\n"; + $h->error() and die "$quis: read from dig:\n $!\n"; last; } chomp; @@ -566,214 +594,3 @@ sub domain_canon ($) { die "domain $_ ?" unless m/^[0-9a-z]/i; return lc $_; } - -__DATA__ - - - - -sub lookup1 ($$) { - my ($type,$domain) = @_; - my (@result)= lookup($type,$domain); - @result==1 or die "$0: lookup -t$type $domain gave more than one RR\n"; - return $result[0]; -} - -sub check () { - return unless $check; - eval { - $soa= lookup1('soa',$zone); - $soa_origin=$soa; $soa_origin =~ s/ .*//; - $soa_origin_addr= lookup1('a',$soa_origin); - - @zone_ns= lookup('ns-',$zone); - - @ok_sources= ($soa_origin_addr); - $ok_sources_descr= "SOA ORIGIN $soa_origin [$soa_origin_addr]"; - - if ($style eq 'unoff' || $style eq 'backup') { - for $zone_ns (@zone_ns) { - @zone_ns_addrs= lookup('a',$zone_ns); - push @ok_sources, @zone_ns_addrs; - $ok_sources_descr.= ", NS $zone_ns [@zone_ns_addrs]"; - } - } - - for $server (@servers) { - grep { $server eq $_ } @ok_sources - or warn "secondarying from $server which is not ". - "$ok_sources_desc\n"; - } - - if ($style eq 'secondary') { - grep { $zone_ns=$_, grep { $myname eq $_ } @mynames } @zone_n - or warn "supposedly published secondary but we ". - "(@mynames) are not published ($@zone_ns)\n"; - } - } - check_after_eval(); - - - -# $superzone= $zone; $superzone =~ s/^[^\.]+\.//; -# @super_ns= lookup('ns-',$zone); - } - - eval { - - for $super_ns (@super_ns) { - @deleg_ns= (); - open DIG, "dig @$super_ns. -t ns +norecurse $zone." - or die "$0: fork for dig:\n $!\n"; - while () { - - - split /\n/, lookup(" - - case "$style" in - secondary|backup) - if [ $meadvert = 0 ] - then - warning "$myname unlisted NS $nsnames" - fi - ;; - unoff) - if $meadvert = 0 - then - warning "$myname advertised NS $nsnames" - fi - ;; - esac - - addrs='' - for ns in $names - do - set -e; a="`host -t a \"$ns\".`"; set +e - taddrs="`echo \" $a\" | expand | sed -n ' - 1s/^ // - s/^[^ ][^ ]* *A *\([0-9][.0-9]*\)/\1/p - '`" - equlines "A $ns" "$a" "$taddrs" - addrs="$addrs $taddrs" - done - fi - - cat <) { - $zone= $f; $zone =~ s/_db$//; - - -for f in $zones -do - zone="`echo $f | sed -e 's/_db$//'`" -END -done -endfile - - - -sub beginfile ($) { - $currentfile= $_[0]; - $currentfile_opened= $install ? "$conf/$currentfile.new" : "/dev/null"; - open CFF, "> $toopen" or die "$0: begin $currentfile_opened:\n $!\n"; -} - -endfile () { - close CFF or die "$0: close $currentfile_opened:\n $!\n"; - push @files, $currentfile; -} - -sub installfiles () { - return unless $install; - chdir $conf or die "$0: chdir $conf:\n $!\n"; - for $f (@files) { - rename "$f.new", $f or die "$0: install new $f:\n $!\n"; - } -} - -warning () { - echo >&2 "$zone $style: $*" - warnings=$[$warnings+1] -} - -equlines () { - if [ "x`echo \" $2\" | wc -l`" != "x`echo \" $3\" | wc -l`" ] - then - warning "$1 >$2|$3<" - fi -} - -checkhostout () { - set +e - hostout="`host $1 \"$zone\" 2>&1 >/dev/null $2 | egrep -v \ -'^ \!\!\! .* SOA primary .* is not advertised via NS$'`" - set -e - if [ "x$hostout" = x ]; then return; fi - if $hostfirstwarn - then - warning "warnings from host:" - hostfirstwarn=0 - fi - echo >&2 "$hostout" -} - -progress () { - if $progress - then - echo -n "$zone $style " >&2 - echo -ne '\r' >&2 - fi -} - -myname='' - -if [ $warnings != 0 ] -then - echo >&2 "$warnings warnings " -fi - -installfiles