X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=chiark-utils.git;a=blobdiff_plain;f=scripts%2Fnamed-conf;h=b6d0c0c3966d8875a53847cfd0e126199c7768b0;hp=4bba39c595a4b9972fb85fd97384373fa436585b;hb=d9b9590be406d6c7488d8140b9b7d22db12f3499;hpb=f7c78677a610e138899dec6474ea89add2299425 diff --git a/scripts/named-conf b/scripts/named-conf index 4bba39c..b6d0c0c 100755 --- a/scripts/named-conf +++ b/scripts/named-conf @@ -1,198 +1,655 @@ -#!/bin/bash -set -e -base=/var/named -conf=$base/conf -etcfile=/etc/named/zones-rgc - -check=true -install=false -hostdelg=false -hostzone=false -progress=true -usage=true - -while [ $# -gt 0 ] -do - case "$1" in - -f) usage=false; check=false; install=true ;; - -y) usage=false; check=true; install=true ;; - -n) usage=false; check=true; install=false ;; - -h) hostdelg=true; hostzone=false ;; - -z) hostdelg=true; hostzone=true ;; - -q) progress=false ;; - *) echo >&2 "$0: usage: $0 [-y|-f] [-h|-z] [-q]"; exit 3 ;; - esac - shift -done +#!/usr/bin/perl -w -if $usage -then - cat <&2 -usage: named-conf-regen -f|-y|-n [-h|-z] -operation modes: - -f install without checking } but you must then - -y check and install } ndc reload - -n check only -additional options: - -h check output from host -C - -z check output from host -C and host -val -END - exit 1 -fi +use strict; +use IO::File; +use Data::Dumper; -beginfile () { - if $install - then - exec >$conf/$1.new - else - exec >/dev/null - fi - currentfile=$1 +use vars qw($quis $mode + $etcfile $where + $debug $needglue $localonly $verbosity); + +$quis= $0; $quis =~ s,.*/,,; + +$mode= ''; +$etcfile= "/etc/bind/chiark-conf-gen.zones"; +$where= ''; +$debug= 0; +$needglue= 2; +$localonly= 0; +$verbosity= 1; + +use vars qw($dig_owner $dig_type $dig_rdata); + +while (@ARGV && $ARGV[0] =~ m/^\-/) { + $_= shift @ARGV; + if (s/^\-\-//) { + last if m/^$/; + if (m/^(yes|no|force)$/) { m/^./; $mode= $&; } + elsif (m/^config$/) { $etcfile= loarg(); $where= '--config option'; } + elsif (m/^glueless$/) { $needglue--; } + elsif (m/^localonly$/) { $localonly=1; } + elsif (m/^quiet$/) { $verbosity=0; } + elsif (m/^verbose$/) { $verbosity=2; } + else { usageerr("unknown option --$_"); } + } else { + s/^\-//; + last if m/^$/; + while (m/^./) { + if (s/^[ynf]//) { $mode=$&; } + elsif (s/^C//) { $etcfile= soarg(); $where= '-C option'; } + elsif (s/^D//) { $debug++; } + elsif (s/^g//) { $needglue--; } + elsif (s/^l//) { $localonly=1; } + elsif (s/^q//) { $verbosity=0; } + elsif (s/^v//) { $verbosity=2; } + else { usageerr("unknown option -$&"); } + } + } } -endfile () { - exec >/dev/null - files="$files $currentfile" +sub loarg() { usageerr("missing option value") if !@ARGV; return shift @ARGV; } +sub soarg() { my ($rv); $rv=$_; $_=''; return length $rv ? $rv : loarg(); } + +usageerr("-g may be specified at most twice") if $needglue<0; +usageerr("-D may be specified at most twice") if $debug>2; +usageerr("must specify either -f|-y|-n or zones (and not both)") + if !!$mode == !!@ARGV; + +sub usageerr ($) { + die +"$_[0] +usage: named-conf-regen [-rvq] -f|-y|-n|...\n". +"operation modes:\n". +" -f --force install without checking\n". +" -y --yes check and install\n". +" -n --no check only\n". +"additional options:\n". +" -q --quiet no output for OK zones\n". +" -v --verbose extra verbose\n"; } -installfiles () { - if $install - then - cd $conf - for f in $files - do - mv -f $f.new $f - done - fi +cfg_fail("config filename $etcfile should have been absolute path of a file") + unless $etcfile =~ m,^/, && $etcfile !~ m,/$,; + +use vars qw($default_dir); +$default_dir= $etcfile; +$default_dir =~ s,/[^/]+$,,; + +use vars qw($slave_dir $slave_prefix $slave_suffix); +$slave_dir= 'slave'; +$slave_prefix= ''; +$slave_suffix= ''; + +use vars qw(@self_ns @self_soa); +@self_ns= @self_soa= (); + +use vars qw(%zone_cfg @zone_cfg_list); +%zone_cfg= (); +@zone_cfg_list= (); + +use vars qw($output $default_output %output_contents); +$output= ''; +$default_output= ''; +%output_contents= (); + +use vars qw($check $install); +$check= $mode !~ m/^f/; +$install= $mode =~ m/^[yf]/; + +read_config($etcfile); +debug_dump('@zone_cfg_list %zone_cfg'); +process_zones($mode ? @zone_cfg_list : @ARGV); +debug_dump('%output_contents'); + +exit 0; + +#-------------------- configuration reading + +sub cfg_fail ($) { die "$quis: $where:\n $_[0]\n"; } + +sub read_config ($) { + my ($if) = @_; + my ($fh,$z,@self, $dir,$prefix,$suffix,$lprefix,$lsuffix); + local ($_); + + $fh= new IO::File $if,'r' or cfg_fail("open $if:\n $!"); + for (;;) { + if (!defined($_= <$fh>)) { + cfg_fail("read config file $if:\n $!") if $fh->error(); + last; + } + $where= "$if:$."; + s/^\s+//; chomp; s/\s+$//; + next if m/^\#/; + last if m/^end$/; + next unless m/\S/; + if (m/^self(\-ns|\-soa|)\s+(\S.*\S)/) { + @self= split /\s+/, $2; + @self_ns= @self if $1 ne '-soa'; + @self_soa= @self if $1 ne '-ns'; + } elsif (m/^primary\-dir\s+(\S+)((?:\s+(\S+))?:\s+(\S+))?$/) { + ($dir, $prefix, $suffix) = (qualify($1),$2,$3); + $suffix= '_db' if !defined $suffix; + $prefix= '' if !defined $prefix; + opendir D, $dir or cfg_fail("open primary-dir $dir:\n $!"); + $lprefix= length $prefix; $lsuffix= length $suffix; + while (defined($_= readdir D)) { + next if m/^\./ && !$lprefix; + next unless length > $lprefix+$lsuffix; + next unless substr($_,0,$lprefix) eq $prefix; + next unless substr($_,length($_)-$lsuffix) eq $suffix; + $z= substr($_,$lprefix,length($_)-($lprefix+$lsuffix)); + zone_conf($z,'primary',"$dir/$_"); + } + closedir D or cfg_fail("close primary-dir $dir:\n $!"); + } elsif (m/^primary\s+(\S+)\s+(\S+)$/) { + zone_conf($1,'primary',qualify($2)); + } elsif (m/^secondary\s+(\S+)\s+([0-9.\t]+)$/) { + zone_conf($1,'secondary','',$2); + } elsif (m/^stealth\s+(\S+)\s+([0-9. \t]+)$/) { + zone_conf($1,'stealth','',split /\s+/, $2); + } elsif (m/^slave\-dir\s+(\S+)((?:\s+(\S+))?:\s+(\S+))?$/) { + ($slave_dir, $slave_prefix, $slave_suffix) = (qualify($1),$2,$3); + } elsif (m/^output\s+bind8\+(\S+)$/) { + cfg_fail("default output may not apply to only some zones") + if @zone_cfg_list && length $default_output; + set_output(qualify($1)); + } elsif (m/^include\s+(\S+)$/) { + read_config($1); + } else { + cfg_fail("unknown configuration directive". + " or incorrect syntax or arguments"); + } + } + $fh->close or cfg_fail("close config file $if:\n $!"); } -warnings=0 +sub qualify ($) { + my ($i) = @_; + $i= "$default_dir/$i" unless $i =~ m,^/,; + return $i; +} -warning () { - echo >&2 "$zone $style: $*" - warnings=$[$warnings+1] +sub zone_conf ($$@) { + my ($zone,$style,$file,@servers) = @_; + $file= qualify("$slave_dir/$slave_prefix".$zone.$slave_suffix) + unless length $file; + if (!length $output) { + $default_output= qualify('chiark-conf-gen.bind8') + unless length $default_output; + set_output($default_output); + } + cfg_fail("redefined zone $zone") if exists $zone_cfg{$zone}; + $zone_cfg{$zone}{'file'}= $file; + $zone_cfg{$zone}{'style'}= $style; + $zone_cfg{$zone}{'servers'}= [ @servers ]; + $zone_cfg{$zone}{'self_soa'}= [ @self_soa ]; + $zone_cfg{$zone}{'self_ns'}= [ @self_ns ]; + $zone_cfg{$zone}{'output'}= $output; + push @zone_cfg_list, $zone; } -equlines () { - if [ "x`echo \" $2\" | wc -l`" != "x`echo \" $3\" | wc -l`" ] - then - warning "$1 >$2|$3<" - fi +sub set_output($) { + my ($newout) = @_; + $output= $newout; + $output_contents{$output}= ''; } -checkhostout () { - set +e - hostout="`host $1 \"$zone\" 2>&1 >/dev/null $2 | egrep -v \ -'^ \!\!\! .* SOA primary .* is not advertised via NS$'`" - set -e - if [ "x$hostout" = x ]; then return; fi - if $hostfirstwarn - then - warning "warnings from host:" - hostfirstwarn=false - fi - echo >&2 "$hostout" + +#-------------------- checking + +use vars qw($zone $cfg $warnings); +$warnings= 0; + +sub progress ($) { + return if !$verbosity; + print "$_[0]\n"; } -progress () { - if $progress - then - echo -n "$zone $style " >&2 - echo -ne '\r' >&2 - fi +sub verbose ($) { + return if $verbosity<2; + print " $_[0]\n"; } -cd $base/primary -zones="*_db" +sub process_zones (@) { + my (@zones) = @_; + local ($zone,$cfg); -beginfile primary.zones -for f in $zones -do - zone="`echo $f | sed -e 's/_db$//'`" - cat < 'foreign', + 'servers' => [ ], + }; + progress(sprintf "%-40s %s", $zone, $$cfg{'style'}); + if ($check) { + eval { + if ($localonly && $cfg->{'style'} eq 'foreign') { + zone_warning("foreign zone specified with -l"); + } elsif ($localonly && $cfg->{'style'} ne 'primary') { + zone_check_local(); + } else { + zone_check_full(); + } + }; + zone_warning("checks failed: $@") if length $@; + } + zone_output() if $install; + } + print STDERR "$quis: $warnings warnings\n" or die $! + if $warnings; +} + +sub zone_warning ($) { + my ($w) = @_; + $w =~ s/\n$//; + $w =~ s,\n, // ,g; + print STDERR "$zone: warning: $w\n" or die $!; + $warnings++; +} + +sub zone_warnmore ($) { + print STDERR " $_[0]\n" or die $!; +} + +use vars qw(%delgs); # $delgs{$nameserver_list} = [ $whosaidandwhy ] +use vars qw(%auths); # $auths{$nameserver_list} = [ $whosaidandwhy ] +use vars qw(%glue); # $glue{$name}{$addr_list} = [ $whosaidandwhy ] +use vars qw(%soas); # $soa{"$origin $serial"} = [ $whosaidandwhy ] +use vars qw(%addr_is_ok %gluelesswarned); +use vars qw(@to_check); # ($addr,$whyask,$is_auth,$glueless_ok, ...) +use vars qw(@to_check_soa); # ($addr,$whyask, ...) + +sub zone_check_full () { + zone_reset(); + zone_investigate(); + zone_consistency(); + zone_servers_ok(); +} + +sub zone_reset() { + %delgs= %auths= %glue= %soas= %gluelesswarned= %addr_is_ok= (); + @to_check= @to_check_soa= (); +} + +sub zone_investigate() { + my ($super_zone, @super_nsnames, + $super_ns, @super_ns_addrs, $s, $wa, $is_auth, + %nsrrset_checked, %soa_checked, $addr, $glueless_ok, $rcode); + + $super_zone= $zone; + for (;;) { + debug_trace("zone $zone superzone $super_zone"); + $super_zone =~ s/^[^.]+\.// or die "no superzone ? ($super_zone)\n"; + ($rcode,@super_nsnames)= lookup($super_zone,'ns-','06'); + last if !$rcode; + } + for $super_ns (@super_nsnames) { + $super_ns= lc $super_ns; + ($rcode,@super_ns_addrs)= lookup($super_ns,'a','0'); + foreach $addr (@super_ns_addrs) { + push @to_check, + $addr, + "$super_ns, server for $super_zone", + 0, 0; + } + } + for (;;) { + # We do these in order so that we always do NS RRset checks on + # nameservers that came from other NS RRsets first; otherwise + # we might set nsrrset_checked due to a glueless_ok check, + # and then not check for gluefulness later. + debug_dump('@to_check @to_check_soa'); + if (($addr,$wa,$is_auth,$glueless_ok,@to_check) = @to_check) { + push @to_check_soa, $addr, $wa if $is_auth; + next if $nsrrset_checked{$addr}++; + zone_check_nsrrset($addr, "[$addr] $wa", + $is_auth, $glueless_ok); + } elsif (($addr,$wa,@to_check_soa) = @to_check_soa) { + next if $soa_checked{$addr}++; + zone_check_soa($addr,"[$addr] $wa"); + } else { + last; + } + } +} + +sub zone_check_nsrrset ($$$$) { + my ($uaddr,$ww, $is_auth, $glueless_ok) = @_; + my (@s, $s, %s2g, @glue, $glue, $delgs_or_auths); + verbose("checking delegation by $ww"); + dig(sub { + if ($dig_type eq 'ns' && $dig_owner eq $zone) { + $s2g{lc $dig_rdata} = [ ]; + } elsif ($dig_type eq 'a' && exists $s2g{$dig_owner}) { + push @to_check, + $dig_rdata, + "$dig_owner, in glue from $ww", + 1, 0; + $addr_is_ok{$dig_rdata}= "$dig_owner (NS [$uaddr])" + if $cfg->{'style'} eq 'stealth'; + push @{ $s2g{$dig_owner} }, $dig_rdata; + } + }, + $zone,'ns',$uaddr); + if (!%s2g) { zone_warning("unable to find NS RRset at $ww"); return; } + elsif (keys %s2g == 1) { zone_warning("only one nameserver at $ww"); } + @s= sort keys %s2g; + foreach $s (@s) { + @glue= @{ $s2g{$s} }; + if (!@glue) { + zone_warning("glueless NS $s,". + ($needglue<=1 ? " (eg)" : ""). + " from $ww") + unless $glueless_ok || !$needglue || + ($needglue<=1 && $gluelesswarned{$s}++); + next; + } + $glue= join ' ', sort @glue; + push @{ $glue{$s}{$glue} }, $ww; + } + $s= join ' ', @s; + $delgs_or_auths= $is_auth ? \%auths : \%delgs; + push @{ $delgs_or_auths->{$s} }, $ww; +} + +sub zone_check_soa ($$) { + my ($uaddr,$ww) = @_; + my ($lame,$origin,$got,$rcode,@soa_addrs,$soa_addr); + verbose("checking service at $ww"); + $lame= 'dead or lame'; + dig(sub { + if ($dig_type eq 'flags:') { + $lame= $dig_rdata =~ m/ aa / ? '' : 'lame'; + } elsif ($dig_type eq 'soa' && $dig_owner eq $zone && !$lame) { + die "several SOAs ? $ww" if defined $origin; + $got= $dig_rdata; + $got =~ m/^(\S+) \d+/ or die "$got ?"; + $origin= $1; + } + }, + $zone,'soa',$uaddr); + $lame= 'broken' if !$lame && !defined $origin; + if ($lame) { zone_warning("$lame server $ww"); return; } + push @{ $soas{$got} }, $ww; + ($rcode,@soa_addrs)= lookup($origin,'a','0'); + foreach $soa_addr (@soa_addrs) { + $addr_is_ok{$soa_addr}= "$origin (SOA [$uaddr])"; + push @to_check, + $soa_addr, + "$origin, SOA ORIGIN from $ww"; + } +} + +sub zone_consistency() { + my ($d, $org_ser, $origin, $a, $h); + zone_consistency_set('delegations',\%delgs); + foreach $d (keys %delgs) { delete $auths{$d}; } + zone_consistency_set('zone nameserver rrset',\%auths); + foreach $h (keys %glue) { + zone_consistency_set("glue for $h", $glue{$h}); + } + zone_consistency_set("SOA ORIGIN and SERIAL",\%soas); + if ($cfg->{'style'} eq 'primary') { + foreach $org_ser (keys %soas) { + $org_ser =~ m/^(\S+) \d+$/ or die "$org_ser ?"; + $origin= $1; + next if grep { $_ eq $origin } @self_soa; + zone_warning("our name(s) @self_soa not in SOA ORIGIN $origin,". + " eg from ".((values %{ $soas{$org_ser} })[1])); + } + } +} + +sub zone_servers_ok () { + my ($showok); + if (%addr_is_ok) { + $showok= 0; + foreach $a (@{ $cfg->{'servers'} }) { + next if exists $addr_is_ok{$a}; + zone_warning("we slave from $a"); $showok=1; + } + if ($showok) { + foreach $a (keys %addr_is_ok) { + zone_warnmore("permitted master [$a] $addr_is_ok{$a}"); + } + } + } +} + +sub zone_consistency_set ($%) { + my ($msg,$set) = @_; + my ($d,$o); + if (keys(%$set) > 1) { + zone_warning("inconsistent $msg:"); + foreach $d (keys %$set) { + foreach $o (@{ $set->{$d} }) { zone_warnmore(" $d from $o"); } + } + } +} + +sub zone_check_local () { + zone_reset(); + zone_servers_simplefind(); + zone_servers_ok(); +} + +sub zone_servers_simplefind () { + my ($rcode,@nsnames,$ns,@soas,$origin); + if ($cfg->{'style'} eq 'stealth') { + ($rcode,@nsnames)= lookup($zone,'ns-','0'); + foreach $ns (@nsnames) { zone_server_simple($ns,'NS'); } + } + ($rcode,@soas)= lookup($zone,'soa','0'); + die "multiple SOA RRs in set! @soas ?" if @soas!=1; + $soas[0] =~ m/^(\S+)\s/ or die "SOA ? $_"; + zone_server_simple(domain_canon($1),'SOA'); +} + +sub zone_server_simple ($$) { + my ($name,$why) = @_; + my ($rcode,@addrs,$addr); + ($rcode,@addrs)= lookup($name,'a','0'); + foreach $addr (@addrs) { $addr_is_ok{$addr}= "$name ($why)"; } +} + +#-------------------- outputting + +sub zone_output () { + $output_contents{$$cfg{'output'}}.= + sprintf(<<'END', +zone "%s" { + type %s; + file "%s"; }; END -done -endfile + $zone, + $$cfg{'style'} eq 'primary' ? 'master' : 'slave', + $$cfg{'file'}); +} -myname='' -beginfile secondary.zones -exec <$etcfile -while read style zone servers -do - names='' - case "$style" in - myname) - myname=$zone - continue - ;; - secondary) - progress - file="slave/$zone" - if $check - then - rectype=SOA - set -e; soa="`host -t soa $zone.`"; set +e - soaname="`echo \" $soa\" | expand | sed -e ' - s/^ [^ ][^ ]* *SOA *//; s/ .*$//; q - '`" - equlines SOA "$soaname" '' - fi - ;; - backup|unoff) - progress - rectype=NS - file="slave/$zone" - ;; - '#'|'') - continue - ;; - *) - echo >&2 "$etcfile: $style" - exit 3 - esac - - if $check - then - set -e; ns="`host -t ns $zone.`"; set +e - nsnames="`echo \" $ns\" | expand | tr A-Z a-z | sed -n ' - 1s/^ // - s/^[^ ][^ ]* *ns *\([0-9a-z][-.0-9a-z]*\)$/\1/p - '`" - equlines NS "$nsnames" "$ns" - nsnames="`echo $nsnames | tr ' -' ' '`" - - if [ "x$myname" != x ] - then - meadvert=false - for ns in $nsnames - do - if [ "x$myname" = "x$ns" ] - then - meadvert=true - fi - done - fi +#-------------------- general utilities - case "$style" in - secondary) names="$soaname" ;; - unoff|backup) names="$nsnames" ;; - esac +sub debug_dump ($) { + my ($vn); + return unless $debug>1; + local $Data::Dumper::Terse=1; + foreach $vn (split /\s+/, $_[0]) { + print "$vn := ", eval "Dumper(\\$vn)"; + } +} + +sub debug_trace ($) { + return unless $debug; + print "D $_[0]\n"; +} + +sub lookup ($$$) { + my ($domain,$type,$okrcodes) = @_; + my ($c,$h,@result); + debug_trace("lookup ==> (->$okrcodes) $domain $type"); + $h= new IO::Handle; + + defined($c= open $h, "-|") or die "$quis: fork adnshost:\n $!\n"; + if (!$c) { + exec 'adnshost','-Fi','+Do','+Dt','+Dc','-Cf',"-t$type", + '-',"$domain."; + die "$quis: exec adnshost:\n $!\n"; + } + @result= $h->getlines(); + $h->error and die "$quis: read from adnshost:\n $!\n"; + chomp @result; + $!=0; $h->close; + die "$quis: lookup -t$type $domain $okrcodes failed $? $!\n" + if $! or $?>6 or index($okrcodes,$?)<0; + debug_trace("lookup <== $? @result"); + return ($?,@result); +} + + +sub dig (&$$$) { + my ($eachrr, $qowner,$qtype,$qaddr) = @_; + # also pseudo-rr with type `flags:' + my ($h,$inmid,$irdata,$c); + local ($_); + debug_trace("dig ==> \@$qaddr $qowner $qtype"); + + $h= new IO::Handle; + defined($c= open $h, "-|") or die "$quis: fork dig:\n $!\n"; + if (!$c) { + open STDERR, ">&STDOUT" or die $!; + exec ('dig', + '+nodef','+nosea','+nodebug','+norecurse', + "\@$qaddr",'-t',$qtype,$qowner); + die "$quis: exec dig:\n $!\n"; + } + $inmid=''; + for (;;) { + if (!defined($_= $h->getline())) { + $h->error() and die "$quis: read from dig:\n $!\n"; + last; + } + chomp; + if (length $inmid) { + s/^\s+/ / or die "$inmid // $_ ?"; + s/\;.*$//; + $_= $inmid.$_; + $inmid=''; + s/$/ \(/ unless s/\s*\)\s*$//; + } + if (s/\s*\(\s*$//) { $inmid= $_; next; } + if (m/^\;\; flags\:( [-0-9a-z ]+)\;/) { + $dig_owner=''; $dig_type='flags:'; $dig_rdata= "$1 "; + debug_trace("dig f: $dig_rdata"); + &$eachrr; + } elsif (m/^\;/) { + } elsif (!m/\S/) { + } elsif (m/^([-.0-9a-z]+)\s+\d\w+\s+in\s+([a-z]+)\s+(\S.*)/i) { + $dig_owner=domain_canon($1); $dig_type=lc $2; $irdata=$3; + if ($dig_type eq 'a') { + $irdata =~ m/^[.0-9]+$/ or die "$irdata ?"; + $dig_rdata= $&; + } elsif ($dig_type eq 'ns') { + $irdata =~ m/^[-.0-9a-z]+$/i or die "bad nameserver $irdata ?"; + $dig_rdata= domain_canon($irdata); + } elsif ($dig_type eq 'soa') { + $irdata =~ m/^([-.0-9a-z]+)\s+.*\s+(\d+)(?:\s+\d\w+){4}$/i + or die "bad SOA $irdata ?"; + $dig_rdata= domain_canon($1).' '.$2; + } else { + debug_trace("ignoring uknown RR type $dig_type"); + next; + } + debug_trace("dig $dig_owner $dig_type $dig_rdata"); + &$eachrr; + } else { + debug_trace("ignoring unknown dig output $_"); + } + } + $h->close; + debug_trace("dig <== gave $?"); +} + +sub domain_canon ($) { + local ($_) = @_; + s/(.)\.$/$1/; + die "domain $_ ?" unless m/^[0-9a-z]/i; + return lc $_; +} + +__DATA__ + + + + +sub lookup1 ($$) { + my ($type,$domain) = @_; + my (@result)= lookup($type,$domain); + @result==1 or die "$quis: lookup -t$type $domain gave more than one RR\n"; + return $result[0]; +} + +sub check () { + return unless $check; + eval { + $soa= lookup1('soa',$zone); + $soa_origin=$soa; $soa_origin =~ s/ .*//; + $soa_origin_addr= lookup1('a',$soa_origin); + + @zone_ns= lookup('ns-',$zone); + + @ok_sources= ($soa_origin_addr); + $ok_sources_descr= "SOA ORIGIN $soa_origin [$soa_origin_addr]"; + + if ($style eq 'unoff' || $style eq 'backup') { + for $zone_ns (@zone_ns) { + @zone_ns_addrs= lookup('a',$zone_ns); + push @ok_sources, @zone_ns_addrs; + $ok_sources_descr.= ", NS $zone_ns [@zone_ns_addrs]"; + } + } + + for $server (@servers) { + grep { $server eq $_ } @ok_sources + or warn "secondarying from $server which is not ". + "$ok_sources_desc\n"; + } + + if ($style eq 'secondary') { + grep { $zone_ns=$_, grep { $myname eq $_ } @mynames } @zone_n + or warn "supposedly published secondary but we ". + "(@mynames) are not published ($@zone_ns)\n"; + } + } + check_after_eval(); + + + +# $superzone= $zone; $superzone =~ s/^[^\.]+\.//; +# @super_ns= lookup('ns-',$zone); + } + + eval { + + for $super_ns (@super_ns) { + @deleg_ns= (); + open DIG, "dig @$super_ns. -t ns +norecurse $zone." + or die "$quis: fork for dig:\n $!\n"; + while () { + + + split /\n/, lookup(" + case "$style" in secondary|backup) - if [ $meadvert = false ] + if [ $meadvert = 0 ] then warning "$myname unlisted NS $nsnames" fi ;; unoff) - if $meadvert = false + if $meadvert = 0 then warning "$myname advertised NS $nsnames" fi @@ -223,12 +680,12 @@ END echo " $server;" if $check then - notfound=true + notfound=1 for addr in $addrs do if [ "x$addr" = "x$server" ] then - notfound=false + notfound=0 fi done if $notfound @@ -241,7 +698,7 @@ END }; }; END - hostfirstwarn=true + hostfirstwarn=1 if $hostdelg then checkhostout -C @@ -253,6 +710,78 @@ END done endfile + +chdir "$base/primary" or die "$quis: chdir $base/primary:\n $!"; +beginfile('primary.zones'); + +for $f (<*_db>) { + $zone= $f; $zone =~ s/_db$//; + + +for f in $zones +do + zone="`echo $f | sed -e 's/_db$//'`" +END +done +endfile + + + +sub beginfile ($) { + $currentfile= $_[0]; + $currentfile_opened= $install ? "$conf/$currentfile.new" : "/dev/null"; + open CFF, "> $toopen" or die "$quis: begin $currentfile_opened:\n $!\n"; +} + +endfile () { + close CFF or die "$quis: close $currentfile_opened:\n $!\n"; + push @files, $currentfile; +} + +sub installfiles () { + return unless $install; + chdir $conf or die "$quis: chdir $conf:\n $!\n"; + for $f (@files) { + rename "$f.new", $f or die "$quis: install new $f:\n $!\n"; + } +} + +warning () { + echo >&2 "$zone $style: $*" + warnings=$[$warnings+1] +} + +equlines () { + if [ "x`echo \" $2\" | wc -l`" != "x`echo \" $3\" | wc -l`" ] + then + warning "$1 >$2|$3<" + fi +} + +checkhostout () { + set +e + hostout="`host $1 \"$zone\" 2>&1 >/dev/null $2 | egrep -v \ +'^ \!\!\! .* SOA primary .* is not advertised via NS$'`" + set -e + if [ "x$hostout" = x ]; then return; fi + if $hostfirstwarn + then + warning "warnings from host:" + hostfirstwarn=0 + fi + echo >&2 "$hostout" +} + +progress () { + if $progress + then + echo -n "$zone $style " >&2 + echo -ne '\r' >&2 + fi +} + +myname='' + if [ $warnings != 0 ] then echo >&2 "$warnings warnings "