From 2dbeba8d398519b846753092ce2cea67a28adc30 Mon Sep 17 00:00:00 2001 From: ianmdlvl Date: Mon, 31 Dec 2001 01:43:50 +0000 Subject: [PATCH] Core coding done. --- scripts/named-conf | 240 +++++++++++++++++++++++++++++++++++++++---- scripts/named-conf.8 | 25 ++--- 2 files changed, 230 insertions(+), 35 deletions(-) diff --git a/scripts/named-conf b/scripts/named-conf index b037492..4c401f4 100755 --- a/scripts/named-conf +++ b/scripts/named-conf @@ -1,14 +1,17 @@ #!/usr/bin/perl -w +use strict; use IO::File; use Data::Dumper; +use vars qw($etcfile $where); $etcfile= "/etc/bind/chiark-conf-gen.zones"; $where= ''; +use vars qw($mode $verbosity $debug); $mode= ''; $verbosity= 1; -$fromroot= 0; +$debug= 0; while (@ARGV && $ARGV[0] =~ m/^\-/) { $_= shift @ARGV; @@ -16,7 +19,6 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { last if m/^$/; if (m/^quiet$/) { $verbosity=0; } elsif (m/^verbose$/) { $verbosity=2; } - elsif (m/^root$/) { $fromroot=1; } elsif (m/^(yes|no|force)$/) { m/^./; $mode= $&; } elsif (m/^config$/) { $etcfile= loarg(); $where= '--config option'; } else { usageerr("unknown option --$_"); } @@ -25,9 +27,9 @@ while (@ARGV && $ARGV[0] =~ m/^\-/) { last if m/^$/; while (m/^./) { if (s/^[ynf]//) { $mode=$&; } - elsif (s/^r//) { $fromroot=1; } elsif (s/^v//) { $verbosity=2; } elsif (s/^q//) { $verbosity=0; } + elsif (s/^D//) { $debug=1; } elsif (s/^C//) { $etcfile= soarg(); $where= '-C option'; } else { usageerr("unknown option -$&"); } } @@ -49,7 +51,6 @@ usage: named-conf-regen [-rvq] -f|-y|-n|...\n". " -y --yes check and install\n". " -n --no check only\n". "additional options:\n". -" -r --root check all the way back to the root\n". " -q --quiet no output for OK zones\n". " -v --verbose extra verbose\n"; } @@ -57,22 +58,220 @@ usage: named-conf-regen [-rvq] -f|-y|-n|...\n". cfg_fail("config filename $etcfile should have been absolute path of a file") unless $etcfile =~ m,^/, && $etcfile !~ m,/$,; +use vars qw($default_dir); $default_dir= $etcfile; $default_dir =~ s,/[^/]+$,,; +use vars qw($slave_dir $slave_prefix $slave_suffix); $slave_dir= 'slave'; $slave_prefix= ''; $slave_suffix= ''; + +use vars qw(@self_ns @self_soa); @self_ns= @self_soa= (); + +use vars qw(%zone_cfg @zone_cfg_list); %zone_cfg= (); @zone_cfg_list= (); + +use vars qw($output $default_output %output_contents); $output= ''; $default_output= ''; %output_contents= (); +use vars qw($check $install); +$check= $mode !~ m/^n/; +$install= $mode =~ m/^[yf]/; + read_config($etcfile); +debug_dump('@zone_cfg_list %zone_cfg'); +process_zones($mode ? @zone_cfg_list : @ARGV); +debug_dump('%output_contents'); + +use vars qw($zone $cfg $warnings); +$warnings= 0; + +sub progress ($) { + return if !$verbosity; + print "$_[0]\n"; +} + +sub process_zones (@) { + my (@zones) = @_; + local ($zone,$cfg); + + foreach $zone (@zones) { + $cfg= $zone_cfg{$zone} || { 'style' => 'foreign' }; + progress(sprintf "%-40s %s", $zone, $$cfg{'style'}); + if ($check) { + eval { zone_check() }; + zone_warning("checks failed: $@") if length $@; + } + zone_output() if $install; + } +} + +sub zone_warning ($) { + my ($w) = @_; + $w =~ s/\n$//; + $w =~ s,\n, // ,g; + print STDERR "$zone: warning: $w\n" or die $!; + $warnings++; +} + +sub zone_warnmore ($) { + print STDERR " $_[0]\n" or die $!; +} -print Dumper(@zone_cfg_list), Dumper(%zone_cfg); +use vars qw(%delgs # $delgs{$nameserver_list} = [ $whosaidandwhy ] + %auths # $auths{$nameserver_list} = [ $whosaidandwhy ] + %glue # $glue{$name}{$addr_list} = [ $whosaidandwhy ] + %soas # $soa{"$origin $serial"} = [ $whosaidandwhy ] + @to_check # ($addr,$whyask,\%delgs_or_auths,$glueless_ok, ...) + @to_check_soa # ($addr,$whyask, ...) + ); + +sub zone_check () { + my ($super_zone, @super_nsnames, + $super_ns, @super_ns_addrs, $super_ns_addr, $s, $wa, $zcr, + %nsrrset_checked, %soa_checked); + + %delgs= %auths= %glue= (); + @to_check= @to_check_soa= (); + + $super_zone= $zone; + for (;;) { + debug_trace("zone $zone superzone $super_zone"); + $super_zone =~ s/^[^.]+\.// or die "no superzone ? ($super_zone)\n"; + ($rcode,@super_nsnames)= lookup($super_zone,'ns-','06'); + last if !$rcode; + } + for $super_ns (@super_nsnames) { + $super_ns= lc $super_ns; + ($rcode,@this_ns_addrs)= lookup($super_ns,'a','0'); + foreach $super_ns_addr (@this_ns_addrs) { + push @to_check, + $super_ns_addr, + "addr for $super_ns, server for $super_zone, parent" + \%delgs, 0; + } + } + for (;;) { + # We do these in order so that we always do NS RRset checks on + # nameservers that came from other NS RRsets first; otherwise + # we might set nsrrset_checked due to a glueless_ok check, + # and then not check for gluefulness later. + if (($addr,$wa,$nsrrset_ref,$glueless_ok,@to_check) = @to_check) { + next if $nsrrset_checked{$ns}++; + push @to_check_soa, $addr, $why; + zone_check_nsrrset($super_ns_addr,"$addr, $wa", + %$delgs_or_auths,$glueless_ok); + } elsif (($addr,$wa) = @to_check_soa) { + next if !$soa_checked{$ns}++; + zone_check_soa($addr,"$addr, $wa"); + } + } + zone_consistency(); +} + +sub zone_consistency() { + my ($d); + zone_consistency_set('delegations',%delgs); + foreach $d (keys %delgs) { delete $auths{$d}; } + zone_consistency_set('zone nameserver rrset',%auths); + foreach $h (keys %glue) { + zone_consistency_set("glue for $h", %{ $glue{$h} }); + } +} + +sub zone_consistency_set ($\%) { + my ($msg,$set) = @_; + my ($d,$o); + if (keys(%$set) != 1) { + zone_warning("inconsistent $msg:"); + foreach $d (keys %$set) { + foreach $o (@$d) { zone_warnmore(" $d from $o"); } + } + } +} + +sub zone_check_soa ($$) { + my ($uaddr,$ww) = @_; + my ($lame,$origin,$got,$rcode,@soa_addrs,$soa_addr); + $lame= 'dead or lame'; + dig::dig({ + if ($dig::type eq 'flags:') { + $lame= $dig::rdata =~ m/ aa / ? 'lame' : ''; + } elsif ($dig::type eq 'soa' && $dig::owner eq $zone && !$lame) { + die "several SOAs ? $why" if defined $origin; + $dig::rdata =~ m/^(\S+) \S+ (\d+) / + or die "soa $dig::rdata ? $why"; + $origin= $1; + $got= "$1 $2"; + } + }, + $zone,'soa',$uaddr); + $lame= 'broken' if !$lame && !defined $origin; + if ($lame) { zone_warning("$lame server $ww"); return; } + push @{ $soas{$got} }, $why; + ($rcode,@soa_addrs)= lookup($origin,'a','0'); + foreach $soa_addr (@soa_addrs) { + push @to_check, + $soa_addr, + "addr for $origin, SOA ORIGIN from $why"; + } +} + +sub zone_check_nsrrset ($$\%\%) { + my ($uaddr,$ww, $delgs_or_auths,$glueless_ok) = @_; + my (@s, $s, %s2g, @glue, $glue); + dig::dig({ + if ($dig::type eq 'ns' && $dig::owner eq $zone) { + $s2g{lc $dig::rdata} = [ ]; + } elsif ($dig::type eq 'a' && exists $s2g{$dig::owner}) { + push @to_check, + $dig::rdata, + "glue for $dig::owner, from (eg) $why", + \%auths, 0; + push @{ $s2g{$dig::rdata} }, $dig::rdata; + } + }, + $zone,'ns',$uaddr); + @s= sort keys %s2g; + foreach $s (@s) { + @glue= @{ $s2g{$s} }; + if (!length @glue) { + zone_warning("glueless NS $s, from $ww") unless $glueless_ok; + next; + } + $glue= join ' ', sort @glue; + push @{ $glue{$s}{$glue} }, $why; + } + $s= join ' ', @s; + push @{ $nsrrset_ref->{$s} }, $why; +} + +sub zone_output () { + $output_contents{$$cfg{'output'}}.= + sprintf(<<'END', +zone "%s" { + type %s; + file "%s"; +}; +END + $zone, + $$cfg{'style'} eq 'primary' ? 'master' : 'slave', + $$cfg{'file'}); +} + +sub debug_dump ($) { + my ($vn); + return unless $debug; + local $Data::Dumper::Terse=1; + foreach $vn (split /\s+/, $_[0]) { + print "$vn := ", eval "Dumper(\\$vn)"; + } +} sub cfg_fail ($) { die "$0: $where:\n $_[0]\n"; } @@ -150,7 +349,9 @@ sub zone_conf ($$@) { cfg_fail("redefined zone $zone") if exists $zone_cfg{$zone}; $zone_cfg{$zone}{'file'}= $file; $zone_cfg{$zone}{'style'}= $style; - $zone_cfg{$zone}{'servers'}= @servers; + $zone_cfg{$zone}{'servers'}= [ @servers ]; + $zone_cfg{$zone}{'self_soa'}= [ @self_soa ]; + $zone_cfg{$zone}{'self_ns'}= [ @self_ns ]; $zone_cfg{$zone}{'output'}= $output; push @zone_cfg_list, $zone; } @@ -161,26 +362,28 @@ sub set_output($) { $output_contents{$output}= ''; } -__DATA__ - - - -sub lookup ($$) { - my ($type,$domain) = @_; +sub lookup ($$$) { + my ($type,$domain,$okrcodes) = @_; my ($c,@result); - defined($c=open ADH, "-|") or die "$0: fork adnshost:\n $!\n"; + defined($c= open ADH, "-|") or die "$0: fork adnshost:\n $!\n"; if (!$c) { - exec 'adnshost','+Do','+Dt','+Dc','-Cf',"-t$type", + exec 'adnshost','-Fi','+Do','+Dt','+Dc','-Cf',"-t$type", '-',"$domain."; die "$0: exec adnshost:\n $!\n"; } @result= ; chomp @result; $!=0; close ADH; - die "$0: lookup -t$type $domain failed $? $!\n" if $? or $!; - return @result; + die "$0: lookup -t$type $domain $okrcodes failed $? $!\n" + if $! or $?>6 or index($okrcodes,$?)<0; + return ($?,@result); } +__DATA__ + + + + sub lookup1 ($$) { my ($type,$domain) = @_; my (@result)= lookup($type,$domain); @@ -319,11 +522,6 @@ for $f (<*_db>) { for f in $zones do zone="`echo $f | sed -e 's/_db$//'`" - cat <