#!/usr/bin/perl

# bin/dns-chk.saint
#

require 'config/paths.pl';
require 'config/saint.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";
$service = "domain";

if ($#ARGV < 0) {
   die "Usage: bin/dns_check.saint hostname\n";
}

$target = $ARGV[0];

$args = "-q=txt -class=chaos version.bind";

die "Can't open $NSLOOKUP: $!\n" unless open(NS, "$NSLOOKUP $args $target 2>&1|");


while(<NS>) {
   chop;
   # catch-all for versions that don't identify themselves
   # (e.g. BIND < 4.9.5)
   if (/can't/i) {
         $status = "a";
         $severity = "zcio";
         $trustee = "ANY@$target";
         $trusted = "ANY@$target";
         $service_output = "DNS vulnerabilities";
         $text = "DNS may be vulnerable";
         &saint_print();
         exit;
   }
   
   if (/VERSION.BIND/i) {
      @version = split("\"", $_);
      @version = split("-", @version[1]);
      $version = @version[0];
      $patchlevel = $betalevel = "";
      if (@version[1] =~ /P\d/) {
         ($patchlevel = @version[1]) =~ s/P//i;
      } elsif (@version[1] =~ /T\d/) {
	  ($betalevel = @version[1]) =~ s/T//i;
      }
      $P_str = ($patchlevel) ? "-P$patchlevel" : "";
      # BIND < 4.9.8 and < 8.2.3 and all 8.2.3 betas have buffer overflow
      if (($version lt "4.9.8") || ($version ge "8.1" && $version lt "8.2.3")
	    || ($version eq "8.2.3" && $betalevel)) {
         $status = "a";
         $severity = "bo";
         $trustee = "ANY@$target";
         $trusted = "ANY@$target";
         $service_output = "DNS vulnerabilities";
         $text = "buffer overflow in BIND $version$P_str";
         &saint_print();
      } elsif ($version ge "9.0" && $version lt "9.2.1") {
         $status = "a";
         $severity = "dos";
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
         $service_output = "DNS vulnerabilities";
         $text = "denial of service problem in BIND $version$P_str";
         &saint_print();
      }
   } else { next; }
}

close(NS);
