1 files changed, 581 insertions, 338 deletions

diff --git a/plugins/check_dig.c b/plugins/check_dig.c
index be7a6101..9ea19e6a 100644
--- a/plugins/check_dig.c
+++ b/plugins/check_dig.c
@@ -1,30 +1,30 @@
 /*****************************************************************************
-* 
-* Monitoring check_dig plugin
-* 
-* License: GPL
-* Copyright (c) 2002-2008 Monitoring Plugins Development Team
-* 
-* Description:
-* 
-* This file contains the check_dig plugin
-* 
-* 
-* This program is free software: you can redistribute it and/or modify
-* it under the terms of the GNU General Public License as published by
-* the Free Software Foundation, either version 3 of the License, or
-* (at your option) any later version.
-* 
-* This program is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-* GNU General Public License for more details.
-* 
-* You should have received a copy of the GNU General Public License
-* along with this program.  If not, see <http://www.gnu.org/licenses/>.
-* 
-* 
-*****************************************************************************/
+ *
+ * Monitoring check_dig plugin
+ *
+ * License: GPL
+ * Copyright (c) 2002-2025 Monitoring Plugins Development Team
+ *
+ * Description:
+ *
+ * This file contains the check_dig plugin
+ *
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ *
+ *****************************************************************************/
 
 /* Hackers note:
  *  There are typecasts to (char *) from _("foo bar") in this file.
@@ -33,348 +33,591 @@
  *  because on some architectures those strings are in non-writable memory */
 
 const char *progname = "check_dig";
-const char *copyright = "2002-2008";
+const char *copyright = "2002-2025";
 const char *email = "devel@monitoring-plugins.org";
 
+#include <ctype.h>
 #include "common.h"
 #include "netutils.h"
 #include "utils.h"
 #include "runcmd.h"
 
-int process_arguments (int, char **);
-int validate_arguments (void);
-void print_help (void);
-void print_usage (void);
-
-#define UNDEFINED 0
-#define DEFAULT_PORT 53
-#define DEFAULT_TRIES 2
-
-char *query_address = NULL;
-char *record_type = "A";
-char *expected_address = NULL;
-char *dns_server = NULL;
-char *dig_args = "";
-char *query_transport = "";
-bool verbose = false;
-int server_port = DEFAULT_PORT;
-int number_tries = DEFAULT_TRIES;
-double warning_interval = UNDEFINED;
-double critical_interval = UNDEFINED;
-struct timeval tv;
-
-int
-main (int argc, char **argv)
-{
-  char *command_line;
-  output chld_out, chld_err;
-  char *msg = NULL;
-  size_t i;
-  char *t;
-  long microsec;
-  double elapsed_time;
-  int result = STATE_UNKNOWN;
-  int timeout_interval_dig;
-
-  setlocale (LC_ALL, "");
-  bindtextdomain (PACKAGE, LOCALEDIR);
-  textdomain (PACKAGE);
-
-  /* Set signal handling and alarm */
-  if (signal (SIGALRM, runcmd_timeout_alarm_handler) == SIG_ERR)
-    usage_va(_("Cannot catch SIGALRM"));
-
-  /* Parse extra opts if any */
-  argv=np_extra_opts (&argc, argv, progname);
-
-  if (process_arguments (argc, argv) == ERROR)
-    usage_va(_("Could not parse arguments"));
-
-  /* dig applies the timeout to each try, so we need to work around this */
-  timeout_interval_dig = timeout_interval / number_tries + number_tries;
-
-  /* get the command to run */
-  xasprintf (&command_line, "%s %s %s -p %d @%s %s %s +retry=%d +time=%d",
-            PATH_TO_DIG, dig_args, query_transport, server_port, dns_server, query_address, record_type, number_tries, timeout_interval_dig);
-
-  alarm (timeout_interval);
-  gettimeofday (&tv, NULL);
-
-  if (verbose) {
-    printf ("%s\n", command_line);
-    if(expected_address != NULL) {
-      printf (_("Looking for: '%s'\n"), expected_address);
-    } else {
-      printf (_("Looking for: '%s'\n"), query_address);
-    }
-  }
-
-  /* run the command */
-  if(np_runcmd(command_line, &chld_out, &chld_err, 0) != 0) {
-    result = STATE_WARNING;
-    msg = (char *)_("dig returned an error status");
-  }
-
-  for(i = 0; i < chld_out.lines; i++) {
-    /* the server is responding, we just got the host name... */
-    if (strstr (chld_out.line[i], ";; ANSWER SECTION:")) {
-
-      /* loop through the whole 'ANSWER SECTION' */
-      for(; i < chld_out.lines; i++) {
-        /* get the host address */
-        if (verbose)
-          printf ("%s\n", chld_out.line[i]);
-
-        if (strcasestr (chld_out.line[i], (expected_address == NULL ? query_address : expected_address)) != NULL) {
-          msg = chld_out.line[i];
-          result = STATE_OK;
-
-          /* Translate output TAB -> SPACE */
-          t = msg;
-          while ((t = strchr(t, '\t')) != NULL) *t = ' ';
-          break;
-        }
-      }
-
-      if (result == STATE_UNKNOWN) {
-        msg = (char *)_("Server not found in ANSWER SECTION");
-        result = STATE_WARNING;
-      }
-
-      /* we found the answer section, so break out of the loop */
-      break;
-    }
-  }
-
-  if (result == STATE_UNKNOWN) {
-    msg = (char *)_("No ANSWER SECTION found");
-    result = STATE_CRITICAL;
-  }
-
-  /* If we get anything on STDERR, at least set warning */
-  if(chld_err.buflen > 0) {
-    result = max_state(result, STATE_WARNING);
-    if(!msg) for(i = 0; i < chld_err.lines; i++) {
-      msg = strchr(chld_err.line[0], ':');
-      if(msg) {
-        msg++;
-        break;
-      }
-    }
-  }
-
-  microsec = deltime (tv);
-  elapsed_time = (double)microsec / 1.0e6;
-
-  if (critical_interval > UNDEFINED && elapsed_time > critical_interval)
-    result = STATE_CRITICAL;
-
-  else if (warning_interval > UNDEFINED && elapsed_time > warning_interval)
-    result = STATE_WARNING;
-
-  printf ("DNS %s - %.3f seconds response time (%s)|%s\n",
-          state_text (result), elapsed_time,
-          msg ? msg : _("Probably a non-existent host/domain"),
-          fperfdata("time", elapsed_time, "s",
-                    (warning_interval>UNDEFINED ? true:false),
-                    warning_interval,
-                    (critical_interval>UNDEFINED ? true:false),
-            critical_interval,
-            true, 0, false, 0));
-  return result;
+#include "check_dig.d/config.h"
+#include "states.h"
+
+typedef struct {
+        int errorcode;
+        check_dig_config config;
+} check_dig_config_wrapper;
+static check_dig_config_wrapper process_arguments(int /*argc*/, char ** /*argv*/);
+static check_dig_config_wrapper validate_arguments(check_dig_config_wrapper /*config_wrapper*/);
+
+static void print_help(void);
+void print_usage(void);
+
+static int verbose = 0;
+
+/* helpers for flag parsing */
+static flag_list parse_flags_line(const char *line);
+static flag_list split_csv_trim(const char *csv);
+static bool flag_list_contains(const flag_list *list, const char *needle);
+static void free_flag_list(flag_list *list);
+
+int main(int argc, char **argv) {
+        setlocale(LC_ALL, "");
+        bindtextdomain(PACKAGE, LOCALEDIR);
+        textdomain(PACKAGE);
+
+        /* Set signal handling and alarm */
+        if (signal(SIGALRM, runcmd_timeout_alarm_handler) == SIG_ERR) {
+                usage_va(_("Cannot catch SIGALRM"));
+        }
+
+        /* Parse extra opts if any */
+        argv = np_extra_opts(&argc, argv, progname);
+
+        check_dig_config_wrapper tmp_config = process_arguments(argc, argv);
+        if (tmp_config.errorcode == ERROR) {
+                usage_va(_("Could not parse arguments"));
+        }
+
+        const check_dig_config config = tmp_config.config;
+
+        /* dig applies the timeout to each try, so we need to work around this */
+        int timeout_interval_dig = ((int)timeout_interval / config.number_tries) + config.number_tries;
+
+        char *command_line;
+        /* get the command to run */
+        xasprintf(&command_line, "%s %s %s -p %d @%s %s %s +retry=%d +time=%d", PATH_TO_DIG,
+                          config.dig_args, config.query_transport, config.server_port, config.dns_server,
+                          config.query_address, config.record_type, config.number_tries, timeout_interval_dig);
+
+        alarm(timeout_interval);
+        struct timeval start_time;
+        gettimeofday(&start_time, NULL);
+
+        if (verbose) {
+                printf("%s\n", command_line);
+                if (config.expected_address != NULL) {
+                        printf(_("Looking for: '%s'\n"), config.expected_address);
+                } else {
+                        printf(_("Looking for: '%s'\n"), config.query_address);
+                }
+        }
+
+        output chld_out;
+        output chld_err;
+        char *msg = NULL;
+        flag_list dig_flags = {.items = NULL, .count = 0};
+        mp_state_enum result = STATE_UNKNOWN;
+
+        /* run the command */
+        if (np_runcmd(command_line, &chld_out, &chld_err, 0) != 0) {
+                result = STATE_WARNING;
+                msg = (char *)_("dig returned an error status");
+        }
+
+        /* extract ';; flags: ...' from stdout (first occurrence) */
+        for (size_t i = 0; i < chld_out.lines; i++) {
+                if (strstr(chld_out.line[i], "flags:")) {
+                        if (verbose) {
+                                printf("Raw flags line: %s\n", chld_out.line[i]);
+                        }
+
+                        dig_flags = parse_flags_line(chld_out.line[i]);
+
+                        if (verbose && dig_flags.count > 0) {
+                                printf(_("Parsed flags:"));
+                                for (size_t k = 0; k < dig_flags.count; k++) {
+                                        printf(" %s", dig_flags.items[k]);
+                                }
+                                printf("\n");
+                        }
+                        break;
+                }
+        }
+
+        for (size_t i = 0; i < chld_out.lines; i++) {
+                /* the server is responding, we just got the host name... */
+                if (strstr(chld_out.line[i], ";; ANSWER SECTION:")) {
+
+                        /* loop through the whole 'ANSWER SECTION' */
+                        for (; i < chld_out.lines; i++) {
+                                /* get the host address */
+                                if (verbose) {
+                                        printf("%s\n", chld_out.line[i]);
+                                }
+
+                                if (strcasestr(chld_out.line[i], (config.expected_address == NULL
+                                                                                                          ? config.query_address
+                                                                                                          : config.expected_address)) != NULL) {
+                                        msg = chld_out.line[i];
+                                        result = STATE_OK;
+
+                                        /* Translate output TAB -> SPACE */
+                                        char *temp = msg;
+                                        while ((temp = strchr(temp, '\t')) != NULL) {
+                                                *temp = ' ';
+                                        }
+                                        break;
+                                }
+                        }
+
+                        if (result == STATE_UNKNOWN) {
+                                msg = (char *)_("Server not found in ANSWER SECTION");
+                                result = STATE_WARNING;
+                        }
+
+                        /* we found the answer section, so break out of the loop */
+                        break;
+                }
+        }
+
+        if (result == STATE_UNKNOWN) {
+                msg = (char *)_("No ANSWER SECTION found");
+                result = STATE_CRITICAL;
+        }
+
+        /* If we get anything on STDERR, at least set warning */
+        if (chld_err.buflen > 0) {
+                result = max_state(result, STATE_WARNING);
+                if (!msg) {
+                        for (size_t i = 0; i < chld_err.lines; i++) {
+                                msg = strchr(chld_err.line[0], ':');
+                                if (msg) {
+                                        msg++;
+                                        break;
+                                }
+                        }
+                }
+        }
+
+        long microsec = deltime(start_time);
+        double elapsed_time = (double)microsec / 1.0e6;
+
+        if (config.critical_interval > UNDEFINED && elapsed_time > config.critical_interval) {
+                result = STATE_CRITICAL;
+        }
+
+        else if (config.warning_interval > UNDEFINED && elapsed_time > config.warning_interval) {
+                result = STATE_WARNING;
+        }
+
+        /* Optional: evaluate dig flags only if -E/-X were provided */
+        if ((config.require_flags.count > 0) || (config.forbid_flags.count > 0)) {
+                if (dig_flags.count > 0) {
+                        for (size_t r = 0; r < config.require_flags.count; r++) {
+                                if (!flag_list_contains(&dig_flags, config.require_flags.items[r])) {
+                                        result = STATE_CRITICAL;
+                                        if (!msg) {
+                                                xasprintf(&msg, _("Missing required DNS flag: %s"),
+                                                                  config.require_flags.items[r]);
+                                        } else {
+                                                char *newmsg = NULL;
+                                                xasprintf(&newmsg, _("%s; missing required DNS flag: %s"), msg,
+                                                                  config.require_flags.items[r]);
+                                                msg = newmsg;
+                                        }
+                                }
+                        }
+
+                        for (size_t r = 0; r < config.forbid_flags.count; r++) {
+                                if (flag_list_contains(&dig_flags, config.forbid_flags.items[r])) {
+                                        result = STATE_CRITICAL;
+                                        if (!msg) {
+                                                xasprintf(&msg, _("Forbidden DNS flag present: %s"),
+                                                                  config.forbid_flags.items[r]);
+                                        } else {
+                                                char *newmsg = NULL;
+                                                xasprintf(&newmsg, _("%s; forbidden DNS flag present: %s"), msg,
+                                                                  config.forbid_flags.items[r]);
+                                                msg = newmsg;
+                                        }
+                                }
+                        }
+                }
+        }
+
+        /* cleanup flags buffer */
+        free_flag_list(&dig_flags);
+
+        printf("DNS %s - %.3f seconds response time (%s)|%s\n", state_text(result), elapsed_time,
+                   msg ? msg : _("Probably a non-existent host/domain"),
+                   fperfdata("time", elapsed_time, "s", (config.warning_interval > UNDEFINED),
+                                         config.warning_interval, (config.critical_interval > UNDEFINED),
+                                         config.critical_interval, true, 0, false, 0));
+        exit(result);
 }
 
-
-
 /* process command-line arguments */
-int
-process_arguments (int argc, char **argv)
-{
-  int c;
-
-  int option = 0;
-  static struct option longopts[] = {
-    {"hostname", required_argument, 0, 'H'},
-    {"query_address", required_argument, 0, 'l'},
-    {"warning", required_argument, 0, 'w'},
-    {"critical", required_argument, 0, 'c'},
-    {"timeout", required_argument, 0, 't'},
-    {"dig-arguments", required_argument, 0, 'A'},
-    {"verbose", no_argument, 0, 'v'},
-    {"version", no_argument, 0, 'V'},
-    {"help", no_argument, 0, 'h'},
-    {"record_type", required_argument, 0, 'T'},
-    {"expected_address", required_argument, 0, 'a'},
-    {"port", required_argument, 0, 'p'},
-    {"use-ipv4", no_argument, 0, '4'},
-    {"use-ipv6", no_argument, 0, '6'},
-    {0, 0, 0, 0}
-  };
-
-  if (argc < 2)
-    return ERROR;
-
-  while (1) {
-    c = getopt_long (argc, argv, "hVvt:l:H:w:c:T:p:a:A:46", longopts, &option);
-
-    if (c == -1 || c == EOF)
-      break;
-
-    switch (c) {
-    case 'h':                 /* help */
-      print_help ();
-      exit (STATE_UNKNOWN);
-    case 'V':                 /* version */
-      print_revision (progname, NP_VERSION);
-      exit (STATE_UNKNOWN);
-    case 'H':                 /* hostname */
-      host_or_die(optarg);
-      dns_server = optarg;
-      break;
-    case 'p':                 /* server port */
-      if (is_intpos (optarg)) {
-        server_port = atoi (optarg);
-      }
-      else {
-        usage_va(_("Port must be a positive integer - %s"), optarg);
-      }
-      break;
-    case 'l':                 /* address to lookup */
-      query_address = optarg;
-      break;
-    case 'w':                 /* warning */
-      if (is_nonnegative (optarg)) {
-        warning_interval = strtod (optarg, NULL);
-      }
-      else {
-        usage_va(_("Warning interval must be a positive integer - %s"), optarg);
-      }
-      break;
-    case 'c':                 /* critical */
-      if (is_nonnegative (optarg)) {
-        critical_interval = strtod (optarg, NULL);
-      }
-      else {
-        usage_va(_("Critical interval must be a positive integer - %s"), optarg);
-      }
-      break;
-    case 't':                 /* timeout */
-      if (is_intnonneg (optarg)) {
-        timeout_interval = atoi (optarg);
-      }
-      else {
-        usage_va(_("Timeout interval must be a positive integer - %s"), optarg);
-      }
-      break;
-    case 'A':                 /* dig arguments */
-      dig_args = strdup(optarg);
-      break;
-    case 'v':                 /* verbose */
-      verbose = true;
-      break;
-    case 'T':
-      record_type = optarg;
-      break;
-    case 'a':
-      expected_address = optarg;
-      break;
-    case '4':
-      query_transport = "-4";
-      break;
-    case '6':
-      query_transport = "-6";
-      break;
-    default:                  /* usage5 */
-      usage5();
-    }
-  }
-
-  c = optind;
-  if (dns_server == NULL) {
-    if (c < argc) {
-      host_or_die(argv[c]);
-      dns_server = argv[c];
-    }
-    else {
-      if (strcmp(query_transport,"-6") == 0)
-        dns_server = strdup("::1");
-      else
-        dns_server = strdup ("127.0.0.1");
-    }
-  }
-
-  return validate_arguments ();
+check_dig_config_wrapper process_arguments(int argc, char **argv) {
+        static struct option longopts[] = {{"hostname", required_argument, 0, 'H'},
+                                                                           {"query_address", required_argument, 0, 'l'},
+                                                                           {"warning", required_argument, 0, 'w'},
+                                                                           {"critical", required_argument, 0, 'c'},
+                                                                           {"timeout", required_argument, 0, 't'},
+                                                                           {"dig-arguments", required_argument, 0, 'A'},
+                                                                           {"require-flags", required_argument, 0, 'E'},
+                                                                           {"forbid-flags", required_argument, 0, 'X'},
+                                                                           {"verbose", no_argument, 0, 'v'},
+                                                                           {"version", no_argument, 0, 'V'},
+                                                                           {"help", no_argument, 0, 'h'},
+                                                                           {"record_type", required_argument, 0, 'T'},
+                                                                           {"expected_address", required_argument, 0, 'a'},
+                                                                           {"port", required_argument, 0, 'p'},
+                                                                           {"use-ipv4", no_argument, 0, '4'},
+                                                                           {"use-ipv6", no_argument, 0, '6'},
+                                                                           {0, 0, 0, 0}};
+
+        check_dig_config_wrapper result = {
+                .errorcode = OK,
+                .config = check_dig_config_init(),
+        };
+
+        if (argc < 2) {
+                result.errorcode = ERROR;
+                return result;
+        }
+
+        int option = 0;
+        while (true) {
+                int option_index =
+                        getopt_long(argc, argv, "hVvt:l:H:w:c:T:p:a:A:E:X:46", longopts, &option);
+
+                if (option_index == -1 || option_index == EOF) {
+                        break;
+                }
+
+                switch (option_index) {
+                case 'h': /* help */
+                        print_help();
+                        exit(STATE_UNKNOWN);
+                case 'V': /* version */
+                        print_revision(progname, NP_VERSION);
+                        exit(STATE_UNKNOWN);
+                case 'H': /* hostname */
+                        host_or_die(optarg);
+                        result.config.dns_server = optarg;
+                        break;
+                case 'p': /* server port */
+                        if (is_intpos(optarg)) {
+                                result.config.server_port = atoi(optarg);
+                        } else {
+                                usage_va(_("Port must be a positive integer - %s"), optarg);
+                        }
+                        break;
+                case 'l': /* address to lookup */
+                        result.config.query_address = optarg;
+                        break;
+                case 'w': /* warning */
+                        if (is_nonnegative(optarg)) {
+                                result.config.warning_interval = strtod(optarg, NULL);
+                        } else {
+                                usage_va(_("Warning interval must be a positive integer - %s"), optarg);
+                        }
+                        break;
+                case 'c': /* critical */
+                        if (is_nonnegative(optarg)) {
+                                result.config.critical_interval = strtod(optarg, NULL);
+                        } else {
+                                usage_va(_("Critical interval must be a positive integer - %s"), optarg);
+                        }
+                        break;
+                case 't': /* timeout */
+                        if (is_intnonneg(optarg)) {
+                                timeout_interval = atoi(optarg);
+                        } else {
+                                usage_va(_("Timeout interval must be a positive integer - %s"), optarg);
+                        }
+                        break;
+                case 'A': /* dig arguments */
+                        result.config.dig_args = strdup(optarg);
+                        break;
+                case 'E': /* require flags */
+                        result.config.require_flags = split_csv_trim(optarg);
+                        break;
+                case 'X': /* forbid flags */
+                        result.config.forbid_flags = split_csv_trim(optarg);
+                        break;
+                case 'v': /* verbose */
+                        verbose++;
+                        break;
+                case 'T':
+                        result.config.record_type = optarg;
+                        break;
+                case 'a':
+                        result.config.expected_address = optarg;
+                        break;
+                case '4':
+                        result.config.query_transport = "-4";
+                        break;
+                case '6':
+                        result.config.query_transport = "-6";
+                        break;
+                default: /* usage5 */
+                        usage5();
+                }
+        }
+
+        int index = optind;
+        if (result.config.dns_server == NULL) {
+                if (index < argc) {
+                        host_or_die(argv[index]);
+                        result.config.dns_server = argv[index];
+                } else {
+                        if (strcmp(result.config.query_transport, "-6") == 0) {
+                                result.config.dns_server = strdup("::1");
+                        } else {
+                                result.config.dns_server = strdup("127.0.0.1");
+                        }
+                }
+        }
+
+        return validate_arguments(result);
 }
 
-
-
-int
-validate_arguments (void)
-{
-  if (query_address != NULL)
-    return OK;
-  else
-    return ERROR;
+check_dig_config_wrapper validate_arguments(check_dig_config_wrapper config_wrapper) {
+        if (config_wrapper.config.query_address == NULL) {
+                config_wrapper.errorcode = ERROR;
+        }
+        return config_wrapper;
 }
 
+void print_help(void) {
+        char *myport;
 
+        xasprintf(&myport, "%d", DEFAULT_PORT);
 
-void
-print_help (void)
-{
-  char *myport;
+        print_revision(progname, NP_VERSION);
 
-  xasprintf (&myport, "%d", DEFAULT_PORT);
+        printf("Copyright (c) 2000 Karl DeBisschop <kdebisschop@users.sourceforge.net>\n");
+        printf(COPYRIGHT, copyright, email);
 
-  print_revision (progname, NP_VERSION);
+        printf(_("This plugin tests the DNS service on the specified host using dig"));
 
-  printf ("Copyright (c) 2000 Karl DeBisschop <kdebisschop@users.sourceforge.net>\n");
-  printf (COPYRIGHT, copyright, email);
+        printf("\n\n");
 
-  printf (_("This plugin tests the DNS service on the specified host using dig"));
+        print_usage();
 
-  printf ("\n\n");
+        printf(UT_HELP_VRSN);
 
-  print_usage ();
+        printf(UT_EXTRA_OPTS);
 
-  printf (UT_HELP_VRSN);
+        printf(UT_HOST_PORT, 'p', myport);
 
-  printf (UT_EXTRA_OPTS);
+        printf(" %s\n", "-4, --use-ipv4");
+        printf("    %s\n", _("Force dig to only use IPv4 query transport"));
+        printf(" %s\n", "-6, --use-ipv6");
+        printf("    %s\n", _("Force dig to only use IPv6 query transport"));
+        printf(" %s\n", "-l, --query_address=STRING");
+        printf("    %s\n", _("Machine name to lookup"));
+        printf(" %s\n", "-T, --record_type=STRING");
+        printf("    %s\n", _("Record type to lookup (default: A)"));
+        printf(" %s\n", "-a, --expected_address=STRING");
+        printf("    %s\n",
+                   _("An address expected to be in the answer section. If not set, uses whatever"));
+        printf("    %s\n", _("was in -l"));
+        printf(" %s\n", "-A, --dig-arguments=STRING");
+        printf("    %s\n", _("Pass STRING as argument(s) to dig"));
+        printf(" %s\n", "-E, --require-flags=LIST");
+        printf("    %s\n", _("Comma-separated dig flags that must be present (e.g. 'aa,qr')"));
+        printf(" %s\n", "-X, --forbid-flags=LIST");
+        printf("    %s\n", _("Comma-separated dig flags that must NOT be present"));
+        printf(UT_WARN_CRIT);
+        printf(UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
+        printf(UT_VERBOSE);
 
-  printf (UT_HOST_PORT, 'p', myport);
+        printf("\n");
+        printf("%s\n", _("Examples:"));
+        printf(" %s\n", "check_dig -H DNSSERVER -l www.example.com -A \"+tcp\"");
+        printf(" %s\n", "This will send a tcp query to DNSSERVER for www.example.com");
 
-  printf (" %s\n","-4, --use-ipv4");
-  printf ("    %s\n",_("Force dig to only use IPv4 query transport"));
-  printf (" %s\n","-6, --use-ipv6");
-  printf ("    %s\n",_("Force dig to only use IPv6 query transport"));
-  printf (" %s\n","-l, --query_address=STRING");
-  printf ("    %s\n",_("Machine name to lookup"));
-  printf (" %s\n","-T, --record_type=STRING");
-  printf ("    %s\n",_("Record type to lookup (default: A)"));
-  printf (" %s\n","-a, --expected_address=STRING");
-  printf ("    %s\n",_("An address expected to be in the answer section. If not set, uses whatever"));
-  printf ("    %s\n",_("was in -l"));
-  printf (" %s\n","-A, --dig-arguments=STRING");
-  printf ("    %s\n",_("Pass STRING as argument(s) to dig"));
-  printf (UT_WARN_CRIT);
-  printf (UT_CONN_TIMEOUT, DEFAULT_SOCKET_TIMEOUT);
-  printf (UT_VERBOSE);
+        printf(UT_SUPPORT);
+}
 
-  printf ("\n");
-  printf ("%s\n", _("Examples:"));
-  printf (" %s\n", "check_dig -H DNSSERVER -l www.example.com -A \"+tcp\"");
-  printf (" %s\n", "This will send a tcp query to DNSSERVER for www.example.com");
+void print_usage(void) {
+        printf("%s\n", _("Usage:"));
+        printf("%s -l <query_address> [-H <host>] [-p <server port>]\n", progname);
+        printf(" [-T <query type>] [-w <warning interval>] [-c <critical interval>]\n");
+        printf(" [-t <timeout>] [-a <expected answer address>] [-E <flags>] [-X <flags>] [-v]\n");
+}
 
-  printf (UT_SUPPORT);
+/* helpers */
+
+/**
+ * parse_flags_line - Parse a dig output line and extract DNS header flags.
+ *
+ * Input:
+ *   line - NUL terminated dig output line, e.g. ";; flags: qr rd ra; ..."
+ *
+ * Returns:
+ *   flag_list where:
+ *     - items: array of NUL terminated flag strings (heap allocated)
+ *     - count: number of entries in items
+ *   On parse failure or if no flags were found, count is 0 and items is NULL.
+ */
+static flag_list parse_flags_line(const char *line) {
+        flag_list result = {.items = NULL, .count = 0};
+
+        if (!line) {
+                return result;
+        }
+
+        /* Locate start of DNS header flags in dig output */
+        const char *p = strstr(line, "flags:");
+        if (!p) {
+                return result;
+        }
+        p += 6; /* skip literal "flags:" */
+
+        /* Skip whitespace after "flags:" */
+        while (*p && isspace((unsigned char)*p)) {
+                p++;
+        }
+
+        /* Flags are terminated by the next semicolon e.g. "qr rd ra;" */
+        const char *q = strchr(p, ';');
+        if (!q) {
+                return result;
+        }
+
+        /* Extract substring containing the flag block */
+        size_t len = (size_t)(q - p);
+        if (len == 0) {
+                return result;
+        }
+
+        char *buf = (char *)malloc(len + 1);
+        if (!buf) {
+                return result;
+        }
+        memcpy(buf, p, len);
+        buf[len] = '\0';
+
+        /* Tokenize flags separated by whitespace */
+        char **arr = NULL;
+        size_t cnt = 0;
+        char *saveptr = NULL;
+        char *tok = strtok_r(buf, " \t", &saveptr);
+
+        while (tok) {
+                /* Expand array for the next flag token */
+                char **tmp = (char **)realloc(arr, (cnt + 1) * sizeof(char *));
+                if (!tmp) {
+                        /* On allocation failure keep what we have and return it */
+                        break;
+                }
+                arr = tmp;
+                arr[cnt++] = strdup(tok);
+                tok = strtok_r(NULL, " \t", &saveptr);
+        }
+
+        free(buf);
+
+        result.items = arr;
+        result.count = cnt;
+        return result;
 }
 
+/**
+ * split_csv_trim - Split a comma separated string into trimmed tokens.
+ *
+ * Input:
+ *   csv - NUL terminated string, e.g. "aa, qr , rd"
+ *
+ * Returns:
+ *   flag_list where:
+ *     - items: array of NUL terminated tokens (heap allocated, whitespace trimmed)
+ *     - count: number of tokens
+ *   On empty input, count is 0 and items is NULL
+ */
+static flag_list split_csv_trim(const char *csv) {
+        flag_list result = {.items = NULL, .count = 0};
+
+        if (!csv || !*csv) {
+                return result;
+        }
+
+        char *tmp = strdup(csv);
+        if (!tmp) {
+                return result;
+        }
+
+        char *s = tmp;
+        char *token = NULL;
+
+        /* Split CSV by commas, trimming whitespace on each token */
+        while ((token = strsep(&s, ",")) != NULL) {
+                /* trim leading whitespace */
+                while (*token && isspace((unsigned char)*token)) {
+                        token++;
+                }
+
+                /* trim trailing whitespace */
+                char *end = token + strlen(token);
+                while (end > token && isspace((unsigned char)end[-1])) {
+                        *--end = '\0';
+                }
+
+                if (*token) {
+                        /* Expand the items array and append the token */
+                        char **arr = (char **)realloc(result.items, (result.count + 1) * sizeof(char *));
+                        if (!arr) {
+                                /* Allocation failed, stop and return what we have */
+                                break;
+                        }
+                        result.items = arr;
+                        result.items[result.count++] = strdup(token);
+                }
+        }
+
+        free(tmp);
+        return result;
+}
 
+/**
+ * flag_list_contains - Case-insensitive membership test in a flag_list.
+ *
+ * Input:
+ *   list   - pointer to a flag_list
+ *   needle - NUL terminated string to search for
+ *
+ * Returns:
+ *   true  if needle is contained in list (strcasecmp)
+ *   false otherwise
+ */
+static bool flag_list_contains(const flag_list *list, const char *needle) {
+        if (!list || !needle || !*needle) {
+                return false;
+        }
+
+        for (size_t i = 0; i < list->count; i++) {
+                if (strcasecmp(list->items[i], needle) == 0) {
+                        return true;
+                }
+        }
+        return false;
+}
 
-void
-print_usage (void)
-{
-  printf ("%s\n", _("Usage:"));
-  printf ("%s -l <query_address> [-H <host>] [-p <server port>]\n", progname);
-  printf (" [-T <query type>] [-w <warning interval>] [-c <critical interval>]\n");
-  printf (" [-t <timeout>] [-a <expected answer address>] [-v]\n");
+/**
+ * free_flag_list - Release all heap allocations held by a flag_list.
+ *
+ * Input:
+ *   list - pointer to a flag_list whose items were allocated by
+ *          parse_flags_line() or split_csv_trim().
+ *
+ * After this call list->items is NULL and list->count is 0.
+ */
+static void free_flag_list(flag_list *list) {
+        if (!list || !list->items) {
+                return;
+        }
+
+        for (size_t i = 0; i < list->count; i++) {
+                free(list->items[i]);
+        }
+        free(list->items);
+
+        list->items = NULL;
+        list->count = 0;
 }