- zonemd-check: yesno option, default no, enables the processing

of ZONEMD records for that zone.

doc/Changelog

@@ -1,6 +1,8 @@
 27 May 2021: Wouter
 	- Merge #496 from banburybill: Use build system endianness if
 	  available, otherwise try to work it out.
+	- zonemd-check: yesno option, default no, enables the processing
+	  of ZONEMD records for that zone.
 
 25 May 2021: Wouter
 	- Move the NSEC3 max iterations count in line with the 150 value

doc/example.conf.in

@@ -1033,6 +1033,7 @@ remote-control:
 #	name: "example.org"
 #	for-downstream: yes
 #	for-upstream: yes
+#	zonemd-check: no
 #	zonemd-reject-absence: no
 #	zonefile: "example.org.zone"
 

doc/unbound.conf.5.in

@@ -1980,6 +1980,12 @@ to the authority servers for this zone, it'll fetch the data directly from
 the zone data.  Turn it on when you want unbound to provide recursion for
 downstream clients, and use the zone data as a local copy to speed up lookups.
 .TP
+.B zonemd\-check: \fI<yes or no>
+Enable this option to check ZONEMD records in the zone. Default is disabled.
+The ZONEMD record is a checksum over the zone data. This includes glue in
+the zone and data from the zone file, and excludes comments from the zone file.
+When there is a DNSSEC chain of trust, DNSSEC signatures are checked too.
+.TP
 .B zonemd\-reject\-absence: \fI<yes or no>
 Enable this option to reject the absence of the ZONEMD record.  Without it,
 when zonemd is not there it is not checked.  It is useful to enable for a

services/authzone.c

@@ -1755,6 +1755,8 @@ zonemd_offline_verify(struct auth_zone* z, struct module_env* env_for_val,
 {
 	struct module_env env;
 	time_t now = 0;
+	if(!z->zonemd_check)
+		return;
 	env = *env_for_val;
 	env.scratch_buffer = sldns_buffer_new(env.cfg->msg_buffer_size);
 	if(!env.scratch_buffer) {
@@ -2096,6 +2098,7 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 	z->for_downstream = c->for_downstream;
 	z->for_upstream = c->for_upstream;
 	z->fallback_enabled = c->fallback_enabled;
+	z->zonemd_check = c->zonemd_check;
 	z->zonemd_reject_absence = c->zonemd_reject_absence;
 	if(c->isrpz && !z->rpz){
 		if(!(z->rpz = rpz_create(c))){
@@ -8234,6 +8237,8 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
 	int is_insecure = 0;
 	/* verify the ZONEMD if present.
 	 * If not present check if absence is allowed by DNSSEC */
+	if(!z->zonemd_check)
+		return;
 
 	/* if zone is under a trustanchor */
 	/* is it equal to trustanchor - get dnskey's verified */
@@ -8302,6 +8307,10 @@ void auth_zones_pickup_zonemd_verify(struct auth_zones* az,
 	lock_rw_rdlock(&az->lock);
 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
 		lock_rw_wrlock(&z->lock);
+		if(!z->zonemd_check) {
+			lock_rw_unlock(&z->lock);
+			continue;
+		}
 		key.dclass = z->dclass;
 		key.namelabs = z->namelabs;
 		if(z->namelen > sizeof(savezname)) {

services/authzone.h

@@ -132,6 +132,8 @@ struct auth_zone {
 	/** for upstream: this zone answers queries that unbound intends to
 	 * send upstream. */
 	int for_upstream;
+	/** check ZONEMD records */
+	int zonemd_check;
 	/** reject absence of ZONEMD records */
 	int zonemd_reject_absence;
 	/** RPZ zones */

testcode/unitzonemd.c

@@ -82,6 +82,7 @@ static void zonemd_generate_test(const char* zname, char* zfile,
 	/* read file */
 	z = authtest_addzone(az, zname, zfile);
 	unit_assert(z);
+	z->zonemd_check = 1;
 
 	/* create zonemd digest */
 	result = auth_zone_generate_zonemd_hash(z, scheme, hashalgo,
@@ -196,6 +197,7 @@ static void zonemd_check_test(void)
 	/* read file */
 	z = authtest_addzone(az, zname, zfile);
 	unit_assert(z);
+	z->zonemd_check = 1;
 	hashlen = sizeof(hash);
 	if(sldns_str2wire_hex_buf(digest, hash, &hashlen) != 0) {
 		unit_assert(0); /* parse failure */
@@ -291,6 +293,7 @@ static void zonemd_verify_test(char* zname, char* zfile, char* tastr,
 
 	/* test */
 	lock_rw_wrlock(&z->lock);
+	z->zonemd_check = 1;
 	auth_zone_verify_zonemd(z, &env, &mods, &result, 1, 0);
 	lock_rw_unlock(&z->lock);
 	if(verbosity >= VERB_ALGO) {

testdata/auth_zonemd_anchor.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_anchor_fail.rpl

@@ -27,6 +27,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_chain.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_chain_fail.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_file.rpl

@@ -21,6 +21,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_file_fail.rpl

@@ -21,6 +21,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_insecure.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_insecure_absent.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_insecure_absent_reject.rpl

@@ -7,6 +7,7 @@ server:
 
 auth-zone:
 	name: "example.com."
+	zonemd-check: yes
 	zonemd-reject-absence: yes
 	## zonefile (or none).
 	## zonefile: "example.com.zone"

testdata/auth_zonemd_insecure_fail.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_nokey.rpl

@@ -24,6 +24,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_permissive_mode.rpl

@@ -22,6 +22,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_xfr.rpl

@@ -22,6 +22,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_xfr_anchor.rpl

@@ -25,6 +25,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_xfr_anchor_fail.rpl

@@ -25,6 +25,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_xfr_chain.rpl

@@ -25,6 +25,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_xfr_chain_fail.rpl

@@ -25,6 +25,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

testdata/auth_zonemd_xfr_fail.rpl

@@ -22,6 +22,7 @@ auth-zone:
 	## on failures with for-upstream, fallback to sending queries to
 	## the authority servers
 	## fallback-enabled: no
+	zonemd-check: yes
 
 	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
 	zonefile:

util/config_file.h

@@ -735,6 +735,8 @@ struct config_auth {
 	/** Always reply with this CNAME target if the cname override action is
 	 * used */
 	char* rpz_cname;
+	/** Check ZONEMD records for this zone */
+	int zonemd_check;
 	/** Reject absence of ZONEMD records, zone must have one */
 	int zonemd_reject_absence;
 };

util/configlexer.lex

@@ -405,6 +405,7 @@ neg-cache-size{COLON}		{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 val-nsec3-keysize-iterations{COLON}	{ 
 				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 zonemd-permissive-mode{COLON}	{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
+zonemd-check{COLON}		{ YDVAR(1, VAR_ZONEMD_CHECK) }
 zonemd-reject-absence{COLON}	{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) }
 add-holddown{COLON}		{ YDVAR(1, VAR_ADD_HOLDDOWN) }
 del-holddown{COLON}		{ YDVAR(1, VAR_DEL_HOLDDOWN) }

util/configparser.h

@@ -364,7 +364,8 @@ extern int yydebug;
     VAR_EDNS_CLIENT_STRING_OPCODE = 565, /* VAR_EDNS_CLIENT_STRING_OPCODE  */
     VAR_NSID = 566,                /* VAR_NSID  */
     VAR_ZONEMD_PERMISSIVE_MODE = 567, /* VAR_ZONEMD_PERMISSIVE_MODE  */
-    VAR_ZONEMD_REJECT_ABSENCE = 568 /* VAR_ZONEMD_REJECT_ABSENCE  */
+    VAR_ZONEMD_CHECK = 568,        /* VAR_ZONEMD_CHECK  */
+    VAR_ZONEMD_REJECT_ABSENCE = 569 /* VAR_ZONEMD_REJECT_ABSENCE  */
   };
   typedef enum yytokentype yytoken_kind_t;
 #endif
@@ -682,7 +683,8 @@ extern int yydebug;
 #define VAR_EDNS_CLIENT_STRING_OPCODE 565
 #define VAR_NSID 566
 #define VAR_ZONEMD_PERMISSIVE_MODE 567
-#define VAR_ZONEMD_REJECT_ABSENCE 568
+#define VAR_ZONEMD_CHECK 568
+#define VAR_ZONEMD_REJECT_ABSENCE 569
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -692,7 +694,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 696 "util/configparser.h"
+#line 698 "util/configparser.h"
 
 };
 typedef union YYSTYPE YYSTYPE;

util/configparser.y

@@ -182,7 +182,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME
 %token VAR_DYNLIB VAR_DYNLIB_FILE VAR_EDNS_CLIENT_STRING
 %token VAR_EDNS_CLIENT_STRING_OPCODE VAR_NSID
-%token VAR_ZONEMD_PERMISSIVE_MODE VAR_ZONEMD_REJECT_ABSENCE
+%token VAR_ZONEMD_PERMISSIVE_MODE VAR_ZONEMD_CHECK VAR_ZONEMD_REJECT_ABSENCE
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -370,6 +370,7 @@ authstart: VAR_AUTH_ZONE
 			s->for_downstream = 1;
 			s->for_upstream = 1;
 			s->fallback_enabled = 0;
+			s->zonemd_check = 0;
 			s->zonemd_reject_absence = 0;
 			s->isrpz = 0;
 		} else 
@@ -380,7 +381,7 @@ contents_auth: contents_auth content_auth
 	| ;
 content_auth: auth_name | auth_zonefile | auth_master | auth_url |
 	auth_for_downstream | auth_for_upstream | auth_fallback_enabled |
-	auth_allow_notify | auth_zonemd_reject_absence
+	auth_allow_notify | auth_zonemd_check | auth_zonemd_reject_absence
 	;
 
 rpz_tag: VAR_TAGS STRING_ARG
@@ -2788,6 +2789,16 @@ auth_allow_notify: VAR_ALLOW_NOTIFY STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+auth_zonemd_check: VAR_ZONEMD_CHECK STRING_ARG
+	{
+		OUTYY(("P(zonemd-check:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->auths->zonemd_check =
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 auth_zonemd_reject_absence: VAR_ZONEMD_REJECT_ABSENCE STRING_ARG
 	{
 		OUTYY(("P(zonemd-reject-absence:%s)\n", $2));