ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Allow named-checkzone to check ZONEMD records

Browse Source
This commit is contained in:
Mark Andrews
2025-03-10 13:45:06 +11:00
parent 68778b9059
commit 4feed108a9
5 changed files with 50 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/check/check-tool.c
+5 -1
View File
@@ -91,6 +91,7 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
#endif /* if CHECK_SIBLING */
DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;
dns_zonemdopt_t zonemd_options;
static isc_symtab_t *symtab = NULL;
static isc_mem_t *sym_mctx;
@@ -624,7 +625,9 @@ setup_logging(FILE *errout) {
logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);
if (debug > 1) {
isc_log_setdebuglevel(debug - 1);
}
return ISC_R_SUCCESS;
}
@@ -676,6 +679,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
dns_zone_setclass(zone, rdclass);
dns_zone_setoption(zone, zone_options, true);
dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);
dns_zone_setzonemd(zone, zonemd_options, true);
dns_zone_setmaxttl(zone, maxttl);
bin/check/check-tool.h
+2
View File
@@ -24,6 +24,7 @@
#include <dns/masterdump.h>
#include <dns/types.h>
#include <dns/zone.h>
#include <dns/zonemd.h>
isc_result_t
setup_logging(FILE *errout);
@@ -45,3 +46,4 @@ extern bool docheckmx;
extern bool docheckns;
extern bool dochecksrv;
extern dns_zoneopt_t zone_options;
extern dns_zonemdopt_t zonemd_options;
bin/check/named-checkzone.c
+17 -3
View File
@@ -69,7 +69,7 @@ usage(void);
static void
usage(void) {
fprintf(stderr,
"usage: %s [-djqvD] [-c class] "
"usage: %s [-djqvDz] [-c class] "
"[-f inputformat] [-F outputformat] [-J filename] "
"[-s (full|relative)] [-t directory] [-w directory] "
"[-k (ignore|warn|fail)] [-m (ignore|warn|fail)] "
@@ -160,8 +160,8 @@ main(int argc, char **argv) {
isc_commandline_errprint = false;
while ((c = isc_commandline_parse(argc, argv,
"c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
"DF:M:R:S:T:W:")) != EOF)
"c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:z:"
"C:DF:M:R:S:T:W:")) != EOF)
{
switch (c) {
case 'c':
@@ -437,6 +437,20 @@ main(int argc, char **argv) {
zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
}
break;
case 'z':
if (ARGCMP("check")) {
zonemd_options |= DNS_ZONEMDOPT_CHECK;
}
if (ARGCMP("dnssec-only")) {
zonemd_options |= DNS_ZONEMDOPT_DNSSECONLY;
}
if (ARGCMP("accept-expired")) {
zonemd_options |= DNS_ZONEMDOPT_ACCEPTEXPIRED;
}
if (ARGCMP("required")) {
zonemd_options |= DNS_ZONEMDOPT_REQUIRED;
}
break;
case '?':
if (isc_commandline_option != '?') {
bin/check/named-checkzone.rst
+13 -1
View File
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
Synopsis
~~~~~~~~
:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] [**-z** mode] {zonename} {filename}
Description
~~~~~~~~~~~
@@ -220,6 +220,18 @@ Options
wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
(the default) and ``ignore``.
.. option:: -z option
This option specifies whether to check the contents of a zone against
the cryptographic hash in a ZONEMD record (:rfc:`8976`). This is
off by default. Up to four options can be active simultaneously;
these options are: ``check`` (check the contents of the zone against
the ZONEMD hash if a ZONEMD record is present), ``required`` (reject
a zone if ZONEMD is *not* present), ``dnssec-only`` (reject a zone if
ZONEMD is present but the zone is not DNSSEC-signed), and
``accept-expired`` (allow expired RRSIG records when verifying the
ZONEMD hash).
.. option:: zonename
This indicates the domain name of the zone being checked.
bin/check/named-compilezone.rst
+13 -1
View File
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
Synopsis
~~~~~~~~
:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] [**-z** mode] {**-o** filename} {zonename} {filename}
Description
~~~~~~~~~~~
@@ -224,6 +224,18 @@ Options
wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
and ``ignore`` (the default).
.. option:: -z option
This option specifies whether to check the contents of a zone against
the cryptographic hash in a ZONEMD record (:rfc:`8976`). This is
off by default. Up to four options can be active simultaneously;
these options are: ``check`` (check the contents of the zone against
the ZONEMD hash if a ZONEMD record is present), ``required`` (reject
a zone if ZONEMD is *not* present), ``dnssec-only`` (reject a zone if
ZONEMD is present but the zone is not DNSSEC-signed), and
``accept-expired`` (allow expired RRSIG records when verifying the
ZONEMD hash).
.. option:: zonename
This indicates the domain name of the zone being checked.