diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c index bd2733b69a..6df5262b13 100644 --- a/bin/check/check-tool.c +++ b/bin/check/check-tool.c @@ -91,6 +91,7 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX | #endif /* if CHECK_SIBLING */ DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD | DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME; +dns_zonemdopt_t zonemd_options; static isc_symtab_t *symtab = NULL; static isc_mem_t *sym_mctx; @@ -624,7 +625,9 @@ setup_logging(FILE *errout) { logconfig, "default_stderr", ISC_LOG_TOFILEDESC, ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0, ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT); - + if (debug > 1) { + isc_log_setdebuglevel(debug - 1); + } return ISC_R_SUCCESS; } @@ -676,6 +679,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename, dns_zone_setclass(zone, rdclass); dns_zone_setoption(zone, zone_options, true); dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge); + dns_zone_setzonemd(zone, zonemd_options, true); dns_zone_setmaxttl(zone, maxttl); diff --git a/bin/check/check-tool.h b/bin/check/check-tool.h index 7e8f946268..3efef7f74d 100644 --- a/bin/check/check-tool.h +++ b/bin/check/check-tool.h @@ -24,6 +24,7 @@ #include #include #include +#include isc_result_t setup_logging(FILE *errout); @@ -45,3 +46,4 @@ extern bool docheckmx; extern bool docheckns; extern bool dochecksrv; extern dns_zoneopt_t zone_options; +extern dns_zonemdopt_t zonemd_options; diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c index fb49f842d6..42f1090f4d 100644 --- a/bin/check/named-checkzone.c +++ b/bin/check/named-checkzone.c @@ -69,7 +69,7 @@ usage(void); static void usage(void) { fprintf(stderr, - "usage: %s [-djqvD] [-c class] " + "usage: %s [-djqvDz] [-c class] " "[-f inputformat] [-F outputformat] [-J filename] " "[-s (full|relative)] [-t directory] [-w directory] " "[-k (ignore|warn|fail)] [-m (ignore|warn|fail)] " @@ -160,8 +160,8 @@ main(int argc, char **argv) { isc_commandline_errprint = false; while ((c = isc_commandline_parse(argc, argv, - "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:" - "DF:M:R:S:T:W:")) != EOF) + "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:z:" + "C:DF:M:R:S:T:W:")) != EOF) { switch (c) { case 'c': @@ -437,6 +437,20 @@ main(int argc, char **argv) { zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD; } break; + case 'z': + if (ARGCMP("check")) { + zonemd_options |= DNS_ZONEMDOPT_CHECK; + } + if (ARGCMP("dnssec-only")) { + zonemd_options |= DNS_ZONEMDOPT_DNSSECONLY; + } + if (ARGCMP("accept-expired")) { + zonemd_options |= DNS_ZONEMDOPT_ACCEPTEXPIRED; + } + if (ARGCMP("required")) { + zonemd_options |= DNS_ZONEMDOPT_REQUIRED; + } + break; case '?': if (isc_commandline_option != '?') { diff --git a/bin/check/named-checkzone.rst b/bin/check/named-checkzone.rst index a58cfb7a14..90e5c22775 100644 --- a/bin/check/named-checkzone.rst +++ b/bin/check/named-checkzone.rst @@ -23,7 +23,7 @@ named-checkzone - zone file validation tool Synopsis ~~~~~~~~ -:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename} +:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] [**-z** mode] {zonename} {filename} Description ~~~~~~~~~~~ @@ -220,6 +220,18 @@ Options wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn`` (the default) and ``ignore``. +.. option:: -z option + + This option specifies whether to check the contents of a zone against + the cryptographic hash in a ZONEMD record (:rfc:`8976`). This is + off by default. Up to four options can be active simultaneously; + these options are: ``check`` (check the contents of the zone against + the ZONEMD hash if a ZONEMD record is present), ``required`` (reject + a zone if ZONEMD is *not* present), ``dnssec-only`` (reject a zone if + ZONEMD is present but the zone is not DNSSEC-signed), and + ``accept-expired`` (allow expired RRSIG records when verifying the + ZONEMD hash). + .. option:: zonename This indicates the domain name of the zone being checked. diff --git a/bin/check/named-compilezone.rst b/bin/check/named-compilezone.rst index c067826194..5bd3099dff 100644 --- a/bin/check/named-compilezone.rst +++ b/bin/check/named-compilezone.rst @@ -23,7 +23,7 @@ named-compilezone - zone file converting tool Synopsis ~~~~~~~~ -:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename} +:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] [**-z** mode] {**-o** filename} {zonename} {filename} Description ~~~~~~~~~~~ @@ -224,6 +224,18 @@ Options wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn`` and ``ignore`` (the default). +.. option:: -z option + + This option specifies whether to check the contents of a zone against + the cryptographic hash in a ZONEMD record (:rfc:`8976`). This is + off by default. Up to four options can be active simultaneously; + these options are: ``check`` (check the contents of the zone against + the ZONEMD hash if a ZONEMD record is present), ``required`` (reject + a zone if ZONEMD is *not* present), ``dnssec-only`` (reject a zone if + ZONEMD is present but the zone is not DNSSEC-signed), and + ``accept-expired`` (allow expired RRSIG records when verifying the + ZONEMD hash). + .. option:: zonename This indicates the domain name of the zone being checked.