rec: fix validation bypass for ZONEMD (part of YWH-PGM6095-274)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

diff --git a/Makefile.am b/Makefile.am
index db54310797fdf2a8c161ab69b44f25d935836538..2ce050b1cdf0b5e3b9e40ab0483442b7cb1420d2 100644 (file)
--- a/Makefile.am
+++ b/Makefile.am
@@ -13,6 +13,8 @@ EXTRA_DIST = \
        regression-tests/zones/zonemd-allunsup.zone \
        regression-tests/zones/zonemd-duplicate.zone \
        regression-tests/zones/zonemd-invalid.zone \
+       regression-tests/zones/zonemd-invalidscheme.zone \
+       regression-tests/zones/zonemd-scheme0.zone \
        regression-tests/zones/zonemd-nozonemd.zone \
        regression-tests/zones/zonemd-serialmismatch.zone \
        regression-tests/zones/zonemd-sha512.zone \

diff --git a/pdns/test-zonemd_cc.cc b/pdns/test-zonemd_cc.cc
index c1cbb599cd79fdd44a5f3c7ed6f379d7c5cd810b..def309515199277787a2da22439e81423a0269a8 100644 (file)
--- a/pdns/test-zonemd_cc.cc
+++ b/pdns/test-zonemd_cc.cc
@@ -110,4 +110,9 @@ BOOST_AUTO_TEST_CASE(test_zonemd14)
   testZoneMD("example", "zonemd-invalidscheme.zone", false, true, false);
 }
 
+BOOST_AUTO_TEST_CASE(test_zonemd15)
+{
+  testZoneMD("example", "zonemd-scheme0.zone", false, true, false);
+}
+
 BOOST_AUTO_TEST_SUITE_END()

diff --git a/pdns/zonemd.cc b/pdns/zonemd.cc
index 91165c0d0b1e95a06a0fa455933111932a665dda..92a10cfde3c3ee3e010ea5b3f8ed53f8540944ef 100644 (file)
--- a/pdns/zonemd.cc
+++ b/pdns/zonemd.cc
@@ -117,6 +117,9 @@ void pdns::ZoneMD::processRecord(const DNSRecord& record)
       }
       break;
     }
+    default:
+      // nothing
+      break;
     }
   }
 }
@@ -153,6 +156,9 @@ void pdns::ZoneMD::readRecord(const DNSRecord& record)
       }
       break;
     }
+    default:
+      // nothing
+      break;
     }
   }
   RRSetKey_t key = std::pair(record.d_name, record.d_type);
@@ -259,8 +265,16 @@ void pdns::ZoneMD::verify(bool& validationDone, bool& validationOK)
   }
 
   // Final verify
-  for (const auto& [k, v] : d_zonemdRecords) {
-    auto [zonemd, duplicate] = v;
+  for (const auto& record : d_zonemdRecords) {
+    const auto scheme = record.first.first;
+    const auto duplicate = record.second.duplicate;
+    if (scheme != 1 || duplicate) {
+      continue;
+    }
+    const auto zonemd = record.second.record;
+    if (zonemd->d_serial != d_soaRecordContent->d_st.serial) {
+      continue;
+    }
     if (zonemd->d_hashalgo == 1 && sha384digest) {
       validationDone = true;
       auto computed = sha384digest->digest();

diff --git a/regression-tests/zones/zonemd-scheme0.zone b/regression-tests/zones/zonemd-scheme0.zone
new file mode 100644 (file)
index 0000000..075f5ec
--- /dev/null
+++ b/regression-tests/zones/zonemd-scheme0.zone
@@ -0,0 +1,20 @@
+example.      86400  IN  SOA     ns1 admin 2018031900 (
+                                 1800 900 604800 86400 )
+              86400  IN  NS      ns1
+              86400  IN  NS      ns2
+              86400  IN  ZONEMD  2018031900 0 1 (
+                                 c68090d90a7aed71
+                                 6bc459f9340e3d7c
+                                 1370d4d24b7e2fc3
+                                 a1ddc0b9a87153b9
+                                 a9713b3c9ae5cc27
+                                 777f98b8e730044c )
+              86400  IN  ZONEMD  2018031900 1 1 (
+                                 068090d90a7aed71
+                                 6bc459f9340e3d7c
+                                 1370d4d24b7e2fc3
+                                 a1ddc0b9a87153b9
+                                 a9713b3c9ae5cc27
+                                 777f98b8e730044c )
+ns1           3600   IN  A       203.0.113.63
+ns2           3600   IN  AAAA    2001:db8::63