From: Otto Moerbeek <otto.moerbeek@open-xchange.com>
Date: Wed, 29 Apr 2026 12:09:12 +0000 (+0200)
Subject: rec: fix validation bypass for ZONEMD (part of YWH-PGM6095-274)
X-Git-Tag: rec-5.3.8~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1f06fa4dbdda2ce0e656086d07035cf9ecba4a92;p=thirdparty%2Fpdns.git

rec: fix validation bypass for ZONEMD (part of YWH-PGM6095-274)

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>
---

diff --git a/Makefile.am b/Makefile.am
index db54310797..2ce050b1cd 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -13,6 +13,8 @@ EXTRA_DIST = \
 	regression-tests/zones/zonemd-allunsup.zone \
 	regression-tests/zones/zonemd-duplicate.zone \
 	regression-tests/zones/zonemd-invalid.zone \
+	regression-tests/zones/zonemd-invalidscheme.zone \
+	regression-tests/zones/zonemd-scheme0.zone \
 	regression-tests/zones/zonemd-nozonemd.zone \
 	regression-tests/zones/zonemd-serialmismatch.zone \
 	regression-tests/zones/zonemd-sha512.zone \
diff --git a/pdns/test-zonemd_cc.cc b/pdns/test-zonemd_cc.cc
index c1cbb599cd..def3095151 100644
--- a/pdns/test-zonemd_cc.cc
+++ b/pdns/test-zonemd_cc.cc
@@ -110,4 +110,9 @@ BOOST_AUTO_TEST_CASE(test_zonemd14)
   testZoneMD("example", "zonemd-invalidscheme.zone", false, true, false);
 }
 
+BOOST_AUTO_TEST_CASE(test_zonemd15)
+{
+  testZoneMD("example", "zonemd-scheme0.zone", false, true, false);
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/pdns/zonemd.cc b/pdns/zonemd.cc
index 91165c0d0b..92a10cfde3 100644
--- a/pdns/zonemd.cc
+++ b/pdns/zonemd.cc
@@ -117,6 +117,9 @@ void pdns::ZoneMD::processRecord(const DNSRecord& record)
       }
       break;
     }
+    default:
+      // nothing
+      break;
     }
   }
 }
@@ -153,6 +156,9 @@ void pdns::ZoneMD::readRecord(const DNSRecord& record)
       }
       break;
     }
+    default:
+      // nothing
+      break;
     }
   }
   RRSetKey_t key = std::pair(record.d_name, record.d_type);
@@ -259,8 +265,16 @@ void pdns::ZoneMD::verify(bool& validationDone, bool& validationOK)
   }
 
   // Final verify
-  for (const auto& [k, v] : d_zonemdRecords) {
-    auto [zonemd, duplicate] = v;
+  for (const auto& record : d_zonemdRecords) {
+    const auto scheme = record.first.first;
+    const auto duplicate = record.second.duplicate;
+    if (scheme != 1 || duplicate) {
+      continue;
+    }
+    const auto zonemd = record.second.record;
+    if (zonemd->d_serial != d_soaRecordContent->d_st.serial) {
+      continue;
+    }
     if (zonemd->d_hashalgo == 1 && sha384digest) {
       validationDone = true;
       auto computed = sha384digest->digest();
diff --git a/regression-tests/zones/zonemd-scheme0.zone b/regression-tests/zones/zonemd-scheme0.zone
new file mode 100644
index 0000000000..075f5ec0cc
--- /dev/null
+++ b/regression-tests/zones/zonemd-scheme0.zone
@@ -0,0 +1,20 @@
+example.      86400  IN  SOA     ns1 admin 2018031900 (
+                                 1800 900 604800 86400 )
+              86400  IN  NS      ns1
+              86400  IN  NS      ns2
+              86400  IN  ZONEMD  2018031900 0 1 (
+                                 c68090d90a7aed71
+                                 6bc459f9340e3d7c
+                                 1370d4d24b7e2fc3
+                                 a1ddc0b9a87153b9
+                                 a9713b3c9ae5cc27
+                                 777f98b8e730044c )
+              86400  IN  ZONEMD  2018031900 1 1 (
+                                 068090d90a7aed71
+                                 6bc459f9340e3d7c
+                                 1370d4d24b7e2fc3
+                                 a1ddc0b9a87153b9
+                                 a9713b3c9ae5cc27
+                                 777f98b8e730044c )
+ns1           3600   IN  A       203.0.113.63
+ns2           3600   IN  AAAA    2001:db8::63