zonemd, zonemd-permissive-mode: yes logs the failure but does not block

the zone after a ZONEMD verification failure.

doc/example.conf.in

@@ -602,6 +602,9 @@ server:
 	# List in ascending order the keysize and count values.
 	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
 
+	# if enabled, ZONEMD verification failures do not block the zone.
+	# zonemd-permissive-mode: no
+
 	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
 	# add-holddown: 2592000 # 30 days
 

doc/unbound.conf.5.in

@@ -1167,6 +1167,12 @@ be in ascending order and have at least one entry. If you set it to
 "1024 65535" there is no restriction to NSEC3 iteration values.
 This table must be kept short; a very long list could cause slower operation.
 .TP
+.B zonemd\-permissive\-mode: \fI<yes or no>
+If enabled the ZONEMD verification failures are only logged and do not cause
+the zone to be blocked and only return servfail.  Useful for testing out
+if it works, or if the operator only wants to be notified of a problem without
+disrupting service.  Default is no.
+.TP
 .B add\-holddown: \fI<seconds>
 Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
 autotrust updates to add new trust anchors only after they have been

services/authzone.c

@@ -7818,6 +7818,12 @@ static void auth_zone_zonemd_fail(struct auth_zone* z, struct module_env* env,
 		log_warn("auth zone %s: ZONEMD verification failed: %s", zstr, reason);
 	}
 
+	if(env->cfg->zonemd_permissive_mode) {
+		verbose(VERB_ALGO, "zonemd-permissive-mode enabled, "
+			"not blocking zone %s", zstr);
+		return;
+	}
+
 	/* expired means the zone gives servfail and is not used by
 	 * lookup if fallback_enabled*/
 	z->zone_expired = 1;

testdata/auth_zonefile_dnssec.rpl

@@ -5,6 +5,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	zonemd-permissive-mode: yes
 
 auth-zone:
 	name: "example.com."

util/config_file.c

@@ -257,6 +257,7 @@ config_create(void)
 	cfg->serve_expired_ttl_reset = 0;
 	cfg->serve_expired_reply_ttl = 30;
 	cfg->serve_expired_client_timeout = 0;
+	cfg->zonemd_permissive_mode = 0;
 	cfg->add_holddown = 30*24*3600;
 	cfg->del_holddown = 30*24*3600;
 	cfg->keep_missing = 366*24*3600; /* one year plus a little leeway */
@@ -623,6 +624,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;}
 	else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
 	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
+	else S_YNO("zonemd-permissive-mode:", zonemd_permissive_mode)
 	else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
 	else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
 	else S_UNSIGNED_OR_ZERO("keep-missing:", keep_missing)
@@ -1037,6 +1039,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "serve-expired-reply-ttl", serve_expired_reply_ttl)
 	else O_DEC(opt, "serve-expired-client-timeout", serve_expired_client_timeout)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
+	else O_YNO(opt, "zonemd_permissive_mode", zonemd_permissive_mode)
 	else O_UNS(opt, "add-holddown", add_holddown)
 	else O_UNS(opt, "del-holddown", del_holddown)
 	else O_UNS(opt, "keep-missing", keep_missing)

util/config_file.h

@@ -388,6 +388,8 @@ struct config_file {
 	int serve_expired_client_timeout;
 	/** nsec3 maximum iterations per key size, string */
 	char* val_nsec3_key_iterations;
+	/** if zonemd failures are permitted, only logged */
+	int zonemd_permissive_mode;
 	/** autotrust add holddown time, in seconds */
 	unsigned int add_holddown;
 	/** autotrust del holddown time, in seconds */

util/configlexer.lex

@@ -399,6 +399,7 @@ key-cache-slabs{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 neg-cache-size{COLON}		{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
 val-nsec3-keysize-iterations{COLON}	{ 
 				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
+zonemd-permissive-mode{COLON}	{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
 add-holddown{COLON}		{ YDVAR(1, VAR_ADD_HOLDDOWN) }
 del-holddown{COLON}		{ YDVAR(1, VAR_DEL_HOLDDOWN) }
 keep-missing{COLON}		{ YDVAR(1, VAR_KEEP_MISSING) }

util/configparser.h

@@ -347,7 +347,8 @@ extern int yydebug;
     VAR_DYNLIB = 553,
     VAR_DYNLIB_FILE = 554,
     VAR_EDNS_CLIENT_TAG = 555,
-    VAR_EDNS_CLIENT_TAG_OPCODE = 556
+    VAR_EDNS_CLIENT_TAG_OPCODE = 556,
+    VAR_ZONEMD_PERMISSIVE_MODE = 557
   };
 #endif
 /* Tokens.  */
@@ -650,6 +651,7 @@ extern int yydebug;
 #define VAR_DYNLIB_FILE 554
 #define VAR_EDNS_CLIENT_TAG 555
 #define VAR_EDNS_CLIENT_TAG_OPCODE 556
+#define VAR_ZONEMD_PERMISSIVE_MODE 557
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -659,7 +661,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 663 "util/configparser.h"
+#line 665 "util/configparser.h"
 
 };
 typedef union YYSTYPE YYSTYPE;

util/configparser.y

@@ -179,6 +179,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_TLS_SESSION_TICKET_KEYS VAR_RPZ VAR_TAGS VAR_RPZ_ACTION_OVERRIDE
 %token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME
 %token VAR_DYNLIB VAR_DYNLIB_FILE VAR_EDNS_CLIENT_TAG VAR_EDNS_CLIENT_TAG_OPCODE
+%token VAR_ZONEMD_PERMISSIVE_MODE
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -292,7 +293,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_stream_wait_size | server_tls_ciphers |
 	server_tls_ciphersuites | server_tls_session_ticket_keys |
 	server_tls_use_sni | server_edns_client_tag |
-	server_edns_client_tag_opcode
+	server_edns_client_tag_opcode | server_zonemd_permissive_mode
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -1945,6 +1946,15 @@ server_val_nsec3_keysize_iterations: VAR_VAL_NSEC3_KEYSIZE_ITERATIONS STRING_ARG
 		cfg_parser->cfg->val_nsec3_key_iterations = $2;
 	}
 	;
+server_zonemd_permissive_mode: VAR_ZONEMD_PERMISSIVE_MODE STRING_ARG
+	{
+		OUTYY(("P(server_zonemd_permissive_mode:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else	cfg_parser->cfg->zonemd_permissive_mode = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_add_holddown: VAR_ADD_HOLDDOWN STRING_ARG
 	{
 		OUTYY(("P(server_add_holddown:%s)\n", $2));