- disable-dnssec-lame-check config option from Charles Walker.

git-svn-id: file:///svn/unbound/trunk@3725 be551aaa-1e26-0410-a405-d3ace91eadb9

doc/Changelog

@@ -1,4 +1,7 @@
-23 May 2016: Ralph
+24 May 2016: Wouter
+	- disable-dnssec-lame-check config option from Charles Walker.
+
+23 May 2016: Wouter
 	- Fix #767:  Reference to an expired Internet-Draft in
 	  harden-below-nxdomain documentation.
 

doc/example.conf.in

@@ -369,6 +369,9 @@ server:
 	# into response messages when those sections are not required.
 	# minimal-responses: no
 
+	# true to disable DNSSEC lameness check in iterator.
+	# disable-dnssec-lame-check: no
+
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. Syntax: "[dns64] [validator] iterator"
 	# module-config: "validator iterator"

doc/unbound.conf.5.in

@@ -681,6 +681,13 @@ This may cause a slight speedup.  The default is no, because the DNS
 protocol RFCs mandate these sections, and the additional content could
 be of use and save roundtrips for clients.
 .TP
+.B disable-dnssec-lame-check: \fI<yes or no>
+If true, disables the DNSSEC lameness check in the iterator.  This check
+sees if RRSIGs are present in the answer, when dnssec is expected,
+and retries another authority if RRSIGs are unexpectedly missing.
+The validator will insist in RRSIGs for DNSSEC signed domains regardless
+of this setting, if a trust anchor is loaded.
+.TP
 .B module\-config: \fI<"module names">
 Module configuration, a list of module names separated by spaces, surround
 the string with quotes (""). The modules can be validator, iterator.

iterator/iterator.c

@@ -2172,7 +2172,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * differently. No queries should be sent elsewhere */
 		type = RESPONSE_TYPE_ANSWER;
 	}
-	if(iq->dnssec_expected && !iq->dnssec_lame_query &&
+	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected 
+                && !iq->dnssec_lame_query &&
 		!(iq->chase_flags&BIT_RD) 
 		&& iq->sent_count < DNSSEC_LAME_DETECT_COUNT
 		&& type != RESPONSE_TYPE_LAME 
@@ -2464,7 +2465,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_ALGO, "cleared outbound list for query restart");
 		/* go to INIT_REQUEST_STATE for new qname. */
 		return next_state(iq, INIT_REQUEST_STATE);
-	} else if(type == RESPONSE_TYPE_LAME) {
+	} else if(!qstate->env->cfg->disable_dnssec_lame_check 
+                      && type == RESPONSE_TYPE_LAME) {
 		/* Cache the LAMEness. */
 		verbose(VERB_DETAIL, "query response was %sLAME",
 			dnsseclame?"DNSSEC ":"");

util/config_file.c

@@ -238,6 +238,7 @@ config_create(void)
 	if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH)))
 		goto error_exit;
 #endif
+	cfg->disable_dnssec_lame_check = 0;
 	cfg->ratelimit = 0;
 	cfg->ratelimit_slabs = 4;
 	cfg->ratelimit_size = 4*1024*1024;
@@ -475,6 +476,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STR("control-cert-file:", control_cert_file)
 	else S_STR("module-config:", module_conf)
 	else S_STR("python-script:", python_script)
+	else S_YNO("disable-dnssec-lame-check:", disable_dnssec_lame_check)
 	else if(strcmp(opt, "ratelimit:") == 0) {
 	    IS_NUMBER_OR_ZERO; cfg->ratelimit = atoi(val);
 	    infra_dp_ratelimit=cfg->ratelimit;
@@ -770,6 +772,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "insecure-lan-zones", insecure_lan_zones)
 	else O_DEC(opt, "max-udp-size", max_udp_size)
 	else O_STR(opt, "python-script", python_script)
+	else O_YNO(opt, "disable-dnssec-lame-check", disable_dnssec_lame_check)
 	else O_DEC(opt, "ratelimit", ratelimit)
 	else O_MEM(opt, "ratelimit-size", ratelimit_size)
 	else O_DEC(opt, "ratelimit-slabs", ratelimit_slabs)

util/config_file.h

@@ -367,6 +367,9 @@ struct config_file {
 	/** true to log dnstap FORWARDER_RESPONSE message events */
 	int dnstap_log_forwarder_response_messages;
 
+	/** true to disable DNSSEC lameness check in iterator */
+	int disable_dnssec_lame_check;
+
 	/** ratelimit 0 is off, otherwise qps (unless overridden) */
 	int ratelimit;
 	/** number of slabs for ratelimit cache */

util/configlexer.lex

@@ -364,6 +364,7 @@ dnstap-log-forwarder-query-messages{COLON}	{
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
 dnstap-log-forwarder-response-messages{COLON}	{
 		YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
+disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
 ratelimit{COLON}		{ YDVAR(1, VAR_RATELIMIT) }
 ratelimit-slabs{COLON}		{ YDVAR(1, VAR_RATELIMIT_SLABS) }
 ratelimit-size{COLON}		{ YDVAR(1, VAR_RATELIMIT_SIZE) }

util/configparser.h

@@ -198,19 +198,20 @@ extern int yydebug;
     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 408,
     VAR_HARDEN_ALGO_DOWNGRADE = 409,
     VAR_IP_TRANSPARENT = 410,
-    VAR_RATELIMIT = 411,
-    VAR_RATELIMIT_SLABS = 412,
-    VAR_RATELIMIT_SIZE = 413,
-    VAR_RATELIMIT_FOR_DOMAIN = 414,
-    VAR_RATELIMIT_BELOW_DOMAIN = 415,
-    VAR_RATELIMIT_FACTOR = 416,
-    VAR_CAPS_WHITELIST = 417,
-    VAR_CACHE_MAX_NEGATIVE_TTL = 418,
-    VAR_PERMIT_SMALL_HOLDDOWN = 419,
-    VAR_QNAME_MINIMISATION = 420,
-    VAR_IP_FREEBIND = 421,
-    VAR_DEFINE_TAG = 422,
-    VAR_LOCAL_ZONE_TAG = 423
+    VAR_DISABLE_DNSSEC_LAME_CHECK = 411,
+    VAR_RATELIMIT = 412,
+    VAR_RATELIMIT_SLABS = 413,
+    VAR_RATELIMIT_SIZE = 414,
+    VAR_RATELIMIT_FOR_DOMAIN = 415,
+    VAR_RATELIMIT_BELOW_DOMAIN = 416,
+    VAR_RATELIMIT_FACTOR = 417,
+    VAR_CAPS_WHITELIST = 418,
+    VAR_CACHE_MAX_NEGATIVE_TTL = 419,
+    VAR_PERMIT_SMALL_HOLDDOWN = 420,
+    VAR_QNAME_MINIMISATION = 421,
+    VAR_IP_FREEBIND = 422,
+    VAR_DEFINE_TAG = 423,
+    VAR_LOCAL_ZONE_TAG = 424
   };
 #endif
 /* Tokens.  */
@@ -367,19 +368,20 @@ extern int yydebug;
 #define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 408
 #define VAR_HARDEN_ALGO_DOWNGRADE 409
 #define VAR_IP_TRANSPARENT 410
-#define VAR_RATELIMIT 411
-#define VAR_RATELIMIT_SLABS 412
-#define VAR_RATELIMIT_SIZE 413
-#define VAR_RATELIMIT_FOR_DOMAIN 414
-#define VAR_RATELIMIT_BELOW_DOMAIN 415
-#define VAR_RATELIMIT_FACTOR 416
-#define VAR_CAPS_WHITELIST 417
-#define VAR_CACHE_MAX_NEGATIVE_TTL 418
-#define VAR_PERMIT_SMALL_HOLDDOWN 419
-#define VAR_QNAME_MINIMISATION 420
-#define VAR_IP_FREEBIND 421
-#define VAR_DEFINE_TAG 422
-#define VAR_LOCAL_ZONE_TAG 423
+#define VAR_DISABLE_DNSSEC_LAME_CHECK 411
+#define VAR_RATELIMIT 412
+#define VAR_RATELIMIT_SLABS 413
+#define VAR_RATELIMIT_SIZE 414
+#define VAR_RATELIMIT_FOR_DOMAIN 415
+#define VAR_RATELIMIT_BELOW_DOMAIN 416
+#define VAR_RATELIMIT_FACTOR 417
+#define VAR_CAPS_WHITELIST 418
+#define VAR_CACHE_MAX_NEGATIVE_TTL 419
+#define VAR_PERMIT_SMALL_HOLDDOWN 420
+#define VAR_QNAME_MINIMISATION 421
+#define VAR_IP_FREEBIND 422
+#define VAR_DEFINE_TAG 423
+#define VAR_LOCAL_ZONE_TAG 424
 
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -390,7 +392,7 @@ union YYSTYPE
 
 	char*	str;
 
-#line 394 "util/configparser.h" /* yacc.c:1909  */
+#line 396 "util/configparser.h" /* yacc.c:1909  */
 };
 
 typedef union YYSTYPE YYSTYPE;

util/configparser.y

@@ -121,6 +121,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
 %token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
+%token VAR_DISABLE_DNSSEC_LAME_CHECK
 %token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE
 %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN VAR_RATELIMIT_FACTOR
 %token VAR_CAPS_WHITELIST VAR_CACHE_MAX_NEGATIVE_TTL VAR_PERMIT_SMALL_HOLDDOWN
@@ -192,7 +193,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_ratelimit_below_domain | server_ratelimit_factor |
 	server_caps_whitelist | server_cache_max_negative_ttl |
 	server_permit_small_holddown | server_qname_minimisation |
-	server_ip_freebind | server_define_tag | server_local_zone_tag
+	server_ip_freebind | server_define_tag | server_local_zone_tag |
+	server_disable_dnssec_lame_check
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -1687,6 +1689,14 @@ py_script: VAR_PYTHON_SCRIPT STRING_ARG
 		free(cfg_parser->cfg->python_script);
 		cfg_parser->cfg->python_script = $2;
 	}
+server_disable_dnssec_lame_check: VAR_DISABLE_DNSSEC_LAME_CHECK STRING_ARG
+	{
+		OUTYY(("P(disable_dnssec_lame_check:%s)\n", $2));
+		if (strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->disable_dnssec_lame_check =
+			(strcmp($2, "yes")==0);
+	}
 %%
 
 /* parse helper routines could be here */