Require "dot" ALPN token for incoming xfrs over XoT

This commit make the code handling incoming zone transfers to verify
if they are allowed to be done over the underlying connections. As a
result the check ensures that the "dot" ALPN token has been negotiated
over the underlying connection.

diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 0dc308839704a850f2bb95c7c22bb923f78a6817..4ebc09e67ca30394cbc19c26ef6b11a470ae1e9b 100644 (file)
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -947,6 +947,7 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
                break;
        case DNS_TRANSPORT_TLS:
                CHECK(isc_tlsctx_createclient(&xfr->tlsctx));
+               isc_tlsctx_enable_dot_client_alpn(xfr->tlsctx);
                isc_nm_tlsdnsconnect(xfr->netmgr, &xfr->sourceaddr,
                                     &xfr->masteraddr, xfrin_connect_done,
                                     connect_xfr, 30000, 0, xfr->tlsctx);
@@ -1018,6 +1019,10 @@ xfrin_connect_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 
        CHECK(result);
 
+       if (!isc_nm_xfr_allowed(handle)) {
+               goto failure;
+       }
+
        zmgr = dns_zone_getmgr(xfr->zone);
        if (zmgr != NULL) {
                if (result != ISC_R_SUCCESS) {