From: Artem Boldariev <artem@boldariev.com>
Date: Thu, 26 Aug 2021 13:06:42 +0000 (+0300)
Subject: Require "dot" ALPN token for zone transfer requests over DoT (XoT)
X-Git-Tag: v9.17.19~11^2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=25b2c6ad96cc36baa2f043cb257f130b5eb0c583;p=thirdparty%2Fbind9.git

Require "dot" ALPN token for zone transfer requests over DoT (XoT)

This commit makes BIND verify that zone transfers are allowed to be
done over the underlying connection. Currently, it makes sense only
for DoT, but the code is deliberately made to be protocol-agnostic.
---

diff --git a/lib/isc/include/isc/netmgr.h b/lib/isc/include/isc/netmgr.h
index 31342946966..ceefd5e20fd 100644
--- a/lib/isc/include/isc/netmgr.h
+++ b/lib/isc/include/isc/netmgr.h
@@ -488,6 +488,9 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
  * 'cb'.
  */
 
+bool
+isc_nm_is_tlsdns_handle(isc_nmhandle_t *handle);
+
 #if HAVE_LIBNGHTTP2
 
 #define ISC_NM_HTTP_DEFAULT_PATH "/dns-query"
diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
index 8aa9acb7d38..80a2224edfc 100644
--- a/lib/isc/netmgr/netmgr.c
+++ b/lib/isc/netmgr/netmgr.c
@@ -3418,6 +3418,14 @@ isc_nm_xfr_allowed(isc_nmhandle_t *handle) {
 	return (false);
 }
 
+bool
+isc_nm_is_tlsdns_handle(isc_nmhandle_t *handle) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	return (handle->sock->type == isc_nm_tlsdnssocket);
+}
+
 #ifdef NETMGR_TRACE
 /*
  * Dump all active sockets in netmgr. We output to stderr
diff --git a/lib/ns/query.c b/lib/ns/query.c
index e5bbb3df1ab..4002433ebf8 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -12054,6 +12054,16 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 				return;
 			}
 #endif
+			if (isc_nm_is_tlsdns_handle(handle) &&
+			    !isc_nm_xfr_allowed(handle)) {
+				/* Currently this code is here for DoT, which
+				 * has more complex requirements for zone
+				 * transfers compared to
+				 * other stream protocols. See RFC9103 for
+				 * the details. */
+				query_error(client, DNS_R_REFUSED, __LINE__);
+				return;
+			}
 			ns_xfr_start(client, rdataset->type);
 			return;
 		case dns_rdatatype_maila: