Apply XFR-out quota after ACL is checked

Unauthorized clients can consume XFR-out quota and block authorized
XFR clients. Apply the quota after ACL is checked.

(cherry picked from commit e8268b76a8a1cde039131234b04b197ee7b46220)

diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index 7149825a3c71f1f7726e4dd2637f4dff450ace95..69ad22d9d2a293a2e62cf5fcd4ca4bfeac7775b5 100644 (file)
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -769,16 +769,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
        ns_client_log(client,
                      DNS_LOGCATEGORY_XFER_OUT, NS_LOGMODULE_XFER_OUT,
                      ISC_LOG_DEBUG(6), "%s request", mnemonic);
-       /*
-        * Apply quota.
-        */
-       result = isc_quota_attach(&ns_g_server->xfroutquota, &quota);
-       if (result != ISC_R_SUCCESS) {
-               isc_log_write(XFROUT_COMMON_LOGARGS, ISC_LOG_WARNING,
-                             "%s request denied: %s", mnemonic,
-                             isc_result_totext(result));
-               goto failure;
-       }
 
        /*
         * Interpret the question section.
@@ -937,6 +927,18 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
                FAILC(DNS_R_FORMERR, "attempted AXFR over UDP");
        }
 
+       /*
+        * Apply quota after ACL is checked, so that unauthorized clients
+        * can not starve the authorized clients.
+        */
+       result = isc_quota_attach(&ns_g_server->xfroutquota, &quota);
+       if (result != ISC_R_SUCCESS) {
+               isc_log_write(XFROUT_COMMON_LOGARGS, ISC_LOG_WARNING,
+                             "%s request denied: %s", mnemonic,
+                             isc_result_totext(result));
+               goto failure;
+       }
+
        /*
         * Look up the requesting server in the peer table.
         */
@@ -1164,6 +1166,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
        }
        /* XXX kludge */
        if (xfr != NULL) {
+               /* The quota will be released in xfrout_ctx_destroy(). */
                xfrout_fail(xfr, result, "setting up zone transfer");
        } else if (result != ISC_R_SUCCESS) {
                ns_client_log(client, DNS_LOGCATEGORY_XFER_OUT,