upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Require "dot" ALPN token for zone transfer requests over DoT (XoT)

Browse source 
This commit makes BIND verify that zone transfers are allowed to be
done over the underlying connection. Currently, it makes sense only
for DoT, but the code is deliberately made to be protocol-agnostic.
This commit is contained in:
Artem Boldariev 2021-08-26 16:06:42 +03:00
parent eba3278e52
commit 25b2c6ad96
3 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/isc/include/isc/netmgr.h
View file

@ -488,6 +488,9 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
* 'cb'.
*/
bool
isc_nm_is_tlsdns_handle(isc_nmhandle_t *handle);
#if HAVE_LIBNGHTTP2
#define ISC_NM_HTTP_DEFAULT_PATH "/dns-query"

8
lib/isc/netmgr/netmgr.c
View file

@ -3418,6 +3418,14 @@ isc_nm_xfr_allowed(isc_nmhandle_t *handle) {
return (false);
}
bool
isc_nm_is_tlsdns_handle(isc_nmhandle_t *handle) {
REQUIRE(VALID_NMHANDLE(handle));
REQUIRE(VALID_NMSOCK(handle->sock));
return (handle->sock->type == isc_nm_tlsdnssocket);
}
#ifdef NETMGR_TRACE
/*
* Dump all active sockets in netmgr. We output to stderr

10
lib/ns/query.c
View file

@ -12054,6 +12054,16 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
return;
}
#endif
if (isc_nm_is_tlsdns_handle(handle) &&
!isc_nm_xfr_allowed(handle)) {
/* Currently this code is here for DoT, which
* has more complex requirements for zone
* transfers compared to
* other stream protocols. See RFC9103 for
* the details. */
query_error(client, DNS_R_REFUSED, __LINE__);
return;
}
ns_xfr_start(client, rdataset->type);
return;
case dns_rdatatype_maila: