mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-02 15:45:25 +00:00
Code Issues Releases Wiki Activity

Require "dot" ALPN token for zone transfer requests over DoT (XoT)

Browse Source 
This commit makes BIND verify that zone transfers are allowed to be
done over the underlying connection. Currently, it makes sense only
for DoT, but the code is deliberately made to be protocol-agnostic.
This commit is contained in:
Artem Boldariev
2021-08-26 16:06:42 +03:00
parent eba3278e52
commit 25b2c6ad96
3 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/isc/include/isc/netmgr.h
View File

@@ -488,6 +488,9 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
* 'cb'. * 'cb'.
*/ */
bool
isc_nm_is_tlsdns_handle(isc_nmhandle_t *handle);
#if HAVE_LIBNGHTTP2 #if HAVE_LIBNGHTTP2
#define ISC_NM_HTTP_DEFAULT_PATH "/dns-query" #define ISC_NM_HTTP_DEFAULT_PATH "/dns-query"

8
lib/isc/netmgr/netmgr.c
View File

@@ -3418,6 +3418,14 @@ isc_nm_xfr_allowed(isc_nmhandle_t *handle) {
return (false); return (false);
} }
bool
isc_nm_is_tlsdns_handle(isc_nmhandle_t *handle) {
REQUIRE(VALID_NMHANDLE(handle));
REQUIRE(VALID_NMSOCK(handle->sock));
return (handle->sock->type == isc_nm_tlsdnssocket);
}
#ifdef NETMGR_TRACE #ifdef NETMGR_TRACE
/* /*
* Dump all active sockets in netmgr. We output to stderr * Dump all active sockets in netmgr. We output to stderr

10
lib/ns/query.c
View File

@@ -12054,6 +12054,16 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
return; return;
} }
#endif #endif
if (isc_nm_is_tlsdns_handle(handle) &&
!isc_nm_xfr_allowed(handle)) {
/* Currently this code is here for DoT, which
* has more complex requirements for zone
* transfers compared to
* other stream protocols. See RFC9103 for
* the details. */
query_error(client, DNS_R_REFUSED, __LINE__);
return;
}
ns_xfr_start(client, rdataset->type); ns_xfr_start(client, rdataset->type);
return; return;
case dns_rdatatype_maila: case dns_rdatatype_maila: