NLnetLabs
diff --git a/‎Makefile.in
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/‎Makefile.in
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/‎axfr.c
Copy file name to clipboard
+36Lines changed: 36 additions & 0 deletions b/‎axfr.c
Copy file name to clipboard
+36Lines changed: 36 additions & 0 deletions
diff --git a/‎configlexer.lex
Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions b/‎configlexer.lex
Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions
diff --git a/‎configparser.y
Copy file name to clipboard
+27-3Lines changed: 27 additions & 3 deletions b/‎configparser.y
Copy file name to clipboard
+27-3Lines changed: 27 additions & 3 deletions
diff --git a/‎configure.ac
Copy file name to clipboard
+4-1Lines changed: 4 additions & 1 deletion b/‎configure.ac
Copy file name to clipboard
+4-1Lines changed: 4 additions & 1 deletion
diff --git a/‎nsd.c
Copy file name to clipboard
+10-1Lines changed: 10 additions & 1 deletion b/‎nsd.c
Copy file name to clipboard
+10-1Lines changed: 10 additions & 1 deletion
diff --git a/‎nsd.conf.5.in
Copy file name to clipboard
+61-8Lines changed: 61 additions & 8 deletions b/‎nsd.conf.5.in
Copy file name to clipboard
+61-8Lines changed: 61 additions & 8 deletions
diff --git a/‎nsd.conf.sample.in
Copy file name to clipboard
+12Lines changed: 12 additions & 0 deletions b/‎nsd.conf.sample.in
Copy file name to clipboard
+12Lines changed: 12 additions & 0 deletions
diff --git a/‎nsd.h
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎nsd.h
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
@@ -170,7 +170,7 @@ nsd:	simdzone/libzone.a $(NSD_OBJ) $(LIBOBJS)
 	$(LINK) -o $@ $(NSD_OBJ) $(LIBOBJS) simdzone/libzone.a $(SSL_LIBS) $(LIBS)
 
 nsd-checkconf:	simdzone/libzone.a $(NSD_CHECKCONF_OBJ) $(LIBOBJS)
-	$(LINK) -o $@ $(NSD_CHECKCONF_OBJ) simdzone/libzone.a $(LIBOBJS) $(LIBS)
+	$(LINK) -o $@ $(NSD_CHECKCONF_OBJ) simdzone/libzone.a $(LIBOBJS) $(SSL_LIBS) $(LIBS)
 
 nsd-checkzone:	simdzone/libzone.a $(NSD_CHECKZONE_OBJ) $(LIBOBJS)
 	$(LINK) -o $@ $(NSD_CHECKZONE_OBJ) $(LIBOBJS) simdzone/libzone.a $(SSL_LIBS) $(LIBS)
 
@@ -187,6 +187,27 @@ static int axfr_ixfr_can_admit_query(struct nsd* nsd, struct query* q)
 {
 	struct acl_options *acl = NULL;
 	struct zone_options* zone_opt;
+
+#ifdef HAVE_SSL
+	/* tls-auth-xfr-only is set and this is not an authenticated TLS */
+	if (nsd->options->tls_auth_xfr_only && !q->tls_auth) {
+		if (verbosity >= 2) {
+			char address[128], proxy[128];
+			addr2str(&q->client_addr, address, sizeof(address));
+			addr2str(&q->remote_addr, proxy, sizeof(proxy));
+			VERBOSITY(2, (LOG_INFO, "%s for %s from %s refused tls-auth-xfr-only",
+				(q->qtype==TYPE_AXFR?"axfr":"ixfr"),
+				dname_to_string(q->qname, NULL),
+				address));
+		}
+		RCODE_SET(q->packet, RCODE_REFUSE);
+		/* RFC8914 - Extended DNS Errors
+		 * 4.19.  Extended DNS Error Code 18 - Prohibited */
+		q->edns.ede = EDE_PROHIBITED;
+		return 0;
+	}
+#endif
+
 	zone_opt = zone_options_find(nsd->options, q->qname);
 	if(zone_opt && q->is_proxied && acl_check_incoming_block_proxy(
 		zone_opt->pattern->provide_xfr, q, &acl) == -1) {
@@ -234,15 +255,30 @@ static int axfr_ixfr_can_admit_query(struct nsd* nsd, struct query* q)
 		}
 		return 0;
 	}
+#ifdef HAVE_SSL
+	DEBUG(DEBUG_XFRD,1, (LOG_INFO, "%s admitted acl %s %s %s",
+		(q->qtype==TYPE_AXFR?"axfr":"ixfr"),
+		acl->ip_address_spec, acl->key_name?acl->key_name:"NOKEY",
+		(q->tls||q->tls_auth)?(q->tls?"tls":"tls-auth"):""));
+#else
 	DEBUG(DEBUG_XFRD,1, (LOG_INFO, "%s admitted acl %s %s",
 		(q->qtype==TYPE_AXFR?"axfr":"ixfr"),
 		acl->ip_address_spec, acl->key_name?acl->key_name:"NOKEY"));
+#endif
 	if (verbosity >= 1) {
 		char a[128];
 		addr2str(&q->client_addr, a, sizeof(a));
+#ifdef HAVE_SSL
+		VERBOSITY(1, (LOG_INFO, "%s for %s from %s %s %s",
+			(q->qtype==TYPE_AXFR?"axfr":"ixfr"),
+			dname_to_string(q->qname, NULL), a,
+			(q->tls||q->tls_auth)?(q->tls?"tls":"tls-auth"):"",
+			q->cert_cn?q->cert_cn:"not-verified"));
+#else
 		VERBOSITY(1, (LOG_INFO, "%s for %s from %s",
 			(q->qtype==TYPE_AXFR?"axfr":"ixfr"),
 			dname_to_string(q->qname, NULL), a));
+#endif
 	}
 	return 1;
 }
 
@@ -304,6 +304,8 @@ tls-service-key{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_SERVICE_KEY;
 tls-service-ocsp{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_SERVICE_OCSP;}
 tls-service-pem{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_SERVICE_PEM;}
 tls-port{COLON}		{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_PORT;}
+tls-auth-port{COLON}		{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_AUTH_PORT;}
+tls-auth-xfr-only{COLON}		{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_AUTH_XFR_ONLY;}
 tls-cert-bundle{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_TLS_CERT_BUNDLE; }
 proxy-protocol-port{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_PROXY_PROTOCOL_PORT; }
 answer-cookie{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_ANSWER_COOKIE;}
 
@@ -127,6 +127,8 @@ struct component {
 %token VAR_TLS_SERVICE_PEM
 %token VAR_TLS_SERVICE_OCSP
 %token VAR_TLS_PORT
+%token VAR_TLS_AUTH_PORT
+%token VAR_TLS_AUTH_XFR_ONLY
 %token VAR_TLS_CERT_BUNDLE
 %token VAR_PROXY_PROTOCOL_PORT
 %token VAR_CPU_AFFINITY
@@ -479,6 +481,21 @@ server_option:
       (void)snprintf(buf, sizeof(buf), "%lld", $2);
       cfg_parser->opt->tls_port = region_strdup(cfg_parser->opt->region, buf);
     }
+  | VAR_TLS_AUTH_PORT number
+    {
+      /* port number, stored as string */
+      char buf[16];
+      (void)snprintf(buf, sizeof(buf), "%lld", $2);
+      cfg_parser->opt->tls_auth_port = region_strdup(cfg_parser->opt->region, buf);
+    }
+  | VAR_TLS_AUTH_XFR_ONLY boolean
+    {
+      if (!cfg_parser->opt->tls_auth_port) {
+        yyerror("tls-auth-xfr-only set without or before tls-auth-port");
+        YYABORT;
+      }
+      cfg_parser->opt->tls_auth_xfr_only = $2;
+    }
   | VAR_TLS_CERT_BUNDLE STRING
     { cfg_parser->opt->tls_cert_bundle = region_strdup(cfg_parser->opt->region, $2); }
   | VAR_PROXY_PROTOCOL_PORT number
@@ -921,7 +938,7 @@ pattern_or_zone_option:
         yyerror("address range used for request-xfr");
       append_acl(&cfg_parser->pattern->request_xfr, acl);
     }
-	tlsauth_option
+	request_xfr_tlsauth_option
 	{ }
   | VAR_REQUEST_XFR VAR_AXFR STRING STRING
     {
@@ -933,7 +950,7 @@ pattern_or_zone_option:
         yyerror("address range used for request-xfr");
       append_acl(&cfg_parser->pattern->request_xfr, acl);
     }
-	tlsauth_option
+	request_xfr_tlsauth_option
 	{ }
   | VAR_REQUEST_XFR VAR_UDP STRING STRING
     {
@@ -964,6 +981,8 @@ pattern_or_zone_option:
       acl_options_type *acl = parse_acl_info(cfg_parser->opt->region, $2, $3);
       append_acl(&cfg_parser->pattern->provide_xfr, acl);
     }
+	provide_xfr_tlsauth_option
+	{ }
   | VAR_ALLOW_QUERY STRING STRING
     {
       acl_options_type *acl = parse_acl_info(cfg_parser->opt->region, $2, $3);
@@ -1174,11 +1193,16 @@ boolean:
       }
     } ;
 
-tlsauth_option:
+request_xfr_tlsauth_option:
 	| STRING
 	{ char *tls_auth_name = region_strdup(cfg_parser->opt->region, $1);
 	  add_to_last_acl(&cfg_parser->pattern->request_xfr, tls_auth_name);} ;
 
+provide_xfr_tlsauth_option:
+	| STRING
+	{ char *tls_auth_name = region_strdup(cfg_parser->opt->region, $1);
+	  add_to_last_acl(&cfg_parser->pattern->provide_xfr, tls_auth_name);} ;
+
 catalog_role:
     STRING
     {
 
@@ -1047,7 +1047,7 @@ if test x$HAVE_SSL = x"yes"; then
 	fi
 	SSL_LIBS="-lssl"
 	AC_SUBST(SSL_LIBS)
-	AC_CHECK_HEADERS([openssl/ssl.h openssl/err.h openssl/rand.h openssl/ocsp.h openssl/core_names.h],,, [AC_INCLUDES_DEFAULT])
+	AC_CHECK_HEADERS([openssl/ssl.h openssl/err.h openssl/rand.h openssl/ocsp.h openssl/core_names.h openssl/x509v3.h],,, [AC_INCLUDES_DEFAULT])
 	AC_CHECK_FUNCS([HMAC_CTX_reset HMAC_CTX_new EVP_cleanup ERR_load_crypto_strings OPENSSL_init_crypto CRYPTO_memcmp EC_KEY_new_by_curve_name EVP_MAC_CTX_new EVP_MAC_CTX_set_params EVP_MAC_CTX_get_mac_size SHA1_Init])
 	if test "$ac_cv_func_SHA1_Init" = "yes"; then
 		ACX_FUNC_DEPRECATED([SHA1_Init], [(void)SHA1_Init(NULL);], [
@@ -1073,6 +1073,9 @@ AC_INCLUDES_DEFAULT
 #endif
 #include <openssl/ssl.h>
 #include <openssl/evp.h>
+#ifdef HAVE_OPENSSL_X509V3_h
+#include <openssl/x509v3.h>
+#endif
 ])
 	AC_CHECK_DECL([TLS1_3_VERSION], 
 		[AC_DEFINE([HAVE_TLS_1_3], [1], [Define if TLS 1.3 is supported by OpenSSL])],
 
@@ -1205,6 +1205,7 @@ main(int argc, char *argv[])
 	nsd.ipv6_edns_size = nsd.options->ipv6_edns_size;
 #ifdef HAVE_SSL
 	nsd.tls_ctx = NULL;
+	nsd.tls_auth_ctx = NULL;
 #endif
 
 	if(udp_port == 0)
@@ -1577,9 +1578,17 @@ main(int argc, char *argv[])
 #if defined(HAVE_SSL)
 	if(nsd.options->tls_service_key && nsd.options->tls_service_key[0]
 	   && nsd.options->tls_service_pem && nsd.options->tls_service_pem[0]) {
+		/* normal tls port with no client authentication */
 		if(!(nsd.tls_ctx = server_tls_ctx_create(&nsd, NULL,
-			nsd.options->tls_service_ocsp)))
+		     nsd.options->tls_service_ocsp)))
 			error("could not set up tls SSL_CTX");
+		/* tls-auth port with required client authentication */
+		if(nsd.options->tls_auth_port) {
+			if(!(nsd.tls_auth_ctx = server_tls_ctx_create(&nsd,
+			     (char*)nsd.options->tls_cert_bundle,
+			     nsd.options->tls_service_ocsp)))
+				error("could not set up tls SSL_CTX");
+		}
 	}
 #endif /* HAVE_SSL */
 
 
@@ -119,7 +119,8 @@ attribute is used to define keys for authentication. The
 attribute is followed by the zone options for zones that use the pattern.
 A
 .B tls-auth:
-attribute is used to define credentials for authenticating an outgoing TLS connection used for XFR-over-TLS.
+attribute is used to define authentication attributes for TLS connections used
+for XFR-over-TLS.
 .P
 Files can be included using the
 .B include:
@@ -563,6 +564,34 @@ openssl ocsp -no_nonce \\
 The port number on which to provide TCP TLS service, default is 853, only
 interfaces configured with that port number as @number get DNS over TLS service.
 .TP
+.B tls\-auth\-port:\fR <number>
+The port number on which to provide TCP TLS service to authenticated clients only.
+If you want to use mutual TLS authentication in Transfer over TLS (XoT) connections,
+this is where the primary server enables a dedicated port for this purpose. Certificates in
+.BR tls-cert-bundle
+are used for verifying the authenticity of a client or a secondary server.
+.IP
+Client (secondary) must enable
+.BR tls-auth ,
+configure
+.BR client-cert
+and
+.BR client-key
+and enable
+.BR tls-auth
+in zone configuration in order to authenticate to a remote (primary) server.
+.TP
+.B tls\-auth\-xfr\-only:\fR <yes or no>
+Allow zone transfers only on the
+.BR tls-auth-port
+port and only to authenticated clients. This works globally for all zones.
+A
+.BR provide-xfr
+access control list with
+.BR tls-auth
+is also required to allow and verify a connection.
+Requests for zone transfers on other ports are refused.
+.TP
 .B tls\-cert\-bundle:\fR <filename>
 If null or "", the default verify locations are used. Set it to the certificate
 bundle file, for example "/etc/pki/tls/certs/ca-bundle.crt". These certificates
@@ -852,8 +881,8 @@ Kaminsky\-style attacks. If the UDP option is left out then IXFR will be
 transmitted using TCP.
 .P
 If a tls-auth-name is given then TLS (by default on port 853) will be used
-for all zone transfers for the zone. If authentication of the primary based on
-the specified tls-auth authentication information fails, the XFR request will
+for all zone transfers for the zone. If authentication of the primary, based on
+the specified tls-auth authentication information, fails the XFR request will
 not be sent. Support for TLS 1.3 is required for XFR-over-TLS.
 .RE
 .TP
@@ -877,7 +906,7 @@ time).
 This option should be accompanied by notify. It sets the number of retries
 when sending notifies.
 .TP
-.B provide\-xfr:\fR <ip\-spec> <key\-name | NOKEY | BLOCKED>
+.B provide\-xfr:\fR <ip\-spec> <key\-name | NOKEY | BLOCKED> [tls\-auth\-name]
 Access control list. The listed address (a secondary) is allowed to
 request XFR from this server. Zone data will be provided to the
 address. The specified key is used during XFR. For unlisted or
@@ -892,6 +921,25 @@ a subnet of the form 1.2.3.4/24, or masked like
 A port number can be added using a suffix of @number, for example
 1.2.3.4@5300 or 1.2.3.4/24@5300 for port 5300. Note the ip\-spec
 ranges do not use spaces around the /, &, @ and \- symbols.
+.P
+If a tls-auth-name is given then TLS authentication of the secondary will be performed
+for zone transfer requests for the zone. The remote end must connect to the
+.BR tls-auth-port
+and must present a certificate with a
+SAN (Subject Alternative Name) DNS entry or CN (Common Name) entry equal to
+.BR auth-domain-name
+of the defined
+.BR tls-auth .
+The certificate validify is also verified with
+.BR tls-cert-bundle .
+If authentication of the secondary, based on the specified tls-auth authentication
+information, fails the XFR zone transfer will be refused. If the connection is performed
+on the
+.BR tls-port
+then no authentication will be performed and the transfer will not be refused.
+To enforce only authenticated zone transfers,
+.BR tls-auth-xfr-only
+should also be enabled. Support for TLS 1.3 is required for XFR-over-TLS.
 .RE
 .TP
 .B outgoing\-interface:\fR <ip\-address>
@@ -1083,16 +1131,21 @@ dev-random output through a base64 encode filter.
 .SS "TLS Auth Declarations"
 The
 .B tls-auth:
-clause establishes authentication attributes to use when authenticating
-the far end of an outgoing TLS connection used in access control lists for XFR-over-TLS.
-It has the following attributes.
+clause establishes attributes to use when authenticating the far end of a TLS connection
+as well as to define credentials to authenticate to a remote server. It is used in
+access control lists for XFR-over-TLS. It has the following attributes.
 .TP
 .B name:\fR <string>
 The tls-auth name. Used to refer to this TLS authentication information in the
 access control list.
 .TP
 .B auth\-domain\-name:\fR <string>
-The authentication domain name as defined in RFC8310.
+The authentication domain name as defined in RFC8310. Used to verify the certificate
+of the remote connecting server. When used by a primary server in
+.BR provide-xfr
+it verifies the secondary. When used by a secondary server in
+.BR request-xfr
+it verifies the primary.
 .TP
 .B client\-cert: <file name of clientcert.pem>
 If you want to use mutual TLS authentication, this is where the client
 
@@ -256,6 +256,18 @@ server:
 	# tls-service-ocsp: "path/to/ocsp.pem"
 	# tls-port: 853
 
+	# Provides a dedidated TLS port where only authenticated clients can
+	# connect. Used for zone transfers to secondary servers. It uses
+	# tls-service-key and tls-service-pem and verifies client certificates
+	# using tls-cert-bundle.
+	# Default is "" (disabled). Requires restart to take effect.
+	# tls-auth-port: 8853
+
+	# Allow zone transfers only on the tls-auth-port port and only to
+	# authenticated clients. Requests for zone transfers on other ports
+	# are refused. Default is no. Requires restart to change it.
+	# tls-auth-xfr-only: yes
+
 	# Certificates used to authenticate connections made upstream for
 	# Transfers over TLS (XoT). Default is "" (default verify locations).
 	# tls-cert-bundle: "path/to/ca-bundle.pem"
 
@@ -374,6 +374,7 @@ struct	nsd
 #ifdef HAVE_SSL
 	/* TLS specific configuration */
 	SSL_CTX *tls_ctx;
+	SSL_CTX *tls_auth_ctx;
 #endif
 };