dnsdist: doq,doh3 make sure we enforce any ACL

[chbruyand]

Short description

This makes sure we enforce ACL in the DOQ and DOH3 paths.

Checklist

I have:

• read the CONTRIBUTING.md document
• compiled this code
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)

[coveralls]

Pull Request Test Coverage Report for Build 7350045492

• 15 of 15 (100.0%) changed or added relevant lines in 2 files are covered.
• 1965 unchanged lines in 37 files lost coverage.
• Overall coverage decreased (-0.08%) to 57.622%

---

Files with Coverage Reduction	New Missed Lines	%
pdns/sodcrypto.cc	1	90.51%
pdns/rcpgenerator.cc	2	89.95%
pdns/recursordist/rec_metrics.hh	2	0.0%
pdns/version.cc	2	89.92%
modules/gpgsqlbackend/spgsql.cc	3	67.7%
modules/lmdbbackend/lmdbbackend.cc	3	72.43%
pdns/epollmplexer.cc	3	80.72%
pdns/iputils.hh	3	74.93%
pdns/recursordist/test-syncres_cc2.cc	3	89.05%
pdns/tsigverifier.cc	3	77.22%

Totals
Change from base Build 7329684697:	-0.08%
Covered Lines:	107562
Relevant Lines:	155335

---

💛 - Coveralls

[rgacogne]

Looks good! I wonder if it would make sense to drop the DoQ connection earlier in the process, before spending CPU time negotiating the key materials?

[chbruyand]

Looks good! I wonder if it would make sense to drop the DoQ connection earlier in the process, before spending CPU time negotiating the key materials?

That would be nice, but I think that if we do so, we cannot properly terminate the connection, but only discard received data ?
Anyway we can indeed do that earlier and avoid some unnecessary processing.

[rgacogne]

Looks good! I wonder if it would make sense to drop the DoQ connection earlier in the process, before spending CPU time negotiating the key materials?

That would be nice, but I think that if we do so, we cannot properly terminate the connection, but only discard received data ? Anyway we can indeed do that earlier and avoid some unnecessary processing.

You are right! Perhaps we could make it optional? I think proper termination is great most of the time, but when you are under attack you might want to just drop DoQ packets not allowed by the ACL.

[rgacogne]

I'm going to merge this because not enforcing the ACL is a clear issue, and we can look for improvements later.