From 1e550ac71ac0326ae5a30f9aa3d17475fa105f71 Mon Sep 17 00:00:00 2001 From: Ilya Kulakov Date: Tue, 15 Sep 2026 20:02:49 -0700 Subject: [PATCH] core/dnsserver: make TsigSecret public (#8434) NewServer aggregates secrets from all assigned sites and the final value can only be reached by plugins via dnsserver.Server Signed-off-by: Ilya Kulakov --- core/dnsserver/server.go | 20 ++++++++++---------- core/dnsserver/server_grpc.go | 4 ++-- core/dnsserver/server_grpc_test.go | 6 +++--- core/dnsserver/server_https.go | 4 ++-- core/dnsserver/server_https3.go | 4 ++-- core/dnsserver/server_quic.go | 4 ++-- core/dnsserver/server_quic_test.go | 4 ++-- core/dnsserver/server_tls.go | 2 +- core/dnsserver/server_tls_test.go | 2 +- 9 files changed, 25 insertions(+), 25 deletions(-) diff --git a/core/dnsserver/server.go b/core/dnsserver/server.go index 9bb1bfaef..372001805 100644 --- a/core/dnsserver/server.go +++ b/core/dnsserver/server.go @@ -75,11 +75,12 @@ import ( // the same address and the listener may be stopped for // graceful termination (POSIX only). type Server struct { - Addr string // Address we listen on - IdleTimeout time.Duration // Idle timeout for connection-oriented transports - ReadTimeout time.Duration // Read timeout for connection-oriented transports - WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it - MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited. + Addr string // Address we listen on + IdleTimeout time.Duration // Idle timeout for connection-oriented transports + ReadTimeout time.Duration // Read timeout for connection-oriented transports + WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it + MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited. + TsigSecret map[string]string // TSIG secrets of all served zones; must not be modified as it's concurrently accessed by DNS server. connPolicy proxyproto.ConnPolicyFunc // Proxy Protocol connection policy function udpSessionTrackingTTL time.Duration // TTL for UDP PPv2 session tracking (0 = disabled) @@ -95,7 +96,6 @@ type Server struct { stacktrace bool // enable stacktrace in recover error log classChaos bool // allow non-INET class queries - tsigSecret map[string]string allowedOpcodes map[int]struct{} // udpDecorateWriterFunc is selected in NewServer from the group configs in @@ -124,7 +124,7 @@ func NewServer(addr string, group []*Config) (*Server, error) { ReadTimeout: 3 * time.Second, WriteTimeout: 5 * time.Second, MaxTCPQueries: tcpMaxQueries, - tsigSecret: make(map[string]string), + TsigSecret: make(map[string]string), allowedOpcodes: make(map[int]struct{}), } @@ -153,7 +153,7 @@ func NewServer(addr string, group []*Config) (*Server, error) { } // copy tsig secrets - maps.Copy(s.tsigSecret, site.TsigSecret) + maps.Copy(s.TsigSecret, site.TsigSecret) maps.Copy(s.allowedOpcodes, site.allowedOpcodes) // compile custom plugin for everything @@ -215,7 +215,7 @@ func (s *Server) Serve(l net.Listener) error { s.server[tcp] = &dns.Server{Listener: l, Net: "tcp", - TsigSecret: s.tsigSecret, + TsigSecret: s.TsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), MaxTCPQueries: s.MaxTCPQueries, ReadTimeout: s.ReadTimeout, @@ -247,7 +247,7 @@ func (s *Server) ServePacket(p net.PacketConn) error { ctx := context.WithValue(context.Background(), Key{}, s) ctx = context.WithValue(ctx, LoopKey{}, 0) s.ServeDNS(ctx, w, r) - }), TsigSecret: s.tsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw} + }), TsigSecret: s.TsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw} s.m.Unlock() return s.server[udp].ActivateAndServe() diff --git a/core/dnsserver/server_grpc.go b/core/dnsserver/server_grpc.go index 972a3b2c0..d23cc25cf 100644 --- a/core/dnsserver/server_grpc.go +++ b/core/dnsserver/server_grpc.go @@ -196,9 +196,9 @@ func (s *ServergRPC) Query(ctx context.Context, in *pb.DnsPacket) (*pb.DnsPacket w := &gRPCresponse{localAddr: s.listenAddr, remoteAddr: a, Msg: msg} if tsig := msg.IsTsig(); tsig != nil { - if s.tsigSecret == nil { + if s.TsigSecret == nil { w.tsigStatus = dns.ErrSecret - } else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { + } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok { w.tsigStatus = dns.ErrSecret } else { w.tsigStatus = dns.TsigVerify(in.GetMsg(), secret, "", false) diff --git a/core/dnsserver/server_grpc_test.go b/core/dnsserver/server_grpc_test.go index 65424e6c5..b22dd99ad 100644 --- a/core/dnsserver/server_grpc_test.go +++ b/core/dnsserver/server_grpc_test.go @@ -516,7 +516,7 @@ func TestServergRPC_Query_TSIGBadSigSetsTsigStatus(t *testing.T) { t.Fatalf("NewServergRPC() failed: %v", err) } - server.tsigSecret = map[string]string{ + server.TsigSecret = map[string]string{ keyName: serverSecret, } @@ -563,7 +563,7 @@ func TestServergRPC_Query_TSIGBadTimeSetsTsigStatus(t *testing.T) { t.Fatalf("NewServergRPC() failed: %v", err) } - server.tsigSecret = map[string]string{ + server.TsigSecret = map[string]string{ keyName: secret, } @@ -610,7 +610,7 @@ func TestServergRPC_Query_TSIGValidLeavesTsigStatusNil(t *testing.T) { t.Fatalf("NewServergRPC() failed: %v", err) } - server.tsigSecret = map[string]string{ + server.TsigSecret = map[string]string{ keyName: secret, } diff --git a/core/dnsserver/server_https.go b/core/dnsserver/server_https.go index 06af08c46..56e775540 100644 --- a/core/dnsserver/server_https.go +++ b/core/dnsserver/server_https.go @@ -234,9 +234,9 @@ func (s *ServerHTTPS) ServeHTTP(w http.ResponseWriter, r *http.Request) { } if tsig := msg.IsTsig(); tsig != nil { - if s.tsigSecret == nil { + if s.TsigSecret == nil { dw.tsigStatus = dns.ErrSecret - } else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { + } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok { dw.tsigStatus = dns.ErrSecret } else { dw.tsigStatus = dns.TsigVerify(raw, secret, "", false) diff --git a/core/dnsserver/server_https3.go b/core/dnsserver/server_https3.go index 205d29995..56c1bb862 100644 --- a/core/dnsserver/server_https3.go +++ b/core/dnsserver/server_https3.go @@ -251,9 +251,9 @@ func (s *ServerHTTPS3) ServeHTTP(w http.ResponseWriter, r *http.Request) { } if tsig := msg.IsTsig(); tsig != nil { - if s.tsigSecret == nil { + if s.TsigSecret == nil { dw.tsigStatus = dns.ErrSecret - } else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { + } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok { dw.tsigStatus = dns.ErrSecret } else { dw.tsigStatus = dns.TsigVerify(raw, secret, "", false) diff --git a/core/dnsserver/server_quic.go b/core/dnsserver/server_quic.go index a2357bcfa..102ac83b6 100644 --- a/core/dnsserver/server_quic.go +++ b/core/dnsserver/server_quic.go @@ -269,9 +269,9 @@ func (s *ServerQUIC) serveQUICStream(stream *quic.Stream, conn *quic.Conn) { } if tsig := req.IsTsig(); tsig != nil { - if s.tsigSecret == nil { + if s.TsigSecret == nil { w.tsigStatus = dns.ErrSecret - } else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { + } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok { w.tsigStatus = dns.ErrSecret } else { w.tsigStatus = dns.TsigVerify(buf, secret, "", false) diff --git a/core/dnsserver/server_quic_test.go b/core/dnsserver/server_quic_test.go index d15164358..b40e9adcb 100644 --- a/core/dnsserver/server_quic_test.go +++ b/core/dnsserver/server_quic_test.go @@ -491,7 +491,7 @@ func TestServerQUIC_ServeQUIC_TSIGBadSigSetsTsigStatus(t *testing.T) { t.Fatalf("NewServerQUIC() failed: %v", err) } - server.tsigSecret = map[string]string{ + server.TsigSecret = map[string]string{ keyName: serverSecret, } @@ -814,7 +814,7 @@ func TestServerQUIC_ServeQUIC_TSIGValidSigLeavesTsigStatusNil(t *testing.T) { t.Fatalf("NewServerQUIC() failed: %v", err) } - server.tsigSecret = map[string]string{ + server.TsigSecret = map[string]string{ keyName: secret, } diff --git a/core/dnsserver/server_tls.go b/core/dnsserver/server_tls.go index d3696870f..3607f4aeb 100644 --- a/core/dnsserver/server_tls.go +++ b/core/dnsserver/server_tls.go @@ -54,7 +54,7 @@ func (s *ServerTLS) Serve(l net.Listener) error { // Only fill out the TCP server for this one. s.server[tcp] = &dns.Server{Listener: l, Net: "tcp-tls", - TsigSecret: s.tsigSecret, + TsigSecret: s.TsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), MaxTCPQueries: s.MaxTCPQueries, ReadTimeout: s.ReadTimeout, diff --git a/core/dnsserver/server_tls_test.go b/core/dnsserver/server_tls_test.go index 28e770edb..d52471dea 100644 --- a/core/dnsserver/server_tls_test.go +++ b/core/dnsserver/server_tls_test.go @@ -35,7 +35,7 @@ func TestServerTLSSetsTsigSecret(t *testing.T) { t.Fatalf("NewServerTLS() failed: %v", err) } - server.tsigSecret = map[string]string{ + server.TsigSecret = map[string]string{ "test.": "abcd", }