Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-08 19:45:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

core/dnsserver: make TsigSecret public (#8434)

Browse Source 
NewServer aggregates secrets from all assigned sites and the final value
can only be reached by plugins via dnsserver.Server

Signed-off-by: Ilya Kulakov <kulakov.ilya@gmail.com>
This commit is contained in:
Ilya Kulakov
2026-09-15 20:02:49 -07:00
committed by GitHub
parent 14ed42bd1f
commit 1e550ac71a
9 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
core/dnsserver/server.go
View File

@@ -75,11 +75,12 @@ import (
// the same address and the listener may be stopped for
// graceful termination (POSIX only).
type Server struct {
Addr string // Address we listen on
IdleTimeout time.Duration // Idle timeout for connection-oriented transports
ReadTimeout time.Duration // Read timeout for connection-oriented transports
WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it
MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited.
Addr string // Address we listen on
IdleTimeout time.Duration // Idle timeout for connection-oriented transports
ReadTimeout time.Duration // Read timeout for connection-oriented transports
WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it
MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited.
TsigSecret map[string]string // TSIG secrets of all served zones; must not be modified as it's concurrently accessed by DNS server.
connPolicy proxyproto.ConnPolicyFunc // Proxy Protocol connection policy function
udpSessionTrackingTTL time.Duration // TTL for UDP PPv2 session tracking (0 = disabled)
@@ -95,7 +96,6 @@ type Server struct {
stacktrace bool // enable stacktrace in recover error log
classChaos bool // allow non-INET class queries
tsigSecret map[string]string
allowedOpcodes map[int]struct{}
// udpDecorateWriterFunc is selected in NewServer from the group configs in
@@ -124,7 +124,7 @@ func NewServer(addr string, group []*Config) (*Server, error) {
ReadTimeout: 3 * time.Second,
WriteTimeout: 5 * time.Second,
MaxTCPQueries: tcpMaxQueries,
tsigSecret: make(map[string]string),
TsigSecret: make(map[string]string),
allowedOpcodes: make(map[int]struct{}),
}
@@ -153,7 +153,7 @@ func NewServer(addr string, group []*Config) (*Server, error) {
}
// copy tsig secrets
maps.Copy(s.tsigSecret, site.TsigSecret)
maps.Copy(s.TsigSecret, site.TsigSecret)
maps.Copy(s.allowedOpcodes, site.allowedOpcodes)
// compile custom plugin for everything
@@ -215,7 +215,7 @@ func (s *Server) Serve(l net.Listener) error {
s.server[tcp] = &dns.Server{Listener: l,
Net: "tcp",
TsigSecret: s.tsigSecret,
TsigSecret: s.TsigSecret,
MsgAcceptFunc: s.msgAcceptFunc(),
MaxTCPQueries: s.MaxTCPQueries,
ReadTimeout: s.ReadTimeout,
@@ -247,7 +247,7 @@ func (s *Server) ServePacket(p net.PacketConn) error {
ctx := context.WithValue(context.Background(), Key{}, s)
ctx = context.WithValue(ctx, LoopKey{}, 0)
s.ServeDNS(ctx, w, r)
}), TsigSecret: s.tsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw}
}), TsigSecret: s.TsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw}
s.m.Unlock()
return s.server[udp].ActivateAndServe()

4
core/dnsserver/server_grpc.go
View File

@@ -196,9 +196,9 @@ func (s *ServergRPC) Query(ctx context.Context, in *pb.DnsPacket) (*pb.DnsPacket
w := &gRPCresponse{localAddr: s.listenAddr, remoteAddr: a, Msg: msg}
if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
if s.TsigSecret == nil {
w.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
} else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
w.tsigStatus = dns.ErrSecret
} else {
w.tsigStatus = dns.TsigVerify(in.GetMsg(), secret, "", false)

6
core/dnsserver/server_grpc_test.go
View File

@@ -516,7 +516,7 @@ func TestServergRPC_Query_TSIGBadSigSetsTsigStatus(t *testing.T) {
t.Fatalf("NewServergRPC() failed: %v", err)
}
server.tsigSecret = map[string]string{
server.TsigSecret = map[string]string{
keyName: serverSecret,
}
@@ -563,7 +563,7 @@ func TestServergRPC_Query_TSIGBadTimeSetsTsigStatus(t *testing.T) {
t.Fatalf("NewServergRPC() failed: %v", err)
}
server.tsigSecret = map[string]string{
server.TsigSecret = map[string]string{
keyName: secret,
}
@@ -610,7 +610,7 @@ func TestServergRPC_Query_TSIGValidLeavesTsigStatusNil(t *testing.T) {
t.Fatalf("NewServergRPC() failed: %v", err)
}
server.tsigSecret = map[string]string{
server.TsigSecret = map[string]string{
keyName: secret,
}

4
core/dnsserver/server_https.go
View File

@@ -234,9 +234,9 @@ func (s *ServerHTTPS) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
if s.TsigSecret == nil {
dw.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
} else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
dw.tsigStatus = dns.ErrSecret
} else {
dw.tsigStatus = dns.TsigVerify(raw, secret, "", false)

4
core/dnsserver/server_https3.go
View File

@@ -251,9 +251,9 @@ func (s *ServerHTTPS3) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
if s.TsigSecret == nil {
dw.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
} else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
dw.tsigStatus = dns.ErrSecret
} else {
dw.tsigStatus = dns.TsigVerify(raw, secret, "", false)

4
core/dnsserver/server_quic.go
View File

@@ -269,9 +269,9 @@ func (s *ServerQUIC) serveQUICStream(stream *quic.Stream, conn *quic.Conn) {
}
if tsig := req.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
if s.TsigSecret == nil {
w.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
} else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
w.tsigStatus = dns.ErrSecret
} else {
w.tsigStatus = dns.TsigVerify(buf, secret, "", false)

4
core/dnsserver/server_quic_test.go
View File

@@ -491,7 +491,7 @@ func TestServerQUIC_ServeQUIC_TSIGBadSigSetsTsigStatus(t *testing.T) {
t.Fatalf("NewServerQUIC() failed: %v", err)
}
server.tsigSecret = map[string]string{
server.TsigSecret = map[string]string{
keyName: serverSecret,
}
@@ -814,7 +814,7 @@ func TestServerQUIC_ServeQUIC_TSIGValidSigLeavesTsigStatusNil(t *testing.T) {
t.Fatalf("NewServerQUIC() failed: %v", err)
}
server.tsigSecret = map[string]string{
server.TsigSecret = map[string]string{
keyName: secret,
}

2
core/dnsserver/server_tls.go
View File

@@ -54,7 +54,7 @@ func (s *ServerTLS) Serve(l net.Listener) error {
// Only fill out the TCP server for this one.
s.server[tcp] = &dns.Server{Listener: l,
Net: "tcp-tls",
TsigSecret: s.tsigSecret,
TsigSecret: s.TsigSecret,
MsgAcceptFunc: s.msgAcceptFunc(),
MaxTCPQueries: s.MaxTCPQueries,
ReadTimeout: s.ReadTimeout,

2
core/dnsserver/server_tls_test.go
View File

@@ -35,7 +35,7 @@ func TestServerTLSSetsTsigSecret(t *testing.T) {
t.Fatalf("NewServerTLS() failed: %v", err)
}
server.tsigSecret = map[string]string{
server.TsigSecret = map[string]string{
"test.": "abcd",
}