Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-08 19:45:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

core/dnsserver: make TsigSecret public (#8434)

Browse Source 
NewServer aggregates secrets from all assigned sites and the final value
can only be reached by plugins via dnsserver.Server

Signed-off-by: Ilya Kulakov <kulakov.ilya@gmail.com>
This commit is contained in:
Ilya Kulakov
2026-09-15 20:02:49 -07:00
committed by GitHub
parent 14ed42bd1f
commit 1e550ac71a
9 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/dnsserver/server.go
View File

@@ -80,6 +80,7 @@ type Server struct {
ReadTimeout time.Duration // Read timeout for connection-oriented transports ReadTimeout time.Duration // Read timeout for connection-oriented transports
WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it
MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited. MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited.
TsigSecret map[string]string // TSIG secrets of all served zones; must not be modified as it's concurrently accessed by DNS server.
connPolicy proxyproto.ConnPolicyFunc // Proxy Protocol connection policy function connPolicy proxyproto.ConnPolicyFunc // Proxy Protocol connection policy function
udpSessionTrackingTTL time.Duration // TTL for UDP PPv2 session tracking (0 = disabled) udpSessionTrackingTTL time.Duration // TTL for UDP PPv2 session tracking (0 = disabled)
@@ -95,7 +96,6 @@ type Server struct {
stacktrace bool // enable stacktrace in recover error log stacktrace bool // enable stacktrace in recover error log
classChaos bool // allow non-INET class queries classChaos bool // allow non-INET class queries
tsigSecret map[string]string
allowedOpcodes map[int]struct{} allowedOpcodes map[int]struct{}
// udpDecorateWriterFunc is selected in NewServer from the group configs in // udpDecorateWriterFunc is selected in NewServer from the group configs in
@@ -124,7 +124,7 @@ func NewServer(addr string, group []*Config) (*Server, error) {
ReadTimeout: 3 * time.Second, ReadTimeout: 3 * time.Second,
WriteTimeout: 5 * time.Second, WriteTimeout: 5 * time.Second,
MaxTCPQueries: tcpMaxQueries, MaxTCPQueries: tcpMaxQueries,
tsigSecret: make(map[string]string), TsigSecret: make(map[string]string),
allowedOpcodes: make(map[int]struct{}), allowedOpcodes: make(map[int]struct{}),
} }
@@ -153,7 +153,7 @@ func NewServer(addr string, group []*Config) (*Server, error) {
} }
// copy tsig secrets // copy tsig secrets
maps.Copy(s.tsigSecret, site.TsigSecret) maps.Copy(s.TsigSecret, site.TsigSecret)
maps.Copy(s.allowedOpcodes, site.allowedOpcodes) maps.Copy(s.allowedOpcodes, site.allowedOpcodes)
// compile custom plugin for everything // compile custom plugin for everything
@@ -215,7 +215,7 @@ func (s *Server) Serve(l net.Listener) error {
s.server[tcp] = &dns.Server{Listener: l, s.server[tcp] = &dns.Server{Listener: l,
Net: "tcp", Net: "tcp",
TsigSecret: s.tsigSecret, TsigSecret: s.TsigSecret,
MsgAcceptFunc: s.msgAcceptFunc(), MsgAcceptFunc: s.msgAcceptFunc(),
MaxTCPQueries: s.MaxTCPQueries, MaxTCPQueries: s.MaxTCPQueries,
ReadTimeout: s.ReadTimeout, ReadTimeout: s.ReadTimeout,
@@ -247,7 +247,7 @@ func (s *Server) ServePacket(p net.PacketConn) error {
ctx := context.WithValue(context.Background(), Key{}, s) ctx := context.WithValue(context.Background(), Key{}, s)
ctx = context.WithValue(ctx, LoopKey{}, 0) ctx = context.WithValue(ctx, LoopKey{}, 0)
s.ServeDNS(ctx, w, r) s.ServeDNS(ctx, w, r)
}), TsigSecret: s.tsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw} }), TsigSecret: s.TsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw}
s.m.Unlock() s.m.Unlock()
return s.server[udp].ActivateAndServe() return s.server[udp].ActivateAndServe()

4
core/dnsserver/server_grpc.go
View File

@@ -196,9 +196,9 @@ func (s *ServergRPC) Query(ctx context.Context, in *pb.DnsPacket) (*pb.DnsPacket
w := &gRPCresponse{localAddr: s.listenAddr, remoteAddr: a, Msg: msg} w := &gRPCresponse{localAddr: s.listenAddr, remoteAddr: a, Msg: msg}
if tsig := msg.IsTsig(); tsig != nil { if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil { if s.TsigSecret == nil {
w.tsigStatus = dns.ErrSecret w.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
w.tsigStatus = dns.ErrSecret w.tsigStatus = dns.ErrSecret
} else { } else {
w.tsigStatus = dns.TsigVerify(in.GetMsg(), secret, "", false) w.tsigStatus = dns.TsigVerify(in.GetMsg(), secret, "", false)

6
core/dnsserver/server_grpc_test.go
View File

@@ -516,7 +516,7 @@ func TestServergRPC_Query_TSIGBadSigSetsTsigStatus(t *testing.T) {
t.Fatalf("NewServergRPC() failed: %v", err) t.Fatalf("NewServergRPC() failed: %v", err)
} }
server.tsigSecret = map[string]string{ server.TsigSecret = map[string]string{
keyName: serverSecret, keyName: serverSecret,
} }
@@ -563,7 +563,7 @@ func TestServergRPC_Query_TSIGBadTimeSetsTsigStatus(t *testing.T) {
t.Fatalf("NewServergRPC() failed: %v", err) t.Fatalf("NewServergRPC() failed: %v", err)
} }
server.tsigSecret = map[string]string{ server.TsigSecret = map[string]string{
keyName: secret, keyName: secret,
} }
@@ -610,7 +610,7 @@ func TestServergRPC_Query_TSIGValidLeavesTsigStatusNil(t *testing.T) {
t.Fatalf("NewServergRPC() failed: %v", err) t.Fatalf("NewServergRPC() failed: %v", err)
} }
server.tsigSecret = map[string]string{ server.TsigSecret = map[string]string{
keyName: secret, keyName: secret,
} }

4
core/dnsserver/server_https.go
View File

@@ -234,9 +234,9 @@ func (s *ServerHTTPS) ServeHTTP(w http.ResponseWriter, r *http.Request) {
} }
if tsig := msg.IsTsig(); tsig != nil { if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil { if s.TsigSecret == nil {
dw.tsigStatus = dns.ErrSecret dw.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
dw.tsigStatus = dns.ErrSecret dw.tsigStatus = dns.ErrSecret
} else { } else {
dw.tsigStatus = dns.TsigVerify(raw, secret, "", false) dw.tsigStatus = dns.TsigVerify(raw, secret, "", false)

4
core/dnsserver/server_https3.go
View File

@@ -251,9 +251,9 @@ func (s *ServerHTTPS3) ServeHTTP(w http.ResponseWriter, r *http.Request) {
} }
if tsig := msg.IsTsig(); tsig != nil { if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil { if s.TsigSecret == nil {
dw.tsigStatus = dns.ErrSecret dw.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
dw.tsigStatus = dns.ErrSecret dw.tsigStatus = dns.ErrSecret
} else { } else {
dw.tsigStatus = dns.TsigVerify(raw, secret, "", false) dw.tsigStatus = dns.TsigVerify(raw, secret, "", false)

4
core/dnsserver/server_quic.go
View File

@@ -269,9 +269,9 @@ func (s *ServerQUIC) serveQUICStream(stream *quic.Stream, conn *quic.Conn) {
} }
if tsig := req.IsTsig(); tsig != nil { if tsig := req.IsTsig(); tsig != nil {
if s.tsigSecret == nil { if s.TsigSecret == nil {
w.tsigStatus = dns.ErrSecret w.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok { } else if secret, ok := s.TsigSecret[tsig.Hdr.Name]; !ok {
w.tsigStatus = dns.ErrSecret w.tsigStatus = dns.ErrSecret
} else { } else {
w.tsigStatus = dns.TsigVerify(buf, secret, "", false) w.tsigStatus = dns.TsigVerify(buf, secret, "", false)

4
core/dnsserver/server_quic_test.go
View File

@@ -491,7 +491,7 @@ func TestServerQUIC_ServeQUIC_TSIGBadSigSetsTsigStatus(t *testing.T) {
t.Fatalf("NewServerQUIC() failed: %v", err) t.Fatalf("NewServerQUIC() failed: %v", err)
} }
server.tsigSecret = map[string]string{ server.TsigSecret = map[string]string{
keyName: serverSecret, keyName: serverSecret,
} }
@@ -814,7 +814,7 @@ func TestServerQUIC_ServeQUIC_TSIGValidSigLeavesTsigStatusNil(t *testing.T) {
t.Fatalf("NewServerQUIC() failed: %v", err) t.Fatalf("NewServerQUIC() failed: %v", err)
} }
server.tsigSecret = map[string]string{ server.TsigSecret = map[string]string{
keyName: secret, keyName: secret,
} }

2
core/dnsserver/server_tls.go
View File

@@ -54,7 +54,7 @@ func (s *ServerTLS) Serve(l net.Listener) error {
// Only fill out the TCP server for this one. // Only fill out the TCP server for this one.
s.server[tcp] = &dns.Server{Listener: l, s.server[tcp] = &dns.Server{Listener: l,
Net: "tcp-tls", Net: "tcp-tls",
TsigSecret: s.tsigSecret, TsigSecret: s.TsigSecret,
MsgAcceptFunc: s.msgAcceptFunc(), MsgAcceptFunc: s.msgAcceptFunc(),
MaxTCPQueries: s.MaxTCPQueries, MaxTCPQueries: s.MaxTCPQueries,
ReadTimeout: s.ReadTimeout, ReadTimeout: s.ReadTimeout,

2
core/dnsserver/server_tls_test.go
View File

@@ -35,7 +35,7 @@ func TestServerTLSSetsTsigSecret(t *testing.T) {
t.Fatalf("NewServerTLS() failed: %v", err) t.Fatalf("NewServerTLS() failed: %v", err)
} }
server.tsigSecret = map[string]string{ server.TsigSecret = map[string]string{
"test.": "abcd", "test.": "abcd",
} }