Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-08-27 23:27:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/tsig: expose validated TSIG key identity (#8471)

Browse Source 
Store the normalized key name in the request context only after successful TSIG verification. This lets downstream plugins distinguish unsigned requests from authenticated requests and authorize by key without relying on the stripped TSIG RR or exposing secret material.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
This commit is contained in:
houyuwushang
2026-08-27 05:13:48 +08:00
committed by GitHub
parent ff06b2a593
commit 789b8d1665
4 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
plugin/tsig/README.md
View File

@@ -12,6 +12,10 @@ respective plugins sending those requests to sign them using the keys defined by
The *tsig* plugin can also require that incoming requests be signed for certain query types, refusing requests that do not comply.
After successfully validating a TSIG record, the plugin adds the normalized key name to the request context. Downstream Go
plugins can call `tsig.ValidatedKeyName(ctx)` to retrieve the key name and distinguish validated requests from unsigned
requests. The value is not set for requests outside the configured zones because the *tsig* plugin does not validate them.
## Syntax
~~~