Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-08-27 23:27:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/tsig: expose validated TSIG key identity (#8471)

Browse Source 
Store the normalized key name in the request context only after successful TSIG verification. This lets downstream plugins distinguish unsigned requests from authenticated requests and authorize by key without relying on the stripped TSIG RR or exposing secret material.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
This commit is contained in:
houyuwushang
2026-08-27 05:13:48 +08:00
committed by GitHub
parent ff06b2a593
commit 789b8d1665
4 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
plugin/tsig/tsig.go
View File

@@ -71,6 +71,7 @@ func (t *TSIGServer) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.
}
tsigRR.Error = dns.RcodeSuccess
ctx = withValidatedKeyName(ctx, plugin.Name(tsigRR.Hdr.Name).Normalize())
rcode, err := plugin.NextOrFailure(t.Name(), t.Next, ctx, w, r)
if err != nil {
log.Errorf("request handler returned an error: %v\n", err)