Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-08-27 23:27:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/tsig: expose validated TSIG key identity (#8471)

Browse Source 
Store the normalized key name in the request context only after successful TSIG verification. This lets downstream plugins distinguish unsigned requests from authenticated requests and authorize by key without relying on the stripped TSIG RR or exposing secret material.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
This commit is contained in:
houyuwushang
2026-08-27 05:13:48 +08:00
committed by GitHub
parent ff06b2a593
commit 789b8d1665
4 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
plugin/tsig/tsig_test.go
View File

@@ -329,6 +329,8 @@ func TestServeDNSTsigNext(t *testing.T) {
reqSigned bool
expectExtra []uint16
expectNext int
expectValid bool
expectKey string
}{
{
desc: "Optional TSIG",
@@ -338,6 +340,7 @@ func TestServeDNSTsigNext(t *testing.T) {
reqSigned: false,
expectExtra: []uint16{dns.TypeOPT},
expectNext: 1,
expectValid: false,
},
{
desc: "Missing TSIG",
@@ -355,6 +358,7 @@ func TestServeDNSTsigNext(t *testing.T) {
reqSigned: true,
expectExtra: []uint16{dns.TypeOPT, dns.TypeTSIG},
expectNext: 1,
expectValid: false,
},
{
desc: "Bad Status",
@@ -373,6 +377,8 @@ func TestServeDNSTsigNext(t *testing.T) {
reqSigned: true,
expectExtra: []uint16{dns.TypeOPT},
expectNext: 1,
expectValid: true,
expectKey: "test.key.",
},
}
@@ -385,6 +391,13 @@ func TestServeDNSTsigNext(t *testing.T) {
allTypes: tc.tsigRequired,
Next: test.HandlerFunc(func(_ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
nextCalled++
keyName, validated := ValidatedKeyName(_ctx)
if validated != tc.expectValid {
t.Errorf("ValidatedKeyName() validated = %t, want %t", validated, tc.expectValid)
}
if keyName != tc.expectKey {
t.Errorf("ValidatedKeyName() name = %q, want %q", keyName, tc.expectKey)
}
if !slices.EqualFunc(r.Extra, tc.expectExtra, func(rr dns.RR, t uint16) bool { return rr.Header().Rrtype == t }) {
t.Errorf("expected %v, got %v", tc.expectExtra, r.Extra)
}
@@ -400,7 +413,7 @@ func TestServeDNSTsigNext(t *testing.T) {
r.SetQuestion("test.example.", dns.TypeA)
r.Extra = tc.reqExtra
if tc.reqSigned {
r.SetTsig("test.key.", dns.HmacSHA256, 300, time.Now().Unix())
r.SetTsig("TEST.Key", dns.HmacSHA256, 300, time.Now().Unix())
}
_, err := tsig.ServeDNS(ctx, w, r)