Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-17 15:55:47 -04:00
Code Issues Packages Projects Releases Wiki Activity

core: Reject conflicting TLS policies on shared listeners. (#8565)

Browse Source 
* core: Reject conflicting TLS policies on shared listeners.

This PR tries to fix the issue when multiple zones share a DoT listener, CoreDNS can apply one sibling block’s tls.Config to all zones, allowing weaker TLS or client-auth settings to override a stricter zone.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix ACME

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This commit is contained in:
Yong Tang
2026-09-21 23:56:27 -07:00
committed by GitHub
parent 559e57ec55
commit 8d66643935
12 changed files with 308 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/dnsserver/register.go
View File

@@ -298,8 +298,10 @@ func propagateConfigParams(configs []*Config) {
c.Stacktrace = c.firstConfigInBlock.Stacktrace
c.NumSockets = c.firstConfigInBlock.NumSockets
// Fork TLSConfig for each encrypted connection
// Fork TLSConfig for each encrypted connection while preserving the
// listener-wide policy identity used to compare dynamic callbacks.
c.TLSConfig = c.firstConfigInBlock.TLSConfig.Clone()
c.tlsConfigIdentity = c.firstConfigInBlock.tlsConfigIdentity
c.ReadTimeout = c.firstConfigInBlock.ReadTimeout
c.WriteTimeout = c.firstConfigInBlock.WriteTimeout
c.IdleTimeout = c.firstConfigInBlock.IdleTimeout