Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-19 16:55:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/tsig: reject non-final TSIG records (#8585)

Browse Source 
This PR returns FORMERR before dispatching requests that contain a non-final TSIG.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This commit is contained in:
Yong Tang
2026-09-29 20:32:06 -07:00
committed by GitHub
parent 6ad382b53d
commit 9fbbdd2698
2 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
plugin/tsig/tsig.go
View File

@@ -32,6 +32,14 @@ func (t TSIGServer) Name() string { return pluginName }
// ServeDNS implements plugin.Handler
func (t *TSIGServer) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
for i, rr := range r.Extra {
if rr.Header().Rrtype == dns.TypeTSIG && i != len(r.Extra)-1 {
resp := new(dns.Msg).SetRcode(r, dns.RcodeFormatError)
w.WriteMsg(resp)
return dns.RcodeSuccess, nil
}
}
var (
state = request.Request{Req: r, W: w}
tsigRR = r.IsTsig()