Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-06-15 13:40:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/dnssec: sign each RRset with the zone that owns its name, not the query zone (#8138)

Browse Source 
Signed-off-by: Björn Kinscher <code@bjoern-kinscher.de>
Co-authored-by: Björn Kinscher <code@bjoern-kinscher.de>
This commit is contained in:
Isolus
2026-06-06 03:36:28 +02:00
committed by GitHub
parent 3718f0cc81
commit b49fe2d469
2 changed files with 111 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
plugin/dnssec/dnssec.go
View File

@@ -93,21 +93,34 @@ func (d Dnssec) Sign(state request.Request, now time.Time, server string) *dns.M
return req
}
zones := plugin.Zones(d.zones) // only sign if CNAME is not outside of our zones
for _, r := range rrSets(req.Answer) {
signer := zones.Matches(r[0].Header().Name)
if signer == "" {
continue
}
ttl := r[0].Header().Ttl
if sigs, err := d.sign(r, state.Zone, ttl, incep, expir, server); err == nil {
if sigs, err := d.sign(r, signer, ttl, incep, expir, server); err == nil {
req.Answer = append(req.Answer, sigs...)
}
}
for _, r := range rrSets(req.Ns) {
signer := zones.Matches(r[0].Header().Name)
if signer == "" {
continue
}
ttl := r[0].Header().Ttl
if sigs, err := d.sign(r, state.Zone, ttl, incep, expir, server); err == nil {
if sigs, err := d.sign(r, signer, ttl, incep, expir, server); err == nil {
req.Ns = append(req.Ns, sigs...)
}
}
for _, r := range rrSets(req.Extra) {
signer := zones.Matches(r[0].Header().Name)
if signer == "" {
continue
}
ttl := r[0].Header().Ttl
if sigs, err := d.sign(r, state.Zone, ttl, incep, expir, server); err == nil {
if sigs, err := d.sign(r, signer, ttl, incep, expir, server); err == nil {
req.Extra = append(req.Extra, sigs...)
}
}