Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-04-10 14:05:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

core: Add full TSIG verification in DoH transport (#8013)

Browse Source 
* core: Add full TSIG verification in DoH transport

This PR add full TSIG verification in DoH using dns.TsigVerify()
7943

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This commit is contained in:
Yong Tang
2026-04-09 05:24:00 -07:00
committed by GitHub
parent 18d692a986
commit c0e6e7cef3
4 changed files with 233 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
core/dnsserver/server_https.go
View File

@@ -19,6 +19,7 @@ import (
"github.com/coredns/coredns/plugin/pkg/reuseport"
"github.com/coredns/coredns/plugin/pkg/transport"
"github.com/miekg/dns"
"github.com/pires/go-proxyproto"
"golang.org/x/net/netutil"
)
@@ -192,7 +193,7 @@ func (s *ServerHTTPS) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
msg, err := doh.RequestToMsg(r)
msg, raw, err := doh.RequestToMsgWire(r)
if err != nil {
http.Error(w, err.Error(), http.StatusBadRequest)
s.countResponse(http.StatusBadRequest)
@@ -208,6 +209,16 @@ func (s *ServerHTTPS) ServeHTTP(w http.ResponseWriter, r *http.Request) {
request: r,
}
if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
dw.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
dw.tsigStatus = dns.ErrSecret
} else {
dw.tsigStatus = dns.TsigVerify(raw, secret, "", false)
}
}
// We just call the normal chain handler - all error handling is done there.
// We should expect a packet to be returned that we can send to the client.