Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-04-23 20:35:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

core: Add full TSIG verification in DoH3 transport (#8044)

Browse Source 
* core: Add full TSIG verification in DoH3 transport

This This PR add full TSIG verification in DoH3 using dns.TsigVerify() - 7943

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This commit is contained in:
Yong Tang
2026-04-21 14:34:21 -07:00
committed by GitHub
parent 8c5ec14e31
commit cf6a78f64d
2 changed files with 199 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
core/dnsserver/server_https3.go
View File

@@ -18,6 +18,7 @@ import (
"github.com/coredns/coredns/plugin/pkg/reuseport"
"github.com/coredns/coredns/plugin/pkg/transport"
"github.com/miekg/dns"
"github.com/quic-go/quic-go"
"github.com/quic-go/quic-go/http3"
)
@@ -172,7 +173,7 @@ func (s *ServerHTTPS3) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
msg, err := doh.RequestToMsg(r)
msg, raw, err := doh.RequestToMsgWire(r)
if err != nil {
http.Error(w, err.Error(), http.StatusBadRequest)
s.countResponse(http.StatusBadRequest)
@@ -188,6 +189,16 @@ func (s *ServerHTTPS3) ServeHTTP(w http.ResponseWriter, r *http.Request) {
request: r,
}
if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
dw.tsigStatus = dns.ErrSecret
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
dw.tsigStatus = dns.ErrSecret
} else {
dw.tsigStatus = dns.TsigVerify(raw, secret, "", false)
}
}
ctx := context.WithValue(r.Context(), Key{}, s.Server)
ctx = context.WithValue(ctx, LoopKey{}, 0)
ctx = context.WithValue(ctx, HTTPRequestKey{}, r)