Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-07-10 09:40:12 -04:00
Code Issues Packages Projects Releases Wiki Activity
4,887 Commits 11 Branches 84 Tags
5cab9853cd80e5a996489a23de17c97cc7ecc944
Commit Graph

1543 Commits

Author SHA1 Message Date
Immanuel Tikhonov
5cab9853cd fix(auto): keep first matching zone file for duplicate origins (#8216) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-07-09 17:43:07 -07:00
houyuwushang
1e01c0ad7c plugin/secondary: serve catalog member zones (#8230) 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-07-09 17:42:30 -07:00
Filippo125
e4990abfa3 feat(forward): add source_address directive (#8011) 
* fix(dnssec): avoid caching empty signing results (#7996)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* save only

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* do #8008

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Fix Address used if tcp

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Fix bad using of dialer type

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* core: Add full TSIG verification in gRPC transport (#8006)

* core: Add full TSIG verification in gRPC transport

This PR add full TSIG verification in gRPC using dns.TsigVerify() so invalid signatures and timestamps are correctly detected instead of only checking key presence.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* core: Add full TSIG verification in QUIC transport (#8007)

* core: Add full TSIG verification in QUIC transport

This PR add full TSIG verification in QUIC using dns.TsigVerify()

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(test): deduplicate TSIG test helpers (#8009)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(dnssec): return nil sigs on sign error (#7999)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(dnssec): return nil from ParseKeyFile on error (#8000)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(dnsserver): allow view server blocks in any declaration order (#8001)

When using the view plugin, filtered and unfiltered server blocks can
share the same zone and port. The zone overlap validation rejected this
configuration when the unfiltered block was not declared last, because
filtered configs treated an already-registered zone as an error.

Skip the 'already defined' check for configs that have filter functions,
since they are expected to coexist with an unfiltered catch-all block on
the same zone/port.

Fixes #7733

Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com>
Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(doh): use per-connection local address for PROXY protocol (#8005)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(transfer): batch AXFR records by message size instead of count (#8002)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix(tls): use temp dir for keylog test path (#8010)

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Rename local_address option to source_address

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Rename local_address also in readme
Add test

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Resolve change request in pr

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix ci lint

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Improve doc on source_address routing needs

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Remove added timeout

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* add use of source address also for health check query

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* remove untrailing newline from health_test.go

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix file format

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Update plugin/forward/setup_test.go

Co-authored-by: Ville Vesilehto <ville@vesilehto.fi>
Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Remove dead code in TestHealthLocalAddress

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Fix misspelling

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* Try to set default timeout

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

* fix format in health.go

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>

---------

Signed-off-by: Filippo <filippo.ferrazini@gmail.com>
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com>
Co-authored-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Yong Tang <yong.tang.github@outlook.com>
Co-authored-by: Umut Polat <52835619+umut-polat@users.noreply.github.com>
Co-authored-by: Cedric Wang <wangzongqi@msn.com>
 2026-07-09 17:38:22 -07:00
Ilya Kulakov
540e2f325f plugin/tsig: don't echo client's TSIG.Error if verification is successful (#8215) 2026-07-09 15:04:23 -07:00
Ville Vesilehto
0ebe4da2b0 docs(timeouts): document DoQ read timeout (#8263) 2026-07-09 15:01:59 -07:00
Pavel Lazureykis
974d693e6f plugin/dnstap: fix self-deadlock in listener broadcast on client flush error (#8260) 
listener.Dnstap holds clientsMu.RLock() while iterating connected sink
clients. In the flush-error branch it called removeClient(c) synchronously,
but removeClient takes clientsMu.Lock(). A sync.RWMutex is not reentrant, so
the goroutine blocks forever waiting to acquire the write lock it can never
get while holding the read lock. The queued Lock() then blocks every
subsequent Dnstap broadcast and close(), and the goroutine leaks.

A flush error is the normal failure mode for a slow or disconnected sink
client (writeMsg buffers into framestream and succeeds; flush does the real
socket write and fails), so a single misbehaving client wedged the whole
listen path. Because Dnstap runs inline in the request-serving goroutine via
TapMessageWithMetadata, this could cascade into stalled request handling.

The write-error branch one line up already offloaded with `go removeClient(c)`.
Do the same in the flush-error branch and drop the early return so the
broadcast still reaches the remaining clients.

Assisted-by: Claude Opus 4.8

Signed-off-by: Pavel Lazureykis <pavel@lazureykis.dev>
 2026-07-09 20:43:35 +03:00
Yong Tang
ab318db7b4 plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS record (#8207) 
This PR fixes panic in CoreDNS transfer plugin caused by empty DNS record.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-07-09 20:21:45 +03:00
Pavel Lazureykis
7df9238255 plugin/kubernetes: fix AXFR panic when nsAddrs returns multiple records (#8256) 2026-07-09 01:45:30 -07:00
Pavel Lazureykis
9bf5de8e92 plugin/hosts: fix data race between lookups and reload (#8253) 
LookupStaticHostV4/V6 dereferenced h.hmap and h.inline as call arguments,
which are evaluated before lookupStaticHostFamily takes the read lock. The
reload path (readHosts) swaps h.hmap under h.Lock() on every reload, so the
field read raced the swap for every A/AAAA lookup. This was introduced when
wildcard support (#8185) refactored these methods to pass the maps as
parameters; LookupStaticAddr still reads the fields inside the lock and was
unaffected.

Read h.hmap/h.inline inside the RLock by selecting the address family with a
bool instead of passing pre-dereferenced maps.

Also read h.mtime under the existing RLock in readHosts: it was read without a
lock while the reload writes it under h.Lock(), and readHosts runs from both
the OnStartup handler and the reload ticker goroutine.

Both races are confirmed by go test -race.

Signed-off-by: Pavel Lazureykis <pavel@lazureykis.dev>
 2026-07-08 21:44:16 -07:00
Omkhar Arasaratnam
19ce0e173a plugin/dnstap: close the previous connection before reconnecting (#8224) 2026-07-08 05:58:55 -07:00
SEONGHYUN HONG
b1a0d2f287 plugin/erratic: apply default truncate amount of 2 for bare truncate (#8240) 2026-07-08 05:37:33 -07:00
Yong Tang
84849690a4 Test: Fix flaky health test (#8239) 2026-07-08 06:00:40 +03:00
houyuwushang
6662dd58ea plugin/pkg/response: classify nxdomain without soa as denial (#8199) 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-07-05 22:48:51 -07:00
Saleh
31559f43e8 plugin/file: return SOA in authority for negative CNAME target answers (#8226) 2026-07-05 00:39:15 -07:00
Aaron Mark
ea19f815a6 plugin/forward: make per-upstream read timeout configurable (#8205) 2026-07-04 17:07:04 -07:00
houyuwushang
97e3a71afb plugin/secondary: parse catalog zones after transfer (#8209) 2026-07-04 17:06:05 -07:00
Omkhar Arasaratnam
9226f8a3aa plugin/pkg/dnsutil: guard Join against an empty label slice (#8225) 2026-07-04 17:02:53 -07:00
Saleh
7abc21bc49 plugin/file: run additional processing for wildcard answers (#8222) 
* plugin/file: run additional processing for wildcard answers

The wildcard branch of Zone.Lookup returned a nil additional section, so a
wildcard-synthesized MX/SRV/SVCB/HTTPS answer with an in-bailiwick target
did not include the target's A/AAAA glue. The non-wildcard path already
does this, so call additionalProcessing in the wildcard branch as well.

Fixes #6629

Signed-off-by: Salih Muhammed <root@lr0.org>

* plugin/file: move wildcard additional test into wildcard_test.go

Requested in review: keep the wildcard tests in one file.

Signed-off-by: Salih Muhammed <root@lr0.org>

---------

Signed-off-by: Salih Muhammed <root@lr0.org>
 2026-07-04 16:07:01 -07:00
Ville Vesilehto
bc4343b083 fix(tls): use Go TLS defaults (#8227) 
Remove fixed TLS 1.2 cipher suite list and maximum TLS version so
crypto/tls can use its maintained defaults. Keep TLS 1.2 as the
minimum supported version.

Document the shared TLS default behavior for plugins that expose TLS
configuration and add coverage to ensure CoreDNS leaves Go-managed
TLS fields unset.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
 2026-07-04 16:03:02 -07:00
houyuwushang
679f764ae1 plugin/secondary: stop update loop on reload shutdown (#8198) 2026-07-02 06:46:03 -07:00
Antoine
3a4b87bdb4 fix(8201): restore old behavior forward plugin continue on empty conf file (#8203) 2026-07-01 23:11:37 -07:00
Jaime Hablutzel
8d94712f99 fix(forward): make dnstap FORWARDER_* describe the socket from CoreDNS to upstream (#8184) 
Signed-off-by: Jaime Hablutzel <hablutzel1@gmail.com>
 2026-07-01 21:04:04 -07:00
Baltasar Blanco
6e7093cafb plugin/cache: add regression test for AD bit not partitioning the cache (#8214) 
The cache key is hashed on qname, qtype, DO and CD, but deliberately not on the AD bit, so a single entry serves both AD- and non-AD-requesting clients. The AD bit returned must therefore be derived per request from the cached answer's authentication status, not frozen from the query that populated the entry.

This pins both orderings (noad-then-ad and ad-then-noad) so the historical asymmetry reported in #6642 cannot regress.

Signed-off-by: baltasarblanco <baltablanco9008@gmail.com>
 2026-07-01 15:46:49 -07:00
Immanuel Tikhonov
33266a45c7 fix(rewrite): restore the original question on empty replies (#8212) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-06-30 07:05:12 -04:00
houyuwushang
4faf983fb6 plugin/auto: warn on duplicate zone file origins (#8191) 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-06-29 00:59:23 -07:00
houyuwushang
02f28345d1 plugin/transfer: configure notify source address (#8192) 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-06-28 21:15:16 -07:00
Immanuel Tikhonov
45a20ddcf1 fix: accept scoped IPv6 addresses in transfer targets (#8204) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-06-27 22:26:12 -07:00
Immanuel Tikhonov
69e7a4be73 fix(trace): correct Zipkin v2 endpoint docs (#8202) 2026-06-27 03:21:26 -07:00
Immanuel Tikhonov
1539f9b7d6 fix(log): synthesize deferred error responses (#8200) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-06-26 01:58:20 -07:00
Jaime Hablutzel
1936a2bb40 fix(dnstap): store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET (#8186) 
Signed-off-by: Jaime Hablutzel <hablutzel1@gmail.com>
 2026-06-25 15:49:32 -07:00
Amirhossein Ebrahimzade
6805f6f8a0 plugin/hosts: add wildcard support (#8185) 
* plugin/hosts: add wildcard support for owner names

Signed-off-by: youknowforsearch <amirhebrahimzader@gmail.com>

* plugin/hosts: document wildcard owner name support

Signed-off-by: youknowforsearch <amirhebrahimzader@gmail.com>

* plugin/hosts: remove unused lookupStaticHost

Signed-off-by: Amirhossein Ebrahimzade <amirhossein.e@smartech.ir>

---------

Signed-off-by: youknowforsearch <amirhebrahimzader@gmail.com>
Signed-off-by: Amirhossein Ebrahimzade <amirhossein.e@smartech.ir>
Co-authored-by: Amirhossein Ebrahimzade <amirhossein.e@smartech.ir>
 2026-06-24 22:08:08 -07:00
Immanuel Tikhonov
e45ad5f87a fix(local): handle names under .localhost. (#8151) 2026-06-24 02:31:31 -07:00
houyuwushang
faeb8ba699 plugin/hosts: fall through unsupported query types (#8193) 2026-06-24 02:28:20 -07:00
Yong Tang
fc447d0658 plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record (#8190) 
* plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record

This PR fix a nil-pointer panic in EDNS0 response reversion when downstream responses do not contain an OPT record,

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-06-23 16:02:35 -07:00
Thomas Gosteli
f2f5b5a1cc feat(forward): add doh support (#8004) 
* chore(pkg/proxy): prepare for DoH implementation

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* chore(pkg/proxy): prepare for DoH implementation

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* feat(proxy): implement basic DoH resolution

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* feat(forward): implement DoH forwarding

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* feat(proxy): add basic DoH health checker

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* chore: align http transport with Go's DefaultTransport

and resolve some of the TODOs

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* docs(forward): add basic documentation for DoH

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* chore: add basic tests to cover DoH

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* chore(health): unify default timeout to 1s

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* feat(forward): make doh method configurable

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* chore: remove maxIdleConnsPerHost setting & update docs

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

* chore(forward): reject https upstreams with path

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>

---------

Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>
 2026-06-14 17:54:05 -07:00
Yong Tang
60a439dd4f plugin/proxyproto: Prevent nil pointer dereference when dropping malformed PROXY packets (#8154) 
Avoid a potential nil pointer dereference in PacketConn.ReadFrom() when malformed PROXY protocol headers cause readFrom() to return a nil address.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-06-08 16:26:32 -07:00
Yong Tang
3342b414e3 plugin/cache: allow cache TTLs above default 3600s (#8134) 
* plugin/cache: allow cache TTLs above default 3600s

This change allows the cache plugin to honor configured maximum TTL values above the default 3600s limit. Default behavior remains unchanged
This PR fixes 7846

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Keep MinimalTTL

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-06-06 07:48:26 +03:00
Isolus
b49fe2d469 plugin/dnssec: sign each RRset with the zone that owns its name, not the query zone (#8138) 
Signed-off-by: Björn Kinscher <code@bjoern-kinscher.de>
Co-authored-by: Björn Kinscher <code@bjoern-kinscher.de>
 2026-06-05 18:36:28 -07:00
Immanuel Tikhonov
4c07a287da fix: reject invalid any and local config (#8133) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-05-31 15:41:27 -07:00
Dmytro Alieksieiev
ce0e5a6f39 plugin/forward: add hostname resolution support for TO endpoints (#5646) (#7923) 
Signed-off-by: Dmytro Alieksieiev <1865999+dragoangel@users.noreply.github.com>
 2026-05-30 19:36:01 -07:00
Immanuel Tikhonov
33c71b1554 fix(kubernetes): remove debug fmt.Println from multicluster zone validation (#8131) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-05-28 22:11:35 -07:00
Immanuel Tikhonov
0bcb17df06 fix: use descriptive error for unknown block options in health and log plugins (#8128) 2026-05-27 16:29:24 -07:00
Jöran Malek
eb49f402cc plugin/forward: Forward NODATA responses to Next handler (#8065) 2026-05-26 17:15:46 -07:00
Immanuel Tikhonov
17142359e0 fix: reject unknown chaos block options (#8121) 2026-05-24 05:58:11 -07:00
Ville Vesilehto
d9c6b9b8b4 fix: reject unknown trace and dnstap block options (#8120) 2026-05-21 16:06:25 -07:00
Immanuel Tikhonov
1fbc686758 fix: reject unknown ready plugin properties (#8119) 
Signed-off-by: immanuwell <pchpr.00@list.ru>
 2026-05-21 22:29:59 +03:00
JUN YANG
3e762bc603 Remove redundant code (#8072) 
Signed-off-by: Yang Jun <yang.jun22@zte.com.cn>
Signed-off-by: 杨军10092085 <yang.jun22@zte.com.cn>
 2026-05-21 22:11:29 +03:00
weiguozhang
65d15af3a9 pkg/tls: remove duplicate cipher suites (#8118) 
Signed-off-by: Weiguo Zhang <weiguozhang1990@163.com>
 2026-05-20 23:54:11 -07:00
James R T
84faec64c3 fix(azure): apply access mode to every zone in the same block (#8110) 2026-05-20 08:06:37 -07:00
Ville Vesilehto
f8dffa7fc2 feat(secondary): add fallthrough support (#8041) 2026-05-20 00:13:03 -07:00