6 Commits

Author	SHA1	Message	Date
houyuwushang	789b8d1665	plugin/tsig: expose validated TSIG key identity (#8471) ... Store the normalized key name in the request context only after successful TSIG verification. This lets downstream plugins distinguish unsigned requests from authenticated requests and authorize by key without relying on the stripped TSIG RR or exposing secret material. Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>	2026-08-26 14:13:48 -07:00
Ilya Kulakov	540e2f325f	plugin/tsig: don't echo client's TSIG.Error if verification is successful (#8215)	2026-07-09 15:04:23 -07:00
Ville Vesilehto	6720959b8b	lint(revive): fix unused-parameter violations (#7980)	2026-03-29 17:02:20 -07:00
Seena Fallah	471d62926d	plugin/tsig: add require_opcode directive for opcode-based TSIG (#7828) ... Extend the tsig plugin to require TSIG signatures based on DNS opcodes, similar to the existing qtype-based requirement. The new require_opcode directive accepts opcode names (QUERY, IQUERY, STATUS, NOTIFY, UPDATE) or the special values "all" and "none". This is useful for requiring TSIG on dynamic update (UPDATE) or zone transfer notification (NOTIFY) requests while allowing unsigned queries. Example: ``` tsig { secret key. NoTCJU+DMqFWywaPyxSijrDEA/eC3nK0xi3AMEZuPVk= require_opcode UPDATE NOTIFY } ``` Signed-off-by: Seena Fallah <seenafallah@gmail.com>	2026-03-27 21:05:49 +02:00
Manuel Rüger	76ba39ffe9	chore: Upgrade to golangci-lint v2 (#7236) ... Signed-off-by: Manuel Rüger <manuel@rueg.eu>	2025-04-04 14:27:39 -04:00
Chris O'Haver	68e141eff2	plugin/tsig: new plugin TSIG (#4957) ... * expose tsig secrets via dnsserver.Config * add tsig plugin Signed-off-by: Chris O'Haver <cohaver@infoblox.com>	2022-06-27 15:48:34 -04:00