Yong Tang 8d66643935 core: Reject conflicting TLS policies on shared listeners. (#8565) ...

* core: Reject conflicting TLS policies on shared listeners.

This PR tries to fix the issue when multiple zones share a DoT listener, CoreDNS can apply one sibling block’s tls.Config to all zones, allowing weaker TLS or client-auth settings to override a stricter zone.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix ACME

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

2026-09-21 23:56:27 -07:00

..

acl

chore: Upgrade to golangci-lint v2 (#7236)

2025-04-04 14:27:39 -04:00

any

fix: reject invalid any and local config (#8133)

2026-05-31 15:41:27 -07:00

auto

plugin/file: reject SOA owners that do not match the zone (#8555)

2026-09-16 17:49:58 -07:00

autopath

plugin/autopath: Fixes a nil pointer dereference panic in autopath during search path walk (#8517)

2026-09-05 02:20:27 -07:00

azure

plugin/azure: allow startup with unavailable zones (#8524)

2026-09-10 20:54:12 -07:00

bind

test: skip certain network-specific tests on non-Linux (#7318)

2025-05-23 09:23:14 -07:00

bufsize

plugin: fix gosec G115 integer overflow warnings (#7799)

2026-01-01 10:20:29 +02:00

cache

plugin/cache: don't cache or panic on responses with no question (#8467)

2026-09-18 16:56:04 -07:00

cancel

docs: move Also See to See Also (#4245)

2020-10-28 10:56:35 -07:00

chaos

plugin/tls: manage certificates with ACME DNS-01 (#8310)

2026-07-29 19:24:22 -07:00

clouddns

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

debug

Add opt-in JSON logging with structured DNS query fields (#8553)

2026-09-16 17:50:39 -07:00

deprecated

For caddy v1 in our org (#4018)

2020-09-24 18:14:41 +02:00

dns64

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

dnssec

plugin/dnssec: sign each RRset with the zone that owns its name, not the query zone (#8138)

2026-06-05 18:36:28 -07:00

dnstap

plugin/dnstap: tap deferred error responses (#8549)

2026-09-14 17:25:11 -07:00

erratic

plugin/erratic: apply default truncate amount of 2 for bare truncate (#8240)

2026-07-08 05:37:33 -07:00

errors

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

etcd

Fix etcd library update issue (#8542)

2026-09-10 23:59:33 -07:00

file

plugin/file: fix less is not up to RFC 1034 and 4034 (#8503)

2026-09-16 17:51:15 -07:00

forward

plugin/forward: Treat forward upstream hostnames as absolute FQDNs to avoid search-domain resolution. (#8563)

2026-09-19 21:37:34 -07:00

geoip

ci: run plugin tests on Windows (#8314)

2026-07-19 03:52:23 -07:00

grpc

ci: run plugin tests on Windows (#8314)

2026-07-19 03:52:23 -07:00

grpc_server

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

header

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

health

test: poll instead of fixed sleeps across several tests (#8275)

2026-07-10 15:20:57 -07:00

hosts

plugin/hosts: don't drop over-long fields silently (#8551)

2026-09-15 19:24:23 -07:00

https

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

https3

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

import

chore: bump coredns/caddy dependency to latest (#7567)

2025-09-20 16:33:00 -07:00

k8s_external

plugin/k8s_external: Fixes a nil pointer dereference panic when upstream lookup returns no response (#8518)

2026-09-04 18:03:47 -07:00

kubernetes

fix(kubernetes): include structured key/value context in client-go logs (#8490)

2026-09-15 00:42:44 -07:00

loadbalance

plugin/loadbalance: validate the response before dereferencing it in WriteMsg (#8523)

2026-09-07 20:50:54 -07:00

local

fix(local): handle names under .localhost. (#8151)

2026-06-24 02:31:31 -07:00

log

Add opt-in JSON logging with structured DNS query fields (#8553)

2026-09-16 17:50:39 -07:00

loop

plugin: use Zones.Contains when any match suffices (#8505)

2026-09-02 23:59:58 -07:00

metadata

plugin: use Zones.Contains when any match suffices (#8505)

2026-09-02 23:59:58 -07:00

metrics

fix(metrics): release listener on TLS startup failure (#8527)

2026-09-13 17:57:30 -07:00

minimal

plugin/minimal: Fixes a nil pointer dereference panic in minimal prefetch response processing (#8506)

2026-09-02 07:58:49 -07:00

multisocket

Update multisocket README.md (#7621)

2025-10-17 19:16:29 +03:00

nomad

lint(revive): fix context-as-argument violations (#7976)

2026-03-29 17:01:03 -07:00

nsid

fix: remove unnecessary conversion (#6258)

2023-08-14 15:14:09 +02:00

pkg

plugin/forward: bound DoT connection setup for retries (#8543)

2026-09-18 16:56:31 -07:00

pprof

lint(revive): fix unreachable-code violation (#7979)

2026-03-29 17:02:39 -07:00

proxyproto

plugin/proxyproto: Apply an explicitly configured default policy evenwhen no allow list is present. (#8278)

2026-07-13 17:34:30 -07:00

quic

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

ready

fix(ready): release lock before server shutdown (#8526)

2026-09-08 13:15:00 -07:00

reload

fix(reload): broadcast shutdown signal (#8504)

2026-09-06 19:40:07 -07:00

rewrite

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

root

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

route53

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

secondary

plugin: use Zones.Contains when any match suffices (#8505)

2026-09-02 23:59:58 -07:00

shed

plugin/shed: add UDP overload protection plugin (#8312)

2026-07-27 12:13:25 +03:00

sign

plugin/file: reject SOA owners that do not match the zone (#8555)

2026-09-16 17:49:58 -07:00

siit

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

template

plugin: use Zones.Contains when any match suffices (#8505)

2026-09-02 23:59:58 -07:00

test

core: upgrade Go requirement to 1.26.0 (#8466)

2026-09-10 19:34:44 -07:00

timeouts

plugin/timeouts: add maxtcpqueries option to bound queries per TCP/TLS connection (#8376)

2026-08-03 16:16:43 -07:00

tls

core: Reject conflicting TLS policies on shared listeners. (#8565)

2026-09-21 23:56:27 -07:00

trace

Support IPv6 service endpoints in trace plugin (#8410)

2026-08-05 21:10:34 -07:00

transfer

plugin/transfer: collect all notify errors instead of shadowing (#8283)

2026-07-15 18:05:01 -07:00

tsig

plugin: use Zones.Contains when any match suffices (#8505)

2026-09-02 23:59:58 -07:00

view

fix(dnsserver): allow view server blocks in any declaration order (#8001)

2026-04-04 20:45:55 +03:00

whoami

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

backend_lookup_test.go

plugin/etcd: allow disabling legacy apex fallback (#8468)

2026-08-23 17:56:12 -07:00

backend_lookup.go

plugin/etcd: allow disabling legacy apex fallback (#8468)

2026-08-23 17:56:12 -07:00

backend.go

plugin/etcd: allow disabling legacy apex fallback (#8468)

2026-08-23 17:56:12 -07:00

done.go

go report card fixes (#3182)

2019-08-24 18:14:25 +00:00

log_test.go

Clean up tests logging (#1979)

2018-07-19 16:23:06 +01:00

normalize_test.go

fix(plugin): normalize panics on invalid origins (#7563)

2025-09-18 19:15:40 -07:00

normalize.go

plugin: use Zones.Contains when any match suffices (#8505)

2026-09-02 23:59:58 -07:00

plugin_test.go

lint(revive): fix unused-parameter violations (#7980)

2026-03-29 17:02:20 -07:00

plugin.go

lint(revive): fix context-as-argument violations (#7976)

2026-03-29 17:01:03 -07:00

register.go

For caddy v1 in our org (#4018)

2020-09-24 18:14:41 +02:00