Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-29 05:35:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

Improve RFC links (#8612)

Browse Source 
The `tools.ietf.org` site now redirects to `www.rfc-editor.org`.
* Update various URLs to the new site.
* Make links to `www.rfc-editor.org` consistent.

Signed-off-by: SuperQ <superq@gmail.com>
This commit is contained in:
Ben Kochie
2026-10-08 10:21:06 +02:00
committed by GitHub
parent 763bdb9b76
commit 311a9915da
60 changed files with 1006 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
man/coredns-tsig.7
View File

@@ -1,5 +1,5 @@
.\" Generated by Mmark Markdown Processer - mmark.miek.nl
.TH "COREDNS-TSIG" 7 "March 2026" "CoreDNS" "CoreDNS Plugins"
.TH "COREDNS-TSIG" 7 "October 2026" "CoreDNS" "CoreDNS Plugins"
.SH "NAME"
.PP
@@ -14,6 +14,11 @@ respective plugins sending those requests to sign them using the keys defined by
.PP
The \fItsig\fP plugin can also require that incoming requests be signed for certain query types, refusing requests that do not comply.
.PP
After successfully validating a TSIG record, the plugin adds the normalized key name to the request context. Downstream Go
plugins can call \fB\fCtsig.ValidatedKeyName(ctx)\fR to retrieve the key name and distinguish validated requests from unsigned
requests. The value is not set for requests outside the configured zones because the \fItsig\fP plugin does not validate them.
.SH "SYNTAX"
.PP
.RS
@@ -23,6 +28,7 @@ tsig [ZONE...] {
secret NAME KEY
secrets FILE
require [QTYPE...]
require\_opcode [OPCODE...]
}
.fi
@@ -50,14 +56,15 @@ to define multiple secrets. Secrets are global to the server instance, not just
Each key may also specify an \fB\fCalgorithm\fR e.g. \fB\fCalgorithm hmac-sha256;\fR, but this is currently ignored by the plugin.
.RS
.IP \(en 4
.IP \(bu 4
\fB\fCrequire\fR \fBQTYPE...\fP - the query types that must be TSIG'd. Requests of the specified types
will be \fB\fCREFUSED\fR if they are not signed.\fB\fCrequire all\fR will require requests of all types to be
will be \fB\fCREFUSED\fR if they are not signed. \fB\fCrequire all\fR will require requests of all types to be
signed. \fB\fCrequire none\fR will not require requests any types to be signed. Default behavior is to not require.
.RE
.IP \(bu 4
\fB\fCrequire_opcode\fR \fBOPCODE...\fP - the opcodes that must be TSIG'd. Requests with the specified opcodes
will be \fB\fCREFUSED\fR if they are not signed. Valid opcodes are: \fB\fCQUERY\fR, \fB\fCIQUERY\fR, \fB\fCSTATUS\fR, \fB\fCNOTIFY\fR, \fB\fCUPDATE\fR.
\fB\fCrequire_opcode all\fR will require requests with all opcodes to be signed. \fB\fCrequire_opcode none\fR will not
require requests with any opcode to be signed. Default behavior is to not require.
.SH "EXAMPLES"
@@ -99,6 +106,23 @@ auth.zone {
.fi
.RE
.PP
Require TSIG signed transactions for UPDATE and NOTIFY operations to \fB\fCdynamic.zone\fR.
.PP
.RS
.nf
dynamic.zone {
tsig {
secret dynamic.zone.key. NoTCJU+DMqFWywaPyxSijrDEA/eC3nK0xi3AMEZuPVk=
require\_opcode UPDATE NOTIFY
}
}
.fi
.RE
.SH "BUGS"
.SS "SECONDARY"
.PP
@@ -110,8 +134,8 @@ With the \fItransfer\fP plugin, zone transfer notifications from CoreDNS are not
.SS "SPECIAL CONSIDERATIONS FOR FORWARDING SERVERS (RFC 8945 5.5)"
.PP
https://datatracker.ietf.org/doc/html/rfc8945#section-5.5
\[la]https://datatracker.ietf.org/doc/html/rfc8945#section-5.5\[ra]
https://www.rfc-editor.org/info/rfc8945/#section-5.5
\[la]https://www.rfc-editor.org/info/rfc8945/#section-5.5\[ra]
.PP
CoreDNS does not implement this section as follows ...