Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-04-08 13:05:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/tsig: add require_opcode directive for opcode-based TSIG (#7828)

Browse Source 
Extend the tsig plugin to require TSIG signatures based on DNS opcodes,
similar to the existing qtype-based requirement.

The new require_opcode directive accepts opcode names (QUERY, IQUERY,
STATUS, NOTIFY, UPDATE) or the special values "all" and "none".

This is useful for requiring TSIG on dynamic update (UPDATE) or zone
transfer notification (NOTIFY) requests while allowing unsigned queries.

Example:
```
  tsig {
    secret key. NoTCJU+DMqFWywaPyxSijrDEA/eC3nK0xi3AMEZuPVk=
    require_opcode UPDATE NOTIFY
  }
```

Signed-off-by: Seena Fallah <seenafallah@gmail.com>
This commit is contained in:
Seena Fallah
2026-03-27 20:05:49 +01:00
committed by GitHub
parent 0918e88368
commit 471d62926d
5 changed files with 228 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
plugin/tsig/README.md
View File

@@ -19,6 +19,7 @@ tsig [ZONE...] {
secret NAME KEY
secrets FILE
require [QTYPE...]
require_opcode [OPCODE...]
}
~~~
@@ -36,10 +37,15 @@ tsig [ZONE...] {
```
Each key may also specify an `algorithm` e.g. `algorithm hmac-sha256;`, but this is currently ignored by the plugin.
* `require` **QTYPE...** - the query types that must be TSIG'd. Requests of the specified types
will be `REFUSED` if they are not signed.`require all` will require requests of all types to be
* `require` **QTYPE...** - the query types that must be TSIG'd. Requests of the specified types
will be `REFUSED` if they are not signed. `require all` will require requests of all types to be
signed. `require none` will not require requests any types to be signed. Default behavior is to not require.
* `require_opcode` **OPCODE...** - the opcodes that must be TSIG'd. Requests with the specified opcodes
will be `REFUSED` if they are not signed. Valid opcodes are: `QUERY`, `IQUERY`, `STATUS`, `NOTIFY`, `UPDATE`.
`require_opcode all` will require requests with all opcodes to be signed. `require_opcode none` will not
require requests with any opcode to be signed. Default behavior is to not require.
## Examples
Require TSIG signed transactions for transfer requests to `example.zone`.
@@ -68,6 +74,17 @@ auth.zone {
}
```
Require TSIG signed transactions for UPDATE and NOTIFY operations to `dynamic.zone`.
```
dynamic.zone {
tsig {
secret dynamic.zone.key. NoTCJU+DMqFWywaPyxSijrDEA/eC3nK0xi3AMEZuPVk=
require_opcode UPDATE NOTIFY
}
}
```
## Bugs
### Secondary