Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-04-05 19:55:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

core: Add full TSIG verification in gRPC transport (#8006)

Browse Source 
* core: Add full TSIG verification in gRPC transport

This PR add full TSIG verification in gRPC using dns.TsigVerify() so invalid signatures and timestamps are correctly detected instead of only checking key presence.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This commit is contained in:
Yong Tang
2026-04-04 01:58:36 -07:00
committed by GitHub
parent 510977c476
commit 4c9a80c296
2 changed files with 192 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/dnsserver/server_grpc.go
View File

@@ -198,8 +198,10 @@ func (s *ServergRPC) Query(ctx context.Context, in *pb.DnsPacket) (*pb.DnsPacket
if tsig := msg.IsTsig(); tsig != nil {
if s.tsigSecret == nil {
w.tsigStatus = dns.ErrSecret
} else if _, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
} else if secret, ok := s.tsigSecret[tsig.Hdr.Name]; !ok {
w.tsigStatus = dns.ErrSecret
} else {
w.tsigStatus = dns.TsigVerify(in.GetMsg(), secret, "", false)
}
}