Skip to content

core: Add full TSIG verification in DoH transport#8013

Merged
thevilledev merged 3 commits into
coredns:masterfrom
yongtang:7943-do
Apr 9, 2026
Merged

core: Add full TSIG verification in DoH transport#8013
thevilledev merged 3 commits into
coredns:masterfrom
yongtang:7943-do

Conversation

@yongtang

@yongtang yongtang commented Apr 7, 2026

Copy link
Copy Markdown
Member

1. Why is this pull request needed and what does it do?

This This PR add full TSIG verification in DoH using dns.TsigVerify()

2. Which issues (if any) are related?

#7943

3. Which documentation changes (if any) need to be made?

n/a

4. Does this introduce a backward incompatible change or deprecation?

n/a

This This PR add full TSIG verification in DoH using dns.TsigVerify()
7943

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
@yongtang yongtang requested review from thevilledev and removed request for chrisohaver, johnbelamaric, miekg and stp-ip April 7, 2026 04:14
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Comment on lines +478 to +498
func forgedTSIGMsg() *dns.Msg {
m := new(dns.Msg)
m.SetQuestion("example.com.", dns.TypeA)

m.Extra = append(m.Extra, &dns.TSIG{
Hdr: dns.RR_Header{
Name: "bogus-key.",
Rrtype: dns.TypeTSIG,
Class: dns.ClassANY,
Ttl: 0,
},
Algorithm: dns.HmacSHA256,
TimeSigned: uint64(time.Now().Unix()),
Fudge: 300,
MACSize: 32,
MAC: strings.Repeat("00", 32),
OrigId: m.Id,
Error: dns.RcodeSuccess,
})
return m
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

forgedTSIGMsg() uses key name "bogus-key." which doesn't exist in the server's tsigSecret map. I think this means dns.TsigVerify() is never reached, and only the map lookup fails. Consider using mustPackSignedTSIGQuery (from tsig_test.go) with the right key name but a different secret, so the test actually exercises the MAC verification path that RequestToMsgWire was introduced to support.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add a test using mustPackSignedTSIGQuery with matching key name and secret, then asserting RcodeSuccess? Kind of a happy-path test like in the gRPC and QUIC implementations

Comment thread core/dnsserver/https.go
Comment on lines 62 to +66
func (d *DoHWriter) TsigStatus() error {
return nil
return d.tsigStatus

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: low hanging fruit for a test, kind of like TestDoQWriterTsigStatusReturnsStoredStatus from QUIC

@yongtang

yongtang commented Apr 9, 2026

Copy link
Copy Markdown
Member Author

Thanks @thevilledev PR updated.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

@thevilledev thevilledev left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @yongtang, LGTM

@thevilledev thevilledev merged commit c0e6e7c into coredns:master Apr 9, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants