rsp2k/coredns-rfc2136
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Sign responses to TSIG-signed UPDATEs (RFC 8945 §5.4.2)

Browse source 
When a request arrives with TSIG, attach a TSIG record to the response
so dns.ResponseWriter computes the MAC at write time using the secret
in TsigSecret. Without this, BIND nsupdate complains "expected a TSIG
or SIG(0)" on every UPDATE, even when the update applies successfully.

Two response paths fixed:
  - handleUpdate success/per-rcode replies (update.go)
  - ServeDNS rejection when TSIG verification fails (plugin.go)

The new helper in tsig.go is a no-op for unsigned requests. Unknown
keys still silently skip signing — we can't authenticate to a peer we
don't share a key with.

Tests verify both branches: signed request → response carries matching
TSIG (key name + algorithm); unsigned request → response stays plain.
This commit is contained in:
Ryan Malloy 2026-05-22 09:24:12 -06:00
parent 1fe95e3f6c
commit 6268e6eafd
4 changed files with 91 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

57
update_test.go
View file

@ -260,6 +260,63 @@ func TestUpdate_NoOpAdd_DoesntRewriteFile(t *testing.T) {
}
}
// TestUpdate_SignedRequest_ResponseGetsTSIG verifies the RFC 8945 §5.4.2
// requirement that a server's response to a TSIG-signed request must
// itself carry TSIG so the client can authenticate the answer. Before
// this fix, BIND nsupdate complained "expected a TSIG or SIG(0)" because
// the response went back without any TSIG record attached.
func TestUpdate_SignedRequest_ResponseGetsTSIG(t *testing.T) {
p := newTestPluginWithZone(t, "auth.example.com")
upd := newUpdate("auth.example.com",
mustRR(t, `foo.auth.example.com. 60 IN TXT "x"`),
)
// Attach a TSIG to the request — the values mimic what nsupdate
// or caddy-dns/rfc2136 emit. handleUpdate runs WITHOUT MAC
// verification in this test (that's ServeDNS's job and is
// covered separately), so the TSIG record's MAC contents don't
// matter — only the presence/algorithm/name do.
upd.SetTsig("acme-update-key.", dns.HmacSHA256, 300, 0)
w := &captureWriter{}
if _, err := p.handleUpdate(w, upd); err != nil {
t.Fatalf("handleUpdate: %v", err)
}
if w.msg == nil {
t.Fatal("response was not written")
}
got := w.msg.IsTsig()
if got == nil {
t.Fatal("response missing TSIG — nsupdate would reject as 'expected a TSIG or SIG(0)'")
}
if !strings.EqualFold(got.Hdr.Name, "acme-update-key.") {
t.Errorf("response TSIG key = %q, want acme-update-key.", got.Hdr.Name)
}
if !strings.EqualFold(got.Algorithm, dns.HmacSHA256) {
t.Errorf("response TSIG alg = %q, want %s", got.Algorithm, dns.HmacSHA256)
}
}
// TestUpdate_UnsignedRequest_ResponseStaysUnsigned guards the no-op
// branch — if the client didn't sign, we don't synthesize a TSIG on
// the response (we couldn't pick a key anyway).
func TestUpdate_UnsignedRequest_ResponseStaysUnsigned(t *testing.T) {
p := newTestPluginWithZone(t, "auth.example.com")
upd := newUpdate("auth.example.com",
mustRR(t, `foo.auth.example.com. 60 IN TXT "x"`),
)
// No SetTsig — request is plain.
w := &captureWriter{}
if _, err := p.handleUpdate(w, upd); err != nil {
t.Fatalf("handleUpdate: %v", err)
}
if w.msg.IsTsig() != nil {
t.Error("response carries TSIG despite unsigned request")
}
}
func TestFindZone_LongestSuffixWins(t *testing.T) {
p := &RFC2136{Zones: []string{"example.com.", "auth.example.com."}}
if got := p.findZone("foo.auth.example.com."); got != "auth.example.com." {