Pass DNS Msg via context into TSIG Verify and Generate functions #1348
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This allows server operators to pass data from the read decorators to the actual DNS handlers. An example use case where this is needed is when there is any proxying service between eyeball and DNS server. In order to preserve the client IP, the proxy server might have to use PROXY protocol v2. If you don't have a context you can read and see the client IPs in the decoraters but your handler will not know this information and therefore might not be able to do things like: 1. Block IPs 2. Verify TSIGs based off specific IP 3. Respond with TSIGs based off source IP 4. Respond with different answers based of IP location Apart from knowing the source IP, there is other situations where you might want to pass information parsed in the read decorators to the handler.
This gives the server operator a lot more flexibility as to how they manage the verification and generation of tsigs. The test TestServerRoundtripTsigProvider displays some of these possibilities. For example: 1. Establish a sync.RWMutex on the secret map so that secrets can be dynamically updated even after the server has been started. 2. Establish more granular secret maps. I.E to ensure that many zones can share TSIG names without collisions in the map. You could do other things like have zone specific verification or generation.
Fattouche
force-pushed
the
tsig_unbuffer
branch
from
f47d13e
to
c56bd76
Compare
tmthrgd
requested changes
Mar 11, 2022
|
context.Context is a good way to cancel functions, using is to smuggle extra parameter into a function is not. |
I'm trying to solve #1331 (comment). Surely there must be a way to get the zoneName inside Generate() function, however it seems that after calling |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This gives the server operator a lot more flexibility as to how they manage the verification and generation of tsigs.
The test TestServerRoundtripTsigProvider displays some of these possibilities.
For example:
You could do other things like have zone specific verification or generation.
Fixes #1347