TSIG downstream support#587
Merged
Merged
Conversation
- New `cascade tsig add` client command to request that the daemon add a TSIG key to the Cascade TSIG store. - New cascaded POST /tsig/ API to add a TSIG key to the Cascade TSIG store. - Extension of the `cascade zone add` command `--source` argument with an optional `!<TSIG key name>` syntax to define the TSIG key that Cascade should use when sending an XFR request to the upstream. - Pass the key defined by the source to the zone loader instead of None (the zone loader is already capable of using the key, it just wasn't being told which key to use)
As Base64 is typically how tooling present/accept TSIG key secret data to/from users.
Begin with a test that should fail: fetching a zone without using the required TSIG key.
And use add instead of register as we say add in some places and register in others, and because remove is used as the opposite of add, we don't say de/unregister.
Updated based on the NSD documentation at https://nsd.docs.nlnetlabs.nl/en/latest/manpages/nsd.conf.html#EXAMPLE.
Also, reverse the change on failure to register the zone. Also, add some missing zone server updates and failure to mark state as dirty.
- Improved field names in TsigListResult. - Include policy names in TsigListResult. - Rename accept_xfr_requests_from to accept_xfr_from to better mirror send_notify_to. - Document accept_xfr_from in policy example and man page. - Rebuild man pages. - Don't allow IP on ACL to be optional. (we can always support ACL by TSIG key only and not by IP later if we wish, but nobody asked for it at this point and it adds complexity) - Reduce noise output by TSIG downstream system test. - Add TSIG key name to NameserverCommsPolicy and friends. - Add parsing of TSIG key name in SimpleNameserverCommsSpec. - Enforce ACLs on outbound XFRs.
ximon18
force-pushed
the
tsig-downstream-support
branch
from
April 28, 2026 08:56
6d0c81f to
1b65da9
Compare
ximon18
marked this pull request as ready for review
April 28, 2026 11:00
bal-e
reviewed
Apr 28, 2026
bal-e
left a comment
bal-e
left a comment
Contributor
There was a problem hiding this comment.
LGTM aside from one minor bug.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements the last piece of work needed for #301: downstream TSIG support.
Downstream TSIG support consists of accepting TSIG signed XFR related requests sent by downstream nameservers to Cascadea nd replying with an appropriately signed response.
Known issues
Changes made
CLI changes:
tsig listto also show policies that use TSIG key(s) with downstreams, in addition to zones whose source uses a TSIG key with an upstream.Policy changes:
server.outbound.accept-xfr-frompolicy setting. Actually it was already supported (under a slightly different name,accept-xfr-requests-from, but was not used anywhere).Daemon changes:
SimpleNameserverCommsSpecfrom string parsing to handle a[^<TSIG_KEY_NAME>]suffix.InboundPolicytype, this is currently handled by the--sourceargument to thezone addCLI subcommand, not via policy.accept-xfr-fromACL on incoming XFR requests handled by the zone server, rejecting requests that have an incorrect source IP address or mismatched TSIG key.send-notify-toto sign NOTIFY messages sent by Cascade.TsigMiddlewareSvc.Documentation changes:
Nameserver Integrations/NSDpage showing how to use NSD as a downstream, optionally with TSIG.System test changes:
tsig-keydefinition and new versions of the existing secondary zone which use TSIG for XFR and for NOTIFY+XFR.downstream-tsigsystem test which tests XFR and NOTIFY against NSD with and without TSIG keys for NOTIFY and XFR communication.If you are changing Rust code or integration tests (
Cargo.*,crates/,etc/,integration-tests/,src/):actthrough theact-wrapper(as described inTESTING.md)?If you are modifying man pages: