upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-21 23:31:06 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix #1175: serve-expired does not adhere to secure-by-default

Browse source 
principle. The default value of serve-expired-client-timeout
  is set to 1800 as suggested by RFC8767.
This commit is contained in:
Yorgos Thessalonikefs 2024-11-22 15:30:51 +01:00
parent e75da7d954
commit eefdbb341f
4 changed files with 22 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/Changelog
View file

@ -1,3 +1,8 @@
22 November 2024: Yorgos
- Fix #1175: serve-expired does not adhere to secure-by-default
principle. The default value of serve-expired-client-timeout
is set to 1800 as suggested by RFC8767.
20 November 2024: Yorgos 20 November 2024: Yorgos
- Fix comparison to help static analyzer. - Fix comparison to help static analyzer.

10
doc/example.conf.in
View file

@ -731,7 +731,8 @@ server:
# disable-edns-do: no # disable-edns-do: no
# Serve expired responses from cache, with serve-expired-reply-ttl in # Serve expired responses from cache, with serve-expired-reply-ttl in
# the response, and then attempt to fetch the data afresh. # the response. By default it first tries to refresh an expired answer.
# Can be configured with serve-expired-client-timeout.
# serve-expired: no # serve-expired: no
# #
# Limit serving of expired responses to configured seconds after # Limit serving of expired responses to configured seconds after
@ -749,10 +750,9 @@ server:
# #
# Time in milliseconds before replying to the client with expired data. # Time in milliseconds before replying to the client with expired data.
# This essentially enables the serve-stale behavior as specified in # This essentially enables the serve-stale behavior as specified in
# RFC 8767 that first tries to resolve before # RFC 8767 that first tries to resolve before immediately responding
# immediately responding with expired data. 0 disables this behavior. # with expired data. 0 disables this behavior.
# A recommended value is 1800. # serve-expired-client-timeout: 1800
# serve-expired-client-timeout: 0
# Return the original TTL as received from the upstream name server rather # Return the original TTL as received from the upstream name server rather
# than the decrementing TTL as stored in the cache. Enabling this feature # than the decrementing TTL as stored in the cache. Enabling this feature

19
doc/unbound.conf.5.in
View file

@ -1402,9 +1402,10 @@ Default is no.
.TP .TP
.B serve\-expired: \fI<yes or no> .B serve\-expired: \fI<yes or no>
If enabled, Unbound attempts to serve old responses from cache with a If enabled, Unbound attempts to serve old responses from cache with a
TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the TTL of \fBserve\-expired\-reply\-ttl\fR in the response.
actual resolution to finish. The actual resolution answer ends up in the cache By default the expired answer will be used after a resolution attempt errored
later on. Default is "no". out or is taking more than serve\-expired\-client\-timeout to resolve.
Default is "no".
.TP .TP
.B serve\-expired\-ttl: \fI<seconds> .B serve\-expired\-ttl: \fI<seconds>
Limit serving of expired responses to configured seconds after expiration. 0 Limit serving of expired responses to configured seconds after expiration. 0
@ -1424,12 +1425,14 @@ TTL value to use when replying with expired data. If
use 30 as the value (RFC 8767). The default is 30. use 30 as the value (RFC 8767). The default is 30.
.TP .TP
.B serve\-expired\-client\-timeout: \fI<msec> .B serve\-expired\-client\-timeout: \fI<msec>
Time in milliseconds before replying to the client with expired data. This Time in milliseconds before replying to the client with expired data.
essentially enables the serve-stale behavior as specified in This essentially enables the serve-stale behavior as specified in
RFC 8767 that first tries to resolve before immediately RFC 8767 that first tries to resolve before immediately
responding with expired data. A recommended value per responding with expired data.
RFC 8767 is 1800. Setting this to 0 will disable this Setting this to 0 will disable this behavior and instead serve the expired
behavior. Default is 0. record immediately from the cache before attempting to refresh it via
resolution.
Default is 1800.
.TP .TP
.B serve\-original\-ttl: \fI<yes or no> .B serve\-original\-ttl: \fI<yes or no>
If enabled, Unbound will always return the original TTL as received from If enabled, Unbound will always return the original TTL as received from

2
util/config_file.c
View file

@ -283,7 +283,7 @@ config_create(void)
cfg->serve_expired_ttl = 0; cfg->serve_expired_ttl = 0;
cfg->serve_expired_ttl_reset = 0; cfg->serve_expired_ttl_reset = 0;
cfg->serve_expired_reply_ttl = 30; cfg->serve_expired_reply_ttl = 30;
cfg->serve_expired_client_timeout = 0; cfg->serve_expired_client_timeout = 1800;
cfg->ede_serve_expired = 0; cfg->ede_serve_expired = 0;
cfg->serve_original_ttl = 0; cfg->serve_original_ttl = 0;
cfg->zonemd_permissive_mode = 0; cfg->zonemd_permissive_mode = 0;