upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix #1175: serve-expired does not adhere to secure-by-default

Browse source 
principle. The default value of serve-expired-client-timeout
  is set to 1800 as suggested by RFC8767.
This commit is contained in:
Yorgos Thessalonikefs 2024-11-22 15:30:51 +01:00
parent e75da7d954
commit eefdbb341f
4 changed files with 22 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/Changelog
View file

@ -1,3 +1,8 @@
22 November 2024: Yorgos
- Fix #1175: serve-expired does not adhere to secure-by-default
principle. The default value of serve-expired-client-timeout
is set to 1800 as suggested by RFC8767.
20 November 2024: Yorgos
- Fix comparison to help static analyzer.

10
doc/example.conf.in
View file

@ -731,7 +731,8 @@ server:
# disable-edns-do: no
# Serve expired responses from cache, with serve-expired-reply-ttl in
# the response, and then attempt to fetch the data afresh.
# the response. By default it first tries to refresh an expired answer.
# Can be configured with serve-expired-client-timeout.
# serve-expired: no
#
# Limit serving of expired responses to configured seconds after
@ -749,10 +750,9 @@ server:
#
# Time in milliseconds before replying to the client with expired data.
# This essentially enables the serve-stale behavior as specified in
# RFC 8767 that first tries to resolve before
# immediately responding with expired data. 0 disables this behavior.
# A recommended value is 1800.
# serve-expired-client-timeout: 0
# RFC 8767 that first tries to resolve before immediately responding
# with expired data. 0 disables this behavior.
# serve-expired-client-timeout: 1800
# Return the original TTL as received from the upstream name server rather
# than the decrementing TTL as stored in the cache. Enabling this feature

19
doc/unbound.conf.5.in
View file

@ -1402,9 +1402,10 @@ Default is no.
.TP
.B serve\-expired: \fI<yes or no>
If enabled, Unbound attempts to serve old responses from cache with a
TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the
actual resolution to finish. The actual resolution answer ends up in the cache
later on. Default is "no".
TTL of \fBserve\-expired\-reply\-ttl\fR in the response.
By default the expired answer will be used after a resolution attempt errored
out or is taking more than serve\-expired\-client\-timeout to resolve.
Default is "no".
.TP
.B serve\-expired\-ttl: \fI<seconds>
Limit serving of expired responses to configured seconds after expiration. 0
@ -1424,12 +1425,14 @@ TTL value to use when replying with expired data. If
use 30 as the value (RFC 8767). The default is 30.
.TP
.B serve\-expired\-client\-timeout: \fI<msec>
Time in milliseconds before replying to the client with expired data. This
essentially enables the serve-stale behavior as specified in
Time in milliseconds before replying to the client with expired data.
This essentially enables the serve-stale behavior as specified in
RFC 8767 that first tries to resolve before immediately
responding with expired data. A recommended value per
RFC 8767 is 1800. Setting this to 0 will disable this
behavior. Default is 0.
responding with expired data.
Setting this to 0 will disable this behavior and instead serve the expired
record immediately from the cache before attempting to refresh it via
resolution.
Default is 1800.
.TP
.B serve\-original\-ttl: \fI<yes or no>
If enabled, Unbound will always return the original TTL as received from

2
util/config_file.c
View file

@ -283,7 +283,7 @@ config_create(void)
cfg->serve_expired_ttl = 0;
cfg->serve_expired_ttl_reset = 0;
cfg->serve_expired_reply_ttl = 30;
cfg->serve_expired_client_timeout = 0;
cfg->serve_expired_client_timeout = 1800;
cfg->ede_serve_expired = 0;
cfg->serve_original_ttl = 0;
cfg->zonemd_permissive_mode = 0;