diff --git a/doc/Changelog b/doc/Changelog index 65533799b..0403e0c10 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -2,6 +2,7 @@ - Fix #1175: serve-expired does not adhere to secure-by-default principle. The default value of serve-expired-client-timeout is set to 1800 as suggested by RFC8767. + - For #1175, update serve-expired tests. 20 November 2024: Yorgos - Fix comparison to help static analyzer. diff --git a/testdata/cachedb_expired.crpl b/testdata/cachedb_expired.crpl index 9f9ff677c..d3bf06fe1 100644 --- a/testdata/cachedb_expired.crpl +++ b/testdata/cachedb_expired.crpl @@ -4,6 +4,7 @@ server: qname-minimisation: no minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 module-config: "cachedb iterator" cachedb: diff --git a/testdata/cachedb_expired_reply_ttl.crpl b/testdata/cachedb_expired_reply_ttl.crpl index b5f340505..03fd01add 100644 --- a/testdata/cachedb_expired_reply_ttl.crpl +++ b/testdata/cachedb_expired_reply_ttl.crpl @@ -4,6 +4,7 @@ server: qname-minimisation: no minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-reply-ttl: 30 module-config: "cachedb iterator" diff --git a/testdata/cachedb_servfail_cname.crpl b/testdata/cachedb_servfail_cname.crpl index 221f00d4d..99b3d51f9 100644 --- a/testdata/cachedb_servfail_cname.crpl +++ b/testdata/cachedb_servfail_cname.crpl @@ -3,7 +3,7 @@ server: target-fetch-policy: "0 0 0 0 0" qname-minimisation: no minimal-responses: no - ;serve-expired: yes + serve-expired: no module-config: "cachedb iterator" cachedb: diff --git a/testdata/cachedb_val_expired.crpl b/testdata/cachedb_val_expired.crpl index 4a51e8272..741445ce8 100644 --- a/testdata/cachedb_val_expired.crpl +++ b/testdata/cachedb_val_expired.crpl @@ -4,6 +4,7 @@ server: qname-minimisation: no minimal-responses: yes serve-expired: yes + serve-expired-client-timeout: 0 ;module-config: "subnetcache validator cachedb iterator" module-config: "validator cachedb iterator" diff --git a/testdata/dnstap.tdir/dnstap.conf b/testdata/dnstap.tdir/dnstap.conf index fc382ccfd..b5497bfeb 100644 --- a/testdata/dnstap.tdir/dnstap.conf +++ b/testdata/dnstap.tdir/dnstap.conf @@ -12,8 +12,9 @@ server: do-not-query-localhost: no local-zone: "example.net." redirect local-data: "example.net. IN A 10.20.30.41" - serve-expired: yes - serve-expired-reply-ttl: 30 + serve-expired: yes + serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 30 remote-control: control-enable: yes control-interface: 127.0.0.1 diff --git a/testdata/fwd_0ttlservfail.rpl b/testdata/fwd_0ttlservfail.rpl index ed912c73b..d50d386d4 100644 --- a/testdata/fwd_0ttlservfail.rpl +++ b/testdata/fwd_0ttlservfail.rpl @@ -2,6 +2,7 @@ ; config options go here. server: serve-expired: yes + serve-expired-client-timeout: 0 prefetch: yes forward-zone: name: "." forward-addr: 216.0.0.1 CONFIG_END diff --git a/testdata/serve_expired.rpl b/testdata/serve_expired.rpl index 3f61019fa..990a562c7 100644 --- a/testdata/serve_expired.rpl +++ b/testdata/serve_expired.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 access-control: 127.0.0.1/32 allow_snoop ede: yes ede-serve-expired: yes diff --git a/testdata/serve_expired_0ttl_nodata.rpl b/testdata/serve_expired_0ttl_nodata.rpl index 7f1b5a565..032706f23 100644 --- a/testdata/serve_expired_0ttl_nodata.rpl +++ b/testdata/serve_expired_0ttl_nodata.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 log-servfail: yes ede: yes ede-serve-expired: yes diff --git a/testdata/serve_expired_0ttl_nxdomain.rpl b/testdata/serve_expired_0ttl_nxdomain.rpl index 4adb4b839..146752658 100644 --- a/testdata/serve_expired_0ttl_nxdomain.rpl +++ b/testdata/serve_expired_0ttl_nxdomain.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 log-servfail: yes ede: yes ede-serve-expired: yes diff --git a/testdata/serve_expired_0ttl_servfail.rpl b/testdata/serve_expired_0ttl_servfail.rpl index 6833af17b..a3bf826fe 100644 --- a/testdata/serve_expired_0ttl_servfail.rpl +++ b/testdata/serve_expired_0ttl_servfail.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 log-servfail: yes ede: yes ede-serve-expired: yes diff --git a/testdata/serve_expired_cached_servfail.rpl b/testdata/serve_expired_cached_servfail.rpl index edec74479..3fd7dd274 100644 --- a/testdata/serve_expired_cached_servfail.rpl +++ b/testdata/serve_expired_cached_servfail.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-reply-ttl: 123 log-servfail: yes ede: yes diff --git a/testdata/serve_expired_cached_servfail_refresh.rpl b/testdata/serve_expired_cached_servfail_refresh.rpl index 4d14dd948..6ad73efa4 100644 --- a/testdata/serve_expired_cached_servfail_refresh.rpl +++ b/testdata/serve_expired_cached_servfail_refresh.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-reply-ttl: 123 log-servfail: yes ede: yes diff --git a/testdata/serve_expired_reply_ttl.rpl b/testdata/serve_expired_reply_ttl.rpl index 124fb874d..e76976bde 100644 --- a/testdata/serve_expired_reply_ttl.rpl +++ b/testdata/serve_expired_reply_ttl.rpl @@ -5,6 +5,7 @@ server: minimal-responses: no serve-expired: yes serve-expired-reply-ttl: 123 + serve-expired-client-timeout: 0 ede: yes ede-serve-expired: yes diff --git a/testdata/serve_expired_ttl.rpl b/testdata/serve_expired_ttl.rpl index df4ecb89d..66acbdcf1 100644 --- a/testdata/serve_expired_ttl.rpl +++ b/testdata/serve_expired_ttl.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-ttl: 10 stub-zone: diff --git a/testdata/serve_expired_ttl_reset.rpl b/testdata/serve_expired_ttl_reset.rpl index 521d5a0f0..faedb1cfc 100644 --- a/testdata/serve_expired_ttl_reset.rpl +++ b/testdata/serve_expired_ttl_reset.rpl @@ -4,6 +4,7 @@ server: serve-expired-ttl: 1 serve-expired-ttl-reset: yes serve-expired-reply-ttl: 123 + serve-expired-client-timeout: 0 ede: yes ede-serve-expired: yes forward-zone: name: "." forward-addr: 216.0.0.1 diff --git a/testdata/serve_expired_val_bogus.rpl b/testdata/serve_expired_val_bogus.rpl index 49afcc0eb..6c28aa9a6 100644 --- a/testdata/serve_expired_val_bogus.rpl +++ b/testdata/serve_expired_val_bogus.rpl @@ -10,6 +10,7 @@ server: minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-reply-ttl: 123 ede: yes ede-serve-expired: yes diff --git a/testdata/serve_expired_zerottl.rpl b/testdata/serve_expired_zerottl.rpl index 0239b4a19..1411cb8e7 100644 --- a/testdata/serve_expired_zerottl.rpl +++ b/testdata/serve_expired_zerottl.rpl @@ -4,6 +4,7 @@ server: qname-minimisation: "no" minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-reply-ttl: 123 ede: yes ede-serve-expired: yes diff --git a/testdata/serve_original_ttl.rpl b/testdata/serve_original_ttl.rpl index 24d01b6fe..30503c285 100644 --- a/testdata/serve_original_ttl.rpl +++ b/testdata/serve_original_ttl.rpl @@ -8,6 +8,7 @@ server: cache-max-ttl: 1000 cache-min-ttl: 20 serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-reply-ttl: 123 ede: yes ede-serve-expired: yes diff --git a/testdata/stat_values.tdir/stat_values.conf b/testdata/stat_values.tdir/stat_values.conf index 7886f19bc..d1adff58c 100644 --- a/testdata/stat_values.tdir/stat_values.conf +++ b/testdata/stat_values.tdir/stat_values.conf @@ -14,6 +14,7 @@ server: outbound-msg-retry: 0 root-key-sentinel: no trust-anchor-signaling: no + serve-expired-client-timeout: 0 local-zone: local.zone static local-data: "www.local.zone A 192.0.2.1" diff --git a/testdata/subnet_cached_servfail.crpl b/testdata/subnet_cached_servfail.crpl index 9c746d579..f1a66159c 100644 --- a/testdata/subnet_cached_servfail.crpl +++ b/testdata/subnet_cached_servfail.crpl @@ -12,6 +12,7 @@ server: qname-minimisation: no minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 prefetch: yes stub-zone: diff --git a/testdata/subnet_global_prefetch_always_forward.crpl b/testdata/subnet_global_prefetch_always_forward.crpl index ccfe5dfd6..775474cbc 100644 --- a/testdata/subnet_global_prefetch_always_forward.crpl +++ b/testdata/subnet_global_prefetch_always_forward.crpl @@ -6,6 +6,7 @@ server: trust-anchor-signaling: no target-fetch-policy: "0 0 0 0 0" serve-expired: yes + serve-expired-client-timeout: 0 client-subnet-always-forward: yes module-config: "subnetcache iterator" verbosity: 3 diff --git a/testdata/subnet_global_prefetch_expired.crpl b/testdata/subnet_global_prefetch_expired.crpl index de1b78055..374bf3e69 100644 --- a/testdata/subnet_global_prefetch_expired.crpl +++ b/testdata/subnet_global_prefetch_expired.crpl @@ -14,6 +14,7 @@ server: qname-minimisation: no minimal-responses: no serve-expired: yes + serve-expired-client-timeout: 0 serve-expired-ttl: 1 prefetch: yes