pq/freemkv-keysources
1
Fork 0
mirror of https://github.com/freemkv/freemkv-keysources.git synced 2026-10-07 18:13:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

online: offline Temporary-verdict test; proxy wording

Browse Source 
Drop the real-DNS .invalid test for an offline check of every GuardFail::Unreachable reason; say every key lookup failed.
This commit is contained in:
Matthew Jackson
2026-09-27 16:44:34 -07:00
parent 1606ff3ca3
commit cedbc4b1fa
2 changed files with 14 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1 -1
View File
@@ -4,7 +4,7 @@
### Fixed
- The online key service ignores `HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`: with one set, every key lookup failed to connect (the pinned resolver also answered the proxy's address).
- The online key service ignores `HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`: with one set, every key lookup failed (the pinned resolver also answered the proxy's address, so the proxy request went to the key service).
### Added
src/online.rs
+13 -15
View File
@@ -336,7 +336,7 @@ fn hardened_agent(pinned: Vec<SocketAddr>) -> ureq::Agent {
// answer arrives in one read, so a TOTAL cap is the right shape here.
.timeout_recv_body(Some(Duration::from_secs(TIMEOUT_SECS)))
// Never the env proxy: PinnedResolver would also answer the proxy's lookup with the key
// service's address, so with HTTP(S)_PROXY/ALL_PROXY set every key lookup failed to connect.
// service's address, so with HTTP(S)_PROXY/ALL_PROXY set every key lookup failed.
.proxy(None)
.build();
// `with_parts`, never `new_with_config` — see [`PinnedResolver`].
@@ -1105,24 +1105,22 @@ mod tests {
#[test]
fn a_failed_lookup_is_a_temporary_rejection() {
let r = KeyserverUrlRejection::from((
GuardFail::Unreachable,
"DNS resolution timed out".into(),
));
assert_eq!(r.fault, KeyserverUrlFault::Temporary);
assert!(r.is_temporary());
assert_eq!(r.message, "DNS resolution timed out");
// Offline: every GuardFail::Unreachable reason resolve_and_guard produces.
for msg in [
"DNS resolution timed out",
"could not resolve host: failed to lookup address information",
"host did not resolve to any address",
"too many concurrent DNS resolutions in flight for this host",
] {
let r = KeyserverUrlRejection::from((GuardFail::Unreachable, msg.to_string()));
assert_eq!(r.fault, KeyserverUrlFault::Temporary, "{msg}");
assert!(r.is_temporary());
assert_eq!(r.message, msg);
}
let c = KeyserverUrlRejection::from((GuardFail::Config, "URL has no host".into()));
assert_eq!(c.fault, KeyserverUrlFault::Permanent);
}
// RFC 6761: `.invalid` never resolves, so the lookup fails (or times out) either way.
#[test]
fn an_unresolvable_host_is_a_temporary_rejection() {
let r = check_keyserver_url("https://nonexistent.invalid/").unwrap_err();
assert_eq!(r.fault, KeyserverUrlFault::Temporary, "{r}");
}
// Callers test their verdict mapping with the hook instead of a real DNS lookup.
#[test]
fn the_decode_reachability_hook_plants_what_take_reads() {