T8881: dns: expose PowerDNS recursor cache tuning options (#5209)

Add refresh-on-ttl-perc, nothing-below-nxdomain, and minimum-ttl-override
under service dns forwarding with recursor template and smoketest coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>

3 files changed, 81 insertions, 0 deletions

diff --git a/data/templates/dns-forwarding/recursor.conf.j2 b/data/templates/dns-forwarding/recursor.conf.j2
index 5ac872f19..b089d8b4d 100644
--- a/data/templates/dns-forwarding/recursor.conf.j2
+++ b/data/templates/dns-forwarding/recursor.conf.j2
@@ -20,6 +20,15 @@ max-cache-entries={{ cache_size }}
 # negative TTL for NXDOMAIN
 max-negative-ttl={{ negative_ttl }}
 
+# TTL refresh percentage
+refresh-on-ttl-perc={{ ttl_percent }}
+
+# nothing-below-nxdomain
+nothing-below-nxdomain={{ nothing_below_nxdomain }}
+
+# minimum-ttl-override
+minimum-ttl-override={{ minimum_ttl_override }}
+
 # timeout
 network-timeout={{ timeout }}
 
diff --git a/interface-definitions/service_dns_forwarding.xml.in b/interface-definitions/service_dns_forwarding.xml.in
index d0bc2e6c8..b07e170f3 100644
--- a/interface-definitions/service_dns_forwarding.xml.in
+++ b/interface-definitions/service_dns_forwarding.xml.in
@@ -684,6 +684,56 @@
                 </properties>
                 <defaultValue>0</defaultValue>
               </leafNode>
+              <leafNode name="ttl-percent">
+                <properties>
+                  <help>Refresh cached records when remaining TTL is below this percentage of the original TTL (0 to disable)</help>
+                  <valueHelp>
+                    <format>u32:0-100</format>
+                    <description>Percentage of original TTL remaining before refresh</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="numeric" argument="--range 0-100"/>
+                  </constraint>
+                </properties>
+                <defaultValue>0</defaultValue>
+              </leafNode>
+              <leafNode name="nothing-below-nxdomain">
+                <properties>
+                  <help>NXDOMAIN subtree handling (RFC 8020)</help>
+                  <completionHelp>
+                    <list>no dnssec yes</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>no</format>
+                    <description>Do not apply RFC 8020 processing</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>dnssec</format>
+                    <description>Apply RFC 8020 only for DNSSEC-validated NXDOMAIN records</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>yes</format>
+                    <description>Apply for any cached NXDOMAIN that is not bogus</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(no|dnssec|yes)</regex>
+                  </constraint>
+                </properties>
+                <defaultValue>dnssec</defaultValue>
+              </leafNode>
+              <leafNode name="minimum-ttl-override">
+                <properties>
+                  <help>Minimum TTL in seconds for cached DNS records</help>
+                  <valueHelp>
+                    <format>u32:0-2147483647</format>
+                    <description>Minimum cached record TTL in seconds</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="numeric" argument="--range 0-2147483647"/>
+                  </constraint>
+                </properties>
+                <defaultValue>1</defaultValue>
+              </leafNode>
               <leafNode name="timeout">
                 <properties>
                   <help>Number of milliseconds to wait for a remote authoritative server to respond</help>
diff --git a/smoketest/scripts/cli/test_service_dns_forwarding.py b/smoketest/scripts/cli/test_service_dns_forwarding.py
index ffc0d7734..52134d8c8 100755
--- a/smoketest/scripts/cli/test_service_dns_forwarding.py
+++ b/smoketest/scripts/cli/test_service_dns_forwarding.py
@@ -131,6 +131,28 @@ class TestServicePowerDNS(VyOSUnitTestSHIM.TestCase):
         tmp = get_config_value('local-port')
         self.assertEqual(tmp, '53')
 
+    # PowerDNS cache-related recursor options
+    def test_recursor_cache_options(self):
+        ttl_percent = '10'
+        nothing_below_nxdomain = 'yes'
+        minimum_ttl_override = '30'
+
+        self.cli_set(base_path + ['ttl-percent', ttl_percent])
+        self.cli_set(base_path + ['nothing-below-nxdomain', nothing_below_nxdomain])
+        self.cli_set(base_path + ['minimum-ttl-override', minimum_ttl_override])
+
+        self.cli_commit()
+
+        self.assertEqual(get_config_value('refresh-on-ttl-perc'), ttl_percent)
+        self.assertEqual(get_config_value('nothing-below-nxdomain'), nothing_below_nxdomain)
+        self.assertEqual(get_config_value('minimum-ttl-override'), minimum_ttl_override)
+
+    def test_nothing_below_nxdomain(self):
+        for option in ['no', 'dnssec', 'yes']:
+            self.cli_set(base_path + ['nothing-below-nxdomain', option])
+            self.cli_commit()
+            self.assertEqual(get_config_value('nothing-below-nxdomain'), option)
+
     def test_dnssec(self):
         # DNSSEC option testing
         options = ['off', 'process-no-validate', 'process', 'log-fail', 'validate']