From c2ebd1f66e5e695d1d772654c710560a2893f958 Mon Sep 17 00:00:00 2001 From: Alessio Podda Date: Sun, 24 May 2026 13:11:29 +0200 Subject: [PATCH 1/2] Add RRL cached NXDOMAIN system test Add a Python system test that primes ns2's negative cache, queries the cached NXDOMAIN through RRL, and verifies named remains responsive. --- bin/tests/system/rrl/tests_ncache.py | 32 ++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 bin/tests/system/rrl/tests_ncache.py diff --git a/bin/tests/system/rrl/tests_ncache.py b/bin/tests/system/rrl/tests_ncache.py new file mode 100644 index 0000000000..3b6e30e672 --- /dev/null +++ b/bin/tests/system/rrl/tests_ncache.py @@ -0,0 +1,32 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +import dns.rcode + +import isctest + + +def test_rrl_cached_recursive_nxdomain(ns2): + query = isctest.query.create("ncache.tld3.", "A", dnssec=False) + + # Prime ns2's negative cache, then query it again to exercise + # query_checkrrl() with DNS_R_NCACHENXDOMAIN. + response = isctest.query.udp( + query, ns2.ip, port=ns2.ports.dns, timeout=5, attempts=3 + ) + assert response.rcode() == dns.rcode.NXDOMAIN + + response = isctest.query.udp( + query, ns2.ip, port=ns2.ports.dns, timeout=5, attempts=3 + ) + assert response.rcode() == dns.rcode.NXDOMAIN + + ns2.rndc("status") From aa022f7ea26527a52f554cf8fffc2bf9f7f68261 Mon Sep 17 00:00:00 2001 From: Alessio Podda Date: Sun, 24 May 2026 13:12:11 +0200 Subject: [PATCH 2/2] Keep RRL ncache fixed name alive Move the fixed name storage out of the NCACHE branch so the name passed to dns_rrl() remains valid for cached NXDOMAIN responses. --- lib/ns/query.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/ns/query.c b/lib/ns/query.c index 4fd70e6fbc..0821050c22 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -6839,6 +6839,7 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) { { bool wouldlog; const dns_name_t *constname; + dns_fixedname_t constname_fixed; char log_buf[DNS_RRL_LOG_BUF_LEN]; isc_result_t resp_result; dns_rrl_result_t rrl_result; @@ -6864,8 +6865,8 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) { * Try to use owner name in the negative cache SOA. */ dns_rdataset_t nc_rdataset = DNS_RDATASET_INIT; - dns_fixedname_t fixed; - dns_name_t *n = dns_fixedname_initname(&fixed); + dns_name_t *n = + dns_fixedname_initname(&constname_fixed); DNS_RDATASET_FOREACH(qctx->rdataset) { dns_ncache_current(qctx->rdataset, n, &nc_rdataset);