From 11e85d15f96e25ff9dc462f3c2cd7598b672117e Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Tue, 9 Jan 2024 11:35:11 +0000
Subject: [PATCH 1/3] Fix a possible dig/host crash in "NS search" mode

When getting a SERVFAIL reply from a query, 'host' tries to start
the next query in the lookup's list (also true for 'dig  +nofail').
However, when running with the '-C' switch (or +nssearch for 'dig'),
all the queries in the lookup start from the beginning, so that logic
brings to a crash because of the attempted start of the query which
was already started.

Don't start the next query in the affected code path when in +nssearch
mode.

(cherry picked from commit f6658b333e44982d8272799e1577b6872909537f)
---
 bin/dig/dighost.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index a8ae79fc28..5b4dca2774 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -4365,7 +4365,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		if (l->current_query == query) {
 			query_detach(&l->current_query);
 		}
-		if (next != NULL) {
+		if (next != NULL && (!l->ns_search_only || l->trace_root)) {
 			debug("sending query %p", next);
 			if (l->tcp_mode) {
 				start_tcp(next);

From 086f569f5270fc412771429ea19e384a9ad13a46 Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Tue, 9 Jan 2024 11:51:34 +0000
Subject: [PATCH 2/3] Print a dig comment about the failed query consistently

Dig failed to print a comment about the reason of the unacceptable
query reply got from a server when there was no other query to
start in the lookup's chain.

Add an "else" block to print out the comment even when not starting
up the next query.

(cherry picked from commit 913b20abf816b1a2d8581fab7f780f5addf3b5e0)
---
 bin/dig/dighost.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 5b4dca2774..5d40c6155f 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -4361,29 +4361,32 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
 	{
+		const char *err = (msg->rcode == dns_rcode_servfail &&
+				   !l->servfail_stops)
+					  ? "SERVFAIL reply"
+					  : "recursion not available";
 		dig_query_t *next = ISC_LIST_NEXT(query, link);
 		if (l->current_query == query) {
 			query_detach(&l->current_query);
 		}
 		if (next != NULL && (!l->ns_search_only || l->trace_root)) {
+			dighost_comments(l,
+					 "Got %s from %s, trying next server",
+					 err, query->servname);
 			debug("sending query %p", next);
 			if (l->tcp_mode) {
 				start_tcp(next);
 			} else {
 				start_udp(next);
 			}
-			dighost_comments(l,
-					 "Got %s from %s, trying next "
-					 "server",
-					 msg->rcode == dns_rcode_servfail
-						 ? "SERVFAIL reply"
-						 : "recursion not available",
-					 query->servname);
 			if (check_if_queries_done(l, query)) {
 				goto cancel_lookup;
 			}
 
 			goto detach_query;
+		} else {
+			dighost_comments(l, "Got %s from %s", err,
+					 query->servname);
 		}
 	}
 

From 55cc5fea67b8f8a9bfcf6e5159578a6b7c5cfa4c Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Tue, 9 Jan 2024 12:01:14 +0000
Subject: [PATCH 3/3] Add a CHANGES note for [GL #4508]

(cherry picked from commit 1246d982a275fdc367319886ba9cc514c83153dc)
---
 CHANGES | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGES b/CHANGES
index 6faa12370c..d9a0c0e083 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6320.	[bug]		Fix a possible crash in 'dig +nssearch +nofail' and
+			'host -C' commands when one of the name servers returns
+			SERVFAIL. [GL #4508]
+
 6312.	[bug]		Conversion from NSEC3 signed to NSEC signed could
 			temporarily put the zone into a state where it was
 			treated as unsigned until the NSEC chain was built.