diff --git a/CHANGES b/CHANGES index 3536565c8a..14e6a610bd 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5936. [bug] Don't enable serve-stale for lookups that error because + it is a duplicate query or a query that would be + dropped. [GL #2982] + 5935. [bug] Fix DiG lookup reference counting bug, which could be observed in NSSEARCH mode. [GL #3478] diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst index 59188df86e..3700e9a3a1 100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-current.rst @@ -40,4 +40,7 @@ Feature Changes Bug Fixes ~~~~~~~~~ -- None. +- Fix a serve-stale bug, where BIND would try to return stale data from cache + for lookups that received duplicate queries or queries that would be dropped. + This bug resulted in premature SERVFAIL responses, and has now been resolved. + :gl:`#2982` diff --git a/lib/ns/query.c b/lib/ns/query.c index 18ab138b1c..1b3261de25 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -7575,6 +7575,14 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) { return (false); } + if (result == DNS_R_DUPLICATE || result == DNS_R_DROP) { + /* + * Don't enable serve-stale if the result signals a duplicate + * query or query that is being dropped. + */ + return (false); + } + qctx_clean(qctx); qctx_freedata(qctx);