From 6efda73ed6b64c568e71f279d3c1f3cd17c5aadd Mon Sep 17 00:00:00 2001
From: Michal Nowak <mnowak@isc.org>
Date: Wed, 3 Jun 2026 16:39:56 +0000
Subject: [PATCH] Retry the SOA serial check in the rpz test

While a response-policy zone is being (re)loaded it can briefly answer
with no SOA (SERVFAIL/REFUSED), which `dig +short` renders as empty
output.  get_sn() aborted the whole tests.sh on the first such miss.
Keep probing for up to ten seconds instead of failing on a single
transient miss.

Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit bb4afd1332dc8a29b5e9ebd7925dd885758c736b)
---
 bin/tests/system/rpz/tests.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 6e81866126..504c5382bd 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -124,11 +124,21 @@ setret() {
 # $1=domain
 # $2=DNS server and client IP address
 get_sn() {
-  SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2")
-  SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*' || true)
-  test "$SN" != "" && return
-  echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
-  exit 1
+  gsn_n=0
+  while true; do
+    SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2")
+    SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*' || true)
+    test "$SN" != "" && return
+    # A policy zone being (re)loaded can briefly answer with no SOA
+    # (SERVFAIL/REFUSED), which +short renders as empty output; keep
+    # probing instead of failing on a single transient miss.
+    gsn_n=$((gsn_n + 1))
+    if test "$gsn_n" -gt $TEN_SECS; then
+      echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
+      exit 1
+    fi
+    $WAIT_CMD
+  done
 }
 
 get_sn_fast() {