From 01523a078a848873be90572171124cdd5c1c7b0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 10:04:20 +0200
Subject: [PATCH 1/9] Temporarily remove TCP fallback after UDP timeouts

The retry path in resquery_send() that flipped DNS_FETCHOPT_TCP on a
query whose dispatch had already been bound as UDP in fctx_query() had
no effect on the transport actually used, but did leave a stale TCP
bit visible to downstream consumers (dnstap framing, cookie checks,
the AUTHORITY-NS spoofability guard).

The ineffective code has been removed from resquery_send().  The
TCP fallback functionality will be corrected and restored in the next
commit.

Assisted-by: Claude:claude-opus-4-7
---
 bin/tests/system/dispatch/ans4/ans.py      | 42 ++++++++++++++++++++++
 bin/tests/system/dispatch/ans4/tcp-only.db | 15 ++++++++
 bin/tests/system/dispatch/ns1/root.db      |  2 ++
 bin/tests/system/dispatch/tests_tcponly.py | 33 +++++++++++++++++
 lib/dns/resolver.c                         | 23 ++----------
 5 files changed, 95 insertions(+), 20 deletions(-)
 create mode 100644 bin/tests/system/dispatch/ans4/ans.py
 create mode 100644 bin/tests/system/dispatch/ans4/tcp-only.db
 create mode 100644 bin/tests/system/dispatch/tests_tcponly.py

diff --git a/bin/tests/system/dispatch/ans4/ans.py b/bin/tests/system/dispatch/ans4/ans.py
new file mode 100644
index 0000000000..5ec4985a7b
--- /dev/null
+++ b/bin/tests/system/dispatch/ans4/ans.py
@@ -0,0 +1,42 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from collections.abc import AsyncGenerator
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsProtocol,
+    DnsResponseSend,
+    QueryContext,
+    ResponseAction,
+    ResponseDrop,
+    ResponseHandler,
+)
+
+
+class TcpOnlyHandler(ResponseHandler):
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        if qctx.protocol == DnsProtocol.TCP:
+            yield DnsResponseSend(qctx.response)
+        else:
+            yield ResponseDrop()
+
+
+def main() -> None:
+    server = AsyncDnsServer()
+    server.install_response_handler(TcpOnlyHandler())
+    server.run()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bin/tests/system/dispatch/ans4/tcp-only.db b/bin/tests/system/dispatch/ans4/tcp-only.db
new file mode 100644
index 0000000000..1f95670a4b
--- /dev/null
+++ b/bin/tests/system/dispatch/ans4/tcp-only.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			3600	SOA	. . 1 1 1 1 1
+@			3600	NS	ns
+ns			3600	A	10.53.0.4
+foo			3600	A	127.0.0.1
diff --git a/bin/tests/system/dispatch/ns1/root.db b/bin/tests/system/dispatch/ns1/root.db
index eb9ad3ecf1..be1492082a 100644
--- a/bin/tests/system/dispatch/ns1/root.db
+++ b/bin/tests/system/dispatch/ns1/root.db
@@ -3,3 +3,5 @@
 ns.nil.		300	A	10.53.0.1
 example.	300	NS	ns.example.
 ns.example.	300	A	10.53.0.2
+tcp-only.	300	NS	ns.tcp-only.
+ns.tcp-only.	300	A	10.53.0.4
diff --git a/bin/tests/system/dispatch/tests_tcponly.py b/bin/tests/system/dispatch/tests_tcponly.py
new file mode 100644
index 0000000000..f87919eb2c
--- /dev/null
+++ b/bin/tests/system/dispatch/tests_tcponly.py
@@ -0,0 +1,33 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import dns.message
+import pytest
+
+import isctest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "ans*/ans.run",
+    ]
+)
+
+
+def test_tcponly_not_resolved():
+    """
+    An authoritative server that only answers over TCP is unreachable
+    when its zone is queried over UDP: the resolver does not transparently
+    fall back to TCP after UDP timeouts. (This confirms the expected behavior
+    for this commit; TCP fallback will be restored in the next.)
+    """
+    msg = dns.message.make_query("foo.tcp-only.", "A")
+    res = isctest.query.udp(msg, "10.53.0.2", timeout=15)
+    isctest.check.servfail(res)
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index faf69ba588..71bc2ac11e 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2553,33 +2553,16 @@ resquery_send(resquery_t *query) {
 
 	if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 		isc_sockaddr_t *sockaddr = &query->addrinfo->sockaddr;
-		struct tried *tried;
+		struct tried *tried = triededns(fctx, sockaddr);
 
 		/*
 		 * If this is the first timeout for this server in this
 		 * fetch context, try setting EDNS UDP buffer size to
 		 * the largest UDP response size we have seen from this
 		 * server so far.
-		 *
-		 * If this server has already timed out twice or more in
-		 * this fetch context, force TCP.
 		 */
-		if ((tried = triededns(fctx, sockaddr)) != NULL) {
-			if (tried->count == 1U) {
-				hint = dns_adb_getudpsize(fctx->adb,
-							  query->addrinfo);
-			} else if (tried->count >= 2U) {
-				if ((query->options & DNS_FETCHOPT_TCP) == 0) {
-					/*
-					 * Inform the ADB that we're ending a
-					 * UDP fetch, and turn the query into
-					 * a TCP query.
-					 */
-					dns_adb_endudpfetch(fctx->adb,
-							    query->addrinfo);
-					query->options |= DNS_FETCHOPT_TCP;
-				}
-			}
+		if (tried != NULL && tried->count == 1U) {
+			hint = dns_adb_getudpsize(fctx->adb, query->addrinfo);
 		}
 	}
 	fctx->timeout = false;

From 59c00a6f311108a6fe5dcf58a3bea51cc4f9224c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 11:19:42 +0200
Subject: [PATCH 2/9] Force TCP after repeated UDP timeouts to the same
 authoritative

Make the decision in fctx_query() before the dispatch is bound so the
chosen transport and the DNS_FETCHOPT_TCP flag agree.  The previous
location in resquery_send() ran after the UDP dispatch had already been
attached, so the flag flip had no effect on the wire.

Moving the decision earlier also means FCTX_ADDRINFO_NOEDNS0 servers,
previously exempt, now escalate to TCP too.  TCP works regardless of
EDNS state, so this is the intended behaviour.

Assisted-by: Claude:claude-opus-4-7
---
 bin/tests/system/dispatch/ans4/ans.py      | 10 +++---
 bin/tests/system/dispatch/tests_tcponly.py | 36 ++++++++++++++++++----
 lib/dns/resolver.c                         | 20 ++++++++++++
 3 files changed, 55 insertions(+), 11 deletions(-)

diff --git a/bin/tests/system/dispatch/ans4/ans.py b/bin/tests/system/dispatch/ans4/ans.py
index 5ec4985a7b..d4b4affda7 100644
--- a/bin/tests/system/dispatch/ans4/ans.py
+++ b/bin/tests/system/dispatch/ans4/ans.py
@@ -22,19 +22,19 @@ from isctest.asyncserver import (
 )
 
 
-class TcpOnlyHandler(ResponseHandler):
+class DropUdpHandler(ResponseHandler):
     async def get_responses(
         self, qctx: QueryContext
     ) -> AsyncGenerator[ResponseAction, None]:
-        if qctx.protocol == DnsProtocol.TCP:
-            yield DnsResponseSend(qctx.response)
-        else:
+        if qctx.protocol == DnsProtocol.UDP:
             yield ResponseDrop()
+        else:
+            yield DnsResponseSend(qctx.response)
 
 
 def main() -> None:
     server = AsyncDnsServer()
-    server.install_response_handler(TcpOnlyHandler())
+    server.install_response_handler(DropUdpHandler())
     server.run()
 
 
diff --git a/bin/tests/system/dispatch/tests_tcponly.py b/bin/tests/system/dispatch/tests_tcponly.py
index f87919eb2c..373ee56017 100644
--- a/bin/tests/system/dispatch/tests_tcponly.py
+++ b/bin/tests/system/dispatch/tests_tcponly.py
@@ -9,7 +9,13 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+from re import compile as Re
+from re import escape
+
 import dns.message
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
 import pytest
 
 import isctest
@@ -21,13 +27,31 @@ pytestmark = pytest.mark.extra_artifacts(
 )
 
 
-def test_tcponly_not_resolved():
+def _count_received(path, qname, protocol):
+    pattern = Re(rf"Received {escape(qname)}/IN/A .* \({protocol}\)$")
+    with open(path, encoding="utf-8") as fh:
+        return sum(1 for line in fh if pattern.search(line.rstrip()))
+
+
+def test_tcponly_fallback():
     """
-    An authoritative server that only answers over TCP is unreachable
-    when its zone is queried over UDP: the resolver does not transparently
-    fall back to TCP after UDP timeouts. (This confirms the expected behavior
-    for this commit; TCP fallback will be restored in the next.)
+    A resolver must fall back to TCP after repeated UDP timeouts to the
+    same authoritative server.  ans4 drops every UDP query and answers
+    only over TCP; the resolver must reach the answer via the TCP
+    fallback path, after at least two UDP attempts have been dropped.
     """
     msg = dns.message.make_query("foo.tcp-only.", "A")
     res = isctest.query.udp(msg, "10.53.0.2", timeout=15)
-    isctest.check.servfail(res)
+    isctest.check.noerror(res)
+    rdataset = res.find_rrset(
+        res.answer,
+        dns.name.from_text("foo.tcp-only."),
+        dns.rdataclass.IN,
+        dns.rdatatype.A,
+    )
+    assert str(rdataset[0]) == "127.0.0.1"
+
+    udp = _count_received("ans4/ans.run", "foo.tcp-only", "UDP")
+    tcp = _count_received("ans4/ans.run", "foo.tcp-only", "TCP")
+    assert udp == 2, f"expected exactly 2 UDP queries, got {udp}"
+    assert tcp == 1, f"expected exactly 1 TCP query, got {tcp}"
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 71bc2ac11e..8d4430ddc0 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2033,6 +2033,9 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
 	isc_interval_set(&fctx->interval, seconds, us * NS_PER_US);
 }
 
+static struct tried *
+triededns(fetchctx_t *fctx, isc_sockaddr_t *address);
+
 static isc_result_t
 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	   unsigned int options) {
@@ -2126,6 +2129,23 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		}
 	}
 
+	/*
+	 * If this server has already been tried at least twice in this
+	 * fetch context after the previous attempt timed out, force TCP
+	 * for this attempt.  The decision must be made here, before the
+	 * dispatch type is chosen below, so that the dispatch and the
+	 * DNS_FETCHOPT_TCP flag agree.
+	 */
+	if (fctx->timeout && fctx->timeouts >= 2U &&
+	    (options & DNS_FETCHOPT_NOEDNS0) == 0 &&
+	    (options & DNS_FETCHOPT_TCP) == 0)
+	{
+		struct tried *tried = triededns(fctx, &sockaddr);
+		if (tried != NULL && tried->count >= 2U) {
+			options |= DNS_FETCHOPT_TCP;
+		}
+	}
+
 	/*
 	 * Allow an additional second for the kernel to resend the SYN
 	 * (or SYN without ECN in the case of stupid firewalls blocking

From 1af37e24b2bcbcd461366d5f52683fa87a211e19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 13:58:39 +0200
Subject: [PATCH 3/9] Open the stale-refresh-time window on any resolver
 failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TCP-fallback fix in the previous commits means a query that would
previously have timed out on UDP now actually escalates to TCP, and a
TCP-side failure surfaces a non-ISC_R_TIMEDOUT result code to
query_usestale().  The trigger for DNS_DBFIND_STALESTART was previously
narrowed to ISC_R_TIMEDOUT, so the stale-refresh-time window stopped
opening for those clients.

Broaden the condition to any failure that has already cleared the
upstream DUPLICATE/DROP filtering in query_usestale() — the spirit of
the window is "the resolver tried and could not get a fresh answer",
not "the resolver timed out specifically".

Co-authored-by: Evan Hunt <each@isc.org>
Assisted-by: Claude:claude-opus-4-7
---
 lib/ns/query.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/ns/query.c b/lib/ns/query.c
index fbb9e8213b..28cbf99250 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7375,10 +7375,10 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
 		}
 
 		/*
-		 * Start the stale-refresh-time window in case there was a
-		 * resolver query timeout.
+		 * Start the stale-refresh-time window as there appears
+		 * to have been a resolver query failure.
 		 */
-		if (qctx->resuming && result == ISC_R_TIMEDOUT) {
+		if (qctx->resuming) {
 			qctx->client->query.dboptions |= DNS_DBFIND_STALESTART;
 		}
 		return true;

From a9283c08c24b22677358782f790c62dfe8569988 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 13:58:49 +0200
Subject: [PATCH 4/9] Emit EDE 22 when the resolver runs out of usable
 addresses

Two exits from fctx_try() landed at DNS_R_SERVFAIL without attaching
DNS_EDE_NOREACHABLEAUTH: when fctx_getaddresses() returned a non-success,
non-wait status, and when every candidate addrinfo was unusable
(over-quota or filtered) after a restart.

With the new TCP fallback actually firing, those paths are now reached
by serve-stale and similar scenarios in which the auth is unreachable.
Attach the EDE so SERVFAIL responses keep carrying the same operator
signal that the timeout-based exit paths already produce.

Co-authored-by: Evan Hunt <each@isc.org>
Assisted-by: Claude:claude-opus-4-7
---
 lib/dns/resolver.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 8d4430ddc0..0fc89804b8 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4354,6 +4354,8 @@ fctx_try(fetchctx_t *fctx, bool retrying) {
 			FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT);
 			return;
 		default:
+			dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH,
+				    NULL);
 			goto done;
 		}
 
@@ -4371,6 +4373,8 @@ fctx_try(fetchctx_t *fctx, bool retrying) {
 		 */
 		if (addrinfo == NULL) {
 			result = DNS_R_SERVFAIL;
+			dns_ede_add(&fctx->edectx, DNS_EDE_NOREACHABLEAUTH,
+				    NULL);
 			goto done;
 		}
 	}

From a0db3d65056c25b6876c9b976c1e6cf560b2cd28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 13:58:59 +0200
Subject: [PATCH 5/9] Tighten serve_stale dig timeouts and inter-step sleeps

With the TCP fallback now actually firing after repeated UDP timeouts,
the resolver covers more retry transitions in the same wall-clock
window, and the original 3-second budgets in two steps of the
serve_stale test left no margin: the dig client at +timeout=3 and the
"sleep 3" before re-enabling the upstream both straddled the moment at
which the resolver switched transport, making the asserted outcome
race-prone.

Drop the dig timeout to 2s and the sleep to 1s so each step lands
firmly on one side of the transport switch.

Co-authored-by: Evan Hunt <each@isc.org>
Assisted-by: Claude:claude-opus-4-7
---
 bin/tests/system/serve_stale/tests.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/tests/system/serve_stale/tests.sh b/bin/tests/system/serve_stale/tests.sh
index 90841afe6a..fe862b2949 100755
--- a/bin/tests/system/serve_stale/tests.sh
+++ b/bin/tests/system/serve_stale/tests.sh
@@ -1399,7 +1399,7 @@ sleep 2
 n=$((n + 1))
 echo_i "check notincache.example TXT times out (max-stale-ttl default) ($n)"
 ret=0
-$DIG -p ${PORT} +tries=1 +timeout=3 @10.53.0.3 notfound.example TXT >dig.out.test$n 2>&1 && ret=1
+$DIG -p ${PORT} +tries=1 +timeout=2 @10.53.0.3 notfound.example TXT >dig.out.test$n 2>&1 && ret=1
 grep "timed out" dig.out.test$n >/dev/null || ret=1
 grep ";; no servers could be reached" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1947,7 +1947,7 @@ status=$((status + ret))
 # authoritative server.
 echo_i "sending query for test $((n + 2))"
 $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$((n + 2)) &
-sleep 3
+sleep 1
 
 n=$((n + 1))
 echo_i "enable responses from authoritative server ($n)"

From 308c370796a6d65ad7e536b9e63de775ec8576ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 13:59:07 +0200
Subject: [PATCH 6/9] Allow either UDP or TCP queries in flight in statistics
 test

The "active sockets" and "queries in progress" assertions previously
required exactly one extra UDP/IPv4 socket and exactly one UDP query in
progress, with no TCP counterpart.  That shape held only because the
broken TCP-fallback path left the resolver retrying UDP indefinitely.

With the fix in place, after two UDP timeouts to the same authority the
resolver legitimately escalates to TCP, and a stats snapshot taken
during recursion may catch the in-flight query on either transport.
Count the UDP and TCP counters together so the test reflects the new
correct behaviour.

Assisted-by: Claude:claude-opus-4-7
---
 bin/tests/system/statistics/tests.sh | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/bin/tests/system/statistics/tests.sh b/bin/tests/system/statistics/tests.sh
index dab0f28a49..71187a5fe3 100644
--- a/bin/tests/system/statistics/tests.sh
+++ b/bin/tests/system/statistics/tests.sh
@@ -122,18 +122,24 @@ n=$((n + 1))
 
 ret=0
 echo_i "verifying active sockets output in named.stats ($n)"
-nsock1nstat=$(grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}')
-[ $((nsock1nstat - nsock0nstat)) -eq 1 ] || ret=1
+# After repeated UDP timeouts to the same authoritative server, the
+# resolver switches to TCP, so the in-flight socket may be either UDP
+# or TCP.  Require at least one extra active socket of either kind.
+nsock1udp=$(grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}')
+nsock1tcp=$(grep "TCP/IPv4 sockets active" $last_stats | awk '{print $1}')
+[ $((${nsock1udp:-0} + ${nsock1tcp:-0} - nsock0nstat)) -ge 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 n=$((n + 1))
 
-# there should be 1 UDP and no TCP queries.  As the TCP counter is zero
-# no status line is emitted.
+# There should be 1 query in progress.  After repeated UDP timeouts the
+# resolver switches to TCP, so depending on which retry attempt the
+# snapshot captures the query may be counted as either UDP or TCP.
 ret=0
 echo_i "verifying queries in progress in named.stats ($n)"
-grep "1 UDP queries in progress" $last_stats >/dev/null || ret=1
-grep "TCP queries in progress" $last_stats >/dev/null && ret=1
+udp_in_progress=$(awk '/UDP queries in progress/ {print $1}' $last_stats)
+tcp_in_progress=$(awk '/TCP queries in progress/ {print $1}' $last_stats)
+[ $((${udp_in_progress:-0} + ${tcp_in_progress:-0})) -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 n=$((n + 1))

From 0c0e9056155ffd3c318689ffb5f7c9c7940748ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 17:10:19 +0200
Subject: [PATCH 7/9] Add pytest serve_stale TCP-fallback regression tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The serve_stale shell suite uses a UDP-only perl mock as its
authoritative server.  Now that the resolver escalates to TCP after
repeated UDP timeouts, three steps in serve_stale/tests.sh that
exercise resolver-query-timeout behaviour no longer reach the
timeout — the TCP fallback short-circuits to SERVFAIL via
`connection refused` on the perl mock.

Move those scenarios to a new system test directory
`bin/tests/system/serve_stale_tcp/` that uses a
ControllableAsyncDnsServer mock listening on both UDP and TCP, so
the resolver's TCP path is exercised end-to-end and the original
timing semantics are preserved.  Remove the corresponding shell
steps from serve_stale/tests.sh.

Assisted-by: Claude:claude-opus-4-7
---
 bin/tests/system/serve_stale/tests.sh         |  77 ++++---------
 bin/tests/system/serve_stale_tcp/ans3/ans.py  |  22 ++++
 .../system/serve_stale_tcp/ans3/example.db    |  15 +++
 .../system/serve_stale_tcp/ns1/named.conf.j2  |  40 +++++++
 bin/tests/system/serve_stale_tcp/ns1/root.db  |  16 +++
 .../system/serve_stale_tcp/ns2/named.conf.j2  |  48 ++++++++
 .../serve_stale_tcp/tests_serve_stale_tcp.py  | 108 ++++++++++++++++++
 7 files changed, 269 insertions(+), 57 deletions(-)
 create mode 100644 bin/tests/system/serve_stale_tcp/ans3/ans.py
 create mode 100644 bin/tests/system/serve_stale_tcp/ans3/example.db
 create mode 100644 bin/tests/system/serve_stale_tcp/ns1/named.conf.j2
 create mode 100644 bin/tests/system/serve_stale_tcp/ns1/root.db
 create mode 100644 bin/tests/system/serve_stale_tcp/ns2/named.conf.j2
 create mode 100644 bin/tests/system/serve_stale_tcp/tests_serve_stale_tcp.py

diff --git a/bin/tests/system/serve_stale/tests.sh b/bin/tests/system/serve_stale/tests.sh
index fe862b2949..92826cfd1f 100755
--- a/bin/tests/system/serve_stale/tests.sh
+++ b/bin/tests/system/serve_stale/tests.sh
@@ -1394,23 +1394,16 @@ status=$((status + ret))
 
 sleep 2
 
-# Check that if we don't have stale data for a domain name, we will
-# not answer anything until the resolver query timeout.
-n=$((n + 1))
-echo_i "check notincache.example TXT times out (max-stale-ttl default) ($n)"
-ret=0
-$DIG -p ${PORT} +tries=1 +timeout=2 @10.53.0.3 notfound.example TXT >dig.out.test$n 2>&1 && ret=1
-grep "timed out" dig.out.test$n >/dev/null || ret=1
-grep ";; no servers could be reached" dig.out.test$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+# Note: the "notincache.example TXT times out" step (the original test
+# 120) has been moved to the pytest suite in serve_stale_tcp/, since
+# the resolver now legitimately escalates to TCP after repeated UDP
+# timeouts and the perl mock ans2 only listens on UDP.
 
 echo_i "sending queries for tests $((n + 1))-$((n + 4))..."
 $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$((n + 1)) &
 $DIG -p ${PORT} @10.53.0.3 othertype.example CAA >dig.out.test$((n + 2)) &
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT >dig.out.test$((n + 3)) &
 $DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT >dig.out.test$((n + 4)) &
-$DIG -p ${PORT} @10.53.0.3 notfound.example TXT >dig.out.test$((n + 5)) &
 
 wait
 
@@ -1452,18 +1445,9 @@ grep "ANSWER: 0," dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-# The notfound.example check is different than nxdomain.example because
-# we didn't send a prime query to add notfound.example to the cache.
-# Independently, EDE 22 is sent as the authoritative server doesn't respond.
-n=$((n + 1))
-echo_i "check notfound.example TXT (max-stale-ttl default) ($n)"
-ret=0
-grep "status: SERVFAIL" dig.out.test$n >/dev/null || ret=1
-grep "EDE: 22 (No Reachable Authority)" dig.out.test$n >/dev/null || ret=1
-grep "EDE: 3 (Stale Answer)" dig.out.test$n >/dev/null && ret=1
-grep "ANSWER: 0," dig.out.test$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
+# Note: the "notfound.example TXT" SERVFAIL+EDE 22 step (the original
+# test 125) has been moved to the pytest suite in serve_stale_tcp/;
+# see the comment above where test 120 was removed.
 
 #
 # Now test server with serve-stale answers disabled.
@@ -1922,10 +1906,19 @@ grep -F "#!TXT" ns5/named.stats.$n.cachedb >/dev/null && ret=1
 status=$((status + ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
-#############################################
-# Test for stale-answer-client-timeout off. #
-#############################################
-echo_i "test stale-answer-client-timeout (off)"
+check_server_responds() {
+  $DIG -p ${PORT} @10.53.0.3 version.bind txt ch >dig.out.test$n || return 1
+  grep "status: NOERROR" dig.out.test$n >/dev/null || return 1
+}
+
+##############################################################
+# Test for stale-answer-client-timeout off and CNAME record. #
+##############################################################
+# The standalone "stale-answer-client-timeout off" test (the original
+# test 163) has been moved to the pytest suite in serve_stale_tcp/;
+# see the comment where test 120 was removed.  Its configuration
+# (named3.conf) is still used as the base for the CNAME case below.
+echo_i "test stale-answer-client-timeout (0) and CNAME record"
 
 n=$((n + 1))
 echo_i "updating ns3/named3.conf ($n)"
@@ -1941,14 +1934,6 @@ rndc_reload ns3 10.53.0.3
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-# Send a query, auth server is disabled, we will enable it after a while in
-# order to receive an answer before resolver-query-timeout expires. Since
-# stale-answer-client-timeout is disabled we must receive an answer from
-# authoritative server.
-echo_i "sending query for test $((n + 2))"
-$DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$((n + 2)) &
-sleep 1
-
 n=$((n + 1))
 echo_i "enable responses from authoritative server ($n)"
 ret=0
@@ -1958,28 +1943,6 @@ grep "TXT.\"1\"" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-# Wait until dig is done.
-wait
-
-n=$((n + 1))
-echo_i "check data.example TXT comes from authoritative server (stale-answer-client-timeout off) ($n)"
-grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
-grep "EDE" dig.out.test$n >/dev/null && ret=1
-grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
-grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n >/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-check_server_responds() {
-  $DIG -p ${PORT} @10.53.0.3 version.bind txt ch >dig.out.test$n || return 1
-  grep "status: NOERROR" dig.out.test$n >/dev/null || return 1
-}
-
-##############################################################
-# Test for stale-answer-client-timeout off and CNAME record. #
-##############################################################
-echo_i "test stale-answer-client-timeout (0) and CNAME record"
-
 n=$((n + 1))
 echo_i "prime cache shortttl.cname.example (stale-answer-client-timeout off) ($n)"
 ret=0
diff --git a/bin/tests/system/serve_stale_tcp/ans3/ans.py b/bin/tests/system/serve_stale_tcp/ans3/ans.py
new file mode 100644
index 0000000000..7224942ac3
--- /dev/null
+++ b/bin/tests/system/serve_stale_tcp/ans3/ans.py
@@ -0,0 +1,22 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from isctest.asyncserver import ControllableAsyncDnsServer, ToggleResponsesCommand
+
+
+def main() -> None:
+    server = ControllableAsyncDnsServer()
+    server.install_control_command(ToggleResponsesCommand())
+    server.run()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bin/tests/system/serve_stale_tcp/ans3/example.db b/bin/tests/system/serve_stale_tcp/ans3/example.db
new file mode 100644
index 0000000000..198cbf6d3b
--- /dev/null
+++ b/bin/tests/system/serve_stale_tcp/ans3/example.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		300	SOA	ns.example. root.example. 1 3600 1800 604800 300
+@		300	NS	ns.example.
+ns.example.	300	A	10.53.0.3
+data		2	TXT	"A text record with a 2 second ttl"
diff --git a/bin/tests/system/serve_stale_tcp/ns1/named.conf.j2 b/bin/tests/system/serve_stale_tcp/ns1/named.conf.j2
new file mode 100644
index 0000000000..de5a836e48
--- /dev/null
+++ b/bin/tests/system/serve_stale_tcp/ns1/named.conf.j2
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
diff --git a/bin/tests/system/serve_stale_tcp/ns1/root.db b/bin/tests/system/serve_stale_tcp/ns1/root.db
new file mode 100644
index 0000000000..97e3fec66b
--- /dev/null
+++ b/bin/tests/system/serve_stale_tcp/ns1/root.db
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.			300	SOA	. . 0 0 0 0 0
+.			300	NS	ns.nil.
+ns.nil.			300	A	10.53.0.1
+example.		300	NS	ns.example.
+ns.example.		300	A	10.53.0.3
diff --git a/bin/tests/system/serve_stale_tcp/ns2/named.conf.j2 b/bin/tests/system/serve_stale_tcp/ns2/named.conf.j2
new file mode 100644
index 0000000000..32ed90cf4c
--- /dev/null
+++ b/bin/tests/system/serve_stale_tcp/ns2/named.conf.j2
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+
+	recursion yes;
+	dnssec-validation no;
+	qname-minimization off;
+
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-ttl 3;
+	stale-refresh-time 0;
+	max-stale-ttl 3600;
+	stale-answer-client-timeout off;
+};
+
+zone "." {
+	type hint;
+	file "../../_common/root.hint";
+};
diff --git a/bin/tests/system/serve_stale_tcp/tests_serve_stale_tcp.py b/bin/tests/system/serve_stale_tcp/tests_serve_stale_tcp.py
new file mode 100644
index 0000000000..57d6be5574
--- /dev/null
+++ b/bin/tests/system/serve_stale_tcp/tests_serve_stale_tcp.py
@@ -0,0 +1,108 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import threading
+import time
+
+import dns.edns
+import dns.exception
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
+import pytest
+
+import isctest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "ans*/ans.run",
+    ]
+)
+
+
+def _toggle(mode: str) -> None:
+    msg = isctest.query.create(f"{mode}.send-responses._control.", "TXT", dnssec=False)
+    isctest.query.udp(msg, "10.53.0.3", attempts=1)
+
+
+def test_no_stale_data_times_out():
+    """Verify the resolver does not answer until the query timeout.
+
+    With the authoritative server unresponsive and the queried name
+    absent from the cache, dig must time out instead of receiving a
+    fast SERVFAIL (the original test 120 in serve_stale/tests.sh).
+    """
+
+    _toggle("disable")
+    msg = isctest.query.create("notincache.example.", "TXT", dnssec=False)
+    start = time.monotonic()
+    with pytest.raises(dns.exception.Timeout):
+        isctest.query.udp(msg, "10.53.0.2", timeout=3, attempts=1)
+    assert time.monotonic() - start >= 3
+
+
+def test_servfail_with_ede22():
+    """Verify SERVFAIL carries EDE 22 (and not EDE 3) when auth is unreachable.
+
+    With the authoritative server unresponsive and no cached data to
+    serve stale, the resolver must return SERVFAIL with EDE 22 (No
+    Reachable Authority) and must not attach EDE 3 (Stale Answer)
+    (the original test 125 in serve_stale/tests.sh).
+    """
+
+    _toggle("disable")
+    msg = isctest.query.create("notfound.example.", "TXT", dnssec=False)
+    res = isctest.query.udp(msg, "10.53.0.2", timeout=15, attempts=1)
+    isctest.check.servfail(res)
+    isctest.check.ede(res, dns.edns.EDECode.NO_REACHABLE_AUTHORITY)
+    assert not any(
+        opt.otype == dns.edns.OptionType.EDE
+        and opt.code == dns.edns.EDECode.STALE_ANSWER
+        for opt in res.options
+    ), "unexpected stale-answer EDE in SERVFAIL response"
+    assert len(res.answer) == 0
+
+
+def test_authoritative_answer_after_reenable():
+    """Verify the resolver waits for auth to recover instead of failing fast.
+
+    Prime the cache, let the TTL expire, disable the authoritative
+    server, issue a query, and re-enable the authoritative server
+    while the query is still in flight.  The resolver must return an
+    authoritative NOERROR answer with no EDE attached, not a stale
+    answer or SERVFAIL (the original test 163 in serve_stale/tests.sh).
+    """
+
+    _toggle("enable")
+    msg = isctest.query.create("data.example.", "TXT", dnssec=False)
+    isctest.check.noerror(isctest.query.udp(msg, "10.53.0.2", timeout=5))
+
+    # allow the 2s TTL to expire
+    time.sleep(3)
+
+    _toggle("disable")
+
+    timer = threading.Timer(1.0, _toggle, args=("enable",))
+    timer.start()
+    try:
+        res = isctest.query.udp(msg, "10.53.0.2", timeout=15, attempts=1)
+    finally:
+        timer.join()
+
+    isctest.check.noerror(res)
+    isctest.check.noede(res)
+    answer = res.find_rrset(
+        res.answer,
+        dns.name.from_text("data.example."),
+        dns.rdataclass.IN,
+        dns.rdatatype.TXT,
+    )
+    assert "A text record with a 2 second ttl" in str(answer[0])

From db28b2127abdd92d83a1da8ae84b7b88dce53a86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 May 2026 18:18:27 +0200
Subject: [PATCH 8/9] Raise the per-server recursive-clients ceiling in
 fetchlimit

With the resolver now legitimately escalating to TCP after repeated
UDP timeouts to the same authoritative, each lame-server lookup
takes ~50% longer to fail.  The recursive-client backlog therefore
peaks a little higher before the fetches-per-server auto-tune drops
the quota below 200.

Bump the upper bound for the burst-against-lame-server and recovery
steps from 200 to 250 to absorb that extra latency.  The lower bound
and the final post-recovery target (clients <= 20) are unchanged.

Assisted-by: Claude:claude-opus-4-7
---
 bin/tests/system/fetchlimit/tests.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/bin/tests/system/fetchlimit/tests.sh b/bin/tests/system/fetchlimit/tests.sh
index 3d8a77397a..b36f792570 100644
--- a/bin/tests/system/fetchlimit/tests.sh
+++ b/bin/tests/system/fetchlimit/tests.sh
@@ -82,9 +82,11 @@ for try in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
   burst 10.53.0.3 a $try
   # fetches-per-server is at 400, but at 20qps against a lame server,
   # we'll reach 200 at the tenth second, and the quota should have been
-  # tuned to less than that by then.
+  # tuned to less than that by then.  Allow a small margin above 200
+  # to absorb the extra latency introduced by the resolver's TCP
+  # fallback after repeated UDP timeouts.
   [ $try -le 5 ] && low=$((try * 10))
-  stat 10.53.0.3 20 200 || ret=1
+  stat 10.53.0.3 20 250 || ret=1
   [ $ret -eq 1 ] && break
   sleep 1
 done
@@ -125,7 +127,7 @@ ret=0
 sendcmd 10.53.0.4 send-responses "enable"
 for try in 1 2 3 4 5; do
   burst 10.53.0.3 b $try
-  stat 10.53.0.3 0 200 || ret=1
+  stat 10.53.0.3 0 250 || ret=1
   [ $ret -eq 1 ] && break
   sleep 1
 done

From 08295d004ee9bdfc8fb8e59aa124e7874ae7b23b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Sat, 16 May 2026 13:24:53 +0200
Subject: [PATCH 9/9] Skip EDNS UDP-size hint on TCP retries

The hint feeds the EDNS OPT UDP-size field, which has no effect on TCP
transport.  Avoid the dns_adb_getudpsize() lookup when the query is
already pinned to TCP.

Assisted-by: Claude:claude-opus-4-7
---
 lib/dns/resolver.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 0fc89804b8..7095143dd3 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2571,7 +2571,9 @@ resquery_send(resquery_t *query) {
 		query->options |= DNS_FETCHOPT_NOEDNS0;
 	}
 
-	if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
+	if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0 &&
+	    (query->options & DNS_FETCHOPT_TCP) == 0)
+	{
 		isc_sockaddr_t *sockaddr = &query->addrinfo->sockaddr;
 		struct tried *tried = triededns(fctx, sockaddr);