diff --git a/CHANGES b/CHANGES index b8db96e181..81399474e4 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5936. [bug] Don't enable serve-stale for lookups that error because + it is a duplicate query or a query that would be + dropped. [GL #2982] + 5935. [bug] Fix DiG lookup reference counting bug, which could be observed in NSSEARCH mode. [GL #3478] diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst index 71ec1735ce..ee2b01cdf8 100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-current.rst @@ -40,4 +40,7 @@ Feature Changes Bug Fixes ~~~~~~~~~ -- None. +- Fix a serve-stale bug, where BIND would try to return stale data from cache + for lookups that received duplicate queries or queries that would be dropped. + This bug resulted in premature SERVFAIL responses, and has now been resolved. + :gl:`#2982` diff --git a/lib/ns/query.c b/lib/ns/query.c index 879a9d68eb..90e74ed0e2 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -7472,6 +7472,14 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) { return (false); } + if (result == DNS_R_DUPLICATE || result == DNS_R_DROP) { + /* + * Don't enable serve-stale if the result signals a duplicate + * query or query that is being dropped. + */ + return (false); + } + qctx_clean(qctx); qctx_freedata(qctx);