Clear the caches *after* loading authzones.

diff --git a/pdns/reczones.cc b/pdns/reczones.cc
index a4b24972ccbcef7dba5911f457849850cdf3e5e6..a7516a79054b1505f8d290f5b8b0bb6df1ef2e98 100644 (file)
--- a/pdns/reczones.cc
+++ b/pdns/reczones.cc
@@ -311,15 +311,18 @@ string reloadZoneConfiguration()
       }
     }
 
-    for (const auto& i : oldAndNewDomains) {
-      wipeCaches(i, true, 0xffff);
-    }
-
     // these explicitly-named captures should not be necessary, as lambda
     // capture of tuple-like structured bindings is permitted, but some
     // compilers still don't allow it
     broadcastFunction([dm = newDomainMap] { return pleaseUseNewSDomainsMap(dm); });
     broadcastFunction([ns = newNotifySet] { return pleaseSupplantAllowNotifyFor(ns); });
+
+    // Wipe the caches *after* the new auth domain info has been set
+    // up, as a query during setting up might fill the caches
+    // again. Old code did the clear before, exposing a race.
+    for (const auto& i : oldAndNewDomains) {
+      wipeCaches(i, true, 0xffff);
+    }
     return "ok\n";
   }
   catch (const std::exception& e) {