From: Colin Vidal <colin@isc.org>
Date: Wed, 11 Feb 2026 14:12:02 +0000 (+0100)
Subject: fix: usr: fetch loop detection improvements
X-Git-Tag: v9.21.19~29
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bc0e9f1ccbf8405fcb13bcfc2ede12d8e8d4f042;p=thirdparty%2Fbind9.git

fix: usr: fetch loop detection improvements

Fixes a case where an in-domain NS with an expired glue would fail to resolve.

Let's consider the following parent-side delegation (both for `foo.example.` and `dnshost.example.`

```
foo.example.            3600    NS      ns.dnshost.example.
dnshost.example.        3600    NS      ns.dnshost.example.
ns.dnshost.example.     3600    A       1.2.3.4
```

Then the child-side of `dnshost.example.`:

```
dnshost.example.        300     NS      ns.dnshost.example.
ns.dnshost.example.     300     A       1.2.3.4
```

And then the child-side of `foo.example.`:

```
foo.example             3600    NS      ns.dnshost.example.
a.foo.example           300     A       5.6.7.8
```

While there is a zone misconfiguration (the TTL of the delegation and glue doesn't match in the parent and the child), it is possible to resolve `a.foo.example` on a cold-cache resolver. However, after the `ns.dnshost.example.` glue expires, the resolution would have failed with a "fetch loop detected" error. This is now fixed.

Closes #5588

Merge branch '5588-loopfetches' into 'main'

See merge request isc-projects/bind9!11535
---

bc0e9f1ccbf8405fcb13bcfc2ede12d8e8d4f042