Clear the caches *after* loading authzones.

(cherry picked from commit 799114529470923a5e633dadc47b59c4e2a7e220)

diff --git a/pdns/reczones.cc b/pdns/reczones.cc
index c0770bfdb785698816e0f3ca2660cad6fee55004..a9bd95e8cc3910310772a9e0808b2ff4531c3fa4 100644 (file)
--- a/pdns/reczones.cc
+++ b/pdns/reczones.cc
@@ -362,15 +362,18 @@ string reloadZoneConfiguration()
       }
     }
 
-    for (const auto& i : oldAndNewDomains) {
-      wipeCaches(i, true, 0xffff);
-    }
-
     // these explicitly-named captures should not be necessary, as lambda
     // capture of tuple-like structured bindings is permitted, but some
     // compilers still don't allow it
     broadcastFunction([dm = newDomainMap] { return pleaseUseNewSDomainsMap(dm); });
     broadcastFunction([ns = newNotifySet] { return pleaseSupplantAllowNotifyFor(ns); });
+
+    // Wipe the caches *after* the new auth domain info has been set
+    // up, as a query during setting up might fill the caches
+    // again. Old code did the clear before, exposing a race.
+    for (const auto& i : oldAndNewDomains) {
+      wipeCaches(i, true, 0xffff);
+    }
     return "ok\n";
   }
   catch (std::exception& e) {