From: Otto <otto.moerbeek@open-xchange.com>
Date: Wed, 11 Aug 2021 11:14:37 +0000 (+0200)
Subject: If we get an NS from the cache, it still could be one forwarding applies to.
X-Git-Tag: dnsdist-1.7.0-alpha1~60^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c03df9bb6f8cd71a67ef9505fcafa27d514a68ad;p=thirdparty%2Fpdns.git

If we get an NS from the cache, it still could be one forwarding applies to.
Take that into acount when determining dont-query status. Should fix #10638.
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 86ee77ae5b..1d51487c98 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2373,9 +2373,17 @@ bool SyncRes::throttledOrBlocked(const std::string& prefix, const ComboAddress&
     return true;
   }
   else if(!pierceDontQuery && s_dontQuery && s_dontQuery->match(&remoteIP)) {
-    LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
-    s_dontqueries++;
-    return true;
+    // We could have retrieved an NS from the cache in a forwarding domain
+    // Even in the case of !pierceDontQuery we still want to allow that NS
+    DNSName forwardCandidate(qname);
+    auto it = getBestAuthZone(&forwardCandidate);
+    if (it == t_sstorage.domainmap->end()) {
+      LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
+      s_dontqueries++;
+      return true;
+    } else {
+      LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+    }
   }
   return false;
 }