From: Otto <otto.moerbeek@open-xchange.com>
Date: Wed, 11 Aug 2021 11:14:37 +0000 (+0200)
Subject: If we get an NS from the cache, it still could be one forwarding applies to.
X-Git-Tag: rec-4.4.6~4^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cf5b195fa8927e0514d730676706d093a9c06b59;p=thirdparty%2Fpdns.git

If we get an NS from the cache, it still could be one forwarding applies to.
Take that into acount when determining dont-query status. Should fix #10638.

(cherry picked from commit c03df9bb6f8cd71a67ef9505fcafa27d514a68ad)
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 0761de6d80..1d8bdaa117 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2300,9 +2300,17 @@ bool SyncRes::throttledOrBlocked(const std::string& prefix, const ComboAddress&
     return true;
   }
   else if(!pierceDontQuery && s_dontQuery && s_dontQuery->match(&remoteIP)) {
-    LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
-    s_dontqueries++;
-    return true;
+    // We could have retrieved an NS from the cache in a forwarding domain
+    // Even in the case of !pierceDontQuery we still want to allow that NS
+    DNSName forwardCandidate(qname);
+    auto it = getBestAuthZone(&forwardCandidate);
+    if (it == t_sstorage.domainmap->end()) {
+      LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
+      s_dontqueries++;
+      return true;
+    } else {
+      LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+    }
   }
   return false;
 }