From: Otto <otto.moerbeek@open-xchange.com>
Date: Wed, 18 Aug 2021 07:24:45 +0000 (+0200)
Subject: Also check if the remoteIP is one of the IPs we would have forwarded to,
X-Git-Tag: rec-4.5.6~8^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F10655%2Fhead;p=thirdparty%2Fpdns.git

Also check if the remoteIP is one of the IPs we would have forwarded to,
even if it's coming from the cache.
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 384051d7e7..85ae467307 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2363,7 +2363,15 @@ bool SyncRes::throttledOrBlocked(const std::string& prefix, const ComboAddress&
       s_dontqueries++;
       return true;
     } else {
-      LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+      // The name (from the cache) is forwarded, but is it forwarded to an IP in known forwarders?
+      const auto& ips = it->second.d_servers;
+      if (std::find(ips.cbegin(), ips.cend(), remoteIP) == ips.cend()) {
+        LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
+        s_dontqueries++;
+        return true;
+      } else {
+        LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+      }
     }
   }
   return false;