From: Ondřej Surý <ondrej@sury.org>
Date: Mon, 20 Jul 2026 04:53:36 +0000 (+0200)
Subject: Only active secure data should block negative cache entries
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=89b0572f3a26c25eff51ca0888e37f8f14ec3dcb;p=thirdparty%2Fbind9.git

Only active secure data should block negative cache entries

Expired secure headers linger in the node's header list until they
are reaped, so the secure-data check could match a header already
past its TTL, reject the new negative entry, and hand the expired
data back to the caller. Require the matching header to be active.
---

diff --git a/lib/dns/qpcache.c b/lib/dns/qpcache.c
index ad0768d36f9..f99989421dc 100644
--- a/lib/dns/qpcache.c
+++ b/lib/dns/qpcache.c
@@ -2329,7 +2329,9 @@ add(qpcache_t *qpdb, qpcnode_t *qpnode, dns_slabheader_t *newheader,
 	    rdtype == dns_rdatatype_any && trust < dns_trust_secure)
 	{
 		DNS_SLABHEADER_FOREACH(header, &qpnode->headers) {
-			if (header_trust(header) >= dns_trust_secure) {
+			if (ACTIVE(header, now) &&
+			    header_trust(header) >= dns_trust_secure)
+			{
 				qpcache_hit(qpdb, header);
 				bindrdataset(qpdb, qpnode, header, now,
 					     nlocktype, tlocktype,