- Fix cleaning up DoH session. The same query can be on multiple

  streams in a session. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.

diff --git a/doc/Changelog b/doc/Changelog
index 10f8e035185fd61943263883f922620cb7a51197..180f0b0334eeb85cbea6d07495ae2b21fc95d7ec 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -41,6 +41,9 @@
        - Fix lame server detection, for selfpointed glue records.
          Thanks to Shuhan Zhang, Dan Li, and Baojun Liu from Tsinghua
          University for the report.
+       - Fix cleaning up DoH session. The same query can be on multiple
+         streams in a session. Thanks to Qifan Zhang, Palo Alto Networks,
+         for the report.
 
 18 May 2026: Wouter
        - Fix for mixed class referrals, the resolver uses the query

diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c
index 5db2b940bc04a531dd5b5a90a248154306639935..9dd57999f8a23d1520eae5e523a609d08d728e7d 100644 (file)
--- a/services/listen_dnsport.c
+++ b/services/listen_dnsport.c
@@ -2167,7 +2167,8 @@ void tcp_req_info_clear(struct tcp_req_info* req)
        open = req->open_req_list;
        while(open) {
                nopen = open->next;
-               mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp);
+               mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp,
+                       NULL);
                free(open);
                open = nopen;
        }

diff --git a/services/mesh.c b/services/mesh.c
index 2869010476985f469c8f7aa6dca393822539539f..04c799751fa8e0fb1f00e95b019a8000150d8908 100644 (file)
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1078,14 +1078,6 @@ mesh_state_cleanup(struct mesh_state* mstate)
        if(!mstate->replies_sent) {
                struct mesh_reply* rep = mstate->reply_list;
                struct mesh_cb* cb;
-               /* One http2 stream could bring down its comm_point along with
-                * the other streams which could share the same query. Do all
-                * the http2 stream bookkeeping upfront. */
-               for(; rep; rep=rep->next) {
-                       if(rep->query_reply.c->use_h2)
-                               http2_stream_remove_mesh_state(rep->h2_stream);
-               }
-               rep = mstate->reply_list;
                /* in tcp_req_info, the mstates linked are removed, but
                 * the reply_list is now NULL, so the remove-from-empty-list
                 * takes no time and also it does not do the mesh accounting */
@@ -2366,7 +2358,7 @@ void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
 }
 
 void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
-       struct comm_point* cp)
+       struct comm_point* cp, struct http2_stream* h2_stream)
 {
        struct mesh_reply* n, *prev = NULL;
        n = m->reply_list;
@@ -2374,7 +2366,8 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
         * there is no accounting twice */
        if(!n) return; /* nothing to remove, also no accounting needed */
        while(n) {
-               if(n->query_reply.c == cp) {
+               if(n->query_reply.c == cp
+                       && (!h2_stream || n->h2_stream == h2_stream)) {
                        /* unlink it */
                        if(prev) prev->next = n->next;
                        else m->reply_list = n->next;

diff --git a/services/mesh.h b/services/mesh.h
index 9ee585156fd4397c038eea544e7bbf7590b196ed..cd10bf462afab9da8a3b8c289c0159c783281ffb 100644 (file)
--- a/services/mesh.h
+++ b/services/mesh.h
@@ -683,9 +683,11 @@ void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
  * @param mesh: to update the counters.
  * @param m: the mesh state.
  * @param cp: the comm_point to remove from the list.
+ * @param h2_stream: if not NULL, it specifies the h2_stream to match
+ *     for the delete.
  */
 void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
-       struct comm_point* cp);
+       struct comm_point* cp, struct http2_stream* h2_stream);
 
 /** Callback for when the serve expired client timer has run out.  Tries to
  * find an expired answer in the cache and reply that to the client.

diff --git a/util/netevent.c b/util/netevent.c
index a86e22518fb81c59b4e9d5b119e3c58accc1f2f7..0eb690344a5ef135c76a98fed5c018e69d3f3568 100644 (file)
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -3174,7 +3174,7 @@ static void http2_stream_delete(struct http2_session* h2_session,
 {
        if(h2_stream->mesh_state) {
                mesh_state_remove_reply(h2_stream->mesh, h2_stream->mesh_state,
-                       h2_session->c);
+                       h2_session->c, h2_stream);
                h2_stream->mesh_state = NULL;
        }
        http2_req_stream_clear(h2_stream);