From: Ondřej Surý <ondrej@isc.org>
Date: Fri, 10 Jul 2026 05:48:02 +0000 (+0200)
Subject: Only refresh negative cache entries that are actually stale
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=4821290c3151d11d182d451f26a6a327e4239dd1;p=thirdparty%2Fbind9.git

Only refresh negative cache entries that are actually stale

query_ncache() always passed a NULL rdataset to query_stale_refresh(),
which reads NULL as "this RRset is stale".  NULL is only meaningful for
the DNS64 caller, whose rdataset has already been detached by the time
the answer is turned into an NXDOMAIN; everywhere else a perfectly fresh
negative cache entry was taken for a stale one.

With stale-answer-client-timeout 0 the staleness check is the only gate
left on the refresh, so every client query for a cached NXDOMAIN or
NODATA name started another fetch and negative caching stopped having
any effect.
---

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 70e4c2eb2bd..d2cd2347326 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2588,7 +2588,7 @@ query_stale_refresh(ns_client_t *client, dns_name_t *qname,
 }
 
 static void
-query_stale_refresh_ncache(ns_client_t *client) {
+query_stale_refresh_ncache(ns_client_t *client, dns_rdataset_t *rdataset) {
 	dns_name_t *qname;
 
 	if (client->query.origqname != NULL) {
@@ -2596,7 +2596,7 @@ query_stale_refresh_ncache(ns_client_t *client) {
 	} else {
 		qname = client->query.qname;
 	}
-	query_stale_refresh(client, qname, NULL);
+	query_stale_refresh(client, qname, rdataset);
 }
 
 static void
@@ -9753,7 +9753,7 @@ query_ncache(query_ctx_t *qctx, isc_result_t result) {
 	}
 
 	if (!qctx->is_zone && qctx->client->query.recursionok) {
-		query_stale_refresh_ncache(qctx->client);
+		query_stale_refresh_ncache(qctx->client, qctx->rdataset);
 	}
 
 	return query_nodata(qctx, result);