package/network/services/dnsmasq/patches/220-try-all-servers-on-fail.patch

   1 From 94a8815892f538b334d640012eebcafc2c7fa284 Mon Sep 17 00:00:00 2001
   2 From: Martin Wetterwald <martin.wetterwald@corp.ovh.com>
   3 Date: Thu, 27 Oct 2016 12:17:03 +0200
   4 Subject: [PATCH] Consider SERVFAIL as a non-successful response
   5
   6 Treat Servfail as a recoverable error instead of a hard error.
   7
   8 A misconfigured dns forwarder upstream can return a Servfail faster than
   9 a correctly configured one.
  10
  11 In the case of a dnssec misbehaving, it will misbehave on all correctly
  12 configured upstreams. In the case of a normal DNS query, the original
  13 behavior of dnsmasq here was more robust.
  14
  15 ---
  16  src/forward.c | 3 ++-
  17  1 file changed, 2 insertions(+), 1 deletion(-)
  18
  19 --- a/src/forward.c
  20 +++ b/src/forward.c
  21 @@ -853,7 +853,8 @@ void reply_query(int fd, int family, tim
  22       we get a good reply from another server. Kill it when we've
  23       had replies from all to avoid filling the forwarding table when
  24       everything is broken */
  25 -  if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != REFUSED)
  26 +  if (forward->forwardall == 0 || --forward->forwardall == 1
  27 +          || (RCODE(header) != REFUSED && RCODE(header) != SERVFAIL))
  28      {
  29        int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0;
  30