9.14.10: query.c:8499: INSIST(qctx->is_zone || (((qctx->client)->query.attributes & 0x20000) != 0)) failed
All servers that received a zone update removing some NS delegation RRs crashed 5 mins later with :
query.c:8499: INSIST(qctx->is_zone || (((qctx->client)->query.attributes & 0x20000) != 0)) failed
These servers have:
- root hint zone configured (so not a mirrored root zone - although we don't know what's actually in the root hints)
- global forwarding (defaulting to forward first)
- a secondary zone (that received the NS RRs zone update removing some delegation NS RRset)
- (default) 'qname-minimization relaxed;'
Prior to the zone update, the secondary zone contained delegation RRs that would have caused the resolver to follow the delegation path directly (global forwarding overridden in the zone definition).
We do not know if ALL the delegation RRs were removed for each subdomain, or only some of them. We also don't know if there was an exception made to the usual IXFR zone update process this time around.
The zone update should have been received via IXFR and was the removal of 50,000 RRs from a 250,000 RR zone.
Post zone-update, all the servers that crashed received a client query that should have either been answered from, or followed delegation from, the zone that had just been updated.
This crash location looks very much like #1862 (closed), but the scenario is a little different, due to the lack of mirrored root.
We have core dumps, binaries and libs available - please see Support Ticket #17077 for further customer-confidential details.
NOTE: This is an important issue for a high-status ISC customer. Although this was encountered on 9.14.10, assurance is needed that the underlying cause is identified and has (or will be soon) fixed.