Bad interaction with 0 TTL records and serve-expired

[saksham-m]

Describe the bug

NXDOMAIN will get stuck in the cache with serve-expired: yes when the new record is 0 TTL

To reproduce
Steps to reproduce the behavior:

1. serve-expired: yes
2. Let us say host.example.com is NXDOMAIN. This will be cached according to the SOA TTL
3. Now add a new record for host.example.com with TTL 0.
4. Cache will forever serve NXDOMAIN as the new record is not allowed to be cached (Log shown: debug: TTL 0: dropped msg from cache)

Expected behavior
Cache should eventually recover without the need to flush the domain.

Other notes

removing the FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NXDOMAIN &&
check in line 629 of worker.c resolves the issue.

But of course, that means we will always resolve NXDOMAIN answers and not serve-expired

2. Setting cache-min-ttl: 1 also resolves the issue by forcing cache to write the new record.

System:

• Unbound version:
• OS: linux
• unbound -V output:

saksham@lhotse:/tmp/unbound-1.17.1$ sudo unbound -V
Version 1.17.1

Configure line:
Linked libs: mini-event internal (it uses select), OpenSSL 1.1.1f 31 Mar 2020
Linked modules: dns64 respip validator iterator

Additional information
Add any other information that you may have gathered about the issue here.