Check RRset trust in validate_neg_rrset()

In many places we only create a validator if the RRset has too low
trust (the RRset is pending validation, or could not be validated
before). This check was missing prior to validating negative response
data.

(cherry picked from commit 6ca67f65cd685cf8699540a852c1e3775bd48d64)

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 976c386cdf179b3961384d99f39efafbe66119c0..ae92231ed5392c66ca211abb00cc20796c5246c4 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -2429,6 +2429,17 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
                }
        }
 
+       if (rdataset->type != dns_rdatatype_nsec &&
+           DNS_TRUST_SECURE(rdataset->trust))
+       {
+               /*
+                * The negative response data is already verified.
+                * We skip NSEC records, because they require special
+                * processing in validator_callback_nsec().
+                */
+               return DNS_R_CONTINUE;
+       }
+
        val->currentset = rdataset;
        result = create_validator(val, name, rdataset->type, rdataset,
                                  sigrdataset, validator_callback_nsec,
@@ -2539,11 +2550,9 @@ validate_ncache(dns_validator_t *val, bool resume) {
                }
 
                result = validate_neg_rrset(val, name, rdataset, sigrdataset);
-               if (result == DNS_R_CONTINUE) {
-                       continue;
+               if (result != DNS_R_CONTINUE) {
+                       return (result);
                }
-
-               return (result);
        }
        if (result == ISC_R_NOMORE) {
                result = ISC_R_SUCCESS;