Check RRset trust in validate_neg_rrset()

In many places we only create a validator if the RRset has too low
trust (the RRset is pending validation, or could not be validated
before). This check was missing prior to validating negative response
data.

(cherry picked from commit 6ca67f65cd685cf8699540a852c1e3775bd48d64)

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 9f39c3a95cf695b9cdee6516a96807c002d596f1..25a1a00c8b6c021b692b214552fdbb543a0aba8c 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -2754,6 +2754,19 @@ validate_authority(dns_validator_t *val, bool resume) {
                                                        dns_rdatatype_soa))
                                        continue;
                        }
+
+                       if (rdataset->type != dns_rdatatype_nsec &&
+                           DNS_TRUST_SECURE(rdataset->trust))
+                       {
+                               /*
+                                * The negative response data is already
+                                * verified. We skip NSEC records, because
+                                * they require special processing in
+                                * authvalidated().
+                                */
+                               continue;
+                       }
+
                        val->currentset = rdataset;
                        result = create_validator(val, name, rdataset->type,
                                                  rdataset, sigrdataset,
@@ -2831,6 +2844,18 @@ validate_ncache(dns_validator_t *val, bool resume) {
                                                dns_rdatatype_soa))
                                continue;
                }
+
+               if (rdataset->type != dns_rdatatype_nsec &&
+                   DNS_TRUST_SECURE(rdataset->trust))
+               {
+                       /*
+                        * The negative response data is already verified.
+                        * We skip NSEC records, because they require special
+                        * processing in authvalidated().
+                        */
+                       continue;
+               }
+
                val->currentset = rdataset;
                result = create_validator(val, name, rdataset->type,
                                          rdataset, sigrdataset,