Limit DNSSEC denial proof validation per fetch

Negative response validation reuses the per-fetch validation counters,
but NSEC/NSEC3 subvalidator quota failures were not terminal. The
parent validator logged the child failure and resumed validate_nx(),
so a response stuffed with many denial proof RRsets could keep driving
more validation work and still eventually validate.

Treat ISC_R_QUOTA from an NSEC/NSEC3 subvalidator as terminal and
propagate the quota reason to the parent validator. This lets the
existing fctx->nvalidations and fctx->nfails limits stop excessive
negative proof validation without a separate resolver-side pre-scan.

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index cba632f6e39b97ff10d8f5cf7ad1ecca2aa88920..20ee80887dd0af2e89f3a4fc4eafc76b887434b9 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -912,6 +912,10 @@ validator_callback_nsec(void *arg) {
                switch (eresult) {
                case ISC_R_CANCELED:
                case ISC_R_SHUTTINGDOWN:
+               case ISC_R_QUOTA:
+                       val->attributes |= subvalidator->attributes &
+                                          (VALATTR_MAXVALIDATIONS |
+                                           VALATTR_MAXVALIDATIONFAILS);
                        result = eresult;
                        break;
                case DNS_R_BROKENCHAIN: