From: Ondřej Surý <ondrej@sury.org>
Date: Sun, 7 Jun 2026 08:19:44 +0000 (+0200)
Subject: Limit DNSSEC denial proof validation per fetch
X-Git-Tag: v9.21.24~11^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c3388378a7699c956603bc405f73e38d2c344dc8;p=thirdparty%2Fbind9.git

Limit DNSSEC denial proof validation per fetch

Negative response validation reuses the per-fetch validation counters,
but NSEC/NSEC3 subvalidator quota failures were not terminal. The
parent validator logged the child failure and resumed validate_nx(),
so a response stuffed with many denial proof RRsets could keep driving
more validation work and still eventually validate.

Treat ISC_R_QUOTA from an NSEC/NSEC3 subvalidator as terminal and
propagate the quota reason to the parent validator. This lets the
existing fctx->nvalidations and fctx->nfails limits stop excessive
negative proof validation without a separate resolver-side pre-scan.
---

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index cba632f6e39..20ee80887dd 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -912,6 +912,10 @@ validator_callback_nsec(void *arg) {
 		switch (eresult) {
 		case ISC_R_CANCELED:
 		case ISC_R_SHUTTINGDOWN:
+		case ISC_R_QUOTA:
+			val->attributes |= subvalidator->attributes &
+					   (VALATTR_MAXVALIDATIONS |
+					    VALATTR_MAXVALIDATIONFAILS);
 			result = eresult;
 			break;
 		case DNS_R_BROKENCHAIN: