Fail promptly on an RRSIG answer with no usable record

A query for an RRSIG is handled as a subset of ANY, so rctx_answer_any()
filters out records that do not match the queried type. When every
record was filtered out (an answer carrying only unrelated types), the
function still returned success with nothing cached, and the fetch then
waited for a validator that was never started until the backstop fetch
timer fired ~12s later. Treat an all-filtered answer as a broken
response, matching how non-meta types already reject a reply with no
usable record.

(cherry picked from commit 938b58a809eff49e706984cccba1cfc42ed890c3)

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 176de96b132822eb3d2aaedfd9f5fe799b767db0..9af4cc3db84aecb08526cded7f7ebb6dd8907f2d 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -8868,6 +8868,19 @@ rctx_answer_any(respctx_t *rctx) {
                                                  check_related, rctx, 0);
        }
 
+       /*
+        * An RRSIG query is handled as a subset of ANY; if every record in
+        * the answer was filtered out above, nothing was marked cacheable,
+        * so there is nothing to cache, validate, or chase.  Treat that as a
+        * broken answer instead of returning success with no answer, which
+        * would leave the fetch waiting for a validator that is never
+        * started.
+        */
+       if (!rctx->aname->attributes.cache) {
+               rctx->result = DNS_R_FORMERR;
+               return ISC_R_COMPLETE;
+       }
+
        return ISC_R_SUCCESS;
 }