From 938b58a809eff49e706984cccba1cfc42ed890c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Fri, 29 May 2026 17:43:54 +0200 Subject: [PATCH] Fail promptly on an RRSIG answer with no usable record A query for an RRSIG is handled as a subset of ANY, so rctx_answer_any() filters out records that do not match the queried type. When every record was filtered out (an answer carrying only unrelated types), the function still returned success with nothing cached, and the fetch then waited for a validator that was never started until the backstop fetch timer fired ~12s later. Treat an all-filtered answer as a broken response, matching how non-meta types already reject a reply with no usable record. --- lib/dns/resolver.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 6eba231ca6..b41a9726ca 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -8781,6 +8781,19 @@ rctx_answer_any(respctx_t *rctx) { rdataset->trust = rctx->trust; } + /* + * An RRSIG query is handled as a subset of ANY; if every record in + * the answer was filtered out above, nothing was marked cacheable, + * so there is nothing to cache, validate, or chase. Treat that as a + * broken answer instead of returning success with no answer, which + * would leave the fetch waiting for a validator that is never + * started. + */ + if (!rctx->aname->attributes.cache) { + rctx->result = DNS_R_FORMERR; + return ISC_R_COMPLETE; + } + return ISC_R_SUCCESS; }