upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fast fail a validator deadlock

Browse source 
We return DNS_R_NOVALIDSIG if we detected a deadlock. Then in
'validate_async_done()', this result value is used to check if we
need to fall back to insecure. As part of that we create a new fetch
but that fails because of the detected deadlock. This results in a loop
of deadlock detected, fallback to insecure, deadlock detected, ...

Add a new result value, ISC_R_DEADLOCK, and return this instead when
we have detected a deadlock. This will be treated as a generic error,
as there is no special handling for this result value.
This commit is contained in:
Matthijs Mekking 2026-03-03 08:37:34 +01:00
parent e0211a727b
commit bc1d177cc2
3 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/dns/validator.c
View file

@ -972,7 +972,7 @@ create_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
if (check_deadlock(val, name, type, NULL, NULL)) {
validator_log(val, ISC_LOG_DEBUG(3),
"deadlock found (create_fetch)");
return DNS_R_NOVALIDSIG;
return ISC_R_DEADLOCK;
}
if ((val->options & DNS_VALIDATOR_NOCDFLAG) != 0) {
@ -1016,7 +1016,7 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
if (check_deadlock(val, name, type, rdataset, sig)) {
validator_log(val, ISC_LOG_DEBUG(3),
"deadlock found (create_validator)");
return DNS_R_NOVALIDSIG;
return ISC_R_DEADLOCK;
}
/* OK to clear other options, but preserve NOCDFLAG and NONTA. */

1
lib/isc/include/isc/result.h
View file

@ -85,6 +85,7 @@ typedef enum isc_result {
ISC_R_HTTP2ALPNERROR, /*%< ALPN for HTTP/2 failed */
ISC_R_DOTALPNERROR, /*%< ALPN for DoT failed */
ISC_R_INVALIDPROTO, /*%< invalid protocol */
ISC_R_DEADLOCK, /*%< deadlock found */
DNS_R_LABELTOOLONG,
DNS_R_BADESCAPE,

1
lib/isc/result.c
View file

@ -88,6 +88,7 @@ static const char *description[ISC_R_NRESULTS] = {
[ISC_R_HTTP2ALPNERROR] = "ALPN for HTTP/2 failed",
[ISC_R_DOTALPNERROR] = "ALPN for DoT failed",
[ISC_R_INVALIDPROTO] = "invalid protocol",
[ISC_R_DEADLOCK] = "deadlock found",
[DNS_R_LABELTOOLONG] = "label too long",
[DNS_R_BADESCAPE] = "bad escape",