[pihole] [unbound] [DNSMASQ] validation failed: resource limit exeeded

[DL6ER]

@the-piholer

validation of google.com failed: resource limit exceeded

@the-piholer

A further started google search does not give me any relatable information.

This is a new warning available as of FTL v5.25 building on dnsmasq v2.90 so it is very new and your findings here may really be the first ones on the web. This is part of the recently added protection against a DNSSEC vulnerability that could take down your Pi-hole in a denial-of-service kind of attack. More details here:

Fixing two new DNSSEC vulnerabilities

Originally published at: Fixing two new DNSSEC vulnerabilities – Pi-hole   Today, we have been informed about two DNSSEC vulnerabilities in dnsmasq, which Pi-hole FTL is forked from. Both vulnerabilities, via specially crafted DNSSEC answers, can lead DNSSEC validators down a very CPU intensive and time costly validation/NSEC3 hash calculation path. This results in degraded performance and denial of service in trivially orchestrated attacks. In fact, the discovered vulnerability is not li…

Please run

sudo kill -s SIGUSR1 $(cat /var/run/pihole-FTL.pid)
grep "DNSSEC per-" /var/log/pihole/pihole.log

and quote the output here. Another question: Is the unbound you've set up your sole upstream server?

@the-piholer

the warning periodically reappearing

Depending on the result of the commands above, we may need to increase the validation limit.

@the-piholer

The linked documentation didn't give me any further hint how to proceed here.

We need to add this, thanks for the reminder!