]> git.ipfire.org Git - thirdparty/knot-resolver.git/commitdiff
layer/iterate: forwarding mode - treat CNAME'ed NS&DS answers as proof of zonecut...
authorGrigorii Demidov <grigorii.demidov@nic.cz>
Thu, 15 Jun 2017 11:11:30 +0000 (13:11 +0200)
committerVladimír Čunát <vladimir.cunat@nic.cz>
Mon, 19 Jun 2017 14:19:21 +0000 (16:19 +0200)
lib/layer/iterate.c
lib/resolve.c

index ef853df0b8ae4e4132abcee41bc06148f798bcc7..11ae80d91b343c8af08807c48b2b2a92d035f7d0 100644 (file)
@@ -635,6 +635,12 @@ static int process_answer(knot_pkt_t *pkt, struct kr_request *req)
                        if (state != kr_ok()) {
                                return state;
                        }
+               } else if ((query->flags & QUERY_FORWARD) &&
+                          ((query->stype == KNOT_RRTYPE_DS) ||
+                           (query->stype == KNOT_RRTYPE_NS))) {
+                       /* CNAME'ed answer for DS or NS subquery.
+                        * Treat it as proof of zonecut nonexistance. */
+                       return KR_STATE_DONE;
                }
                VERBOSE_MSG("<= cname chain, following\n");
                /* Check if the same query was followed in the same CNAME chain. */
index 6902cbeb91e2c0eeac86b2e3cad2181fd9bd11d6..ac6f731c7ac1672fcb413685d3ef89f63412c33a 100644 (file)
@@ -1044,6 +1044,10 @@ static int forward_trust_chain_check(struct kr_request *request, struct kr_query
                                        if (qry->flags & QUERY_DNSSEC_NODS) {
                                                nods = true;
                                        }
+                                       if (qry->flags & QUERY_CNAME) {
+                                               nods = true;
+                                               ns_req = true;
+                                       }
                                        if (!(q->flags & QUERY_DNSSEC_OPTOUT)) {
                                                int ret = kr_dnssec_matches_name_and_type(&request->auth_selected, q->uid,
                                                                                          wanted_name, KNOT_RRTYPE_NS);