Merge branch 'nonauth_cname' into 'master'

Nonauth cname

Closes #713

See merge request !1242

src/knot/nameserver/internet.c

@@ -324,6 +324,13 @@ static int name_found(knot_pkt_t *pkt, knotd_qdata_t *qdata)
 {
 	uint16_t qtype = knot_pkt_qtype(pkt);
 
+	/* DS query at DP is answered normally, but everything else at/below DP
+	 * triggers referral response. */
+	if (((qdata->extra->node->flags & NODE_FLAGS_DELEG) && qtype != KNOT_RRTYPE_DS) ||
+	    (qdata->extra->node->flags & NODE_FLAGS_NONAUTH)) {
+		return KNOTD_IN_STATE_DELEG;
+	}
+
 	if (node_rrtype_exists(qdata->extra->node, KNOT_RRTYPE_CNAME)
 	    && qtype != KNOT_RRTYPE_CNAME
 	    && qtype != KNOT_RRTYPE_RRSIG
@@ -332,13 +339,6 @@ static int name_found(knot_pkt_t *pkt, knotd_qdata_t *qdata)
 		return follow_cname(pkt, KNOT_RRTYPE_CNAME, qdata);
 	}
 
-	/* DS query at DP is answered normally, but everything else at/below DP
-	 * triggers referral response. */
-	if (((qdata->extra->node->flags & NODE_FLAGS_DELEG) && qtype != KNOT_RRTYPE_DS) ||
-	    (qdata->extra->node->flags & NODE_FLAGS_NONAUTH)) {
-		return KNOTD_IN_STATE_DELEG;
-	}
-
 	uint16_t old_rrcount = pkt->rrset_count;
 	int ret = put_answer(pkt, qtype, qdata);
 	if (ret != KNOT_EOK) {
@@ -381,8 +381,9 @@ static int name_not_found(knot_pkt_t *pkt, knotd_qdata_t *qdata)
 	}
 
 	/* Name is under DNAME, use it for substitution. */
+	bool encloser_auth = !(qdata->extra->encloser->flags & (NODE_FLAGS_NONAUTH | NODE_FLAGS_DELEG));
 	knot_rrset_t dname_rrset = node_rrset(qdata->extra->encloser, KNOT_RRTYPE_DNAME);
-	if (!knot_rrset_empty(&dname_rrset)) {
+	if (encloser_auth && !knot_rrset_empty(&dname_rrset)) {
 		qdata->extra->node = qdata->extra->encloser; /* Follow encloser as new node. */
 		return follow_cname(pkt, KNOT_RRTYPE_DNAME, qdata);
 	}

tests-extra/data/flags.zone

@@ -32,6 +32,9 @@ cname-ns	CNAME	sub
 ; CNAME to a name below delegation
 cname-below-ns	CNAME	below.sub
 
+; CNAME being below a delegation
+cname.below.sub	CNAME	mail
+
 ; CNAME to out
 cname-out	CNAME	another.world.
 
@@ -69,6 +72,7 @@ f.dname-tree	DNAME	f.f.dname-tree
 
 dname-out	DNAME	outside.zone.
 dname-dangl	DNAME	dangling
+dname.below.sub	DNAME	dname-tree
 
 ; DS tests
 ds-sub		NS	dns.net.ds-sub

tests-extra/tests/basic/query/test.py

@@ -100,6 +100,10 @@ resp.cmp(bind, additional=True)
 resp = knot.dig("cname-below-ns.flags", "A", udp=True)
 resp.cmp(bind, additional=True)
 
+# CNAME being below a delegation
+resp = knot.dig("cname.below.sub.flags", "A", udp=True)
+resp.cmp(bind, additional=True)
+
 # CNAME leading out
 resp = knot.dig("cname-out.flags", "A", udp=True)
 resp.cmp(bind)
@@ -173,6 +177,10 @@ resp.check(rcode="NOERROR")
 resp = knot.dig("dname.flags", "DNAME", udp=True)
 resp.cmp(bind)
 
+# DNAME being below a delegation
+resp = knot.dig("a.dname.below.sub.flags", "A", udp=True)
+resp.cmp(bind, additional=True)
+
 # DNAME query leading out of zone
 resp = knot.dig("a.dname-out.flags", "A", udp=True)
 resp.cmp(bind)