always clear AD flag in forwarding mode

It's perhaps questionable to pass AD through, but we were setting it by
mistake (!).  Fixes #98.

diff --git a/lib/resolve.c b/lib/resolve.c
index fdc3a8d283b952b33e4171a7484e29c0e687ace9..a8d47f8ae2bf81a9d129fa0adb23918a9a46ad07 100644 (file)
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -525,7 +525,9 @@ static int answer_finalize(struct kr_request *request, int state)
                /* Do not set AD for RRSIG query, as we can't validate it. */
                const bool secure = (last->flags & QUERY_DNSSEC_WANT) &&
                                   !(last->flags & QUERY_DNSSEC_INSECURE);
-               if (has_ad && secure && knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
+               if (!(last->flags & QUERY_STUB) /* Never set AD if forwarding. */
+                   && has_ad && secure
+                   && knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
                        knot_wire_set_ad(answer->wire);
                }
        }