validate: avoid DNSSEC_NODS for . DS queries

... after the parent commit. Perhaps it can't cause trouble,
but I'll feel safer this way.

diff --git a/lib/layer/validate.c b/lib/layer/validate.c
index 7f5e69659880f8a15ce09b6232a30ae1c1f0863f..38cd169f48af393574d3f08c2f5ab790b50eb904 100644 (file)
--- a/lib/layer/validate.c
+++ b/lib/layer/validate.c
@@ -414,7 +414,7 @@ static int update_delegation(struct kr_request *req, struct kr_query *qry, knot_
                } else if (ret != 0) {
                        VERBOSE_MSG(qry, "<= bogus proof of DS non-existence\n");
                        qry->flags.DNSSEC_BOGUS = true;
-               } else {
+               } else if (proved_name[0] != '\0') { /* don't go to insecure for . DS */
                        VERBOSE_MSG(qry, "<= DS doesn't exist, going insecure\n");
                        qry->flags.DNSSEC_NODS = true;
                        /* Rank the corresponding nonauth NS as insecure. */