lib/dnssec: fixed nsec3 opt-out ignored

diff --git a/lib/dnssec/nsec3.c b/lib/dnssec/nsec3.c
index 29e2fa38657d185ad0f959760938a4ebe3f78fde..dcfa4053e72353d1d76f1d8930e4d21de426973e 100644 (file)
--- a/lib/dnssec/nsec3.c
+++ b/lib/dnssec/nsec3.c
@@ -261,10 +261,10 @@ static int covers_name(int *flags, const knot_rrset_t *nsec3, const knot_dname_t
        if (nsec3_flags & ~OPT_OUT_BIT) {
                /* RFC5155 3.1.2 */
                ret = kr_error(EINVAL);
+       } else {
+               ret = kr_ok();
        }
 
-       ret = kr_ok();
-
 fail:
        if (params.salt.data) {
                dnssec_nsec3_params_free(&params);