lib/resolve: set AD=1 when client asks with it and secure

diff --git a/lib/layer/rrcache.c b/lib/layer/rrcache.c
index 8c33b4f84d4fcb1b3fb7dbe803540c9c57ede7e3..7226bfc5102e1b99f8797e311c5fa7e89fb247e8 100644 (file)
--- a/lib/layer/rrcache.c
+++ b/lib/layer/rrcache.c
@@ -91,8 +91,9 @@ static int loot_rrcache(struct kr_cache *cache, knot_pkt_t *pkt, struct kr_query
                rrtype = KNOT_RRTYPE_CNAME;
                ret = loot_rr(&txn, pkt, qry->sname, qry->sclass, rrtype, qry, &rank, 0);
        }
-       /* Record isn't flagged as INSECURE => doesn't have RRSIG. */
+       /* Record is flagged as INSECURE => doesn't have RRSIG. */
        if (ret == 0 && (rank & KR_RANK_INSECURE)) {
+               qry->flags |= QUERY_DNSSEC_INSECURE;
                qry->flags &= ~QUERY_DNSSEC_WANT;
        /* Record may have RRSIG, try to find it. */
        } else if (ret == 0 && dobit) {

diff --git a/lib/resolve.c b/lib/resolve.c
index 9d33847ccd5bcdfca83eba27b0ecd57d1b9b9584..6e27de2935bd4d617d5b1a987b059cdf88ef5503 100644 (file)
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -325,8 +325,8 @@ static int answer_finalize(struct kr_request *request, int state)
        if (state == KNOT_STATE_DONE && rplan->resolved.len > 0) {
                struct kr_query *last = array_tail(rplan->resolved);
                /* Do not set AD for RRSIG query, as we can't validate it. */
-               if ((last->flags & QUERY_DNSSEC_WANT) && knot_pkt_has_dnssec(answer) &&
-                       knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
+               const bool dnssec_ok = (last->flags & QUERY_DNSSEC_WANT) && !(last->flags & QUERY_DNSSEC_INSECURE);
+               if (dnssec_ok && knot_pkt_qtype(answer) != KNOT_RRTYPE_RRSIG) {
                        knot_wire_set_ad(answer->wire);
                }
        }
@@ -393,7 +393,7 @@ static int resolve_query(struct kr_request *request, const knot_pkt_t *packet)
        /* Want DNSSEC if it's posible to secure this name (e.g. is covered by any TA) */
        map_t *negative_anchors = &request->ctx->negative_anchors;
        map_t *trust_anchors = &request->ctx->trust_anchors;
-       if (knot_pkt_has_dnssec(packet) &&
+       if ((knot_wire_get_ad(packet->wire) || knot_pkt_has_dnssec(packet)) &&
            kr_ta_covers(trust_anchors, qname) && !kr_ta_covers(negative_anchors, qname)) {
                qry->flags |= QUERY_DNSSEC_WANT;
        }