dnssec/nsec: fix wildcard_match_check() to allow processing of *. wildcard

diff --git a/lib/dnssec/nsec.c b/lib/dnssec/nsec.c
index 1f598c4b9e1562c972c896fa4b1cdae5f778d8c5..cff0ab43125cacf544b20c47d14776d9b7a23640 100644 (file)
--- a/lib/dnssec/nsec.c
+++ b/lib/dnssec/nsec.c
@@ -299,7 +299,7 @@ static int wildcard_match_check(const knot_pkt_t *pkt, const knot_pktsection_t *
                int wcard_labels = knot_dname_labels(rrset->owner, NULL);
                int common_labels = knot_dname_matched_labels(rrset->owner, sname);
                int rrsig_labels = coverign_rrsig_labels(rrset, sec);
-               if (wcard_labels <= 1 ||
+               if (wcard_labels < 1 ||
                    common_labels != wcard_labels - 1 ||
                    common_labels != rrsig_labels) {
                        continue;