resolve: always send DO bit when iterating or forwarding

diff --git a/NEWS b/NEWS
index ce7588b92fe6aac64d00f054dd0f7e65e300776f..7c2a17c416d55f7fd1841a4a0a069ea4ed76cd5b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ Improvements
 - policy module: policy.rpz() will watch the file for changes by default
 - packaging: lua cqueues added to default dependencies where available
 - systemd: service is no longer auto-restarted on configuration errors
+- always send DO+CD flags upstream, even in insecure zones
 
 Bugfixes
 --------

diff --git a/lib/resolve.c b/lib/resolve.c
index 1d4541d3daa8d205f737b7967dda0f22d36be23c..c2c90287569a347b997b363dd350641619849b6e 100644 (file)
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -698,13 +698,12 @@ static int query_finalize(struct kr_request *request, struct kr_query *qry, knot
                                        knot_wire_set_cd(pkt->wire);
                                }
                        /* Full resolution (ask for +cd and +do) */
-                       } else if (qry->flags.FORWARD) {
-                               knot_wire_set_rd(pkt->wire);
-                               knot_edns_set_do(pkt->opt_rr);
-                               knot_wire_set_cd(pkt->wire);
-                       } else if (qry->flags.DNSSEC_WANT) {
+                       } else {
                                knot_edns_set_do(pkt->opt_rr);
                                knot_wire_set_cd(pkt->wire);
+                               if (qry->flags.FORWARD) {
+                                       knot_wire_set_rd(pkt->wire);
+                               }
                        }
                }
        }