iterate: fix NSEC3 records missing from answer in an edge case

When positive wildcard expansion happens, NSEC(3) records are needed
to prove that the expansion was allowed.  If the NSEC3 had too many
iterations, we downgrade the answer to insecure status, but
unintentionally we also dropped the NSEC3 record from the answer.

That was breaking DNSSEC validation of that answer, e.g. when
forwarding to Knot Resolver.  The validator needs the NSEC3 -
either to validate the expansion or to determine that it's too expensive.

1 files changed, 4 insertions, 1 deletions

diff --git a/lib/layer/iterate.c b/lib/layer/iterate.c
index 5d16015e..656bc2d2 100644
--- a/lib/layer/iterate.c
+++ b/lib/layer/iterate.c
@@ -825,7 +825,10 @@ static int process_answer(knot_pkt_t *pkt, struct kr_request *req)
 		}
 	} else if (!query->parent) {
 		/* Answer for initial query */
-		const bool to_wire = ((pkt_class & (PKT_NXDOMAIN|PKT_NODATA)) != 0);
+		const bool to_wire = ((pkt_class & (PKT_NXDOMAIN|PKT_NODATA)) != 0)
+			/* We need to cover the case of positive wildcard answer
+			 * with over-limit NSEC3 iterations. */
+				|| query->flags.DNSSEC_WEXPAND;
 		state = pick_authority(pkt, req, to_wire);
 		if (state != kr_ok()) {
 			return KR_STATE_FAIL;