mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-08-31 14:35:26 +00:00
reversed previous change: data that is neither secure not pending
is assumed to be from insecure zones and therefore should have AD set per server policy
This commit is contained in:
@@ -1664,7 +1664,7 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
|
||||
* If we have rendered pending data, ensure
|
||||
* that the AD bit is not set.
|
||||
*/
|
||||
if (rdataset->trust < dns_trust_secure &&
|
||||
if (rdataset->trust == dns_trust_pending &&
|
||||
(sectionid == DNS_SECTION_ANSWER ||
|
||||
sectionid == DNS_SECTION_AUTHORITY))
|
||||
msg->flags &= ~DNS_MESSAGEFLAG_AD;
|
||||
|
Reference in New Issue
Block a user