From 926321a8d991374879f0ba3aba10ac4ad9c5f72f Mon Sep 17 00:00:00 2001
From: Kees Monshouwer <mind04@monshouwer.org>
Date: Mon, 6 May 2019 23:56:13 +0200
Subject: [PATCH] auth: fix, missing insecure zones in authSet #7785

---
 pdns/packethandler.cc | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 9d686a69f..267b1344f 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1108,7 +1108,7 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
   set<DNSName> authSet;
 
   vector<DNSZoneRecord> rrset;
-  bool weDone=0, weRedirected=0, weHaveUnauth=0;
+  bool weDone=0, weRedirected=0, weHaveUnauth=0, doSigs=0;
   DNSName haveAlias;
   uint8_t aliasScopeMask;
 
@@ -1274,10 +1274,9 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
     }
     DLOG(g_log<<Logger::Error<<"We have authority, zone='"<<sd.qname<<"', id="<<sd.domain_id<<endl);
 
+    authSet.insert(sd.qname);
     d_dnssec=(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname));
-    if(d_dnssec) {
-      authSet.insert(sd.qname);
-    }
+    doSigs |= d_dnssec;
 
     if(!retargetcount) r->qdomainzone=sd.qname;
 
@@ -1569,7 +1568,7 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
         break;
       }
     }
-    if(authSet.size())
+    if(doSigs)
       addRRSigs(d_dk, B, authSet, r->getRRS());
       
     r->wrapup(); // needed for inserting in cache
-- 
2.40.0