bugfix: nsec3 opt out not working in some cases

src/knot/dnssec/nsec3-chain.c

@@ -676,11 +676,8 @@ static int fix_nsec3_nodes(zone_update_t *update, const dnssec_nsec3_params_t *p
  */
 static bool nsec3_is_empty(zone_node_t *node, bool opt_out)
 {
-	if (node->children > 0) {
-		return false;
-	}
-
-	return knot_nsec_empty_nsec_and_rrsigs_in_node(node) || nsec3_opt_out(node, opt_out);
+	return ((node->children == 0 && knot_nsec_empty_nsec_and_rrsigs_in_node(node)) ||
+		nsec3_opt_out(node, opt_out));
 }
 
 /*!

tests-extra/tests/dnssec/nsec_update/test.py

@@ -22,6 +22,7 @@ for zone in zones:
     master.dnssec(zone).nsec3 = random.choice([True, False])
     master.dnssec(zone).nsec3_iters = 2
     master.dnssec(zone).nsec3_salt_len = 8
+    master.dnssec(zone).nsec3_opt_out = (random.random() < 0.5)
 
 t.start()
 t.sleep(4)