lua resolve(): correctly include EDNS0 in the virtual packet

The new allocation approach isn't perfectly optimal, but it seems
relatively easy to understand and handles OOM conditions OK (I think).

NEWS

@@ -11,6 +11,8 @@ Bugfixes
 - cache: missing filesystem support for pre-allocation is no longer fatal (#549)
 - lua: policy.rpz() no longer watches the file when watch is set to false (!954)
 - fix a strict aliasing problem that might've lead to "miscompilation" (!962)
+- lua resolve(): correctly include EDNS0 in the virtual packet (!963)
+  Custom modules might have been confused by that.
 
 Incompatible changes
 --------------------

daemon/lua/sandbox.lua.in

@@ -76,7 +76,6 @@ worker.resolve = function (qname, qtype, qclass, options, finish, init)
 		panic('failure in worker.resolve(); probably invalid qname "%s"', qname)
 	end
 	local ret = worker.resolve_pkt(pkt, options, finish, init)
-	ffi.C.knot_rrset_free(pkt.opt_rr, nil);
 	ffi.C.knot_pkt_free(pkt);
 	return ret
 end

daemon/worker.c

@@ -1801,15 +1801,26 @@ knot_pkt_t * worker_resolve_mk_pkt(const char *qname_str, uint16_t qtype, uint16
 	knot_wire_set_rd(pkt->wire);
 	knot_wire_set_ad(pkt->wire);
 
-	/* Add OPT RR */
-	pkt->opt_rr = knot_rrset_copy(the_worker->engine->resolver.opt_rr, NULL);
-	if (!pkt->opt_rr) {
+	/* Add OPT RR, including wire format so modules can see both representations.
+	 * knot_pkt_put() copies the outside; we need to duplicate the inside manually. */
+	knot_rrset_t *opt = knot_rrset_copy(the_worker->engine->resolver.opt_rr, NULL);
+	if (!opt) {
 		knot_pkt_free(pkt);
 		return NULL;
 	}
 	if (options->DNSSEC_WANT) {
-		knot_edns_set_do(pkt->opt_rr);
+		knot_edns_set_do(opt);
 	}
+	knot_pkt_begin(pkt, KNOT_ADDITIONAL);
+	int ret = knot_pkt_put(pkt, KNOT_COMPR_HINT_NONE, opt, KNOT_PF_FREE);
+	if (ret == KNOT_EOK) {
+		free(opt); /* inside is owned by pkt now */
+	} else {
+		knot_rrset_free(opt, NULL);
+		knot_pkt_free(pkt);
+		return NULL;
+	}
+
 	if (options->DNSSEC_CD) {
 		knot_wire_set_cd(pkt->wire);
 	}