41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
From 0532ea83b5e806e0d5b0b1fa85760c8d680ac173 Mon Sep 17 00:00:00 2001
|
|
From: Mark Andrews <marka@isc.org>
|
|
Date: Tue, 14 Apr 2026 15:14:06 +1000
|
|
Subject: [PATCH] Don't sign out of zone records in dnssec-signzone
|
|
|
|
dnssec-signzone was signing extraneous records that were not within
|
|
the namespace of the zone. This no longer occurs.
|
|
|
|
(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
|
|
|
|
Don't sign out of zone records in dnssec-signzone
|
|
|
|
dnssec-signzone was signing extraneous records that were not within
|
|
the namespace of the zone. This no longer occurs.
|
|
|
|
(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
|
|
(cherry picked from commit 1a4986e2533f87e80eb21da3f06708d335aff1e2)
|
|
---
|
|
bin/dnssec/dnssec-signzone.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
|
|
index b2c77d497a..d968f95d5e 100644
|
|
--- a/bin/dnssec/dnssec-signzone.c
|
|
+++ b/bin/dnssec/dnssec-signzone.c
|
|
@@ -1643,6 +1643,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
|
|
dns_db_detachnode(gdb, &node);
|
|
goto next;
|
|
}
|
|
+ if (!dns_name_issubdomain(name, gorigin)) {
|
|
+ dumpnode(name, node);
|
|
+ dns_db_detachnode(gdb, &node);
|
|
+ goto next;
|
|
+ }
|
|
/*
|
|
* Sort the zone data from the glue and out-of-zone data.
|
|
* For NSEC zones nodes with zone data have NSEC records.
|
|
--
|
|
2.55.0
|
|
|