Be more precise with the stopping conditions in zone_resigninc

If there happens to be a RRSIG(SOA) that is not at the zone apex
for any reason it should not be considered as a stopping condition
for incremental zone signing.

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 261c6242a7b4d36d3b47e72f53f2810757c6d6ce..031fa4827c87b8ef44a045f793bf3c08272dd8b6 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -7089,8 +7089,10 @@ zone_resigninc(dns_zone_t *zone) {
                 * recent signature.
                 */
                /* XXXMPA increase number of RRsets signed pre call */
-               if (covers == dns_rdatatype_soa || i++ > zone->signatures ||
-                   resign > stop) {
+               if ((covers == dns_rdatatype_soa &&
+                    dns_name_equal(name, &zone->origin)) ||
+                   i++ > zone->signatures || resign > stop)
+               {
                        break;
                }