Don't sign out of zone records in dnssec-signzone

dnssec-signzone was signing extraneous records that were not within
the namespace of the zone.  This no longer occurs.

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 7745993ddf6b3ecc64fbaf4c2a07e9c93d5abd92..ba30e0e0ca48df343014eeec5e4fc8cf8c4cf8d7 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -1545,6 +1545,10 @@ assignwork(void *arg) {
                        dns_db_detachnode(&node);
                        goto next;
                }
+               if (!dns_name_issubdomain(name, gorigin)) {
+                       dns_db_detachnode(&node);
+                       goto next;
+               }
                /*
                 * Sort the zone data from the glue and out-of-zone data.
                 * For NSEC zones nodes with zone data have NSEC records.