From: Mark Andrews <marka@isc.org>
Date: Thu, 8 Apr 2021 00:49:28 +0000 (+1000)
Subject: Be more precise with the stopping conditions in zone_resigninc
X-Git-Tag: v9.17.13~41^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b7cdc3583e3643c2177a62bd94ca598360a83fc3;p=thirdparty%2Fbind9.git

Be more precise with the stopping conditions in zone_resigninc

If there happens to be a RRSIG(SOA) that is not at the zone apex
for any reason it should not be considered as a stopping condition
for incremental zone signing.
---

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 261c6242a7b..031fa4827c8 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -7089,8 +7089,10 @@ zone_resigninc(dns_zone_t *zone) {
 		 * recent signature.
 		 */
 		/* XXXMPA increase number of RRsets signed pre call */
-		if (covers == dns_rdatatype_soa || i++ > zone->signatures ||
-		    resign > stop) {
+		if ((covers == dns_rdatatype_soa &&
+		     dns_name_equal(name, &zone->origin)) ||
+		    i++ > zone->signatures || resign > stop)
+		{
 			break;
 		}