From: Mark Andrews <marka@isc.org>
Date: Tue, 14 Apr 2026 05:14:06 +0000 (+1000)
Subject: Don't sign out of zone records in dnssec-signzone
X-Git-Tag: v9.21.24~12^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e45c9af7051421fd370f20ba8325199c606223fd;p=thirdparty%2Fbind9.git

Don't sign out of zone records in dnssec-signzone

dnssec-signzone was signing extraneous records that were not within
the namespace of the zone.  This no longer occurs.
---

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 7745993ddf6..ba30e0e0ca4 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -1545,6 +1545,10 @@ assignwork(void *arg) {
 			dns_db_detachnode(&node);
 			goto next;
 		}
+		if (!dns_name_issubdomain(name, gorigin)) {
+			dns_db_detachnode(&node);
+			goto next;
+		}
 		/*
 		 * Sort the zone data from the glue and out-of-zone data.
 		 * For NSEC zones nodes with zone data have NSEC records.