Strip ZONEMD RRs on load so that signing without ZONEMD doesn't leave an incorrect ZONEMD RR in the output.

2026-09-10 03:47:45 +02:00 · 2024-12-09 10:30:11 +01:00
parent 43c6f7caee
commit ee5e86a45d
1 changed files with 8 additions and 1 deletions
@@ -1004,9 +1004,16 @@ impl SignZone {
                    // once, while our current implementation only supports
                    // having either NSEC or NSEC3 in the zone at any one
                    // time.
+                    //
+                    // TODO: NSEC3PARAM and ZONEMD should only be ignored at
+                    // the apex (the only place RFCs define them to be valid).
                    if !matches!(
                        record.rtype(),
-                        Rtype::NSEC | Rtype::NSEC3 | Rtype::NSEC3PARAM | Rtype::RRSIG
+                        Rtype::NSEC
+                            | Rtype::NSEC3
+                            | Rtype::NSEC3PARAM
+                            | Rtype::RRSIG
+                            | Rtype::ZONEMD
                    ) {
                        let _ = records.insert(record);
                    }