From d67ca6bfedcb896a1b1f13fd9bc4a3846191263e Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 16 Jun 2026 09:32:24 +0200
Subject: [PATCH] Disallow $INCLUDE for secondary zones. This matches the
 change in the code repository, and is meant for after merge of the simdzone
 change.

---
 services/authzone.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/services/authzone.c b/services/authzone.c
index b6705dd79..2ee4b5012 100644
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -1687,7 +1687,11 @@ az_parse_include(zone_parser_t *parser, const char *file,
 {
 	struct az_parse_state* state = (struct az_parse_state*)user_data;
 	(void)parser;
-	(void)state;
+	if(state->z->zone_is_slave) {
+		/* A $INCLUDE is not expected for a secondary zone. */
+		log_err("$INCLUDE not allowed for secondary zone");
+		return ZONE_SEMANTIC_ERROR;
+	}
 	verbose(6, "zone parse descended into include file %s (full path %s)",
 		file, path);
 	return 0;