Open Habbie opened 2 years ago
You are right, it is actually marking all occluded data (including glue). See this excerpt from dnssec_zone.h:
/**
* Unlike what the name is_glue suggests, this field is set to true by
* ldns_dnssec_zone_mark_glue() or ldns_dnssec_zone_mark_and_get_glue()
* when the name, this dnssec_name struct represents, is occluded.
* Names that contain other occluded rrsets and records with glue on
* the delegation point will NOT have this bool set to true.
* This field should NOT be read directly, but only via the
* ldns_dnssec_name_is_glue() function!
*/
bool is_glue;
Perhaps it would already be an improvement to just change the message in ", but is occluded (or glue)" instead of ", but is glue" WDYT?
With a zone containing
(plus SOA, DNSKEY, signatures, etc.), ldns-verify-zone reports:
It is correct in flagging those records (they should not be there, as the DNAME occludes them), but the error text is wrong. I briefly looked at the code, fixing this might mean adding another bool similar to
is_glue
to the data astructure.