dns_private_chains wasn't handling PRIVATE DNSSEC algorithms correctly

dns_private_chains wasn't looking for the private records that
indicate that a zone is being signed by a PRIVATE DNSSEC algorithm.
This has been fixed.

diff --git a/lib/dns/private.c b/lib/dns/private.c
index 510b8fb08010f94cc5a3c5e7b8192456ea04658a..bfe8ba367bd80d16ab4714ebc9c017e1ccb33906 100644 (file)
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -253,6 +253,18 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
                            private.data[3] == 0 && private.data[4] == 0)
                        {
                                signing = true;
+                       } else if (private.length == 7 &&
+                                  private.data[0] != 0 &&
+                                  private.data[3] == 0 && private.data[4] == 0)
+                       {
+                               dst_algorithm_t alg = private.data[6] |
+                                                     (private.data[5] << 8);
+
+                               if (dst_algorithm_tosecalg(alg) ==
+                                   private.data[0])
+                               {
+                                       signing = true;
+                               }
                        }
                } else {
                        if (CREATE(rdata.data[1])) {