From: Mark Andrews <marka@isc.org>
Date: Tue, 19 May 2026 01:24:01 +0000 (+1000)
Subject: Make it clearer that decompression is not allowed here
X-Git-Tag: v9.21.24~13^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5e397a16dabd12c6c2459840dcd9db976d950c6c;p=thirdparty%2Fbind9.git

Make it clearer that decompression is not allowed here

For DNSKEY and RRSIG as per RFC 4034, A.1.1. Private Algorithm Types

For KEY, SIG as per RFC 2535 3.2 The KEY Algorithm Number Specification,
which only allowed local domain compression which itself is no
longer allowed.

Other key types inherit from these or the general proscription that
compression is not allow in new types.
---

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 22de68e5072..d4307b309a8 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -2633,7 +2633,7 @@ dst_algorithm_fromprivatedns(isc_buffer_t *buffer) {
 	dns_name_t *name = dns_fixedname_initname(&fixed);
 	isc_result_t result;
 
-	result = dns_name_fromwire(name, buffer, DNS_DECOMPRESS_DEFAULT, NULL);
+	result = dns_name_fromwire(name, buffer, DNS_DECOMPRESS_NEVER, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return 0;
 	}
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index 3330d47d71c..dc6931ea106 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -589,7 +589,7 @@ check_private(isc_buffer_t *source, dns_secalg_t alg) {
 		dns_fixedname_t fixed;
 
 		RETERR(dns_name_fromwire(dns_fixedname_initname(&fixed), source,
-					 DNS_DECOMPRESS_DEFAULT, NULL));
+					 DNS_DECOMPRESS_NEVER, NULL));
 	} else if (alg == DNS_KEYALG_PRIVATEOID) {
 		/*
 		 * Check that we can extract the OID from the start of the