From: Mark Andrews <marka@isc.org>
Date: Tue, 30 Jun 2026 01:46:28 +0000 (+1000)
Subject: Add minimal testing for the PRIVATEDNS algorithm mapping
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7d06ac20a3614b83de230dfc72d9a461bba82f88;p=thirdparty%2Fbind9.git

Add minimal testing for the PRIVATEDNS algorithm mapping

Enable the example PRIVATEDNS mappings (rsasha256.example.org and
rsasha512.example.org) in developer builds via TEST_PRIVATEDNS and use
them to test dst_algorithm_fromdata().

The test algorithms take the DST algorithm numbers 258 and 259, so
DST_MAX_ALGS has to grow to cover them: arrays sized by it are indexed
with the numbers dst_algorithm_fromdata() returns, and a value past the
bound would overflow them. Also map the new numbers back to
DNS_KEYALG_PRIVATEDNS in dst_algorithm_tosecalg() so the round trip
stays consistent.
---

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index c84a7f9ba3..451e3da385 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -2604,6 +2604,10 @@ dst_algorithm_tosecalg(dst_algorithm_t dst_alg) {
 	static dns_secalg_t dns_alg[DST_MAX_ALGS] = {
 		[DST_ALG_RSASHA256PRIVATEOID] = DNS_KEYALG_PRIVATEOID,
 		[DST_ALG_RSASHA512PRIVATEOID] = DNS_KEYALG_PRIVATEOID,
+#if TEST_PRIVATEDNS
+		[DST_ALG_RSASHA256PRIVATEDNS] = DNS_KEYALG_PRIVATEDNS,
+		[DST_ALG_RSASHA512PRIVATEDNS] = DNS_KEYALG_PRIVATEDNS,
+#endif
 	};
 
 	if (dst_alg < 256) {
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index bb24b63c07..efbd99a628 100644
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -118,7 +118,13 @@ typedef enum dst_algorithm {
 	 */
 	DST_ALG_RSASHA256PRIVATEOID = 256, /* 1.2.840.113549.1.1.11 */
 	DST_ALG_RSASHA512PRIVATEOID = 257, /* 1.2.840.113549.1.1.13 */
+#ifdef TEST_PRIVATEDNS
+	DST_ALG_RSASHA256PRIVATEDNS = 258, /* rsasha256.example.org. */
+	DST_ALG_RSASHA512PRIVATEDNS = 259, /* rsasha512.example.org. */
+	DST_MAX_ALGS = 260,
+#else
 	DST_MAX_ALGS = 258,
+#endif
 } dst_algorithm_t;
 
 /*% 'Type' for dst_read_key() */
diff --git a/meson.build b/meson.build
index 88e554e559..c3644cf6a2 100644
--- a/meson.build
+++ b/meson.build
@@ -359,6 +359,7 @@ if developer_mode
     config.set('ISC_SOCKET_DETAILS', 1)
     config.set('ISC_STATS_CHECKUNDERFLOW', 1)
     config.set('DNS_TYPEPAIR_CHECK', 1)
+    config.set('TEST_PRIVATEDNS', 1)
 endif
 
 # mandatory builtins
diff --git a/tests/dns/dst_test.c b/tests/dns/dst_test.c
index d74d693de5..73871677e7 100644
--- a/tests/dns/dst_test.c
+++ b/tests/dns/dst_test.c
@@ -62,6 +62,16 @@ ISC_RUN_TEST_IMPL(algorithm_fromdata) {
 		/* An unsupported private dns algorithm */
 		FROMDATA(DNS_KEYALG_PRIVATEDNS, 0, 0x04, 't', 'e', 's', 't',
 			 0x00),
+#ifdef TEST_PRIVATEDNS
+		FROMDATA(DNS_KEYALG_PRIVATEDNS, DST_ALG_RSASHA256PRIVATEDNS,
+			 0x09, 'r', 's', 'a', 's', 'h', 'a', '2', '5', '6',
+			 0x07, 'e', 'x', 'a', 'm', 'p', 'l', 'e', 0x03, 'o',
+			 'r', 'g', 0x00),
+		FROMDATA(DNS_KEYALG_PRIVATEDNS, DST_ALG_RSASHA512PRIVATEDNS,
+			 0x09, 'r', 's', 'a', 's', 'h', 'a', '5', '1', '2',
+			 0x07, 'e', 'x', 'a', 'm', 'p', 'l', 'e', 0x03, 'o',
+			 'r', 'g', 0x00),
+#endif
 
 		/* length byte + 1.2.840.113549.1.1.11 BER encoded RFC 4055 */
 		FROMDATA(DNS_KEYALG_PRIVATEOID, DST_ALG_RSASHA256PRIVATEOID,
@@ -83,6 +93,10 @@ ISC_RUN_TEST_IMPL(algorithm_fromdata) {
 		alg = dst_algorithm_fromdata(fromdata[i].secalg,
 					     fromdata[i].data, fromdata[i].len);
 		assert_int_equal(alg, fromdata[i].dstalg);
+		if (alg != 0) {
+			assert_int_equal(dst_algorithm_tosecalg(alg),
+					 fromdata[i].secalg);
+		}
 	}
 }