From: Mark Andrews <marka@isc.org>
Date: Tue, 28 Jul 2026 05:59:37 +0000 (+1000)
Subject: dns_private_chains wasn't handling PRIVATE DNSSEC algorithms correctly
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bdee7273ec3a5d550c6d178f8b74f69d45c7a5a6;p=thirdparty%2Fbind9.git

dns_private_chains wasn't handling PRIVATE DNSSEC algorithms correctly

dns_private_chains wasn't looking for the private records that
indicate that a zone is being signed by a PRIVATE DNSSEC algorithm.
This has been fixed.
---

diff --git a/lib/dns/private.c b/lib/dns/private.c
index 510b8fb0801..bfe8ba367bd 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -253,6 +253,18 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 			    private.data[3] == 0 && private.data[4] == 0)
 			{
 				signing = true;
+			} else if (private.length == 7 &&
+				   private.data[0] != 0 &&
+				   private.data[3] == 0 && private.data[4] == 0)
+			{
+				dst_algorithm_t alg = private.data[6] |
+						      (private.data[5] << 8);
+
+				if (dst_algorithm_tosecalg(alg) ==
+				    private.data[0])
+				{
+					signing = true;
+				}
 			}
 		} else {
 			if (CREATE(rdata.data[1])) {