From: Mark Andrews <marka@isc.org>
Date: Tue, 30 Jun 2026 01:54:51 +0000 (+1000)
Subject: Use dst_algorithm_fromdata() to extract DST algorithm numbers
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dbd24e67dda070ab5e3f7a9b411a00595a2ca6f9;p=thirdparty%2Fbind9.git

Use dst_algorithm_fromdata() to extract DST algorithm numbers

dns_resolver_algorithm_supported() open-coded the extraction for
PRIVATEDNS and PRIVATEOID keys, and the PRIVATEDNS copy never set the
active region on the buffer, so dns_name_fromwire() failed and every
PRIVATEDNS key was treated as unsupported.

Replace both copies with dst_algorithm_fromdata(), which sets up the
buffer correctly and passes other algorithms through unchanged.
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 9b0ac0ce48d..592cbac84b8 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -11191,25 +11191,13 @@ dns_resolver_algorithm_supported(dns_resolver_t *resolver,
 	 * Look up the DST algorithm identifier for private-OID
 	 * and private-DNS keys.
 	 */
-	if (alg == DST_ALG_PRIVATEDNS && private != NULL) {
-		isc_buffer_t b;
-		isc_buffer_init(&b, private, len);
-		isc_buffer_add(&b, len);
-		alg = dst_algorithm_fromprivatedns(&b);
+	if (private != NULL) {
+		alg = dst_algorithm_fromdata(alg, private, len);
 		if (alg == 0) {
 			return false;
 		}
 	}
 
-	if (alg == DST_ALG_PRIVATEOID && private != NULL) {
-		isc_buffer_t b;
-		isc_buffer_init(&b, private, len);
-		isc_buffer_add(&b, len);
-		alg = dst_algorithm_fromprivateoid(&b);
-		if (alg == 0) {
-			return false;
-		}
-	}
 	if (dns_nametree_covered(resolver->algorithms, name, NULL, alg)) {
 		return false;
 	}