Blame SOURCES/bind99-CVE-2015-5722.patch

4be90d
diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
4be90d
index 7a56c79..3ac01a8 100644
4be90d
--- a/lib/dns/hmac_link.c
4be90d
+++ b/lib/dns/hmac_link.c
4be90d
@@ -76,7 +76,7 @@ hmacmd5_createctx(dst_key_t *key, dst_context_t *dctx) {
4be90d
 	hmacmd5ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacmd5_t));
4be90d
 	if (hmacmd5ctx == NULL)
4be90d
 		return (ISC_R_NOMEMORY);
4be90d
-	isc_hmacmd5_init(hmacmd5ctx, hkey->key, ISC_SHA1_BLOCK_LENGTH);
4be90d
+	isc_hmacmd5_init(hmacmd5ctx, hkey->key, ISC_MD5_BLOCK_LENGTH);
4be90d
 	dctx->ctxdata.hmacmd5ctx = hmacmd5ctx;
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
@@ -139,7 +139,7 @@ hmacmd5_compare(const dst_key_t *key1, const dst_key_t *key2) {
4be90d
 	else if (hkey1 == NULL || hkey2 == NULL)
4be90d
 		return (ISC_FALSE);
4be90d
 
4be90d
-	if (isc_safe_memcmp(hkey1->key, hkey2->key, ISC_SHA1_BLOCK_LENGTH))
4be90d
+	if (isc_safe_memcmp(hkey1->key, hkey2->key, ISC_MD5_BLOCK_LENGTH))
4be90d
 		return (ISC_TRUE);
4be90d
 	else
4be90d
 		return (ISC_FALSE);
4be90d
@@ -150,17 +150,17 @@ hmacmd5_generate(dst_key_t *key, int pseudorandom_ok, void (*callback)(int)) {
4be90d
 	isc_buffer_t b;
4be90d
 	isc_result_t ret;
4be90d
 	unsigned int bytes;
4be90d
-	unsigned char data[ISC_SHA1_BLOCK_LENGTH];
4be90d
+	unsigned char data[ISC_MD5_BLOCK_LENGTH];
4be90d
 
4be90d
 	UNUSED(callback);
4be90d
 
4be90d
 	bytes = (key->key_size + 7) / 8;
4be90d
-	if (bytes > ISC_SHA1_BLOCK_LENGTH) {
4be90d
-		bytes = ISC_SHA1_BLOCK_LENGTH;
4be90d
-		key->key_size = ISC_SHA1_BLOCK_LENGTH * 8;
4be90d
+	if (bytes > ISC_MD5_BLOCK_LENGTH) {
4be90d
+		bytes = ISC_MD5_BLOCK_LENGTH;
4be90d
+		key->key_size = ISC_MD5_BLOCK_LENGTH * 8;
4be90d
 	}
4be90d
 
4be90d
-	memset(data, 0, ISC_SHA1_BLOCK_LENGTH);
4be90d
+	memset(data, 0, ISC_MD5_BLOCK_LENGTH);
4be90d
 	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
4be90d
 
4be90d
 	if (ret != ISC_R_SUCCESS)
4be90d
@@ -169,7 +169,7 @@ hmacmd5_generate(dst_key_t *key, int pseudorandom_ok, void (*callback)(int)) {
4be90d
 	isc_buffer_init(&b, data, bytes);
4be90d
 	isc_buffer_add(&b, bytes);
4be90d
 	ret = hmacmd5_fromdns(key, &b);
4be90d
-	memset(data, 0, ISC_SHA1_BLOCK_LENGTH);
4be90d
+	memset(data, 0, ISC_MD5_BLOCK_LENGTH);
4be90d
 
4be90d
 	return (ret);
4be90d
 }
4be90d
@@ -223,7 +223,7 @@ hmacmd5_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 
4be90d
 	memset(hkey->key, 0, sizeof(hkey->key));
4be90d
 
4be90d
-	if (r.length > ISC_SHA1_BLOCK_LENGTH) {
4be90d
+	if (r.length > ISC_MD5_BLOCK_LENGTH) {
4be90d
 		isc_md5_init(&md5ctx);
4be90d
 		isc_md5_update(&md5ctx, r.base, r.length);
4be90d
 		isc_md5_final(&md5ctx, hkey->key);
4be90d
@@ -237,6 +237,8 @@ hmacmd5_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	key->key_size = keylen * 8;
4be90d
 	key->keydata.hmacmd5 = hkey;
4be90d
 
4be90d
+	isc_buffer_forward(data, r.length);
4be90d
+
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
 
4be90d
@@ -518,6 +520,8 @@ hmacsha1_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	key->key_size = keylen * 8;
4be90d
 	key->keydata.hmacsha1 = hkey;
4be90d
 
4be90d
+	isc_buffer_forward(data, r.length);
4be90d
+
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
 
4be90d
@@ -804,6 +808,8 @@ hmacsha224_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	key->key_size = keylen * 8;
4be90d
 	key->keydata.hmacsha224 = hkey;
4be90d
 
4be90d
+	isc_buffer_forward(data, r.length);
4be90d
+
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
 
4be90d
@@ -1090,6 +1096,8 @@ hmacsha256_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	key->key_size = keylen * 8;
4be90d
 	key->keydata.hmacsha256 = hkey;
4be90d
 
4be90d
+	isc_buffer_forward(data, r.length);
4be90d
+
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
 
4be90d
@@ -1376,6 +1384,8 @@ hmacsha384_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	key->key_size = keylen * 8;
4be90d
 	key->keydata.hmacsha384 = hkey;
4be90d
 
4be90d
+	isc_buffer_forward(data, r.length);
4be90d
+
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
 
4be90d
@@ -1662,6 +1672,8 @@ hmacsha512_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	key->key_size = keylen * 8;
4be90d
 	key->keydata.hmacsha512 = hkey;
4be90d
 
4be90d
+	isc_buffer_forward(data, r.length);
4be90d
+
4be90d
 	return (ISC_R_SUCCESS);
4be90d
 }
4be90d
 
4be90d
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
4be90d
index bdbd269..37853aa 100644
4be90d
--- a/lib/dns/include/dst/dst.h
4be90d
+++ b/lib/dns/include/dst/dst.h
4be90d
@@ -69,6 +69,7 @@ typedef struct dst_context 	dst_context_t;
4be90d
 #define DST_ALG_HMACSHA256	163	/* XXXMPA */
4be90d
 #define DST_ALG_HMACSHA384	164	/* XXXMPA */
4be90d
 #define DST_ALG_HMACSHA512	165	/* XXXMPA */
4be90d
+#define DST_ALG_INDIRECT	252
4be90d
 #define DST_ALG_PRIVATE		254
4be90d
 #define DST_ALG_EXPAND		255
4be90d
 #define DST_MAX_ALGS		255
4be90d
diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
4be90d
index bcb3d05..3114954 100644
4be90d
--- a/lib/dns/ncache.c
4be90d
+++ b/lib/dns/ncache.c
4be90d
@@ -614,13 +614,11 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
4be90d
 		dns_name_fromregion(&tname, &remaining);
4be90d
 		INSIST(remaining.length >= tname.length);
4be90d
 		isc_buffer_forward(&source, tname.length);
4be90d
-		remaining.length -= tname.length;
4be90d
-		remaining.base += tname.length;
4be90d
+		isc_region_consume(&remaining, tname.length);
4be90d
 
4be90d
 		INSIST(remaining.length >= 2);
4be90d
 		type = isc_buffer_getuint16(&source);
4be90d
-		remaining.length -= 2;
4be90d
-		remaining.base += 2;
4be90d
+		isc_region_consume(&remaining, 2);
4be90d
 
4be90d
 		if (type != dns_rdatatype_rrsig ||
4be90d
 		    !dns_name_equal(&tname, name)) {
4be90d
@@ -632,8 +630,7 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
4be90d
 		INSIST(remaining.length >= 1);
4be90d
 		trust = isc_buffer_getuint8(&source);
4be90d
 		INSIST(trust <= dns_trust_ultimate);
4be90d
-		remaining.length -= 1;
4be90d
-		remaining.base += 1;
4be90d
+		isc_region_consume(&remaining, 1);
4be90d
 
4be90d
 		raw = remaining.base;
4be90d
 		count = raw[0] * 256 + raw[1];
4be90d
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
4be90d
index 55752da..f0cee8d 100644
4be90d
--- a/lib/dns/openssldh_link.c
4be90d
+++ b/lib/dns/openssldh_link.c
4be90d
@@ -266,8 +266,10 @@ openssldh_destroy(dst_key_t *key) {
4be90d
 
4be90d
 static void
4be90d
 uint16_toregion(isc_uint16_t val, isc_region_t *region) {
4be90d
-	*region->base++ = (val & 0xff00) >> 8;
4be90d
-	*region->base++ = (val & 0x00ff);
4be90d
+	*region->base = (val & 0xff00) >> 8;
4be90d
+	isc_region_consume(region, 1);
4be90d
+	*region->base = (val & 0x00ff);
4be90d
+	isc_region_consume(region, 1);
4be90d
 }
4be90d
 
4be90d
 static isc_uint16_t
4be90d
@@ -278,7 +280,8 @@ uint16_fromregion(isc_region_t *region) {
4be90d
 	val = ((unsigned int)(cp[0])) << 8;
4be90d
 	val |= ((unsigned int)(cp[1]));
4be90d
 
4be90d
-	region->base += 2;
4be90d
+	isc_region_consume(region, 2);
4be90d
+
4be90d
 	return (val);
4be90d
 }
4be90d
 
4be90d
@@ -319,16 +322,16 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
4be90d
 	}
4be90d
 	else
4be90d
 		BN_bn2bin(dh->p, r.base);
4be90d
-	r.base += plen;
4be90d
+	isc_region_consume(&r, plen);
4be90d
 
4be90d
 	uint16_toregion(glen, &r);
4be90d
 	if (glen > 0)
4be90d
 		BN_bn2bin(dh->g, r.base);
4be90d
-	r.base += glen;
4be90d
+	isc_region_consume(&r, glen);
4be90d
 
4be90d
 	uint16_toregion(publen, &r);
4be90d
 	BN_bn2bin(dh->pub_key, r.base);
4be90d
-	r.base += publen;
4be90d
+	isc_region_consume(&r, publen);
4be90d
 
4be90d
 	isc_buffer_add(data, dnslen);
4be90d
 
4be90d
@@ -369,10 +372,12 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 		return (DST_R_INVALIDPUBLICKEY);
4be90d
 	}
4be90d
 	if (plen == 1 || plen == 2) {
4be90d
-		if (plen == 1)
4be90d
-			special = *r.base++;
4be90d
-		else
4be90d
+		if (plen == 1) {
4be90d
+			special = *r.base;
4be90d
+			isc_region_consume(&r, 1);
4be90d
+		} else {
4be90d
 			special = uint16_fromregion(&r);
4be90d
+		}
4be90d
 		switch (special) {
4be90d
 			case 1:
4be90d
 				dh->p = &bn768;
4be90d
@@ -387,10 +392,9 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 				DH_free(dh);
4be90d
 				return (DST_R_INVALIDPUBLICKEY);
4be90d
 		}
4be90d
-	}
4be90d
-	else {
4be90d
+	} else {
4be90d
 		dh->p = BN_bin2bn(r.base, plen, NULL);
4be90d
-		r.base += plen;
4be90d
+		isc_region_consume(&r, plen);
4be90d
 	}
4be90d
 
4be90d
 	/*
4be90d
@@ -421,15 +425,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 				return (DST_R_INVALIDPUBLICKEY);
4be90d
 			}
4be90d
 		}
4be90d
-	}
4be90d
-	else {
4be90d
+	} else {
4be90d
 		if (glen == 0) {
4be90d
 			DH_free(dh);
4be90d
 			return (DST_R_INVALIDPUBLICKEY);
4be90d
 		}
4be90d
 		dh->g = BN_bin2bn(r.base, glen, NULL);
4be90d
 	}
4be90d
-	r.base += glen;
4be90d
+	isc_region_consume(&r, glen);
4be90d
 
4be90d
 	if (r.length < 2) {
4be90d
 		DH_free(dh);
4be90d
@@ -441,7 +444,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 		return (DST_R_INVALIDPUBLICKEY);
4be90d
 	}
4be90d
 	dh->pub_key = BN_bin2bn(r.base, publen, NULL);
4be90d
-	r.base += publen;
4be90d
+	isc_region_consume(&r, publen);
4be90d
 
4be90d
 	key->key_size = BN_num_bits(dh->p);
4be90d
 
4be90d
diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
4be90d
index fd6e91e..8e16557 100644
4be90d
--- a/lib/dns/openssldsa_link.c
4be90d
+++ b/lib/dns/openssldsa_link.c
4be90d
@@ -137,6 +135,7 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
4be90d
 	DSA *dsa = key->keydata.dsa;
4be90d
 	isc_region_t r;
4be90d
 	DSA_SIG *dsasig;
4be90d
+	unsigned int klen;
4be90d
 #if USE_EVP
4be90d
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
4be90d
 	EVP_PKEY *pkey;
4be90d
@@ -209,11 +209,17 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
4be90d
 					       "DSA_do_sign",
4be90d
 					       DST_R_SIGNFAILURE));
4be90d
 #endif
4be90d
-	*r.base++ = (key->key_size - 512)/64;
4be90d
+
4be90d
+	klen = (key->key_size - 512)/64;
4be90d
+	if (klen > 255)
4be90d
+		return (ISC_R_FAILURE);
4be90d
+	*r.base = klen;
4be90d
+	isc_region_consume(&r, 1);
4be90d
+
4be90d
 	BN_bn2bin_fixed(dsasig->r, r.base, ISC_SHA1_DIGESTLENGTH);
4be90d
-	r.base += ISC_SHA1_DIGESTLENGTH;
4be90d
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
4be90d
 	BN_bn2bin_fixed(dsasig->s, r.base, ISC_SHA1_DIGESTLENGTH);
4be90d
-	r.base += ISC_SHA1_DIGESTLENGTH;
4be90d
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
4be90d
 	DSA_SIG_free(dsasig);
4be90d
 	isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1);
4be90d
 
4be90d
@@ -446,15 +452,16 @@ openssldsa_todns(const dst_key_t *key, isc_buffer_t *data) {
4be90d
 	if (r.length < (unsigned int) dnslen)
4be90d
 		return (ISC_R_NOSPACE);
4be90d
 
4be90d
-	*r.base++ = t;
4be90d
+	*r.base = t;
4be90d
+	isc_region_consume(&r, 1);
4be90d
 	BN_bn2bin_fixed(dsa->q, r.base, ISC_SHA1_DIGESTLENGTH);
4be90d
-	r.base += ISC_SHA1_DIGESTLENGTH;
4be90d
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
4be90d
 	BN_bn2bin_fixed(dsa->p, r.base, key->key_size/8);
4be90d
-	r.base += p_bytes;
4be90d
+	isc_region_consume(&r, p_bytes);
4be90d
 	BN_bn2bin_fixed(dsa->g, r.base, key->key_size/8);
4be90d
-	r.base += p_bytes;
4be90d
+	isc_region_consume(&r, p_bytes);
4be90d
 	BN_bn2bin_fixed(dsa->pub_key, r.base, key->key_size/8);
4be90d
-	r.base += p_bytes;
4be90d
+	isc_region_consume(&r, p_bytes);
4be90d
 
4be90d
 	isc_buffer_add(data, dnslen);
4be90d
 
4be90d
@@ -479,29 +486,30 @@ openssldsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 		return (ISC_R_NOMEMORY);
4be90d
 	dsa->flags &= ~DSA_FLAG_CACHE_MONT_P;
4be90d
 
4be90d
-	t = (unsigned int) *r.base++;
4be90d
+	t = (unsigned int) *r.base;
4be90d
+	isc_region_consume(&r, 1);
4be90d
 	if (t > 8) {
4be90d
 		DSA_free(dsa);
4be90d
 		return (DST_R_INVALIDPUBLICKEY);
4be90d
 	}
4be90d
 	p_bytes = 64 + 8 * t;
4be90d
 
4be90d
-	if (r.length < 1 + ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
4be90d
+	if (r.length < ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
4be90d
 		DSA_free(dsa);
4be90d
 		return (DST_R_INVALIDPUBLICKEY);
4be90d
 	}
4be90d
 
4be90d
 	dsa->q = BN_bin2bn(r.base, ISC_SHA1_DIGESTLENGTH, NULL);
4be90d
-	r.base += ISC_SHA1_DIGESTLENGTH;
4be90d
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
4be90d
 
4be90d
 	dsa->p = BN_bin2bn(r.base, p_bytes, NULL);
4be90d
-	r.base += p_bytes;
4be90d
+	isc_region_consume(&r, p_bytes);
4be90d
 
4be90d
 	dsa->g = BN_bin2bn(r.base, p_bytes, NULL);
4be90d
-	r.base += p_bytes;
4be90d
+	isc_region_consume(&r, p_bytes);
4be90d
 
4be90d
 	dsa->pub_key = BN_bin2bn(r.base, p_bytes, NULL);
4be90d
-	r.base += p_bytes;
4be90d
+	isc_region_consume(&r, p_bytes);
4be90d
 
4be90d
 	key->key_size = p_bytes * 8;
4be90d
 
4be90d
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
4be90d
index c64cc55..40c612b 100644
4be90d
--- a/lib/dns/opensslecdsa_link.c
4be90d
+++ b/lib/dns/opensslecdsa_link.c
4be90d
@@ -159,9 +157,9 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
4be90d
 					       "ECDSA_do_sign",
4be90d
 					       DST_R_SIGNFAILURE));
4be90d
 	BN_bn2bin_fixed(ecdsasig->r, r.base, siglen / 2);
4be90d
-	r.base += siglen / 2;
4be90d
+	isc_region_consume(&r, siglen / 2);
4be90d
 	BN_bn2bin_fixed(ecdsasig->s, r.base, siglen / 2);
4be90d
-	r.base += siglen / 2;
4be90d
+	isc_region_consume(&r, siglen / 2);
4be90d
 	ECDSA_SIG_free(ecdsasig);
4be90d
 	isc_buffer_add(sig, siglen);
4be90d
 	ret = ISC_R_SUCCESS;
4be90d
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
4be90d
index 1edeb8d..53c6d4b 100644
4be90d
--- a/lib/dns/opensslrsa_link.c
4be90d
+++ b/lib/dns/opensslrsa_link.c
4be90d
@@ -965,6 +965,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	RSA *rsa;
4be90d
 	isc_region_t r;
4be90d
 	unsigned int e_bytes;
4be90d
+	unsigned int length;
4be90d
 #if USE_EVP
4be90d
 	EVP_PKEY *pkey;
4be90d
 #endif
4be90d
@@ -972,6 +973,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 	isc_buffer_remainingregion(data, &r);
4be90d
 	if (r.length == 0)
4be90d
 		return (ISC_R_SUCCESS);
4be90d
+	length = r.length;
4be90d
 
4be90d
 	rsa = RSA_new();
4be90d
 	if (rsa == NULL)
4be90d
@@ -982,17 +984,18 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 		RSA_free(rsa);
4be90d
 		return (DST_R_INVALIDPUBLICKEY);
4be90d
 	}
4be90d
-	e_bytes = *r.base++;
4be90d
-	r.length--;
4be90d
+	e_bytes = *r.base;
4be90d
+	isc_region_consume(&r, 1);
4be90d
 
4be90d
 	if (e_bytes == 0) {
4be90d
 		if (r.length < 2) {
4be90d
 			RSA_free(rsa);
4be90d
 			return (DST_R_INVALIDPUBLICKEY);
4be90d
 		}
4be90d
-		e_bytes = ((*r.base++) << 8);
4be90d
-		e_bytes += *r.base++;
4be90d
-		r.length -= 2;
4be90d
+		e_bytes = (*r.base) << 8;
4be90d
+		isc_region_consume(&r, 1);
4be90d
+		e_bytes += *r.base;
4be90d
+		isc_region_consume(&r, 1);
4be90d
 	}
4be90d
 
4be90d
 	if (r.length < e_bytes) {
4be90d
@@ -1000,14 +1003,13 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
4be90d
 		return (DST_R_INVALIDPUBLICKEY);
4be90d
 	}
4be90d
 	rsa->e = BN_bin2bn(r.base, e_bytes, NULL);
4be90d
-	r.base += e_bytes;
4be90d
-	r.length -= e_bytes;
4be90d
+	isc_region_consume(&r, e_bytes);
4be90d
 
4be90d
 	rsa->n = BN_bin2bn(r.base, r.length, NULL);
4be90d
 
4be90d
 	key->key_size = BN_num_bits(rsa->n);
4be90d
 
4be90d
-	isc_buffer_forward(data, r.length);
4be90d
+	isc_buffer_forward(data, length);
4be90d
 
4be90d
 #if USE_EVP
4be90d
 	pkey = EVP_PKEY_new();
4be90d
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
4be90d
index 2004b0b..c7971b1 100644
4be90d
--- a/lib/dns/resolver.c
4be90d
+++ b/lib/dns/resolver.c
4be90d
@@ -8959,6 +8959,12 @@ dns_resolver_algorithm_supported(dns_resolver_t *resolver, dns_name_t *name,
4be90d
 
4be90d
 	REQUIRE(VALID_RESOLVER(resolver));
4be90d
 
4be90d
+	/*
4be90d
+	 * DH is unsupported for DNSKEYs, see RFC 4034 sec. A.1.
4be90d
+	 */
4be90d
+	if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT))
4be90d
+		return (ISC_FALSE);
4be90d
+
4be90d
 #if USE_ALGLOCK
4be90d
 	RWLOCK(&resolver->alglock, isc_rwlocktype_read);
4be90d
 #endif
4be90d