Commit 1a2d60995f for bind

commit 1a2d60995f3524cb0c13c1785feb0b8d3423f140
Author: Matthijs Mekking <matthijs@isc.org>
Date:   Wed Sep 16 17:56:55 2026 +0200

    Mark salt-length > 0 as deprecated

    BCP 236 recommends not using salt and iterations. We have been
    disallowing extra iterations for a while now, we now also will
    deprecate salt.

diff --git a/bin/tests/system/checkconf/kasp-deprecated-fips.conf b/bin/tests/system/checkconf/kasp-deprecated-fips.conf
index e82bb0f4ff..676f022ddd 100644
--- a/bin/tests/system/checkconf/kasp-deprecated-fips.conf
+++ b/bin/tests/system/checkconf/kasp-deprecated-fips.conf
@@ -3,4 +3,5 @@ dnssec-policy deprecated {
 	keys {
 		csk lifetime unlimited algorithm ecdsa256;
 	};
+	nsec3param salt-length 8;
 };
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 1d47f42ba0..66bcd50186 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -732,10 +732,11 @@ if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
-echo_i "checking named-checkconf kasp deprecated algorithms and digests ($n)"
+echo_i "checking named-checkconf kasp deprecated algorithms, digests, and salt ($n)"
 ret=0
 if [ $RSASHA1_SUPPORTED = 0 ]; then
   $CHECKCONF kasp-deprecated-fips.conf >checkconf.out$n 2>&1 || ret=1
+  grep "dnssec-policy: deprecated NSEC3 salt-length > 0" <checkconf.out$n >/dev/null || ret=1
 else
   $CHECKCONF kasp-deprecated.conf >checkconf.out$n 2>&1 || ret=1
   grep "dnssec-policy: DNSSEC algorithm rsasha1 is deprecated" checkconf.out$n >/dev/null || ret=1
diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index 7eb8a1c4f8..0b1593c4cf 100644
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -502,6 +502,13 @@ cfg_nsec3param_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 	if (cfg_obj_isuint32(obj)) {
 		saltlen = cfg_obj_asuint32(obj);
 	}
+	if (saltlen != DEFAULT_NSEC3PARAM_SALTLEN) {
+		if (log_errors) {
+			kaspcfg_log(obj, ISC_LOG_WARNING,
+				    "dnssec-policy: deprecated NSEC3 "
+				    "salt-length > 0");
+		}
+	}
 	if (saltlen > 0xff) {
 		if (log_errors) {
 			kaspcfg_log(