[master] Addes addtional HMAC TSIG algorithms to DDNS

    Merges in rt36947

diff --git a/RELNOTES b/RELNOTES
index 3593975192212461cea9ccbb8cbefd829ce70f34..e5796a9d9c89fcebfa7cf065ec2755b7fc8b9281 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -54,6 +54,11 @@ by Eric Young (eay@cryptsoft.com).
 
                        Changes since 4.3.1
 
+- TSIG-authenticated dynamic DNS updates now support the use of these
+  additional algorithms: hmac-sha1, hmac_sha224, hmac_sha256, hmac_sha384,
+  and hmac_sha512
+  [ISC-Bugs #36947]
+
 - Corrected rate limiting checks for bad packet logging. 
   [ISC-Bugs #36897]
 

diff --git a/includes/omapip/isclib.h b/includes/omapip/isclib.h
index 831047ae32a66fb05fb6aa673187b9b10d2029ff..caa388ad90c7cf6b8f9f3ca7bfeda97200ec55aa 100644 (file)
--- a/includes/omapip/isclib.h
+++ b/includes/omapip/isclib.h
@@ -3,7 +3,7 @@
    connections to the isc and dns libraries */
 
 /*
- * Copyright (c) 2009,2013 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2009,2013,2014 by Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -106,6 +106,11 @@ extern dhcp_context_t dhcp_gbl_ctx;
 #define DHCP_MAXDNS_WIRE 256
 #define DHCP_MAXNS         3
 #define DHCP_HMAC_MD5_NAME "HMAC-MD5.SIG-ALG.REG.INT."
+#define DHCP_HMAC_SHA1_NAME "HMAC-SHA1.SIG-ALG.REG.INT."
+#define DHCP_HMAC_SHA224_NAME "HMAC-SHA224.SIG-ALG.REG.INT."
+#define DHCP_HMAC_SHA256_NAME "HMAC-SHA256.SIG-ALG.REG.INT."
+#define DHCP_HMAC_SHA384_NAME "HMAC-SHA384.SIG-ALG.REG.INT."
+#define DHCP_HMAC_SHA512_NAME "HMAC-SHA512.SIG-ALG.REG.INT."
 
 isc_result_t dhcp_isc_name(unsigned char    *namestr,
                           dns_fixedname_t  *namefix,

diff --git a/omapip/isclib.c b/omapip/isclib.c
index 69edc2efa3e3d1a4042c6333e19ae4da611952b0..3e5e1c2b30e2eaec1d2ebb70270bd42a62e2ecfe 100644 (file)
--- a/omapip/isclib.c
+++ b/omapip/isclib.c
@@ -289,12 +289,24 @@ isclib_make_dst_key(char          *inname,
        dns_name_t *name;
        dns_fixedname_t name0;
        isc_buffer_t b;
+       unsigned int algorithm_code;
 
        isc_buffer_init(&b, secret, length);
        isc_buffer_add(&b, length);
 
-       /* We only support HMAC_MD5 currently */
-       if (strcasecmp(algorithm, DHCP_HMAC_MD5_NAME) != 0) {
+       if (strcasecmp(algorithm, DHCP_HMAC_MD5_NAME) == 0) {
+               algorithm_code =  DST_ALG_HMACMD5;
+       } else if (strcasecmp(algorithm, DHCP_HMAC_SHA1_NAME) == 0) {
+               algorithm_code =  DST_ALG_HMACSHA1;
+       } else if (strcasecmp(algorithm, DHCP_HMAC_SHA224_NAME) == 0) {
+               algorithm_code =  DST_ALG_HMACSHA224;
+       } else if (strcasecmp(algorithm, DHCP_HMAC_SHA256_NAME) == 0) {
+               algorithm_code =  DST_ALG_HMACSHA256;
+       } else if (strcasecmp(algorithm, DHCP_HMAC_SHA384_NAME) == 0) {
+               algorithm_code =  DST_ALG_HMACSHA384;
+       } else if (strcasecmp(algorithm, DHCP_HMAC_SHA512_NAME) == 0) {
+               algorithm_code =  DST_ALG_HMACSHA512;
+       } else {
                return(DHCP_R_INVALIDARG);
        }
 
@@ -303,7 +315,7 @@ isclib_make_dst_key(char          *inname,
                return(result);
        }
 
-       return(dst_key_frombuffer(name, DST_ALG_HMACMD5, DNS_KEYOWNER_ENTITY,
+       return(dst_key_frombuffer(name, algorithm_code, DNS_KEYOWNER_ENTITY,
                                  DNS_KEYPROTO_DNSSEC, dns_rdataclass_in,
                                  &b, dhcp_gbl_ctx.mctx, dstkey));
 }

diff --git a/server/dhcpd.conf.5 b/server/dhcpd.conf.5
index 2c63f9c7ccdd40f49386144916104d657bb5c2e6..3a7739e8daf508af22a3e4b829b8d49d53a501ab 100644 (file)
--- a/server/dhcpd.conf.5
+++ b/server/dhcpd.conf.5
@@ -1,6 +1,6 @@
 .\"    dhcpd.conf.5
 .\"
-.\" Copyright (c) 2004-2013 by Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (c) 2004-2014 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1996-2003 by Internet Software Consortium
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -1305,6 +1305,18 @@ dnssec-keygen, the above key would be created as follows:
        dnssec-keygen -a HMAC-MD5 -b 128 -n USER DHCP_UPDATER
 .fi
 .PP
+The key name, algorithm, and secret must match that being used by the DNS
+server. The DHCP server currently supports the following algorithms:
+.nf
+
+        HMAC-MD5
+        HMAC-SHA1
+        HMAC-SHA224
+        HMAC-SHA256
+        HMAC-SHA384
+        HMAC-SHA512
+.fi
+.PP
 You may wish to enable logging of DNS updates on your DNS server.
 To do so, you might write a logging statement like the following:
 .PP