named-checkconf needs to know if named will be running in FIPS mode

Call dst_lib_init to set FIPS mode if it was turned on at configure
time.

Check that named-checkconf report that dnssec policies that wont
work in FIPS mode are reported if named would be running in FIPS
mode.

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index a24435f03eba27526304517f8167478786e26966..42efae4ddbeeb9721cc5c907e497c0ae524a2844 100644 (file)
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -720,6 +720,8 @@ main(int argc, char **argv) {
 
        RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
 
+       RUNTIME_CHECK(dst_lib_init(mctx, NULL) == ISC_R_SUCCESS);
+
        RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
 
        if (nodeprecate) {
@@ -748,12 +750,15 @@ main(int argc, char **argv) {
        if (print && exit_status == 0) {
                cfg_printx(config, flags, output, NULL);
        }
+
        cfg_obj_destroy(parser, &config);
 
        cfg_parser_destroy(&parser);
 
        isc_log_destroy(&logc);
 
+       dst_lib_destroy();
+
        isc_mem_destroy(&mctx);
 
        return (exit_status);

diff --git a/bin/tests/system/checkconf/kasp-bad-keylen.conf b/bin/tests/system/checkconf/kasp-bad-keylen.conf
index 5ca4c34614513b02479dffb4fa2086730b5f5bda..385de8c58a7394c649a4dd13346f855f249f1f13 100644 (file)
--- a/bin/tests/system/checkconf/kasp-bad-keylen.conf
+++ b/bin/tests/system/checkconf/kasp-bad-keylen.conf
@@ -13,7 +13,7 @@
 
 dnssec-policy "bad-keylen" {
        keys {
-               csk lifetime P10Y algorithm rsasha1 511;
+               csk lifetime P10Y algorithm rsasha256 511;
        };
 };
 

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 68ed4088d8a8a58686a23d6c62eebb3a63155522..81e4af62f6854ff670e48ff792cb27e0611a50a7 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -536,7 +536,11 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-alg.conf > checkconf.out$n 2>&1 && ret=1
-grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
+if $FEATURETEST --have-fips-mode; then
+    grep "dnssec-policy: algorithm rsasha1 not supported in FIPS mode" < checkconf.out$n > /dev/null || ret=1
+else
+    grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
+fi
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -544,7 +548,7 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf kasp key errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-keylen.conf > checkconf.out$n 2>&1 && ret=1
-grep "dnssec-policy: key with algorithm rsasha1 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: key with algorithm rsasha256 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`