allow multiple key algorithms in the same control listener

if a control channel listener was configured with more than one
key algorithm, message verification would be attempted with each
algorithm in turn. if the first key failed due to the wrong
signature length, the entire verification process was aborted,
rather than continuing on to try with another key.

(cherry picked from commit 841b557df8482c180b4ecbcf8115406100396bcc)

diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index 958b8027fa61058244d62f5193b1a734e64d7eac..cbff2ddf7bb2429ce6ca5a92dc267483c79e8832 100644 (file)
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -392,10 +392,6 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
                        break;
                }
                isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
-               if (result != ISCCC_R_BADAUTH) {
-                       log_invalid(&conn->ccmsg, result);
-                       goto cleanup;
-               }
        }
 
        if (key == NULL) {

diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
index b59e7a7c2f168fa35bfaa541ba4ad231b34ae98b..155c4e185465b4bb0ad2e57812cf2bc2ea59ff36 100644 (file)
--- a/bin/tests/system/rndc/setup.sh
+++ b/bin/tests/system/rndc/setup.sh
@@ -39,3 +39,12 @@ make_key 3 ${EXTRAPORT3} hmac-sha224
 make_key 4 ${EXTRAPORT4} hmac-sha256
 make_key 5 ${EXTRAPORT5} hmac-sha384
 make_key 6 ${EXTRAPORT6} hmac-sha512
+
+cat >> ns4/named.conf <<- EOF
+
+controls {
+       inet 10.53.0.4 port ${EXTRAPORT7}
+               allow { any; } keys { "key1"; "key2"; "key3";
+                                      "key4"; "key5"; "key6"; };
+};
+EOF

diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index 9fd84ede0a0427fde43f603640af24b956c02829..e463eb4d4ed0a6a36fa08255827c3cb5ccc575f0 100644 (file)
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -413,6 +413,16 @@ done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "testing single control channel with multiple algorithms ($n)"
+ret=0
+for i in 1 2 3 4 5 6
+do
+        $RNDC -s 10.53.0.4 -p ${EXTRAPORT7} -c ns4/key${i}.conf status > /dev/null 2>&1 || ret=1
+done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "testing automatic zones are reported ($n)"
 ret=0