Emit deprecated warning for K* file pairs

We try reading the same file using different methods so only
emit a warning if we successfully read the file.

(cherry picked from commit e3e20ed76e4b13d5cb66718cb8f75538e3290a50)

diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index 2302d685c0f42ab1e476d0834ae517a805b32f8d..689c2f589af4af41463a4664c88da79428c7a299 100644 (file)
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -63,6 +63,7 @@ rm -f ns9/denyname.example.db
 rm -f ns9/example.com.db
 rm -f ns9/in-addr.db
 rm -f perl.update_test.out
+rm -f nsupdate.alg-*
 rm -f nsupdate.out*
 rm -f typelist.out.*
 rm -f update.out.*

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 81b51926ce8ccb5b1c79aa4c4e80145c68585809..4df7ad8f1ca982f7facb055ac7877a8164dfe1b2 100755 (executable)
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -852,7 +852,7 @@ else
        echo_i "skipping disabled md5 (157) algorithm"
 fi
 for alg in $ALGS; do
-    $NSUPDATE -k ns1/legacy/Klegacy-${alg}.+${alg}+*.key <<END > /dev/null || ret=1
+    $NSUPDATE -k ns1/legacy/Klegacy-${alg}.+${alg}+*.key <<END > nsupdate.alg-$alg.out 2>&1 || ret=1
 server 10.53.0.1 ${PORT}
 update add ${alg}.keytests.nil. 600 A 10.10.10.3
 send
@@ -861,6 +861,7 @@ done
 sleep 2
 for alg in $ALGS; do
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
+    grep "Use of K\* file pairs for HMAC is deprecated" nsupdate.alg-$alg.out > /dev/null || ret=1
 done
 if [ $ret -ne 0 ]; then
     echo_i "failed"

diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
index 42ee16cf54541b7faa770914269c4a7bb3657339..97912837788c996cc2709615aab02063e4cb110a 100644 (file)
--- a/bin/tests/system/tsig/tests.sh
+++ b/bin/tests/system/tsig/tests.sh
@@ -261,8 +261,9 @@ if $FEATURETEST --md5
 then
        echo_i "fetching using hmac-md5 (legacy)"
        ret=0
-       $DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-md5-legacy.+*.key @10.53.0.1 soa > dig.out.md5.legacy || ret=1
+       $DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-md5-legacy.+*.key @10.53.0.1 soa > dig.out.md5.legacy 2>&1 || ret=1
        grep -i "md5.*TSIG.*NOERROR" dig.out.md5.legacy > /dev/null || ret=1
+       grep "Use of K\* file pairs for HMAC is deprecated" dig.out.md5.legacy > /dev/null || ret=1
        if [ $ret -eq 1 ] ; then
                echo_i "failed"; status=1
        fi
@@ -272,39 +273,44 @@ fi
 
 echo_i "fetching using hmac-sha1 (legacy)"
 ret=0
-$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha1-legacy.+*.key @10.53.0.1 soa > dig.out.sha1.legacy || ret=1
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha1-legacy.+*.key @10.53.0.1 soa > dig.out.sha1.legacy 2>&1 || ret=1
 grep -i "sha1.*TSIG.*NOERROR" dig.out.sha1.legacy > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha1.legacy > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
        echo_i "failed"; status=1
 fi
 
 echo_i "fetching using hmac-sha224 (legacy)"
 ret=0
-$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha224-legacy.+*.key @10.53.0.1 soa > dig.out.sha224 || ret=1
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha224-legacy.+*.key @10.53.0.1 soa > dig.out.sha224 2>&1 || ret=1
 grep -i "sha224.*TSIG.*NOERROR" dig.out.sha224 > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha224 > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
        echo_i "failed"; status=1
 fi
 
 echo_i "fetching using hmac-sha256 (legacy)"
 ret=0
-$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha256-legacy.*.key @10.53.0.1 soa > dig.out.sha256 || ret=1
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha256-legacy.*.key @10.53.0.1 soa > dig.out.sha256 2>&1 || ret=1
 grep -i "sha256.*TSIG.*NOERROR" dig.out.sha256 > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha256 > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
        echo_i "failed"; status=1
 fi
 
 echo_i "fetching using hmac-sha384 (legacy)"
 ret=0
-$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha384-legacy.*.key @10.53.0.1 soa > dig.out.sha384 || ret=1
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha384-legacy.*.key @10.53.0.1 soa > dig.out.sha384 2>&1 || ret=1
 grep -i "sha384.*TSIG.*NOERROR" dig.out.sha384 > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha384 > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
        echo_i "failed"; status=1
 fi
 
 echo_i "fetching using hmac-sha512 (legacy)"
 ret=0
-$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha512-legacy.*.key @10.53.0.1 soa > dig.out.sha512 || ret=1
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha512-legacy.*.key @10.53.0.1 soa > dig.out.sha512 2>&1 || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha512 > /dev/null || ret=1
 grep -i "sha512.*TSIG.*NOERROR" dig.out.sha512 > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
        echo_i "failed"; status=1

diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
index 0a0df8a25bb7fc45f332a19e399b9858e7ac9178..9f8e94b3d6be0928a118bd6f2fcb76cd4bfa9fb7 100644 (file)
--- a/lib/dns/hmac_link.c
+++ b/lib/dns/hmac_link.c
@@ -32,6 +32,7 @@
 
 #include <isc/buffer.h>
 #include <isc/hmac.h>
+#include <isc/lex.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
@@ -102,7 +103,17 @@
        }                                                                      \
        static isc_result_t hmac##alg##_parse(                                 \
                dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {            \
-               return (hmac_parse(ISC_MD_##alg, key, lexer, pub));            \
+               const char *file = isc_lex_getsourcename(lexer);               \
+               isc_result_t result;                                           \
+               result = hmac_parse(ISC_MD_##alg, key, lexer, pub);            \
+               if (result == ISC_R_SUCCESS && file != NULL) {                 \
+                       isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,       \
+                                     DNS_LOGMODULE_CRYPTO, ISC_LOG_WARNING,   \
+                                     "%s: Use of K* file pairs for HMAC is "  \
+                                     "deprecated\n",                          \
+                                     file);                                   \
+               }                                                              \
+               return (result);                                               \
        }                                                                      \
        static dst_func_t hmac##alg##_functions = {                            \
                hmac##alg##_createctx,                                         \