[master] support all algorithms in ddns-confgen

3431.	[bug]		ddns-confgen: Some valid key algorithms were
			not accepted. [RT #31927]

diff --git a/CHANGES b/CHANGES
index 2245e8ce948bc1a41800b5e321a162f8beb78f1d..0c71c541edac4588027da9dc7e8ad83fa452a5f0 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3431.  [bug]           ddns-confgen: Some valid key algorithms were
+                       not accepted. [RT #31927]
+
 3430.  [bug]           win32: isc_time_formatISO8601 was missing the
                        'T' between the date and time. [RT #32044]
 

diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
index a5db317700d8aa106adbd909f8739f0dcc821268..32e5b595e42fb197040449976b6e9636c727d9a8 100644 (file)
--- a/bin/confgen/keygen.c
+++ b/bin/confgen/keygen.c
@@ -126,6 +126,7 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 
        switch (alg) {
            case DST_ALG_HMACMD5:
+           case DST_ALG_HMACSHA512:
                if (keysize < 1 || keysize > 512)
                        fatal("keysize %d out of range (must be 1-512)\n",
                              keysize);
@@ -135,6 +136,21 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
                        fatal("keysize %d out of range (must be 1-256)\n",
                              keysize);
                break;
+           case DST_ALG_HMACSHA1:
+               if (keysize < 1 || keysize > 160)
+                       fatal("keysize %d out of range (must be 1-160)\n",
+                             keysize);
+               break;
+           case DST_ALG_HMACSHA224:
+               if (keysize < 1 || keysize > 224)
+                       fatal("keysize %d out of range (must be 1-224)\n",
+                             keysize);
+               break;
+           case DST_ALG_HMACSHA384:
+               if (keysize < 1 || keysize > 384)
+                       fatal("keysize %d out of range (must be 1-384)\n",
+                             keysize);
+               break;
            default:
                fatal("unsupported algorithm %d\n", alg);
        }

diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index 84af5e7b0b5986b79019beee50b69e992bc862f7..f8654d65d3e102d4509ff5c247fcb6866d7bcd09 100644 (file)
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -22,7 +22,9 @@
 #
 
 rm -f ns1/*.jnl ns2/*.jnl
-rm -f ns1/example.db ns1/unixtime.db ns1/update.db ns1/other.db ns1/ddns.key
+rm -f ns1/example.db ns1/unixtime.db ns1/update.db ns1/other.db ns1/keytests.db
+rm -f ns1/md5.key ns1/sha1.key ns1/sha224.key ns1/sha256.key ns1/sha384.key
+rm -f ns1/sha512.key ns1/ddns.key
 rm -f nsupdate.out
 rm -f random.data
 rm -f ns2/example.bk

diff --git a/bin/tests/system/nsupdate/ns1/named.conf b/bin/tests/system/nsupdate/ns1/named.conf
index 0132c2259afd900e4f2c73ee9b4b5f173f62508e..9722be814bb0c99d21f0a92464e798aef362c8f3 100644 (file)
--- a/bin/tests/system/nsupdate/ns1/named.conf
+++ b/bin/tests/system/nsupdate/ns1/named.conf
@@ -90,3 +90,22 @@ zone "unixtime.nil" {
        serial-update-method unixtime;
 };
 
+include "md5.key";
+include "sha1.key";
+include "sha224.key";
+include "sha256.key";
+include "sha384.key";
+include "sha512.key";
+
+zone "keytests.nil" {
+        type master;
+        file "keytests.db";
+        update-policy {
+            grant md5-key name md5.keytests.nil. ANY;
+            grant sha1-key name sha1.keytests.nil. ANY;
+            grant sha224-key name sha224.keytests.nil. ANY;
+            grant sha256-key name sha256.keytests.nil. ANY;
+            grant sha384-key name sha384.keytests.nil. ANY;
+            grant sha512-key name sha512.keytests.nil. ANY;
+        };
+};

diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
index 16c030c7656817a67f20920c97de68cfbd1cbab9..bb015142dac8b0d22b1020e137f28bf7a9839850 100644 (file)
--- a/bin/tests/system/nsupdate/setup.sh
+++ b/bin/tests/system/nsupdate/setup.sh
@@ -31,6 +31,7 @@ rm -f ns3/example.db.jnl
 cp -f ns1/example1.db ns1/example.db
 sed 's/example.nil/other.nil/g' ns1/example1.db > ns1/other.db
 sed 's/example.nil/unixtime.nil/g' ns1/example1.db > ns1/unixtime.db
+sed 's/example.nil/keytests.nil/g' ns1/example1.db > ns1/keytests.db
 cp -f ns3/example.db.in ns3/example.db
 
 # update_test.pl has its own zone file because it
@@ -53,4 +54,11 @@ EOF
 ../../../tools/genrandom 400 random.data
 $DDNSCONFGEN -q -r random.data -z example.nil > ns1/ddns.key
 
+$DDNSCONFGEN -q -r random.data -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
+$DDNSCONFGEN -q -r random.data -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
+$DDNSCONFGEN -q -r random.data -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
+$DDNSCONFGEN -q -r random.data -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
+$DDNSCONFGEN -q -r random.data -a hmac-sha384 -k sha384-key -z keytests.nil > ns1/sha384.key
+$DDNSCONFGEN -q -r random.data -a hmac-sha512 -k sha512-key -z keytests.nil > ns1/sha512.key
+
 (cd ns3; sh -e sign.sh)

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index bd5590e8e31bafd7b30a3b7edfcece66f8bd9e22..77caccf63313015435ecc60a5dc8dd0a33ecabe8 100644 (file)
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -504,5 +504,24 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
+n=`expr $n + 1`
+ret=0
+echo "I:check TSIG key algorithms ($n)"
+for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+    $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
+server 10.53.0.1 5300
+update add ${alg}.keytests.nil. 600 A 10.10.10.3
+send
+END
+done
+sleep 2
+for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+    $DIG +short @10.53.0.1 -p 5300 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
+done
+if [ $ret -ne 0 ]; then
+    echo "I:failed"
+    status=1
+fi
+
 echo "I:exit status: $status"
 exit $status