From 85938345f9da377e903de0e99b36eaa2a98d99c7 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Wed, 13 Mar 2013 17:53:11 -0700 Subject: [PATCH] algorithm flexibility for rndc 3525. [func] Support for additional signing algorithms in rndc: hmac-sha1, -sha224, -sha256, -sha384, and -sha512. The -A option to rndc-confgen can be used to select the algorithm for the generated key. (The default is still hmac-md5; this may change in a future release.) [RT #20363] --- bin/confgen/rndc-confgen.c | 27 +- bin/confgen/rndc-confgen.docbook | 18 +- bin/named/controlconf.c | 22 +- bin/rndc/rndc.c | 38 ++- bin/rndc/rndc.conf | 4 +- bin/rndc/rndc.conf.docbook | 16 +- bin/rndc/rndc.docbook | 14 +- bin/tests/system/autosign/ns1/named.conf | 2 +- bin/tests/system/autosign/ns2/named.conf | 2 +- bin/tests/system/autosign/ns3/named.conf | 2 +- bin/tests/system/cacheclean/ns2/named.conf | 2 +- bin/tests/system/common/controls.conf | 2 +- bin/tests/system/common/rndc.conf | 2 +- bin/tests/system/common/rndc.key | 2 +- bin/tests/system/conf.sh.in | 1 + bin/tests/system/database/ns1/named.conf1 | 2 +- bin/tests/system/database/ns1/named.conf2 | 2 +- bin/tests/system/dlv/ns5/named.conf | 4 +- bin/tests/system/dlv/ns5/rndc.conf | 2 +- bin/tests/system/dlvauto/ns2/named.conf | 2 +- bin/tests/system/dlzexternal/ns1/named.conf.in | 2 +- bin/tests/system/dnssec/ns3/named.conf | 2 +- bin/tests/system/dnssec/ns4/named1.conf | 2 +- bin/tests/system/dnssec/ns4/named2.conf | 2 +- bin/tests/system/dnssec/ns4/named3.conf | 2 +- bin/tests/system/geoip/ns2/named1.conf | 2 +- bin/tests/system/geoip/ns2/named10.conf | 2 +- bin/tests/system/geoip/ns2/named11.conf | 2 +- bin/tests/system/geoip/ns2/named2.conf | 2 +- bin/tests/system/geoip/ns2/named3.conf | 2 +- bin/tests/system/geoip/ns2/named4.conf | 2 +- bin/tests/system/geoip/ns2/named5.conf | 2 +- bin/tests/system/geoip/ns2/named6.conf | 2 +- bin/tests/system/geoip/ns2/named7.conf | 2 +- bin/tests/system/geoip/ns2/named8.conf | 2 +- bin/tests/system/geoip/ns2/named9.conf | 2 +- bin/tests/system/ixfr/ns3/named.conf | 2 +- bin/tests/system/ixfr/ns4/named.conf | 2 +- bin/tests/system/ixfr/setup.sh | 2 +- bin/tests/system/logfileconfig/ns1/named.dirconf | 2 +- bin/tests/system/logfileconfig/ns1/named.pipeconf | 2 +- bin/tests/system/logfileconfig/ns1/named.plain | 2 +- bin/tests/system/logfileconfig/ns1/named.symconf | 2 +- bin/tests/system/logfileconfig/ns1/rndc.conf | 2 +- bin/tests/system/nsupdate/ns1/named.conf | 2 +- bin/tests/system/pkcs11/ns1/named.conf | 2 +- bin/tests/system/resolver/ns4/named.conf | 2 +- bin/tests/system/rndc/clean.sh | 2 + bin/tests/system/rndc/ns2/named.conf | 4 +- bin/tests/system/rndc/ns2/secondkey.conf | 2 +- bin/tests/system/rndc/ns3/named.conf | 4 +- bin/tests/system/rndc/ns4/3bf305731dd26307.nta | 3 + bin/tests/system/rndc/ns4/named.conf.in | 28 +++ bin/tests/system/rndc/setup.sh | 24 +- bin/tests/system/rndc/tests.sh | 60 +++++ bin/tests/system/rpz/ns3/named.conf | 2 +- bin/tests/system/rpz/ns5/named.conf | 2 +- bin/tests/system/rrl/ns2/named.conf | 2 +- bin/tests/system/staticstub/ns3/named.conf.in | 2 +- bin/tests/system/stress/ns3/named.conf | 2 +- bin/tests/system/tkey/ns1/named.conf.in | 2 +- bin/tests/system/tsiggss/ns1/named.conf | 2 +- bin/tests/system/views/ns3/named1.conf | 2 +- bin/tests/system/views/ns3/named2.conf | 2 +- bin/tests/system/xfer/ns3/named.conf | 2 +- bin/tests/system/xfer/ns4/named.conf.base | 2 +- lib/isccc/cc.c | 289 ++++++++++++++++++---- lib/isccc/include/isccc/cc.h | 26 +- 68 files changed, 526 insertions(+), 158 deletions(-) create mode 100644 bin/tests/system/rndc/ns4/3bf305731dd26307.nta create mode 100644 bin/tests/system/rndc/ns4/named.conf.in diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c index e2ac079..3fd54fe 100644 --- a/bin/confgen/rndc-confgen.c +++ b/bin/confgen/rndc-confgen.c @@ -57,7 +57,6 @@ #include "util.h" #include "keygen.h" -#define DEFAULT_KEYLENGTH 128 /*% Bits. */ #define DEFAULT_KEYNAME "rndc-key" #define DEFAULT_SERVER "127.0.0.1" #define DEFAULT_PORT 953 @@ -80,7 +79,8 @@ Usage:\n\ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \ [-s addr] [-t chrootdir] [-u user]\n\ -a: generate just the key clause and write it to keyfile (%s)\n\ - -b bits: from 1 through 512, default %d; total length of the secret\n\ + -A alg: algorithm (default hmac-md5)\n\ + -b bits: from 1 through 512, default 256; total length of the secret\n\ -c keyfile: specify an alternate key file (requires -a)\n\ -k keyname: the name as it will be used in named.conf and rndc.conf\n\ -p port: the port named will listen on and rndc will connect to\n\ @@ -88,7 +88,7 @@ Usage:\n\ -s addr: the address to which rndc should connect\n\ -t chrootdir: write a keyfile in chrootdir as well (requires -a)\n\ -u user: set the keyfile owner to \"user\" (requires -a)\n", - progname, keydef, DEFAULT_KEYLENGTH); + progname, keydef); exit (status); } @@ -103,12 +103,12 @@ main(int argc, char **argv) { const char *keyname = NULL; const char *randomfile = NULL; const char *serveraddr = NULL; - dns_secalg_t alg = DST_ALG_HMACMD5; - const char *algname = alg_totext(alg); + dns_secalg_t alg; + const char *algname; char *p; int ch; int port; - int keysize; + int keysize = -1; struct in_addr addr4_dummy; struct in6_addr addr6_dummy; char *chrootdir = NULL; @@ -124,18 +124,25 @@ main(int argc, char **argv) { progname = program; keyname = DEFAULT_KEYNAME; - keysize = DEFAULT_KEYLENGTH; + alg = DST_ALG_HMACMD5; serveraddr = DEFAULT_SERVER; port = DEFAULT_PORT; isc_commandline_errprint = ISC_FALSE; while ((ch = isc_commandline_parse(argc, argv, - "ab:c:hk:Mmp:r:s:t:u:Vy")) != -1) { + "aA:b:c:hk:Mmp:r:s:t:u:Vy")) != -1) + { switch (ch) { case 'a': keyonly = ISC_TRUE; break; + case 'A': + algname = isc_commandline_argument; + alg = alg_fromtext(algname); + if (alg == DST_ALG_UNKNOWN) + fatal("Unsupported algorithm '%s'", algname); + break; case 'b': keysize = strtol(isc_commandline_argument, &p, 10); if (*p != '\0' || keysize < 0) @@ -203,6 +210,10 @@ main(int argc, char **argv) { if (argc > 0) usage(1); + if (keysize < 0) + keysize = alg_bits(alg); + algname = alg_totext(alg); + DO("create memory context", isc_mem_create(0, 0, &mctx)); isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret)); diff --git a/bin/confgen/rndc-confgen.docbook b/bin/confgen/rndc-confgen.docbook index af2cc43..f367b94 100644 --- a/bin/confgen/rndc-confgen.docbook +++ b/bin/confgen/rndc-confgen.docbook @@ -1,6 +1,6 @@ ]> + []>