xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-09-24 00:34:02 +00:00
Code Issues Releases Wiki Activity

fix(xcat-core): makedns rewrites its own TSIG key and then fails against it

Browse Source 
makedns exits 1 on a management node that has Net::DNS below 1.36 and an
hmac-sha256 key, and reports "Failure encountered updating <zone> with entry
'', error was FORMERR".

update_namedconf in ddns.pm rewrites the named.conf key stanza to hmac-md5
whenever Net::DNS is below 1.36, and ddns_tsig_algorithm returns hmac-md5 for
the same reason. ddns_sign_update signs with site.dhcpomapialgorithm, which
xcatconfig sets to hmac-sha256 on EL9 and later. named matches a TSIG key by
name and by algorithm, so it answers NOTAUTH. The retry signs the same packet
a second time, and named answers FORMERR to the two signatures.

The version test protected the two-argument sign_tsig($name, $secret), which
produces an HMAC-MD5 signature only. ddns_sign_update signs every other
algorithm through a KEY RR, so the Net::DNS version no longer selects the
algorithm. This change deletes the rewrite and the version test, and signs with
the algorithm the key stanza declares. OmapiPolicy->algorithm_rr_type maps that
algorithm to its KEY RR number.

ddns_named_key_algorithm.t fails before this change: it reads the stanza as
hmac-md5 where the key was hmac-sha256.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This commit is contained in:
Daniel Hilst
2026-09-04 18:44:57 -03:00
parent b9b66aab14
commit 4eb9718548
2 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
+7
View File
@@ -66,6 +66,13 @@ sub normalize_algorithm {
return;
}
sub algorithm_rr_type {
my ( $class, $algorithm ) = @_;
$algorithm = $class->normalize_algorithm($algorithm) or return;
return $ALGORITHMS{$algorithm};
}
sub new_install_default_algorithm {
my ( $class, %args ) = @_;
xCAT-server/lib/xcat/plugins/ddns.pm
+11 -11
View File
@@ -37,10 +37,10 @@ sub ddns_tsig_algorithm {
my $settings = $ctx->{omapi_settings} || xCAT::DHCP::OmapiPolicy->settings();
# Keep old Net::DNS on MD5 unless the administrator explicitly selects a
# different OMAPI algorithm. Old Net::DNS can sign non-MD5 updates only
# through a KEY RR, which ddns_sign_update builds below.
return "hmac-md5" if (!net_dns_uses_keyfile() && !$settings->{algorithm_explicit});
# $ctx->{tsig_algorithm} is the algorithm the named.conf key stanza already declares.
# The Net::DNS version does not select the algorithm: old Net::DNS signs every algorithm
# except MD5 through a KEY RR, which ddns_sign_update builds.
return $settings->{algorithm} if $settings->{algorithm_explicit};
return $ctx->{tsig_algorithm} || $settings->{algorithm};
}
@@ -65,13 +65,17 @@ sub ddns_sign_update {
return;
}
if ($settings->{algorithm} eq 'hmac-md5') {
# named matches the key by name and by algorithm. Sign with the algorithm the key stanza
# declares, not with the OMAPI default.
my $algorithm = ddns_tsig_algorithm($ctx);
if ($algorithm eq 'hmac-md5') {
$update->sign_tsig($settings->{key_name}, $ctx->{privkey});
return;
}
my $owner = xCAT::DHCP::OmapiPolicy->key_owner($settings);
my $keyrr = Net::DNS::RR->new("$owner IN KEY 512 3 $settings->{key_rr_type} $ctx->{privkey}");
my $owner = xCAT::DHCP::OmapiPolicy->key_owner($settings);
my $rr_type = xCAT::DHCP::OmapiPolicy->algorithm_rr_type($algorithm);
my $keyrr = Net::DNS::RR->new("$owner IN KEY 512 3 $rr_type $ctx->{privkey}");
$update->sign_tsig($keyrr);
}
@@ -1345,10 +1349,6 @@ sub update_namedconf {
$ctx->{tsig_algorithm} = $omapi_settings->{algorithm};
push @newnamed, ddns_key_contents($ctx);
$ctx->{restartneeded} = 1;
} elsif ($algorithmnow && !net_dns_uses_keyfile() && lc($algorithmnow) ne "hmac-md5") {
$ctx->{tsig_algorithm} = "hmac-md5";
push @newnamed, ddns_key_contents($ctx);
$ctx->{restartneeded} = 1;
} else {
push @newnamed, @keyblock;
}