From 4eb97185487654097afe1390f529ceff9697bfa3 Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:44:57 -0300
Subject: [PATCH] fix(xcat-core): makedns rewrites its own TSIG key and then
 fails against it

makedns exits 1 on a management node that has Net::DNS below 1.36 and an
hmac-sha256 key, and reports "Failure encountered updating <zone> with entry
'', error was FORMERR".

update_namedconf in ddns.pm rewrites the named.conf key stanza to hmac-md5
whenever Net::DNS is below 1.36, and ddns_tsig_algorithm returns hmac-md5 for
the same reason. ddns_sign_update signs with site.dhcpomapialgorithm, which
xcatconfig sets to hmac-sha256 on EL9 and later. named matches a TSIG key by
name and by algorithm, so it answers NOTAUTH. The retry signs the same packet
a second time, and named answers FORMERR to the two signatures.

The version test protected the two-argument sign_tsig($name, $secret), which
produces an HMAC-MD5 signature only. ddns_sign_update signs every other
algorithm through a KEY RR, so the Net::DNS version no longer selects the
algorithm. This change deletes the rewrite and the version test, and signs with
the algorithm the key stanza declares. OmapiPolicy->algorithm_rr_type maps that
algorithm to its KEY RR number.

ddns_named_key_algorithm.t fails before this change: it reads the stanza as
hmac-md5 where the key was hmac-sha256.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 perl-xCAT/xCAT/DHCP/OmapiPolicy.pm   |  7 +++++++
 xCAT-server/lib/xcat/plugins/ddns.pm | 22 +++++++++++-----------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm b/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
index 38c808532..b67d2db22 100644
--- a/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
+++ b/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
@@ -66,6 +66,13 @@ sub normalize_algorithm {
     return;
 }
 
+sub algorithm_rr_type {
+    my ( $class, $algorithm ) = @_;
+
+    $algorithm = $class->normalize_algorithm($algorithm) or return;
+    return $ALGORITHMS{$algorithm};
+}
+
 sub new_install_default_algorithm {
     my ( $class, %args ) = @_;
 
diff --git a/xCAT-server/lib/xcat/plugins/ddns.pm b/xCAT-server/lib/xcat/plugins/ddns.pm
index 5b072464b..99c291d67 100644
--- a/xCAT-server/lib/xcat/plugins/ddns.pm
+++ b/xCAT-server/lib/xcat/plugins/ddns.pm
@@ -37,10 +37,10 @@ sub ddns_tsig_algorithm {
 
     my $settings = $ctx->{omapi_settings} || xCAT::DHCP::OmapiPolicy->settings();
 
-    # Keep old Net::DNS on MD5 unless the administrator explicitly selects a
-    # different OMAPI algorithm. Old Net::DNS can sign non-MD5 updates only
-    # through a KEY RR, which ddns_sign_update builds below.
-    return "hmac-md5" if (!net_dns_uses_keyfile() && !$settings->{algorithm_explicit});
+    # $ctx->{tsig_algorithm} is the algorithm the named.conf key stanza already declares.
+    # The Net::DNS version does not select the algorithm: old Net::DNS signs every algorithm
+    # except MD5 through a KEY RR, which ddns_sign_update builds.
+    return $settings->{algorithm} if $settings->{algorithm_explicit};
     return $ctx->{tsig_algorithm} || $settings->{algorithm};
 }
 
@@ -65,13 +65,17 @@ sub ddns_sign_update {
         return;
     }
 
-    if ($settings->{algorithm} eq 'hmac-md5') {
+    # named matches the key by name and by algorithm. Sign with the algorithm the key stanza
+    # declares, not with the OMAPI default.
+    my $algorithm = ddns_tsig_algorithm($ctx);
+    if ($algorithm eq 'hmac-md5') {
         $update->sign_tsig($settings->{key_name}, $ctx->{privkey});
         return;
     }
 
-    my $owner = xCAT::DHCP::OmapiPolicy->key_owner($settings);
-    my $keyrr = Net::DNS::RR->new("$owner IN KEY 512 3 $settings->{key_rr_type} $ctx->{privkey}");
+    my $owner   = xCAT::DHCP::OmapiPolicy->key_owner($settings);
+    my $rr_type = xCAT::DHCP::OmapiPolicy->algorithm_rr_type($algorithm);
+    my $keyrr   = Net::DNS::RR->new("$owner IN KEY 512 3 $rr_type $ctx->{privkey}");
     $update->sign_tsig($keyrr);
 }
 
@@ -1345,10 +1349,6 @@ sub update_namedconf {
                         $ctx->{tsig_algorithm} = $omapi_settings->{algorithm};
                         push @newnamed, ddns_key_contents($ctx);
                         $ctx->{restartneeded} = 1;
-                    } elsif ($algorithmnow && !net_dns_uses_keyfile() && lc($algorithmnow) ne "hmac-md5") {
-                        $ctx->{tsig_algorithm} = "hmac-md5";
-                        push @newnamed, ddns_key_contents($ctx);
-                        $ctx->{restartneeded} = 1;
                     } else {
                         push @newnamed, @keyblock;
                     }