mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-01 15:05:23 +00:00
Code Issues Releases Wiki Activity

nsupdate: use FIPS compatible algorithms

Browse Source 
HMACMD5 is not permitted in FIPS mode, use HMACSHA256 instead.
This commit is contained in:
Mark Andrews
2021-12-20 19:28:36 +11:00
parent bcb3846603
commit ff7e73db6a
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bin/tests/system/nsupdate/setup.sh
View File

@@ -76,7 +76,7 @@ $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
if $FEATURETEST --md5; then if $FEATURETEST --md5; then
$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key $TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
else else
echo -n > ns1/md5.key echo "/* MD5 NOT SUPPORTED */" > ns1/md5.key
fi fi
$TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key
$TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key

4
bin/tests/system/nsupdate/tests.sh
View File

@@ -985,7 +985,7 @@ fi
n=$((n + 1)) n=$((n + 1))
ret=0 ret=0
echo_i "check TSIG key algorithms (nsupdate -y) ($n)" echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
for alg in md5 sha1 sha224 sha256 sha384 sha512; do for alg in $ALGS; do
secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key) secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
$NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1 $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
server 10.53.0.1 ${PORT} server 10.53.0.1 ${PORT}
@@ -994,7 +994,7 @@ send
END END
done done
sleep 2 sleep 2
for alg in md5 sha1 sha224 sha256 sha384 sha512; do for alg in $ALGS; do
$DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1 $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
done done
if [ $ret -ne 0 ]; then if [ $ret -ne 0 ]; then