xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-08-03 07:57:00 +00:00
Code Issues Releases Wiki Activity

fix(xcat-core): default DNS TSIG to hmac-sha256 on new EL9+/Ubuntu installs (backport #7597)

Browse Source 
xCAT 2.18 defaults the DNS/DHCP OMAPI TSIG key to hmac-md5. On EL9/EL10 the newer
bind/Net::DNS reject md5-signed dynamic updates (TSIG BADSIG), so makedns fails
(FORMERR) and node DNS setup / install cases fail on a DEFAULT install, needing a
manual 'chdef -t site dhcpomapialgorithm=hmac-sha256' workaround.

Backport xcat2/xcat-core#7597: xcatconfig initDB detects a fresh install and, via
OmapiPolicy::new_install_default_algorithm, seeds site.dhcpomapialgorithm=hmac-sha256
for EL9+/Ubuntu 20.04+ (EL8/older keep hmac-md5, which works there). Existing sites
are untouched. Default installs on EL9/EL10 now work with no intervention.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This commit is contained in:
Daniel Hilst
2026-07-29 15:04:04 -03:00
parent 2e3eef2867
commit 27ec50528f
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
+18
View File
@@ -64,6 +64,24 @@ sub normalize_algorithm {
return;
}
sub new_install_default_algorithm {
my ( $class, %args ) = @_;
my $platform = $args{platform};
my $os = $args{os};
return unless $args{is_new_install};
return 'hmac-sha256'
if defined($platform) && $platform =~ /^el(\d+)\b/i && $1 >= 9;
if ( defined($os) && $os =~ /^ubuntu,(\d+\.\d+(?:\.\d+)*)\b/i ) {
my $ubuntu_version = $1;
require xCAT::Utils;
return 'hmac-sha256'
if xCAT::Utils->version_cmp( $ubuntu_version, '20.04' ) >= 0;
}
return;
}
sub normalize_key_name {
my ( $class, $key_name ) = @_;
xCAT-server/sbin/xcatconfig
+18
View File
@@ -25,6 +25,7 @@ use strict;
use xCAT::Utils;
use xCAT::SvrUtils;
use xCAT::DHCP::Backend;
use xCAT::DHCP::OmapiPolicy;
use xCAT::TLSPolicy qw(tls_setting_warnings);
use xCAT::NetworkUtils;
use Getopt::Long;
@@ -134,6 +135,13 @@ else
$::osname = 'Linux';
}
# Record whether this invocation is creating a new site before database setup
# runs. Reinitializing an existing site must preserve its key algorithm.
my $initializing_new_site =
$::INITIALINSTALL
&& !-r "/etc/xcat/site.sqlite"
&& !-r "/etc/xcat/cfgloc";
# if on rhel6, check to see if perl-IO-Compress-Zlib* is installed
if (($::INITIALINSTALL) || ($::UPDATEINSTALL))
{
@@ -1253,6 +1261,16 @@ sub initDB
$chtabcmds .= "$::XCATROOT/sbin/chtab key=vsftp site.value=n;";
$chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupxcatpost site.value=no;";
$chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupdiskfullxcatpost site.value=no;";
my $omapi_algorithm =
xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
is_new_install => $initializing_new_site,
platform => xCAT::Utils->osver("platform"),
os => xCAT::Utils->osver("all"),
);
if ($omapi_algorithm) {
$chtabcmds .=
"$::XCATROOT/sbin/chtab key=dhcpomapialgorithm site.value=$omapi_algorithm;";
}
$chtabcmds .= "$::XCATROOT/sbin/chtab key=dhcplease site.value=43200;";
$chtabcmds .= "$::XCATROOT/sbin/chtab key=auditnosyslog site.value=0;";
$chtabcmds .= "$::XCATROOT/sbin/chtab key=xcatsslversion site.value=;";