From 27ec50528fbd9c380e7ca3c6e5aa86f9d4a9ccc1 Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:04:04 -0300
Subject: [PATCH] fix(xcat-core): default DNS TSIG to hmac-sha256 on new
 EL9+/Ubuntu installs (backport #7597)

xCAT 2.18 defaults the DNS/DHCP OMAPI TSIG key to hmac-md5. On EL9/EL10 the newer
bind/Net::DNS reject md5-signed dynamic updates (TSIG BADSIG), so makedns fails
(FORMERR) and node DNS setup / install cases fail on a DEFAULT install, needing a
manual 'chdef -t site dhcpomapialgorithm=hmac-sha256' workaround.

Backport xcat2/xcat-core#7597: xcatconfig initDB detects a fresh install and, via
OmapiPolicy::new_install_default_algorithm, seeds site.dhcpomapialgorithm=hmac-sha256
for EL9+/Ubuntu 20.04+ (EL8/older keep hmac-md5, which works there). Existing sites
are untouched. Default installs on EL9/EL10 now work with no intervention.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 perl-xCAT/xCAT/DHCP/OmapiPolicy.pm | 18 ++++++++++++++++++
 xCAT-server/sbin/xcatconfig        | 18 ++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm b/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
index 36b2b6d77..a3621a3ce 100644
--- a/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
+++ b/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm
@@ -64,6 +64,24 @@ sub normalize_algorithm {
     return;
 }
 
+sub new_install_default_algorithm {
+    my ( $class, %args ) = @_;
+
+    my $platform = $args{platform};
+    my $os       = $args{os};
+
+    return unless $args{is_new_install};
+    return 'hmac-sha256'
+      if defined($platform) && $platform =~ /^el(\d+)\b/i && $1 >= 9;
+    if ( defined($os) && $os =~ /^ubuntu,(\d+\.\d+(?:\.\d+)*)\b/i ) {
+        my $ubuntu_version = $1;
+        require xCAT::Utils;
+        return 'hmac-sha256'
+          if xCAT::Utils->version_cmp( $ubuntu_version, '20.04' ) >= 0;
+    }
+    return;
+}
+
 sub normalize_key_name {
     my ( $class, $key_name ) = @_;
 
diff --git a/xCAT-server/sbin/xcatconfig b/xCAT-server/sbin/xcatconfig
index 7eec28355..829116d93 100755
--- a/xCAT-server/sbin/xcatconfig
+++ b/xCAT-server/sbin/xcatconfig
@@ -25,6 +25,7 @@ use strict;
 use xCAT::Utils;
 use xCAT::SvrUtils;
 use xCAT::DHCP::Backend;
+use xCAT::DHCP::OmapiPolicy;
 use xCAT::TLSPolicy qw(tls_setting_warnings);
 use xCAT::NetworkUtils;
 use Getopt::Long;
@@ -134,6 +135,13 @@ else
     $::osname = 'Linux';
 }
 
+# Record whether this invocation is creating a new site before database setup
+# runs.  Reinitializing an existing site must preserve its key algorithm.
+my $initializing_new_site =
+  $::INITIALINSTALL
+  && !-r "/etc/xcat/site.sqlite"
+  && !-r "/etc/xcat/cfgloc";
+
 # if on rhel6, check to see if perl-IO-Compress-Zlib* is installed
 if (($::INITIALINSTALL) || ($::UPDATEINSTALL))
 {
@@ -1253,6 +1261,16 @@ sub initDB
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=vsftp site.value=n;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupxcatpost site.value=no;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupdiskfullxcatpost site.value=no;";
+        my $omapi_algorithm =
+          xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+            is_new_install => $initializing_new_site,
+            platform      => xCAT::Utils->osver("platform"),
+            os            => xCAT::Utils->osver("all"),
+          );
+        if ($omapi_algorithm) {
+            $chtabcmds .=
+              "$::XCATROOT/sbin/chtab key=dhcpomapialgorithm site.value=$omapi_algorithm;";
+        }
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=dhcplease site.value=43200;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=auditnosyslog site.value=0;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=xcatsslversion site.value=;";