feat(dhcp): default new EL sites to HMAC-SHA256

Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>

docs/source/advanced/domain_name_resolution/domain_name_resolution.rst

@@ -93,7 +93,7 @@ Edit **/etc/resolv.conf** to contain the cluster domain value you set in the sit
 Legacy ISC DHCP and BIND TSIG Key Options
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-xCAT uses **xcat_key** with **hmac-md5** by default for legacy ISC DHCP OMAPI and BIND DDNS updates. Existing installations should keep that default unless a site policy or external DNS provider requires a different key.
+xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New Enterprise Linux 9 or later installations set **hmac-sha256**. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
 
 To use another supported algorithm, set **dhcpomapialgorithm** in the site table and update the matching **passwd** table secret. Supported values are **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, and **hmac-sha512**. For example: ::
 

docs/source/guides/admin-guides/references/man5/site.5.rst

@@ -92,11 +92,14 @@ site Attributes:
    -------------
   DHCP ATTRIBUTES
    -------------
-   dhcpomapialgorithm:  The TSIG/OMAPI algorithm used by legacy ISC DHCP and
-                        BIND DDNS integration. Valid values are hmac-md5,
+   dhcpomapialgorithm:  The TSIG algorithm used by BIND DDNS and, for legacy
+                        ISC DHCP, OMAPI. Valid values are hmac-md5,
                         hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
-                        and hmac-sha512. The default is hmac-md5 for
-                        compatibility with existing ISC DHCP installations.
+                        and hmac-sha512. New Enterprise Linux 9 or later
+                        installations set hmac-sha256. When this attribute is
+                        not set, including on an existing installation, xCAT
+                        uses hmac-md5 for compatibility. Kea does not use
+                        OMAPI, but Kea DDNS uses this TSIG algorithm.
 
    dhcpomapikeyname:  The TSIG/OMAPI key name used by legacy ISC DHCP and
                      BIND DDNS integration. The default is xcat_key. The

perl-xCAT/xCAT/DHCP/OmapiPolicy.pm

@@ -64,6 +64,17 @@ sub normalize_algorithm {
     return;
 }
 
+sub new_install_default_algorithm {
+    my ( $class, %args ) = @_;
+
+    my $platform = $args{platform};
+
+    return unless $args{is_new_install};
+    return 'hmac-sha256'
+      if defined($platform) && $platform =~ /^el(\d+)\b/i && $1 >= 9;
+    return;
+}
+
 sub normalize_key_name {
     my ( $class, $key_name ) = @_;
 

perl-xCAT/xCAT/Schema.pm

@@ -1042,11 +1042,14 @@ passed as argument rather than by table value',
 "                  reservations use JSON render and reload unless Control\n" .
 "                  Agent operations are explicitly enabled and the Kea\n" .
 "                  host-commands hook is installed.\n\n" .
-" dhcpomapialgorithm:  The TSIG/OMAPI algorithm used by legacy ISC DHCP and\n" .
-"                      BIND DDNS integration. Valid values are hmac-md5,\n" .
+" dhcpomapialgorithm:  The TSIG algorithm used by BIND DDNS and, for legacy\n" .
+"                      ISC DHCP, OMAPI. Valid values are hmac-md5,\n" .
 "                      hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,\n" .
-"                      and hmac-sha512. The default is hmac-md5 for\n" .
-"                      compatibility with existing ISC DHCP installations.\n\n" .
+"                      and hmac-sha512. New Enterprise Linux 9 or later\n" .
+"                      installations set hmac-sha256. When this attribute is\n" .
+"                      not set, including on an existing installation, xCAT\n" .
+"                      uses hmac-md5 for compatibility. Kea does not use\n" .
+"                      OMAPI, but Kea DDNS uses this TSIG algorithm.\n\n" .
 " dhcpomapikeyname:  The TSIG/OMAPI key name used by legacy ISC DHCP and\n" .
 "                   BIND DDNS integration. The default is xcat_key. The\n" .
 "                   value maps to the passwd table entry where key=omapi\n" .

xCAT-server/sbin/xcatconfig

@@ -25,6 +25,7 @@ use strict;
 use xCAT::Utils;
 use xCAT::SvrUtils;
 use xCAT::DHCP::Backend;
+use xCAT::DHCP::OmapiPolicy;
 use xCAT::TLSPolicy qw(tls_setting_warnings);
 use xCAT::NetworkUtils;
 use Getopt::Long;
@@ -134,6 +135,13 @@ else
     $::osname = 'Linux';
 }
 
+# Record whether this invocation is creating a new site before database setup
+# runs.  Reinitializing an existing site must preserve its key algorithm.
+my $initializing_new_site =
+  $::INITIALINSTALL
+  && !-r "/etc/xcat/site.sqlite"
+  && !-r "/etc/xcat/cfgloc";
+
 # if on rhel6, check to see if perl-IO-Compress-Zlib* is installed
 if (($::INITIALINSTALL) || ($::UPDATEINSTALL))
 {
@@ -1253,6 +1261,15 @@ sub initDB
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=vsftp site.value=n;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupxcatpost site.value=no;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupdiskfullxcatpost site.value=no;";
+        my $omapi_algorithm =
+          xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+            is_new_install => $initializing_new_site,
+            platform      => xCAT::Utils->osver("platform"),
+          );
+        if ($omapi_algorithm) {
+            $chtabcmds .=
+              "$::XCATROOT/sbin/chtab key=dhcpomapialgorithm site.value=$omapi_algorithm;";
+        }
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=dhcplease site.value=43200;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=auditnosyslog site.value=0;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=xcatsslversion site.value=;";

xCAT-test/unit/dhcp_omapi_policy.t

@@ -28,6 +28,49 @@ is(
     'default omshell preamble keeps legacy key command without key-algorithm'
 );
 
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        platform       => 'el9'
+    ),
+    'hmac-sha256',
+    'new EL9 installations default to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        platform       => 'el8'
+    ),
+    undef,
+    'new EL8 installations retain the implicit MD5 default'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        platform       => 'el10'
+    ),
+    'hmac-sha256',
+    'new EL10 installations default DDNS TSIG to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 0,
+        platform       => 'el9'
+    ),
+    undef,
+    'existing EL9 installations retain their key algorithm choice'
+);
+
+my $explicit_md5 = xCAT::DHCP::OmapiPolicy->settings(
+    site_values => { dhcpomapialgorithm => 'hmac-md5' }
+);
+is( $explicit_md5->{algorithm}, 'hmac-md5',
+    'an explicit hmac-md5 setting remains supported' );
+ok( $explicit_md5->{algorithm_explicit},
+    'an explicit hmac-md5 setting remains marked as explicit' );
+ok( !$explicit_md5->{needs_omshell_key_algorithm},
+    'explicit MD5 keeps the legacy omshell command format' );
+
 my $sha512 = xCAT::DHCP::OmapiPolicy->settings(
     site_values => {
         dhcpomapialgorithm => ' HMAC-SHA512 ',