diff --git a/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst b/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst index 7a05b8dc3..1d5f26b8f 100644 --- a/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst +++ b/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst @@ -93,7 +93,7 @@ Edit **/etc/resolv.conf** to contain the cluster domain value you set in the sit Legacy ISC DHCP and BIND TSIG Key Options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04 leaves **dhcpomapialgorithm** unset because its bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm. +xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15 leave **dhcpomapialgorithm** unset because their bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm. To use another supported algorithm, set **dhcpomapialgorithm** in the site table and update the matching **passwd** table secret. Supported values are **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, and **hmac-sha512**. For example: :: diff --git a/docs/source/guides/admin-guides/references/man5/site.5.rst b/docs/source/guides/admin-guides/references/man5/site.5.rst index 1737e4ed8..69b3be415 100644 --- a/docs/source/guides/admin-guides/references/man5/site.5.rst +++ b/docs/source/guides/admin-guides/references/man5/site.5.rst @@ -97,10 +97,11 @@ site Attributes: hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set hmac-sha256. - Ubuntu 18.04 leaves this attribute unset because its - bundled omshell does not support the key-algorithm - command. When this attribute is not set, including on - an existing installation, xCAT uses hmac-md5 for + Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15 + leave this attribute unset because their bundled + omshell does not support the key-algorithm command. + When this attribute is not set, including on an + existing installation, xCAT uses hmac-md5 for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm. diff --git a/perl-xCAT/xCAT/Schema.pm b/perl-xCAT/xCAT/Schema.pm index ec8ea6aa4..b8481038b 100644 --- a/perl-xCAT/xCAT/Schema.pm +++ b/perl-xCAT/xCAT/Schema.pm @@ -1047,10 +1047,11 @@ passed as argument rather than by table value', " hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,\n" . " and hmac-sha512. New installations on Enterprise Linux\n" . " 9 or later and Ubuntu 20.04 or later set hmac-sha256.\n" . -" Ubuntu 18.04 leaves this attribute unset because its\n" . -" bundled omshell does not support the key-algorithm\n" . -" command. When this attribute is not set, including on\n" . -" an existing installation, xCAT uses hmac-md5 for\n" . +" Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15\n" . +" leave this attribute unset because their bundled\n" . +" omshell does not support the key-algorithm command.\n" . +" When this attribute is not set, including on an\n" . +" existing installation, xCAT uses hmac-md5 for\n" . " compatibility. Kea does not use OMAPI, but Kea DDNS\n" . " uses this TSIG algorithm.\n\n" . " dhcpomapikeyname: The TSIG/OMAPI key name used by legacy ISC DHCP and\n" . diff --git a/xCAT-test/unit/dhcp_backend_selection.t b/xCAT-test/unit/dhcp_backend_selection.t index 8363a851d..544d0cf76 100644 --- a/xCAT-test/unit/dhcp_backend_selection.t +++ b/xCAT-test/unit/dhcp_backend_selection.t @@ -91,6 +91,39 @@ is( 'Ubuntu LTS releases newer than 24.04 default to Kea' ); +is( + xCAT::DHCP::Backend->default_backend( + platform => '', + os => 'sles12', + os_name => 'sles', + version => 12 + ), + 'isc', + 'SLES 12 defaults to ISC' +); + +is( + xCAT::DHCP::Backend->default_backend( + platform => '', + os => 'sles15', + os_name => 'sles', + version => 15 + ), + 'isc', + 'SLES 15 defaults to ISC' +); + +is( + xCAT::DHCP::Backend->default_backend( + platform => '', + os => 'opensuse-leap15', + os_name => 'opensuse-leap', + version => 15 + ), + 'isc', + 'openSUSE Leap 15 defaults to ISC' +); + is( xCAT::DHCP::Backend->choose( requested => 'isc', os => 'rhel10', platform => 'el10' )->{name}, 'isc', diff --git a/xCAT-test/unit/dhcp_omapi_policy.t b/xCAT-test/unit/dhcp_omapi_policy.t index d7746db47..4bb5462c6 100644 --- a/xCAT-test/unit/dhcp_omapi_policy.t +++ b/xCAT-test/unit/dhcp_omapi_policy.t @@ -118,6 +118,39 @@ is( 'existing Ubuntu installations retain their key algorithm choice' ); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'sles,12.5' + ), + undef, + 'new SLES 12 installations retain the implicit MD5 default' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'sles,15.6' + ), + undef, + 'new SLES 15 installations retain the implicit MD5 default' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'opensuse-leap,15.6' + ), + undef, + 'new openSUSE Leap 15 installations retain the implicit MD5 default' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 0, + os => 'sles,15.6' + ), + undef, + 'existing SLES installations retain their key algorithm choice' +); + my $explicit_md5 = xCAT::DHCP::OmapiPolicy->settings( site_values => { dhcpomapialgorithm => 'hmac-md5' } );