feat(dhcp): default new Ubuntu sites to HMAC-SHA256

Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>

docs/source/advanced/domain_name_resolution/domain_name_resolution.rst

@@ -93,7 +93,7 @@ Edit **/etc/resolv.conf** to contain the cluster domain value you set in the sit
 Legacy ISC DHCP and BIND TSIG Key Options
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New Enterprise Linux 9 or later installations set **hmac-sha256**. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
+xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04 leaves **dhcpomapialgorithm** unset because its bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
 
 To use another supported algorithm, set **dhcpomapialgorithm** in the site table and update the matching **passwd** table secret. Supported values are **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, and **hmac-sha512**. For example: ::
 

docs/source/guides/admin-guides/references/man5/site.5.rst

@@ -95,11 +95,14 @@ site Attributes:
    dhcpomapialgorithm:  The TSIG algorithm used by BIND DDNS and, for legacy
                         ISC DHCP, OMAPI. Valid values are hmac-md5,
                         hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
-                        and hmac-sha512. New Enterprise Linux 9 or later
-                        installations set hmac-sha256. When this attribute is
-                        not set, including on an existing installation, xCAT
-                        uses hmac-md5 for compatibility. Kea does not use
-                        OMAPI, but Kea DDNS uses this TSIG algorithm.
+                        and hmac-sha512. New installations on Enterprise Linux
+                        9 or later and Ubuntu 20.04 or later set hmac-sha256.
+                        Ubuntu 18.04 leaves this attribute unset because its
+                        bundled omshell does not support the key-algorithm
+                        command. When this attribute is not set, including on
+                        an existing installation, xCAT uses hmac-md5 for
+                        compatibility. Kea does not use OMAPI, but Kea DDNS
+                        uses this TSIG algorithm.
 
    dhcpomapikeyname:  The TSIG/OMAPI key name used by legacy ISC DHCP and
                      BIND DDNS integration. The default is xcat_key. The

perl-xCAT/xCAT/DHCP/OmapiPolicy.pm

@@ -68,10 +68,15 @@ sub new_install_default_algorithm {
     my ( $class, %args ) = @_;
 
     my $platform = $args{platform};
+    my $os       = $args{os};
 
     return unless $args{is_new_install};
     return 'hmac-sha256'
       if defined($platform) && $platform =~ /^el(\d+)\b/i && $1 >= 9;
+    return 'hmac-sha256'
+      if defined($os)
+      && $os =~ /^ubuntu,(\d+\.\d+(?:\.\d+)*)\b/i
+      && _version_at_least( $1, '20.04' );
     return;
 }
 
@@ -120,6 +125,23 @@ sub omshell_preamble {
     return $commands;
 }
 
+sub _version_at_least {
+    my ( $version, $minimum ) = @_;
+
+    my @version_parts = split /\./, $version;
+    my @minimum_parts = split /\./, $minimum;
+    my $max = @version_parts > @minimum_parts ? @version_parts : @minimum_parts;
+
+    for my $idx ( 0 .. $max - 1 ) {
+        my $left  = $version_parts[$idx] || 0;
+        my $right = $minimum_parts[$idx] || 0;
+        return 1 if $left > $right;
+        return 0 if $left < $right;
+    }
+
+    return 1;
+}
+
 sub _site_value {
     my ( $key, %args ) = @_;
 

perl-xCAT/xCAT/Schema.pm

@@ -1045,11 +1045,14 @@ passed as argument rather than by table value',
 " dhcpomapialgorithm:  The TSIG algorithm used by BIND DDNS and, for legacy\n" .
 "                      ISC DHCP, OMAPI. Valid values are hmac-md5,\n" .
 "                      hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,\n" .
-"                      and hmac-sha512. New Enterprise Linux 9 or later\n" .
-"                      installations set hmac-sha256. When this attribute is\n" .
-"                      not set, including on an existing installation, xCAT\n" .
-"                      uses hmac-md5 for compatibility. Kea does not use\n" .
-"                      OMAPI, but Kea DDNS uses this TSIG algorithm.\n\n" .
+"                      and hmac-sha512. New installations on Enterprise Linux\n" .
+"                      9 or later and Ubuntu 20.04 or later set hmac-sha256.\n" .
+"                      Ubuntu 18.04 leaves this attribute unset because its\n" .
+"                      bundled omshell does not support the key-algorithm\n" .
+"                      command. When this attribute is not set, including on\n" .
+"                      an existing installation, xCAT uses hmac-md5 for\n" .
+"                      compatibility. Kea does not use OMAPI, but Kea DDNS\n" .
+"                      uses this TSIG algorithm.\n\n" .
 " dhcpomapikeyname:  The TSIG/OMAPI key name used by legacy ISC DHCP and\n" .
 "                   BIND DDNS integration. The default is xcat_key. The\n" .
 "                   value maps to the passwd table entry where key=omapi\n" .

xCAT-server/sbin/xcatconfig

@@ -1265,6 +1265,7 @@ sub initDB
           xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
             is_new_install => $initializing_new_site,
             platform      => xCAT::Utils->osver("platform"),
+            os            => xCAT::Utils->osver("all"),
           );
         if ($omapi_algorithm) {
             $chtabcmds .=

xCAT-test/unit/dhcp_omapi_policy.t

@@ -61,6 +61,63 @@ is(
     'existing EL9 installations retain their key algorithm choice'
 );
 
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        os             => 'ubuntu,18.04'
+    ),
+    undef,
+    'new Ubuntu 18.04 installations retain the implicit MD5 default'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        os             => 'ubuntu,20.04'
+    ),
+    'hmac-sha256',
+    'new Ubuntu 20.04 installations default to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        os             => 'ubuntu,20.04.6'
+    ),
+    'hmac-sha256',
+    'Ubuntu 20.04 point releases default to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        os             => 'ubuntu,22.04'
+    ),
+    'hmac-sha256',
+    'new Ubuntu 22.04 installations default to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        os             => 'ubuntu,24.04'
+    ),
+    'hmac-sha256',
+    'new Ubuntu 24.04 installations default to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 1,
+        os             => 'ubuntu,26.04'
+    ),
+    'hmac-sha256',
+    'newer Ubuntu installations default to hmac-sha256'
+);
+is(
+    xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
+        is_new_install => 0,
+        os             => 'ubuntu,24.04'
+    ),
+    undef,
+    'existing Ubuntu installations retain their key algorithm choice'
+);
+
 my $explicit_md5 = xCAT::DHCP::OmapiPolicy->settings(
     site_values => { dhcpomapialgorithm => 'hmac-md5' }
 );