From 6e4cffddc3eb38a957c2aeb5c8e3dd937ace0ab4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?= <2031761+viniciusferrao@users.noreply.github.com> Date: Thu, 16 Jul 2026 17:19:19 -0300 Subject: [PATCH] feat(dhcp): default new Ubuntu sites to HMAC-SHA256 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com> --- .../domain_name_resolution.rst | 2 +- .../admin-guides/references/man5/site.5.rst | 13 +++-- perl-xCAT/xCAT/DHCP/OmapiPolicy.pm | 22 +++++++ perl-xCAT/xCAT/Schema.pm | 13 +++-- xCAT-server/sbin/xcatconfig | 1 + xCAT-test/unit/dhcp_omapi_policy.t | 57 +++++++++++++++++++ 6 files changed, 97 insertions(+), 11 deletions(-) diff --git a/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst b/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst index ac760054a..7a05b8dc3 100644 --- a/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst +++ b/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst @@ -93,7 +93,7 @@ Edit **/etc/resolv.conf** to contain the cluster domain value you set in the sit Legacy ISC DHCP and BIND TSIG Key Options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New Enterprise Linux 9 or later installations set **hmac-sha256**. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm. +xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04 leaves **dhcpomapialgorithm** unset because its bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm. To use another supported algorithm, set **dhcpomapialgorithm** in the site table and update the matching **passwd** table secret. Supported values are **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, and **hmac-sha512**. For example: :: diff --git a/docs/source/guides/admin-guides/references/man5/site.5.rst b/docs/source/guides/admin-guides/references/man5/site.5.rst index b92f0e798..1737e4ed8 100644 --- a/docs/source/guides/admin-guides/references/man5/site.5.rst +++ b/docs/source/guides/admin-guides/references/man5/site.5.rst @@ -95,11 +95,14 @@ site Attributes: dhcpomapialgorithm: The TSIG algorithm used by BIND DDNS and, for legacy ISC DHCP, OMAPI. Valid values are hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, - and hmac-sha512. New Enterprise Linux 9 or later - installations set hmac-sha256. When this attribute is - not set, including on an existing installation, xCAT - uses hmac-md5 for compatibility. Kea does not use - OMAPI, but Kea DDNS uses this TSIG algorithm. + and hmac-sha512. New installations on Enterprise Linux + 9 or later and Ubuntu 20.04 or later set hmac-sha256. + Ubuntu 18.04 leaves this attribute unset because its + bundled omshell does not support the key-algorithm + command. When this attribute is not set, including on + an existing installation, xCAT uses hmac-md5 for + compatibility. Kea does not use OMAPI, but Kea DDNS + uses this TSIG algorithm. dhcpomapikeyname: The TSIG/OMAPI key name used by legacy ISC DHCP and BIND DDNS integration. The default is xcat_key. The diff --git a/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm b/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm index e0597e582..23ade1271 100644 --- a/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm +++ b/perl-xCAT/xCAT/DHCP/OmapiPolicy.pm @@ -68,10 +68,15 @@ sub new_install_default_algorithm { my ( $class, %args ) = @_; my $platform = $args{platform}; + my $os = $args{os}; return unless $args{is_new_install}; return 'hmac-sha256' if defined($platform) && $platform =~ /^el(\d+)\b/i && $1 >= 9; + return 'hmac-sha256' + if defined($os) + && $os =~ /^ubuntu,(\d+\.\d+(?:\.\d+)*)\b/i + && _version_at_least( $1, '20.04' ); return; } @@ -120,6 +125,23 @@ sub omshell_preamble { return $commands; } +sub _version_at_least { + my ( $version, $minimum ) = @_; + + my @version_parts = split /\./, $version; + my @minimum_parts = split /\./, $minimum; + my $max = @version_parts > @minimum_parts ? @version_parts : @minimum_parts; + + for my $idx ( 0 .. $max - 1 ) { + my $left = $version_parts[$idx] || 0; + my $right = $minimum_parts[$idx] || 0; + return 1 if $left > $right; + return 0 if $left < $right; + } + + return 1; +} + sub _site_value { my ( $key, %args ) = @_; diff --git a/perl-xCAT/xCAT/Schema.pm b/perl-xCAT/xCAT/Schema.pm index f86245b84..ec8ea6aa4 100644 --- a/perl-xCAT/xCAT/Schema.pm +++ b/perl-xCAT/xCAT/Schema.pm @@ -1045,11 +1045,14 @@ passed as argument rather than by table value', " dhcpomapialgorithm: The TSIG algorithm used by BIND DDNS and, for legacy\n" . " ISC DHCP, OMAPI. Valid values are hmac-md5,\n" . " hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,\n" . -" and hmac-sha512. New Enterprise Linux 9 or later\n" . -" installations set hmac-sha256. When this attribute is\n" . -" not set, including on an existing installation, xCAT\n" . -" uses hmac-md5 for compatibility. Kea does not use\n" . -" OMAPI, but Kea DDNS uses this TSIG algorithm.\n\n" . +" and hmac-sha512. New installations on Enterprise Linux\n" . +" 9 or later and Ubuntu 20.04 or later set hmac-sha256.\n" . +" Ubuntu 18.04 leaves this attribute unset because its\n" . +" bundled omshell does not support the key-algorithm\n" . +" command. When this attribute is not set, including on\n" . +" an existing installation, xCAT uses hmac-md5 for\n" . +" compatibility. Kea does not use OMAPI, but Kea DDNS\n" . +" uses this TSIG algorithm.\n\n" . " dhcpomapikeyname: The TSIG/OMAPI key name used by legacy ISC DHCP and\n" . " BIND DDNS integration. The default is xcat_key. The\n" . " value maps to the passwd table entry where key=omapi\n" . diff --git a/xCAT-server/sbin/xcatconfig b/xCAT-server/sbin/xcatconfig index 7808434cf..829116d93 100755 --- a/xCAT-server/sbin/xcatconfig +++ b/xCAT-server/sbin/xcatconfig @@ -1265,6 +1265,7 @@ sub initDB xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( is_new_install => $initializing_new_site, platform => xCAT::Utils->osver("platform"), + os => xCAT::Utils->osver("all"), ); if ($omapi_algorithm) { $chtabcmds .= diff --git a/xCAT-test/unit/dhcp_omapi_policy.t b/xCAT-test/unit/dhcp_omapi_policy.t index 40d966bf4..d7746db47 100644 --- a/xCAT-test/unit/dhcp_omapi_policy.t +++ b/xCAT-test/unit/dhcp_omapi_policy.t @@ -61,6 +61,63 @@ is( 'existing EL9 installations retain their key algorithm choice' ); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'ubuntu,18.04' + ), + undef, + 'new Ubuntu 18.04 installations retain the implicit MD5 default' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'ubuntu,20.04' + ), + 'hmac-sha256', + 'new Ubuntu 20.04 installations default to hmac-sha256' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'ubuntu,20.04.6' + ), + 'hmac-sha256', + 'Ubuntu 20.04 point releases default to hmac-sha256' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'ubuntu,22.04' + ), + 'hmac-sha256', + 'new Ubuntu 22.04 installations default to hmac-sha256' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'ubuntu,24.04' + ), + 'hmac-sha256', + 'new Ubuntu 24.04 installations default to hmac-sha256' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 1, + os => 'ubuntu,26.04' + ), + 'hmac-sha256', + 'newer Ubuntu installations default to hmac-sha256' +); +is( + xCAT::DHCP::OmapiPolicy->new_install_default_algorithm( + is_new_install => 0, + os => 'ubuntu,24.04' + ), + undef, + 'existing Ubuntu installations retain their key algorithm choice' +); + my $explicit_md5 = xCAT::DHCP::OmapiPolicy->settings( site_values => { dhcpomapialgorithm => 'hmac-md5' } );