mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-09-21 16:39:30 +00:00
Daniel Hilst
4eb9718548
makedns exits 1 on a management node that has Net::DNS below 1.36 and an hmac-sha256 key, and reports "Failure encountered updating <zone> with entry '', error was FORMERR". update_namedconf in ddns.pm rewrites the named.conf key stanza to hmac-md5 whenever Net::DNS is below 1.36, and ddns_tsig_algorithm returns hmac-md5 for the same reason. ddns_sign_update signs with site.dhcpomapialgorithm, which xcatconfig sets to hmac-sha256 on EL9 and later. named matches a TSIG key by name and by algorithm, so it answers NOTAUTH. The retry signs the same packet a second time, and named answers FORMERR to the two signatures. The version test protected the two-argument sign_tsig($name, $secret), which produces an HMAC-MD5 signature only. ddns_sign_update signs every other algorithm through a KEY RR, so the Net::DNS version no longer selects the algorithm. This change deletes the rewrite and the version test, and signs with the algorithm the key stanza declares. OmapiPolicy->algorithm_rr_type maps that algorithm to its KEY RR number. ddns_named_key_algorithm.t fails before this change: it reads the stanza as hmac-md5 where the key was hmac-sha256. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>