|
 |
b40bc8c |
From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
|
|
|
b40bc8c |
From: Petr Mensik <pemensik@redhat.com>
|
|
|
b40bc8c |
Date: Mon, 5 Aug 2019 11:54:03 +0200
|
|
|
b40bc8c |
Subject: [PATCH] Allow explicit disabling of autodisabled MD5
|
|
|
b40bc8c |
|
|
|
b40bc8c |
Default security policy might include explicitly disabled RSAMD5
|
|
|
b40bc8c |
algorithm. Current FIPS code automatically disables in FIPS mode. But if
|
|
|
b40bc8c |
RSAMD5 is included in security policy, it fails to start, because that
|
|
|
b40bc8c |
algorithm is not recognized. Allow it disabled, but fail on any
|
|
|
b40bc8c |
other usage.
|
|
|
b40bc8c |
---
|
|
|
b40bc8c |
bin/named/server.c | 2 +-
|
|
|
b40bc8c |
lib/dns/rcode.c | 31 +++++++++++++------------------
|
|
|
b40bc8c |
2 files changed, 14 insertions(+), 19 deletions(-)
|
|
|
b40bc8c |
|
|
|
b40bc8c |
diff --git a/bin/named/server.c b/bin/named/server.c
|
|
|
b40bc8c |
index 3cd49a9..ef82d89 100644
|
|
|
b40bc8c |
--- a/bin/named/server.c
|
|
|
b40bc8c |
+++ b/bin/named/server.c
|
|
|
b40bc8c |
@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
|
|
b40bc8c |
result = isc_parse_uint8(&ui, r.base, 10);
|
|
|
b40bc8c |
alg = ui;
|
|
|
b40bc8c |
}
|
|
|
b40bc8c |
- if (result != ISC_R_SUCCESS) {
|
|
|
b40bc8c |
+ if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
|
|
|
b40bc8c |
cfg_obj_log(cfg_listelt_value(element),
|
|
|
b40bc8c |
ns_g_lctx, ISC_LOG_ERROR,
|
|
|
b40bc8c |
"invalid algorithm");
|
|
|
b40bc8c |
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
|
|
|
b40bc8c |
index f51d548..8dbb12d 100644
|
|
|
b40bc8c |
--- a/lib/dns/rcode.c
|
|
|
b40bc8c |
+++ b/lib/dns/rcode.c
|
|
|
b40bc8c |
@@ -126,7 +126,6 @@
|
|
|
b40bc8c |
#endif
|
|
|
b40bc8c |
|
|
|
b40bc8c |
#define SECALGNAMES \
|
|
|
b40bc8c |
- MD5_SECALGNAMES \
|
|
|
b40bc8c |
DH_SECALGNAMES \
|
|
|
b40bc8c |
DSA_SECALGNAMES \
|
|
|
b40bc8c |
{ DNS_KEYALG_ECC, "ECC", 0 }, \
|
|
|
b40bc8c |
@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
|
|
|
b40bc8c |
static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
|
|
|
b40bc8c |
static struct tbl certs[] = { CERTNAMES };
|
|
|
b40bc8c |
static struct tbl secalgs[] = { SECALGNAMES };
|
|
|
b40bc8c |
+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
|
|
|
b40bc8c |
static struct tbl secprotos[] = { SECPROTONAMES };
|
|
|
b40bc8c |
static struct tbl hashalgs[] = { HASHALGNAMES };
|
|
|
b40bc8c |
static struct tbl dsdigests[] = { DSDIGESTNAMES };
|
|
|
b40bc8c |
@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
|
|
|
b40bc8c |
return (dns_mnemonic_totext(cert, target, certs));
|
|
|
b40bc8c |
}
|
|
|
b40bc8c |
|
|
|
b40bc8c |
-static inline struct tbl *
|
|
|
b40bc8c |
-secalgs_tbl_start() {
|
|
|
b40bc8c |
- struct tbl *algs = secalgs;
|
|
|
b40bc8c |
-
|
|
|
b40bc8c |
-#ifndef PK11_MD5_DISABLE
|
|
|
b40bc8c |
- if (!isc_md5_available()) {
|
|
|
b40bc8c |
- while (algs->name != NULL &&
|
|
|
b40bc8c |
- algs->value == DNS_KEYALG_RSAMD5)
|
|
|
b40bc8c |
- ++algs;
|
|
|
b40bc8c |
- }
|
|
|
b40bc8c |
-#endif
|
|
|
b40bc8c |
- return algs;
|
|
|
b40bc8c |
-}
|
|
|
b40bc8c |
-
|
|
|
b40bc8c |
isc_result_t
|
|
|
b40bc8c |
dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
|
|
|
b40bc8c |
unsigned int value;
|
|
|
b40bc8c |
+ isc_result_t result;
|
|
|
b40bc8c |
|
|
|
b40bc8c |
- RETERR(dns_mnemonic_fromtext(&value, source,
|
|
|
b40bc8c |
- secalgs_tbl_start(), 0xff));
|
|
|
b40bc8c |
+ result = dns_mnemonic_fromtext(&value, source,
|
|
|
b40bc8c |
+ secalgs, 0xff);
|
|
|
b40bc8c |
+ if (result != ISC_R_SUCCESS) {
|
|
|
b40bc8c |
+ result = dns_mnemonic_fromtext(&value, source,
|
|
|
b40bc8c |
+ md5_secalgs, 0xff);
|
|
|
b40bc8c |
+ if (result != ISC_R_SUCCESS) {
|
|
|
b40bc8c |
+ return (result);
|
|
|
b40bc8c |
+ } else if (!isc_md5_available())
|
|
|
b40bc8c |
+ return (ISC_R_DISABLED);
|
|
|
b40bc8c |
+ }
|
|
|
b40bc8c |
*secalgp = value;
|
|
|
b40bc8c |
return (ISC_R_SUCCESS);
|
|
|
b40bc8c |
}
|
|
|
b40bc8c |
|
|
|
b40bc8c |
isc_result_t
|
|
|
b40bc8c |
dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
|
|
|
b40bc8c |
- return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
|
|
|
b40bc8c |
+ return (dns_mnemonic_totext(secalg, target, secalgs));
|
|
|
b40bc8c |
}
|
|
|
b40bc8c |
|
|
|
b40bc8c |
void
|
|
|
b40bc8c |
--
|
|
|
b40bc8c |
2.20.1
|
|
|
b40bc8c |
|