diff --git a/CHANGES b/CHANGES
index 09fce689e3..e1af721bd5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+3525. [func] Support for additional signing algorithms in rndc:
+ hmac-sha1, -sha224, -sha256, -sha384, and -sha512.
+ The -A option to rndc-confgen can be used to
+ select the algorithm for the generated key.
+ (The default is still hmac-md5; this may
+ change in a future release.) [RT #20363]
+
3524. [func] Added an alternate statistics channel in JSON format,
when the server is built with the json-c library:
http://[address]:[port]/json. [RT #32630]
diff --git a/FAQ b/FAQ
index 9e3469ce4a..ad31e544bd 100644
--- a/FAQ
+++ b/FAQ
@@ -869,7 +869,7 @@ A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do:
Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.:
key "rndc-key" {
- algorithm hmac-md5;
+ algorithm hmac-sha256;
secret "uvceheVuqf17ZwIcTydddw==";
};
diff --git a/FAQ.xml b/FAQ.xml
index 7b21689ce9..e31fbaa1b1 100644
--- a/FAQ.xml
+++ b/FAQ.xml
@@ -30,6 +30,7 @@
2008
2009
2010
+ 2013
Internet Systems Consortium, Inc. ("ISC")
@@ -1564,7 +1565,7 @@ rand_irqs="3 14 15"
key "rndc-key" {
- algorithm hmac-md5;
+ algorithm hmac-sha256;
secret "uvceheVuqf17ZwIcTydddw==";
};
diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
index e2ac07923a..3fd54fe2bb 100644
--- a/bin/confgen/rndc-confgen.c
+++ b/bin/confgen/rndc-confgen.c
@@ -57,7 +57,6 @@
#include "util.h"
#include "keygen.h"
-#define DEFAULT_KEYLENGTH 128 /*% Bits. */
#define DEFAULT_KEYNAME "rndc-key"
#define DEFAULT_SERVER "127.0.0.1"
#define DEFAULT_PORT 953
@@ -80,7 +79,8 @@ Usage:\n\
%s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
[-s addr] [-t chrootdir] [-u user]\n\
-a: generate just the key clause and write it to keyfile (%s)\n\
- -b bits: from 1 through 512, default %d; total length of the secret\n\
+ -A alg: algorithm (default hmac-md5)\n\
+ -b bits: from 1 through 512, default 256; total length of the secret\n\
-c keyfile: specify an alternate key file (requires -a)\n\
-k keyname: the name as it will be used in named.conf and rndc.conf\n\
-p port: the port named will listen on and rndc will connect to\n\
@@ -88,7 +88,7 @@ Usage:\n\
-s addr: the address to which rndc should connect\n\
-t chrootdir: write a keyfile in chrootdir as well (requires -a)\n\
-u user: set the keyfile owner to \"user\" (requires -a)\n",
- progname, keydef, DEFAULT_KEYLENGTH);
+ progname, keydef);
exit (status);
}
@@ -103,12 +103,12 @@ main(int argc, char **argv) {
const char *keyname = NULL;
const char *randomfile = NULL;
const char *serveraddr = NULL;
- dns_secalg_t alg = DST_ALG_HMACMD5;
- const char *algname = alg_totext(alg);
+ dns_secalg_t alg;
+ const char *algname;
char *p;
int ch;
int port;
- int keysize;
+ int keysize = -1;
struct in_addr addr4_dummy;
struct in6_addr addr6_dummy;
char *chrootdir = NULL;
@@ -124,18 +124,25 @@ main(int argc, char **argv) {
progname = program;
keyname = DEFAULT_KEYNAME;
- keysize = DEFAULT_KEYLENGTH;
+ alg = DST_ALG_HMACMD5;
serveraddr = DEFAULT_SERVER;
port = DEFAULT_PORT;
isc_commandline_errprint = ISC_FALSE;
while ((ch = isc_commandline_parse(argc, argv,
- "ab:c:hk:Mmp:r:s:t:u:Vy")) != -1) {
+ "aA:b:c:hk:Mmp:r:s:t:u:Vy")) != -1)
+ {
switch (ch) {
case 'a':
keyonly = ISC_TRUE;
break;
+ case 'A':
+ algname = isc_commandline_argument;
+ alg = alg_fromtext(algname);
+ if (alg == DST_ALG_UNKNOWN)
+ fatal("Unsupported algorithm '%s'", algname);
+ break;
case 'b':
keysize = strtol(isc_commandline_argument, &p, 10);
if (*p != '\0' || keysize < 0)
@@ -203,6 +210,10 @@ main(int argc, char **argv) {
if (argc > 0)
usage(1);
+ if (keysize < 0)
+ keysize = alg_bits(alg);
+ algname = alg_totext(alg);
+
DO("create memory context", isc_mem_create(0, 0, &mctx));
isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
diff --git a/bin/confgen/rndc-confgen.docbook b/bin/confgen/rndc-confgen.docbook
index af2cc4321d..f367b94aae 100644
--- a/bin/confgen/rndc-confgen.docbook
+++ b/bin/confgen/rndc-confgen.docbook
@@ -1,6 +1,6 @@
]>
+ []>