[master] fix keysizes in confgen

3514.	[bug]		The ranges for valid key sizes in ddns-confgen and
			rndc-confgen were too constrained. Keys up to 512
			bits are now allowed for most algorithms, and up
			to 1024 bits for hmac-sha384 and hmac-sha512.
			[RT #32753]

CHANGES

@@ -1,3 +1,9 @@
+3514.	[bug]		The ranges for valid key sizes in ddns-confgen and
+			rndc-confgen were too constrained. Keys up to 512
+			bits are now allowed for most algorithms, and up
+			to 1024 bits for hmac-sha384 and hmac-sha512.
+			[RT #32753]
+
 3513.	[func]		"dig -u" prints times in microseconds rather than
 			milliseconds. [RT #32704]
 

bin/confgen/keygen.c

@@ -126,29 +126,17 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 
 	switch (alg) {
 	    case DST_ALG_HMACMD5:
-	    case DST_ALG_HMACSHA512:
+	    case DST_ALG_HMACSHA1:
+	    case DST_ALG_HMACSHA224:
+	    case DST_ALG_HMACSHA256:
 		if (keysize < 1 || keysize > 512)
 			fatal("keysize %d out of range (must be 1-512)\n",
 			      keysize);
 		break;
-	    case DST_ALG_HMACSHA256:
-		if (keysize < 1 || keysize > 256)
-			fatal("keysize %d out of range (must be 1-256)\n",
-			      keysize);
-		break;
-	    case DST_ALG_HMACSHA1:
-		if (keysize < 1 || keysize > 160)
-			fatal("keysize %d out of range (must be 1-160)\n",
-			      keysize);
-		break;
-	    case DST_ALG_HMACSHA224:
-		if (keysize < 1 || keysize > 224)
-			fatal("keysize %d out of range (must be 1-224)\n",
-			      keysize);
-		break;
 	    case DST_ALG_HMACSHA384:
-		if (keysize < 1 || keysize > 384)
-			fatal("keysize %d out of range (must be 1-384)\n",
+	    case DST_ALG_HMACSHA512:
+		if (keysize < 1 || keysize > 1024)
+			fatal("keysize %d out of range (must be 1-1024)\n",
 			      keysize);
 		break;
 	    default:

bin/confgen/rndc-confgen.c

@@ -140,8 +140,6 @@ main(int argc, char **argv) {
 			keysize = strtol(isc_commandline_argument, &p, 10);
 			if (*p != '\0' || keysize < 0)
 				fatal("-b requires a non-negative number");
-			if (keysize < 1 || keysize > 512)
-				fatal("-b must be in the range 1 through 512");
 			break;
 		case 'c':
 			keyfile = isc_commandline_argument;