From 52784fc3cc2e5f0df3d2facc026fb1c7007fb347 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Sat, 3 Nov 2018 15:50:38 +0700 Subject: [PATCH] Disable runtime detection of md5 and sha1 support for Utimaco HSM. Utimaco HSM requires user to be logged in before executing DigestUpdate, thus breaking dst_lib_init2 that ran isc_md5_check and isc_sha1_check before sending PIN to the HSM. Therefore isc_*_check needs to be disabled when Utimaco HSM is being used as PKCS#11 library. --- lib/dns/hmac_link.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c index 94e73b1d9e..3b6579bf10 100644 --- a/lib/dns/hmac_link.c +++ b/lib/dns/hmac_link.c @@ -355,12 +355,13 @@ dst__hmacmd5_init(dst_func_t **funcp) { } #endif +#if PK11_FLAVOR != PK11_UTIMACO_FLAVOR /* * Prevent use of incorrect crypto */ - RUNTIME_CHECK(isc_md5_check(false)); RUNTIME_CHECK(isc_hmacmd5_check(0)); +#endif REQUIRE(funcp != NULL); if (*funcp == NULL) @@ -648,11 +649,13 @@ static dst_func_t hmacsha1_functions = { isc_result_t dst__hmacsha1_init(dst_func_t **funcp) { +#if PK11_FLAVOR != PK11_UTIMACO_FLAVOR /* * Prevent use of incorrect crypto */ RUNTIME_CHECK(isc_sha1_check(false)); RUNTIME_CHECK(isc_hmacsha1_check(0)); +#endif REQUIRE(funcp != NULL); if (*funcp == NULL)