diff --git a/CHANGES b/CHANGES index 1c6b0b911f..3b644850e9 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +4797. [func] Removed "isc-hmac-fixup", as the versions of BIND that + had the bug it worked around are long past end of + life. [RT #46411] + 4796. [bug] Increase the maximum configurable TCP keepalive timeout to 65535. [RT #44710] diff --git a/bin/tools/.gitignore b/bin/tools/.gitignore index b760aa3025..088ac8f730 100644 --- a/bin/tools/.gitignore +++ b/bin/tools/.gitignore @@ -1,7 +1,6 @@ arpaname dnstap-read genrandom -isc-hmac-fixup mdig named-journalprint named-nzd2nzf diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in index aed60d16b7..b162311423 100644 --- a/bin/tools/Makefile.in +++ b/bin/tools/Makefile.in @@ -38,21 +38,21 @@ DNSTAPTARGETS = dnstap-read@EXEEXT@ NZDTARGETS = named-nzd2nzf@EXEEXT@ TARGETS = arpaname@EXEEXT@ named-journalprint@EXEEXT@ \ named-rrchecker@EXEEXT@ nsec3hash@EXEEXT@ \ - genrandom@EXEEXT@ isc-hmac-fixup@EXEEXT@ mdig@EXEEXT@ \ + genrandom@EXEEXT@ mdig@EXEEXT@ \ @DNSTAPTARGETS@ @NZDTARGETS@ DNSTAPSRCS = dnstap-read.c NZDSRCS = named-nzd2nzf.c SRCS = arpaname.c named-journalprint.c named-rrchecker.c \ - nsec3hash.c genrandom.c isc-hmac-fixup.c mdig.c \ + nsec3hash.c genrandom.c mdig.c \ @DNSTAPSRCS@ @NZDSRCS@ MANPAGES = arpaname.1 dnstap-read.1 genrandom.8 \ - isc-hmac-fixup.8 mdig.1 named-journalprint.8 \ + mdig.1 named-journalprint.8 \ named-nzd2nzf.8 named-rrchecker.1 nsec3hash.8 HTMLPAGES = arpaname.html dnstap-read.html genrandom.html \ - isc-hmac-fixup.html mdig.html named-journalprint.html \ + mdig.html named-journalprint.html \ named-nzd2nzf.html named-rrchecker.html nsec3hash.html MANOBJS = ${MANPAGES} ${HTMLPAGES} @@ -78,11 +78,6 @@ nsec3hash@EXEEXT@: nsec3hash.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS} export LIBS0="${DNSLIBS} ${ISCLIBS}"; \ ${FINALBUILDCMD} -isc-hmac-fixup@EXEEXT@: isc-hmac-fixup.@O@ ${ISCDEPLIBS} - export BASEOBJS="isc-hmac-fixup.@O@"; \ - export LIBS0="${ISCLIBS}"; \ - ${FINALBUILDCMD} - genrandom@EXEEXT@: genrandom.@O@ ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \ -o $@ genrandom.@O@ @GENRANDOMLIB@ ${LIBS} @@ -134,12 +129,9 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@ ${DESTDIR}${sbindir} ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} genrandom@EXEEXT@ \ ${DESTDIR}${sbindir} - ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} isc-hmac-fixup@EXEEXT@ \ - ${DESTDIR}${sbindir} ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \ ${DESTDIR}${bindir} ${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1 - ${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8 ${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8 ${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1 ${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8 @@ -152,12 +144,9 @@ uninstall:: rm -f ${DESTDIR}${mandir}/man8/nsec3hash.8 rm -f ${DESTDIR}${mandir}/man1/named-rrchecker.1 rm -f ${DESTDIR}${mandir}/man8/named-journalprint.8 - rm -f ${DESTDIR}${mandir}/man8/isc-hmac-fixup.8 rm -f ${DESTDIR}${mandir}/man1/arpaname.1 ${LIBTOOL_MODE_UNINSTALL} rm -f \ ${DESTDIR}${bindir}/mdig@EXEEXT@ - ${LIBTOOL_MODE_UNINSTALL} rm -f \ - ${DESTDIR}${sbindir}/isc-hmac-fixup@EXEEXT@ ${LIBTOOL_MODE_UNINSTALL} rm -f \ ${DESTDIR}${sbindir}/genrandom@EXEEXT@ ${LIBTOOL_MODE_UNINSTALL} rm -f \ diff --git a/bin/tools/isc-hmac-fixup.8 b/bin/tools/isc-hmac-fixup.8 deleted file mode 100644 index 0743e4ceeb..0000000000 --- a/bin/tools/isc-hmac-fixup.8 +++ /dev/null @@ -1,69 +0,0 @@ -.\" Copyright (C) 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC") -.\" -.\" This Source Code Form is subject to the terms of the Mozilla Public -.\" License, v. 2.0. If a copy of the MPL was not distributed with this -.\" file, You can obtain one at http://mozilla.org/MPL/2.0/. -.\" -.hy 0 -.ad l -'\" t -.\" Title: isc-hmac-fixup -.\" Author: -.\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 2013-04-28 -.\" Manual: BIND9 -.\" Source: ISC -.\" Language: English -.\" -.TH "ISC\-HMAC\-FIXUP" "8" "2013\-04\-28" "ISC" "BIND9" -.\" ----------------------------------------------------------------- -.\" * Define some portability stuff -.\" ----------------------------------------------------------------- -.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -.\" http://bugs.debian.org/507673 -.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html -.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -.ie \n(.g .ds Aq \(aq -.el .ds Aq ' -.\" ----------------------------------------------------------------- -.\" * set default formatting -.\" ----------------------------------------------------------------- -.\" disable hyphenation -.nh -.\" disable justification (adjust text to left margin only) -.ad l -.\" ----------------------------------------------------------------- -.\" * MAIN CONTENT STARTS HERE * -.\" ----------------------------------------------------------------- -.SH "NAME" -isc-hmac-fixup \- fixes HMAC keys generated by older versions of BIND -.SH "SYNOPSIS" -.HP \w'\fBisc\-hmac\-fixup\fR\ 'u -\fBisc\-hmac\-fixup\fR {\fIalgorithm\fR} {\fIsecret\fR} -.SH "DESCRIPTION" -.PP -Versions of BIND 9 up to and including BIND 9\&.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i\&.e\&., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations\&. -.PP -This bug has been fixed in BIND 9\&.7\&. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys\&. -\fBisc\-hmac\-fixup\fR -modifies those keys to restore compatibility\&. -.PP -To modify a key, run -\fBisc\-hmac\-fixup\fR -and specify the key\*(Aqs algorithm and secret on the command line\&. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret\&. (If the secret did not require conversion, then it will be printed without modification\&.) -.SH "SECURITY CONSIDERATIONS" -.PP -Secrets that have been converted by -\fBisc\-hmac\-fixup\fR -are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security\&. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength\&." -.SH "SEE ALSO" -.PP -BIND 9 Administrator Reference Manual, -RFC 2104\&. -.SH "AUTHOR" -.PP -\fBInternet Systems Consortium, Inc\&.\fR -.SH "COPYRIGHT" -.br -Copyright \(co 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC") -.br diff --git a/bin/tools/isc-hmac-fixup.c b/bin/tools/isc-hmac-fixup.c deleted file mode 100644 index 408338cdd3..0000000000 --- a/bin/tools/isc-hmac-fixup.c +++ /dev/null @@ -1,139 +0,0 @@ -/* - * Copyright (C) 2010, 2014-2016 Internet Systems Consortium, Inc. ("ISC") - * - * This Source Code Form is subject to the terms of the Mozilla Public - * License, v. 2.0. If a copy of the MPL was not distributed with this - * file, You can obtain one at http://mozilla.org/MPL/2.0/. - */ - -/* $Id: isc-hmac-fixup.c,v 1.4 2010/03/10 02:17:52 marka Exp $ */ - -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include - -#define HMAC_LEN 64 - -int -main(int argc, char **argv) { - isc_buffer_t buf; - unsigned char key[1024]; - char secret[1024]; - char base64[(1024*4)/3]; - isc_region_t r; - isc_result_t result; - - if (argc != 3) { - fprintf(stderr, "Usage:\t%s algorithm secret\n", argv[0]); -#ifndef PK11_MD5_DISABLE - fprintf(stderr, "\talgorithm: (MD5 | SHA1 | SHA224 | " - "SHA256 | SHA384 | SHA512)\n"); -#else - fprintf(stderr, "\talgorithm: (SHA1 | SHA224 | " - "SHA256 | SHA384 | SHA512)\n"); -#endif - return (1); - } - - isc_buffer_init(&buf, secret, sizeof(secret)); - result = isc_base64_decodestring(argv[2], &buf); - if (result != ISC_R_SUCCESS) { - fprintf(stderr, "error: %s\n", isc_result_totext(result)); - return (1); - } - isc_buffer_usedregion(&buf, &r); - -#ifndef PK11_MD5_DISABLE - if (!strcasecmp(argv[1], "md5") || - !strcasecmp(argv[1], "hmac-md5")) { - if (r.length > HMAC_LEN) { - isc_md5_t md5ctx; - isc_md5_init(&md5ctx); - isc_md5_update(&md5ctx, r.base, r.length); - isc_md5_final(&md5ctx, key); - - r.base = key; - r.length = ISC_MD5_DIGESTLENGTH; - } - } else -#endif - if (!strcasecmp(argv[1], "sha1") || - !strcasecmp(argv[1], "hmac-sha1")) { - if (r.length > ISC_SHA1_DIGESTLENGTH) { - isc_sha1_t sha1ctx; - isc_sha1_init(&sha1ctx); - isc_sha1_update(&sha1ctx, r.base, r.length); - isc_sha1_final(&sha1ctx, key); - - r.base = key; - r.length = ISC_SHA1_DIGESTLENGTH; - } - } else if (!strcasecmp(argv[1], "sha224") || - !strcasecmp(argv[1], "hmac-sha224")) { - if (r.length > ISC_SHA224_DIGESTLENGTH) { - isc_sha224_t sha224ctx; - isc_sha224_init(&sha224ctx); - isc_sha224_update(&sha224ctx, r.base, r.length); - isc_sha224_final(key, &sha224ctx); - - r.base = key; - r.length = ISC_SHA224_DIGESTLENGTH; - } - } else if (!strcasecmp(argv[1], "sha256") || - !strcasecmp(argv[1], "hmac-sha256")) { - if (r.length > ISC_SHA256_DIGESTLENGTH) { - isc_sha256_t sha256ctx; - isc_sha256_init(&sha256ctx); - isc_sha256_update(&sha256ctx, r.base, r.length); - isc_sha256_final(key, &sha256ctx); - - r.base = key; - r.length = ISC_SHA256_DIGESTLENGTH; - } - } else if (!strcasecmp(argv[1], "sha384") || - !strcasecmp(argv[1], "hmac-sha384")) { - if (r.length > ISC_SHA384_DIGESTLENGTH) { - isc_sha384_t sha384ctx; - isc_sha384_init(&sha384ctx); - isc_sha384_update(&sha384ctx, r.base, r.length); - isc_sha384_final(key, &sha384ctx); - - r.base = key; - r.length = ISC_SHA384_DIGESTLENGTH; - } - } else if (!strcasecmp(argv[1], "sha512") || - !strcasecmp(argv[1], "hmac-sha512")) { - if (r.length > ISC_SHA512_DIGESTLENGTH) { - isc_sha512_t sha512ctx; - isc_sha512_init(&sha512ctx); - isc_sha512_update(&sha512ctx, r.base, r.length); - isc_sha512_final(key, &sha512ctx); - - r.base = key; - r.length = ISC_SHA512_DIGESTLENGTH; - } - } else { - fprintf(stderr, "unknown hmac/digest algorithm: %s\n", argv[1]); - return (1); - } - - isc_buffer_init(&buf, base64, sizeof(base64)); - result = isc_base64_totext(&r, 0, "", &buf); - if (result != ISC_R_SUCCESS) { - fprintf(stderr, "error: %s\n", isc_result_totext(result)); - return (1); - } - fprintf(stdout, "%.*s\n", (int)isc_buffer_usedlength(&buf), base64); - return (0); -} diff --git a/bin/tools/isc-hmac-fixup.docbook b/bin/tools/isc-hmac-fixup.docbook deleted file mode 100644 index 50fffaf890..0000000000 --- a/bin/tools/isc-hmac-fixup.docbook +++ /dev/null @@ -1,96 +0,0 @@ - - - - - - 2013-04-28 - - - ISC - Internet Systems Consortium, Inc. - - - - isc-hmac-fixup - 8 - BIND9 - - - - isc-hmac-fixup - fixes HMAC keys generated by older versions of BIND - - - - - 2010 - 2013 - 2014 - 2015 - 2016 - Internet Systems Consortium, Inc. ("ISC") - - - - - - isc-hmac-fixup - algorithm - secret - - - - DESCRIPTION - - - Versions of BIND 9 up to and including BIND 9.6 had a bug causing - HMAC-SHA* TSIG keys which were longer than the digest length of the - hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys - longer than 256 bits, etc) to be used incorrectly, generating a - message authentication code that was incompatible with other DNS - implementations. - - - This bug has been fixed in BIND 9.7. However, the fix may - cause incompatibility between older and newer versions of - BIND, when using long keys. isc-hmac-fixup - modifies those keys to restore compatibility. - - - To modify a key, run isc-hmac-fixup and - specify the key's algorithm and secret on the command line. If the - secret is longer than the digest length of the algorithm (64 bytes - for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a - new secret will be generated consisting of a hash digest of the old - secret. (If the secret did not require conversion, then it will be - printed without modification.) - - - - SECURITY CONSIDERATIONS - - - Secrets that have been converted by isc-hmac-fixup - are shortened, but as this is how the HMAC protocol works in - operation anyway, it does not affect security. RFC 2104 notes, - "Keys longer than [the digest length] are acceptable but the - extra length would not significantly increase the function - strength." - - - - SEE ALSO - - - BIND 9 Administrator Reference Manual, - RFC 2104. - - - - diff --git a/bin/tools/isc-hmac-fixup.html b/bin/tools/isc-hmac-fixup.html deleted file mode 100644 index b95b0e0fc9..0000000000 --- a/bin/tools/isc-hmac-fixup.html +++ /dev/null @@ -1,92 +0,0 @@ - - - - - -isc-hmac-fixup - - -
-
- - - - - -
-

Name

-

- isc-hmac-fixup - — fixes HMAC keys generated by older versions of BIND -

-
- - - -
-

Synopsis

-

- isc-hmac-fixup - {algorithm} - {secret} -

-
- -
-

DESCRIPTION

- -

- Versions of BIND 9 up to and including BIND 9.6 had a bug causing - HMAC-SHA* TSIG keys which were longer than the digest length of the - hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys - longer than 256 bits, etc) to be used incorrectly, generating a - message authentication code that was incompatible with other DNS - implementations. -

-

- This bug has been fixed in BIND 9.7. However, the fix may - cause incompatibility between older and newer versions of - BIND, when using long keys. isc-hmac-fixup - modifies those keys to restore compatibility. -

-

- To modify a key, run isc-hmac-fixup and - specify the key's algorithm and secret on the command line. If the - secret is longer than the digest length of the algorithm (64 bytes - for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a - new secret will be generated consisting of a hash digest of the old - secret. (If the secret did not require conversion, then it will be - printed without modification.) -

-
- -
-

SECURITY CONSIDERATIONS

- -

- Secrets that have been converted by isc-hmac-fixup - are shortened, but as this is how the HMAC protocol works in - operation anyway, it does not affect security. RFC 2104 notes, - "Keys longer than [the digest length] are acceptable but the - extra length would not significantly increase the function - strength." -

-
- -
-

SEE ALSO

- -

- BIND 9 Administrator Reference Manual, - RFC 2104. -

-
- -
- diff --git a/bin/tools/win32/ischmacfixup.vcxproj.filters.in b/bin/tools/win32/ischmacfixup.vcxproj.filters.in deleted file mode 100644 index 49d58143fa..0000000000 --- a/bin/tools/win32/ischmacfixup.vcxproj.filters.in +++ /dev/null @@ -1,18 +0,0 @@ - - - - - {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx - - - {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} - rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - - - - Source Files - - - \ No newline at end of file diff --git a/bin/tools/win32/ischmacfixup.vcxproj.in b/bin/tools/win32/ischmacfixup.vcxproj.in deleted file mode 100644 index 39c558050a..0000000000 --- a/bin/tools/win32/ischmacfixup.vcxproj.in +++ /dev/null @@ -1,112 +0,0 @@ - - - - - Debug - @PLATFORM@ - - - Release - @PLATFORM@ - - - - {70F2F0DF-665D-4444-A982-AEA31A861A22} - Win32Proj - ischmacfixup - - - - Application - true - MultiByte - - - Application - false - true - MultiByte - - - - - - - - - - - - - true - ..\..\..\Build\$(Configuration)\ - .\$(Configuration)\ - isc-hmac-fixup - - - false - ..\..\..\Build\$(Configuration)\ - .\$(Configuration)\ - isc-hmac-fixup - - - - - - Level3 - Disabled - WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - .\$(Configuration)\$(ProjectName).pch - .\$(Configuration)\ - .\$(Configuration)\ - $(OutDir)$(TargetName).pdb - true - .\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories) - CompileAsC - - - Console - true - ..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt) - ..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories) - libisc.lib;%(AdditionalDependencies) - - - - - Level3 - - - MaxSpeed - true - @INTRINSIC@ - WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - OnlyExplicitInline - false - true - .\$(Configuration)\$(ProjectName).pch - .\$(Configuration)\ - .\$(Configuration)\ - $(OutDir)$(TargetName).pdb - .\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;%(AdditionalIncludeDirectories) - CompileAsC - - - Console - false - true - true - ..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt) - Default - ..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories) - libisc.lib;%(AdditionalDependencies) - - - - - - - - - diff --git a/bin/tools/win32/ischmacfixup.vcxproj.user b/bin/tools/win32/ischmacfixup.vcxproj.user deleted file mode 100644 index 695b5c78b9..0000000000 --- a/bin/tools/win32/ischmacfixup.vcxproj.user +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/bin/win32/BINDInstall/BINDInstallDlg.cpp b/bin/win32/BINDInstall/BINDInstallDlg.cpp index c633785adc..441b760d92 100644 --- a/bin/win32/BINDInstall/BINDInstallDlg.cpp +++ b/bin/win32/BINDInstall/BINDInstallDlg.cpp @@ -186,7 +186,6 @@ const FileData installFiles[] = {"named-compilezone.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE}, {"named-journalprint.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE}, {"named-rrchecker.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE}, - {"isc-hmac-fixup.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE}, #ifdef USE_PKCS11 {"pkcs11-destroy.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE}, {"pkcs11-keygen.exe", FileData::BinDir, FileData::Normal, FALSE, FALSE}, diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index c3fb5c94cb..5843ed1d4f 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18560,7 +18560,6 @@ allow-query { !{ !10/8; any; }; key example; }; - diff --git a/doc/arm/man.isc-hmac-fixup.html b/doc/arm/man.isc-hmac-fixup.html deleted file mode 100644 index dd20e7736d..0000000000 --- a/doc/arm/man.isc-hmac-fixup.html +++ /dev/null @@ -1,130 +0,0 @@ - - - - - -isc-hmac-fixup - - - - - - - -
- - - - - - - -
isc-hmac-fixup
-Prev Manual pages Next -
-
-
-
-
- - - - - -
-

Name

-

- isc-hmac-fixup - — fixes HMAC keys generated by older versions of BIND -

-
- - - -
-

Synopsis

-

- isc-hmac-fixup - {algorithm} - {secret} -

-
- -
-

DESCRIPTION

- -

- Versions of BIND 9 up to and including BIND 9.6 had a bug causing - HMAC-SHA* TSIG keys which were longer than the digest length of the - hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys - longer than 256 bits, etc) to be used incorrectly, generating a - message authentication code that was incompatible with other DNS - implementations. -

-

- This bug has been fixed in BIND 9.7. However, the fix may - cause incompatibility between older and newer versions of - BIND, when using long keys. isc-hmac-fixup - modifies those keys to restore compatibility. -

-

- To modify a key, run isc-hmac-fixup and - specify the key's algorithm and secret on the command line. If the - secret is longer than the digest length of the algorithm (64 bytes - for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a - new secret will be generated consisting of a hash digest of the old - secret. (If the secret did not require conversion, then it will be - printed without modification.) -

-
- -
-

SECURITY CONSIDERATIONS

- -

- Secrets that have been converted by isc-hmac-fixup - are shortened, but as this is how the HMAC protocol works in - operation anyway, it does not affect security. RFC 2104 notes, - "Keys longer than [the digest length] are acceptable but the - extra length would not significantly increase the function - strength." -

-
- -
-

SEE ALSO

- -

- BIND 9 Administrator Reference Manual, - RFC 2104. -

-
- -
-
-
- - - - - - - - - - - -
-Prev Up Next -
host Home mdig -
-
-

BIND 9.12.0b1

- - diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index fe52b2d672..8997a269ed 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -507,6 +507,14 @@ in a future release. [RT #42272] + + + The isc-hmac-fixup command, which was created + to address an interoperability problem in TSIG keys between + early versions of BIND and other DNS implmentations, is now + obsolete and has been removed. [RT #46411] + + diff --git a/lib/isc/win32/libisc.vcxproj.in b/lib/isc/win32/libisc.vcxproj.in index 1e246b17de..6c888e5934 100644 --- a/lib/isc/win32/libisc.vcxproj.in +++ b/lib/isc/win32/libisc.vcxproj.in @@ -226,7 +226,6 @@ copy ..\bin\pkcs11\pkcs11-tokens.html ..\Build\Release @END PKCS11 copy ..\bin\tools\arpaname.html ..\Build\Release copy ..\bin\tools\genrandom.html ..\Build\Release -copy ..\bin\tools\isc-hmac-fixup.html ..\Build\Release copy ..\bin\tools\named-journalprint.html ..\Build\Release copy ..\bin\tools\named-rrchecker.html ..\Build\Release copy ..\bin\tools\nsec3hash.html ..\Build\Release diff --git a/util/copyrights b/util/copyrights index 00285acbae..9a2df19689 100644 --- a/util/copyrights +++ b/util/copyrights @@ -2562,10 +2562,6 @@ ./bin/tools/genrandom.c C 2000,2001,2002,2003,2004,2005,2007,2009,2010,2012,2014,2016 ./bin/tools/genrandom.docbook SGML 2009,2010,2011,2014,2015,2016 ./bin/tools/genrandom.html HTML DOCBOOK -./bin/tools/isc-hmac-fixup.8 MAN DOCBOOK -./bin/tools/isc-hmac-fixup.c C 2010,2014,2015,2016 -./bin/tools/isc-hmac-fixup.docbook SGML 2010,2013,2014,2015,2016 -./bin/tools/isc-hmac-fixup.html HTML DOCBOOK ./bin/tools/mdig.1 MAN DOCBOOK ./bin/tools/mdig.c C 2015,2016,2017 ./bin/tools/mdig.docbook SGML 2015,2016,2017 @@ -2592,9 +2588,6 @@ ./bin/tools/win32/genrandom.vcxproj.filters.in X 2013,2015 ./bin/tools/win32/genrandom.vcxproj.in X 2013,2015,2016,2017 ./bin/tools/win32/genrandom.vcxproj.user X 2013 -./bin/tools/win32/ischmacfixup.vcxproj.filters.in X 2013,2015 -./bin/tools/win32/ischmacfixup.vcxproj.in X 2013,2014,2015,2016,2017 -./bin/tools/win32/ischmacfixup.vcxproj.user X 2013 ./bin/tools/win32/journalprint.vcxproj.filters.in X 2013,2015 ./bin/tools/win32/journalprint.vcxproj.in X 2013,2015,2016,2017 ./bin/tools/win32/journalprint.vcxproj.user X 2013 @@ -3070,7 +3063,6 @@ ./doc/arm/man.dnstap-read.html X 2015,2016,2017 ./doc/arm/man.genrandom.html X 2009,2010,2011,2012,2013,2014,2015,2016,2017 ./doc/arm/man.host.html X 2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017 -./doc/arm/man.isc-hmac-fixup.html X 2010,2011,2012,2013,2014,2015,2016,2017 ./doc/arm/man.mdig.html X 2016,2017 ./doc/arm/man.named-checkconf.html X 2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017 ./doc/arm/man.named-checkzone.html X 2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017 diff --git a/win32utils/Configure b/win32utils/Configure index 0f91fb3bf0..b74a1e7f15 100644 --- a/win32utils/Configure +++ b/win32utils/Configure @@ -105,8 +105,6 @@ my @projectlist = ("..\\bin\\check\\win32\\checkconf.vcxproj", "..\\bin\\tools\\win32\\arpaname.vcxproj.filters", "..\\bin\\tools\\win32\\genrandom.vcxproj", "..\\bin\\tools\\win32\\genrandom.vcxproj.filters", - "..\\bin\\tools\\win32\\ischmacfixup.vcxproj", - "..\\bin\\tools\\win32\\ischmacfixup.vcxproj.filters", "..\\bin\\tools\\win32\\journalprint.vcxproj", "..\\bin\\tools\\win32\\journalprint.vcxproj.filters", "..\\bin\\tools\\win32\\mdig.vcxproj", diff --git a/win32utils/bind9.sln.in b/win32utils/bind9.sln.in index a75e147ba1..8230983a2c 100644 --- a/win32utils/bind9.sln.in +++ b/win32utils/bind9.sln.in @@ -45,7 +45,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BINDInstall", "..\bin\win32 {B19042CE-D3D9-469B-BCD2-C3140150939A} = {B19042CE-D3D9-469B-BCD2-C3140150939A} {4EE91023-94C3-48C0-B71C-5333B726C2EE} = {4EE91023-94C3-48C0-B71C-5333B726C2EE} {B4AC7F81-E3DC-43E9-B339-4FA5149FA8F7} = {B4AC7F81-E3DC-43E9-B339-4FA5149FA8F7} - {70F2F0DF-665D-4444-A982-AEA31A861A22} = {70F2F0DF-665D-4444-A982-AEA31A861A22} {98743A7C-6AF8-467F-9911-FA69C451AF2B} = {98743A7C-6AF8-467F-9911-FA69C451AF2B} {3115091C-8135-481F-9757-F013A26255E0} = {3115091C-8135-481F-9757-F013A26255E0} {C41266C7-E27E-4D60-9815-82D3B32BF82F} = {C41266C7-E27E-4D60-9815-82D3B32BF82F} @@ -388,12 +387,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "genrandom", "..\bin\tools\w {3840E563-D180-4761-AA9C-E6155F02EAFF} = {3840E563-D180-4761-AA9C-E6155F02EAFF} EndProjectSection EndProject -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ischmacfixup", "..\bin\tools\win32\ischmacfixup.vcxproj", "{70F2F0DF-665D-4444-A982-AEA31A861A22}" - ProjectSection(ProjectDependencies) = postProject - {A3F71D12-F38A-4C77-8D87-8E8854CA74A1} = {A3F71D12-F38A-4C77-8D87-8E8854CA74A1} - {3840E563-D180-4761-AA9C-E6155F02EAFF} = {3840E563-D180-4761-AA9C-E6155F02EAFF} - EndProjectSection -EndProject Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "rrchecker", "..\bin\tools\win32\rrchecker.vcxproj", "{98743A7C-6AF8-467F-9911-FA69C451AF2B}" ProjectSection(ProjectDependencies) = postProject {A3F71D12-F38A-4C77-8D87-8E8854CA74A1} = {A3F71D12-F38A-4C77-8D87-8E8854CA74A1} @@ -849,10 +842,6 @@ Global {B4AC7F81-E3DC-43E9-B339-4FA5149FA8F7}.Debug|@PLATFORM@.Build.0 = Debug|@PLATFORM@ {B4AC7F81-E3DC-43E9-B339-4FA5149FA8F7}.Release|@PLATFORM@.ActiveCfg = Release|@PLATFORM@ {B4AC7F81-E3DC-43E9-B339-4FA5149FA8F7}.Release|@PLATFORM@.Build.0 = Release|@PLATFORM@ - {70F2F0DF-665D-4444-A982-AEA31A861A22}.Debug|@PLATFORM@.ActiveCfg = Debug|@PLATFORM@ - {70F2F0DF-665D-4444-A982-AEA31A861A22}.Debug|@PLATFORM@.Build.0 = Debug|@PLATFORM@ - {70F2F0DF-665D-4444-A982-AEA31A861A22}.Release|@PLATFORM@.ActiveCfg = Release|@PLATFORM@ - {70F2F0DF-665D-4444-A982-AEA31A861A22}.Release|@PLATFORM@.Build.0 = Release|@PLATFORM@ {98743A7C-6AF8-467F-9911-FA69C451AF2B}.Debug|@PLATFORM@.ActiveCfg = Debug|@PLATFORM@ {98743A7C-6AF8-467F-9911-FA69C451AF2B}.Debug|@PLATFORM@.Build.0 = Debug|@PLATFORM@ {98743A7C-6AF8-467F-9911-FA69C451AF2B}.Release|@PLATFORM@.ActiveCfg = Release|@PLATFORM@