nsupdate: use FIPS compatible algorithms

HMACMD5 is not permitted in FIPS mode, use HMACSHA256 instead.
This commit is contained in:
Mark Andrews
2021-12-20 19:28:36 +11:00
parent bcb3846603
commit ff7e73db6a
2 changed files with 3 additions and 3 deletions

View File

@@ -985,7 +985,7 @@ fi
n=$((n + 1))
ret=0
echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
for alg in md5 sha1 sha224 sha256 sha384 sha512; do
for alg in $ALGS; do
secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
$NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
server 10.53.0.1 ${PORT}
@@ -994,7 +994,7 @@ send
END
done
sleep 2
for alg in md5 sha1 sha224 sha256 sha384 sha512; do
for alg in $ALGS; do
$DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
done
if [ $ret -ne 0 ]; then