From 7ca8845b3dbf8bc2324c42ba32a97205a4ab8140 Mon Sep 17 00:00:00 2001 From: Joeri Capens Date: Thu, 28 Dec 2017 23:39:55 +0100 Subject: [PATCH 1/6] Replace Dynamic DNS dnssec-keygen style files with simpler ddns-confgen style file. --- src/etc/inc/services.inc | 44 +++++---------------- src/usr/local/www/services_rfc2136_edit.php | 33 ---------------- 2 files changed, 9 insertions(+), 68 deletions(-) diff --git a/src/etc/inc/services.inc b/src/etc/inc/services.inc index f0a204fa45..c23aed42a0 100644 --- a/src/etc/inc/services.inc +++ b/src/etc/inc/services.inc @@ -2531,39 +2531,15 @@ function services_dnsupdate_process($int = "", $updatehost = "", $forced = false $hostname .= "."; } - /* - * write private key file - * this is dumb - public and private keys are the same for - * HMAC-MD5, but nsupdate insists on having both - */ - $fd = fopen($g['varetc_path'] . - "/K{$i}{$keyname}+157+00000.private", "w"); - $privkey = <<addInput(new Form_Input( $pconfig['keyname'] ))->setHelp('This must match the setting on the DNS server.'); -$group = new Form_Group('*Key Type'); - -$group->add(new Form_Checkbox( - 'keytype', - 'Key Type', - 'Zone', - ($pconfig['keytype'] == 'zone'), - 'zone' -))->displayAsRadio(); - -$group->add(new Form_Checkbox( - 'keytype', - 'Key Type', - 'Host', - ($pconfig['keytype'] == 'host'), - 'host' -))->displayAsRadio(); - -$group->add(new Form_Checkbox( - 'keytype', - 'Key Type', - 'User', - ($pconfig['keytype'] == 'user'), - 'user' -))->displayAsRadio(); - -$section->add($group); - $section->addInput(new Form_Input( 'keydata', '*Key', From 16c260fac2b1a1c7414891c3c971d5362ad104df Mon Sep 17 00:00:00 2001 From: Joeri Capens Date: Thu, 28 Dec 2017 23:46:33 +0100 Subject: [PATCH 2/6] Use consistent variable order, remove unused variable. --- src/usr/local/www/services_rfc2136_edit.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/usr/local/www/services_rfc2136_edit.php b/src/usr/local/www/services_rfc2136_edit.php index 03fa661f5f..9ddb489f1c 100644 --- a/src/usr/local/www/services_rfc2136_edit.php +++ b/src/usr/local/www/services_rfc2136_edit.php @@ -45,8 +45,8 @@ if (isset($id) && isset($a_rfc2136[$id])) { if (!$pconfig['ttl']) { $pconfig['ttl'] = 60; } - $pconfig['keydata'] = $a_rfc2136[$id]['keydata']; $pconfig['keyname'] = $a_rfc2136[$id]['keyname']; + $pconfig['keydata'] = $a_rfc2136[$id]['keydata']; $pconfig['server'] = $a_rfc2136[$id]['server']; $pconfig['interface'] = $a_rfc2136[$id]['interface']; $pconfig['usetcp'] = isset($a_rfc2136[$id]['usetcp']); @@ -156,8 +156,6 @@ $section->addInput(new Form_Checkbox( $pconfig['enable'] )); -$optionlist = array(); - $iflist = build_if_list(); $section->addInput(new Form_Select( From ab1112eed9c14f95d32469755c17dc067f903e61 Mon Sep 17 00:00:00 2001 From: Joeri Capens Date: Fri, 29 Dec 2017 00:01:18 +0100 Subject: [PATCH 3/6] Add RFC 2136 Client key algorithm choice. Implements #8244 --- src/etc/inc/services.inc | 3 ++- src/usr/local/www/services_rfc2136_edit.php | 18 +++++++++++++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/src/etc/inc/services.inc b/src/etc/inc/services.inc index c23aed42a0..e5e5805cc4 100644 --- a/src/etc/inc/services.inc +++ b/src/etc/inc/services.inc @@ -2532,9 +2532,10 @@ function services_dnsupdate_process($int = "", $updatehost = "", $forced = false } /* write key file */ + $algorithm = empty($dnsupdate['keyalgorithm']) ? 'hmac-md5' : $dnsupdate['keyalgorithm']; $upkey = <<addInput(new Form_Input( $pconfig['keyname'] ))->setHelp('This must match the setting on the DNS server.'); +$section->addInput(new Form_Select( + 'keyalgorithm', + '*Key algorithm', + $pconfig['keyalgorithm'], + array( + 'hmac-md5' => 'HMAC-MD5 (legacy default)', + 'hmac-sha1' => 'HMAC-SHA1', + 'hmac-sha224' => 'HMAC-SHA224', + 'hmac-sha256' => 'HMAC-SHA256 (current bind9 default)', + 'hmac-sha384' => 'HMAC-SHA384', + 'hmac-sha512' => 'HMAC-SHA512 (most secure)', + ) +)); + $section->addInput(new Form_Input( 'keydata', '*Key', 'text', $pconfig['keydata'] -))->setHelp('Paste an HMAC-MD5 key here.'); +))->setHelp('Secret TSIG domain key.'); $section->addInput(new Form_Input( 'server', From 0ccfd70e2c28fbf9dd0b51c1e11bfb8b09d95ca8 Mon Sep 17 00:00:00 2001 From: Joeri Capens Date: Fri, 29 Dec 2017 00:24:11 +0100 Subject: [PATCH 4/6] Remove old dnssec-keygen style files during upgrade --- src/etc/inc/globals.inc | 2 +- src/etc/inc/upgrade_config.inc | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/etc/inc/globals.inc b/src/etc/inc/globals.inc index 304bfee7f3..53b876ed85 100644 --- a/src/etc/inc/globals.inc +++ b/src/etc/inc/globals.inc @@ -74,7 +74,7 @@ $g = array( "disablecrashreporter" => false, "crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php", "debug" => false, - "latest_config" => "17.3", + "latest_config" => "17.4", "minimum_ram_warning" => "101", "minimum_ram_warning_text" => "128 MB", "wan_interface_name" => "wan", diff --git a/src/etc/inc/upgrade_config.inc b/src/etc/inc/upgrade_config.inc index 6b7ac30397..de78e3c540 100644 --- a/src/etc/inc/upgrade_config.inc +++ b/src/etc/inc/upgrade_config.inc @@ -5493,6 +5493,17 @@ function upgrade_172_to_173() { } } +/* + * Delete old Dynamic DNS dnssec-keygen style files, + * they are replaced with a simpler single ddns-confgen style file. + */ +function upgrade_173_to_174() { + global $g; + + unlink_if_exists("{$g['varetc_path']}/K*+157+00000.key"); + unlink_if_exists("{$g['varetc_path']}/K*+157+00000.private"); +} + /* * Special function that is called independent of current config version. It's * a workaround to have config_upgrade running on older versions after next From 16f8df9a89ade7a898ecb8bfea72a054652975dd Mon Sep 17 00:00:00 2001 From: Joeri Capens Date: Tue, 2 Jan 2018 21:49:12 +0100 Subject: [PATCH 5/6] Delete keytype field from config, remove unnecessary file cleanup. --- src/etc/inc/upgrade_config.inc | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/etc/inc/upgrade_config.inc b/src/etc/inc/upgrade_config.inc index de78e3c540..dc5543893a 100644 --- a/src/etc/inc/upgrade_config.inc +++ b/src/etc/inc/upgrade_config.inc @@ -5494,14 +5494,15 @@ function upgrade_172_to_173() { } /* - * Delete old Dynamic DNS dnssec-keygen style files, - * they are replaced with a simpler single ddns-confgen style file. + * Dynamic DNS nsupdate keyfiles have been replaced with a simpler ddns-confgen style file. */ function upgrade_173_to_174() { - global $g; + global $config; - unlink_if_exists("{$g['varetc_path']}/K*+157+00000.key"); - unlink_if_exists("{$g['varetc_path']}/K*+157+00000.private"); + /* Remove unused keytype field. */ + foreach ($config['dnsupdates']['dnsupdate'] as $i => &$dnsupdate) { + unset($dnsupdate['keytype']); + } } /* From c0305bb85388499cddf9044dec406bbb57ad5c79 Mon Sep 17 00:00:00 2001 From: Joeri Capens Date: Tue, 2 Jan 2018 21:49:48 +0100 Subject: [PATCH 6/6] Add keyalgorithm input validation. --- src/usr/local/www/services_rfc2136_edit.php | 33 +++++++++++---------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/src/usr/local/www/services_rfc2136_edit.php b/src/usr/local/www/services_rfc2136_edit.php index ff1cfb229b..ba8f803de9 100644 --- a/src/usr/local/www/services_rfc2136_edit.php +++ b/src/usr/local/www/services_rfc2136_edit.php @@ -28,6 +28,15 @@ require_once("guiconfig.inc"); +$tsig_key_algos = array( + 'hmac-md5' => 'HMAC-MD5 (legacy default)', + 'hmac-sha1' => 'HMAC-SHA1', + 'hmac-sha224' => 'HMAC-SHA224', + 'hmac-sha256' => 'HMAC-SHA256 (current bind9 default)', + 'hmac-sha384' => 'HMAC-SHA384', + 'hmac-sha512' => 'HMAC-SHA512 (most secure)', +); + if (!is_array($config['dnsupdates']['dnsupdate'])) { $config['dnsupdates']['dnsupdate'] = array(); } @@ -66,22 +75,23 @@ if ($_POST['save'] || $_POST['force']) { $pconfig = $_POST; /* input validation */ - $reqdfields = array(); - $reqdfieldsn = array(); - $reqdfields = array_merge($reqdfields, explode(" ", "host ttl keyname keydata")); - $reqdfieldsn = array_merge($reqdfieldsn, array(gettext("Hostname"), gettext("TTL"), gettext("Key name"), gettext("Key"))); + $reqdfields = array('host', 'ttl', 'keyname', 'keydata'); + $reqdfieldsn = array(gettext("Hostname"), gettext("TTL"), gettext("Key name"), gettext("Key")); do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors); - if (($_POST['host'] && !is_domain($_POST['host']))) { + if ($_POST['host'] && !is_domain($_POST['host'])) { $input_errors[] = gettext("The DNS update host name contains invalid characters."); } - if (($_POST['ttl'] && !is_numericint($_POST['ttl']))) { + if ($_POST['ttl'] && !is_numericint($_POST['ttl'])) { $input_errors[] = gettext("The DNS update TTL must be an integer."); } - if (($_POST['keyname'] && !is_domain($_POST['keyname']))) { + if ($_POST['keyname'] && !is_domain($_POST['keyname'])) { $input_errors[] = gettext("The DNS update key name contains invalid characters."); } + if ($_POST['keyalgorithm'] && !array_key_exists($_POST['keyalgorithm'], $tsig_key_algos)) { + $input_errors[] = gettext("The DNS update key algorithm is invalid."); + } if (!$input_errors) { $rfc2136 = array(); @@ -192,14 +202,7 @@ $section->addInput(new Form_Select( 'keyalgorithm', '*Key algorithm', $pconfig['keyalgorithm'], - array( - 'hmac-md5' => 'HMAC-MD5 (legacy default)', - 'hmac-sha1' => 'HMAC-SHA1', - 'hmac-sha224' => 'HMAC-SHA224', - 'hmac-sha256' => 'HMAC-SHA256 (current bind9 default)', - 'hmac-sha384' => 'HMAC-SHA384', - 'hmac-sha512' => 'HMAC-SHA512 (most secure)', - ) + $tsig_key_algos )); $section->addInput(new Form_Input(