From fb8665aebd79ea33cb255f578544e1738f5bbb58 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Thu, 2 Aug 2018 23:34:45 +0200

Subject: [PATCH 1/2] Squashed commit of the following:

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

commit b49f70ce0575b6b52a71b90fe0376dbf16f92c6b

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 14:12:37 2018 +0100

    Update system tests to detect MD5 disabled at runtime

commit 80ceffee4860c24baf70bc9a8653d92731eda2e4

Author: Petr Menšík <pemensik@redhat.com>

Date:   Thu Aug 2 14:53:54 2018 +0200

    Avoid warning about undefined parameters

commit e4ad4363e3d1acaac58456117579f02761f38fdc

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Jun 20 19:31:19 2018 +0200

    Fix rndc-confgen default algorithm, report true algorithm in usage.

commit 7e629a351010cb75e0589ec361f720085675998c

Author: Petr Menšík <pemensik@redhat.com>

Date:   Fri Feb 23 21:21:30 2018 +0100

    Cleanup only if initialization was successful

commit 2101b948c77cbcbe07eb4a1e60f3e693b2245ec6

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Feb 5 12:19:28 2018 +0100

    Ensure dst backend is initialized first even before hmac algorithms.

commit 7567c7edde7519115a9ae7e20818c835d3eb1ffe

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Feb 5 12:17:54 2018 +0100

    Skip initialization of MD5 based algorithms if not available.

commit 5782137df6b45a6d900d5a1c250c1257227e917a

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Feb 5 10:21:27 2018 +0100

    Change secalgs skipping to be more safe

commit f2d78729898182d2d19d5064de1bec9b66817159

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Jan 31 18:26:11 2018 +0100

    Skip MD5 algorithm also in case of NULL name

commit 32a2ad4abc7aaca1c257730319ad3c27405d3407

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Jan 31 11:38:12 2018 +0100

    Make MD5 behave like unknown algorithm in TSIG.

commit 13cd3f704dce568fdf24a567be5802b58ac6007b

Author: Petr Menšík <pemensik@redhat.com>

Date:   Tue Nov 28 20:14:37 2017 +0100

    Select token with most supported functions, instead of demanding it must support all functions

    Initialize PKCS#11 always until successfully initialized

commit a71df74abdca4fe63bcdf542b81a109cf1f495b4

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 16:17:44 2018 +0100

    Handle MD5 unavailability from DST

commit dd82cb263efa2753d3ee772972726ea08bcc639b

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 14:11:16 2018 +0100

    Check runtime flag from library and applications, fail gracefully.

commit c7b2f87f07ecae75b821a908e29f08a42371e32e

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 08:39:08 2018 +0100

    Modify libraries to use isc_md5_available() if PK11_MD5_DISABLE is not

    defined.

    TODO: pk11.c should accept slot without MD5 support.

commit 0b8e470ec636b9e350b5ec3203eb2b4091415fde

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 07:21:04 2018 +0100

    Add runtime detection whether MD5 is useable.

---

 bin/confgen/keygen.c              | 10 ++++-

 bin/confgen/rndc-confgen.c        | 36 +++++-------------

 bin/dig/dig.c                     |  7 ++--

 bin/dig/dighost.c                 | 14 +++++--

 bin/dnssec/dnssec-keygen.c        | 14 +++++++

 bin/named/config.c                | 25 ++++++++++++-

 bin/nsupdate/nsupdate.c           | 24 +++++++-----

 bin/rndc/rndc.c                   |  3 +-

 bin/tests/optional/hash_test.c    | 78 ++++++++++++++++++++-------------------

 bin/tests/system/tkey/keycreate.c |  3 ++

 bin/tests/system/tkey/keydelete.c | 18 ++++++---

 lib/bind9/check.c                 | 10 +++++

 lib/dns/dst_api.c                 | 23 ++++++++----

 lib/dns/dst_internal.h            |  3 +-

 lib/dns/dst_parse.c               | 18 +++++++--

 lib/dns/hmac_link.c               | 20 +++-------

 lib/dns/opensslrsa_link.c         |  6 +++

 lib/dns/pkcs11rsa_link.c          | 33 +++++++++++++++--

 lib/dns/rcode.c                   | 21 ++++++++++-

 lib/dns/tests/rsa_test.c          | 29 ++++++++-------

 lib/dns/tests/tsig_test.c         |  1 +

 lib/dns/tkey.c                    |  9 +++++

 lib/dns/tsec.c                    |  8 +++-

 lib/dns/tsig.c                    | 17 +++++----

 lib/isc/include/isc/md5.h         |  3 ++

 lib/isc/md5.c                     | 59 +++++++++++++++++++++++++++++

 lib/isc/pk11.c                    | 58 ++++++++++++++++++++---------

 lib/isc/tests/hash_test.c         |  9 +++--

 lib/isccc/cc.c                    | 42 +++++++++++++--------

 29 files changed, 424 insertions(+), 177 deletions(-)

diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c

index 453c641dba..11cc54dd46 100644

--- a/bin/confgen/keygen.c

+++ b/bin/confgen/keygen.c

@@ -22,6 +22,7 @@

 #include <isc/entropy.h>

 #include <isc/file.h>

 #include <isc/keyboard.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/result.h>

@@ -73,7 +74,7 @@ alg_fromtext(const char *name) {

 		p = &name[5];

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(p, "md5") == 0)

+	if (strcasecmp(p, "md5") == 0 && isc_md5_available())

 		return DST_ALG_HMACMD5;

 #endif

 	if (strcasecmp(p, "sha1") == 0)

@@ -132,6 +133,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,

 	switch (alg) {

 #ifndef PK11_MD5_DISABLE

 	    case DST_ALG_HMACMD5:

+		if (isc_md5_available() == ISC_FALSE) {

+			fatal("unsupported algorithm %d\n", alg);

+		} else if (keysize < 1 || keysize > 512) {

+			fatal("keysize %d out of range (must be 1-512)\n",

+			      keysize);

+		}

+		break;

 #endif

 	    case DST_ALG_HMACSHA1:

 	    case DST_ALG_HMACSHA224:

diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c

index 2925baf32f..d7d8418073 100644

--- a/bin/confgen/rndc-confgen.c

+++ b/bin/confgen/rndc-confgen.c

@@ -35,6 +35,7 @@

 #include <isc/file.h>

 #include <isc/keyboard.h>

 #include <isc/mem.h>

+#include <isc/md5.h>

 #include <isc/net.h>

 #include <isc/print.h>

 #include <isc/result.h>

@@ -62,7 +63,7 @@ const char *progname;

 isc_boolean_t verbose = ISC_FALSE;

-const char *keyfile, *keydef;

+const char *keyfile, *keydef, *algdef;

 ISC_PLATFORM_NORETURN_PRE static void

 usage(int status) ISC_PLATFORM_NORETURN_POST;

@@ -70,13 +71,12 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;

 static void

 usage(int status) {

-#ifndef PK11_MD5_DISABLE

 	fprintf(stderr, "\

 Usage:\n\

  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \

 [-s addr] [-t chrootdir] [-u user]\n\

   -a:		 generate just the key clause and write it to keyfile (%s)\n\

-  -A alg:	 algorithm (default hmac-md5)\n\

+  -A alg:	 algorithm (default %s)\n\

   -b bits:	 from 1 through 512, default 256; total length of the secret\n\

   -c keyfile:	 specify an alternate key file (requires -a)\n\

   -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\

@@ -85,24 +85,7 @@ Usage:\n\

   -s addr:	 the address to which rndc should connect\n\

   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\

   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",

-		 progname, keydef);

-#else

-	fprintf(stderr, "\

-Usage:\n\

- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \

-[-s addr] [-t chrootdir] [-u user]\n\

-  -a:		 generate just the key clause and write it to keyfile (%s)\n\

-  -A alg:	 algorithm (default hmac-sha256)\n\

-  -b bits:	 from 1 through 512, default 256; total length of the secret\n\

-  -c keyfile:	 specify an alternate key file (requires -a)\n\

-  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\

-  -p port:	 the port named will listen on and rndc will connect to\n\

-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\

-  -s addr:	 the address to which rndc should connect\n\

-  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\

-  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",

-		 progname, keydef);

-#endif

+		 progname, keydef, algdef);

 	exit (status);

 }

@@ -138,13 +121,14 @@ main(int argc, char **argv) {

 	progname = program;

 	keyname = DEFAULT_KEYNAME;

-#ifndef PK11_MD5_DISABLE

-	alg = DST_ALG_HMACMD5;

-#else

-	alg = DST_ALG_HMACSHA256;

-#endif

 	serveraddr = DEFAULT_SERVER;

 	port = DEFAULT_PORT;

+	alg = DST_ALG_HMACSHA256;

+#ifndef PK11_MD5_DISABLE

+	if (isc_md5_available())

+		alg = DST_ALG_HMACMD5;

+#endif

+	algdef = alg_totext(alg);

 	isc_commandline_errprint = ISC_FALSE;

diff --git a/bin/dig/dig.c b/bin/dig/dig.c

index d4808ada67..9dff7c8ecd 100644

--- a/bin/dig/dig.c

+++ b/bin/dig/dig.c

@@ -17,6 +17,7 @@

 #include <ctype.h>

 #include <isc/app.h>

+#include <isc/md5.h>

 #include <isc/netaddr.h>

 #include <isc/parseint.h>

 #include <isc/platform.h>

@@ -1757,10 +1758,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,

 			ptr = ptr2;

 			ptr2 = ptr3;

 		} else  {

-#ifndef PK11_MD5_DISABLE

-			hmacname = DNS_TSIG_HMACMD5_NAME;

-#else

 			hmacname = DNS_TSIG_HMACSHA256_NAME;

+#ifndef PK11_MD5_DISABLE

+			if (isc_md5_available())

+				hmacname = DNS_TSIG_HMACMD5_NAME;

 #endif

 			digestbits = 0;

 		}

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c

index ecefc98453..94c428ed30 100644

--- a/bin/dig/dighost.c

+++ b/bin/dig/dighost.c

@@ -77,6 +77,7 @@

 #include <isc/hex.h>

 #include <isc/lang.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/netaddr.h>

 #include <isc/netdb.h>

 #include <isc/parseint.h>

@@ -1243,9 +1244,10 @@ parse_hmac(const char *hmac) {

 	digestbits = 0;

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(buf, "hmac-md5") == 0) {

+	if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {

 		hmacname = DNS_TSIG_HMACMD5_NAME;

-	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {

+	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&

+		   isc_md5_available()) {

 		hmacname = DNS_TSIG_HMACMD5_NAME;

 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);

 	} else

@@ -1365,7 +1367,13 @@ setup_file_key(void) {

 	switch (dst_key_alg(dstkey)) {

 #ifndef PK11_MD5_DISABLE

 	case DST_ALG_HMACMD5:

-		hmacname = DNS_TSIG_HMACMD5_NAME;

+		if (isc_md5_available()) {

+			hmacname = DNS_TSIG_HMACMD5_NAME;

+		} else {

+			printf(";; Couldn't create key %s: bad algorithm\n",

+			       keynametext);

+			goto failure;

+		}

 		break;

 #endif

 	case DST_ALG_HMACSHA1:

diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c

index 6fc3ab0979..fc04356ed4 100644

--- a/bin/dnssec/dnssec-keygen.c

+++ b/bin/dnssec/dnssec-keygen.c

@@ -34,6 +34,7 @@

 #include <isc/buffer.h>

 #include <isc/commandline.h>

 #include <isc/entropy.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/region.h>

@@ -560,6 +561,19 @@ main(int argc, char **argv) {

 					"\"-a RSAMD5\"\n");

 			INSIST(freeit == NULL);

 			return (1);

+		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {

+			if (isc_md5_available()) {

+				alg = DST_ALG_HMACMD5;

+			} else {

+				fprintf(stderr,

+					"The use of HMAC-MD5 was disabled\n");

+				return (1);

+			}

+		} else if (strcasecmp(algname, "RSAMD5") == 0 &&

+			   isc_md5_available() == ISC_FALSE) {

+			fprintf(stderr, "The use of RSAMD5 was disabled\n");

+			INSIST(freeit == NULL);

+			return (1);

 		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {

 			alg = DST_ALG_HMACMD5;

 #else

diff --git a/bin/named/config.c b/bin/named/config.c

index 54bc37fff7..c50f759ddd 100644

--- a/bin/named/config.c

+++ b/bin/named/config.c

@@ -17,6 +17,7 @@

 #include <isc/buffer.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/parseint.h>

 #include <isc/region.h>

@@ -966,6 +967,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,

 	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));

 }

+static inline int

+algorithms_start() {

+#ifndef PK11_MD5_DISABLE

+	if (isc_md5_available() == ISC_FALSE) {

+		int i = 0;

+		while (algorithms[i].str != NULL &&

+			algorithms[i].hmac == hmacmd5) {

+			i++;

+		}

+		return i;

+	}

+#endif

+	return 0;

+}

+

 isc_result_t

 ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,

 			   unsigned int *typep, isc_uint16_t *digestbits)

@@ -975,7 +991,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,

 	isc_uint16_t bits;

 	isc_result_t result;

-	for (i = 0; algorithms[i].str != NULL; i++) {

+	for (i = algorithms_start(); algorithms[i].str != NULL; i++) {

 		len = strlen(algorithms[i].str);

 		if (strncasecmp(algorithms[i].str, str, len) == 0 &&

 		    (str[len] == '\0' ||

@@ -998,7 +1014,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,

 	if (name != NULL) {

 		switch (algorithms[i].hmac) {

 #ifndef PK11_MD5_DISABLE

-		case hmacmd5: *name = dns_tsig_hmacmd5_name; break;

+		case hmacmd5:

+			if (isc_md5_available()) {

+				*name = dns_tsig_hmacmd5_name; break;

+			} else {

+				return (ISC_R_NOTFOUND);

+			}

 #endif

 		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;

 		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c

index 6967b49754..bb5d50038f 100644

--- a/bin/nsupdate/nsupdate.c

+++ b/bin/nsupdate/nsupdate.c

@@ -29,6 +29,7 @@

 #include <isc/hash.h>

 #include <isc/lex.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/parseint.h>

 #include <isc/print.h>

@@ -474,9 +475,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,

 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(buf, "hmac-md5") == 0) {

+	if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {

 		*hmac = DNS_TSIG_HMACMD5_NAME;

-	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {

+	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&

+		   isc_md5_available()) {

 		*hmac = DNS_TSIG_HMACMD5_NAME;

 		result = isc_parse_uint16(&digestbits, &buf[9], 10);

 		if (result != ISC_R_SUCCESS || digestbits > 128) {

@@ -589,10 +591,10 @@ setup_keystr(void) {

 			exit(1);

 		}

 	} else {

-#ifndef PK11_MD5_DISABLE

-		hmacname = DNS_TSIG_HMACMD5_NAME;

-#else

 		hmacname = DNS_TSIG_HMACSHA256_NAME;

+#ifndef PK11_MD5_DISABLE

+		if (isc_md5_available())

+			hmacname = DNS_TSIG_HMACMD5_NAME;

 #endif

 		name = keystr;

 		n = s;

@@ -729,7 +731,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {

 	switch (dst_key_alg(dstkey)) {

 #ifndef PK11_MD5_DISABLE

 	case DST_ALG_HMACMD5:

-		hmacname = DNS_TSIG_HMACMD5_NAME;

+		if (isc_md5_available())

+			hmacname = DNS_TSIG_HMACMD5_NAME;

 		break;

 #endif

 	case DST_ALG_HMACSHA1:

@@ -1604,12 +1607,13 @@ evaluate_key(char *cmdline) {

 			return (STATUS_SYNTAX);

 		}

 		namestr = n + 1;

-	} else

-#ifndef PK11_MD5_DISABLE

-		hmacname = DNS_TSIG_HMACMD5_NAME;

-#else

+	} else {

 		hmacname = DNS_TSIG_HMACSHA256_NAME;

+#ifndef PK11_MD5_DISABLE

+		if (isc_md5_available())

+			hmacname = DNS_TSIG_HMACMD5_NAME;

 #endif

+	}

 	isc_buffer_init(&b, namestr, strlen(namestr));

 	isc_buffer_add(&b, strlen(namestr));

diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c

index 5c29caf86b..617b06b4a1 100644

--- a/bin/rndc/rndc.c

+++ b/bin/rndc/rndc.c

@@ -21,6 +21,7 @@

 #include <isc/file.h>

 #include <isc/log.h>

 #include <isc/net.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/random.h>

@@ -634,7 +635,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,

 	algorithmstr = cfg_obj_asstring(algorithmobj);

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(algorithmstr, "hmac-md5") == 0)

+	if (strcasecmp(algorithmstr, "hmac-md5") == 0 && isc_md5_available())

 		algorithm = ISCCC_ALG_HMACMD5;

 	else

 #endif

diff --git a/bin/tests/optional/hash_test.c b/bin/tests/optional/hash_test.c

index bf2891ad4c..b5f0a1c5f5 100644

--- a/bin/tests/optional/hash_test.c

+++ b/bin/tests/optional/hash_test.c

@@ -90,43 +90,47 @@ main(int argc, char **argv) {

 	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);

 #ifndef PK11_MD5_DISABLE

-	s = "abc";

-	isc_md5_init(&md5;;

-	memmove(buffer, s, strlen(s));

-	isc_md5_update(&md5, buffer, strlen(s));

-	isc_md5_final(&md5, digest);

-	print_digest(s, "md5", digest, 4);

-

-	/*

-	 * The 3 HMAC-MD5 examples from RFC2104

-	 */

-	s = "Hi There";

-	memset(key, 0x0b, 16);

-	isc_hmacmd5_init(&hmacmd5, key, 16);

-	memmove(buffer, s, strlen(s));

-	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

-	isc_hmacmd5_sign(&hmacmd5, digest);

-	print_digest(s, "hmacmd5", digest, 4);

-

-	s = "what do ya want for nothing?";

-	strlcpy((char *)key, "Jefe", sizeof(key));

-	isc_hmacmd5_init(&hmacmd5, key, 4);

-	memmove(buffer, s, strlen(s));

-	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

-	isc_hmacmd5_sign(&hmacmd5, digest);

-	print_digest(s, "hmacmd5", digest, 4);

-

-	s = "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335";

-	memset(key, 0xaa, 16);

-	isc_hmacmd5_init(&hmacmd5, key, 16);

-	memmove(buffer, s, strlen(s));

-	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

-	isc_hmacmd5_sign(&hmacmd5, digest);

-	print_digest(s, "hmacmd5", digest, 4);

+	if (isc_md5_available()) {

+		s = "abc";

+		isc_md5_init(&md5;;

+		memmove(buffer, s, strlen(s));

+		isc_md5_update(&md5, buffer, strlen(s));

+		isc_md5_final(&md5, digest);

+		print_digest(s, "md5", digest, 4);

+

+		/*

+		 * The 3 HMAC-MD5 examples from RFC2104

+		 */

+		s = "Hi There";

+		memset(key, 0x0b, 16);

+		isc_hmacmd5_init(&hmacmd5, key, 16);

+		memmove(buffer, s, strlen(s));

+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

+		isc_hmacmd5_sign(&hmacmd5, digest);

+		print_digest(s, "hmacmd5", digest, 4);

+

+		s = "what do ya want for nothing?";

+		strlcpy((char *)key, "Jefe", sizeof(key));

+		isc_hmacmd5_init(&hmacmd5, key, 4);

+		memmove(buffer, s, strlen(s));

+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

+		isc_hmacmd5_sign(&hmacmd5, digest);

+		print_digest(s, "hmacmd5", digest, 4);

+

+		s = "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335";

+		memset(key, 0xaa, 16);

+		isc_hmacmd5_init(&hmacmd5, key, 16);

+		memmove(buffer, s, strlen(s));

+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

+		isc_hmacmd5_sign(&hmacmd5, digest);

+		print_digest(s, "hmacmd5", digest, 4);

+	} else {

+		fprintf(stderr, "Skipping disabled MD5 algorithm\n");

+	}

 #endif

 	/*

diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c

index 2a0ee94888..489f4390dc 100644

--- a/bin/tests/system/tkey/keycreate.c

+++ b/bin/tests/system/tkey/keycreate.c

@@ -20,6 +20,7 @@

 #include <isc/entropy.h>

 #include <isc/hash.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/sockaddr.h>

@@ -142,6 +143,8 @@ sendquery(isc_task_t *task, isc_event_t *event) {

 	static char keystr[] = "0123456789ab";

 	isc_event_free(&event);

+	if (isc_md5_available() == ISC_FALSE)

+		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);

 	result = ISC_R_FAILURE;

 	if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1)

diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c

index 7057c318e4..36ee6c7d21 100644

--- a/bin/tests/system/tkey/keydelete.c

+++ b/bin/tests/system/tkey/keydelete.c

@@ -225,12 +225,18 @@ main(int argc, char **argv) {

 	result = dst_key_fromnamedfile(keyname, NULL, type, mctx, &dstkey);

 	CHECK("dst_key_fromnamedfile", result);

 #ifndef PK11_MD5_DISABLE

-	result = dns_tsigkey_createfromkey(dst_key_name(dstkey),

-					   DNS_TSIG_HMACMD5_NAME,

-					   dstkey, ISC_TRUE, NULL, 0, 0,

-					   mctx, ring, &tsigkey);

-	dst_key_free(&dstkey);

-	CHECK("dns_tsigkey_createfromkey", result);

+	if (isc_md5_available()) {

+		result = dns_tsigkey_createfromkey(dst_key_name(dstkey),

+						   DNS_TSIG_HMACMD5_NAME,

+						   dstkey, ISC_TRUE,

+						   NULL, 0, 0,

+						   mctx, ring, &tsigkey);

+		dst_key_free(&dstkey);

+		CHECK("dns_tsigkey_createfromkey", result);

+	} else {

+		dst_key_free(&dstkey);

+		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);

+	}

 #else

 	dst_key_free(&dstkey);

 	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);

diff --git a/lib/bind9/check.c b/lib/bind9/check.c

index 3da83a7ae2..1a3d534799 100644

--- a/lib/bind9/check.c

+++ b/lib/bind9/check.c

@@ -21,6 +21,7 @@

 #include <isc/file.h>

 #include <isc/hex.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/netaddr.h>

 #include <isc/parseint.h>

@@ -2572,6 +2573,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {

 	}

 	algorithm = cfg_obj_asstring(algobj);

+#ifndef PK11_MD5_DISABLE

+	/* Skip hmac-md5* algorithms */

+	if (isc_md5_available() == ISC_FALSE &&

+	    strncasecmp(algorithm, "hmac-md5", 8) == 0) {

+		cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,

+			    "disabled algorithm '%s'", algorithm);

+		return (ISC_R_DISABLED);

+	}

+#endif

 	for (i = 0; algorithms[i].name != NULL; i++) {

 		len = strlen(algorithms[i].name);

 		if (strncasecmp(algorithms[i].name, algorithm, len) == 0 &&

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c

index 4f3d6ac55c..dbece0ac56 100644

--- a/lib/dns/dst_api.c

+++ b/lib/dns/dst_api.c

@@ -190,6 +190,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,

 	dst_result_register();

 	memset(dst_t_func, 0, sizeof(dst_t_func));

+

+#ifdef OPENSSL

+	RETERR(dst__openssl_init(engine));

+#elif PKCS11CRYPTO

+	RETERR(dst__pkcs11_init(mctx, engine));

+#endif

 #ifndef PK11_MD5_DISABLE

 	RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));

 #endif

@@ -199,7 +205,6 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,

 	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));

 	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));

 #ifdef OPENSSL

-	RETERR(dst__openssl_init(engine));

 #ifndef PK11_MD5_DISABLE

 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],

 				    DST_ALG_RSAMD5));

@@ -233,14 +238,18 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,

 	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448]));

 #endif

 #elif PKCS11CRYPTO

-	RETERR(dst__pkcs11_init(mctx, engine));

 #ifndef PK11_MD5_DISABLE

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5]));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5],

+				   DST_ALG_RSAMD5));

 #endif

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1]));

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1]));

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256]));

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1],

+				   DST_ALG_RSASHA1));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],

+				   DST_ALG_NSEC3RSASHA1));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256],

+				   DST_ALG_RSASHA256));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512],

+				   DST_ALG_RSASHA512));

 #ifndef PK11_DSA_DISABLE

 	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));

 	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));

diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h

index 640519a5ba..deb7ed4e13 100644

--- a/lib/dns/dst_internal.h

+++ b/lib/dns/dst_internal.h

@@ -245,7 +245,8 @@ isc_result_t dst__hmacsha384_init(struct dst_func **funcp);

 isc_result_t dst__hmacsha512_init(struct dst_func **funcp);

 isc_result_t dst__opensslrsa_init(struct dst_func **funcp,

 				  unsigned char algorithm);

-isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp);

+isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp,

+				 unsigned char algorithm);

 #ifndef PK11_DSA_DISABLE

 isc_result_t dst__openssldsa_init(struct dst_func **funcp);

 isc_result_t dst__pkcs11dsa_init(struct dst_func **funcp);

diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c