From 9ff202072b286ef57e0ffcd7c55777f2994d3985 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Thu, 2 Aug 2018 23:34:45 +0200

Subject: [PATCH] FIPS code changes

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Squashed commit of the following:

commit b49f70ce0575b6b52a71b90fe0376dbf16f92c6b

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 14:12:37 2018 +0100

    Update system tests to detect MD5 disabled at runtime

commit 80ceffee4860c24baf70bc9a8653d92731eda2e4

Author: Petr Menšík <pemensik@redhat.com>

Date:   Thu Aug 2 14:53:54 2018 +0200

    Avoid warning about undefined parameters

commit e4ad4363e3d1acaac58456117579f02761f38fdc

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Jun 20 19:31:19 2018 +0200

    Fix rndc-confgen default algorithm, report true algorithm in usage.

commit 7e629a351010cb75e0589ec361f720085675998c

Author: Petr Menšík <pemensik@redhat.com>

Date:   Fri Feb 23 21:21:30 2018 +0100

    Cleanup only if initialization was successful

commit 2101b948c77cbcbe07eb4a1e60f3e693b2245ec6

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Feb 5 12:19:28 2018 +0100

    Ensure dst backend is initialized first even before hmac algorithms.

commit 7567c7edde7519115a9ae7e20818c835d3eb1ffe

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Feb 5 12:17:54 2018 +0100

    Skip initialization of MD5 based algorithms if not available.

commit 5782137df6b45a6d900d5a1c250c1257227e917a

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Feb 5 10:21:27 2018 +0100

    Change secalgs skipping to be more safe

commit f2d78729898182d2d19d5064de1bec9b66817159

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Jan 31 18:26:11 2018 +0100

    Skip MD5 algorithm also in case of NULL name

commit 32a2ad4abc7aaca1c257730319ad3c27405d3407

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Jan 31 11:38:12 2018 +0100

    Make MD5 behave like unknown algorithm in TSIG.

commit 13cd3f704dce568fdf24a567be5802b58ac6007b

Author: Petr Menšík <pemensik@redhat.com>

Date:   Tue Nov 28 20:14:37 2017 +0100

    Select token with most supported functions, instead of demanding it must support all functions

    Initialize PKCS#11 always until successfully initialized

commit a71df74abdca4fe63bcdf542b81a109cf1f495b4

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 16:17:44 2018 +0100

    Handle MD5 unavailability from DST

commit dd82cb263efa2753d3ee772972726ea08bcc639b

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 14:11:16 2018 +0100

    Check runtime flag from library and applications, fail gracefully.

commit c7b2f87f07ecae75b821a908e29f08a42371e32e

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 08:39:08 2018 +0100

    Modify libraries to use isc_md5_available() if PK11_MD5_DISABLE is not

    defined.

    TODO: pk11.c should accept slot without MD5 support.

commit 0b8e470ec636b9e350b5ec3203eb2b4091415fde

Author: Petr Menšík <pemensik@redhat.com>

Date:   Mon Jan 22 07:21:04 2018 +0100

    Add runtime detection whether MD5 is useable.

---

 bin/confgen/keygen.c              | 10 +++-

 bin/confgen/rndc-confgen.c        | 32 ++++---------

 bin/dig/dig.c                     |  7 +--

 bin/dig/dighost.c                 | 14 ++++--

 bin/dnssec/dnssec-keygen.c        | 14 ++++++

 bin/named/config.c                | 25 +++++++++-

 bin/nsupdate/nsupdate.c           | 24 ++++++----

 bin/rndc/rndc.c                   |  3 +-

 bin/tests/optional/hash_test.c    | 78 ++++++++++++++++---------------

 bin/tests/system/tkey/keycreate.c |  3 ++

 bin/tests/system/tkey/keydelete.c | 17 ++++---

 lib/bind9/check.c                 | 10 ++++

 lib/dns/dst_api.c                 | 23 ++++++---

 lib/dns/dst_internal.h            |  3 +-

 lib/dns/dst_parse.c               | 18 +++++--

 lib/dns/hmac_link.c               | 18 ++-----

 lib/dns/opensslrsa_link.c         |  6 +++

 lib/dns/pkcs11rsa_link.c          | 33 +++++++++++--

 lib/dns/rcode.c                   | 21 ++++++++-

 lib/dns/tests/rsa_test.c          |  4 ++

 lib/dns/tests/tsig_test.c         |  1 +

 lib/dns/tkey.c                    |  9 ++++

 lib/dns/tsec.c                    |  8 +++-

 lib/dns/tsig.c                    | 17 ++++---

 lib/isc/include/isc/md5.h         |  3 ++

 lib/isc/md5.c                     | 59 +++++++++++++++++++++++

 lib/isc/pk11.c                    | 44 +++++++++++------

 lib/isc/tests/hash_test.c         |  9 ++++

 lib/isccc/cc.c                    | 42 +++++++++++------

 29 files changed, 400 insertions(+), 155 deletions(-)

diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c

index 8931ad5..5015abb 100644

--- a/bin/confgen/keygen.c

+++ b/bin/confgen/keygen.c

@@ -22,6 +22,7 @@

 #include <isc/entropy.h>

 #include <isc/file.h>

 #include <isc/keyboard.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/result.h>

@@ -73,7 +74,7 @@ alg_fromtext(const char *name) {

 		p = &name[5];

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(p, "md5") == 0)

+	if (strcasecmp(p, "md5") == 0 && isc_md5_available())

 		return DST_ALG_HMACMD5;

 #endif

 	if (strcasecmp(p, "sha1") == 0)

@@ -132,6 +133,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,

 	switch (alg) {

 #ifndef PK11_MD5_DISABLE

 	    case DST_ALG_HMACMD5:

+		if (!isc_md5_available()) {

+			fatal("unsupported algorithm %d\n", alg);

+		} else if (keysize < 1 || keysize > 512) {

+			fatal("keysize %d out of range (must be 1-512)\n",

+			      keysize);

+		}

+		break;

 #endif

 	    case DST_ALG_HMACSHA1:

 	    case DST_ALG_HMACSHA224:

diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c

index 5ca3d76..6b7790a 100644

--- a/bin/confgen/rndc-confgen.c

+++ b/bin/confgen/rndc-confgen.c

@@ -36,6 +36,7 @@

 #include <isc/file.h>

 #include <isc/keyboard.h>

 #include <isc/mem.h>

+#include <isc/md5.h>

 #include <isc/net.h>

 #include <isc/print.h>

 #include <isc/result.h>

@@ -63,7 +64,7 @@ const char *progname;

 bool verbose = false;

-const char *keyfile, *keydef;

+const char *keyfile, *keydef, *algdef;

 ISC_PLATFORM_NORETURN_PRE static void

 usage(int status) ISC_PLATFORM_NORETURN_POST;

@@ -71,13 +72,12 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;

 static void

 usage(int status) {

-#ifndef PK11_MD5_DISABLE

 	fprintf(stderr, "\

 Usage:\n\

  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \

 [-s addr] [-t chrootdir] [-u user]\n\

   -a:		 generate just the key clause and write it to keyfile (%s)\n\

-  -A alg:	 algorithm (default hmac-md5)\n\

+  -A alg:	 algorithm (default %s)\n\

   -b bits:	 from 1 through 512, default 256; total length of the secret\n\

   -c keyfile:	 specify an alternate key file (requires -a)\n\

   -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\

@@ -86,24 +86,7 @@ Usage:\n\

   -s addr:	 the address to which rndc should connect\n\

   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\

   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",

-		 progname, keydef);

-#else

-	fprintf(stderr, "\

-Usage:\n\

- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \

-[-s addr] [-t chrootdir] [-u user]\n\

-  -a:		 generate just the key clause and write it to keyfile (%s)\n\

-  -A alg:	 algorithm (default hmac-sha256)\n\

-  -b bits:	 from 1 through 512, default 256; total length of the secret\n\

-  -c keyfile:	 specify an alternate key file (requires -a)\n\

-  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\

-  -p port:	 the port named will listen on and rndc will connect to\n\

-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\

-  -s addr:	 the address to which rndc should connect\n\

-  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\

-  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",

-		 progname, keydef);

-#endif

+		 progname, keydef, algdef);

 	exit (status);

 }

@@ -139,11 +122,12 @@ main(int argc, char **argv) {

 	progname = program;

 	keyname = DEFAULT_KEYNAME;

-#ifndef PK11_MD5_DISABLE

-	alg = DST_ALG_HMACMD5;

-#else

 	alg = DST_ALG_HMACSHA256;

+#ifndef PK11_MD5_DISABLE

+	if (isc_md5_available())

+		alg = DST_ALG_HMACMD5;

 #endif

+	algdef = alg_totext(alg);

 	serveraddr = DEFAULT_SERVER;

 	port = DEFAULT_PORT;

diff --git a/bin/dig/dig.c b/bin/dig/dig.c

index 2063a3b..8e856c5 100644

--- a/bin/dig/dig.c

+++ b/bin/dig/dig.c

@@ -20,6 +20,7 @@

 #include <ctype.h>

 #include <isc/app.h>

+#include <isc/md5.h>

 #include <isc/netaddr.h>

 #include <isc/parseint.h>

 #include <isc/platform.h>

@@ -1767,10 +1768,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,

 			ptr = ptr2;

 			ptr2 = ptr3;

 		} else  {

-#ifndef PK11_MD5_DISABLE

-			hmacname = DNS_TSIG_HMACMD5_NAME;

-#else

 			hmacname = DNS_TSIG_HMACSHA256_NAME;

+#ifndef PK11_MD5_DISABLE

+			if (isc_md5_available())

+				hmacname = DNS_TSIG_HMACMD5_NAME;

 #endif

 			digestbits = 0;

 		}

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c

index 011b118..5eabc1f 100644

--- a/bin/dig/dighost.c

+++ b/bin/dig/dighost.c

@@ -80,6 +80,7 @@

 #include <isc/hex.h>

 #include <isc/lang.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/netaddr.h>

 #include <isc/netdb.h>

 #include <isc/parseint.h>

@@ -1246,9 +1247,10 @@ parse_hmac(const char *hmac) {

 	digestbits = 0;

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(buf, "hmac-md5") == 0) {

+	if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {

 		hmacname = DNS_TSIG_HMACMD5_NAME;

-	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {

+	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&

+		   isc_md5_available()) {

 		hmacname = DNS_TSIG_HMACMD5_NAME;

 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);

 	} else

@@ -1368,7 +1370,13 @@ setup_file_key(void) {

 	switch (dst_key_alg(dstkey)) {

 #ifndef PK11_MD5_DISABLE

 	case DST_ALG_HMACMD5:

-		hmacname = DNS_TSIG_HMACMD5_NAME;

+		if (isc_md5_available()) {

+			hmacname = DNS_TSIG_HMACMD5_NAME;

+		} else {

+			printf(";; Couldn't create key %s: bad algorithm\n",

+			       keynametext);

+			goto failure;

+		}

 		break;

 #endif

 	case DST_ALG_HMACSHA1:

diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c

index 1476d0d..f5c9316 100644

--- a/bin/dnssec/dnssec-keygen.c

+++ b/bin/dnssec/dnssec-keygen.c

@@ -36,6 +36,7 @@

 #include <isc/buffer.h>

 #include <isc/commandline.h>

 #include <isc/entropy.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/region.h>

@@ -562,6 +563,19 @@ main(int argc, char **argv) {

 					"\"-a RSAMD5\"\n");

 			INSIST(freeit == NULL);

 			return (1);

+		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {

+			if (isc_md5_available()) {

+				alg = DST_ALG_HMACMD5;

+			} else {

+				fprintf(stderr,

+					"The use of HMAC-MD5 was disabled\n");

+				return (1);

+			}

+		} else if (strcasecmp(algname, "RSAMD5") == 0 &&

+			   !isc_md5_available()) {

+			fprintf(stderr, "The use of RSAMD5 was disabled\n");

+			INSIST(freeit == NULL);

+			return (1);

 		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {

 			alg = DST_ALG_HMACMD5;

 #else

diff --git a/bin/named/config.c b/bin/named/config.c

index 7584efb..a153172 100644

--- a/bin/named/config.c

+++ b/bin/named/config.c

@@ -18,6 +18,7 @@

 #include <isc/buffer.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/parseint.h>

 #include <isc/region.h>

@@ -969,6 +970,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,

 	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));

 }

+static inline int

+algorithms_start() {

+#ifndef PK11_MD5_DISABLE

+	if (!isc_md5_available()) {

+		int i = 0;

+		while (algorithms[i].str != NULL &&

+			algorithms[i].hmac == hmacmd5) {

+			i++;

+		}

+		return i;

+	}

+#endif

+	return 0;

+}

+

 isc_result_t

 ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,

 			   unsigned int *typep, uint16_t *digestbits)

@@ -978,7 +994,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,

 	uint16_t bits;

 	isc_result_t result;

-	for (i = 0; algorithms[i].str != NULL; i++) {

+	for (i = algorithms_start(); algorithms[i].str != NULL; i++) {

 		len = strlen(algorithms[i].str);

 		if (strncasecmp(algorithms[i].str, str, len) == 0 &&

 		    (str[len] == '\0' ||

@@ -1001,7 +1017,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,

 	if (name != NULL) {

 		switch (algorithms[i].hmac) {

 #ifndef PK11_MD5_DISABLE

-		case hmacmd5: *name = dns_tsig_hmacmd5_name; break;

+		case hmacmd5:

+			if (isc_md5_available()) {

+				*name = dns_tsig_hmacmd5_name; break;

+			} else {

+				return (ISC_R_NOTFOUND);

+			}

 #endif

 		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;

 		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c

index 548e0ce..509784c 100644

--- a/bin/nsupdate/nsupdate.c

+++ b/bin/nsupdate/nsupdate.c

@@ -31,6 +31,7 @@

 #include <isc/hash.h>

 #include <isc/lex.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/parseint.h>

 #include <isc/print.h>

@@ -476,9 +477,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,

 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(buf, "hmac-md5") == 0) {

+	if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {

 		*hmac = DNS_TSIG_HMACMD5_NAME;

-	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {

+	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&

+		   isc_md5_available()) {

 		*hmac = DNS_TSIG_HMACMD5_NAME;

 		result = isc_parse_uint16(&digestbits, &buf[9], 10);

 		if (result != ISC_R_SUCCESS || digestbits > 128) {

@@ -591,10 +593,10 @@ setup_keystr(void) {

 			exit(1);

 		}

 	} else {

-#ifndef PK11_MD5_DISABLE

-		hmacname = DNS_TSIG_HMACMD5_NAME;

-#else

 		hmacname = DNS_TSIG_HMACSHA256_NAME;

+#ifndef PK11_MD5_DISABLE

+		if (isc_md5_available())

+			hmacname = DNS_TSIG_HMACMD5_NAME;

 #endif

 		name = keystr;

 		n = s;

@@ -731,7 +733,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {

 	switch (dst_key_alg(dstkey)) {

 #ifndef PK11_MD5_DISABLE

 	case DST_ALG_HMACMD5:

-		hmacname = DNS_TSIG_HMACMD5_NAME;

+		if (isc_md5_available())

+			hmacname = DNS_TSIG_HMACMD5_NAME;

 		break;

 #endif

 	case DST_ALG_HMACSHA1:

@@ -1606,12 +1609,13 @@ evaluate_key(char *cmdline) {

 			return (STATUS_SYNTAX);

 		}

 		namestr = n + 1;

-	} else

-#ifndef PK11_MD5_DISABLE

-		hmacname = DNS_TSIG_HMACMD5_NAME;

-#else

+	} else {

 		hmacname = DNS_TSIG_HMACSHA256_NAME;

+#ifndef PK11_MD5_DISABLE

+		if (isc_md5_available())

+			hmacname = DNS_TSIG_HMACMD5_NAME;

 #endif

+	}

 	isc_buffer_init(&b, namestr, strlen(namestr));

 	isc_buffer_add(&b, strlen(namestr));

diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c

index 9eb0ce0..8083654 100644

--- a/bin/rndc/rndc.c

+++ b/bin/rndc/rndc.c

@@ -23,6 +23,7 @@

 #include <isc/file.h>

 #include <isc/log.h>

 #include <isc/net.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/random.h>

@@ -636,7 +637,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,

 	algorithmstr = cfg_obj_asstring(algorithmobj);

 #ifndef PK11_MD5_DISABLE

-	if (strcasecmp(algorithmstr, "hmac-md5") == 0)

+	if (strcasecmp(algorithmstr, "hmac-md5") == 0 && isc_md5_available())

 		algorithm = ISCCC_ALG_HMACMD5;

 	else

 #endif

diff --git a/bin/tests/optional/hash_test.c b/bin/tests/optional/hash_test.c

index bf2891a..b5f0a1c 100644

--- a/bin/tests/optional/hash_test.c

+++ b/bin/tests/optional/hash_test.c

@@ -90,43 +90,47 @@ main(int argc, char **argv) {

 	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);

 #ifndef PK11_MD5_DISABLE

-	s = "abc";

-	isc_md5_init(&md5;;

-	memmove(buffer, s, strlen(s));

-	isc_md5_update(&md5, buffer, strlen(s));

-	isc_md5_final(&md5, digest);

-	print_digest(s, "md5", digest, 4);

-

-	/*

-	 * The 3 HMAC-MD5 examples from RFC2104

-	 */

-	s = "Hi There";

-	memset(key, 0x0b, 16);

-	isc_hmacmd5_init(&hmacmd5, key, 16);

-	memmove(buffer, s, strlen(s));

-	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

-	isc_hmacmd5_sign(&hmacmd5, digest);

-	print_digest(s, "hmacmd5", digest, 4);

-

-	s = "what do ya want for nothing?";

-	strlcpy((char *)key, "Jefe", sizeof(key));

-	isc_hmacmd5_init(&hmacmd5, key, 4);

-	memmove(buffer, s, strlen(s));

-	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

-	isc_hmacmd5_sign(&hmacmd5, digest);

-	print_digest(s, "hmacmd5", digest, 4);

-

-	s = "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335"

-	    "\335\335\335\335\335\335\335\335\335\335";

-	memset(key, 0xaa, 16);

-	isc_hmacmd5_init(&hmacmd5, key, 16);

-	memmove(buffer, s, strlen(s));

-	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

-	isc_hmacmd5_sign(&hmacmd5, digest);

-	print_digest(s, "hmacmd5", digest, 4);

+	if (isc_md5_available()) {

+		s = "abc";

+		isc_md5_init(&md5;;

+		memmove(buffer, s, strlen(s));

+		isc_md5_update(&md5, buffer, strlen(s));

+		isc_md5_final(&md5, digest);

+		print_digest(s, "md5", digest, 4);

+

+		/*

+		 * The 3 HMAC-MD5 examples from RFC2104

+		 */

+		s = "Hi There";

+		memset(key, 0x0b, 16);

+		isc_hmacmd5_init(&hmacmd5, key, 16);

+		memmove(buffer, s, strlen(s));

+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

+		isc_hmacmd5_sign(&hmacmd5, digest);

+		print_digest(s, "hmacmd5", digest, 4);

+

+		s = "what do ya want for nothing?";

+		strlcpy((char *)key, "Jefe", sizeof(key));

+		isc_hmacmd5_init(&hmacmd5, key, 4);

+		memmove(buffer, s, strlen(s));

+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

+		isc_hmacmd5_sign(&hmacmd5, digest);

+		print_digest(s, "hmacmd5", digest, 4);

+

+		s = "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335"

+		    "\335\335\335\335\335\335\335\335\335\335";

+		memset(key, 0xaa, 16);

+		isc_hmacmd5_init(&hmacmd5, key, 16);

+		memmove(buffer, s, strlen(s));

+		isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));

+		isc_hmacmd5_sign(&hmacmd5, digest);

+		print_digest(s, "hmacmd5", digest, 4);

+	} else {

+		fprintf(stderr, "Skipping disabled MD5 algorithm\n");

+	}

 #endif

 	/*

diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c

index 5a00f86..653c951 100644

--- a/bin/tests/system/tkey/keycreate.c

+++ b/bin/tests/system/tkey/keycreate.c

@@ -20,6 +20,7 @@

 #include <isc/entropy.h>

 #include <isc/hash.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/sockaddr.h>

@@ -142,6 +143,8 @@ sendquery(isc_task_t *task, isc_event_t *event) {

 	static char keystr[] = "0123456789ab";

 	isc_event_free(&event);

+	if (!isc_md5_available())

+		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);

 	result = ISC_R_FAILURE;

 	if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1)

diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c

index bde66a4..70a40c3 100644

--- a/bin/tests/system/tkey/keydelete.c

+++ b/bin/tests/system/tkey/keydelete.c

@@ -225,12 +225,17 @@ main(int argc, char **argv) {

 	result = dst_key_fromnamedfile(keyname, NULL, type, mctx, &dstkey);

 	CHECK("dst_key_fromnamedfile", result);

 #ifndef PK11_MD5_DISABLE

-	result = dns_tsigkey_createfromkey(dst_key_name(dstkey),

-					   DNS_TSIG_HMACMD5_NAME,

-					   dstkey, true, NULL, 0, 0,

-					   mctx, ring, &tsigkey);

-	dst_key_free(&dstkey);

-	CHECK("dns_tsigkey_createfromkey", result);

+	if (isc_md5_available()) {

+		result = dns_tsigkey_createfromkey(dst_key_name(dstkey),

+						   DNS_TSIG_HMACMD5_NAME,

+						   dstkey, true, NULL, 0, 0,

+						   mctx, ring, &tsigkey);

+		dst_key_free(&dstkey);

+		CHECK("dns_tsigkey_createfromkey", result);

+	} else {

+		dst_key_free(&dstkey);

+		CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);

+	}

 #else

 	dst_key_free(&dstkey);

 	CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);

diff --git a/lib/bind9/check.c b/lib/bind9/check.c

index d6fba22..ac60ba8 100644

--- a/lib/bind9/check.c

+++ b/lib/bind9/check.c

@@ -23,6 +23,7 @@

 #include <isc/file.h>

 #include <isc/hex.h>

 #include <isc/log.h>

+#include <isc/md5.h>

 #include <isc/mem.h>

 #include <isc/netaddr.h>

 #include <isc/parseint.h>

@@ -2589,6 +2590,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {

 	}

 	algorithm = cfg_obj_asstring(algobj);

+#ifndef PK11_MD5_DISABLE

+	/* Skip hmac-md5* algorithms */

+	if (!isc_md5_available() &&

+	    strncasecmp(algorithm, "hmac-md5", 8) == 0) {

+		cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,

+			    "disabled algorithm '%s'", algorithm);

+		return (ISC_R_DISABLED);

+	}

+#endif

 	for (i = 0; algorithms[i].name != NULL; i++) {

 		len = strlen(algorithms[i].name);

 		if (strncasecmp(algorithms[i].name, algorithm, len) == 0 &&

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c

index e3c47a9..320c0f8 100644

--- a/lib/dns/dst_api.c

+++ b/lib/dns/dst_api.c

@@ -192,6 +192,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,

 	dst_result_register();

 	memset(dst_t_func, 0, sizeof(dst_t_func));

+

+#ifdef OPENSSL

+	RETERR(dst__openssl_init(engine));

+#elif PKCS11CRYPTO

+	RETERR(dst__pkcs11_init(mctx, engine));

+#endif

 #ifndef PK11_MD5_DISABLE

 	RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));

 #endif

@@ -201,7 +207,6 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,

 	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));

 	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));

 #ifdef OPENSSL

-	RETERR(dst__openssl_init(engine));

 #ifndef PK11_MD5_DISABLE

 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],

 				    DST_ALG_RSAMD5));

@@ -235,14 +240,18 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,

 	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448]));

 #endif

 #elif PKCS11CRYPTO

-	RETERR(dst__pkcs11_init(mctx, engine));

 #ifndef PK11_MD5_DISABLE

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5]));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5],

+				   DST_ALG_RSAMD5));

 #endif

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1]));

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1]));

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256]));

-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1],

+				   DST_ALG_RSASHA1));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],

+				   DST_ALG_NSEC3RSASHA1));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256],

+				   DST_ALG_RSASHA256));

+	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512],

+				   DST_ALG_RSASHA512));

 #ifndef PK11_DSA_DISABLE

 	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));

 	RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));

diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h

index 6ee796c..3e55d44 100644

--- a/lib/dns/dst_internal.h

+++ b/lib/dns/dst_internal.h

@@ -250,7 +250,8 @@ isc_result_t dst__hmacsha384_init(struct dst_func **funcp);

 isc_result_t dst__hmacsha512_init(struct dst_func **funcp);

 isc_result_t dst__opensslrsa_init(struct dst_func **funcp,

 				  unsigned char algorithm);

-isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp);

+isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp,

+				 unsigned char algorithm);

 #ifndef PK11_DSA_DISABLE

 isc_result_t dst__openssldsa_init(struct dst_func **funcp);

 isc_result_t dst__pkcs11dsa_init(struct dst_func **funcp);

diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c

index f31c33d..87023a6 100644

--- a/lib/dns/dst_parse.c

+++ b/lib/dns/dst_parse.c