summaryrefslogtreecommitdiff
path: root/external/mpl/bind
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2023-01-25 20:36:33 +0000
committerchristos <christos@NetBSD.org>2023-01-25 20:36:33 +0000
commit4bcbe0a38f27afc5e9fcf3fd7ebf80856ad1a084 (patch)
tree911c76d41130613fb0568d0e2cefec20396eba4f /external/mpl/bind
parented460d0537dd19aa85963028b091410e2d0ee006 (diff)
Import bind-9.16.37 (previous was bind-9.16.33)
--- 9.16.37 released --- 6067. [security] Fix serve-stale crash when recursive clients soft quota is reached. (CVE-2022-3924) [GL #3619] 6066. [security] Handle RRSIG lookups when serve-stale is active. (CVE-2022-3736) [GL #3622] 6064. [security] An UPDATE message flood could cause named to exhaust all available memory. This flaw was addressed by adding a new "update-quota" statement that controls the number of simultaneous UPDATE messages that can be processed or forwarded. The default is 100. A stats counter has been added to record events when the update quota is exceeded, and the XML and JSON statistics version numbers have been updated. (CVE-2022-3094) [GL #3523] 6062. [func] The DSCP implementation, which has only been partly operational since 9.16.0, is now marked as deprecated. Configuring DSCP values in named.conf will cause a warning will be logged. [GL #3773] 6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone() by detaching from the zone manager outside of the write lock. [GL #3768] 6059. [bug] In some serve stale scenarios, like when following an expired CNAME record, named could return SERVFAIL if the previous request wasn't successful. Consider non-stale data when in serve-stale mode. [GL #3678] 6058. [bug] Prevent named from crashing when "rndc delzone" attempts to delete a zone added by a catalog zone. [GL #3745] 6050. [bug] Changes to the RPZ response-policy min-update-interval and add-soa options now take effect as expected when named is reconfigured. [GL #3740] 6048. [bug] Fix a log message error in dns_catz_update_from_db(), where serials with values of 2^31 or larger were logged incorrectly as negative numbers. [GL #3742] 6045. [cleanup] The list of supported DNSSEC algorithms changed log level from "warning" to "notice" to match named's other startup messages. [GL !7217] 6044. [bug] There was an "RSASHA236" typo in a log message. [GL !7206] --- 9.16.36 released --- 6043. [bug] The key file IO locks objects would never get deleted from the hashtable due to off-by-one error. [GL #3727] 6042. [bug] ANY responses could sometimes have the wrong TTL. [GL #3613] 6040. [bug] Speed up the named shutdown time by explicitly canceling all recursing ns_client objects for each ns_clientmgr. [GL #3183] 6039. [bug] Removing a catalog zone from catalog-zones without also removing the referenced zone could leave a dangling pointer. [GL #3683] 6031. [bug] Move the "final reference detached" log message from dns_zone unit to the DEBUG(1) log level. [GL #3707] 6024. [func] Deprecate 'auto-dnssec'. [GL #3667] 6021. [bug] Use the current domain name when checking answers from a dual-stack-server. [GL #3607] 6020. [bug] Ensure 'named-checkconf -z' respects the check-wildcard option when loading a zone. [GL #1905] 6017. [bug] The view's zone table was not locked when it should have been leading to race conditions when external extensions that manipulate the zone table where in use. [GL #3468] --- 9.16.35 released --- 6013. [bug] Fix a crash that could happen when you change a dnssec-policy zone with NSEC3 to start using inline-signing. [GL #3591] 6009. [bug] Don't trust a placeholder KEYDATA from the managed-keys zone by adding it into secroots. [GL #2895] 6008. [bug] Fixed a race condition that could cause a crash in dns_zone_synckeyzone(). [GL #3617] 6002. [bug] Fix a resolver prefetch bug when the record's TTL value is equal to the configured prefetch eligibility value, but the record was erroneously not treated as eligible for prefetching. [GL #3603] 6001. [bug] Always call dns_adb_endudpfetch() after calling dns_adb_beginudpfetch() for UDP queries in resolver.c, in order to adjust back the quota. [GL #3598] 6000. [bug] Fix a startup issue on Solaris systems with many (reportedly > 510) CPUs. Thanks to Stacey Marshall from Oracle for deep investigation of the problem. [GL #3563] 5999. [bug] rpz-ip rules could be ineffective in some scenarios with CD=1 queries. [GL #3247] 5998. [bug] The RecursClients statistics counter could overflow in certain resolution scenarios. [GL #3584] 5996. [bug] Fix a couple of bugs in cfg_print_duration(), which could result in generating incomplete duration values when printing the configuration using named-checkconf. [GL !6880] --- 9.16.34 released --- 5991. [protocol] Add support for parsing and validating "dohpath" to SVCB. [GL #3544] 5988. [bug] Some out of memory conditions in opensslrsa_link.c could lead to memory leaks. [GL #3551] 5984. [func] 'named -V' now reports the list of supported DNSSEC/DS/HMAC algorithms and the supported TKEY modes. [GL #3541] 5983. [bug] Changing just the TSIG key names for primaries in catalog zones' member zones was not effective. [GL #3557] 5973. [bug] Fixed a possible invalid detach in UPDATE processing. [GL #3522] 5963. [bug] Ensure struct named_server is properly initialized. [GL #6531] 5921. [test] Convert system tests to use a default DNSKEY algorithm where the test is not DNSKEY algorithm specific. [GL #3440]
Diffstat (limited to 'external/mpl/bind')
-rw-r--r--external/mpl/bind/dist/CHANGES146
-rw-r--r--external/mpl/bind/dist/COPYRIGHT2
-rw-r--r--external/mpl/bind/dist/bin/dig/dig.rst8
-rw-r--r--external/mpl/bind/dist/bin/named/bind9.xsl4
-rw-r--r--external/mpl/bind/dist/bin/named/named.conf.rst13
-rw-r--r--external/mpl/bind/dist/bin/named/named.rst16
-rw-r--r--external/mpl/bind/dist/bin/nsupdate/nsupdate.rst2
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/addzone/tests.sh22
-rw-r--r--external/mpl/bind/dist/bin/tests/system/auth/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns1/keygen.sh20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.key5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.private6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.key5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.private6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns2/keygen.sh18
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns3/keygen.sh101
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns3/named.conf.in4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/autosign/ns3/nsec-only.example.db.in26
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/autosign/tests.sh582
-rw-r--r--external/mpl/bind/dist/bin/tests/system/builtin/tests.sh14
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/cacheclean/tests.sh6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/case/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/ns1/named.conf.in7
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/ns2/named1.conf.in7
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/ns2/named2.conf.in2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/ns3/catalog.example.db.in14
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/catz/tests.sh94
-rw-r--r--external/mpl/bind/dist/bin/tests/system/cds/setup.sh26
-rw-r--r--external/mpl/bind/dist/bin/tests/system/cds/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/chain/ns2/sign.sh20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/chain/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in50
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in48
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in55
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in52
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in52
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard-no.conf18
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.conf18
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.db23
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/clean.sh12
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/deprecated.conf5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/dnssec.420
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/good.conf1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkconf/tests.sh142
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkds/ns9/setup.sh6
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/checkds/tests_checkds.py445
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checknames/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkzone/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkzone/setup.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkzone/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkzone/zones/bad-tsig.db.in17
-rw-r--r--external/mpl/bind/dist/bin/tests/system/checkzone/zones/good-svcb.db1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/ckdnsrps.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/conf.sh.common154
-rw-r--r--external/mpl/bind/dist/bin/tests/system/conf.sh.in187
-rw-r--r--external/mpl/bind/dist/bin/tests/system/conf.sh.win32158
-rw-r--r--external/mpl/bind/dist/bin/tests/system/cookie/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/coverage/setup.sh74
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dialup/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dialup/ns1/named.conf.in40
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dialup/ns2/named.conf.in40
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dialup/ns3/named.conf.in40
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dialup/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/digdelv/yamlget.py1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dlzexternal/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dns64/ns1/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/ns4/managed-keys.bind.in21
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private13
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private13
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-ksk.key4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-zsk.key4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test1.zone4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test2.zone2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test3.zone2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test4.zone4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test5.zone4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test6.zone4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test8.zone2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnssec/tests.sh105
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnstap/prereq.sh20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dnstap/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dscp/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dscp/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dsdigest/ns1/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dsdigest/ns2/sign.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dupsigs/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/named.conf.in2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/reset_keys.sh13
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/signing.test.db.in2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dupsigs/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/dupsigs/tests.sh36
-rw-r--r--external/mpl/bind/dist/bin/tests/system/emptyzones/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/emptyzones/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/formerr/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/forward/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/forward/tests.sh6
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/get_algorithms.py241
-rw-r--r--external/mpl/bind/dist/bin/tests/system/idna/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/inline/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/inline/ns1/sign.sh4
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/inline/ns3/sign.sh78
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/inline/ns7/sign.sh6
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/inline/ns8/sign.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/inline/setup.sh2
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/inline/tests.sh461
-rw-r--r--external/mpl/bind/dist/bin/tests/system/ixfr/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/journal/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/kasp.conf4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns3/named-fips.conf.in508
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns3/named.conf.in494
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in118
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp.conf.in106
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns3/setup.sh155
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns4/named.conf.in6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns6/named.conf.in10
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns6/named2.conf.in9
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/csk1.conf.in2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in63
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp.conf.in28
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/ns6/setup.sh96
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/setup.sh18
-rw-r--r--external/mpl/bind/dist/bin/tests/system/kasp/tests.sh245
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keepalive/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr/18-nonstd-prepub/policy.conf.in20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr/19-old-keys/policy.conf.in20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr/policy.conf.in23
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr/setup.sh98
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/clean.sh1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/setup.sh14
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named.conf.in4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named2.conf.in6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/keymgr2kasp/tests.sh28
-rw-r--r--external/mpl/bind/dist/bin/tests/system/legacy/clean.sh2
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/legacy/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/logfileconfig/tests.sh4
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/masterformat/tests.sh6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/metadata/setup.sh22
-rw-r--r--external/mpl/bind/dist/bin/tests/system/metadata/tests.sh110
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mirror/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mirror/ns1/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mirror/ns2/sign.sh16
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mirror/tests.sh146
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mkeys/clean.sh1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mkeys/ns1/sign.sh37
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mkeys/ns3/named.conf.in5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mkeys/ns6/setup.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mkeys/setup.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/mkeys/tests.sh45
-rw-r--r--external/mpl/bind/dist/bin/tests/system/names/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/notify/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/ns2/named.conf.in46
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/ns2/setup.sh22
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/ns2/template.db.in28
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named.conf.in32
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named2.conf.in17
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/ns3/setup.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/setup.sh6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsec3/tests.sh54
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nslookup/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsupdate/krb/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsupdate/ns1/named.conf.in2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nsupdate/ns3/sign.sh12
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh246
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nzd2nzf/prereq.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/nzd2nzf/tests.sh9
-rw-r--r--external/mpl/bind/dist/bin/tests/system/padding/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/pending/ns1/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/pending/ns2/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/pytest_custom_markers.py21
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/qmin/ans3/ans.py1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/redirect/ns1/sign.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/redirect/ns3/sign.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/redirect/ns5/sign.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ans2/ans.pl9
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ans3/ans.pl71
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns1/named.conf.in13
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns4/named.conf.in5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld1.db3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld2.db7
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns4/v4only.net.db22
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns6/keygen.sh11
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns6/named.conf.in12
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns6/redirect.com.db27
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns6/root.db3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns6/tld1.db17
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns7/named1.conf.in12
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns7/named2.conf.in12
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns7/sub.tld1.db17
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns7/tld2.db18
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.args2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.conf.in39
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.ipv6-only0
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/ns9/root.hint15
-rw-r--r--external/mpl/bind/dist/bin/tests/system/resolver/setup.sh1
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/resolver/tests.sh665
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rndc/ns7/named.conf.in4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rndc/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rndc/tests.sh18
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns1/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns2/sign.sh14
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/clean.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/ns2/base-tld2s.db1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/ns2/tld2.db3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/ns6/bl.tld2s.db.in20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/ns6/named.conf.in6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/qperf.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/setup.sh13
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpz/tests.sh38
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpzrecurse/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rpzrecurse/tests.sh10
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rrchecker/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rrl/broken.conf.in46
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rrl/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rrl/setup.sh1
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rrl/tests.sh14
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rrsetorder/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/README.md8
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/rsabigexponent/ns1/sign.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private13
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private10
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/dsset-example.in3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/example.db.bad226
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/sign.sh6
-rw-r--r--external/mpl/bind/dist/bin/tests/system/run.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/serve-stale/ans2/ans.pl24
-rw-r--r--external/mpl/bind/dist/bin/tests/system/serve-stale/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named3.conf.in5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/stale.test.db19
-rw-r--r--external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named6.conf.in4
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/serve-stale/tests.sh379
-rw-r--r--external/mpl/bind/dist/bin/tests/system/shutdown/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/shutdown/setup.sh2
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/shutdown/tests_shutdown.py207
-rw-r--r--external/mpl/bind/dist/bin/tests/system/smartsign/tests.sh76
-rw-r--r--external/mpl/bind/dist/bin/tests/system/sortlist/tests.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/spf/clean.sh2
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/start.pl40
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/staticstub/ns3/sign.sh8
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/staticstub/ns4/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/statschannel/tests.sh51
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/statschannel/tests_json.py108
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/statschannel/tests_xml.py137
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stop.pl4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/clean.sh3
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/ns1/named.conf.in32
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/ns2/named.conf.in34
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/ns3/named.conf.in50
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/ns4/named.conf.in35
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/setup.sh5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stress/tests.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/stub/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns1/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns4/named.conf.in1
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/system-test-driver.sh5
-rw-r--r--external/mpl/bind/dist/bin/tests/system/tcp/tests_tcp.py72
-rw-r--r--external/mpl/bind/dist/bin/tests/system/testcrypto.sh100
-rw-r--r--external/mpl/bind/dist/bin/tests/system/timeouts/tests_tcp_timeouts.py283
-rw-r--r--external/mpl/bind/dist/bin/tests/system/tsiggss/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/unknown/ns3/sign.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/unknown/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/unknown/tests.sh8
-rw-r--r--external/mpl/bind/dist/bin/tests/system/upforwd/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named1.conf.in63
-rw-r--r--external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named2.conf.in41
-rw-r--r--external/mpl/bind/dist/bin/tests/system/upforwd/setup.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/upforwd/tests.sh39
-rw-r--r--external/mpl/bind/dist/bin/tests/system/verify/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/verify/tests.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/verify/zones/genzones.sh109
-rw-r--r--external/mpl/bind/dist/bin/tests/system/views/setup.sh12
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/wildcard/ns1/sign.sh20
-rw-r--r--external/mpl/bind/dist/bin/tests/system/wildcard/tests.sh2
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/wildcard/tests_wildcard.py112
-rwxr-xr-xexternal/mpl/bind/dist/bin/tests/system/xfer/tests.sh4
-rw-r--r--external/mpl/bind/dist/bin/tests/system/zero/clean.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/zero/setup.sh2
-rw-r--r--external/mpl/bind/dist/bin/tests/system/zonechecks/setup.sh4
-rw-r--r--external/mpl/bind/dist/configure.ac2
-rw-r--r--external/mpl/bind/dist/contrib/dlz/modules/perl/Makefile4
-rw-r--r--external/mpl/bind/dist/dangerfile.py124
-rw-r--r--external/mpl/bind/dist/doc/arm/conf.py4
-rw-r--r--external/mpl/bind/dist/doc/arm/dnssec.inc.rst9
-rw-r--r--external/mpl/bind/dist/doc/arm/notes.rst6
-rw-r--r--external/mpl/bind/dist/doc/arm/platforms.rst6
-rw-r--r--external/mpl/bind/dist/doc/arm/reference.rst55
-rw-r--r--external/mpl/bind/dist/doc/arm/requirements.txt2
-rw-r--r--external/mpl/bind/dist/doc/dnssec-guide/introduction.rst2
-rw-r--r--external/mpl/bind/dist/doc/dnssec-guide/recipes.rst4
-rw-r--r--external/mpl/bind/dist/doc/dnssec-guide/signing.rst19
-rw-r--r--external/mpl/bind/dist/doc/man/Makefile.in3
-rw-r--r--external/mpl/bind/dist/doc/man/arpaname.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/conf.py1
-rw-r--r--external/mpl/bind/dist/doc/man/ddns-confgen.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/delv.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/dig.1in10
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-cds.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-checkds.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-coverage.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-dsfromkey.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-importkey.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-keyfromlabel.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-keygen.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-keymgr.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-revoke.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-settime.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-signzone.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnssec-verify.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/dnstap-read.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/filter-aaaa.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/host.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/mdig.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/named-checkconf.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/named-checkzone.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/named-compilezone.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/named-journalprint.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/named-nzd2nzf.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/named-rrchecker.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/named.8in18
-rw-r--r--external/mpl/bind/dist/doc/man/named.conf.5in15
-rw-r--r--external/mpl/bind/dist/doc/man/nsec3hash.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/nslookup.1in2
-rw-r--r--external/mpl/bind/dist/doc/man/nsupdate.1in9
-rw-r--r--external/mpl/bind/dist/doc/man/pkcs11-destroy.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/pkcs11-keygen.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/pkcs11-list.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/pkcs11-tokens.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/rndc-confgen.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/rndc.8in2
-rw-r--r--external/mpl/bind/dist/doc/man/rndc.conf.5in2
-rw-r--r--external/mpl/bind/dist/doc/man/tsig-keygen.8in2
-rw-r--r--external/mpl/bind/dist/doc/misc/master.zoneopt4
-rw-r--r--external/mpl/bind/dist/doc/misc/master.zoneopt.rst4
-rw-r--r--external/mpl/bind/dist/doc/misc/options15
-rw-r--r--external/mpl/bind/dist/doc/misc/options.active15
-rw-r--r--external/mpl/bind/dist/doc/misc/options.grammar.rst3
-rw-r--r--external/mpl/bind/dist/doc/misc/slave.zoneopt2
-rw-r--r--external/mpl/bind/dist/doc/misc/slave.zoneopt.rst2
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.0.rst6
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.1.rst3
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.10.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.11.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.12.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.13.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.15.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.16.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.17.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.18.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.19.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.2.rst5
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.20.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.21.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.22.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.23.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.24.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.25.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.26.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.27.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.28.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.29.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.3.rst3
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.30.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.31.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.32.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.33.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.34.rst46
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.35.rst56
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.36.rst49
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.37.rst80
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.4.rst13
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.5.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.6.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.7.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.8.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-9.16.9.rst7
-rw-r--r--external/mpl/bind/dist/doc/notes/notes-known-issues.rst46
-rw-r--r--external/mpl/bind/dist/lib/dns/tests/Krsa.+008+29238.key5
-rw-r--r--external/mpl/bind/dist/lib/isc/win32/libisc.def.in1
-rw-r--r--external/mpl/bind/dist/lib/ns/win32/libns.def1
-rw-r--r--external/mpl/bind/dist/srcid2
-rw-r--r--external/mpl/bind/dist/version2
394 files changed, 8286 insertions, 3320 deletions
diff --git a/external/mpl/bind/dist/CHANGES b/external/mpl/bind/dist/CHANGES
index fba149d7c93..0d8baed833a 100644
--- a/external/mpl/bind/dist/CHANGES
+++ b/external/mpl/bind/dist/CHANGES
@@ -1,3 +1,149 @@
+ --- 9.16.37 released ---
+
+6067. [security] Fix serve-stale crash when recursive clients soft quota
+ is reached. (CVE-2022-3924) [GL #3619]
+
+6066. [security] Handle RRSIG lookups when serve-stale is active.
+ (CVE-2022-3736) [GL #3622]
+
+6064. [security] An UPDATE message flood could cause named to exhaust all
+ available memory. This flaw was addressed by adding a
+ new "update-quota" statement that controls the number of
+ simultaneous UPDATE messages that can be processed or
+ forwarded. The default is 100. A stats counter has been
+ added to record events when the update quota is
+ exceeded, and the XML and JSON statistics version
+ numbers have been updated. (CVE-2022-3094) [GL #3523]
+
+6062. [func] The DSCP implementation, which has only been
+ partly operational since 9.16.0, is now marked as
+ deprecated. Configuring DSCP values in named.conf
+ will cause a warning will be logged. [GL #3773]
+
+6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone()
+ by detaching from the zone manager outside of the write
+ lock. [GL #3768]
+
+6059. [bug] In some serve stale scenarios, like when following an
+ expired CNAME record, named could return SERVFAIL if the
+ previous request wasn't successful. Consider non-stale
+ data when in serve-stale mode. [GL #3678]
+
+6058. [bug] Prevent named from crashing when "rndc delzone"
+ attempts to delete a zone added by a catalog zone.
+ [GL #3745]
+
+6050. [bug] Changes to the RPZ response-policy min-update-interval
+ and add-soa options now take effect as expected when
+ named is reconfigured. [GL #3740]
+
+6048. [bug] Fix a log message error in dns_catz_update_from_db(),
+ where serials with values of 2^31 or larger were logged
+ incorrectly as negative numbers. [GL #3742]
+
+6045. [cleanup] The list of supported DNSSEC algorithms changed log
+ level from "warning" to "notice" to match named's other
+ startup messages. [GL !7217]
+
+6044. [bug] There was an "RSASHA236" typo in a log message.
+ [GL !7206]
+
+ --- 9.16.36 released ---
+
+6043. [bug] The key file IO locks objects would never get
+ deleted from the hashtable due to off-by-one error.
+ [GL #3727]
+
+6042. [bug] ANY responses could sometimes have the wrong TTL.
+ [GL #3613]
+
+6040. [bug] Speed up the named shutdown time by explicitly
+ canceling all recursing ns_client objects for
+ each ns_clientmgr. [GL #3183]
+
+6039. [bug] Removing a catalog zone from catalog-zones without
+ also removing the referenced zone could leave a
+ dangling pointer. [GL #3683]
+
+6031. [bug] Move the "final reference detached" log message
+ from dns_zone unit to the DEBUG(1) log level.
+ [GL #3707]
+
+6024. [func] Deprecate 'auto-dnssec'. [GL #3667]
+
+6021. [bug] Use the current domain name when checking answers from
+ a dual-stack-server. [GL #3607]
+
+6020. [bug] Ensure 'named-checkconf -z' respects the check-wildcard
+ option when loading a zone. [GL #1905]
+
+6017. [bug] The view's zone table was not locked when it should
+ have been leading to race conditions when external
+ extensions that manipulate the zone table where in
+ use. [GL #3468]
+
+ --- 9.16.35 released ---
+
+6013. [bug] Fix a crash that could happen when you change
+ a dnssec-policy zone with NSEC3 to start using
+ inline-signing. [GL #3591]
+
+6009. [bug] Don't trust a placeholder KEYDATA from the managed-keys
+ zone by adding it into secroots. [GL #2895]
+
+6008. [bug] Fixed a race condition that could cause a crash
+ in dns_zone_synckeyzone(). [GL #3617]
+
+6002. [bug] Fix a resolver prefetch bug when the record's TTL value
+ is equal to the configured prefetch eligibility value,
+ but the record was erroneously not treated as eligible
+ for prefetching. [GL #3603]
+
+6001. [bug] Always call dns_adb_endudpfetch() after calling
+ dns_adb_beginudpfetch() for UDP queries in resolver.c,
+ in order to adjust back the quota. [GL #3598]
+
+6000. [bug] Fix a startup issue on Solaris systems with many
+ (reportedly > 510) CPUs. Thanks to Stacey Marshall from
+ Oracle for deep investigation of the problem. [GL #3563]
+
+5999. [bug] rpz-ip rules could be ineffective in some scenarios
+ with CD=1 queries. [GL #3247]
+
+5998. [bug] The RecursClients statistics counter could overflow
+ in certain resolution scenarios. [GL #3584]
+
+5996. [bug] Fix a couple of bugs in cfg_print_duration(), which
+ could result in generating incomplete duration values
+ when printing the configuration using named-checkconf.
+ [GL !6880]
+
+ --- 9.16.34 released ---
+
+5991. [protocol] Add support for parsing and validating "dohpath" to
+ SVCB. [GL #3544]
+
+5988. [bug] Some out of memory conditions in opensslrsa_link.c
+ could lead to memory leaks. [GL #3551]
+
+5984. [func] 'named -V' now reports the list of supported
+ DNSSEC/DS/HMAC algorithms and the supported TKEY modes.
+ [GL #3541]
+
+5983. [bug] Changing just the TSIG key names for primaries in
+ catalog zones' member zones was not effective.
+ [GL #3557]
+
+5973. [bug] Fixed a possible invalid detach in UPDATE
+ processing. [GL #3522]
+
+5963. [bug] Ensure struct named_server is properly initialized.
+ [GL #6531]
+
+5921. [test] Convert system tests to use a default DNSKEY algorithm
+ where the test is not DNSKEY algorithm specific.
+ [GL #3440]
+
--- 9.16.33 released ---
5962. [security] Fix memory leak in EdDSA verify processing.
diff --git a/external/mpl/bind/dist/COPYRIGHT b/external/mpl/bind/dist/COPYRIGHT
index ff9d42d39cd..c6e4d039203 100644
--- a/external/mpl/bind/dist/COPYRIGHT
+++ b/external/mpl/bind/dist/COPYRIGHT
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2022 Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2023 Internet Systems Consortium, Inc. ("ISC")
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
diff --git a/external/mpl/bind/dist/bin/dig/dig.rst b/external/mpl/bind/dist/bin/dig/dig.rst
index 417c951eaa1..d27b1fd2ae3 100644
--- a/external/mpl/bind/dist/bin/dig/dig.rst
+++ b/external/mpl/bind/dist/bin/dig/dig.rst
@@ -495,9 +495,11 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
``+notcflag``. This bit is ignored by the server for QUERY.
``+[no]tcp``
- This option uses [or does not use] TCP when querying name servers. The default behavior
- is to use UDP unless a type ``any`` or ``ixfr=N`` query is requested,
- in which case the default is TCP. AXFR queries always use TCP.
+ This option uses [or does not use] TCP when querying name servers.
+ The default behavior is to use UDP unless a type ``any`` or
+ ``ixfr=N`` query is requested, in which case the default is TCP.
+ AXFR queries always use TCP. To prevent retry over TCP when TC=1
+ is returned from a UDP query, use ``+ignore``.
``+timeout=T``
This option sets the timeout for a query to ``T`` seconds. The default timeout is
diff --git a/external/mpl/bind/dist/bin/named/bind9.xsl b/external/mpl/bind/dist/bin/named/bind9.xsl
index c145915a197..309e5d4bb75 100644
--- a/external/mpl/bind/dist/bin/named/bind9.xsl
+++ b/external/mpl/bind/dist/bin/named/bind9.xsl
@@ -2,7 +2,9 @@
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
<xsl:output method="html" indent="yes" version="4.0"/>
- <xsl:template match="statistics[@version=&quot;3.11&quot;]">
+ <!-- the version number **below** must match version in bin/named/statschannel.c -->
+ <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
+ <xsl:template match="statistics[@version=&quot;3.11.1&quot;]">
<html>
<head>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
diff --git a/external/mpl/bind/dist/bin/named/named.conf.rst b/external/mpl/bind/dist/bin/named/named.conf.rst
index 64a2b770c8b..4c9f9a73704 100644
--- a/external/mpl/bind/dist/bin/named/named.conf.rst
+++ b/external/mpl/bind/dist/bin/named/named.conf.rst
@@ -179,7 +179,7 @@ OPTIONS
answer-cookie boolean;
attach-cache string;
auth-nxdomain boolean; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off );// deprecated
automatic-interface-scan boolean;
avoid-v4-udp-ports { portrange; ... };
avoid-v6-udp-ports { portrange; ... };
@@ -446,6 +446,7 @@ OPTIONS
trust-anchor-telemetry boolean; // experimental
try-tcp-refresh boolean;
update-check-ksk boolean;
+ update-quota integer;
use-alt-transfer-source boolean;
use-v4-udp-ports { portrange; ... };
use-v6-udp-ports { portrange; ... };
@@ -584,7 +585,7 @@ VIEW
* ) ] [ dscp integer ];
attach-cache string;
auth-nxdomain boolean; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off );// deprecated
cache-file quoted_string;// deprecated
catalog-zones { zone string [ default-masters [ port integer ]
[ dscp integer ] { ( remote-servers | ipv4_address [ port
@@ -859,7 +860,7 @@ VIEW
integer | * ) ] [ dscp integer ];
alt-transfer-source-v6 ( ipv6_address | * ) [ port (
integer | * ) ] [ dscp integer ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off );// deprecated
check-dup-records ( fail | warn | ignore );
check-integrity boolean;
check-mx ( fail | warn | ignore );
@@ -950,7 +951,7 @@ VIEW
6to4-self | external | krb5-self | krb5-selfsub |
krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
name | self | selfsub | selfwild | subdomain | tcp-self
- | wildcard | zonesub ) [ string ] rrtypelist; ... };
+ | wildcard | zonesub ) [ string ] rrtypelist; ... } );
use-alt-transfer-source boolean;
zero-no-soa-ttl boolean;
zone-statistics ( full | terse | none | boolean );
@@ -977,7 +978,7 @@ ZONE
] [ dscp integer ];
alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
* ) ] [ dscp integer ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off );// deprecated
check-dup-records ( fail | warn | ignore );
check-integrity boolean;
check-mx ( fail | warn | ignore );
@@ -1063,7 +1064,7 @@ ZONE
external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
| ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
| subdomain | tcp-self | wildcard | zonesub ) [ string ]
- rrtypelist; ... };
+ rrtypelist; ... } );
use-alt-transfer-source boolean;
zero-no-soa-ttl boolean;
zone-statistics ( full | terse | none | boolean );
diff --git a/external/mpl/bind/dist/bin/named/named.rst b/external/mpl/bind/dist/bin/named/named.rst
index 818a896c8dc..449761ca9df 100644
--- a/external/mpl/bind/dist/bin/named/named.rst
+++ b/external/mpl/bind/dist/bin/named/named.rst
@@ -111,10 +111,15 @@ Options
``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.
``-n #cpus``
- This option creates ``#cpus`` worker threads to take advantage of multiple CPUs. If
- not specified, ``named`` tries to determine the number of CPUs
- present and creates one thread per CPU. If it is unable to determine
- the number of CPUs, a single worker thread is created.
+ This option controls the number of CPUs that ``named`` assumes the
+ presence of. If not specified, ``named`` tries to determine the
+ number of CPUs present automatically; if it fails, a single CPU is
+ assumed to be present.
+
+ ``named`` creates two threads per each CPU present (one thread for
+ receiving and sending client traffic and another thread for sending
+ and receiving resolver traffic) and then on top of that a single
+ thread for handling time-based events.
``-p port``
This option listens for queries on ``port``. If not specified, the default is
@@ -185,7 +190,8 @@ Options
This option reports the version number and exits.
``-V``
- This option reports the version number and build options, and exits.
+ This option reports the version number, build options, supported
+ cryptographics algorithms, and exits.
``-X lock-file``
This option acquires a lock on the specified file at runtime; this helps to
diff --git a/external/mpl/bind/dist/bin/nsupdate/nsupdate.rst b/external/mpl/bind/dist/bin/nsupdate/nsupdate.rst
index 928bb59261a..aad9b025eb2 100644
--- a/external/mpl/bind/dist/bin/nsupdate/nsupdate.rst
+++ b/external/mpl/bind/dist/bin/nsupdate/nsupdate.rst
@@ -186,6 +186,8 @@ The command formats and their meanings are as follows:
update requests are sent. If no port number is specified, the default
DNS port number of 53 is used.
+ .. note:: This command has no effect when GSS-TSIG is in use.
+
``local address port``
This command sends all dynamic update requests using the local ``address``. When
no local statement is provided, ``nsupdate`` sends updates using
diff --git a/external/mpl/bind/dist/bin/tests/system/addzone/tests.sh b/external/mpl/bind/dist/bin/tests/system/addzone/tests.sh
index de8f9eb5612..b3e21c654ac 100755
--- a/external/mpl/bind/dist/bin/tests/system/addzone/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/addzone/tests.sh
@@ -46,7 +46,7 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
echo_i "checking that existing NZF file was renamed after migration ($n)"
[ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
n=`expr $n + 1`
@@ -125,7 +125,7 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
echo_i "verifying no comments in NZF file ($n)"
ret=0
hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
@@ -144,7 +144,7 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
echo_i "checking zone is present in NZD ($n)"
ret=0
$NZD2NZF ns2/_default.nzd | grep previous.example > /dev/null || ret=1
@@ -170,14 +170,14 @@ check_nzd2nzf() (
! grep previous.example nzd2nzf.out.$n > /dev/null
)
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
echo_i "checking zone was deleted from NZD ($n)"
retry_quiet 10 check_nzd2nzf || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
fi
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
echo_i "checking NZF file now has comment ($n)"
ret=0
hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
@@ -513,7 +513,7 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
echo_i "checking new NZF file has comment ($n)"
ret=0
hcount=`grep "^# New zone file for view: external" ns2/external.nzf | wc -l`
@@ -523,7 +523,7 @@ if [ -z "$NZD" ]; then
status=`expr $status + $ret`
fi
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
echo_i "verifying added.example in external view created an external.nzd DB ($n)"
ret=0
[ -e ns2/external.nzd ] || ret=1
@@ -549,7 +549,7 @@ status=`expr $status + $ret`
echo_i "checking rndc showzone with newly added zone ($n)"
_check_rndc_showzone_newly_added() (
- if [ -z "$NZD" ]; then
+ if ! $FEATURETEST --with-lmdb; then
expected='zone "added.example" in external { type primary; file "added.db"; };'
else
expected='zone "added.example" { type primary; file "added.db"; };'
@@ -656,7 +656,7 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
echo_i "checking NZD file was created in new-zones-directory ($n)"
expect=ns2/new-zones/directory.nzd
else
@@ -726,8 +726,8 @@ $RNDCCMD 10.53.0.3 addzone '"test\".baz"' '{ type primary; check-names ignore; f
$RNDCCMD 10.53.0.3 addzone '"test\\.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
$RNDCCMD 10.53.0.3 addzone '"test\032.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
$RNDCCMD 10.53.0.3 addzone '"test\010.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
-$PERL $SYSTEMTESTTOP/stop.pl addzone ns3
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} addzone ns3 || ret=1
+stop_server ns3
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
retry_quiet 10 _check_version_bind || ret=1
$DIG $DIGOPTS @10.53.0.3 SOA "test4.baz" > dig.out.1.test$n || ret=1
grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
diff --git a/external/mpl/bind/dist/bin/tests/system/auth/clean.sh b/external/mpl/bind/dist/bin/tests/system/auth/clean.sh
index 88e4b249bdd..5fb37aca029 100644
--- a/external/mpl/bind/dist/bin/tests/system/auth/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/auth/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/clean.sh b/external/mpl/bind/dist/bin/tests/system/autosign/clean.sh
index f4ab636e8ea..a8118dd2f4d 100644
--- a/external/mpl/bind/dist/bin/tests/system/autosign/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/clean.sh
@@ -49,7 +49,7 @@ rm -f ns3/kskonly.example.db
rm -f ns3/named.ns3.prev
rm -f ns3/noksk.example.db
rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
-rm -f ns3/nsec.example.db
+rm -f ns3/nsec-only.example.db
rm -f ns3/nsec3-to-nsec.example.db
rm -f ns3/nsec3.example.db
rm -f ns3/nsec3.nsec3.example.db
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns1/keygen.sh b/external/mpl/bind/dist/bin/tests/system/autosign/ns1/keygen.sh
index 4b96fa2a453..44401cbab99 100644
--- a/external/mpl/bind/dist/bin/tests/system/autosign/ns1/keygen.sh
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns1/keygen.sh
@@ -22,18 +22,18 @@ infile=root.db.in
cat $infile ../ns2/dsset-example$TP ../ns2/dsset-bar$TP > $zonefile
-zskact=`$KEYGEN -3 -a RSASHA1 -q $zone`
-zskvanish=`$KEYGEN -3 -a RSASHA1 -q $zone`
-zskdel=`$KEYGEN -3 -a RSASHA1 -q -D now $zone`
-zskinact=`$KEYGEN -3 -a RSASHA1 -q -I now $zone`
-zskunpub=`$KEYGEN -3 -a RSASHA1 -q -G $zone`
-zsksby=`$KEYGEN -3 -a RSASHA1 -q -A none $zone`
-zskactnowpub1d=`$KEYGEN -3 -a RSASHA1 -q -A now -P +1d $zone`
-zsknopriv=`$KEYGEN -3 -a RSASHA1 -q $zone`
+zskact=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q $zone)
+zskvanish=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q $zone)
+zskdel=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -D now $zone)
+zskinact=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -I now $zone)
+zskunpub=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -G $zone)
+zsksby=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -A none $zone)
+zskactnowpub1d=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -A now -P +1d $zone)
+zsknopriv=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q $zone)
rm $zsknopriv.private
-ksksby=`$KEYGEN -3 -a RSASHA1 -q -P now -A now+15s -fk $zone`
-kskrev=`$KEYGEN -3 -a RSASHA1 -q -R now+15s -fk $zone`
+ksksby=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -P now -A now+15s -fk $zone)
+kskrev=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -R now+15s -fk $zone)
keyfile_to_static_ds $ksksby > trusted.conf
cp trusted.conf ../ns2/trusted.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.key b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.key
new file mode 100644
index 00000000000..1f4d1f4d458
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 59973, for bar.
+; Created: 20220623022335 (Thu Jun 23 12:23:35 2022)
+; Publish: 20220623022335 (Thu Jun 23 12:23:35 2022)
+; Activate: 20220623022335 (Thu Jun 23 12:23:35 2022)
+bar. IN DNSKEY 257 3 13 QT6CpMaV4BT072+NaKLY5H01Mj2r1MOgsxgoiTAq1Fbf6rrkEWpnbktu Dh9Ol9kuzcUrefxDuxNwsXJu3iDPxw==
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.private b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.private
new file mode 100644
index 00000000000..708d242da39
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+59973.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: joFZ8vCdyqkgMb6rZ0zanrdrzOSCg1GyEJV6tp5F+Bw=
+Created: 20220623022335
+Publish: 20220623022335
+Activate: 20220623022335
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.key b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.key
new file mode 100644
index 00000000000..0c478408a63
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 60101, for bar.
+; Created: 20220623022331 (Thu Jun 23 12:23:31 2022)
+; Publish: 20220623022331 (Thu Jun 23 12:23:31 2022)
+; Activate: 20220623022331 (Thu Jun 23 12:23:31 2022)
+bar. IN DNSKEY 257 3 13 dLGGOAE5uJd53Gci9MdymaRTMwsXVn13j05IfGJoVt9ucpeXpoIKVViX JNVE/uO4eJvkHycdEAvdVUWcslEmMQ==
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.private b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.private
new file mode 100644
index 00000000000..6ca837002f5
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/Xbar.+013+60101.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: pTTXxZUTzeVBXHMUJxTMxjh9yU4oxDtEhEvpkj+olf0=
+Created: 20220623022331
+Publish: 20220623022331
+Activate: 20220623022331
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns2/keygen.sh b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/keygen.sh
index 383be7d3be9..839995ced4b 100644
--- a/external/mpl/bind/dist/bin/tests/system/autosign/ns2/keygen.sh
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns2/keygen.sh
@@ -30,16 +30,16 @@ zonefile="${zone}.db"
infile="${zonefile}.in"
cat $infile dsset-*.example$TP > $zonefile
-kskname=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
-$KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
+kskname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
+$KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone > /dev/null
$DSFROMKEY $kskname.key > dsset-${zone}$TP
# Create keys for a private secure zone.
zone=private.secure.example
zonefile="${zone}.db"
infile="${zonefile}.in"
-ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
-$KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
+$KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone > /dev/null
keyfile_to_static_ds $ksk > private.conf
cp private.conf ../ns4/private.conf
$SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > /dev/null
@@ -49,10 +49,10 @@ zone=bar
zonefile="${zone}.db"
infile="${zonefile}.in"
cat $infile > $zonefile
-for i in Xbar.+005+30676.key Xbar.+005+30804.key Xbar.+005+30676.private \
- Xbar.+005+30804.private
+for i in Xbar.+013+59973.key Xbar.+013+59973.private \
+ Xbar.+013+60101.key Xbar.+013+60101.private
do
- cp $i `echo $i | sed s/X/K/`
+ cp $i $(echo $i | sed s/X/K/)
done
-$KEYGEN -a RSASHA1 -q $zone > /dev/null
-$DSFROMKEY Kbar.+005+30804.key > dsset-bar$TP
+$KEYGEN -a ECDSAP256SHA256 -q $zone > /dev/null
+$DSFROMKEY Kbar.+013+60101.key > dsset-bar$TP
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns3/keygen.sh b/external/mpl/bind/dist/bin/tests/system/autosign/ns3/keygen.sh
index 23d69f2fd5c..53547d37845 100644
--- a/external/mpl/bind/dist/bin/tests/system/autosign/ns3/keygen.sh
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns3/keygen.sh
@@ -27,12 +27,12 @@ setup () {
zone="$1"
zonefile="${zone}.db"
infile="${zonefile}.in"
- n=`expr ${n:-0} + 1`
+ n=$((${n:-0} + 1))
}
setup secure.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -41,7 +41,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup secure.nsec3.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -50,7 +50,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup nsec3.nsec3.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -63,7 +63,7 @@ count=1
while [ $count -le 1000 ]
do
echo "label${count} IN TXT label${count}" >> $zonefile
- count=`expr $count + 1`
+ count=$((count + 1))
done
# Don't create keys just yet, because the scenario we want to test
# is an unsigned zone that has a NSEC3PARAM record added with
@@ -74,7 +74,7 @@ done
#
setup optout.nsec3.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -83,7 +83,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup nsec3.example
cat $infile dsset-*.${zone}$TP > $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -92,9 +92,9 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup autonsec3.example
cat $infile > $zonefile
-ksk=`$KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
echo $ksk > ../autoksk.key
-zsk=`$KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
+zsk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
echo $zsk > ../autozsk.key
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -103,7 +103,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup secure.optout.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -112,7 +112,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup nsec3.optout.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -121,7 +121,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup optout.optout.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -130,7 +130,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup optout.example
cat $infile dsset-*.${zone}$TP > $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -139,8 +139,8 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup rsasha256.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA256 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
+ksk=$($KEYGEN -q -a RSASHA256 -b 2048 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a RSASHA256 -b 2048 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
#
@@ -148,18 +148,25 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup rsasha512.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA512 -b 2048 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA512 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
+ksk=$($KEYGEN -q -a RSASHA512 -b 2048 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a RSASHA512 -b 2048 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
#
-# NSEC-only zone.
+# NSEC-only zone. A zone using NSEC-only DNSSEC algorithms.
+# None of these algorithms are supported for signing in FIPS mode
+# as they are MD5 and SHA1 based.
#
-setup nsec.example
-cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+if (cd ..; SYSTEMTESTTOP=.. $SHELL ../testcrypto.sh -q RSASHA1)
+then
+ setup nsec-only.example
+ cp $infile $zonefile
+ ksk=$($KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out) || dumpit kg.out
+ $KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
+ $DSFROMKEY $ksk.key > dsset-${zone}$TP
+else
+ echo_i "skip: nsec-only.example - signing with RSASHA1 not supported"
+fi
#
# Signature refresh test zone. Signatures are set to expire long
@@ -171,7 +178,7 @@ count=1
while [ $count -le 1000 ]
do
echo "label${count} IN TXT label${count}" >> $zonefile
- count=`expr $count + 1`
+ count=$((count + 1))
done
$KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
@@ -182,8 +189,8 @@ mv $zonefile.signed $zonefile
# NSEC3->NSEC transition test zone.
#
setup nsec3-to-nsec.example
-$KEYGEN -q -a RSASHA512 -b 2048 -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -q -a RSASHA512 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
$SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > s.out || dumpit s.out
#
@@ -200,9 +207,9 @@ $SIGNER -S -o $zone -f $zonefile $infile > s.out || dumpit s.out
# removal of keys on schedule.
#
setup secure-to-insecure2.example
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
echo $ksk > ../del1.key
-zsk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
echo $zsk > ../del2.key
$SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
@@ -247,9 +254,9 @@ $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -L 180 $zone > kg.out 2>&1 || dumpit kg.out
# A zone with a DNSKEY RRset that is published before it's activated
#
setup delay.example
-ksk=`$KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
echo $ksk > ../delayksk.key
-zsk=`$KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
+zsk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
echo $zsk > ../delayzsk.key
#
@@ -257,8 +264,8 @@ echo $zsk > ../delayzsk.key
# is missing.
#
setup noksk.example
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
-zsk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
$SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > s.out || dumpit s.out
echo $ksk > ../noksk-ksk.key
rm -f ${ksk}.private
@@ -268,8 +275,8 @@ rm -f ${ksk}.private
# is missing.
#
setup nozsk.example
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
-zsk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
$SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > s.out || dumpit s.out
echo $ksk > ../nozsk-ksk.key
echo $zsk > ../nozsk-zsk.key
@@ -280,8 +287,8 @@ rm -f ${zsk}.private
# is inactive.
#
setup inaczsk.example
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
-zsk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
$SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > s.out || dumpit s.out
echo $ksk > ../inaczsk-ksk.key
echo $zsk > ../inaczsk-zsk.key
@@ -300,7 +307,7 @@ $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
#
setup sync.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
echo ns3/$ksk > ../sync.key
@@ -310,7 +317,7 @@ echo ns3/$ksk > ../sync.key
#
setup kskonly.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -319,7 +326,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup inacksk2.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -Pnow -A now+3600 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -Pnow -A now+3600 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -328,7 +335,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup inaczsk2.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -338,7 +345,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
setup inacksk3.example
cp $infile $zonefile
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 -fk $zone > kg.out 2>&1 || dumpit kg.out
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -347,7 +354,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup inaczsk3.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -358,9 +365,9 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup delzsk.example
cp $infile $zonefile
-ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-zsk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -I now-1w $zone 2>kg.out` || dumpit kg.out
+zsk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -I now-1w $zone 2>kg.out) || dumpit kg.out
echo $zsk > ../delzsk.key
#
@@ -368,7 +375,7 @@ echo $zsk > ../delzsk.key
#
setup dname-at-apex-nsec3.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -377,7 +384,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup cds-delete.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
@@ -387,6 +394,6 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
#
setup cdnskey-delete.example
cp $infile $zonefile
-ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
$DSFROMKEY $ksk.key > dsset-${zone}$TP
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns3/named.conf.in b/external/mpl/bind/dist/bin/tests/system/autosign/ns3/named.conf.in
index 8f2eb5675ad..a1f1f0d1703 100644
--- a/external/mpl/bind/dist/bin/tests/system/autosign/ns3/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns3/named.conf.in
@@ -156,9 +156,9 @@ zone "rsasha512.example" {
auto-dnssec maintain;
};
-zone "nsec.example" {
+zone "nsec-only.example" {
type primary;
- file "nsec.example.db";
+ file "nsec-only.example.db";
allow-update { any; };
auto-dnssec maintain;
};
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/ns3/nsec-only.example.db.in b/external/mpl/bind/dist/bin/tests/system/autosign/ns3/nsec-only.example.db.in
new file mode 100644
index 00000000000..0b11a00b004
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/ns3/nsec-only.example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300 ; 5 minutes
+@ IN SOA mname1. . (
+ 2009102722 ; serial
+ 20 ; refresh (20 seconds)
+ 20 ; retry (20 seconds)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+ )
+ NS ns
+ns A 10.53.0.3
+
+a A 10.0.0.1
+b A 10.0.0.2
+d A 10.0.0.4
+x CNAME a
diff --git a/external/mpl/bind/dist/bin/tests/system/autosign/tests.sh b/external/mpl/bind/dist/bin/tests/system/autosign/tests.sh
index 1792ebabcd6..309e938f277 100755
--- a/external/mpl/bind/dist/bin/tests/system/autosign/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/autosign/tests.sh
@@ -40,7 +40,7 @@ showprivate () {
checkprivate () {
_ret=0
expected="${3:-0}"
- x=`showprivate "$@"`
+ x=$(showprivate "$@")
echo $x | grep incomplete > /dev/null && _ret=1
if [ $_ret = $expected ]; then
@@ -164,14 +164,14 @@ do
$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
done
- i=`expr $i + 1`
+ i=$((i + 1))
if [ $ret = 0 ]; then break; fi
echo_i "waiting ... ($i)"
sleep 2
done
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "done"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "Initial counts of RRSIG expiry fields values for auto signed zones"
for z in .
@@ -203,33 +203,33 @@ ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inacksk3.example > dig.out.ns3.test$n
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
- $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}'`
+zskid=$(awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
+ $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}')
grep "DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 2 " dig.out.ns3.test$n > /dev/null || ret=1
pattern="DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 2 [0-9]* [0-9]* [0-9]* ${zskid} "
grep "${pattern}" dig.out.ns3.test$n > /dev/null && ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "RRSIG" && $5 == "DNSKEY" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "DNSKEY" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 3 || ret=1
awk='$4 == "RRSIG" && $5 == "DNSKEY" { printf "%05u\n", $11 }'
-id=`awk "${awk}" dig.out.ns3.test$n`
+id=$(awk "${awk}" dig.out.ns3.test$n)
keyfile=$(printf "ns3/Kinacksk3.example.+%03u+%s" "${DEFAULT_ALGORITHM_NUMBER}" "${id}")
$SETTIME -D now+5 "${keyfile}" > settime.out.test$n || ret=1
($RNDCCMD 10.53.0.3 loadkeys inacksk3.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
#
# Check that zone is initially signed with a ZSK and not a KSK.
@@ -239,26 +239,26 @@ echo_ic "resigned after the active ZSK is deleted - stage 1: Verify that zone"
echo_ic "is initially signed with a ZSK and not a KSK. ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
- $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
+kskid=$(awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
+ $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' )
grep "CNAME ${DEFAULT_ALGORITHM_NUMBER} 3 " dig.out.ns3.test$n > /dev/null || ret=1
grep "CNAME ${DEFAULT_ALGORITHM_NUMBER} 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "RRSIG" && $5 == "CNAME" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "DNSKEY" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 3 || ret=1
-id=`awk '$4 == "RRSIG" && $5 == "CNAME" { printf "%05u\n", $11 }' dig.out.ns3.test$n`
+id=$(awk '$4 == "RRSIG" && $5 == "CNAME" { printf "%05u\n", $11 }' dig.out.ns3.test$n)
keyfile=$(printf "ns3/Kinaczsk3.example.+%03u+%s" "${DEFAULT_ALGORITHM_NUMBER}" "${id}")
$SETTIME -D now+5 "${keyfile}" > settime.out.test$n || ret=1
($RNDCCMD 10.53.0.3 loadkeys inaczsk3.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking NSEC->NSEC3 conversion prerequisites ($n)"
ret=0
@@ -267,17 +267,17 @@ $DIG $DIGOPTS +noall +answer nsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.
grep "NSEC3PARAM" dig.out.ns3.1.test$n > /dev/null && ret=1
$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
grep "NSEC3PARAM" dig.out.ns3.2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking NSEC3->NSEC conversion prerequisites ($n)"
ret=0
$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "converting zones from nsec to nsec3"
$NSUPDATE > /dev/null 2>&1 <<END || status=1
@@ -305,30 +305,34 @@ update add optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
send
END
-# try to convert nsec.example; this should fail due to non-NSEC key
-echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
-$NSUPDATE > nsupdate.out 2>&1 <<END
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+ # try to convert nsec-only.example; this should fail due to
+ # non-NSEC3 compatible keys
+ echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
+ $NSUPDATE > nsupdate.out 2>&1 <<END
server 10.53.0.3 ${PORT}
-zone nsec.example.
-update add nsec.example. 3600 NSEC3PARAM 1 0 10 BEEF
+zone nsec-only.example.
+update add nsec-only.example. 3600 NSEC3PARAM 1 0 10 BEEF
send
END
+fi
echo_i "checking for nsec3param in unsigned zone ($n)"
ret=0
$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking for nsec3param signing record ($n)"
ret=0
$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
grep "Pending NSEC3 chain 1 0 20 DEAF" signing.out.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "resetting nsec3param via rndc signing ($n)"
ret=0
@@ -338,19 +342,19 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
ret=0
$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
grep "Pending NSEC3 chain 1 1 10 BEEF" signing.out.test$n > /dev/null || ret=1
- num=`grep "Pending " signing.out.test$n | wc -l`
+ num=$(grep "Pending " signing.out.test$n | wc -l)
[ $num -eq 1 ] || ret=1
[ $ret -eq 0 ] && break
echo_i "waiting ... ($i)"
sleep 2
done
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "signing preset nsec3 zone"
-zsk=`cat autozsk.key`
-ksk=`cat autoksk.key`
+zsk=$(cat autozsk.key)
+ksk=$(cat autoksk.key)
$SETTIME -K ns3 -P now -A now $zsk > settime.out.test$n.zsk || ret=1
$SETTIME -K ns3 -P now -A now $ksk > settime.out.test$n.ksk || ret=1
($RNDCCMD 10.53.0.3 loadkeys autonsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
@@ -374,9 +378,9 @@ echo_i "checking that expired RRSIGs from missing KSK $missing are not deleted (
ret=0
$JOURNALPRINT ns3/noksk.example.db.jnl | \
awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {error=1}} END {exit error}' id=$missing || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
missing=$(keyfile_to_key_id "$(cat nozsk-zsk.key)")
ksk=$(keyfile_to_key_id "$(cat nozsk-ksk.key)")
@@ -386,9 +390,9 @@ $JOURNALPRINT ns3/nozsk.example.db.jnl | \
awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$missing || ret=1
$JOURNALPRINT ns3/nozsk.example.db.jnl | \
awk '{if ($1 == "add" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$ksk || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
inactive=$(keyfile_to_key_id "$(cat inaczsk-zsk.key)")
ksk=$(keyfile_to_key_id "$(cat inaczsk-ksk.key)")
@@ -398,25 +402,25 @@ $JOURNALPRINT ns3/inaczsk.example.db.jnl | \
awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$inactive || ret=1
$JOURNALPRINT ns3/inaczsk.example.db.jnl | \
awk '{if ($1 == "add" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$ksk || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that replaced RRSIGs are not logged (missing ZSK private key) ($n)"
ret=0
-loglines=`grep "Key nozsk.example/$DEFAULT_ALGORITHM/$missing .* retaining signatures" ns3/named.run | wc -l`
+loglines=$(grep "Key nozsk.example/$DEFAULT_ALGORITHM/$missing .* retaining signatures" ns3/named.run | wc -l)
[ "$loglines" -eq 0 ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that replaced RRSIGs are not logged (inactive ZSK private key) ($n)"
ret=0
-loglines=`grep "Key inaczsk.example/$DEFAULT_ALGORITHM/$inactive .* retaining signatures" ns3/named.run | wc -l`
+loglines=$(grep "Key inaczsk.example/$DEFAULT_ALGORITHM/$inactive .* retaining signatures" ns3/named.run | wc -l)
[ "$loglines" -eq 0 ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Send rndc sync command to ns1, ns2 and ns3, to force the dynamically
# signed zones to be dumped to their zone files
@@ -441,18 +445,18 @@ $DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.3 a > dig.out.ns3.test$n || re
$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Check jitter distribution.
echo_i "checking expired signatures were jittered correctly ($n)"
ret=0
$DIG $DIGOPTS axfr oldsigs.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
checkjitter dig.out.ns3.test$n || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking NSEC->NSEC3 conversion succeeded ($n)"
ret=0
@@ -463,9 +467,9 @@ $DIG $DIGOPTS +noauth q.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking direct NSEC3 autosigning succeeded ($n)"
ret=0
@@ -477,16 +481,21 @@ $DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.4 a > dig.out.ns4.test$n ||
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking NSEC->NSEC3 conversion failed with NSEC-only key ($n)"
ret=0
-grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
-n=`expr $n + 1`
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+ grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
+else
+ echo_i "skip: RSASHA1 not supported"
+fi
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking NSEC3->NSEC conversion succeeded ($n)"
ret=0
@@ -498,9 +507,9 @@ $DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.4 a > dig.out.ns4.test$n
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking NSEC3->NSEC conversion with 'rndc signing -nsec3param none' ($n)"
ret=0
@@ -517,45 +526,45 @@ $DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.4 a > dig.out.ns4.test$n ||
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking TTLs of imported DNSKEYs (no default) ($n)"
ret=0
$DIG $DIGOPTS +tcp +noall +answer dnskey ttl1.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
[ -s dig.out.ns3.test$n ] || ret=1
(awk 'BEGIN {r=0} $2 != 300 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking TTLs of imported DNSKEYs (with default) ($n)"
ret=0
$DIG $DIGOPTS +tcp +noall +answer dnskey ttl2.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
[ -s dig.out.ns3.test$n ] || ret=1
(awk 'BEGIN {r=0} $2 != 60 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking TTLs of imported DNSKEYs (mismatched) ($n)"
ret=0
$DIG $DIGOPTS +tcp +noall +answer dnskey ttl3.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
[ -s dig.out.ns3.test$n ] || ret=1
(awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking TTLs of imported DNSKEYs (existing RRset) ($n)"
ret=0
$DIG $DIGOPTS +tcp +noall +answer dnskey ttl4.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
[ -s dig.out.ns3.test$n ] || ret=1
(awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking positive validation NSEC ($n)"
ret=0
@@ -563,9 +572,9 @@ $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
$DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking positive validation NSEC3 ($n)"
ret=0
@@ -575,9 +584,9 @@ $DIG $DIGOPTS +noauth a.nsec3.example. \
@10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking positive validation OPTOUT ($n)"
ret=0
@@ -587,9 +596,9 @@ $DIG $DIGOPTS +noauth a.optout.example. \
@10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking negative validation NXDOMAIN NSEC ($n)"
ret=0
@@ -598,9 +607,9 @@ $DIG $DIGOPTS +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking negative validation NXDOMAIN NSEC3 ($n)"
ret=0
@@ -611,9 +620,9 @@ $DIG $DIGOPTS +noauth q.nsec3.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking negative validation NXDOMAIN OPTOUT ($n)"
ret=0
@@ -625,9 +634,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
# Note - this is looking for failure, hence the &&
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking negative validation NODATA NSEC ($n)"
ret=0
@@ -637,9 +646,9 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking negative validation NODATA NSEC3 ($n)"
ret=0
@@ -651,9 +660,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking negative validation NODATA OPTOUT ($n)"
ret=0
@@ -665,9 +674,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Check the insecure.example domain
@@ -679,9 +688,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
# Note - this is looking for failure, hence the &&
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking 1-server negative insecurity proof NSEC ($n)"
ret=0
@@ -693,9 +702,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
# Note - this is looking for failure, hence the &&
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Check the secure.example domain
@@ -708,9 +717,9 @@ $DIG $DIGOPTS +noauth a.secure.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)"
ret=0
@@ -721,9 +730,9 @@ $DIG $DIGOPTS +noauth a.nsec3.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation NSEC/OPTOUT ($n)"
ret=0
@@ -734,9 +743,9 @@ $DIG $DIGOPTS +noauth a.optout.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation NSEC3/NSEC ($n)"
ret=0
@@ -747,9 +756,9 @@ $DIG $DIGOPTS +noauth a.secure.nsec3.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation NSEC3/NSEC3 ($n)"
ret=0
@@ -760,9 +769,9 @@ $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation NSEC3/OPTOUT ($n)"
ret=0
@@ -773,9 +782,9 @@ $DIG $DIGOPTS +noauth a.optout.nsec3.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation OPTOUT/NSEC ($n)"
ret=0
@@ -786,9 +795,9 @@ $DIG $DIGOPTS +noauth a.secure.optout.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation OPTOUT/NSEC3 ($n)"
ret=0
@@ -799,9 +808,9 @@ $DIG $DIGOPTS +noauth a.nsec3.optout.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking multi-stage positive validation OPTOUT/OPTOUT ($n)"
ret=0
@@ -812,9 +821,9 @@ $DIG $DIGOPTS +noauth a.optout.optout.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking empty NODATA OPTOUT ($n)"
ret=0
@@ -825,9 +834,9 @@ $DIG $DIGOPTS +noauth empty.optout.example. \
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
#grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Check the insecure.secure.example domain (insecurity proof)
@@ -841,9 +850,9 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
# Note - this is looking for failure, hence the &&
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Check a negative response in insecure.secure.example
@@ -857,18 +866,18 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
# Note - this is looking for failure, hence the &&
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking security root query ($n)"
ret=0
$DIG $DIGOPTS . @10.53.0.4 key > dig.out.ns4.test$n || ret=1
grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking positive validation RSASHA256 NSEC ($n)"
ret=0
@@ -876,9 +885,9 @@ $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n ||
$DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking positive validation RSASHA512 NSEC ($n)"
ret=0
@@ -886,9 +895,9 @@ $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n ||
$DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that positive validation in a privately secure zone works ($n)"
ret=0
@@ -899,9 +908,9 @@ $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.4 \
digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that negative validation in a privately secure zone works ($n)"
ret=0
@@ -913,18 +922,18 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
# Note - this is looking for failure, hence the &&
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking privately secure to nxdomain works ($n)"
ret=0
$DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.4 > dig.out.ns4.test$n || ret=1
grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Try validating with a revoked trusted key.
# This should fail.
@@ -934,69 +943,69 @@ ret=0
$DIG $DIGOPTS example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
grep "flags:.*; QUERY" dig.out.ns5.test$n > /dev/null || ret=1
grep "flags:.* ad.*; QUERY" dig.out.ns5.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that revoked key is present ($n)"
ret=0
-id=`cat rev.key`
+id=$(cat rev.key)
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that revoked key self-signs ($n)"
ret=0
-id=`cat rev.key`
+id=$(cat rev.key)
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking for unpublished key ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat unpub.key)")
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking for activated but unpublished key ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat activate-now-publish-1day.key)")
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that standby key does not sign records ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat standby.key)")
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that deactivated key does not sign records ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat inact.key)")
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking insertion of public-only key ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat nopriv.key)")
-file="ns1/`cat nopriv.key`.key"
-keydata=`grep DNSKEY $file`
+file="ns1/$(cat nopriv.key).key"
+keydata=$(grep DNSKEY $file)
$NSUPDATE > /dev/null 2>&1 <<END || status=1
server 10.53.0.1 ${PORT}
zone .
@@ -1007,18 +1016,18 @@ END
sleep 1
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking key deletion ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat del.key)")
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking secure-to-insecure transition, nsupdate ($n)"
ret=0
@@ -1031,33 +1040,33 @@ END
for i in 0 1 2 3 4 5 6 7 8 9; do
ret=0
$DIG $DIGOPTS axfr secure-to-insecure.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
- egrep '(RRSIG|DNSKEY|NSEC)' dig.out.ns3.test$n > /dev/null && ret=1
+ grep -E '(RRSIG|DNSKEY|NSEC)' dig.out.ns3.test$n > /dev/null && ret=1
[ $ret -eq 0 ] && break
echo_i "waiting ... ($i)"
sleep 2
done
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking secure-to-insecure transition, scheduled ($n)"
ret=0
-file="ns3/`cat del1.key`.key"
+file="ns3/$(cat del1.key).key"
$SETTIME -I now -D now $file > settime.out.test$n.1 || ret=1
-file="ns3/`cat del2.key`.key"
+file="ns3/$(cat del2.key).key"
$SETTIME -I now -D now $file > settime.out.test$n.2 || ret=1
($RNDCCMD 10.53.0.3 sign secure-to-insecure2.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
for i in 0 1 2 3 4 5 6 7 8 9; do
ret=0
$DIG $DIGOPTS axfr secure-to-insecure2.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
- egrep '(RRSIG|DNSKEY|NSEC3)' dig.out.ns3.test$n > /dev/null && ret=1
+ grep -E '(RRSIG|DNSKEY|NSEC3)' dig.out.ns3.test$n > /dev/null && ret=1
[ $ret -eq 0 ] && break
echo_i "waiting ... ($i)"
sleep 2
done
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking jitter in a newly signed NSEC3 zone ($n)"
ret=0
@@ -1085,14 +1094,14 @@ retry_quiet 40 check_if_nsec3param_exists || {
$DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
# Check jitter distribution.
checkjitter dig.out.ns3.2.test$n || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that serial number and RRSIGs are both updated (rt21045) ($n)"
ret=0
-oldserial=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}'`
-oldinception=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u`
+oldserial=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}')
+oldinception=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u)
$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -K ns3 -P 0 -A +6d -I +38d -D +45d prepub.example > /dev/null
@@ -1101,43 +1110,43 @@ newserial=$oldserial
try=0
while [ $oldserial -eq $newserial -a $try -lt 42 ]
do
- newserial=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 |
- awk '$0 !~ /SOA/ {print $3}'`
+ newserial=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 |
+ awk '$0 !~ /SOA/ {print $3}')
sleep 1
- try=`expr $try + 1`
+ try=$((try + 1))
done
-newinception=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u`
+newinception=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u)
#echo "$oldserial : $newserial"
#echo "$oldinception : $newinception"
[ "$oldserial" = "$newserial" ] && ret=1
[ "$oldinception" = "$newinception" ] && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "preparing to test key change corner cases"
echo_i "removing a private key file"
-file="ns1/`cat vanishing.key`.private"
+file="ns1/$(cat vanishing.key).private"
rm -f $file
echo_i "preparing ZSK roll"
-starttime=`$PERL -e 'print time(), "\n";'`
-oldfile=`cat active.key`
+starttime=$($PERL -e 'print time(), "\n";')
+oldfile=$(cat active.key)
oldid=$(keyfile_to_key_id "$(cat active.key)")
-newfile=`cat standby.key`
+newfile=$(cat standby.key)
newid=$(keyfile_to_key_id "$(cat standby.key)")
$SETTIME -K ns1 -I now+2s -D now+25 $oldfile > settime.out.test$n.1 || ret=1
$SETTIME -K ns1 -i 0 -S $oldfile $newfile > settime.out.test$n.2 || ret=1
# note previous zone serial number
-oldserial=`$DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}'`
+oldserial=$($DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}')
($RNDCCMD 10.53.0.1 loadkeys . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
sleep 4
echo_i "revoking key to duplicated key ID"
-$SETTIME -R now -K ns2 Kbar.+005+30676.key > settime.out.test$n.3 || ret=1
+$SETTIME -R now -K ns2 Kbar.+013+59973.key > settime.out.test$n.3 || ret=1
($RNDCCMD 10.53.0.2 loadkeys bar. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
@@ -1148,18 +1157,18 @@ echo_i "checking former standby key $newid is now active ($n)"
ret=0
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking former standby key has only signed incrementally ($n)"
ret=0
$DIG $DIGOPTS txt . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
grep 'RRSIG.*'" $oldid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that signing records have been marked as complete ($n)"
ret=0
@@ -1171,7 +1180,10 @@ checkprivate nsec3.example 10.53.0.3 || ret=1
checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
checkprivate nsec3.optout.example 10.53.0.3 || ret=1
checkprivate nsec3-to-nsec.example 10.53.0.3 || ret=1
-checkprivate nsec.example 10.53.0.3 || ret=1
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+ checkprivate nsec-only.example 10.53.0.3 || ret=1
+fi
checkprivate oldsigs.example 10.53.0.3 || ret=1
checkprivate optout.example 10.53.0.3 || ret=1
checkprivate optout.nsec3.example 10.53.0.3 || ret=1
@@ -1188,8 +1200,8 @@ checkprivate ttl1.example 10.53.0.3 || ret=1
checkprivate ttl2.example 10.53.0.3 || ret=1
checkprivate ttl3.example 10.53.0.3 || ret=1
checkprivate ttl4.example 10.53.0.3 || ret=1
-n=`expr $n + 1`
-status=`expr $status + $ret`
+n=$((n + 1))
+status=$((status + ret))
echo_i "forcing full sign"
($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
@@ -1201,22 +1213,22 @@ echo_i "checking former standby key has now signed fully ($n)"
ret=0
$DIG $DIGOPTS txt . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking SOA serial number has been incremented ($n)"
ret=0
-newserial=`$DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}'`
+newserial=$($DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}')
[ "$newserial" != "$oldserial" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking delayed key publication/activation ($n)"
ret=0
-zsk=`cat delayzsk.key`
-ksk=`cat delayksk.key`
+zsk=$(cat delayzsk.key)
+ksk=$(cat delayksk.key)
# publication and activation times should be unset
$SETTIME -K ns3 -pA -pP $zsk > settime.out.test$n.zsk || ret=1
grep -v UNSET settime.out.test$n.zsk >/dev/null && ret=1
@@ -1225,9 +1237,9 @@ grep -v UNSET settime.out.test$n.ksk >/dev/null && ret=1
$DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
# DNSKEY not expected:
awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking scheduled key publication, not activation ($n)"
ret=0
@@ -1245,9 +1257,9 @@ $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test
awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n || ret=1
# RRSIG not expected:
awk 'BEGIN {r=1} $4=="RRSIG" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking scheduled key activation ($n)"
ret=0
@@ -1271,17 +1283,17 @@ check_is_signed() {
return 0
}
retry_quiet 5 check_is_signed || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking former active key was removed ($n)"
#
# Work out how long we need to sleep. Allow 4 seconds for the records
# to be removed.
#
-now=`$PERL -e 'print time(), "\n";'`
-sleep=`expr $starttime + 29 - $now`
+now=$($PERL -e 'print time(), "\n";')
+sleep=$((starttime + 29 - now))
case $sleep in
-*|0);;
*) echo_i "waiting for timer to have activated"; sleep $sleep;;
@@ -1289,23 +1301,23 @@ esac
ret=0
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$oldid"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking private key file removal caused no immediate harm ($n)"
ret=0
id=$(keyfile_to_key_id "$(cat vanishing.key)")
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking revoked key with duplicate key ID ($n)"
ret=0
-id=30676
-rid=30804
+id=59973
+rid=60101
$DIG $DIGOPTS +multi dnskey bar @10.53.0.2 > dig.out.ns2.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns2.test$n > /dev/null && ret=1
keys=$(grep '; key id = '"$rid"'$' dig.out.ns2.test$n | wc -l)
@@ -1322,9 +1334,9 @@ ret=0
# be scheduled for the present moment, and then never fire. check for
# visible evidence of this error in the logs:
awk '/next key event/ {if ($1 == $8 && $2 == $9) exit 1}' */named.run || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# this confirms that key events are never scheduled more than
# 'dnssec-loadkeys-interval' minutes in the future, and that the
@@ -1358,19 +1370,19 @@ ret=0
check_interval ns1 3600 || ret=1
check_interval ns2 1800 || ret=1
check_interval ns3 600 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking for key reloading loops ($n)"
ret=0
# every key event should schedule a successor, so these should be equal
-rekey_calls=`grep "reconfiguring zone keys" ns*/named.run | wc -l`
-rekey_events=`grep "next key event" ns*/named.run | wc -l`
+rekey_calls=$(grep "reconfiguring zone keys" ns*/named.run | wc -l)
+rekey_events=$(grep "next key event" ns*/named.run | wc -l)
[ "$rekey_calls" = "$rekey_events" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "forcing full sign with unreadable keys ($n)"
ret=0
@@ -1378,31 +1390,31 @@ chmod 0 ns1/K.+*+*.key ns1/K.+*+*.private || ret=1
($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
$DIG $DIGOPTS . @10.53.0.1 dnskey > dig.out.ns1.test$n || ret=1
grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "test turning on auto-dnssec during reconfig ($n)"
ret=0
# first create a zone that doesn't have auto-dnssec
($RNDCCMD 10.53.0.3 addzone reconf.example '{ type primary; file "reconf.example.db"; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
+rekey_calls=$(grep "zone reconf.example.*next key event" ns3/named.run | wc -l)
[ "$rekey_calls" -eq 0 ] || ret=1
# ...then we add auto-dnssec and reconfigure
($RNDCCMD 10.53.0.3 modzone reconf.example '{ type primary; file "reconf.example.db"; allow-update { any; }; auto-dnssec maintain; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
rndc_reconfig ns3 10.53.0.3
for i in 0 1 2 3 4 5 6 7 8 9; do
lret=0
- rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
+ rekey_calls=$(grep "zone reconf.example.*next key event" ns3/named.run | wc -l)
[ "$rekey_calls" -gt 0 ] || lret=1
if [ "$lret" -eq 0 ]; then break; fi
echo_i "waiting ... ($i)"
sleep 1
done
-n=`expr $n + 1`
+n=$((n + 1))
if [ "$lret" != 0 ]; then ret=$lret; fi
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "test CDS and CDNSKEY auto generation ($n)"
ret=0
@@ -1410,42 +1422,42 @@ $DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null || ret=1
grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "test 'dnssec-dnskey-kskonly no' affects DNSKEY/CDS/CDNSKEY ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 sync.example dnskey > dig.out.ns3.dnskeytest$n
$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
$DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
-lines=`awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l)
test ${lines:-0} -eq 2 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l)
test ${lines:-0} -eq 2 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l)
test ${lines:-0} -eq 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "test 'dnssec-dnskey-kskonly yes' affects DNSKEY/CDS/CDNSKEY ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 kskonly.example dnskey > dig.out.ns3.dnskeytest$n
$DIG $DIGOPTS @10.53.0.3 kskonly.example cdnskey > dig.out.ns3.cdnskeytest$n
$DIG $DIGOPTS @10.53.0.3 kskonly.example cds > dig.out.ns3.cdstest$n
-lines=`awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l)
test ${lines:-0} -eq 1 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l)
test ${lines:-0} -eq 1 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l)
test ${lines:-0} -eq 1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "setting CDS and CDNSKEY deletion times and calling 'rndc loadkeys'"
-$SETTIME -D sync now `cat sync.key` > settime.out.test$n || ret=1
+$SETTIME -D sync now $(cat sync.key) > settime.out.test$n || ret=1
($RNDCCMD 10.53.0.3 loadkeys sync.example | sed 's/^/ns3 /' | cat_i) || ret=1
echo_i "checking that the CDS and CDNSKEY are deleted ($n)"
@@ -1457,51 +1469,51 @@ ensure_cds_and_cdnskey_are_deleted() {
awk '$1 == "sync.example." && $4 == "CDNSKEY" { exit 1; }' dig.out.ns3.cdnskeytest$n || return 1
}
retry 10 ensure_cds_and_cdnskey_are_deleted || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "check that dnssec-settime -p Dsync works ($n)"
ret=0
-$SETTIME -p Dsync `cat sync.key` > settime.out.test$n || ret=1
+$SETTIME -p Dsync $(cat sync.key) > settime.out.test$n || ret=1
grep "SYNC Delete:" settime.out.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "check that dnssec-settime -p Psync works ($n)"
ret=0
-$SETTIME -p Psync `cat sync.key` > settime.out.test$n || ret=1
+$SETTIME -p Psync $(cat sync.key) > settime.out.test$n || ret=1
grep "SYNC Publish:" settime.out.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "check that zone with inactive KSK and active ZSK is properly autosigned ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inacksk2.example > dig.out.ns3.test$n
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
- $DSFROMKEY -A -2 -f - inacksk2.example | awk '{ print $4}' `
+zskid=$(awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
+ $DSFROMKEY -A -2 -f - inacksk2.example | awk '{ print $4}' )
pattern="DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 2 [0-9]* [0-9]* [0-9]* ${zskid} "
grep "${pattern}" dig.out.ns3.test$n > /dev/null || ret=1
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
- $DSFROMKEY -2 -f - inacksk2.example | awk '{ print $4}' `
+kskid=$(awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
+ $DSFROMKEY -2 -f - inacksk2.example | awk '{ print $4}' )
pattern="DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 2 [0-9]* [0-9]* [0-9]* ${kskid} "
grep "${pattern}" dig.out.ns3.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "check that zone with inactive ZSK and active KSK is properly autosigned ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inaczsk2.example > dig.out.ns3.test$n
grep "SOA ${DEFAULT_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
#
# Check that DNSKEY is now signed with the ZSK.
@@ -1513,24 +1525,24 @@ ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inacksk3.example > dig.out.ns3.test$n
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
- $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}' `
+zskid=$(awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
+ $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}' )
pattern="DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 2 [0-9]* [0-9]* [0-9]* ${zskid} "
grep "${pattern}" dig.out.ns3.test$n > /dev/null || ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "RRSIG" && $5 == "DNSKEY" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "DNSKEY" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
#
# Check that zone is now signed with the KSK.
@@ -1540,20 +1552,20 @@ echo_ic "resigned after the active ZSK is deleted - stage 2: Verify that zone"
echo_ic "is now signed with the KSK. ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
- $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
+kskid=$(awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
+ $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' )
grep "CNAME ${DEFAULT_ALGORITHM_NUMBER} 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "RRSIG" && $5 == "CNAME" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
+count=$(awk 'BEGIN { count = 0 }
$4 == "DNSKEY" { count++ }
- END {print count}' dig.out.ns3.test$n`
+ END {print count}' dig.out.ns3.test$n)
test $count -eq 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking for out-of-zone NSEC3 records after ZSK removal ($n)"
ret=0
@@ -1578,7 +1590,7 @@ if [ $_ret -ne 0 ]; then
ret=1
fi
# Mark the inactive ZSK as pending removal.
-file="ns3/`cat delzsk.key`.key"
+file="ns3/$(cat delzsk.key).key"
$SETTIME -D now-1h $file > settime.out.test$n || ret=1
# Trigger removal of the inactive ZSK and wait until its completion.
($RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
@@ -1587,7 +1599,7 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.3.test$n 2>&1
grep "Signing " signing.out.3.test$n > /dev/null 2>&1
if [ $? -ne 0 ]; then
- if [ `grep "Done signing " signing.out.3.test$n | wc -l` -eq 2 ]; then
+ if [ $(grep "Done signing " signing.out.3.test$n | wc -l) -eq 2 ]; then
_ret=0
break
fi
@@ -1609,17 +1621,17 @@ fi
#
$DIG $DIGOPTS delzsk.example AXFR @10.53.0.3 > dig.out.ns3.3.test$n || ret=1
grep "589R358VSPJUFVAJU949JPVF74D9PTGH" dig.out.ns3.3.test$n > /dev/null 2>&1 && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "check that DNAME at apex with NSEC3 is correctly signed (auto-dnssec maintain) ($n)"
ret=0
$DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "RRSIG NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 600" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that DNAME is not treated as a delegation when signing ($n)"
ret=0
@@ -1627,25 +1639,25 @@ $DIG $DIGOPTS dname-and-txt.secure.example. DNAME @10.53.0.3 > dig.out.ns3.1.tes
grep "dname-and-txt.secure.example.*RRSIG.*DNAME" dig.out.ns3.1.test$n > /dev/null 2>&1 || ret=1
$DIG $DIGOPTS dname-and-txt.secure.example. TXT @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
grep "dname-and-txt.secure.example.*RRSIG.*TXT" dig.out.ns3.2.test$n > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking key maintenance events were logged correctly ($n)"
ret=0
-pub=`grep "DNSKEY .* is now published" ns1/named.run | wc -l`
+pub=$(grep "DNSKEY .* is now published" ns1/named.run | wc -l)
[ "$pub" -eq 6 ] || ret=1
-act=`grep "DNSKEY .* is now active" ns1/named.run | wc -l`
+act=$(grep "DNSKEY .* is now active" ns1/named.run | wc -l)
[ "$act" -eq 5 ] || ret=1
-rev=`grep "DNSKEY .* is now revoked" ns1/named.run | wc -l`
+rev=$(grep "DNSKEY .* is now revoked" ns1/named.run | wc -l)
[ "$rev" -eq 1 ] || ret=1
-inac=`grep "DNSKEY .* is now inactive" ns1/named.run | wc -l`
+inac=$(grep "DNSKEY .* is now inactive" ns1/named.run | wc -l)
[ "$inac" -eq 1 ] || ret=1
-del=`grep "DNSKEY .* is now deleted" ns1/named.run | wc -l`
+del=$(grep "DNSKEY .* is now deleted" ns1/named.run | wc -l)
[ "$del" -eq 1 ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that CDS (DELETE) persists after zone sign ($n)"
echo_i "update add cds-delete.example. CDS 0 0 00"
@@ -1684,9 +1696,9 @@ retry_quiet 1 _cds_delete cds-delete.example. || ret=1
echo_i "query cds-delete.example. CDNSKEY"
retry_quiet 1 _cdnskey_delete_nx cds-delete.example. || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that CDNSKEY (DELETE) persists after zone sign ($n)"
echo_i "update add cdnskey-delete.example. CDNSKEY 0 3 0 AA=="
@@ -1725,9 +1737,9 @@ retry_quiet 1 _cdnskey_delete cdnskey-delete.example. || ret=1
echo_i "query cdnskey-delete.example. CDS"
retry_quiet 1 _cds_delete_nx cdnskey-delete.example. || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/builtin/tests.sh b/external/mpl/bind/dist/bin/tests/system/builtin/tests.sh
index 482f31733a2..416b79270fd 100644
--- a/external/mpl/bind/dist/bin/tests/system/builtin/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/builtin/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -159,7 +161,7 @@ sleep 1
grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-HOSTNAME=`$FEATURETEST --gethostname`
+HOST_NAME=`$FEATURETEST --gethostname`
BIND_VERSION_STRING=$($NAMED -V | head -1)
BIND_VERSION=$($NAMED -V | sed -ne 's/^BIND \([^ ]*\).*/\1/p')
@@ -167,14 +169,14 @@ n=`expr $n + 1`
ret=0
echo_i "Checking that default version works for rndc ($n)"
$RNDCCMD 10.53.0.1 status > rndc.status.ns1.$n 2>&1
-fgrep "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
+grep -F "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
n=`expr $n + 1`
ret=0
echo_i "Checking that custom version works for rndc ($n)"
$RNDCCMD 10.53.0.3 status > rndc.status.ns3.$n 2>&1
-fgrep "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
+grep -F "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
n=`expr $n + 1`
@@ -195,7 +197,7 @@ n=`expr $n + 1`
ret=0
echo_i "Checking that default hostname works for query ($n)"
$DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.1 > dig.out.ns1.$n
-grep "^\"$HOSTNAME\"$" dig.out.ns1.$n > /dev/null || ret=1
+grep "^\"$HOST_NAME\"$" dig.out.ns1.$n > /dev/null || ret=1
if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
n=`expr $n + 1`
@@ -217,14 +219,14 @@ n=`expr $n + 1`
ret=0
echo_i "Checking that server-id hostname works for query ($n)"
$DIG $DIGOPTS +short id.server txt ch @10.53.0.2 > dig.out.ns2.$n
-grep "^\"$HOSTNAME\"$" dig.out.ns2.$n > /dev/null || ret=1
+grep "^\"$HOST_NAME\"$" dig.out.ns2.$n > /dev/null || ret=1
if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
n=`expr $n + 1`
ret=0
echo_i "Checking that server-id hostname works for EDNS name server ID request ($n)"
$DIG $DIGOPTS +norec +nsid foo @10.53.0.2 > dig.out.ns2.$n
-grep "^; NSID: .* (\"$HOSTNAME\")$" dig.out.ns2.$n > /dev/null || ret=1
+grep "^; NSID: .* (\"$HOST_NAME\")$" dig.out.ns2.$n > /dev/null || ret=1
if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
n=`expr $n + 1`
diff --git a/external/mpl/bind/dist/bin/tests/system/cacheclean/tests.sh b/external/mpl/bind/dist/bin/tests/system/cacheclean/tests.sh
index ef13f0f010a..033caf001b7 100755
--- a/external/mpl/bind/dist/bin/tests/system/cacheclean/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/cacheclean/tests.sh
@@ -109,7 +109,7 @@ echo_i "reset and check that records are correctly cached initially ($n)"
ret=0
load_cache
dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
[ $nrecords -eq 18 ] || { ret=1; echo_i "found $nrecords records expected 18"; }
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
@@ -203,7 +203,7 @@ n=`expr $n + 1`
echo_i "check the number of cached records remaining ($n)"
ret=0
dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | egrep '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | grep -E '(TXT|ANY)' | wc -l`
[ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
@@ -221,7 +221,7 @@ n=`expr $n + 1`
echo_i "check the number of cached records remaining ($n)"
ret=0
dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
[ $nrecords -eq 1 ] || { ret=1; echo_i "found $nrecords records expected 1"; }
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
diff --git a/external/mpl/bind/dist/bin/tests/system/case/setup.sh b/external/mpl/bind/dist/bin/tests/system/case/setup.sh
index f2974234bd5..f691185e137 100644
--- a/external/mpl/bind/dist/bin/tests/system/case/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/case/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/clean.sh b/external/mpl/bind/dist/bin/tests/system/catz/clean.sh
index c3600d305bd..fd8e9e4c3fb 100644
--- a/external/mpl/bind/dist/bin/tests/system/catz/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/catz/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/ns1/named.conf.in b/external/mpl/bind/dist/bin/tests/system/catz/ns1/named.conf.in
index 5a46d3984f8..b64b4d5dbfa 100644
--- a/external/mpl/bind/dist/bin/tests/system/catz/ns1/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/catz/ns1/named.conf.in
@@ -63,5 +63,10 @@ zone "catalog4.example" {
key tsig_key. {
secret "LSAnCU+Z";
- algorithm hmac-md5;
+ algorithm @DEFAULT_HMAC@;
+};
+
+key next_key. {
+ secret "LaAnCU+Z";
+ algorithm @DEFAULT_HMAC@;
};
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/ns2/named1.conf.in b/external/mpl/bind/dist/bin/tests/system/catz/ns2/named1.conf.in
index 8519802bb05..14cb8e01462 100644
--- a/external/mpl/bind/dist/bin/tests/system/catz/ns2/named1.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/catz/ns2/named1.conf.in
@@ -80,5 +80,10 @@ zone "catalog4.example" {
key tsig_key. {
secret "LSAnCU+Z";
- algorithm hmac-md5;
+ algorithm @DEFAULT_HMAC@;
+};
+
+key next_key. {
+ secret "LaAnCU+Z";
+ algorithm @DEFAULT_HMAC@;
};
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/ns2/named2.conf.in b/external/mpl/bind/dist/bin/tests/system/catz/ns2/named2.conf.in
index b6f0745ffcf..c167310e8df 100644
--- a/external/mpl/bind/dist/bin/tests/system/catz/ns2/named2.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/catz/ns2/named2.conf.in
@@ -58,5 +58,5 @@ zone "catalog4.example" {
key tsig_key. {
secret "LSAnCU+Z";
- algorithm hmac-md5;
+ algorithm @DEFAULT_HMAC@;
};
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/ns3/catalog.example.db.in b/external/mpl/bind/dist/bin/tests/system/catz/ns3/catalog.example.db.in
new file mode 100644
index 00000000000..eccb4f1004a
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/catz/ns3/catalog.example.db.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 2670950424 86400 3600 86400 3600
+@ 3600 IN NS invalid.
+version IN TXT "1"
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/setup.sh b/external/mpl/bind/dist/bin/tests/system/catz/setup.sh
index 8aa70c2afa4..ec3580b597d 100644
--- a/external/mpl/bind/dist/bin/tests/system/catz/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/catz/setup.sh
@@ -21,7 +21,7 @@ copy_setports ns2/named1.conf.in ns2/named.conf
copy_setports ns3/named.conf.in ns3/named.conf
cp -f ns1/catalog.example.db.in ns1/catalog1.example.db
-cp -f ns1/catalog.example.db.in ns3/catalog2.example.db
+cp -f ns3/catalog.example.db.in ns3/catalog2.example.db
cp -f ns1/catalog.example.db.in ns1/catalog3.example.db
cp -f ns1/catalog.example.db.in ns1/catalog4.example.db
diff --git a/external/mpl/bind/dist/bin/tests/system/catz/tests.sh b/external/mpl/bind/dist/bin/tests/system/catz/tests.sh
index 97b7e314b47..d85dfbbda77 100644
--- a/external/mpl/bind/dist/bin/tests/system/catz/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/catz/tests.sh
@@ -317,6 +317,9 @@ status=$((status+ret))
n=$((n+1))
echo_i "waiting for secondary to sync up ($n)"
ret=0
+wait_for_message ns2/named.run "catz: updating catalog zone 'catalog2.example' with serial 2670950425" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom2.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom3.example' from catalog 'catalog1.example'" &&
wait_for_message ns2/named.run "catz: adding zone 'dom4.example' from catalog 'catalog2.example'" &&
wait_for_message ns2/named.run "transfer of 'dom4.example/IN' from 10.53.0.1#${EXTRAPORT1}: Transfer status: success" || ret=1
if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -804,13 +807,63 @@ if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
+echo_i "change TSIG key name on primary ($n)"
+ret=0
+rndccmd 10.53.0.1 modzone dom9.example. '{type primary; notify yes; file "dom9.example.db"; allow-transfer { key next_key; }; };' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "update TSIG key name in catalog zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+ server 10.53.0.1 ${PORT}
+ update del label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+ update add label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "next_key"
+ send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: modifying zone 'dom9.example' from catalog 'catalog1.example'" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "update zone contents and reload ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 2 3600 3600 3600 3600" > ns1/dom9.example.db
+echo "@ IN NS ns2" >> ns1/dom9.example.db
+echo "ns2 IN A 10.53.0.2" >> ns1/dom9.example.db
+rndccmd 10.53.0.1 reload dom9.example. || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for primary to update zone ($n)"
+ret=0
+wait_for_a @10.53.0.1 ns2.dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for secondary to update zone ($n)"
+ret=0
+wait_for_a @10.53.0.2 ns2.dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
echo_i "deleting domain dom9.example. from catalog1 zone ($n)"
ret=0
$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
server 10.53.0.1 ${PORT}
update delete f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
update delete label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN A 10.53.0.1
- update delete label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+ update delete label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "next_key"
send
END
if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1766,5 +1819,44 @@ rndccmd 10.53.0.2 reconfig || ret=1
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status+ret))
+#########################################################################
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Adding a dom19.example. to primary via RNDC ($n)"
+ret=0
+# enough initial content for IXFR response when TXT record is added below
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom19.example.db
+echo "@ 3600 IN NS invalid." >> ns1/dom19.example.db
+echo "foo 3600 IN TXT some content here" >> ns1/dom19.example.db
+echo "bar 3600 IN TXT some content here" >> ns1/dom19.example.db
+echo "xxx 3600 IN TXT some content here" >> ns1/dom19.example.db
+echo "yyy 3600 IN TXT some content here" >> ns1/dom19.example.db
+rndccmd 10.53.0.1 addzone dom19.example. '{ type primary; file "dom19.example.db"; allow-transfer { key tsig_key; }; allow-update { any; }; notify explicit; also-notify { 10.53.0.2; }; };' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "add an entry to the restored catalog zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+ server 10.53.0.1 ${PORT}
+ update add 09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN PTR dom19.example.
+ update add label1.masters.09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN A 10.53.0.1
+ update add label1.masters.09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN TXT "tsig_key"
+ send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: adding zone 'dom19.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "transfer of 'dom19.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/cds/setup.sh b/external/mpl/bind/dist/bin/tests/system/cds/setup.sh
index d851b3f9187..dcb0070a122 100644
--- a/external/mpl/bind/dist/bin/tests/system/cds/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/cds/setup.sh
@@ -20,9 +20,9 @@ touch empty
Z=cds.test
-keyz=`$KEYGEN -q -a RSASHA256 $Z`
-key1=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
-key2=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
+keyz=$($KEYGEN -q -a $DEFAULT_ALGORITHM $Z)
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -f KSK $Z)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -f KSK $Z)
idz=$(keyfile_to_key_id $keyz)
id1=$(keyfile_to_key_id $key1)
@@ -38,15 +38,15 @@ id2=$id2
EOF
tac() {
- $PERL -e 'print reverse <>' "$@"
+ $PERL -e 'print reverse <>'
}
convert() {
key=$1
n=$2
$DSFROMKEY -12 $key >DS.$n
- grep ' 8 1 ' DS.$n >DS.$n-1
- grep ' 8 2 ' DS.$n >DS.$n-2
+ grep " ${DEFAULT_ALGORITHM_NUMBER} 1 " DS.$n >DS.$n-1
+ grep " ${DEFAULT_ALGORITHM_NUMBER} 2 " DS.$n >DS.$n-2
sed 's/ IN DS / IN CDS /' <DS.$n >>CDS.$n
sed 's/ IN DNSKEY / IN CDNSKEY /' <$key.key >CDNSKEY.$n
sed 's/ IN DS / 3600 IN DS /' <DS.$n >DS.ttl$n
@@ -64,9 +64,9 @@ $PERL -we 'utime time, time - 7200, "DS.inplace" or die'
mangle="$PERL mangle.pl"
-$mangle " IN DS $id1 8 1 " <DS.1 >DS.broke1
-$mangle " IN DS $id1 8 2 " <DS.1 >DS.broke2
-$mangle " IN DS $id1 8 [12] " <DS.1 >DS.broke12
+$mangle " IN DS $id1 ${DEFAULT_ALGORITHM_NUMBER} 1 " <DS.1 >DS.broke1
+$mangle " IN DS $id1 ${DEFAULT_ALGORITHM_NUMBER} 2 " <DS.1 >DS.broke2
+$mangle " IN DS $id1 ${DEFAULT_ALGORITHM_NUMBER} [12] " <DS.1 >DS.broke12
sed 's/^/update add /
$a\
@@ -118,14 +118,14 @@ $mangle '\s+IN\s+RRSIG\s+CDS .* '$idz' '$Z'\. ' \
$mangle '\s+IN\s+RRSIG\s+CDS .* '$id1' '$Z'\. ' \
<sig.cds.1 >brk.rrsig.cds.ksk
-$mangle " IN CDS $id1 8 1 " <db.cds.1 |
+$mangle " IN CDS $id1 ${DEFAULT_ALGORITHM_NUMBER} 1 " <db.cds.1 |
sign cds-mangled
-bad=`$PERL -le "print ($id1 ^ 255);"`
-sed 's/IN CDS '$id1' 8 1 /IN CDS '$bad' 8 1 /' <db.cds.1 |
+bad=$($PERL -le "print ($id1 ^ 255);")
+sed "s/IN CDS $id1 ${DEFAULT_ALGORITHM_NUMBER} 1 /IN CDS $bad ${DEFAULT_ALGORITHM_NUMBER} 1 /" <db.cds.1 |
sign bad-digests
-sed '/IN CDS '$id1' 8 /p;s//IN CDS '$bad' 13 /' <db.cds.1 |
+sed "/IN CDS $id1 ${DEFAULT_ALGORITHM_NUMBER} /p;s//IN CDS $bad $ALTERNATIVE_ALGORITHM_NUMBER /" <db.cds.1 |
sign bad-algos
rm -f dsset-*
diff --git a/external/mpl/bind/dist/bin/tests/system/cds/tests.sh b/external/mpl/bind/dist/bin/tests/system/cds/tests.sh
index 81630fcb044..700ae635a80 100644
--- a/external/mpl/bind/dist/bin/tests/system/cds/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/cds/tests.sh
@@ -43,7 +43,7 @@ testcase() {
check_stderr() {
if [ -n "${err:=}" ]; then
- egrep "$err" err.$n >/dev/null && return 0
+ grep -E "$err" err.$n >/dev/null && return 0
echo_d "stderr did not match '$err'"
else
[ -s err.$n ] || return 0
diff --git a/external/mpl/bind/dist/bin/tests/system/chain/ns2/sign.sh b/external/mpl/bind/dist/bin/tests/system/chain/ns2/sign.sh
index f0df00e2797..c067807c7ff 100644
--- a/external/mpl/bind/dist/bin/tests/system/chain/ns2/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/chain/ns2/sign.sh
@@ -18,38 +18,38 @@ zone=example.
zonefile=example.db
signedfile=example.db.signed
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
$SIGNER -S -o $zone -f $signedfile $zonefile > /dev/null
zone=wildcard-secure.example.
zonefile=wildcard-secure.db
signedfile=wildcard-secure.example.db.signed
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
$SIGNER -S -o $zone -f $signedfile $zonefile > /dev/null
zone=wildcard-nsec.example.
zonefile=wildcard.db
signedfile=wildcard-nsec.example.db.signed
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
$SIGNER -S -o $zone -f $signedfile $zonefile > /dev/null
zone=wildcard-nsec3.example.
zonefile=wildcard.db
signedfile=wildcard-nsec3.example.db.signed
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
$SIGNER -S -3 - -H 0 -o $zone -f $signedfile $zonefile > /dev/null
zone=wildcard-nsec3-optout.example.
zonefile=wildcard.db
signedfile=wildcard-nsec3-optout.example.db.signed
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
$SIGNER -S -3 - -H 0 -A -o $zone -f $signedfile $zonefile > /dev/null
diff --git a/external/mpl/bind/dist/bin/tests/system/chain/tests.sh b/external/mpl/bind/dist/bin/tests/system/chain/tests.sh
index 69287650844..19cdb68dd3c 100644
--- a/external/mpl/bind/dist/bin/tests/system/chain/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/chain/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in
new file mode 100644
index 00000000000..b0deaeae336
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The same zone in different views is using different DNSSEC policies, so it
+ * may not have the same key-directory.
+ */
+
+
+key "keyforview1" {
+ algorithm @DEFAULT_HMAC@;
+ secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+ algorithm @DEFAULT_HMAC@;
+ secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+ match-clients { key "keyforview1"; };
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "default";
+ key-directory ".";
+ file "example1.db";
+ };
+};
+
+view "example2" {
+ match-clients { key "keyforview2"; };
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "insecure";
+ key-directory ".";
+ file "example2.db";
+ };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in
new file mode 100644
index 00000000000..699c193aaa0
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * No key-directory is set, so the default is used.
+ * Should fail because the same zone in different views is using different
+ * DNSSEC policies.
+ */
+
+key "keyforview1" {
+ algorithm @DEFAULT_HMAC@;
+ secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+ algorithm @DEFAULT_HMAC@;
+ secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+ match-clients { key "keyforview1"; };
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "default";
+ file "example1.db";
+ };
+};
+
+view "example2" {
+ match-clients { key "keyforview2"; };
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "insecure";
+ file "example2.db";
+ };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in
new file mode 100644
index 00000000000..0dbd7e22651
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The zone in view "example1" inherits the key directory value from "options",
+ * but in view "example2" sets the key directory to the same value. This should
+ * be detected as an error because the zone is using different DNSSEC policies
+ * and should thus use different key directories.
+ */
+
+key "keyforview1" {
+ algorithm @DEFAULT_HMAC@;
+ secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+ algorithm @DEFAULT_HMAC@;
+ secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+options {
+ key-directory "keys";
+};
+
+view "example1" {
+ match-clients { key "keyforview1"; };
+
+ zone "example.net" {
+ type primary;
+ /* key-directory inherited from options. */
+ dnssec-policy "default";
+ file "example1.db";
+ };
+};
+
+view "example2" {
+ match-clients { key "keyforview2"; };
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "insecure";
+ key-directory "keys";
+ file "example2.db";
+ };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in
new file mode 100644
index 00000000000..af4a8f907b2
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The zone inherits the key-directory from the "view" level. Both views use the
+ * same key-directory, but the zone uses a different DNSSEC policy per view.
+ * This is a configuration error.
+ */
+
+key "keyforview1" {
+ algorithm @DEFAULT_HMAC@;
+ secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+ algorithm @DEFAULT_HMAC@;
+ secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+ match-clients { key "keyforview1"; };
+
+ key-directory "keys";
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "default";
+ file "example1.db";
+ };
+};
+
+view "example2" {
+ match-clients { key "keyforview2"; };
+
+ key-directory "keys";
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "insecure";
+ file "example2.db";
+ };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in
new file mode 100644
index 00000000000..1cca6083263
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * In one view, the zone inherits the key-directory from the "view" level, while
+ * in the other it is set explicitly at the "zone" level. In both cases, the
+ * same key-directory is used, but the zone uses a different DNSSEC policy per
+ * view. This is a configuration error.
+ */
+
+key "keyforview1" {
+ algorithm @DEFAULT_HMAC@;
+ secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+ algorithm @DEFAULT_HMAC@;
+ secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+ match-clients { key "keyforview1"; };
+
+ key-directory "keys";
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "default";
+ file "example1.db";
+ };
+};
+
+view "example2" {
+ match-clients { key "keyforview2"; };
+
+ zone "example.net" {
+ type primary;
+ dnssec-policy "insecure";
+ key-directory "keys";
+ file "example2.db";
+ };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard-no.conf b/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard-no.conf
new file mode 100644
index 00000000000..beb641a9bda
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard-no.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "check-wildcard" {
+ type primary;
+ file "check-wildcard.db";
+ check-wildcard no;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.conf b/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.conf
new file mode 100644
index 00000000000..263f8b4a65b
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "check-wildcard" {
+ type primary;
+ file "check-wildcard.db";
+ check-wildcard yes;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.db b/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.db
new file mode 100644
index 00000000000..1db5af00e34
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/check-wildcard.db
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600 ; 10 minutes
+@ IN SOA mname1. . (
+ 1 ; serial
+ 20 ; refresh (20 seconds)
+ 20 ; retry (20 seconds)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+ )
+ NS ns2
+ns2 A 10.53.0.2
+; an interior wildcard name
+foo.* TXT The owner name contains an interior wildcard
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/clean.sh b/external/mpl/bind/dist/bin/tests/system/checkconf/clean.sh
index e4d367f2c45..0d6001da767 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkconf/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/clean.sh
@@ -11,9 +11,15 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
-rm -f good.conf.in good.conf.out badzero.conf *.out
-rm -f good-kasp.conf.in
-rm -rf test.keydir
+rm -f bad-kasp-keydir1.conf
+rm -f bad-kasp-keydir2.conf
+rm -f bad-kasp-keydir3.conf
+rm -f bad-kasp-keydir4.conf
+rm -f bad-kasp-keydir5.conf
rm -f checkconf.out*
rm -f diff.out*
+rm -f good-kasp.conf.in
+rm -f good-server-christmas-tree.conf
+rm -f good.conf.in good.conf.out badzero.conf *.out
rm -f ns*/named.lock
+rm -rf test.keydir
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/deprecated.conf b/external/mpl/bind/dist/bin/tests/system/checkconf/deprecated.conf
index 44607a042bf..82a555d98b3 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkconf/deprecated.conf
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/deprecated.conf
@@ -11,8 +11,13 @@
* information regarding copyright ownership.
*/
+server 1.2.3.4 {
+ query-source 10.10.10.10 dscp 10;
+};
+
options {
dnssec-validation yes;
+ dscp 10;
};
trusted-keys {
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/dnssec.4 b/external/mpl/bind/dist/bin/tests/system/checkconf/dnssec.4
new file mode 100644
index 00000000000..4d4d934ba45
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/dnssec.4
@@ -0,0 +1,20 @@
+.\" $NetBSD: dnssec.4,v 1.1.1.1 2023/01/25 20:36:37 christos Exp $
+.\"
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "test" {
+ type primary;
+ file "test.db";
+ auto-dnssec maintain;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/good.conf b/external/mpl/bind/dist/bin/tests/system/checkconf/good.conf
index b1f7059acf8..0ecdb68e95a 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkconf/good.conf
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/good.conf
@@ -75,6 +75,7 @@ options {
recursive-clients 3000;
serial-query-rate 100;
server-id none;
+ update-quota 200;
check-names primary warn;
check-names secondary ignore;
max-cache-size 20000000000000;
diff --git a/external/mpl/bind/dist/bin/tests/system/checkconf/tests.sh b/external/mpl/bind/dist/bin/tests/system/checkconf/tests.sh
index 1ad24684a7a..c978efe347e 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkconf/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -21,7 +23,7 @@ n=`expr $n + 1`
echo_i "checking that named-checkconf handles a known good config ($n)"
ret=0
$CHECKCONF good.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -32,7 +34,7 @@ awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.co
$CHECKCONF -p good.conf.in > checkconf.out$n || ret=1
grep -v '^good.conf.in:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
cmp good.conf.in good.conf.out || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -44,7 +46,7 @@ grep 'secret "????????????????"' good.conf.in > /dev/null 2>&1 && ret=1
$CHECKCONF -p -x good.conf.in > checkconf.out$n || ret=1
grep -v '^good.conf.in:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
grep 'secret "????????????????"' good.conf.out > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
for bad in bad-*.conf
@@ -53,7 +55,7 @@ do
echo_i "checking that named-checkconf detects error in $bad ($n)"
ret=0
$CHECKCONF $bad > checkconf.out$n 2>&1
- if [ $? != 1 ]; then ret=1; fi
+ if [ $? -ne 1 ]; then ret=1; fi
grep "^$bad:[0-9]*: " < checkconf.out$n > /dev/null || ret=1
case $bad in
bad-update-policy[123].conf)
@@ -69,7 +71,7 @@ do
grep "$pat" < checkconf.out$n > /dev/null || ret=1
;;
esac
- if [ $ret != 0 ]; then echo_i "failed"; fi
+ if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
done
@@ -79,7 +81,7 @@ do
echo_i "checking that named-checkconf detects no error in $good ($n)"
ret=0
$CHECKCONF $good > checkconf.out$n 2>&1
- if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
+ if [ $? -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
done
@@ -88,7 +90,7 @@ echo_i "checking that ancient options report a fatal error ($n)"
ret=0
$CHECKCONF ancient.conf > ancient.out 2>&1 && ret=1
grep "no longer exists" ancient.out > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -96,14 +98,14 @@ echo_i "checking that named-checkconf -z catches missing hint file ($n)"
ret=0
$CHECKCONF -z hint-nofile.conf > hint-nofile.out 2>&1 && ret=1
grep "could not configure root hints from 'nonexistent.db': file not found" hint-nofile.out > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf catches range errors ($n)"
ret=0
$CHECKCONF range.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -112,7 +114,7 @@ ret=0
$CHECKCONF notify.conf > checkconf.out$n 2>&1
warnings=`grep "'notify' is disabled" < checkconf.out$n | wc -l`
[ $warnings -eq 3 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -124,9 +126,14 @@ grep "'dnssec-enable' is obsolete and should be removed" < checkconf.out$n.1 > /
# dnssec.2: auto-dnssec warning
$CHECKCONF dnssec.2 > checkconf.out$n.2 2>&1
grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
-# dnssec.3: should have no warnings
+# dnssec.3: should have no warnings (other than deprecation warning)
$CHECKCONF dnssec.3 > checkconf.out$n.3 2>&1
-grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
+grep "option 'auto-dnssec' is deprecated" < checkconf.out$n.3 > /dev/null || ret=1
+lines=$(wc -l < "checkconf.out$n.3")
+if [ $lines != 1 ]; then ret=1; fi
+# dnssec.4: should have specific deprecation warning
+$CHECKCONF dnssec.4 > checkconf.out$n.4 2>&1
+grep "'auto-dnssec' option is deprecated and will be removed in BIND 9\.19" < checkconf.out$n.4 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
@@ -136,12 +143,14 @@ ret=0
$CHECKCONF deprecated.conf > checkconf.out$n.1 2>&1
grep "option 'managed-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
grep "option 'trusted-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+grep "option 'dscp' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "token 'dscp' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
# set -i to ignore deprecate warnings
$CHECKCONF -i deprecated.conf > checkconf.out$n.2 2>&1
grep '.*' < checkconf.out$n.2 > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -149,12 +158,12 @@ echo_i "checking named-checkconf servestale warnings ($n)"
ret=0
$CHECKCONF servestale.stale-refresh-time.0.conf > checkconf.out$n.1 2>&1
grep "'stale-refresh-time' should either be 0 or otherwise 30 seconds or higher" < checkconf.out$n.1 > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
ret=0
$CHECKCONF servestale.stale-refresh-time.29.conf > checkconf.out$n.1 2>&1
grep "'stale-refresh-time' should either be 0 or otherwise 30 seconds or higher" < checkconf.out$n.1 > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -194,7 +203,7 @@ EOF
$CHECKCONF badzero.conf > checkconf.out$n.4 2>&1
[ $? -eq 1 ] || { echo_i "zone $field failed" ; ret=1; }
done
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -209,7 +218,7 @@ l=`grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l`
$CHECKCONF bad-dnssec.conf > checkconf.out$n.3 2>&1
l=`grep "update-check-ksk.*requires inline" < checkconf.out$n.3 | wc -l`
[ $l -eq 1 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -223,7 +232,7 @@ l=`grep "missing 'file' entry" < checkconf.out$n.2 | wc -l`
$CHECKCONF inline-bad.conf > checkconf.out$n.3 2>&1
l=`grep "missing 'file' entry" < checkconf.out$n.3 | wc -l`
[ $l -eq 1 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -231,7 +240,7 @@ echo_i "checking named-checkconf DLZ warnings ($n)"
ret=0
$CHECKCONF dlz-bad.conf > checkconf.out$n 2>&1
grep "'dlz' and 'database'" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -251,7 +260,7 @@ $CHECKCONF warn-keydir.conf > checkconf.out$n.3 2>&1
l=`grep "key-directory" < checkconf.out$n.3 | wc -l`
[ $l -eq 0 ] || ret=1
rm -rf test.keydir
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
n=`expr $n + 1`
echo_i "checking that named-checkconf -z catches conflicting ttl with max-ttl ($n)"
@@ -260,56 +269,56 @@ $CHECKCONF -z max-ttl.conf > check.out 2>&1
grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z catches invalid max-ttl ($n)"
ret=0
$CHECKCONF -z max-ttl-bad.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z skips zone check with alternate databases ($n)"
ret=0
$CHECKCONF -z altdb.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z skips zone check with DLZ ($n)"
ret=0
$CHECKCONF -z altdlz.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z fails on view with ANY class ($n)"
ret=0
$CHECKCONF -z view-class-any1.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z fails on view with CLASS255 class ($n)"
ret=0
$CHECKCONF -z view-class-any2.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z passes on view with IN class ($n)"
ret=0
$CHECKCONF -z view-class-in1.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking that named-checkconf -z passes on view with CLASS1 class ($n)"
ret=0
$CHECKCONF -z view-class-in2.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -318,7 +327,7 @@ ret=0
$CHECKCONF -z check-names-fail.conf > checkconf.out$n 2>&1 && ret=1
grep "near '_underscore': bad name (check-names)" < checkconf.out$n > /dev/null || ret=1
grep "zone check-names/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -327,7 +336,7 @@ ret=0
$CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
grep "near '10.0.0.1': MX is an address" < checkconf.out$n > /dev/null || ret=1
grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -336,7 +345,7 @@ ret=0
$CHECKCONF -z check-dup-records-fail.conf > checkconf.out$n 2>&1 && ret=1
grep "has semantically identical records" < checkconf.out$n > /dev/null || ret=1
grep "zone check-dup-records/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -345,7 +354,7 @@ ret=0
$CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
grep "failed: MX is an address" < checkconf.out$n > /dev/null || ret=1
grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -354,7 +363,7 @@ ret=0
$CHECKCONF -z check-mx-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
grep "MX.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -363,7 +372,7 @@ ret=0
$CHECKCONF -z check-srv-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
grep "SRV.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -371,7 +380,7 @@ echo_i "check that named-checkconf -p properly print a port range ($n)"
ret=0
$CHECKCONF -p portrange-good.conf > checkconf.out$n 2>&1 || ret=1
grep "range 8610 8614;" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -379,14 +388,14 @@ echo_i "check that named-checkconf -z handles in-view ($n)"
ret=0
$CHECKCONF -z in-view-good.conf > checkconf.out$n 2>&1 || ret=1
grep "zone shared.example/IN: loaded serial" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that named-checkconf -z returns error when a later view is okay ($n)"
ret=0
$CHECKCONF -z check-missing-zone.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -394,19 +403,20 @@ echo_i "check that named-checkconf prints max-cache-size <percentage> correctly
ret=0
$CHECKCONF -p max-cache-size-good.conf > checkconf.out$n 2>&1 || ret=1
grep "max-cache-size 60%;" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that named-checkconf -l prints out the zone list ($n)"
ret=0
$CHECKCONF -l good.conf |
+grep -v "is deprecated" |
grep -v "is not implemented" |
grep -v "is not recommended" |
grep -v "no longer exists" |
grep -v "is obsolete" > checkconf.out$n || ret=1
diff good.zonelist checkconf.out$n > diff.out$n || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -439,7 +449,7 @@ ret=0
$CHECKCONF check-root-ksk-2010.conf > checkconf.out$n 2>/dev/null || ret=1
[ -s checkconf.out$n ] || ret=1
grep "key without the updated" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -447,7 +457,7 @@ echo_i "check that the 2010 ICANN ROOT KSK with the 2017 ICANN ROOT KSK does not
ret=0
$CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
[ -s checkconf.out$n ] && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -455,7 +465,7 @@ echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n
ret=0
$CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
[ -s checkconf.out$n ] && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -463,7 +473,7 @@ echo_i "check that a static root key generates a warning ($n)"
ret=0
$CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
grep "static entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -471,7 +481,7 @@ echo_i "check that a static root DS trust anchor generates a warning ($n)"
ret=0
$CHECKCONF check-root-static-ds.conf > checkconf.out$n 2>/dev/null || ret=1
grep "static entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -479,7 +489,7 @@ echo_i "check that a trusted-keys entry for root generates a warning ($n)"
ret=0
$CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -487,7 +497,7 @@ echo_i "check that using trust-anchors and managed-keys generates an error ($n)"
ret=0
$CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -503,7 +513,7 @@ n=`expr $n + 1`
echo_i "checking named-checkconf kasp errors ($n)"
ret=0
$CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
-grep "'dnssec-policy;' requires dynamic DNS or inline-signing to be configured for the zone" < checkconf.out$n > /dev/null || ret=1
+grep "'inline-signing yes;' must also be configured explicitly for zones using dnssec-policy without a configured 'allow-update' or 'update-policy'" < checkconf.out$n > /dev/null || ret=1
grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
@@ -511,7 +521,7 @@ grep "dnssec-secure-to-insecure: cannot be configured if dnssec-policy is also s
grep "dnssec-update-mode: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
grep "sig-validity-interval: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
grep "update-check-ksk: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -520,8 +530,8 @@ ret=0
$CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
lines=$(wc -l < "checkconf.out$n")
-if [ $lines != 3 ]; then ret=1; fi
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $lines -ne 3 ]; then ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -529,7 +539,7 @@ echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
ret=0
$CHECKCONF kasp-bad-nsec3-alg.conf > checkconf.out$n 2>&1 && ret=1
grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -537,7 +547,7 @@ echo_i "checking named-checkconf kasp key errors ($n)"
ret=0
$CHECKCONF kasp-bad-keylen.conf > checkconf.out$n 2>&1 && ret=1
grep "dnssec-policy: key with algorithm rsasha1 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -545,14 +555,14 @@ echo_i "checking named-checkconf kasp predefined key length ($n)"
ret=0
$CHECKCONF kasp-ignore-keylen.conf > checkconf.out$n 2>&1 || ret=1
grep "dnssec-policy: key algorithm ecdsa256 has predefined length; ignoring length value 2048" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that a good 'kasp' configuration is accepted ($n)"
ret=0
$CHECKCONF good-kasp.conf > checkconf.out$n 2>/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -562,7 +572,7 @@ awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good-ka
[ -s good-kasp.conf.in ] || ret=1
$CHECKCONF -p good-kasp.conf.in | grep -v '^good-kasp.conf.in:' > good-kasp.conf.out 2>&1 || ret=1
cmp good-kasp.conf.in good-kasp.conf.out || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -570,7 +580,7 @@ echo_i "check that max-ixfr-ratio 100% generates a warning ($n)"
ret=0
$CHECKCONF warn-maxratio1.conf > checkconf.out$n 2>/dev/null || ret=1
grep "exceeds 100%" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -582,7 +592,7 @@ $CHECKCONF warn-notify-source.conf > checkconf.out$n 2>/dev/null || ret=1
grep "not recommended" < checkconf.out$n > /dev/null || ret=1
$CHECKCONF warn-parental-source.conf > checkconf.out$n 2>/dev/null || ret=1
grep "not recommended" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -611,6 +621,22 @@ grep "is deprecated" < checkconf.out$n >/dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
status=$((status+ret))
+n=$((n+1))
+echo_i "check that 'check-wildcard no;' succeeds as configured ($n)"
+ret=0
+$CHECKCONF -z check-wildcard-no.conf > checkconf.out$n 2>&1 || ret=1
+grep -F "warning: ownername 'foo.*.check-wildcard' contains an non-terminal wildcard" checkconf.out$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that 'check-wildcard yes;' warns as configured ($n)"
+ret=0
+$CHECKCONF -z check-wildcard.conf > checkconf.out$n 2>&1 || ret=1
+grep -F "warning: ownername 'foo.*.check-wildcard' contains an non-terminal wildcard" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
rmdir keys
echo_i "exit status: $status"
diff --git a/external/mpl/bind/dist/bin/tests/system/checkds/ns9/setup.sh b/external/mpl/bind/dist/bin/tests/system/checkds/ns9/setup.sh
index e5a12534977..0990fa3c6bf 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkds/ns9/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checkds/ns9/setup.sh
@@ -43,7 +43,8 @@ do
$SETTIME -s -g $O -k $O $T -r $O $T -z $O $T -d $R $T "$CSK" > settime.out.$zone 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
- $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+ cp $infile $zonefile
+ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
done
# DS Withdrawal.
@@ -57,5 +58,6 @@ do
$SETTIME -s -g $H -k $O $T -r $O $T -z $O $T -d $U $T "$CSK" > settime.out.$zone 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
- $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+ cp $infile $zonefile
+ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
done
diff --git a/external/mpl/bind/dist/bin/tests/system/checkds/tests_checkds.py b/external/mpl/bind/dist/bin/tests/system/checkds/tests_checkds.py
new file mode 100755
index 00000000000..af78d7a2fe7
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkds/tests_checkds.py
@@ -0,0 +1,445 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import mmap
+import os
+import subprocess
+import sys
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.exception
+import dns.message
+import dns.name
+import dns.query
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+import dns.resolver
+
+
+def has_signed_apex_nsec(zone, response):
+ has_nsec = False
+ has_rrsig = False
+
+ ttl = 300
+ nextname = "a."
+ types = "NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY"
+ match = "{0} {1} IN NSEC {2}{0} {3}".format(zone, ttl, nextname, types)
+ sig = "{0} {1} IN RRSIG NSEC 13 2 300".format(zone, ttl)
+
+ for rr in response.answer:
+ if match in rr.to_text():
+ has_nsec = True
+ if sig in rr.to_text():
+ has_rrsig = True
+
+ if not has_nsec:
+ print("error: missing apex NSEC record in response")
+ if not has_rrsig:
+ print("error: missing NSEC signature in response")
+
+ return has_nsec and has_rrsig
+
+
+def do_query(server, qname, qtype, tcp=False):
+ query = dns.message.make_query(qname, qtype, use_edns=True, want_dnssec=True)
+ try:
+ if tcp:
+ response = dns.query.tcp(
+ query, server.nameservers[0], timeout=3, port=server.port
+ )
+ else:
+ response = dns.query.udp(
+ query, server.nameservers[0], timeout=3, port=server.port
+ )
+ except dns.exception.Timeout:
+ print(
+ "error: query timeout for query {} {} to {}".format(
+ qname, qtype, server.nameservers[0]
+ )
+ )
+ return None
+
+ return response
+
+
+def verify_zone(zone, transfer):
+ verify = os.getenv("VERIFY")
+ assert verify is not None
+
+ filename = "{}out".format(zone)
+ with open(filename, "w", encoding="utf-8") as file:
+ for rr in transfer.answer:
+ file.write(rr.to_text())
+ file.write("\n")
+
+ # dnssec-verify command with default arguments.
+ verify_cmd = [verify, "-z", "-o", zone, filename]
+
+ verifier = subprocess.run(verify_cmd, capture_output=True, check=True)
+
+ if verifier.returncode != 0:
+ print("error: dnssec-verify {} failed".format(zone))
+ sys.stderr.buffer.write(verifier.stderr)
+
+ return verifier.returncode == 0
+
+
+def read_statefile(server, zone):
+ addr = server.nameservers[0]
+ count = 0
+ keyid = 0
+ state = {}
+
+ response = do_query(server, zone, "DS", tcp=True)
+ if not isinstance(response, dns.message.Message):
+ print("error: no response for {} DS from {}".format(zone, addr))
+ return {}
+
+ if response.rcode() == dns.rcode.NOERROR:
+ # fetch key id from response.
+ for rr in response.answer:
+ if rr.match(
+ dns.name.from_text(zone),
+ dns.rdataclass.IN,
+ dns.rdatatype.DS,
+ dns.rdatatype.NONE,
+ ):
+ if count == 0:
+ keyid = list(dict(rr.items).items())[0][0].key_tag
+ count += 1
+
+ if count != 1:
+ print(
+ "error: expected a single DS in response for {} from {},"
+ "got {}".format(zone, addr, count)
+ )
+ return {}
+ else:
+ print(
+ "error: {} response for {} DNSKEY from {}".format(
+ dns.rcode.to_text(response.rcode()), zone, addr
+ )
+ )
+ return {}
+
+ filename = "ns9/K{}+013+{:05d}.state".format(zone, keyid)
+ print("read state file {}".format(filename))
+
+ try:
+ with open(filename, "r", encoding="utf-8") as file:
+ for line in file:
+ if line.startswith(";"):
+ continue
+ key, val = line.strip().split(":", 1)
+ state[key.strip()] = val.strip()
+
+ except FileNotFoundError:
+ # file may not be written just yet.
+ return {}
+
+ return state
+
+
+def zone_check(server, zone):
+ addr = server.nameservers[0]
+
+ # wait until zone is fully signed.
+ signed = False
+ for _ in range(10):
+ response = do_query(server, zone, "NSEC")
+ if not isinstance(response, dns.message.Message):
+ print("error: no response for {} NSEC from {}".format(zone, addr))
+ elif response.rcode() == dns.rcode.NOERROR:
+ signed = has_signed_apex_nsec(zone, response)
+ else:
+ print(
+ "error: {} response for {} NSEC from {}".format(
+ dns.rcode.to_text(response.rcode()), zone, addr
+ )
+ )
+
+ if signed:
+ break
+
+ time.sleep(1)
+
+ assert signed
+
+ # check if zone if DNSSEC valid.
+ verified = False
+ transfer = do_query(server, zone, "AXFR", tcp=True)
+ if not isinstance(transfer, dns.message.Message):
+ print("error: no response for {} AXFR from {}".format(zone, addr))
+ elif transfer.rcode() == dns.rcode.NOERROR:
+ verified = verify_zone(zone, transfer)
+ else:
+ print(
+ "error: {} response for {} AXFR from {}".format(
+ dns.rcode.to_text(transfer.rcode()), zone, addr
+ )
+ )
+
+ assert verified
+
+
+def keystate_check(server, zone, key):
+ val = 0
+ deny = False
+
+ search = key
+ if key.startswith("!"):
+ deny = True
+ search = key[1:]
+
+ for _ in range(10):
+ state = read_statefile(server, zone)
+ try:
+ val = state[search]
+ except KeyError:
+ pass
+
+ if not deny and val != 0:
+ break
+ if deny and val == 0:
+ break
+
+ time.sleep(1)
+
+ if deny:
+ assert val == 0
+ else:
+ assert val != 0
+
+
+def wait_for_log(filename, log):
+ found = False
+
+ for _ in range(10):
+ print("read log file {}".format(filename))
+
+ try:
+ with open(filename, "r", encoding="utf-8") as file:
+ s = mmap.mmap(file.fileno(), 0, access=mmap.ACCESS_READ)
+ if s.find(bytes(log, "ascii")) != -1:
+ found = True
+ except FileNotFoundError:
+ print("file not found {}".format(filename))
+
+ if found:
+ break
+
+ print("sleep")
+ time.sleep(1)
+
+ assert found
+
+
+def test_checkds_dspublished(named_port):
+ # We create resolver instances that will be used to send queries.
+ server = dns.resolver.Resolver()
+ server.nameservers = ["10.53.0.9"]
+ server.port = named_port
+
+ parent = dns.resolver.Resolver()
+ parent.nameservers = ["10.53.0.2"]
+ parent.port = named_port
+
+ # DS correctly published in parent.
+ zone_check(server, "dspublished.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone dspublished.checkds/IN (signed): checkds: DS response from 10.53.0.2",
+ )
+ keystate_check(parent, "dspublished.checkds.", "DSPublish")
+
+ # DS correctly published in parent (reference to parental-agent).
+ zone_check(server, "reference.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone reference.checkds/IN (signed): checkds: DS response from 10.53.0.2",
+ )
+ keystate_check(parent, "reference.checkds.", "DSPublish")
+
+ # DS not published in parent.
+ zone_check(server, "missing-dspublished.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone missing-dspublished.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.5",
+ )
+ keystate_check(parent, "missing-dspublished.checkds.", "!DSPublish")
+
+ # Badly configured parent.
+ zone_check(server, "bad-dspublished.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad-dspublished.checkds/IN (signed): checkds: "
+ "bad DS response from 10.53.0.6",
+ )
+ keystate_check(parent, "bad-dspublished.checkds.", "!DSPublish")
+
+ # TBD: DS published in parent, but bogus signature.
+
+ # DS correctly published in all parents.
+ zone_check(server, "multiple-dspublished.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone multiple-dspublished.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.2",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone multiple-dspublished.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.4",
+ )
+ keystate_check(parent, "multiple-dspublished.checkds.", "DSPublish")
+
+ # DS published in only one of multiple parents.
+ zone_check(server, "incomplete-dspublished.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone incomplete-dspublished.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.2",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone incomplete-dspublished.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.4",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone incomplete-dspublished.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.5",
+ )
+ keystate_check(parent, "incomplete-dspublished.checkds.", "!DSPublish")
+
+ # One of the parents is badly configured.
+ zone_check(server, "bad2-dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad2-dspublished.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.2",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad2-dspublished.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.4",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad2-dspublished.checkds/IN (signed): checkds: "
+ "bad DS response from 10.53.0.6",
+ )
+ keystate_check(parent, "bad2-dspublished.checkds.", "!DSPublish")
+
+ # TBD: DS published in all parents, but one has bogus signature.
+
+ # TBD: Check with TSIG
+
+
+def test_checkds_dswithdrawn(named_port):
+ # We create resolver instances that will be used to send queries.
+ server = dns.resolver.Resolver()
+ server.nameservers = ["10.53.0.9"]
+ server.port = named_port
+
+ parent = dns.resolver.Resolver()
+ parent.nameservers = ["10.53.0.2"]
+ parent.port = named_port
+
+ # DS correctly published in single parent.
+ zone_check(server, "dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.5",
+ )
+ keystate_check(parent, "dswithdrawn.checkds.", "DSRemoved")
+
+ # DS not withdrawn from parent.
+ zone_check(server, "missing-dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone missing-dswithdrawn.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.2",
+ )
+ keystate_check(parent, "missing-dswithdrawn.checkds.", "!DSRemoved")
+
+ # Badly configured parent.
+ zone_check(server, "bad-dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad-dswithdrawn.checkds/IN (signed): checkds: "
+ "bad DS response from 10.53.0.6",
+ )
+ keystate_check(parent, "bad-dswithdrawn.checkds.", "!DSRemoved")
+
+ # TBD: DS published in parent, but bogus signature.
+
+ # DS correctly withdrawn from all parents.
+ zone_check(server, "multiple-dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone multiple-dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.5",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone multiple-dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.7",
+ )
+ keystate_check(parent, "multiple-dswithdrawn.checkds.", "DSRemoved")
+
+ # DS withdrawn from only one of multiple parents.
+ zone_check(server, "incomplete-dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone incomplete-dswithdrawn.checkds/IN (signed): checkds: "
+ "DS response from 10.53.0.2",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone incomplete-dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.5",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone incomplete-dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.7",
+ )
+ keystate_check(parent, "incomplete-dswithdrawn.checkds.", "!DSRemoved")
+
+ # One of the parents is badly configured.
+ zone_check(server, "bad2-dswithdrawn.checkds.")
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad2-dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.5",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad2-dswithdrawn.checkds/IN (signed): checkds: "
+ "empty DS response from 10.53.0.7",
+ )
+ wait_for_log(
+ "ns9/named.run",
+ "zone bad2-dswithdrawn.checkds/IN (signed): checkds: "
+ "bad DS response from 10.53.0.6",
+ )
+ keystate_check(parent, "bad2-dswithdrawn.checkds.", "!DSRemoved")
+
+ # TBD: DS withdrawn from all parents, but one has bogus signature.
diff --git a/external/mpl/bind/dist/bin/tests/system/checknames/setup.sh b/external/mpl/bind/dist/bin/tests/system/checknames/setup.sh
index 2f321522ab2..9b3fb1d48c5 100644
--- a/external/mpl/bind/dist/bin/tests/system/checknames/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checknames/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/checkzone/clean.sh b/external/mpl/bind/dist/bin/tests/system/checkzone/clean.sh
index 045af7095ae..a02fc64a453 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkzone/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checkzone/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -11,3 +13,4 @@
rm -f test.* good1.db.map good1.db.raw named-compilezone
rm -f ns*/named.lock
+rm -f zones/bad-tsig.db
diff --git a/external/mpl/bind/dist/bin/tests/system/checkzone/setup.sh b/external/mpl/bind/dist/bin/tests/system/checkzone/setup.sh
index cecfe1830a6..f8b464a8eed 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkzone/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checkzone/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -18,3 +20,5 @@ ln -s $CHECKZONE named-compilezone
zones/good1.db > /dev/null 2>&1
./named-compilezone -D -F map -o good1.db.map example \
zones/good1.db > /dev/null 2>&1
+
+copy_setports zones/bad-tsig.db.in zones/bad-tsig.db
diff --git a/external/mpl/bind/dist/bin/tests/system/checkzone/tests.sh b/external/mpl/bind/dist/bin/tests/system/checkzone/tests.sh
index ab2a54db844..0b0e822fb8d 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkzone/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/checkzone/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/checkzone/zones/bad-tsig.db.in b/external/mpl/bind/dist/bin/tests/system/checkzone/zones/bad-tsig.db.in
new file mode 100644
index 00000000000..daef06c3943
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/checkzone/zones/bad-tsig.db.in
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@ SOA ns hostmaster 2011012708 3600 1200 604800 1200
+ NS ns
+ns A 192.0.2.1
+
+tsig TSIG @DEFAULT_HMAC@ 1516135665 300 20 thBt8DheAD7qpqSFTiGK999sxGg= 54994 NOERROR 0
diff --git a/external/mpl/bind/dist/bin/tests/system/checkzone/zones/good-svcb.db b/external/mpl/bind/dist/bin/tests/system/checkzone/zones/good-svcb.db
index 7b7b31d6f0a..df868f3d4ef 100644
--- a/external/mpl/bind/dist/bin/tests/system/checkzone/zones/good-svcb.db
+++ b/external/mpl/bind/dist/bin/tests/system/checkzone/zones/good-svcb.db
@@ -24,3 +24,4 @@ svcb6 SVCB 6 . mandatory=port,alpn port=60 alpn=h3
svcb7 SVCB 7 . mandatory=port,alpn port=60 alpn=h1,h3
svcb8 SVCB 8 . mandatory=port,alpn port=60 alpn="h1\\,h2,h3"
svcb9 SVCB 0 44._svbc.example.net.
+svcb10 SVCB 7 . alpn="h2,h3" dohpath=/{?dns}
diff --git a/external/mpl/bind/dist/bin/tests/system/ckdnsrps.sh b/external/mpl/bind/dist/bin/tests/system/ckdnsrps.sh
index 5bebfc2dbaa..2c14aa8f013 100644
--- a/external/mpl/bind/dist/bin/tests/system/ckdnsrps.sh
+++ b/external/mpl/bind/dist/bin/tests/system/ckdnsrps.sh
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
diff --git a/external/mpl/bind/dist/bin/tests/system/conf.sh.common b/external/mpl/bind/dist/bin/tests/system/conf.sh.common
index 4948d364830..c337f465dd9 100644
--- a/external/mpl/bind/dist/bin/tests/system/conf.sh.common
+++ b/external/mpl/bind/dist/bin/tests/system/conf.sh.common
@@ -27,11 +27,6 @@ export LANG=C
#
# Common lists of system tests to run.
#
-# The "stress" test is not run by default since it creates enough
-# load on the machine to make it unusable to other users.
-# The "dialup", "delzone", and "dupsigs" tests are also not run by
-# default because they take a very long time to complete.
-#
# The following tests are hard-coded to use ports 5300 and 9953. For
# this reason, these must be run sequentially.
#
@@ -54,7 +49,7 @@ SEQUENTIAL_COMMON="ecdsa eddsa tkey"
# rpzrecurse are scheduled first, in order to get more benefit from
# parallelism.
#
-PARALLEL_COMMON="dnssec rpzrecurse serve-stale \
+PARALLEL_COMMON="dnssec rpzrecurse serve-stale dupsigs \
acl \
additional \
addzone \
@@ -153,25 +148,25 @@ zonechecks"
# Set up color-coded test output
#
if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
- COLOR_END=`tput setaf 4` # blue
- COLOR_FAIL=`tput setaf 1` # red
- COLOR_INFO=`tput bold` # bold
- COLOR_NONE=`tput sgr0`
- COLOR_PASS=`tput setaf 2` # green
- COLOR_START=`tput setaf 4` # blue
- COLOR_WARN=`tput setaf 3` # yellow
+ export COLOR_END=`tput setaf 4` # blue
+ export COLOR_FAIL=`tput setaf 1` # red
+ export COLOR_INFO=`tput bold` # bold
+ export COLOR_NONE=`tput sgr0`
+ export COLOR_PASS=`tput setaf 2` # green
+ export COLOR_START=`tput setaf 4` # blue
+ export COLOR_WARN=`tput setaf 3` # yellow
else
# set to empty strings so printf succeeds
- COLOR_END=''
- COLOR_FAIL=''
- COLOR_INFO=''
- COLOR_NONE=''
- COLOR_PASS=''
- COLOR_START=''
- COLOR_WARN=''
+ export COLOR_END=''
+ export COLOR_FAIL=''
+ export COLOR_INFO=''
+ export COLOR_NONE=''
+ export COLOR_PASS=''
+ export COLOR_START=''
+ export COLOR_WARN=''
fi
-SYSTESTDIR="`basename $PWD`"
+export SYSTESTDIR="`basename $PWD`"
if type printf > /dev/null 2>&1
then
@@ -269,11 +264,11 @@ digcomp() {
}
start_server() {
- $PERL "$TOP_SRCDIR/bin/tests/system/start.pl" "$@"
+ $PERL "$TOP_SRCDIR/bin/tests/system/start.pl" "$SYSTESTDIR" "$@"
}
stop_server() {
- $PERL "$TOP_SRCDIR/bin/tests/system/stop.pl" "$@"
+ $PERL "$TOP_SRCDIR/bin/tests/system/stop.pl" "$SYSTESTDIR" "$@"
}
send() {
@@ -284,27 +279,52 @@ send() {
# Useful variables in test scripts
#
+# The following script sets the following algorithm-related variables. These
+# are selected randomly at runtime from a list of supported algorithms. The
+# randomization is deterministic and remains stable for a period of time for a
+# given platform.
+#
# Default algorithm for testing.
-DEFAULT_ALGORITHM=ECDSAP256SHA256
-DEFAULT_ALGORITHM_NUMBER=13
-DEFAULT_BITS=256
-
-# This is an alternative algorithm for test cases that require more than
-# one algorithm (for example algorithm rollover). Must be different from
+# DEFAULT_ALGORITHM
+# DEFAULT_ALGORITHM_NUMBER
+# DEFAULT_BITS
+#
+# This is an alternative algorithm for test cases that require more than one
+# algorithm (for example algorithm rollover). Must be different from
# DEFAULT_ALGORITHM.
-ALTERNATIVE_ALGORITHM=RSASHA256
-ALTERNATIVE_ALGORITHM_NUMBER=8
-ALTERNATIVE_BITS=1280
-
-# This is an algorithm that is used for tests against the
-# "disable-algorithms" configuration option. Must be different from above
-# algorithms.
-DISABLED_ALGORITHM=ECDSAP384SHA384
-DISABLED_ALGORITHM_NUMBER=14
-DISABLED_BITS=384
+# ALTERNATIVE_ALGORITHM
+# ALTERNATIVE_ALGORITHM_NUMBER
+# ALTERNATIVE_BITS
+#
+# This is an algorithm that is used for tests against the "disable-algorithms"
+# configuration option. Must be different from above algorithms.
+# DISABLED_ALGORITHM
+# DISABLED_ALGORITHM_NUMBER
+# DISABLED_BITS
+#
+# There are multiple algoritms sets to choose from (see get_algorithms.py). To
+# override the default choice, set the ALGORITHM_SET env var (see mkeys system
+# test for example).
+if test -x "$PYTHON" && test -x "$KEYGEN"; then
+ eval "$($PYTHON "$TOP_SRCDIR/bin/tests/system/get_algorithms.py")"
+else
+ # 9.16 workarounds
+ # - for ./configure which calls bin/tests/system/cleanall.sh, which
+ # includes this file before $KEYGEN is compiled
+ # - for our Windows CI which lacks Python
+ DEFAULT_ALGORITHM=ECDSAP256SHA256
+ DEFAULT_ALGORITHM_NUMBER=13
+ DEFAULT_BITS=256
+ ALTERNATIVE_ALGORITHM=RSASHA256
+ ALTERNATIVE_ALGORITHM_NUMBER=8
+ ALTERNATIVE_BITS=1280
+ DISABLED_ALGORITHM=ECDSAP384SHA384
+ DISABLED_ALGORITHM_NUMBER=14
+ DISABLED_BITS=384
+fi
# Default HMAC algorithm.
-DEFAULT_HMAC=hmac-sha256
+export DEFAULT_HMAC=hmac-sha256
#
# Useful functions in test scripts
@@ -484,25 +504,25 @@ nextpartreset() {
# nextpartread: read everything that's been appended to a file since the
# last time nextpart() was called and print it to stdout, print the
-# total number of lines read from that file so far to stderr
+# total number of lines read from that file so far to file descriptor 3
nextpartread() {
[ -f $1.prev ] || nextpartreset $1
prev=`cat $1.prev`
awk "NR > $prev "'{ print }
- END { print NR > "/dev/stderr" }' $1
+ END { print NR > "/dev/stderr" }' $1 2>&3
}
# nextpart: read everything that's been appended to a file since the
# last time nextpart() was called
nextpart() {
- nextpartread $1 2> $1.prev.tmp
+ nextpartread $1 3> $1.prev.tmp
mv $1.prev.tmp $1.prev
}
# nextpartpeek: read everything that's been appended to a file since the
# last time nextpart() was called
nextpartpeek() {
- nextpartread $1 2> /dev/null
+ nextpartread $1 3> /dev/null
}
# _search_log: look for message $1 in file $2 with nextpart().
@@ -721,49 +741,3 @@ copy_setports() {
-e "s/${atsign}DISABLED_BITS${atsign}/${DISABLED_BITS}/g" \
$1 > $2
}
-
-#
-# Export command paths
-#
-export ARPANAME
-export BIGKEY
-export CDS
-export CHECKZONE
-export CYGWIN
-export DESCRIPTION
-export DIG
-export FEATURETEST
-export FSTRM_CAPTURE
-export GENCHECK
-export JOURNALPRINT
-export KEYCREATE
-export KEYDELETE
-export KEYFRLAB
-export KEYGEN
-export KEYSETTOOL
-export KEYSIGNER
-export KRB5_CONFIG
-export KRB5_KTNAME
-export MAKEJOURNAL
-export MDIG
-export NAMED
-export NSEC3HASH
-export NSLOOKUP
-export NSUPDATE
-export NZD2NZF
-export PERL
-export PIPEQUERIES
-export PK11DEL
-export PK11GEN
-export PK11LIST
-export PSSUSPEND
-export PYTHON
-export RESOLVE
-export RNDC
-export RRCHECKER
-export SIGNER
-export SUBDIRS
-export TMPDIR
-export TSIGKEYGEN
-export VERIFY
-export WIRETEST
diff --git a/external/mpl/bind/dist/bin/tests/system/conf.sh.in b/external/mpl/bind/dist/bin/tests/system/conf.sh.in
index b9641c42b2d..a229c856717 100644
--- a/external/mpl/bind/dist/bin/tests/system/conf.sh.in
+++ b/external/mpl/bind/dist/bin/tests/system/conf.sh.in
@@ -17,121 +17,110 @@
#
# Find the top of the BIND9 tree.
-TOP=@abs_top_builddir@
-TOP_SRCDIR=@abs_top_srcdir@
+export TOP=@abs_top_builddir@
+export TOP_SRCDIR=@abs_top_srcdir@
# Provide TMPDIR variable for tests that need it.
-TMPDIR=${TMPDIR:-/tmp}
+export TMPDIR=${TMPDIR:-/tmp}
# This is not the windows build.
-CYGWIN=""
-
-# Load common values shared between windows and unix/linux.
-. $TOP/bin/tests/system/conf.sh.common
-
-ARPANAME=$TOP/bin/tools/arpaname
-CDS=$TOP/bin/dnssec/dnssec-cds
-CHECKCONF=$TOP/bin/check/named-checkconf
-CHECKDS=$TOP/bin/python/dnssec-checkds
-CHECKZONE=$TOP/bin/check/named-checkzone
-COVERAGE=$TOP/bin/python/dnssec-coverage
-DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
-DELV=$TOP/bin/delv/delv
-DIG=$TOP/bin/dig/dig
-DNSTAPREAD=$TOP/bin/tools/dnstap-read
-DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
-FEATURETEST=$TOP/bin/tests/system/feature-test
-FSTRM_CAPTURE=@FSTRM_CAPTURE@
-HOST=$TOP/bin/dig/host
-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
-JOURNALPRINT=$TOP/bin/tools/named-journalprint
-KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
-KEYGEN=$TOP/bin/dnssec/dnssec-keygen
-KEYMGR=$TOP/bin/python/dnssec-keymgr
-MDIG=$TOP/bin/tools/mdig
-NAMED=$TOP/bin/named/named
-NSEC3HASH=$TOP/bin/tools/nsec3hash
-NSLOOKUP=$TOP/bin/dig/nslookup
-NSUPDATE=$TOP/bin/nsupdate/nsupdate
-NZD2NZF=$TOP/bin/tools/named-nzd2nzf
-PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
-PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-RESOLVE=$TOP/bin/tests/system/resolve
-REVOKE=$TOP/bin/dnssec/dnssec-revoke
-RNDC=$TOP/bin/rndc/rndc
-RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
-RRCHECKER=$TOP/bin/tools/named-rrchecker
-SETTIME=$TOP/bin/dnssec/dnssec-settime
-SIGNER=$TOP/bin/dnssec/dnssec-signzone
-TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
-VERIFY=$TOP/bin/dnssec/dnssec-verify
-WIRETEST=$TOP/bin/tests/wire_test
-
-BIGKEY=$TOP/bin/tests/system/rsabigexponent/bigkey
-GENCHECK=$TOP/bin/tests/system/rndc/gencheck
-KEYCREATE=$TOP/bin/tests/system/tkey/keycreate
-KEYDELETE=$TOP/bin/tests/system/tkey/keydelete
-MAKEJOURNAL=$TOP/bin/tests/makejournal
-PIPEQUERIES=$TOP/bin/tests/system/pipelined/pipequeries
+export CYGWIN=""
+
+export ARPANAME=$TOP/bin/tools/arpaname
+export CDS=$TOP/bin/dnssec/dnssec-cds
+export CHECKCONF=$TOP/bin/check/named-checkconf
+export CHECKDS=$TOP/bin/python/dnssec-checkds
+export CHECKZONE=$TOP/bin/check/named-checkzone
+export COVERAGE=$TOP/bin/python/dnssec-coverage
+export DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
+export DELV=$TOP/bin/delv/delv
+export DIG=$TOP/bin/dig/dig
+export DNSTAPREAD=$TOP/bin/tools/dnstap-read
+export DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
+export FEATURETEST=$TOP/bin/tests/system/feature-test
+export FSTRM_CAPTURE=@FSTRM_CAPTURE@
+export HOST=$TOP/bin/dig/host
+export IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
+export JOURNALPRINT=$TOP/bin/tools/named-journalprint
+export KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
+export KEYGEN=$TOP/bin/dnssec/dnssec-keygen
+export KEYMGR=$TOP/bin/python/dnssec-keymgr
+export MDIG=$TOP/bin/tools/mdig
+export NAMED=$TOP/bin/named/named
+export NSEC3HASH=$TOP/bin/tools/nsec3hash
+export NSLOOKUP=$TOP/bin/dig/nslookup
+export NSUPDATE=$TOP/bin/nsupdate/nsupdate
+export NZD2NZF=$TOP/bin/tools/named-nzd2nzf
+export PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
+export PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+export PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+export RESOLVE=$TOP/bin/tests/system/resolve
+export REVOKE=$TOP/bin/dnssec/dnssec-revoke
+export RNDC=$TOP/bin/rndc/rndc
+export RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
+export RRCHECKER=$TOP/bin/tools/named-rrchecker
+export SETTIME=$TOP/bin/dnssec/dnssec-settime
+export SIGNER=$TOP/bin/dnssec/dnssec-signzone
+export TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
+export VERIFY=$TOP/bin/dnssec/dnssec-verify
+export WIRETEST=$TOP/bin/tests/wire_test
+
+export BIGKEY=$TOP/bin/tests/system/rsabigexponent/bigkey
+export GENCHECK=$TOP/bin/tests/system/rndc/gencheck
+export KEYCREATE=$TOP/bin/tests/system/tkey/keycreate
+export KEYDELETE=$TOP/bin/tests/system/tkey/keydelete
+export MAKEJOURNAL=$TOP/bin/tests/makejournal
+export PIPEQUERIES=$TOP/bin/tests/system/pipelined/pipequeries
# we don't want a KRB5_CONFIG setting breaking the tests
-KRB5_CONFIG=/dev/null
+export KRB5_CONFIG=/dev/null
# use local keytab instead of default /etc/krb5.keytab
-KRB5_KTNAME=dns.keytab
-
-#
-# Construct the lists of tests to run
-#
-SEQUENTIAL_UNIX="@PKCS11_TEST@"
-SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_UNIX"
-
-PARALLEL_UNIX="@CHECKDS@ @COVERAGE@ @DNSTAP@ @KEYMGR@ cookie logfileconfig"
-PARALLELDIRS="$PARALLEL_COMMON $PARALLEL_UNIX"
-
-SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
-
+export KRB5_KTNAME=dns.keytab
# Things that are different on Windows
-KILL=kill
-DIFF=diff
-DOS2UNIX=true
+export KILL=kill
+export DIFF=diff
+export DOS2UNIX=true
# There's no trailing period on Windows
-TP=.
+export TP=.
-# Use the CONFIG_SHELL detected by configure for tests
-SHELL=@SHELL@
+# Programs detected by configure
+# Variables will be empty if no program was found by configure
+export SHELL=@SHELL@
+export CURL=@CURL@
+export XMLLINT=@XMLLINT@
+export XSLTPROC=@XSLTPROC@
+export PYTEST=@PYTEST@
-# CURL will be empty if no program was found by configure
-CURL=@CURL@
-
-# XMLLINT will be empty if no program was found by configure
-XMLLINT=@XMLLINT@
+# Windows process management leave empty
+export PSSUSPEND=
-# XSLTPROC will be empty if no program was found by configure
-XSLTPROC=@XSLTPROC@
+#
+# Interpreters for system tests detected by configure
+#
+export PERL=@PERL@
+if ! test -x "$PERL"; then
+ echo "Perl interpreter is required for system tests."
+ exit 77
+fi
+export PYTHON=@PYTHON@
-# PERL will be an empty string if no perl interpreter was found.
-PERL=@PERL@
+#
+# Determine if we support various optional features.
+#
+export CRYPTO=@CRYPTO@
-# Windows process management leave empty
-PSSUSPEND=
-PYTHON=@PYTHON@
-PYTEST=@PYTEST@
+# Load common values shared between windows and unix/linux.
+. $TOP/bin/tests/system/conf.sh.common
#
-# Determine if we support various optional features.
+# Construct the lists of tests to run
#
-LIBXML2_LIBS="@LIBXML2_LIBS@"
-HAVEXMLSTATS=${LIBXML2_LIBS:+1}
-JSON_C_LIBS="@JSON_C_LIBS@"
-HAVEJSONSTATS=${JSON_C_LIBS:+1}
-MAXMINDDB_LIBS="@MAXMINDDB_LIBS@"
-HAVEGEOIP2=${MAXMINDDB_LIBS:+1}
-ZLIB_LIBS="@ZLIB_LIBS@"
-HAVEZLIB=${ZLIB_LIBS:+1}
-NZD=@NZD_TOOLS@
-CRYPTO=@CRYPTO@
-
-export HAVEXMLSTATS HAVEJSONSTATS
+SEQUENTIAL_UNIX="@PKCS11_TEST@"
+SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_UNIX"
+
+PARALLEL_UNIX="@CHECKDS@ @COVERAGE@ @DNSTAP@ @KEYMGR@ cookie logfileconfig"
+PARALLELDIRS="$PARALLEL_COMMON $PARALLEL_UNIX"
+
+SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
diff --git a/external/mpl/bind/dist/bin/tests/system/conf.sh.win32 b/external/mpl/bind/dist/bin/tests/system/conf.sh.win32
index 86a3be3aa85..95f9c1679d6 100644
--- a/external/mpl/bind/dist/bin/tests/system/conf.sh.win32
+++ b/external/mpl/bind/dist/bin/tests/system/conf.sh.win32
@@ -20,110 +20,110 @@
TOP=${SYSTEMTESTTOP:=.}/../../..
# Make it absolute so that it continues to work after we cd.
-TOP=`cd $TOP && pwd`
-TOP_SRCDIR="$TOP"
+export TOP=`cd $TOP && pwd`
+export TOP_SRCDIR="$TOP"
# This is the windows build. This disables certain tests cases
# and changes some specific behaviors where necessary.
-CYGWIN=1
-
-# Load common values shared between windows and unix/linux.
-. $TOP/bin/tests/system/conf.sh.common
+export CYGWIN=1
# Visual Studio build configurations are Release and Debug
-VSCONF=${VSCONF:-Debug}
-
-ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
-CDS=$TOP/Build/$VSCONF/dnssec-cds@EXEEXT@
-CHECKCONF=$TOP/Build/$VSCONF/named-checkconf@EXEEXT@
-CHECKDS="$PYTHON `cygpath -w $TOP/bin/python/dnssec-checkds.py`"
-CHECKZONE=$TOP/Build/$VSCONF/named-checkzone@EXEEXT@
-COVERAGE="$PYTHON `cygpath -w $TOP/bin/python/dnssec-coverage.py`"
-DDNSCONFGEN=$TOP/Build/$VSCONF/ddns-confgen@EXEEXT@
-DELV=$TOP/Build/$VSCONF/delv@EXEEXT@
-DIG=$TOP/Build/$VSCONF/dig@EXEEXT@
-DNSTAPREAD=$TOP/Build/$VSCONF/dnstap-read@EXEEXT@
-DSFROMKEY=$TOP/Build/$VSCONF/dnssec-dsfromkey@EXEEXT@
-FEATURETEST=$TOP/Build/$VSCONF/feature-test@EXEEXT@
-FSTRM_CAPTURE=@FSTRM_CAPTURE@
-IMPORTKEY=$TOP/Build/$VSCONF/dnssec-importkey@EXEEXT@
-JOURNALPRINT=$TOP/Build/$VSCONF/named-journalprint@EXEEXT@
-KEYFRLAB=$TOP/Build/$VSCONF/dnssec-keyfromlabel@EXEEXT@
-KEYGEN=$TOP/Build/$VSCONF/dnssec-keygen@EXEEXT@
-KEYMGR="$PYTHON `cygpath -w $TOP/bin/python/dnssec-keymgr.py`"
-MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
-NAMED=$TOP/Build/$VSCONF/named@EXEEXT@
-NSEC3HASH=$TOP/Build/$VSCONF/nsec3hash@EXEEXT@
-NSLOOKUP=$TOP/Build/$VSCONF/nslookup@EXEEXT@
-NSUPDATE=$TOP/Build/$VSCONF/nsupdate@EXEEXT@
-NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
-PK11DEL="$TOP/Build/$VSCONF/pkcs11-destroy@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
-PK11GEN="$TOP/Build/$VSCONF/pkcs11-keygen@EXEEXT@ -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-PK11LIST="$TOP/Build/$VSCONF/pkcs11-list@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-REVOKE=$TOP/Build/$VSCONF/dnssec-revoke@EXEEXT@
-RNDC=$TOP/Build/$VSCONF/rndc@EXEEXT@
-RNDCCONFGEN=$TOP/Build/$VSCONF/rndc-confgen@EXEEXT@
-RRCHECKER=$TOP/Build/$VSCONF/named-rrchecker@EXEEXT@
-SETTIME=$TOP/Build/$VSCONF/dnssec-settime@EXEEXT@
-SIGNER=$TOP/Build/$VSCONF/dnssec-signzone@EXEEXT@
-TSIGKEYGEN=$TOP/Build/$VSCONF/tsig-keygen@EXEEXT@
-VERIFY=$TOP/Build/$VSCONF/dnssec-verify@EXEEXT@
+export VSCONF=${VSCONF:-Debug}
+
+# Interpreters for system tests
+export PERL=/usr/bin/perl
+if ! test -x "$PERL"; then
+ echo "Perl interpreter is required for system tests."
+ exit 77
+fi
+export PYTHON=@PYTHON@
+
+
+export ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
+export CDS=$TOP/Build/$VSCONF/dnssec-cds@EXEEXT@
+export CHECKCONF=$TOP/Build/$VSCONF/named-checkconf@EXEEXT@
+export CHECKDS="$PYTHON `cygpath -w $TOP/bin/python/dnssec-checkds.py`"
+export CHECKZONE=$TOP/Build/$VSCONF/named-checkzone@EXEEXT@
+export COVERAGE="$PYTHON `cygpath -w $TOP/bin/python/dnssec-coverage.py`"
+export DDNSCONFGEN=$TOP/Build/$VSCONF/ddns-confgen@EXEEXT@
+export DELV=$TOP/Build/$VSCONF/delv@EXEEXT@
+export DIG=$TOP/Build/$VSCONF/dig@EXEEXT@
+export DNSTAPREAD=$TOP/Build/$VSCONF/dnstap-read@EXEEXT@
+export DSFROMKEY=$TOP/Build/$VSCONF/dnssec-dsfromkey@EXEEXT@
+export FEATURETEST=$TOP/Build/$VSCONF/feature-test@EXEEXT@
+export FSTRM_CAPTURE=@FSTRM_CAPTURE@
+export IMPORTKEY=$TOP/Build/$VSCONF/dnssec-importkey@EXEEXT@
+export JOURNALPRINT=$TOP/Build/$VSCONF/named-journalprint@EXEEXT@
+export KEYFRLAB=$TOP/Build/$VSCONF/dnssec-keyfromlabel@EXEEXT@
+export KEYGEN=$TOP/Build/$VSCONF/dnssec-keygen@EXEEXT@
+export KEYMGR="$PYTHON `cygpath -w $TOP/bin/python/dnssec-keymgr.py`"
+export MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
+export NAMED=$TOP/Build/$VSCONF/named@EXEEXT@
+export NSEC3HASH=$TOP/Build/$VSCONF/nsec3hash@EXEEXT@
+export NSLOOKUP=$TOP/Build/$VSCONF/nslookup@EXEEXT@
+export NSUPDATE=$TOP/Build/$VSCONF/nsupdate@EXEEXT@
+export NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
+export PK11DEL="$TOP/Build/$VSCONF/pkcs11-destroy@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
+export PK11GEN="$TOP/Build/$VSCONF/pkcs11-keygen@EXEEXT@ -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+export PK11LIST="$TOP/Build/$VSCONF/pkcs11-list@EXEEXT@ -s ${SLOT:-0} -p ${HSMPIN:-1234}"
+export REVOKE=$TOP/Build/$VSCONF/dnssec-revoke@EXEEXT@
+export RNDC=$TOP/Build/$VSCONF/rndc@EXEEXT@
+export RNDCCONFGEN=$TOP/Build/$VSCONF/rndc-confgen@EXEEXT@
+export RRCHECKER=$TOP/Build/$VSCONF/named-rrchecker@EXEEXT@
+export SETTIME=$TOP/Build/$VSCONF/dnssec-settime@EXEEXT@
+export SIGNER=$TOP/Build/$VSCONF/dnssec-signzone@EXEEXT@
+export TSIGKEYGEN=$TOP/Build/$VSCONF/tsig-keygen@EXEEXT@
+export VERIFY=$TOP/Build/$VSCONF/dnssec-verify@EXEEXT@
# to port WIRETEST=$TOP/Build/$VSCONF/wire_test@EXEEXT@
-WIRETEST=
+export WIRETEST=
-BIGKEY=$TOP/Build/$VSCONF/bigkey@EXEEXT@
-GENCHECK=$TOP/Build/$VSCONF/gencheck@EXEEXT@
-KEYCREATE=$TOP/Build/$VSCONF/keycreate@EXEEXT@
-KEYDELETE=$TOP/Build/$VSCONF/keydelete@EXEEXT@
-MAKEJOURNAL=$TOP/Build/$VSCONF/makejournal@EXEEXT@
-PIPEQUERIES=$TOP/Build/$VSCONF/pipequeries@EXEEXT@
-RESOLVE=$TOP/Build/$VSCONF/resolve@EXEEXT@
+export BIGKEY=$TOP/Build/$VSCONF/bigkey@EXEEXT@
+export GENCHECK=$TOP/Build/$VSCONF/gencheck@EXEEXT@
+export KEYCREATE=$TOP/Build/$VSCONF/keycreate@EXEEXT@
+export KEYDELETE=$TOP/Build/$VSCONF/keydelete@EXEEXT@
+export MAKEJOURNAL=$TOP/Build/$VSCONF/makejournal@EXEEXT@
+export PIPEQUERIES=$TOP/Build/$VSCONF/pipequeries@EXEEXT@
+export RESOLVE=$TOP/Build/$VSCONF/resolve@EXEEXT@
# we don't want a KRB5_CONFIG setting breaking the tests
-KRB5_CONFIG=NUL
-
-#
-# Construct the lists of tests to run
-#
-SEQUENTIAL_WINDOWS=""
-SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_WINDOWS"
-
-PARALLEL_WINDOWS="@CHECKDS@ @COVERAGE@ @DNSTAP@ @KEYMGR@"
-PARALLELDIRS="$PARALLEL_COMMON $PARALLEL_WINDOWS"
-
-SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
+export KRB5_CONFIG=NUL
# Things that are different on Windows
-KILL="/bin/kill -f"
-DIFF="diff --strip-trailing-cr"
-DOS2UNIX=dos2unix
+export KILL="/bin/kill -f"
+export DIFF="diff --strip-trailing-cr"
+export DOS2UNIX=dos2unix
# No trailing period
-TP=
+export TP=
# Configure is launched from native environment, but tests are run in Cygwin -
# so any detection is unreliable.
-SHELL="/bin/bash -o igncr"
-CURL=/usr/bin/curl
-XMLLINT=/usr/bin/xmllint
-PERL=/usr/bin/perl
+export SHELL="/bin/bash -o igncr"
+export CURL=/usr/bin/curl
+export XMLLINT=/usr/bin/xmllint
#
# PsSuspend is part of PSTools and can be downloaded from
# https://download.sysinternals.com/files/PSTools.zip
#
-PSSUSPEND=@PSSUSPEND@
-
-PYTHON=@PYTHON@
+export PSSUSPEND=@PSSUSPEND@
#
# Determine if we support various optional features.
#
-HAVEXMLSTATS=@XMLSTATS@
-HAVEJSONSTATS=@JSONSTATS@
-HAVEZLIB=@ZLIB@
-NZD=@NZD_TOOLS@
-CRYPTO=@CRYPTO@
+export CRYPTO=@CRYPTO@
+
# The rest is shared between Windows and Unices
. $TOP/bin/tests/system/conf.sh.common
+
+#
+# Construct the lists of tests to run
+#
+SEQUENTIAL_WINDOWS=""
+SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_WINDOWS"
+
+PARALLEL_WINDOWS="@CHECKDS@ @COVERAGE@ @DNSTAP@ @KEYMGR@"
+PARALLELDIRS="$PARALLEL_COMMON $PARALLEL_WINDOWS"
+
+SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
diff --git a/external/mpl/bind/dist/bin/tests/system/cookie/clean.sh b/external/mpl/bind/dist/bin/tests/system/cookie/clean.sh
index 5ef9ea3b245..2c107573c9a 100644
--- a/external/mpl/bind/dist/bin/tests/system/cookie/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/cookie/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/coverage/setup.sh b/external/mpl/bind/dist/bin/tests/system/coverage/setup.sh
index ac401e120e3..7de73b8a92c 100644
--- a/external/mpl/bind/dist/bin/tests/system/coverage/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/coverage/setup.sh
@@ -20,100 +20,100 @@ ln -s $CHECKZONE named-compilezone
# Test 1: KSK goes inactive before successor is active
dir=01-ksk-inactive
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
-ksk2=`$KEYGEN -q -K $dir -S $ksk1`
+ksk2=$($KEYGEN -q -K $dir -S $ksk1)
$SETTIME -K $dir -I +7mo $ksk1 > /dev/null 2>&1
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
# Test 2: ZSK goes inactive before successor is active
dir=02-zsk-inactive
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
-zsk2=`$KEYGEN -q -K $dir -S $zsk1`
+zsk2=$($KEYGEN -q -K $dir -S $zsk1)
$SETTIME -K $dir -I +7mo $zsk1 > /dev/null 2>&1
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
# Test 3: KSK is unpublished before its successor is published
dir=03-ksk-unpublished
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
-ksk2=`$KEYGEN -q -K $dir -S $ksk1`
+ksk2=$($KEYGEN -q -K $dir -S $ksk1)
$SETTIME -K $dir -D +6mo $ksk1 > /dev/null 2>&1
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
# Test 4: ZSK is unpublished before its successor is published
dir=04-zsk-unpublished
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
-zsk2=`$KEYGEN -q -K $dir -S $zsk1`
+zsk2=$($KEYGEN -q -K $dir -S $zsk1)
$SETTIME -K $dir -D +6mo $zsk1 > /dev/null 2>&1
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
# Test 5: KSK deleted and successor published before KSK is deactivated
# and successor activated.
dir=05-ksk-unpub-active
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
$SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
-ksk2=`$KEYGEN -q -K $dir -S $ksk1`
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+ksk2=$($KEYGEN -q -K $dir -S $ksk1)
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
# Test 6: ZSK deleted and successor published before ZSK is deactivated
# and successor activated.
dir=06-zsk-unpub-active
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
$SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
-zsk2=`$KEYGEN -q -K $dir -S $zsk1`
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+zsk2=$($KEYGEN -q -K $dir -S $zsk1)
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
# Test 7: KSK rolled with insufficient delay after prepublication.
dir=07-ksk-ttl
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
-ksk2=`$KEYGEN -q -K $dir -S $ksk1`
+ksk2=$($KEYGEN -q -K $dir -S $ksk1)
# allow only 1 day between publication and activation
$SETTIME -K $dir -P +269d $ksk2 > /dev/null 2>&1
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
# Test 8: ZSK rolled with insufficient delay after prepublication.
dir=08-zsk-ttl
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
-zsk2=`$KEYGEN -q -K $dir -S $zsk1`
+zsk2=$($KEYGEN -q -K $dir -S $zsk1)
# allow only 1 day between publication and activation
$SETTIME -K $dir -P +269d $zsk2 > /dev/null 2>&1
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
# Test 9: KSK goes inactive before successor is active, but checking ZSKs
dir=09-check-zsk
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
-ksk2=`$KEYGEN -q -K $dir -S $ksk1`
+ksk2=$($KEYGEN -q -K $dir -S $ksk1)
$SETTIME -K $dir -I +7mo $ksk1 > /dev/null 2>&1
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
# Test 10: ZSK goes inactive before successor is active, but checking KSKs
dir=10-check-ksk
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
-zsk2=`$KEYGEN -q -K $dir -S $zsk1`
+zsk2=$($KEYGEN -q -K $dir -S $zsk1)
$SETTIME -K $dir -I +7mo $zsk1 > /dev/null 2>&1
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
# Test 11: ZSK goes inactive before successor is active, but after cutoff
dir=11-cutoff
-zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
+zsk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com)
$SETTIME -K $dir -I +18mo -D +2y $zsk1 > /dev/null 2>&1
-zsk2=`$KEYGEN -q -K $dir -S $zsk1`
+zsk2=$($KEYGEN -q -K $dir -S $zsk1)
$SETTIME -K $dir -I +16mo $zsk1 > /dev/null 2>&1
-ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
+ksk1=$($KEYGEN -q -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com)
# Test 12: Too early KSK deletion
dir=12-ksk-deletion
-ksk1=`$KEYGEN -q -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com`
-ksk2=`$KEYGEN -q -K $dir -S $ksk1.key example.com`
+ksk1=$($KEYGEN -q -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com)
+ksk2=$($KEYGEN -q -K $dir -S $ksk1.key example.com)
# Test 13: check names with/without dots at the end
dir=13-dotted-dotless
-zsk1=`$KEYGEN -q -K $dir -a rsasha256 one.example`
-zsk2=`$KEYGEN -q -K $dir -a rsasha256 two.example`
+zsk1=$($KEYGEN -q -K $dir -a rsasha256 one.example)
+zsk2=$($KEYGEN -q -K $dir -a rsasha256 two.example)
diff --git a/external/mpl/bind/dist/bin/tests/system/dialup/clean.sh b/external/mpl/bind/dist/bin/tests/system/dialup/clean.sh
index 581c3ccdfaf..9318255bfaf 100644
--- a/external/mpl/bind/dist/bin/tests/system/dialup/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dialup/clean.sh
@@ -14,3 +14,5 @@
rm -f ns2/example.bk
rm -f ns3/example.bk
rm -f */named.memstats */named.run
+rm -f ns*/named.conf
+rm -f ns*/named.lock
diff --git a/external/mpl/bind/dist/bin/tests/system/dialup/ns1/named.conf.in b/external/mpl/bind/dist/bin/tests/system/dialup/ns1/named.conf.in
new file mode 100644
index 00000000000..8ed56a836fc
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dialup/ns1/named.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.1;
+ notify-source 10.53.0.1;
+ transfer-source 10.53.0.1;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.1; };
+ listen-on-v6 { none; };
+ heartbeat-interval 2;
+ recursion no;
+ dnssec-validation no;
+};
+
+zone "." {
+ type master;
+ file "root.db";
+};
+
+zone "example." {
+ type master;
+ notify explicit;
+ also-notify { 10.53.0.2; };
+ dialup yes;
+ file "example.db";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/dialup/ns2/named.conf.in b/external/mpl/bind/dist/bin/tests/system/dialup/ns2/named.conf.in
new file mode 100644
index 00000000000..a30bb0d9255
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dialup/ns2/named.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.2;
+ notify-source 10.53.0.2;
+ transfer-source 10.53.0.2;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.2; };
+ listen-on-v6 { none; };
+ heartbeat-interval 2;
+ recursion no;
+ dnssec-validation no;
+};
+
+zone "." {
+ type hint;
+ file "hint.db";
+};
+
+zone "example." {
+ type slave;
+ dialup passive;
+ notify no;
+ file "example.bk";
+ masters { 10.53.0.1; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/dialup/ns3/named.conf.in b/external/mpl/bind/dist/bin/tests/system/dialup/ns3/named.conf.in
new file mode 100644
index 00000000000..df6514d7201
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dialup/ns3/named.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.3;
+ notify-source 10.53.0.3;
+ transfer-source 10.53.0.3;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ heartbeat-interval 2;
+ recursion no;
+ dnssec-validation no;
+};
+
+zone "." {
+ type hint;
+ file "hint.db";
+};
+
+zone "example." {
+ type slave;
+ dialup refresh;
+ notify no;
+ file "example.bk";
+ masters { 10.53.0.2; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/dialup/tests.sh b/external/mpl/bind/dist/bin/tests/system/dialup/tests.sh
index 2387ce3aab5..1353569f2ff 100644
--- a/external/mpl/bind/dist/bin/tests/system/dialup/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dialup/tests.sh
@@ -18,7 +18,7 @@ status=0
rm -f dig.out.*
-DIGOPTS="+norec +tcp +noadd +nosea +nostat +noquest +nocmd -p 5300"
+DIGOPTS="+norec +tcp +noadd +nosea +nostat +noquest +nocmd -p ${PORT}"
# Check the example. domain
diff --git a/external/mpl/bind/dist/bin/tests/system/digdelv/yamlget.py b/external/mpl/bind/dist/bin/tests/system/digdelv/yamlget.py
index 2b00bf245b8..afa582dd9ce 100644
--- a/external/mpl/bind/dist/bin/tests/system/digdelv/yamlget.py
+++ b/external/mpl/bind/dist/bin/tests/system/digdelv/yamlget.py
@@ -13,7 +13,6 @@ import sys
try:
import yaml
-# flake8: noqa: E722
# pylint: disable=bare-except
except:
print("No python yaml module, skipping")
diff --git a/external/mpl/bind/dist/bin/tests/system/dlzexternal/tests.sh b/external/mpl/bind/dist/bin/tests/system/dlzexternal/tests.sh
index 1e48fc8770c..ab35051c7d4 100644
--- a/external/mpl/bind/dist/bin/tests/system/dlzexternal/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dlzexternal/tests.sh
@@ -46,7 +46,7 @@ EOF
return 1
}
- out=`$DIG $DIGOPTS -t $type -q $host | egrep "^$host"`
+ out=`$DIG $DIGOPTS -t $type -q $host | grep -E "^$host"`
lines=`echo "$out" | grep "$digout" | wc -l`
[ $lines -eq 1 ] || {
[ "$should_fail" ] || \
diff --git a/external/mpl/bind/dist/bin/tests/system/dns64/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/dns64/ns1/sign.sh
index ba45d95d67e..9eff6e395af 100644
--- a/external/mpl/bind/dist/bin/tests/system/dns64/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dns64/ns1/sign.sh
@@ -18,8 +18,8 @@ zone=signed
infile=example.db
zonefile=signed.db
-key1=`$KEYGEN -q -a rsasha256 $zone`
-key2=`$KEYGEN -q -a rsasha256 -fk $zone`
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM $zone)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone)
cat $infile $key1.key $key2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/clean.sh b/external/mpl/bind/dist/bin/tests/system/dnssec/clean.sh
index f7816498d36..28e72ba6bc1 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/clean.sh
@@ -34,7 +34,7 @@ rm -f ./keygen.err
rm -f ./named.secroots.test*
rm -f ./nosign.before
rm -f ./ns*/*.nta
-rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
+rm -f ./ns*/managed-keys.bind ./ns*/managed-keys.bind.jnl ./ns*/*.mkeys*
rm -f ./ns*/named.lock
rm -f ./ns1/managed.key.id
rm -f ./ns1/root.db ./ns2/example.db ./ns2/managed.db ./ns2/trusted.db
@@ -96,7 +96,6 @@ rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
rm -f ./ns3/ttlpatch.example.db.patched
rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
rm -f ./ns3/unsupported.managed.db.tmp ./ns3/unsupported.trusted.db.tmp
-rm -f ./ns4/managed-keys.bind*
rm -f ./ns4/named_dump.db*
rm -f ./ns6/optout-tld.db
rm -f ./ns7/multiple.example.bk ./ns7/nsec3.example.bk ./ns7/optout.example.bk
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/ns4/managed-keys.bind.in b/external/mpl/bind/dist/bin/tests/system/dnssec/ns4/managed-keys.bind.in
new file mode 100644
index 00000000000..570669df3c7
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/ns4/managed-keys.bind.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN .
+$TTL 0 ; 0 seconds
+@ IN SOA . . (
+ 2 ; serial
+ 0 ; refresh (0 seconds)
+ 0 ; retry (0 seconds)
+ 0 ; expire (0 seconds)
+ 0 ; minimum (0 seconds)
+ )
+ KEYDATA 20221028094934 19700101000000 19700101000000 0 0 0 ; placeholder
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key
new file mode 100644
index 00000000000..47003a44c22
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 18240, for example.com.
+; Created: 20211221062121 (Tue Dec 21 17:21:21 2021)
+; Publish: 20211221062121 (Tue Dec 21 17:21:21 2021)
+; Activate: 20211221062121 (Tue Dec 21 17:21:21 2021)
+example.com. IN DNSKEY 256 3 10 AwEAAe5GunnuJFyzmKiGUknSQY3aPtR5UR8vNLLyMCJswffRzoYwY14/ 60ZTsqzh7N+lJV3KAOraocFSsTnmWIM7D7DPpqtaJMQw90ypBG0cnUP1 wKX9L/gdOH/ITlluBiZpCv9Aux3FRECHBO4Gx8Rse8ST2Vag3UuOPW+q HkLsWQt22K/hYuDhEtUWWx2dTIaXUVXNSNbk2zPL+lhC9PaRV+//1Fjo UX4qXCUuUN4TiqlkK2v4UkcIyld1n2R7qTQAkoN9amGFtPu8z5Zw7CxC San03yUSNuKub3fGys11gQRFuEHRX7FxKxvJjmcngG9qCh8AyfHZ8zYb VstTy1unFoM=
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private
new file mode 100644
index 00000000000..f16b62708a2
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 10 (RSASHA512)
+Modulus: 7ka6ee4kXLOYqIZSSdJBjdo+1HlRHy80svIwImzB99HOhjBjXj/rRlOyrOHs36UlXcoA6tqhwVKxOeZYgzsPsM+mq1okxDD3TKkEbRydQ/XApf0v+B04f8hOWW4GJmkK/0C7HcVEQIcE7gbHxGx7xJPZVqDdS449b6oeQuxZC3bYr+Fi4OES1RZbHZ1MhpdRVc1I1uTbM8v6WEL09pFX7//UWOhRfipcJS5Q3hOKqWQra/hSRwjKV3WfZHupNACSg31qYYW0+7zPlnDsLEJJqfTfJRI24q5vd8bKzXWBBEW4QdFfsXErG8mOZyeAb2oKHwDJ8dnzNhtWy1PLW6cWgw==
+PublicExponent: AQAB
+PrivateExponent: U/ipDv9V4TWJvxpXNZzbbVpUehym8g54y/d97yPU17kgxzmWS0jLaWVluneEOuzAVmUyHZIfHzo9KuJ6nwTZar5DRm/mNR3siR+nZ6yF38VjtxubJB1oI+A7fFjB4hdywLHXP46dlv/+RMQu8pIorAZOubDHTDE8hXW2ZG9WkisJ5P7KoaL4KFHHHXi5vsXAMph4Zphd/zPxVL2tHD3l5c3QXRpQWfTNZNQcZ1f/4yVCuMRibg5LCvpia0ZwRrlygfZdAHUUd0VJDfRO45J5nlIJSAHQtjYtVTL+xNISWOHXovVlInkVyluACqfX94I7qPXTu41yg3SxrrtHE6RTwQ==
+Prime1: +/YsRxmUxgvHKUh4SxdjzqNDDEi8b2BtM5IpctjVG3oYsL6J9xJB3U5/lbrGEPgl/1ndBUSXMQ6zQ5WcDE1qBAdW8t0eyniyuiexcgQ9f04Ds7p7oUiSHGLRn8YqQOzmiASXoZmkzfJZ+42pGhT3RZ+aYKtWQGMHqXabwV3zZl0=
+Prime2: 8hhnKzPzExy6wv/MV0aYKo1g4azrRjug6743/ctTC7zjnMmDW7RMFTXmq5Tu3pFaIL4N4C4m1b7P3abfTrjm+DwHnrlRIvLWS3zJnvUEM22i4BwqqTLRiJpoT5Bfp4pVsdOPT7Iyx1q5UsJZ7Q4qMpg2TFpGiQyieRB5Xwpu4l8=
+Exponent1: ZFPx7Z3SD8pA0793pu75Xx7DY/DSl8bdtNtOhdyxfu9vRXGZnjg24diQFR76H2ewOa2exKo7Sd2ApDi+mmd4/4Gsrag+yoClKlsD3VKy6i42ayqmb+Jly8fNkMFnsdKjOSYa+s4jQZ5vFiuiWjBfBeo3nqabAahtNJ12B9lRQkE=
+Exponent2: tNz4TnVsFo4zFLVHsrghvECM7WxjBMBNc3FToT6CV1WRcjO1+A/Ve08eenc0kYBjpex2r1GrX6pC3uPpFoXav/8Q7kqiTArBf/nFIwUHU2iH8wf38xntIjHA1hgU7jTR2p0kBrUpbHfh1esuhYQ8kDnY7ufOpFqVEv70vcUsm98=
+Coefficient: 3acDCJ9jCnHAP1km7jRO388mOpiI8U6SMv0PBD8l2UoB4CYwujrFxy6PhgUa486bbm5xZEaOwhYZcbw/g1qyC6Qt5kYOb2fVWOob/lEQmyqbDvHMQWTJoIbqaDTKQN/szI4xVdb/xZ6QR4Bq7JgbJpUACgweS540Y7Lf8Dry8C0=
+Created: 20211221062121
+Publish: 20211221062121
+Activate: 20211221062121
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key
new file mode 100644
index 00000000000..37bd259f6bf
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 28633, for example.com.
+; Created: 20211221062130 (Tue Dec 21 17:21:30 2021)
+; Publish: 20211221062130 (Tue Dec 21 17:21:30 2021)
+; Activate: 20211221062130 (Tue Dec 21 17:21:30 2021)
+example.com. IN DNSKEY 257 3 10 AwEAAc4lt8fDsdCzMCLHxXm8Ok/dw6XDiqx06Rf47LTeLmo6b64xm1Fs 0zloNMrcZDgwS5IxjQ3Breqc5aEc+jehueqCXa/fJXMdIt1VpUG0H7GP 4B+1IVmEiziHfmOozktdkuAyLqcsNhsf+J1+bCoHJSffgz6KbjBks/jR 12uyUnZCDrKGE/KfiR0gpT3watqGqqChO0KXq2N2PsnYfyRDea5FMUjM oPgOOyAT8LIMsM8x4f+EbU6m9Zc3Esafek9iLCS9R1333Pm1EEh5ghQT BsZ7omc5aSvrKUaIneojU3RdofceZouCliIDXmqscfY0y6bivGcmCQI/ LM4XUh7GWlM=
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private
new file mode 100644
index 00000000000..6d7f72e48ba
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 10 (RSASHA512)
+Modulus: ziW3x8Ox0LMwIsfFebw6T93DpcOKrHTpF/jstN4uajpvrjGbUWzTOWg0ytxkODBLkjGNDcGt6pzloRz6N6G56oJdr98lcx0i3VWlQbQfsY/gH7UhWYSLOId+Y6jOS12S4DIupyw2Gx/4nX5sKgclJ9+DPopuMGSz+NHXa7JSdkIOsoYT8p+JHSClPfBq2oaqoKE7QperY3Y+ydh/JEN5rkUxSMyg+A47IBPwsgywzzHh/4RtTqb1lzcSxp96T2IsJL1HXffc+bUQSHmCFBMGxnuiZzlpK+spRoid6iNTdF2h9x5mi4KWIgNeaqxx9jTLpuK8ZyYJAj8szhdSHsZaUw==
+PublicExponent: AQAB
+PrivateExponent: Wr3fl99cdjFqDuVA18UzJdTIOj9I24Da2eKIz1S9uaTfZB4R8FWm5K4qDuHUe6dGnKOTI2sN0ygdLD5FJhfabo/UDYZ8RZ+dqS/5/mH7UX2zekGQ3Iargcaiq9uycxpNfMKaJpwfdPEtzqXHlvhuMo8AhpcIyeSKFAzKdm2YPtUqIrum4RARHyfRLfLyWlkIotPdyiaKCVGQxiRbFsTcmIB2Bizmt7zRjlB+Hxf8MooXmaKUFRQtMCLnFGK0ecFI1CWAxmLSanvYVKQ0HxcFkFKzRiZAz1au7ZfMgYDZj0jF72WAGU3Edcmdc0QIQRTWjb/3wcBfwlr9s6lKoF3ngQ==
+Prime1: 1EIziKhz7dF41rb/hckdr2qeY8eM7tLrT5jIMPLISHCCuKm5IK2u7PY6m6NjMdhx1ilm7K2RGTt+TTFZaqDIEd8qpzRCxAGcfTVOmB9iHwmi9i9RoPSlY6o+iShft68ZnvPiGJWUF2huRYVK2F0cIWErwSqaBGsFd79mXmlkn98=
+Prime2: +KEdNtZj9JyCCR2xbLAw3tnAYxHvJ3skVMjxV3cyUupMWi12NWxGhHH1nnetXxDR2LBBuqIl4pE/4MeXe3sClMHTL3Z9XG+pzQAsHS7yvsfZERdyuWZYYy0ya/7XY2auvRVO6LxN7d47VWjYxAGfoCsbCEivgDxmt1dTZhAtRA0=
+Exponent1: d5TcZ69PsLoEtCLhDkRh/wO4PEqeMaaOf4d5sWn2QCly3Apyi+CN3l5SYoDIT7q7V4Z3v/uA9ZA49dBJqfLvBHKQGycsPjUSLtAreTSlGQtazguWl3F9BAtTs/4U/u0dKBoKVQNgLVfeWDhiFEdQo9WUyvzvTHHm4LHqQGJsGE0=
+Exponent2: EU2dK+DVygNOZXYEkAzfCdNbuUlZPIUsbR4i9bRc8zpNIAWD8YncioEn1+R6U2BnSk5R9LwuKMt1B568YyKXdmTa3rW/WbyHs7WsXEeVK0PbTn40RMTjp9tQZAWzVb6isJQYDsh0H/bUaEhItbNrOYlmczgjxqftehsAudysWc0=
+Coefficient: sl2u/8vttxpiTbspGV4SsaDmKUNdzQH7BgJ5rl3mXPp/aUpLw0Sr7FuARy8W8tq3yVNi9qCOnvGwVl6aQzZP7b8N04KiH8gewlAVdSfxG24yFKJIQNbWGKFZYZFYyjtLVlpK6NYF0f0I1KpAjn58XR0qIBvRFZYWBAkggU9C7ro=
+Created: 20211221062130
+Publish: 20211221062130
+Activate: 20211221062130
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-ksk.key b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-ksk.key
index af4640baeb2..e4685741ffe 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-ksk.key
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-ksk.key
@@ -1,6 +1,6 @@
;
; This is a bogus key. It will not have a .private file.
;
-; This will be key id 7091
+; This will be key id 23221
;
-example.com. IN DNSKEY 257 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpz
+example.com. IN DNSKEY 257 3 10 AwEAAbcyptpM++pVjhpYQW2fVtyOw04IBSw4X0SYi/Ke4wVkmDNW2vBm AFkgiVVKmmNbb0IHDYQiIY7seXk0fjEwjzeY2bmeOAZxDdv2KT9VQpoY Matk2y4NTi6F/V04x0lL/CBvyifTeNbZKvY+S1eKFuWHeS5Ss8tiagz9 zdYWUe/msvmin+Hbs2tlLwXVl4hOmABCL9uK9H8R6GPL5VdEXYyFOh/v 71CNhRU5ufrARti69YYkfzH6NpWhlJWyJvDjqAdt2L3H8V71C2vcXbBu S5NscEYl+8JQfwUvOTN553I5IQrG+NQEusW36UM/Rkad8mMnUVM9Vzqk GH86GHKtLMc=
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-zsk.key b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-zsk.key
index 2e53d5c52ae..aa459384262 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-zsk.key
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/bogus-zsk.key
@@ -1,6 +1,6 @@
;
; This is a bogus key. It will not have a .private file.
;
-; This will be key id 7092
+; This will be key id 48930
;
-example.com. IN DNSKEY 256 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpz
+example.com. IN DNSKEY 256 3 10 AwEAAa/0IcnbGutPVkrz04tw5ZIYx6rU+FprB2rlKS8cTK/wiBOqbOC6 QIDdegDpZG1fOdj04ZQGa3pIizqC2CnlIWfxpfR6W+qSLRBuQ8gmwTmS c/Jy/0vAGB3fv3oVIqKslLNqIXZb3CKNiA2kGcut3aUgfeOW970Jga6z PAGKqPpPZTelW1Qy9N5BO4cRTuYo4uvbZveJv1W/2n5RN+UaeqU0f+AE DP0+wqSWNUfZsi6HygLwk08x3eO8PzTBlqBlAMfvNAygrmXqccMREyyH KEc5dVJ1qOXfj8BAdJUPmunyJhIwC9PxzOW7mn1lW7mZO2D5U/Jaxw2k eX2KblmVk8s=
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test1.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test1.zone
index 1bb8daecbb1..98c9f0233c3 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test1.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test1.zone
@@ -15,5 +15,5 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test2.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test2.zone
index 1ce77fea243..97c0d3d8dc2 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test2.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test2.zone
@@ -15,4 +15,4 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
+$include Kexample.com.+010+18240.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test3.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test3.zone
index 61e162c8003..bf9bc66c56f 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test3.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test3.zone
@@ -15,4 +15,4 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+28633.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test4.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test4.zone
index 2a6b42e52df..9f05de50fb1 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test4.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test4.zone
@@ -15,6 +15,6 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
$include bogus-zsk.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test5.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test5.zone
index 79377cee96b..d61504fbf91 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test5.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test5.zone
@@ -14,6 +14,6 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
$include bogus-ksk.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test6.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test6.zone
index 14bdfebba76..fcfb1ec2607 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test6.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test6.zone
@@ -15,7 +15,7 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
$include bogus-ksk.key
$include bogus-zsk.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test8.zone b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test8.zone
index cd88b4f6623..893d32da10b 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test8.zone
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test8.zone
@@ -15,5 +15,5 @@
;
$TTL 3600
example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+28633.key
$include bogus-zsk.key
diff --git a/external/mpl/bind/dist/bin/tests/system/dnssec/tests.sh b/external/mpl/bind/dist/bin/tests/system/dnssec/tests.sh
index 8ebe1bb9ab5..a01c3256943 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnssec/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dnssec/tests.sh
@@ -1420,14 +1420,14 @@ n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
-get_rsasha1_key_ids_from_sigs() {
+get_default_algorithm_key_ids_from_sigs() {
zone=$1
tr -d '\r' < signer/$zone.db.signed | \
- awk '
+ awk -v alg=$DEFAULT_ALGORITHM_NUMBER '
NF < 8 { next }
$(NF-5) != "RRSIG" { next }
- $(NF-3) != "5" { next }
+ $(NF-3) != alg { next }
$NF != "(" { next }
{
getline;
@@ -1442,9 +1442,9 @@ echo_i "check dnssec-signzone doesn't sign with prepublished zsk ($n)"
ret=0
zone=prepub
# Generate keys.
-ksk=$("$KEYGEN" -K signer -f KSK -q -a RSASHA1 -b 1024 -n zone "$zone")
-zsk1=$("$KEYGEN" -K signer -q -a RSASHA1 -b 1024 -n zone "$zone")
-zsk2=$("$KEYGEN" -K signer -q -a RSASHA1 -b 1024 -n zone "$zone")
+ksk=$("$KEYGEN" -K signer -f KSK -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zsk1=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zsk2=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM -n zone "$zone")
zskid1=$(keyfile_to_key_id "$zsk1")
zskid2=$(keyfile_to_key_id "$zsk2")
(
@@ -1462,8 +1462,8 @@ cp -f $zone.db.in $zone.db
$SIGNER -SDx -e +2592000 -X +5184000 -o $zone $zone.db > /dev/null
echo "\$INCLUDE \"$zone.db.signed\"" >> $zone.db
)
-get_rsasha1_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null && ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed: missing signatures from key $zskid1"
status=$((status+ret))
@@ -1482,8 +1482,8 @@ $SETTIME -A now-30d -I now -D now+30d $zsk1 > /dev/null
$SETTIME -A now $zsk2 > /dev/null
$SIGNER -SDx -e +2592000 -X +5184000 -o $zone $zone.db > /dev/null
)
-get_rsasha1_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null && ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1501,8 +1501,8 @@ $SETTIME -A now-50d -I now-20d -D now+10d $zsk1 > /dev/null
$SETTIME -A now-20d $zsk2 > /dev/null
$SIGNER -SDx -e +2592000 -X +5184000 -i 2592001 -o $zone $zone.db > /dev/null
)
-get_rsasha1_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null && ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1551,8 +1551,8 @@ status=$((status+ret))
echo_i "checking that we can sign a zone with out-of-zone records ($n)"
ret=0
zone=example
-key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
(
cd signer || exit 1
cat example.db.in "$key1.key" "$key2.key" > example.db
@@ -1565,8 +1565,8 @@ status=$((status+ret))
echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)"
ret=0
zone=example
-key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
(
cd signer || exit 1
cat example.db.in "$key1.key" "$key2.key" > example.db
@@ -1590,8 +1590,8 @@ status=$((status+ret))
echo_i "checking NSEC3 signing with empty nonterminals above a delegation ($n)"
ret=0
zone=example
-key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
(
cd signer || exit 1
cat example.db.in "$key1.key" "$key2.key" > example3.db
@@ -1616,8 +1616,8 @@ status=$((status+ret))
echo_i "checking that dnssec-signzone updates originalttl on ttl changes ($n)"
ret=0
zone=example
-key1=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
(
cd signer || exit 1
cat example.db.in "$key1.key" "$key2.key" > example.db
@@ -1625,7 +1625,7 @@ $SIGNER -o example -f example.db.before example.db > /dev/null
sed 's/60.IN.SOA./50 IN SOA /' example.db.before > example.db.changed
$SIGNER -o example -f example.db.after example.db.changed > /dev/null
)
-grep "SOA 5 1 50" signer/example.db.after > /dev/null || ret=1
+grep "SOA $DEFAULT_ALGORITHM_NUMBER 1 50" signer/example.db.after > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1633,10 +1633,10 @@ status=$((status+ret))
echo_i "checking dnssec-signzone keeps valid signatures from removed keys ($n)"
ret=0
zone=example
-key1=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
keyid2=$(keyfile_to_key_id "$key2")
-key3=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)
+key3=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
keyid3=$(keyfile_to_key_id "$key3")
(
cd signer || exit 1
@@ -1648,8 +1648,8 @@ cat example.db.in "$key1.key" "$key3.key" > example.db
echo "\$INCLUDE \"example.db.signed\"" >> example.db
$SIGNER -D -o example example.db > /dev/null
) || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1660,8 +1660,8 @@ ret=0
cd signer || exit 1
$SIGNER -RD -o example example.db > /dev/null
) || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null && ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1678,8 +1678,8 @@ echo "\$INCLUDE \"example.db.signed\"" >> example.db
$SETTIME -I now "$key2" > /dev/null 2>&1
$SIGNER -SD -o example example.db > /dev/null
) || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1690,8 +1690,8 @@ ret=0
cd signer || exit 1
$SIGNER -SDQ -o example example.db > /dev/null
) || ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null && ret=1
-get_rsasha1_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -1851,7 +1851,7 @@ keyid=$(cat ns1/managed.key.id)
rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
cp ns4/named.secroots named.secroots.test$n
check_secroots_layout named.secroots.test$n || ret=1
-linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; static" named.secroots.test$n || true)
+linecount=$(grep -c "./$DEFAULT_ALGORITHM/$keyid ; static" named.secroots.test$n || true)
[ "$linecount" -eq 1 ] || ret=1
linecount=$(< named.secroots.test$n wc -l)
[ "$linecount" -eq 9 ] || ret=1
@@ -2169,7 +2169,7 @@ echo_i "waiting till 14s have passed since NTAs were added before restarting ns4
$PERL -e 'my $delay = '"$start"' + 14 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
if
- $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4
+ start_server --noclean --restart --port "$PORT" ns4
then
echo_i "restarted server ns4"
else
@@ -2235,7 +2235,7 @@ echo "secure.example. regular $future" > ns4/_default.nta
start=$($PERL -e 'print time()."\n";')
if
- $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4
+ start_server --noclean --restart --port "$PORT" ns4
then
echo_i "restarted server ns4"
else
@@ -2291,7 +2291,7 @@ echo "secure.example. forced $future" > ns4/_default.nta
start=$($PERL -e 'print time()."\n";')
if
- $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4
+ start_server --noclean --restart --port "$PORT" ns4
then
echo_i "restarted server ns4"
else
@@ -2339,7 +2339,7 @@ echo "secure.example. forced $future" > ns4/_default.nta
added=$($PERL -e 'print time()."\n";')
if
- $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4
+ start_server --noclean --restart --port "$PORT" ns4
then
echo_i "restarted server ns4"
else
@@ -2432,7 +2432,10 @@ status=$((status+ret))
# Reconfigure caching server to use "dnssec-validation auto", and repeat
# some of the DNSSEC validation tests to ensure that it works correctly.
+# Also setup a placeholder managed-keys zone to check if named can process it
+# correctly.
echo_i "switching to automatic root key configuration"
+cp ns4/managed-keys.bind.in ns4/managed-keys.bind
copy_setports ns4/named2.conf.in ns4/named.conf
rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i
sleep 5
@@ -2532,7 +2535,7 @@ echo_i "checking that the NSEC3 record for the apex is properly signed when a DN
ret=0
(
cd ns3 || exit 1
-kskname=$($KEYGEN -q -3 -a RSASHA1 -fk update-nsec3.example)
+kskname=$($KEYGEN -q -3 -a $DEFAULT_ALGORITHM -fk update-nsec3.example)
(
echo zone update-nsec3.example
echo server 10.53.0.3 "$PORT"
@@ -2734,7 +2737,7 @@ grep -q "No signing records found" signing.out || {
sed 's/^/ns3 /' signing.out | cat_i
}
{ rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1
-grep -q "Done signing with key .*/NSEC3RSASHA1" signing.out || {
+grep -q "Done signing with key .*/$DEFAULT_ALGORITHM" signing.out || {
ret=1
sed 's/^/ns3 /' signing.out | cat_i
}
@@ -2879,7 +2882,7 @@ status=$((status+ret))
# includes it anyway to avoid confusion (RT #21731)
echo_i "check dnssec-dsfromkey error message when keyfile is not found ($n)"
ret=0
-key=$($KEYGEN -a RSASHA1 -q example.) || ret=1
+key=$($KEYGEN -a $DEFAULT_ALGORITHM -q example.) || ret=1
mv "$key.key" "$key"
$DSFROMKEY "$key" > dsfromkey.out.$n 2>&1 && ret=1
grep "$key.key: file not found" dsfromkey.out.$n > /dev/null || ret=1
@@ -3786,8 +3789,8 @@ ret=0
# generate signed zone with MX and AAAA records at apex.
(
cd signer || exit 1
-$KEYGEN -q -a RSASHA1 -3 -fK remove > /dev/null
-$KEYGEN -q -a RSASHA1 -33 remove > /dev/null
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fK remove > /dev/null
+$KEYGEN -q -a $DEFAULT_ALGORITHM -33 remove > /dev/null
echo > remove.db.signed
$SIGNER -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n
)
@@ -3872,9 +3875,9 @@ ret=0
dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
-$PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
+stop_server ns1 || ret=1
nextpart ns1/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1
+start_server --noclean --restart --port ${PORT} ns1 || ret=1
n=$(($n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -3896,7 +3899,7 @@ status=$((status+ret))
echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)"
ret=0
dig_with_opts txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 600" dig.out.ns3.test$n > /dev/null || ret=1
+grep "RRSIG.NSEC3 $DEFAULT_ALGORITHM_NUMBER 3 600" dig.out.ns3.test$n > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
@@ -4084,10 +4087,10 @@ status=$((status+ret))
# Save some useful information
zone="updatecheck-kskonly.secure"
-KSK=`cat ns2/${zone}.ksk.key`
-ZSK=`cat ns2/${zone}.zsk.key`
-KSK_ID=`cat ns2/${zone}.ksk.id`
-ZSK_ID=`cat ns2/${zone}.zsk.id`
+KSK=$(cat ns2/${zone}.ksk.key)
+ZSK=$(cat ns2/${zone}.zsk.key)
+KSK_ID=$(cat ns2/${zone}.ksk.id)
+ZSK_ID=$(cat ns2/${zone}.zsk.id)
SECTIONS="+answer +noauthority +noadditional"
echo_i "testing zone $zone KSK=$KSK_ID ZSK=$ZSK_ID"
@@ -4129,7 +4132,7 @@ status=$((status+ret))
# Roll the ZSK.
zsk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
keyfile_to_key_id "$zsk2" > ns2/$zone.zsk.id2
-ZSK_ID2=`cat ns2/$zone.zsk.id2`
+ZSK_ID2=$(cat ns2/$zone.zsk.id2)
echo_i "load new ZSK $ZSK_ID2 for $zone ($n)"
ret=0
@@ -4201,7 +4204,7 @@ mv ns2/$KSK.private.bak ns2/$KSK.private
# Roll the ZSK again.
zsk3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
keyfile_to_key_id "$zsk3" > ns2/$zone.zsk.id3
-ZSK_ID3=`cat ns2/$zone.zsk.id3`
+ZSK_ID3=$(cat ns2/$zone.zsk.id3)
# Schedule the new ZSK (ZSK3) to become active.
echo_i "delete old ZSK $ZSK_ID schedule ZSK $ZSK_ID2 inactive and new ZSK $ZSK_ID3 active for zone $zone ($n)"
diff --git a/external/mpl/bind/dist/bin/tests/system/dnstap/prereq.sh b/external/mpl/bind/dist/bin/tests/system/dnstap/prereq.sh
new file mode 100644
index 00000000000..f0748f3bf31
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/dnstap/prereq.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+$FEATURETEST --enable-dnstap || {
+ echo_i "This test requires dnstap support." >&2
+ exit 255
+}
+exit 0
diff --git a/external/mpl/bind/dist/bin/tests/system/dnstap/tests.sh b/external/mpl/bind/dist/bin/tests/system/dnstap/tests.sh
index c8d21b6ec49..a630c3b6ba6 100644
--- a/external/mpl/bind/dist/bin/tests/system/dnstap/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dnstap/tests.sh
@@ -798,14 +798,14 @@ test_dnstap_roll() (
echo_i "checking 'rndc -roll <value>' (no versions)"
ret=0
-start_server --noclean --restart --port "${PORT}" dnstap ns3
+start_server --noclean --restart --port "${PORT}" ns3
_repeat 5 test_dnstap_roll 10.53.0.3 ns3 3 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "checking 'rndc -roll <value>' (versions)"
ret=0
-start_server --noclean --restart --port "${PORT}" dnstap ns2
+start_server --noclean --restart --port "${PORT}" ns2
_repeat 5 test_dnstap_roll 10.53.0.2 ns2 3 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
diff --git a/external/mpl/bind/dist/bin/tests/system/dscp/clean.sh b/external/mpl/bind/dist/bin/tests/system/dscp/clean.sh
index f124690bc87..e52f7b6fcef 100644
--- a/external/mpl/bind/dist/bin/tests/system/dscp/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dscp/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/dscp/tests.sh b/external/mpl/bind/dist/bin/tests/system/dscp/tests.sh
index 055278c9310..d6b0824064b 100644
--- a/external/mpl/bind/dist/bin/tests/system/dscp/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dscp/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/dsdigest/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/dsdigest/ns1/sign.sh
index 2009e0a789b..567d92f6892 100644
--- a/external/mpl/bind/dist/bin/tests/system/dsdigest/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dsdigest/ns1/sign.sh
@@ -23,8 +23,8 @@ zonefile=root.db
cp ../ns2/dsset-good$TP .
cp ../ns2/dsset-bad$TP .
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 2048 -n zone -f KSK $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
cat $infile $key1.key $key2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/dsdigest/ns2/sign.sh b/external/mpl/bind/dist/bin/tests/system/dsdigest/ns2/sign.sh
index bb6138a7b97..d86c717953f 100644
--- a/external/mpl/bind/dist/bin/tests/system/dsdigest/ns2/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dsdigest/ns2/sign.sh
@@ -21,10 +21,10 @@ zone2=bad
infile2=bad.db.in
zonefile2=bad.db
-keyname11=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone1`
-keyname12=`$KEYGEN -q -a RSASHA256 -b 2048 -n zone -f KSK $zone1`
-keyname21=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone2`
-keyname22=`$KEYGEN -q -a RSASHA256 -b 2048 -n zone -f KSK $zone2`
+keyname11=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone1)
+keyname12=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone1)
+keyname21=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone2)
+keyname22=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone2)
cat $infile1 $keyname11.key $keyname12.key >$zonefile1
cat $infile2 $keyname21.key $keyname22.key >$zonefile2
diff --git a/external/mpl/bind/dist/bin/tests/system/dupsigs/clean.sh b/external/mpl/bind/dist/bin/tests/system/dupsigs/clean.sh
index 9db07994900..2af75a0b999 100644
--- a/external/mpl/bind/dist/bin/tests/system/dupsigs/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dupsigs/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -9,6 +11,7 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
+rm -f dig.out*
rm -f ns1/named.conf
rm -f ns1/named.lock
rm -f ns1/named.memstats
diff --git a/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/named.conf.in b/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/named.conf.in
index c5ade8bf8ec..494ecfb9e3d 100644
--- a/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/named.conf.in
@@ -29,5 +29,5 @@ zone "signing.test" {
key-directory "keys/signing.test";
inline-signing yes;
auto-dnssec maintain;
- sig-validity-interval 120 30;
+ sig-validity-interval 20 5;
};
diff --git a/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/reset_keys.sh b/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/reset_keys.sh
index 6f3defbd826..4faa0bb8776 100644
--- a/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/reset_keys.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/reset_keys.sh
@@ -53,14 +53,14 @@ $SETTIME -P $BASET -A $BASET $KEYDIR/$KSK
$SETTIME -P $BASET -A $BASET $KEYDIR/$ZSK0
# schedule the first roll
-R1=`expr $BASE + 300`
+R1=`expr $BASE + 50`
R1T=`timetodnssec $R1`
$SETTIME -I $R1T $KEYDIR/$ZSK0
$SETTIME -P $BASET -A $R1T $KEYDIR/$ZSK1
# schedule the second roll (which includes the delete of the first key)
-R2=`expr $R1 + 300`
+R2=`expr $R1 + 50`
R2T=`timetodnssec $R2`
DT=$R2
DTT=`timetodnssec $DT`
@@ -70,8 +70,7 @@ $SETTIME -I $R2T $KEYDIR/$ZSK1
$SETTIME -P $R1T -A $R2T $KEYDIR/$ZSK2
# schedule the third roll
-# this isn't long enough for the signing to complete
-R3=`expr $R2 + 60`
+R3=`expr $R2 + 25`
R3T=`timetodnssec $R3`
$SETTIME -D $R3T $KEYDIR/$ZSK1
@@ -90,8 +89,10 @@ echo ZSK4=$ZSK4
exit
# schedule the fourth roll
-# this isn't long enough for the signing to complete
-R4=`expr $R3 + 30`
+# this isn't long enough for the signing to complete and would result in
+# duplicate signatures, see
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/231#note_9597
+R4=`expr $R3 + 10`
R4T=`timetodnssec $R4`
$SETTIME -D $R4T $KEYDIR/$ZSK2
diff --git a/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/signing.test.db.in b/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/signing.test.db.in
index f4c6643533c..b522b6f0ef1 100644
--- a/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/signing.test.db.in
+++ b/external/mpl/bind/dist/bin/tests/system/dupsigs/ns1/signing.test.db.in
@@ -15,4 +15,4 @@ $TTL 3600
ns A 127.0.0.1
ns AAAA ::1
-$GENERATE 0-1999 a${0,4,d} AAAA ::$
+$GENERATE 0-499 a${0,4,d} AAAA ::$
diff --git a/external/mpl/bind/dist/bin/tests/system/dupsigs/setup.sh b/external/mpl/bind/dist/bin/tests/system/dupsigs/setup.sh
index 6511d27f247..f68754333d6 100644
--- a/external/mpl/bind/dist/bin/tests/system/dupsigs/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dupsigs/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/dupsigs/tests.sh b/external/mpl/bind/dist/bin/tests/system/dupsigs/tests.sh
index f7a63cad97e..c9599b22349 100644
--- a/external/mpl/bind/dist/bin/tests/system/dupsigs/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/dupsigs/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -13,23 +15,41 @@ SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
status=0
+
+# Wait for the zone to be fully signed before beginning test
+#
+# We expect the zone to have the following:
+#
+# - 5 signatures for signing.test.
+# - 3 signatures for ns.signing.test.
+# - 2 x 500 signatures for a{0000-0499}.signing.test.
+#
+# for a total of 1008.
+fully_signed () {
+ $DIG axfr signing.test -p ${PORT} @10.53.0.1 |
+ awk 'BEGIN { lines = 0 }
+ $4 == "RRSIG" {lines++}
+ END { if (lines != 1008) exit(1) }'
+}
+retry_quiet 30 fully_signed || ret=1
+
start=`date +%s`
-end=`expr $start + 1200`
now=$start
-while test $now -lt $end
-do
- et=`expr $now - $start`
+end=$((start + 140))
+
+while [ $now -lt $end ]; do
+ et=$((now - start))
echo "=============== $et ============"
$JOURNALPRINT ns1/signing.test.db.signed.jnl | $PERL check_journal.pl
- $DIG axfr signing.test -p 5300 @10.53.0.1 > dig.out.at$et
+ $DIG axfr signing.test -p ${PORT} @10.53.0.1 > dig.out.at$et
awk '$4 == "RRSIG" { print $11 }' dig.out.at$et | sort | uniq -c
lines=`awk '$4 == "RRSIG" { print}' dig.out.at$et | wc -l`
- if [ ${et} -ne 0 -a ${lines} -ne 4009 ]
+ if [ ${et} -ne 0 -a ${lines} -ne 1009 ]
then
echo_i "failed"
- status=`expr $status + 1`
+ status=$((status + 1))
fi
- sleep 20
+ sleep 5
now=`date +%s`
done
diff --git a/external/mpl/bind/dist/bin/tests/system/emptyzones/clean.sh b/external/mpl/bind/dist/bin/tests/system/emptyzones/clean.sh
index 597472d6260..c7ff161ac21 100644
--- a/external/mpl/bind/dist/bin/tests/system/emptyzones/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/emptyzones/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/emptyzones/setup.sh b/external/mpl/bind/dist/bin/tests/system/emptyzones/setup.sh
index 210d1e5da4c..df9d8f33093 100644
--- a/external/mpl/bind/dist/bin/tests/system/emptyzones/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/emptyzones/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/formerr/clean.sh b/external/mpl/bind/dist/bin/tests/system/formerr/clean.sh
index b573505fa3a..e52553075d3 100644
--- a/external/mpl/bind/dist/bin/tests/system/formerr/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/formerr/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/forward/clean.sh b/external/mpl/bind/dist/bin/tests/system/forward/clean.sh
index f0ba439d4f0..fad8ec5feca 100644
--- a/external/mpl/bind/dist/bin/tests/system/forward/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/forward/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/forward/tests.sh b/external/mpl/bind/dist/bin/tests/system/forward/tests.sh
index 6af636c929a..4b3a1ab18b9 100644
--- a/external/mpl/bind/dist/bin/tests/system/forward/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/forward/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -111,10 +113,10 @@ echo_i "checking for negative caching of forwarder response ($n)"
ret=0
dig_with_opts nonexist. txt @10.53.0.5 > dig.out.$n.f2 || ret=1
grep "status: NXDOMAIN" dig.out.$n.f2 > /dev/null || ret=1
-$PERL ../stop.pl forward ns4 || ret=1
+stop_server ns4 || ret=1
dig_with_opts nonexist. txt @10.53.0.5 > dig.out.$n.f2 || ret=1
grep "status: NXDOMAIN" dig.out.$n.f2 > /dev/null || ret=1
-$PERL ../start.pl --restart --noclean --port "${PORT}" forward ns4 || ret=1
+start_server --restart --noclean --port "${PORT}" ns4 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
diff --git a/external/mpl/bind/dist/bin/tests/system/get_algorithms.py b/external/mpl/bind/dist/bin/tests/system/get_algorithms.py
new file mode 100755
index 00000000000..f1b020bffca
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/get_algorithms.py
@@ -0,0 +1,241 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# This script is a 'port' broker. It keeps track of ports given to the
+# individual system subtests, so every test is given a unique port range.
+
+import logging
+import os
+from pathlib import Path
+import platform
+import random
+import subprocess
+import time
+from typing import Dict, List, NamedTuple, Union
+
+# Uncomment to enable DEBUG logging
+# logging.basicConfig(
+# format="get_algorithms.py %(levelname)s %(message)s", level=logging.DEBUG
+# )
+
+STABLE_PERIOD = 3600 * 3
+"""number of secs during which algorithm selection remains stable"""
+
+
+class Algorithm(NamedTuple):
+ name: str
+ number: int
+ bits: int
+
+
+class AlgorithmSet(NamedTuple):
+ """Collection of DEFAULT, ALTERNATIVE and DISABLED algorithms"""
+
+ default: Union[Algorithm, List[Algorithm]]
+ """DEFAULT is the algorithm for testing."""
+
+ alternative: Union[Algorithm, List[Algorithm]]
+ """ALTERNATIVE is an alternative algorithm for test cases that require more
+ than one algorithm (for example algorithm rollover)."""
+
+ disabled: Union[Algorithm, List[Algorithm]]
+ """DISABLED is an algorithm that is used for tests against the
+ "disable-algorithms" configuration option."""
+
+
+RSASHA1 = Algorithm("RSASHA1", 5, 1280)
+RSASHA256 = Algorithm("RSASHA256", 8, 1280)
+RSASHA512 = Algorithm("RSASHA512", 10, 1280)
+ECDSAP256SHA256 = Algorithm("ECDSAP256SHA256", 13, 256)
+ECDSAP384SHA384 = Algorithm("ECDSAP384SHA384", 14, 384)
+ED25519 = Algorithm("ED25519", 15, 256)
+ED448 = Algorithm("ED448", 16, 456)
+
+ALL_ALGORITHMS = [
+ RSASHA1,
+ RSASHA256,
+ RSASHA512,
+ ECDSAP256SHA256,
+ ECDSAP384SHA384,
+ ED25519,
+ ED448,
+]
+
+ALGORITHM_SETS = {
+ "stable": AlgorithmSet(
+ default=ECDSAP256SHA256, alternative=RSASHA256, disabled=ECDSAP384SHA384
+ ),
+ "ecc_default": AlgorithmSet(
+ default=[
+ ECDSAP256SHA256,
+ ECDSAP384SHA384,
+ ED25519,
+ ED448,
+ ],
+ alternative=RSASHA256,
+ disabled=RSASHA512,
+ ),
+ # FUTURE The system tests needs more work before they're ready for this.
+ # "random": AlgorithmSet(
+ # default=ALL_ALGORITHMS,
+ # alternative=ALL_ALGORITHMS,
+ # disabled=ALL_ALGORITHMS,
+ # ),
+}
+
+TESTCRYPTO = Path(__file__).resolve().parent / "testcrypto.sh"
+
+KEYGEN = os.getenv("KEYGEN", "")
+if not KEYGEN:
+ raise RuntimeError("KEYGEN environment variable has to be set")
+
+ALGORITHM_SET = os.getenv("ALGORITHM_SET", "stable")
+assert ALGORITHM_SET in ALGORITHM_SETS, f'ALGORITHM_SET "{ALGORITHM_SET}" unknown'
+logging.debug('choosing from ALGORITHM_SET "%s"', ALGORITHM_SET)
+
+
+def is_supported(alg: Algorithm) -> bool:
+ """Test whether a given algorithm is supported on the current platform."""
+ try:
+ subprocess.run(
+ f"{TESTCRYPTO} -q {alg.name}",
+ shell=True,
+ check=True,
+ env={"KEYGEN": KEYGEN},
+ stdout=subprocess.DEVNULL,
+ )
+ except subprocess.CalledProcessError as exc:
+ logging.debug(exc)
+ logging.info("algorithm %s not supported", alg.name)
+ return False
+ return True
+
+
+def filter_supported(algs: AlgorithmSet) -> AlgorithmSet:
+ """Select supported algorithms from the set."""
+ filtered = {}
+ for alg_type in algs._fields:
+ candidates = getattr(algs, alg_type)
+ if isinstance(candidates, Algorithm):
+ candidates = [candidates]
+ supported = list(filter(is_supported, candidates))
+ if len(supported) == 1:
+ supported = supported.pop()
+ elif not supported:
+ raise RuntimeError(
+ f'no {alg_type.upper()} algorithm from "{ALGORITHM_SET}" set '
+ "supported on this platform"
+ )
+ filtered[alg_type] = supported
+ return AlgorithmSet(**filtered)
+
+
+def select_random(algs: AlgorithmSet, stable_period=STABLE_PERIOD) -> AlgorithmSet:
+ """Select random DEFAULT, ALTERNATIVE and DISABLED algorithms from the set.
+
+ The algorithm selection is deterministic for a given time period and
+ platform. This should make potential issues more reproducible.
+
+ To increase the likelyhood of detecting an issue with a given algorithm in
+ CI, the current platform is used as a randomness source. When testing on
+ multiple platforms at the same time, this ensures more algorithm variance
+ while keeping reproducibility for a single platform.
+
+ The function also ensures that DEFAULT, ALTERNATIVE and DISABLED algorithms
+ are all different.
+ """
+ # FUTURE Random selection of ALTERNATIVE and DISABLED algorithms needs to
+ # be implemented.
+ alternative = algs.alternative
+ disabled = algs.disabled
+ assert isinstance(
+ alternative, Algorithm
+ ), "ALTERNATIVE algorithm randomization not supported yet"
+ assert isinstance(
+ disabled, Algorithm
+ ), "DISABLED algorithm randomization not supported yet"
+
+ # initialize randomness
+ now = time.time()
+ time_seed = int(now - now % stable_period)
+ seed = f"{platform.platform()}_{time_seed}"
+ random.seed(seed)
+
+ # DEFAULT selection
+ if isinstance(algs.default, Algorithm):
+ default = algs.default
+ else:
+ candidates = algs.default
+ for taken in [alternative, disabled]:
+ try:
+ candidates.remove(taken)
+ except ValueError:
+ pass
+ assert len(candidates), "no possible choice for DEFAULT algorithm"
+ random.shuffle(candidates)
+ default = candidates[0]
+
+ # Ensure only single algorithm is present for each option
+ assert isinstance(default, Algorithm)
+ assert isinstance(alternative, Algorithm)
+ assert isinstance(disabled, Algorithm)
+
+ assert default != alternative, "DEFAULT and ALTERNATIVE algorithms are the same"
+ assert default != disabled, "DEFAULT and DISABLED algorithms are the same"
+ assert alternative != disabled, "ALTERNATIVE and DISABLED algorithms are the same"
+
+ return AlgorithmSet(default, alternative, disabled)
+
+
+def algorithms_env(algs: AlgorithmSet) -> Dict[str, str]:
+ """Return environment variables with selected algorithms as a dict."""
+ algs_env: Dict[str, str] = {}
+
+ def set_alg_env(alg: Algorithm, prefix):
+ algs_env[f"{prefix}_ALGORITHM"] = alg.name
+ algs_env[f"{prefix}_ALGORITHM_NUMBER"] = str(alg.number)
+ algs_env[f"{prefix}_BITS"] = str(alg.bits)
+
+ assert isinstance(algs.default, Algorithm)
+ assert isinstance(algs.alternative, Algorithm)
+ assert isinstance(algs.disabled, Algorithm)
+
+ set_alg_env(algs.default, "DEFAULT")
+ set_alg_env(algs.alternative, "ALTERNATIVE")
+ set_alg_env(algs.disabled, "DISABLED")
+
+ logging.info("selected algorithms: %s", algs_env)
+ return algs_env
+
+
+def main():
+ disable_checking = int(os.getenv("DISABLE_ALGORITHM_SUPPORT_CHECKING", "0"))
+ try:
+ algs = ALGORITHM_SETS[ALGORITHM_SET]
+ if not disable_checking:
+ algs = filter_supported(algs)
+ algs = select_random(algs)
+ algs_env = algorithms_env(algs)
+ except Exception:
+ # if anything goes wrong, the conf.sh ignores error codes, so make sure
+ # we set an environment variable to an error value that can be checked
+ # later by run.sh
+ print("export ALGORITHM_SET=error")
+ raise
+ else:
+ for name, value in algs_env.items():
+ print(f"export {name}={value}")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/external/mpl/bind/dist/bin/tests/system/idna/tests.sh b/external/mpl/bind/dist/bin/tests/system/idna/tests.sh
index d22d4b2b994..e38736e7429 100644
--- a/external/mpl/bind/dist/bin/tests/system/idna/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/idna/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/clean.sh b/external/mpl/bind/dist/bin/tests/system/inline/clean.sh
index 149a1d83319..79f3774439b 100644
--- a/external/mpl/bind/dist/bin/tests/system/inline/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/inline/ns1/sign.sh
index 9a851b64264..5e024c2a226 100644
--- a/external/mpl/bind/dist/bin/tests/system/inline/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/ns1/sign.sh
@@ -17,8 +17,8 @@ SYSTEMTESTTOP=../..
zone=.
rm -f K.+*+*.key
rm -f K.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$SIGNER -S -x -T 1200 -o ${zone} root.db > signer.out
[ $? = 0 ] || cat signer.out
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/ns3/sign.sh b/external/mpl/bind/dist/bin/tests/system/inline/ns3/sign.sh
index f5923e96e36..7e33046d5ab 100755
--- a/external/mpl/bind/dist/bin/tests/system/inline/ns3/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/ns3/sign.sh
@@ -22,36 +22,36 @@ mv ${unsupportedkey}.tmp ${unsupportedkey}.key
zone=bits
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=noixfr
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=master
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=dynamic
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=updated
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
$SIGNER -S -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null
cp master2.db.in updated.db
@@ -60,92 +60,92 @@ cp master2.db.in updated.db
zone=expired
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
$SIGNER -PS -s 20100101000000 -e 20110101000000 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null
zone=retransfer
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=nsec3
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=retransfer3
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=inactiveksk
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 -f KSK $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -P now -A now+3600 -f KSK $zone)
+keyname=$($KEYGEN -q -a ${ALTERNATIVE_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${ALTERNATIVE_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=inactivezsk
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -P now -A now+3600 $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname=$($KEYGEN -q -a ${ALTERNATIVE_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${ALTERNATIVE_ALGORITHM} -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=delayedkeys
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
# Keys for the "delayedkeys" zone should not be initially accessible.
mv K${zone}.+*+*.* ../
zone=removedkeys-primary
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
zone=removedkeys-secondary
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
for s in a c d h k l m q z
do
zone=test-$s
- keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+ keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
done
for s in b f i o p t v
do
zone=test-$s
- keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
- keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+ keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+ keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
done
zone=externalkey
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-for alg in ECDSAP256SHA256 NSEC3RSASHA1
+for alg in ${DEFAULT_ALGORITHM} ${ALTERNATIVE_ALGORITHM}
do
- k1=`$KEYGEN -q -a $alg -b 1024 -n zone -f KSK $zone`
- k2=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
- k3=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
- k4=`$KEYGEN -q -a $alg -b 1024 -n zone -f KSK $zone`
+ k1=$($KEYGEN -q -a $alg -n zone -f KSK $zone)
+ k2=$($KEYGEN -q -a $alg -n zone $zone)
+ k3=$($KEYGEN -q -a $alg -n zone $zone)
+ k4=$($KEYGEN -q -a $alg -n zone -f KSK $zone)
$DSFROMKEY -T 1200 $k4 >> ../ns1/root.db
# Convert k1 and k2 in to External Keys.
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/ns7/sign.sh b/external/mpl/bind/dist/bin/tests/system/inline/ns7/sign.sh
index 9168f5283df..462d6adac4f 100755
--- a/external/mpl/bind/dist/bin/tests/system/inline/ns7/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/ns7/sign.sh
@@ -20,6 +20,6 @@ SYSTEMTESTTOP=../..
zone=nsec3-loop
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/ns8/sign.sh b/external/mpl/bind/dist/bin/tests/system/inline/ns8/sign.sh
index 3cad3f970fe..cedad7c3002 100755
--- a/external/mpl/bind/dist/bin/tests/system/inline/ns8/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/ns8/sign.sh
@@ -21,8 +21,8 @@ for zone in example01.com example02.com example03.com example04.com \
do
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
- keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
- keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+ keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+ keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone)
cp example.com.db.in ${zone}.db
$SIGNER -S -T 3600 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
done
@@ -30,7 +30,7 @@ done
for zone in example unsigned-serial-test; do
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
- keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
- keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+ keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+ keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone)
cp example.db.in ${zone}.db
done
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/setup.sh b/external/mpl/bind/dist/bin/tests/system/inline/setup.sh
index 0772b03baa8..b31606c9b66 100644
--- a/external/mpl/bind/dist/bin/tests/system/inline/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/inline/tests.sh b/external/mpl/bind/dist/bin/tests/system/inline/tests.sh
index 6fa7acf7b65..2242d793b39 100755
--- a/external/mpl/bind/dist/bin/tests/system/inline/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/inline/tests.sh
@@ -38,55 +38,55 @@ $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - nsec3 > /dev/null 2>&1
for i in 1 2 3 4 5 6 7 8 9 0
do
- nsec3param=`$DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param nsec3.`
+ nsec3param=$($DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param nsec3.)
test "$nsec3param" = "1 0 0 -" && break
sleep 1
done
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that an unsupported algorithm is not used for signing ($n)"
ret=0
grep -q "algorithm is unsupported" ns3/named.run || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that rrsigs are replaced with ksk only ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 axfr nsec3. |
awk '/RRSIG NSEC3/ {a[$1]++} END { for (i in a) {if (a[i] != 1) exit (1)}}' || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the zone is signed on initial transfer ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
do
ret=0
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
- keys=`grep '^Done signing' signing.out.test$n | wc -l`
+ keys=$(grep '^Done signing' signing.out.test$n | wc -l)
[ $keys = 2 ] || ret=1
if [ $ret = 0 ]; then break; fi
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking expired signatures are updated on load ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 +noall +answer +dnssec expired SOA > dig.out.ns3.test$n
-expiry=`awk '$4 == "RRSIG" { print $9 }' dig.out.ns3.test$n`
+expiry=$(awk '$4 == "RRSIG" { print $9 }' dig.out.ns3.test$n)
[ "$expiry" = "20110101000000" ] && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking removal of private type record via 'rndc signing -clear' ($n)"
ret=0
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
-keys=`sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n`
+keys=$(sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n)
for key in $keys; do
$RNDCCMD 10.53.0.3 signing -clear ${key} bits > /dev/null || ret=1
break; # We only want to remove 1 record for now.
@@ -96,16 +96,16 @@ for i in 1 2 3 4 5 6 7 8 9 10
do
ans=0
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
- num=`grep "Done signing with" signing.out.test$n | wc -l`
+ num=$(grep "Done signing with" signing.out.test$n | wc -l)
[ $num = 1 ] && break
sleep 1
done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking private type was properly signed ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n
@@ -113,9 +113,9 @@ grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ret=1
grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking removal of remaining private type record via 'rndc signing -clear all' ($n)"
ret=0
$RNDCCMD 10.53.0.3 signing -clear all bits > /dev/null || ret=1
@@ -131,9 +131,9 @@ done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking negative private type response was properly signed ($n)"
ret=0
sleep 1
@@ -143,7 +143,7 @@ grep "ANSWER: 0," dig.out.ns6.test$n > /dev/null || ret=1
grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone bits
@@ -152,16 +152,16 @@ update add added.bits 0 A 1.2.3.4
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the record is added on the hidden primary ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 added.bits A > dig.out.ns2.test$n
grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that update has been transferred and has been signed ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9 10
@@ -174,7 +174,7 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone bits
@@ -183,7 +183,7 @@ update add bits 0 SOA ns2.bits. . 2011072400 20 20 1814400 3600
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n
@@ -191,9 +191,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
grep "2011072400" dig.out.ns2.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone ($n)"
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -206,22 +206,22 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the zone is signed on initial transfer, noixfr ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
do
ret=0
$RNDCCMD 10.53.0.3 signing -list noixfr > signing.out.test$n 2>&1
- keys=`grep '^Done signing' signing.out.test$n | wc -l`
+ keys=$(grep '^Done signing' signing.out.test$n | wc -l)
[ $keys = 2 ] || ret=1
if [ $ret = 0 ]; then break; fi
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone noixfr
@@ -230,16 +230,16 @@ update add added.noixfr 0 A 1.2.3.4
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the record is added on the hidden primary, noixfr ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.4 added.noixfr A > dig.out.ns4.test$n
grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that update has been transferred and has been signed, noixfr ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
@@ -252,7 +252,7 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone noixfr
@@ -261,7 +261,7 @@ update add noixfr 0 SOA ns4.noixfr. . 2011072400 20 20 1814400 3600
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary, noixfr ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n
@@ -269,9 +269,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
grep "2011072400" dig.out.ns4.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone, noixfr ($n)"
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -284,28 +284,28 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the primary zone signed on initial load ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9 10
do
ret=0
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
- keys=`grep '^Done signing' signing.out.test$n | wc -l`
+ keys=$(grep '^Done signing' signing.out.test$n | wc -l)
[ $keys = 2 ] || ret=1
if [ $ret = 0 ]; then break; fi
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking removal of private type record via 'rndc signing -clear' (primary) ($n)"
ret=0
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
-keys=`sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n`
+keys=$(sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n)
for key in $keys; do
$RNDCCMD 10.53.0.3 signing -clear ${key} master > /dev/null || ret=1
break; # We only want to remove 1 record for now.
@@ -315,16 +315,16 @@ for i in 1 2 3 4 5 6 7 8 9
do
ans=0
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
- num=`grep "Done signing with" signing.out.test$n | wc -l`
+ num=$(grep "Done signing with" signing.out.test$n | wc -l)
[ $num = 1 ] && break
sleep 1
done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking private type was properly signed (primary) ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.6 master TYPE65534 > dig.out.ns6.test$n
@@ -332,9 +332,9 @@ grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ret=1
grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking removal of remaining private type record via 'rndc signing -clear' (primary) ($n)"
ret=0
$RNDCCMD 10.53.0.3 signing -clear all master > /dev/null || ret=1
@@ -349,9 +349,9 @@ done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check adding of record to unsigned primary ($n)"
ret=0
cp ns3/master2.db.in ns3/master.db
@@ -367,9 +367,9 @@ do
done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check adding record fails when SOA serial not changed ($n)"
ret=0
echo "c A 10.0.0.3" >> ns3/master.db
@@ -378,9 +378,9 @@ sleep 1
$DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n
grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check adding record works after updating SOA serial ($n)"
ret=0
cp ns3/master3.db.in ns3/master.db
@@ -396,9 +396,9 @@ do
done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check the added record was properly signed ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns6.test$n
@@ -406,28 +406,28 @@ grep "10.0.0.5" dig.out.ns6.test$n > /dev/null || ans=1
grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ans=1
grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ans=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the dynamic primary zone signed on initial load ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9 10
do
ret=0
$RNDCCMD 10.53.0.3 signing -list dynamic > signing.out.test$n 2>&1
- keys=`grep '^Done signing' signing.out.test$n | wc -l`
+ keys=$(grep '^Done signing' signing.out.test$n | wc -l)
[ $keys = 2 ] || ret=1
if [ $ret = 0 ]; then break; fi
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking primary zone that was updated while offline is correct ($n)"
ret=0
$DIG $DIGOPTS +nodnssec +short @10.53.0.3 updated SOA >dig.out.ns2.soa.test$n
-serial=`awk '{print $3}' dig.out.ns2.soa.test$n`
+serial=$(awk '{print $3}' dig.out.ns2.soa.test$n)
# serial should have changed
[ "$serial" = "2000042407" ] && ret=1
# e.updated should exist and should be signed
@@ -439,14 +439,14 @@ grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
# records (SOA/RRSIG, 2 x NSEC/RRSIG, A/RRSIG), and 4 removed records
# (SOA/RRSIG, NSEC/RRSIG).
$JOURNALPRINT ns3/updated.db.signed.jnl >journalprint.out.test$n
-serial=`awk '/Source serial =/ {print $4}' journalprint.out.test$n`
+serial=$(awk '/Source serial =/ {print $4}' journalprint.out.test$n)
[ "$serial" = "2000042408" ] || ret=1
-diffsize=`wc -l < journalprint.out.test$n`
+diffsize=$(wc -l < journalprint.out.test$n)
[ "$diffsize" -le 13 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking adding of record to unsigned primary using UPDATE ($n)"
ret=0
@@ -474,21 +474,21 @@ done
[ $ans = 0 ] || { ret=1; echo_i "signed record not found"; cat dig.out.ns3.test$n ; }
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "stop bump in the wire signer server ($n)"
ret=0
-$PERL ../stop.pl inline ns3 || ret=1
+stop_server ns3 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "restart bump in the wire signer server ($n)"
ret=0
-$PERL ../start.pl --noclean --restart --port ${PORT} inline ns3 || ret=1
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone bits
@@ -497,7 +497,7 @@ update add bits 0 SOA ns2.bits. . 2011072450 20 20 1814400 3600
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n
@@ -505,9 +505,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
grep "2011072450" dig.out.ns2.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone ($n)"
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -520,7 +520,7 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone noixfr
@@ -529,7 +529,7 @@ update add noixfr 0 SOA ns4.noixfr. . 2011072450 20 20 1814400 3600
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary, noixfr ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n
@@ -537,9 +537,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
grep "2011072450" dig.out.ns4.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone, noixfr ($n)"
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -552,7 +552,7 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone bits
@@ -561,7 +561,7 @@ update add bits 0 SOA ns2.bits. . 2011072460 20 20 1814400 3600
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking forwarded update on hidden primary ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n
@@ -569,9 +569,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
grep "2011072460" dig.out.ns2.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking forwarded update on signed zone ($n)"
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -584,7 +584,7 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone noixfr
@@ -593,7 +593,7 @@ update add noixfr 0 SOA ns4.noixfr. . 2011072460 20 20 1814400 3600
send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking forwarded update on hidden primary, noixfr ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n
@@ -601,9 +601,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
grep "2011072460" dig.out.ns4.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking forwarded update on signed zone, noixfr ($n)"
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -616,19 +616,19 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
ret=0
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking turning on of inline signing in a secondary zone via reload ($n)"
$DIG $DIGOPTS @10.53.0.5 +dnssec bits SOA > dig.out.ns5.test$n
grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "setup broken"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
copy_setports ns5/named.conf.post ns5/named.conf
-(cd ns5; $KEYGEN -q -a rsasha256 bits) > /dev/null 2>&1
-(cd ns5; $KEYGEN -q -a rsasha256 -f KSK bits) > /dev/null 2>&1
+(cd ns5; $KEYGEN -q -a ${DEFAULT_ALGORITHM} bits) > /dev/null 2>&1
+(cd ns5; $KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK bits) > /dev/null 2>&1
rndc_reload ns5 10.53.0.5
for i in 1 2 3 4 5 6 7 8 9 10
do
@@ -640,9 +640,9 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking rndc freeze/thaw of dynamic inline zone no change ($n)"
ret=0
$RNDCCMD 10.53.0.3 freeze dynamic > freeze.test$n 2>&1 || { echo_i "/' < freeze.test$n"; ret=1; }
@@ -651,10 +651,10 @@ $RNDCCMD 10.53.0.3 thaw dynamic > thaw.test$n 2>&1 || { echo_i "rndc thaw dynami
sleep 1
grep "zone dynamic/IN (unsigned): ixfr-from-differences: unchanged" ns3/named.run > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking rndc freeze/thaw of dynamic inline zone ($n)"
ret=0
$RNDCCMD 10.53.0.3 freeze dynamic > freeze.test$n 2>&1 || ret=1
@@ -665,9 +665,9 @@ awk '$2 == ";" && $3 ~ /serial/ { printf("%d %s %s\n", $1 + 1, $2, $3); next; }
mv ns3/dynamic.db.new ns3/dynamic.db
$RNDCCMD 10.53.0.3 thaw dynamic > thaw.test$n 2>&1 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check added record freeze1.dynamic ($n)"
for i in 1 2 3 4 5 6 7 8 9
do
@@ -679,12 +679,12 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# allow 1 second so that file time stamps change
sleep 1
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking rndc freeze/thaw of server ($n)"
ret=0
$RNDCCMD 10.53.0.3 freeze > freeze.test$n 2>&1 || ret=1
@@ -695,9 +695,9 @@ awk '$2 == ";" && $3 ~ /serial/ { printf("%d %s %s\n", $1 + 1, $2, $3); next; }
mv ns3/dynamic.db.new ns3/dynamic.db
$RNDCCMD 10.53.0.3 thaw > thaw.test$n 2>&1 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check added record freeze2.dynamic ($n)"
for i in 1 2 3 4 5 6 7 8 9
do
@@ -709,17 +709,17 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check rndc reload allows reuse of inline-signing zones ($n)"
ret=0
{ $RNDCCMD 10.53.0.3 reload 2>&1 || ret=1 ; } | sed 's/^/ns3 /' | cat_i
grep "not reusable" ns3/named.run > /dev/null 2>&1 && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check rndc sync removes both signed and unsigned journals ($n)"
ret=0
[ -f ns3/dynamic.db.jnl ] || ret=1
@@ -728,7 +728,7 @@ $RNDCCMD 10.53.0.3 sync -clean dynamic 2>&1 || ret=1
[ -f ns3/dynamic.db.jnl ] && ret=1
[ -f ns3/dynamic.db.signed.jnl ] && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
$NSUPDATE << EOF
zone retransfer
@@ -738,16 +738,16 @@ send
EOF
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the retransfer record is added on the hidden primary ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 added.retransfer A > dig.out.ns2.test$n
grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that the change has not been transferred due to notify ($n)"
ret=0
for i in 0 1 2 3 4 5 6 7 8 9
@@ -759,9 +759,9 @@ do
sleep 1
done
if [ $ans != 1 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check rndc retransfer of a inline secondary zone works ($n)"
ret=0
$RNDCCMD 10.53.0.3 retransfer retransfer 2>&1 || ret=1
@@ -776,9 +776,9 @@ do
done
[ $ans = 1 ] && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check 'rndc signing -nsec3param' requests are queued for zones which are not loaded ($n)"
ret=0
# The "retransfer3" zone is configured with "allow-transfer { none; };" on ns2,
@@ -808,9 +808,9 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check rndc retransfer of a inline nsec3 secondary retains nsec3 ($n)"
ret=0
$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
@@ -835,11 +835,11 @@ do
done
[ $ans = 1 ] && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# NOTE: The test below should be considered fragile. More details can be found
# in the comment inside ns7/named.conf.
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check rndc retransfer of a inline nsec3 secondary does not trigger an infinite loop ($n)"
ret=0
zone=nsec3-loop
@@ -851,7 +851,7 @@ for i in 1 2 3 4 5 6 7 8 9 0
do
ret=1
$RNDCCMD 10.53.0.7 signing -list $zone > signing.out.test$n 2>&1
- keys=`grep '^Done signing' signing.out.test$n | wc -l`
+ keys=$(grep '^Done signing' signing.out.test$n | wc -l)
[ $keys -eq 3 ] && ret=0 && break
sleep 1
done
@@ -861,7 +861,7 @@ $RNDCCMD 10.53.0.7 signing -nsec3param 1 0 2 12345678 $zone > /dev/null 2>&1
for i in 1 2 3 4 5 6 7 8 9 0
do
ret=1
- nsec3param=`$DIG $DIGOPTS +nodnssec +short @10.53.0.7 nsec3param $zone`
+ nsec3param=$($DIG $DIGOPTS +nodnssec +short @10.53.0.7 nsec3param $zone)
test "$nsec3param" = "1 0 2 12345678" && ret=0 && break
sleep 1
done
@@ -882,27 +882,27 @@ do
sleep 1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "stop bump in the wire signer server ($n)"
ret=0
-$PERL ../stop.pl inline ns3 || ret=1
+stop_server ns3 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "update SOA record while stopped"
cp ns3/master4.db.in ns3/master.db
rm ns3/master.db.jnl
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "restart bump in the wire signer server ($n)"
ret=0
-$PERL ../start.pl --noclean --restart --port ${PORT} inline ns3 || ret=1
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "updates to SOA parameters other than serial while stopped are reflected in signed zone ($n)"
ret=0
for i in 1 2 3 4 5 6 7 8 9
@@ -916,9 +916,9 @@ do
done
[ $ans = 0 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check that reloading all zones does not cause zone maintenance to cease for inline-signed zones ($n)"
ret=1
# Ensure "rndc reload" attempts to load ns3/master.db by waiting 1 second so
@@ -941,9 +941,9 @@ done
$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n || ret=1
grep "hostmaster" dig.out.ns3.test$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check that reloading errors prevent synchronization ($n)"
ret=1
$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1
@@ -964,14 +964,14 @@ done
$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1
$DIFF dig.out.ns3.test$n.1 dig.out.ns3.test$n.2 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check inline-signing with an include file ($n)"
ret=0
$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
sleep 1
nextpart ns3/named.run > /dev/null
cp ns3/master7.db.in ns3/master.db
@@ -988,9 +988,9 @@ retry_quiet 10 _includefile_loaded
$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1
$DIFF dig.out.ns3.test$n.1 dig.out.ns3.test$n.2 > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "test add/del zone combinations ($n)"
ret=0
for zone in a b c d e f g h i j k l m n o p q r s t u v w x y z
@@ -1004,34 +1004,35 @@ $RNDCCMD 10.53.0.3 addzone test-$zone \
$RNDCCMD 10.53.0.3 delzone test-$zone > /dev/null 2>&1
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing adding external keys to a inline zone ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 dnskey externalkey > dig.out.ns3.test$n
-for alg in 7 13
+for alg in ${DEFAULT_ALGORITHM_NUMBER} ${ALTERNATIVE_ALGORITHM_NUMBER}
do
[ $alg = 13 -a ! -f checkecdsa ] && continue;
case $alg in
7) echo_i "checking NSEC3RSASHA1";;
+ 8) echo_i "checking RSASHA256";;
13) echo_i "checking ECDSAP256SHA256";;
*) echo_i "checking $alg";;
esac
- dnskeys=`grep "IN.DNSKEY.25[67] [0-9]* $alg " dig.out.ns3.test$n | wc -l`
- rrsigs=`grep "RRSIG.DNSKEY $alg " dig.out.ns3.test$n | wc -l`
+ dnskeys=$(grep "IN.DNSKEY.25[67] [0-9]* $alg " dig.out.ns3.test$n | wc -l)
+ rrsigs=$(grep "RRSIG.DNSKEY $alg " dig.out.ns3.test$n | wc -l)
test ${dnskeys:-0} -eq 3 || { echo_i "failed $alg (dnskeys ${dnskeys:-0})"; ret=1; }
test ${rrsigs:-0} -eq 2 || { echo_i "failed $alg (rrsigs ${rrsigs:-0})"; ret=1; }
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing imported key won't overwrite a private key ($n)"
ret=0
-key=`$KEYGEN -q -a rsasha256 import.example`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} import.example)
cp ${key}.key import.key
# import should fail
$IMPORTKEY -f import.key import.example > /dev/null 2>&1 && ret=1
@@ -1041,90 +1042,90 @@ $IMPORTKEY -f import.key import.example > /dev/null 2>&1 || ret=1
# now that it's an external key, re-import should succeed
$IMPORTKEY -f import.key import.example > /dev/null 2>&1 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing updating inline secure serial via 'rndc signing -serial' ($n)"
ret=0
$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n)
$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post.test$n || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing updating inline secure serial via 'rndc signing -serial' with negative change ($n)"
ret=0
$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n)
$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
sleep 1
$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
+serial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n)
[ ${oldserial:-0} -eq ${serial:-1} ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
#
# Freezing only operates on the raw zone.
#
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing updating inline secure serial via 'rndc signing -serial' when frozen ($n)"
ret=0
$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n)
$RNDCCMD 10.53.0.3 freeze nsec3 > /dev/null 2>&1
$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
$RNDCCMD 10.53.0.3 thaw nsec3 > /dev/null 2>&1
retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post1.test$n || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing updating dynamic serial via 'rndc signing -serial' ($n)"
ret=0
$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n)
$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-0}" dig.out.ns2.post.test$n || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing updating dynamic serial via 'rndc signing -serial' with negative change ($n)"
ret=0
$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n)
$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing updating dynamic serial via 'rndc signing -serial' when frozen ($n)"
ret=0
$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n)
$RNDCCMD 10.53.0.2 freeze bits > /dev/null 2>&1
$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
$RNDCCMD 10.53.0.2 thaw bits > /dev/null 2>&1
retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing that inline signing works with inactive ZSK and active KSK ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 soa inactivezsk > dig.out.ns3.pre.test$n || ret=1
-soa1=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n`
+soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n)
$NSUPDATE << EOF
server 10.53.0.2 ${PORT}
@@ -1135,7 +1136,7 @@ EOF
for i in 1 2 3 4 5 6 7 8 9 10
do
$DIG $DIGOPTS @10.53.0.3 soa inactivezsk > dig.out.ns3.post.test$n || ret=1
- soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
+ soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n)
test ${soa1:-0} -ne ${soa2:-0} && break
sleep 1
done
@@ -1144,44 +1145,44 @@ test ${soa1:-0} -ne ${soa2:-0} || ret=1
$DIG $DIGOPTS @10.53.0.3 txt added.inactivezsk > dig.out.ns3.test$n || ret=1
grep "ANSWER: 3," dig.out.ns3.test$n > /dev/null || ret=1
grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
-grep "TXT 7 2" dig.out.ns3.test$n > /dev/null || ret=1
-grep "TXT 8 2" dig.out.ns3.test$n > /dev/null || ret=1
+grep "TXT ${DEFAULT_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n > /dev/null || ret=1
+grep "TXT ${ALTERNATIVE_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "testing that inline signing works with inactive KSK and active ZSK ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 axfr inactiveksk > dig.out.ns3.test$n
#
-# check that DNSKEY is signed with ZSK for algorithm 7
+# check that DNSKEY is signed with ZSK for default algorithm
#
-awk='$4 == "DNSKEY" && $5 == 256 && $7 == 7 { print }'
-zskid=`awk "${awk}" dig.out.ns3.test$n |
- $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 7 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null || ret=1
-awk='$4 == "DNSKEY" && $5 == 257 && $7 == 7 { print }'
-kskid=`awk "${awk}" dig.out.ns3.test$n |
- $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 7 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
+awk='$4 == "DNSKEY" && $5 == 256 && $7 == alg { print }'
+zskid=$(awk -v alg=${DEFAULT_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n |
+ $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' )
+grep "DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null || ret=1
+awk='$4 == "DNSKEY" && $5 == 257 && $7 == alg { print }'
+kskid=$(awk -v alg=${DEFAULT_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n |
+ $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' )
+grep "DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
#
-# check that DNSKEY is signed with KSK for algorithm 8
+# check that DNSKEY is signed with KSK for alternative algorithm
#
-awk='$4 == "DNSKEY" && $5 == 256 && $7 == 8 { print }'
-zskid=`awk "${awk}" dig.out.ns3.test$n |
- $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 8 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null && ret=1
-awk='$4 == "DNSKEY" && $5 == 257 && $7 == 8 { print }'
-kskid=`awk "${awk}" dig.out.ns3.test$n |
- $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 8 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
+awk='$4 == "DNSKEY" && $5 == 256 && $7 == alg { print }'
+zskid=$(awk -v alg=${ALTERNATIVE_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n |
+ $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' )
+grep "DNSKEY ${ALTERNATIVE_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null && ret=1
+awk='$4 == "DNSKEY" && $5 == 257 && $7 == alg { print }'
+kskid=$(awk -v alg=${ALTERNATIVE_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n |
+ $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' )
+grep "DNSKEY ${ALTERNATIVE_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Wait until an update to the raw part of a given inline signed zone is fully
# processed. As waiting for a fixed amount of time is suboptimal and there is
@@ -1194,14 +1195,14 @@ wait_until_raw_zone_update_is_processed() {
zone="$1"
for i in 1 2 3 4 5 6 7 8 9 10
do
- if nextpart ns3/named.run | egrep "zone ${zone}.*(sending notifies|receive_secure_serial)" > /dev/null; then
+ if nextpart ns3/named.run | grep -E "zone ${zone}.*(sending notifies|receive_secure_serial)" > /dev/null; then
return
fi
sleep 1
done
}
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that changes to raw zone are applied to a previously unsigned secure zone ($n)"
ret=0
# Query for bar.nokeys/A and ensure the response is negative. As this zone
@@ -1226,9 +1227,9 @@ $DIG $DIGOPTS @10.53.0.3 bar.nokeys. A > dig.out.ns3.post.test$n 2>&1
grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null || ret=1
grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that changes to raw zone are not applied to a previously signed secure zone with no keys available (primary) ($n)"
ret=0
# Query for bar.removedkeys-primary/A and ensure the response is negative. As
@@ -1255,16 +1256,16 @@ $DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.post.test$n 2>
grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null && ret=1
grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that backlogged changes to raw zone are applied after keys become available (primary) ($n)"
ret=0
# Restore the signing keys for this zone.
mv ns3/removedkeys/Kremovedkeys-primary* ns3
$RNDCCMD 10.53.0.3 loadkeys removedkeys-primary > /dev/null 2>&1
# Determine what a SOA record with a bumped serial number should look like.
-BUMPED_SOA=`sed -n 's/.*\(add removedkeys-primary.*IN.*SOA\)/\1/p;' ns3/named.run | tail -1 | awk '{$8 += 1; print $0}'`
+BUMPED_SOA=$(sed -n 's/.*\(add removedkeys-primary.*IN.*SOA\)/\1/p;' ns3/named.run | tail -1 | awk '{$8 += 1; print $0}')
# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore
# log messages generated before the raw zone is updated.
nextpart ns3/named.run > /dev/null
@@ -1283,9 +1284,9 @@ $DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.test$n 2>&1
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that changes to raw zone are not applied to a previously signed secure zone with no keys available (secondary) ($n)"
ret=0
# Query for bar.removedkeys-secondary/A and ensure the response is negative. As this
@@ -1312,16 +1313,16 @@ $DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.post.test$n
grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null && ret=1
grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that backlogged changes to raw zone are applied after keys become available (secondary) ($n)"
ret=0
# Restore the signing keys for this zone.
mv ns3/removedkeys/Kremovedkeys-secondary* ns3
$RNDCCMD 10.53.0.3 loadkeys removedkeys-secondary > /dev/null 2>&1
# Determine what a SOA record with a bumped serial number should look like.
-BUMPED_SOA=`sed -n 's/.*\(add removedkeys-secondary.*IN.*SOA\)/\1/p;' ns2/named.run | tail -1 | awk '{$8 += 1; print $0}'`
+BUMPED_SOA=$(sed -n 's/.*\(add removedkeys-secondary.*IN.*SOA\)/\1/p;' ns2/named.run | tail -1 | awk '{$8 += 1; print $0}')
# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore
# log messages generated before the raw zone is updated.
nextpart ns3/named.run > /dev/null
@@ -1340,7 +1341,7 @@ $DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.test$n 2>&1
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# Check that the file $2 for zone $1 does not contain RRSIG records
# while the journal file for that zone does contain them.
@@ -1351,7 +1352,7 @@ ensure_sigs_only_in_journal() {
$CHECKZONE -j -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null || ret=1
}
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that records added from a journal are scheduled to be resigned ($n)"
ret=0
# Signing keys for the "delayedkeys" zone are not yet accessible. Thus, the
@@ -1363,25 +1364,25 @@ $RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
# Wait until the zone is signed.
check_done_signing () (
$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
- num=`grep "Done signing with" signing.out.test$n | wc -l`
+ num=$(grep "Done signing with" signing.out.test$n | wc -l)
[ $num -eq 2 ]
)
retry_quiet 10 check_done_signing || ret=1
# Halt rather than stopping the server to prevent the file from being
# flushed upon shutdown since we specifically want to avoid it.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
+stop_server --use-rndc --halt --port ${CONTROLPORT} ns3
ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
+start_server --noclean --restart --port ${PORT} ns3
# At this point, the raw zone journal will not have a source serial set. Upon
# server startup, receive_secure_serial() will rectify that, update SOA, resign
# it, and schedule its future resign. This will cause "rndc zonestatus" to
# return delayedkeys/SOA as the next node to resign, so we restart the server
# once again; with the raw zone journal now having a source serial set,
# receive_secure_serial() should refrain from introducing any zone changes.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
+stop_server --use-rndc --halt --port ${CONTROLPORT} ns3
ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
nextpart ns3/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
+start_server --noclean --restart --port ${PORT} ns3
# We can now test whether the secure zone journal was correctly processed:
# unless the records contained in it were scheduled for resigning, no resigning
# event will be scheduled at all since the secure zone file contains no
@@ -1390,30 +1391,30 @@ wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
$RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1
grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check that zonestatus reports 'type: primary' for an inline primary zone ($n)"
ret=0
$RNDCCMD 10.53.0.3 zonestatus master > rndc.out.ns3.test$n
grep "type: primary" rndc.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check that zonestatus reports 'type: secondary' for an inline secondary zone ($n)"
ret=0
$RNDCCMD 10.53.0.3 zonestatus bits > rndc.out.ns3.test$n
grep "type: secondary" rndc.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking reload of touched inline zones ($n)"
ret=0
echo_ic "pre-reload 'next key event'"
nextpart ns8/named.run > nextpart.pre$n.out
-count=`grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.pre$n.out | wc -l`
+count=$(grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.pre$n.out | wc -l)
echo_ic "found: $count/16"
[ $count -eq 16 ] || ret=1
echo_ic "touch and reload"
@@ -1422,13 +1423,13 @@ $RNDCCMD 10.53.0.8 reload 2>&1 | sed 's/^/ns3 /' | cat_i
sleep 5
echo_ic "post-reload 'next key event'"
nextpart ns8/named.run > nextpart.post$n.out
-count=`grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.post$n.out | wc -l`
+count=$(grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.post$n.out | wc -l)
echo_ic "found: $count/16"
[ $count -eq 16 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking second reload of touched inline zones ($n)"
ret=0
nextpart ns8/named.run > nextpart.pre$n.out
@@ -1437,7 +1438,7 @@ sleep 5
nextpart ns8/named.run > nextpart.post$n.out
grep "ixfr-from-differences: unchanged" nextpart.post$n.out && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
n=$((n+1))
echo_i "Check that 'rndc reload' of just the serial updates the signed instance ($n)"
@@ -1464,12 +1465,12 @@ echo_i "Check that restart with zone changes and deleted journal works ($n)"
TSIG=
ret=0
dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa1 || ret=1
-stop_server --use-rndc --port ${CONTROLPORT} inline ns8
+stop_server --use-rndc --port ${CONTROLPORT} ns8
# TTL of all records change from 300 to 400
cp ns8/example3.db.in ns8/example.db || ret=1
rm ns8/example.db.jnl
nextpart ns8/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} inline ns8
+start_server --noclean --restart --port ${PORT} ns8
wait_for_log 3 "all zones loaded" ns8/named.run
sleep 1
dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa2 || ret=1
diff --git a/external/mpl/bind/dist/bin/tests/system/ixfr/tests.sh b/external/mpl/bind/dist/bin/tests/system/ixfr/tests.sh
index aa6bf85f097..4b366a52895 100644
--- a/external/mpl/bind/dist/bin/tests/system/ixfr/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/ixfr/tests.sh
@@ -214,6 +214,7 @@ retry_quiet 10 wait_for_serial 10.53.0.4 test. 1 dig.out.test$n || ret=1
nextpart ns4/named.run > /dev/null
# modify the primary
+sleep 1
cp ns3/mytest1.db ns3/mytest.db
$RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
@@ -241,6 +242,7 @@ ret=0
# we want to make sure that a change to sub.test results in AXFR, while
# changes to test. result in IXFR
+sleep 1
cp ns3/subtest1.db ns3/subtest.db # change to sub.test zone, should be AXFR
nextpart ns4/named.run > /dev/null
$RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
@@ -264,6 +266,7 @@ status=$((status+ret))
n=$((n+1))
echo_i "testing 'request-ixfr yes' option inheritance from view ($n)"
ret=0
+sleep 1
cp ns3/mytest2.db ns3/mytest.db # change to test zone, should be IXFR
nextpart ns4/named.run > /dev/null
$RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
@@ -388,6 +391,7 @@ ret=0
echo_i "testing fallback to AXFR when max-ixfr-ratio is exceeded ($n)"
nextpart ns4/named.run > /dev/null
+sleep 1
cp ns3/mytest3.db ns3/mytest.db # change to test zone, too big for IXFR
$RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
diff --git a/external/mpl/bind/dist/bin/tests/system/journal/clean.sh b/external/mpl/bind/dist/bin/tests/system/journal/clean.sh
index d5bfeb62636..adab870685d 100644
--- a/external/mpl/bind/dist/bin/tests/system/journal/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/journal/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp.sh b/external/mpl/bind/dist/bin/tests/system/kasp.sh
index 03ff93c4c4a..f0c83b19ab9 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp.sh
+++ b/external/mpl/bind/dist/bin/tests/system/kasp.sh
@@ -695,7 +695,7 @@ dnssec_verify()
echo_i "dnssec-verify zone ${ZONE} ($n)"
ret=0
_dig_with_opts "$ZONE" "@${SERVER}" AXFR > dig.out.axfr.test$n || _log_error "dig ${ZONE} AXFR failed"
- $VERIFY -z -o "$ZONE" dig.out.axfr.test$n > /dev/null || _log_error "dnssec verify zone $ZONE failed"
+ $VERIFY -z -o "$ZONE" dig.out.axfr.test$n > verify.out.$ZONE.test$n || _log_error "dnssec verify zone $ZONE failed"
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
}
@@ -1107,7 +1107,7 @@ _check_apex_dnskey() {
test "$_checksig" -eq 0 && return 0
- retry_quiet 3 _check_signatures "DNSKEY" "dig.out.$DIR.test$n" "KSK" || return 1
+ _check_signatures "DNSKEY" "dig.out.$DIR.test$n" "KSK" || return 1
return 0
}
@@ -1120,11 +1120,11 @@ check_apex() {
n=$((n+1))
echo_i "check DNSKEY rrset is signed correctly for zone ${ZONE} ($n)"
ret=0
- retry_quiet 3 _check_apex_dnskey || ret=1
+ retry_quiet 10 _check_apex_dnskey || ret=1
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
- # We retry the DNSKEY query for at most three seconds to avoid test
+ # We retry the DNSKEY query for at most ten seconds to avoid test
# failures due to timing issues. If the DNSKEY query check passes this
# means the zone is resigned and further apex checks (SOA, CDS, CDNSKEY)
# don't need to be retried quietly.
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/clean.sh b/external/mpl/bind/dist/bin/tests/system/kasp/clean.sh
index 637e5e0ce78..db264c28107 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/clean.sh
@@ -16,8 +16,9 @@ set -e
rm -f ./keygen.*
rm -f ./K*.private ./K*.key ./K*.state ./K*.cmp
rm -rf ./keys/
-rm -f dig.out* rrsig.out.* keyevent.out.*
+rm -f dig.out* rrsig.out.* keyevent.out.* verify.out.* zone.out.*
rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f ns*/named-fips.conf
rm -f ns*/policies/*.conf
rm -f ns*/*.jnl ns*/*.jbk
rm -f ns*/K*.private ns*/K*.key ns*/K*.state
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/kasp.conf b/external/mpl/bind/dist/bin/tests/system/kasp/kasp.conf
index b706558f7f6..e7a2eab9665 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/kasp.conf
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/kasp.conf
@@ -21,7 +21,7 @@ dnssec-policy "kasp" {
keys {
csk key-directory lifetime P1Y algorithm 13;
ksk key-directory lifetime P1Y algorithm 8;
- zsk key-directory lifetime P30D algorithm 8 1024;
- zsk key-directory lifetime P6M algorithm 8 2000;
+ zsk key-directory lifetime P30D algorithm 8 2048;
+ zsk key-directory lifetime P6M algorithm 8 3072;
};
};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named-fips.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named-fips.conf.in
new file mode 100644
index 00000000000..6199b0496b5
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named-fips.conf.in
@@ -0,0 +1,508 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+include "policies/kasp.conf";
+include "policies/autosign.conf";
+
+options {
+ query-source address 10.53.0.3;
+ notify-source 10.53.0.3;
+ transfer-source 10.53.0.3;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ allow-transfer { any; };
+ recursion no;
+ dnssec-policy "rsasha256";
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* Zones that are getting initially signed */
+
+/* The default case: No keys created, using default policy. */
+zone "default.kasp" {
+ type primary;
+ file "default.kasp.db";
+ inline-signing yes;
+ dnssec-policy "default";
+};
+
+/* checkds: Zone with one KSK. */
+zone "checkds-ksk.kasp" {
+ type primary;
+ file "checkds-ksk.kasp.db";
+ inline-signing yes;
+ dnssec-policy "checkds-ksk";
+};
+
+/* checkds: Zone with two KSKs. */
+zone "checkds-doubleksk.kasp" {
+ type primary;
+ file "checkds-doubleksk.kasp.db";
+ inline-signing yes;
+ dnssec-policy "checkds-doubleksk";
+};
+
+/* checkds: Zone with one CSK. */
+zone "checkds-csk.kasp" {
+ type primary;
+ file "checkds-csk.kasp.db";
+ inline-signing yes;
+ dnssec-policy "checkds-csk";
+};
+
+/* Key lifetime unlimited. */
+zone "unlimited.kasp" {
+ type primary;
+ file "unlimited.kasp.db";
+ inline-signing yes;
+ dnssec-policy "unlimited";
+};
+
+/* Manual rollover. */
+zone "manual-rollover.kasp" {
+ type primary;
+ file "manual-rollover.kasp.db";
+ inline-signing yes;
+ dnssec-policy "manual-rollover";
+};
+
+/* A zone that inherits dnssec-policy. */
+zone "inherit.kasp" {
+ type primary;
+ inline-signing yes;
+ file "inherit.kasp.db";
+};
+
+/* A zone that overrides dnssec-policy. */
+zone "unsigned.kasp" {
+ type primary;
+ file "unsigned.kasp.db";
+ inline-signing yes;
+ dnssec-policy "none";
+};
+
+/* A zone that is initially set to insecure. */
+zone "insecure.kasp" {
+ type primary;
+ file "insecure.kasp.db";
+ inline-signing yes;
+ dnssec-policy "insecure";
+};
+
+/* A primary zone with dnssec-policy but keys already created. */
+zone "dnssec-keygen.kasp" {
+ type primary;
+ file "dnssec-keygen.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha256";
+};
+
+/* A secondary zone with dnssec-policy. */
+zone "secondary.kasp" {
+ type secondary;
+ primaries { 10.53.0.2; };
+ file "secondary.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha256";
+};
+
+/* A dynamic zone with dnssec-policy. */
+zone "dynamic.kasp" {
+ type primary;
+ file "dynamic.kasp.db";
+ dnssec-policy "default";
+ allow-update { any; };
+};
+
+/* A dynamic inline-signed zone with dnssec-policy. */
+zone "dynamic-inline-signing.kasp" {
+ type primary;
+ file "dynamic-inline-signing.kasp.db";
+ dnssec-policy "default";
+ allow-update { any; };
+ inline-signing yes;
+};
+
+/* An inline-signed zone with dnssec-policy. */
+zone "inline-signing.kasp" {
+ type primary;
+ file "inline-signing.kasp.db";
+ dnssec-policy "default";
+ inline-signing yes;
+};
+
+/*
+ * A configured dnssec-policy but some keys already created.
+ */
+zone "some-keys.kasp" {
+ type primary;
+ file "some-keys.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha256";
+};
+
+/*
+ * A configured dnssec-policy but some keys already in use.
+ */
+zone "legacy-keys.kasp" {
+ type primary;
+ file "legacy-keys.kasp.db";
+ inline-signing yes;
+ dnssec-policy "migrate-to-dnssec-policy";
+};
+
+/*
+ * A configured dnssec-policy with (too) many keys pregenerated.
+ */
+zone "pregenerated.kasp" {
+ type primary;
+ file "pregenerated.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha256";
+};
+
+/*
+ * A configured dnssec-policy with one rumoured key.
+ * Bugfix case for GL #1593.
+ */
+zone "rumoured.kasp" {
+ type primary;
+ file "rumoured.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha256";
+};
+
+/* RFC 8901 Multi-signer Model 2. */
+zone "multisigner-model2.kasp" {
+ type primary;
+ file "multisigner-model2.kasp.db";
+ dnssec-policy "multisigner-model2";
+ allow-update { any; };
+};
+
+/*
+ * Different algorithms.
+ */
+zone "rsasha256.kasp" {
+ type primary;
+ file "rsasha256.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha256";
+};
+zone "rsasha512.kasp" {
+ type primary;
+ file "rsasha512.kasp.db";
+ inline-signing yes;
+ dnssec-policy "rsasha512";
+};
+zone "ecdsa256.kasp" {
+ type primary;
+ file "ecdsa256.kasp.db";
+ inline-signing yes;
+ dnssec-policy "ecdsa256";
+};
+zone "ecdsa384.kasp" {
+ type primary;
+ file "ecdsa384.kasp.db";
+ inline-signing yes;
+ dnssec-policy "ecdsa384";
+};
+
+/*
+ * Zone with too high TTL.
+ */
+zone "max-zone-ttl.kasp" {
+ type primary;
+ file "max-zone-ttl.kasp.db";
+ inline-signing yes;
+ dnssec-policy "ttl";
+};
+
+/*
+ * Zones in different signing states.
+ */
+
+/*
+ * Zone that has expired signatures.
+ */
+zone "expired-sigs.autosign" {
+ type primary;
+ file "expired-sigs.autosign.db";
+ inline-signing yes;
+ dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has valid, fresh signatures.
+ */
+zone "fresh-sigs.autosign" {
+ type primary;
+ file "fresh-sigs.autosign.db";
+ inline-signing yes;
+ dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has unfresh signatures.
+ */
+zone "unfresh-sigs.autosign" {
+ type primary;
+ file "unfresh-sigs.autosign.db";
+ inline-signing yes;
+ dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has missing private KSK.
+ */
+zone "ksk-missing.autosign" {
+ type primary;
+ file "ksk-missing.autosign.db";
+ inline-signing yes;
+ dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has missing private ZSK.
+ */
+zone "zsk-missing.autosign" {
+ type primary;
+ file "zsk-missing.autosign.db";
+ inline-signing yes;
+ dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has inactive ZSK.
+ */
+zone "zsk-retired.autosign" {
+ type primary;
+ file "zsk-retired.autosign.db";
+ inline-signing yes;
+ dnssec-policy "autosign";
+};
+
+/*
+ * Zones for testing enabling DNSSEC.
+ */
+zone "step1.enable-dnssec.autosign" {
+ type primary;
+ file "step1.enable-dnssec.autosign.db";
+ inline-signing yes;
+ dnssec-policy "enable-dnssec";
+};
+zone "step2.enable-dnssec.autosign" {
+ type primary;
+ file "step2.enable-dnssec.autosign.db";
+ inline-signing yes;
+ dnssec-policy "enable-dnssec";
+};
+zone "step3.enable-dnssec.autosign" {
+ type primary;
+ file "step3.enable-dnssec.autosign.db";
+ inline-signing yes;
+ dnssec-policy "enable-dnssec";
+};
+zone "step4.enable-dnssec.autosign" {
+ type primary;
+ file "step4.enable-dnssec.autosign.db";
+ inline-signing yes;
+ dnssec-policy "enable-dnssec";
+};
+
+/*
+ * Zones for testing ZSK Pre-Publication steps.
+ */
+zone "step1.zsk-prepub.autosign" {
+ type primary;
+ file "step1.zsk-prepub.autosign.db";
+ inline-signing yes;
+ dnssec-policy "zsk-prepub";
+};
+zone "step2.zsk-prepub.autosign" {
+ type primary;
+ file "step2.zsk-prepub.autosign.db";
+ inline-signing yes;
+ dnssec-policy "zsk-prepub";
+};
+zone "step3.zsk-prepub.autosign" {
+ type primary;
+ file "step3.zsk-prepub.autosign.db";
+ inline-signing yes;
+ dnssec-policy "zsk-prepub";
+};
+zone "step4.zsk-prepub.autosign" {
+ type primary;
+ file "step4.zsk-prepub.autosign.db";
+ inline-signing yes;
+ dnssec-policy "zsk-prepub";
+};
+zone "step5.zsk-prepub.autosign" {
+ type primary;
+ file "step5.zsk-prepub.autosign.db";
+ inline-signing yes;
+ dnssec-policy "zsk-prepub";
+};
+zone "step6.zsk-prepub.autosign" {
+ type primary;
+ file "step6.zsk-prepub.autosign.db";
+ inline-signing yes;
+ dnssec-policy "zsk-prepub";
+};
+
+/*
+ * Zones for testing KSK Double-KSK steps.
+ */
+zone "step1.ksk-doubleksk.autosign" {
+ type primary;
+ file "step1.ksk-doubleksk.autosign.db";
+ inline-signing yes;
+ dnssec-policy "ksk-doubleksk";
+};
+zone "step2.ksk-doubleksk.autosign" {
+ type primary;
+ file "step2.ksk-doubleksk.autosign.db";
+ inline-signing yes;
+ dnssec-policy "ksk-doubleksk";
+};
+zone "step3.ksk-doubleksk.autosign" {
+ type primary;
+ file "step3.ksk-doubleksk.autosign.db";
+ inline-signing yes;
+ dnssec-policy "ksk-doubleksk";
+};
+zone "step4.ksk-doubleksk.autosign" {
+ type primary;
+ file "step4.ksk-doubleksk.autosign.db";
+ inline-signing yes;
+ dnssec-policy "ksk-doubleksk";
+};
+zone "step5.ksk-doubleksk.autosign" {
+ type primary;
+ file "step5.ksk-doubleksk.autosign.db";
+ inline-signing yes;
+ dnssec-policy "ksk-doubleksk";
+};
+zone "step6.ksk-doubleksk.autosign" {
+ type primary;
+ file "step6.ksk-doubleksk.autosign.db";
+ inline-signing yes;
+ dnssec-policy "ksk-doubleksk";
+};
+
+/*
+ * Zones for testing CSK rollover steps.
+ */
+zone "step1.csk-roll.autosign" {
+ type primary;
+ file "step1.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step2.csk-roll.autosign" {
+ type primary;
+ file "step2.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step3.csk-roll.autosign" {
+ type primary;
+ file "step3.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step4.csk-roll.autosign" {
+ type primary;
+ file "step4.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step5.csk-roll.autosign" {
+ type primary;
+ file "step5.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step6.csk-roll.autosign" {
+ type primary;
+ file "step6.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step7.csk-roll.autosign" {
+ type primary;
+ file "step7.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+zone "step8.csk-roll.autosign" {
+ type primary;
+ file "step8.csk-roll.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll";
+};
+
+zone "step1.csk-roll2.autosign" {
+ type primary;
+ file "step1.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
+zone "step2.csk-roll2.autosign" {
+ type primary;
+ file "step2.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
+zone "step3.csk-roll2.autosign" {
+ type primary;
+ file "step3.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
+zone "step4.csk-roll2.autosign" {
+ type primary;
+ file "step4.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
+zone "step5.csk-roll2.autosign" {
+ type primary;
+ file "step5.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
+zone "step6.csk-roll2.autosign" {
+ type primary;
+ file "step6.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
+zone "step7.csk-roll2.autosign" {
+ type primary;
+ file "step7.csk-roll2.autosign.db";
+ inline-signing yes;
+ dnssec-policy "csk-roll2";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named.conf.in
index aa3bef12031..92e007d1e73 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/named.conf.in
@@ -13,82 +13,8 @@
// NS3
-include "policies/kasp.conf";
-include "policies/autosign.conf";
+include "named-fips.conf";
-options {
- query-source address 10.53.0.3;
- notify-source 10.53.0.3;
- transfer-source 10.53.0.3;
- port @PORT@;
- pid-file "named.pid";
- listen-on { 10.53.0.3; };
- listen-on-v6 { none; };
- allow-transfer { any; };
- recursion no;
- dnssec-policy "rsasha1";
-};
-
-key rndc_key {
- secret "1234abcd8765";
- algorithm hmac-sha256;
-};
-
-controls {
- inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* Zones that are getting initially signed */
-
-/* The default case: No keys created, using default policy. */
-zone "default.kasp" {
- type primary;
- file "default.kasp.db";
- inline-signing yes;
- dnssec-policy "default";
-};
-
-/* checkds: Zone with one KSK. */
-zone "checkds-ksk.kasp" {
- type primary;
- file "checkds-ksk.kasp.db";
- inline-signing yes;
- dnssec-policy "checkds-ksk";
-};
-
-/* checkds: Zone with two KSKs. */
-zone "checkds-doubleksk.kasp" {
- type primary;
- file "checkds-doubleksk.kasp.db";
- inline-signing yes;
- dnssec-policy "checkds-doubleksk";
-};
-
-/* checkds: Zone with one CSK. */
-zone "checkds-csk.kasp" {
- type primary;
- file "checkds-csk.kasp.db";
- inline-signing yes;
- dnssec-policy "checkds-csk";
-};
-
-/* Key lifetime unlimited. */
-zone "unlimited.kasp" {
- type primary;
- file "unlimited.kasp.db";
- inline-signing yes;
- dnssec-policy "unlimited";
-};
-
-/* Manual rollover. */
-zone "manual-rollover.kasp" {
- type primary;
- file "manual-rollover.kasp.db";
- inline-signing yes;
- dnssec-policy "manual-rollover";
-};
-
-/* A master zone with dnssec-policy, no keys created. */
zone "rsasha1.kasp" {
type primary;
file "rsasha1.kasp.db";
@@ -96,427 +22,9 @@ zone "rsasha1.kasp" {
dnssec-policy "rsasha1";
};
-/* A zone that inherits dnssec-policy. */
-zone "inherit.kasp" {
- type primary;
- inline-signing yes;
- file "inherit.kasp.db";
-};
-
-/* A zone that overrides dnssec-policy. */
-zone "unsigned.kasp" {
- type primary;
- file "unsigned.kasp.db";
- inline-signing yes;
- dnssec-policy "none";
-};
-
-/* A zone that is initially set to insecure. */
-zone "insecure.kasp" {
- type primary;
- file "insecure.kasp.db";
- inline-signing yes;
- dnssec-policy "insecure";
-};
-
-/* A master zone with dnssec-policy but keys already created. */
-zone "dnssec-keygen.kasp" {
- type primary;
- file "dnssec-keygen.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha1";
-};
-
-/* A secondary zone with dnssec-policy. */
-zone "secondary.kasp" {
- type secondary;
- primaries { 10.53.0.2; };
- file "secondary.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha1";
-};
-
-/* A dynamic zone with dnssec-policy. */
-zone "dynamic.kasp" {
- type primary;
- file "dynamic.kasp.db";
- dnssec-policy "default";
- allow-update { any; };
-};
-
-/* A dynamic inline-signed zone with dnssec-policy. */
-zone "dynamic-inline-signing.kasp" {
- type primary;
- file "dynamic-inline-signing.kasp.db";
- dnssec-policy "default";
- allow-update { any; };
- inline-signing yes;
-};
-
-/* An inline-signed zone with dnssec-policy. */
-zone "inline-signing.kasp" {
- type primary;
- file "inline-signing.kasp.db";
- dnssec-policy "default";
- inline-signing yes;
-};
-
-/*
- * A configured dnssec-policy but some keys already created.
- */
-zone "some-keys.kasp" {
- type primary;
- file "some-keys.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha1";
-};
-
-/*
- * A configured dnssec-policy but some keys already in use.
- */
-zone "legacy-keys.kasp" {
- type primary;
- file "legacy-keys.kasp.db";
- inline-signing yes;
- dnssec-policy "migrate-to-dnssec-policy";
-};
-
-/*
- * A configured dnssec-policy with (too) many keys pregenerated.
- */
-zone "pregenerated.kasp" {
- type primary;
- file "pregenerated.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha1";
-};
-
-/*
- * A configured dnssec-policy with one rumoured key.
- * Bugfix case for GL #1593.
- */
-zone "rumoured.kasp" {
- type primary;
- file "rumoured.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha1";
-};
-
-/* RFC 8901 Multi-signer Model 2. */
-zone "multisigner-model2.kasp" {
- type primary;
- file "multisigner-model2.kasp.db";
- dnssec-policy "multisigner-model2";
- allow-update { any; };
-};
-
-/*
- * Different algorithms.
- */
zone "rsasha1-nsec3.kasp" {
type primary;
file "rsasha1-nsec3.kasp.db";
inline-signing yes;
dnssec-policy "rsasha1-nsec3";
};
-zone "rsasha256.kasp" {
- type primary;
- file "rsasha256.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha256";
-};
-zone "rsasha512.kasp" {
- type primary;
- file "rsasha512.kasp.db";
- inline-signing yes;
- dnssec-policy "rsasha512";
-};
-zone "ecdsa256.kasp" {
- type primary;
- file "ecdsa256.kasp.db";
- inline-signing yes;
- dnssec-policy "ecdsa256";
-};
-zone "ecdsa384.kasp" {
- type primary;
- file "ecdsa384.kasp.db";
- inline-signing yes;
- dnssec-policy "ecdsa384";
-};
-
-/*
- * Zone with too high TTL.
- */
-zone "max-zone-ttl.kasp" {
- type primary;
- file "max-zone-ttl.kasp.db";
- inline-signing yes;
- dnssec-policy "ttl";
-};
-
-/*
- * Zones in different signing states.
- */
-
-/*
- * Zone that has expired signatures.
- */
-zone "expired-sigs.autosign" {
- type primary;
- file "expired-sigs.autosign.db";
- inline-signing yes;
- dnssec-policy "autosign";
-};
-
-/*
- * Zone that has valid, fresh signatures.
- */
-zone "fresh-sigs.autosign" {
- type primary;
- file "fresh-sigs.autosign.db";
- inline-signing yes;
- dnssec-policy "autosign";
-};
-
-/*
- * Zone that has unfresh signatures.
- */
-zone "unfresh-sigs.autosign" {
- type primary;
- file "unfresh-sigs.autosign.db";
- inline-signing yes;
- dnssec-policy "autosign";
-};
-
-/*
- * Zone that has missing private KSK.
- */
-zone "ksk-missing.autosign" {
- type primary;
- file "ksk-missing.autosign.db";
- inline-signing yes;
- dnssec-policy "autosign";
-};
-
-/*
- * Zone that has missing private ZSK.
- */
-zone "zsk-missing.autosign" {
- type primary;
- file "zsk-missing.autosign.db";
- inline-signing yes;
- dnssec-policy "autosign";
-};
-
-/*
- * Zone that has inactive ZSK.
- */
-zone "zsk-retired.autosign" {
- type primary;
- file "zsk-retired.autosign.db";
- inline-signing yes;
- dnssec-policy "autosign";
-};
-
-/*
- * Zones for testing enabling DNSSEC.
- */
-zone "step1.enable-dnssec.autosign" {
- type primary;
- file "step1.enable-dnssec.autosign.db";
- inline-signing yes;
- dnssec-policy "enable-dnssec";
-};
-zone "step2.enable-dnssec.autosign" {
- type primary;
- file "step2.enable-dnssec.autosign.db";
- inline-signing yes;
- dnssec-policy "enable-dnssec";
-};
-zone "step3.enable-dnssec.autosign" {
- type primary;
- file "step3.enable-dnssec.autosign.db";
- inline-signing yes;
- dnssec-policy "enable-dnssec";
-};
-zone "step4.enable-dnssec.autosign" {
- type primary;
- file "step4.enable-dnssec.autosign.db";
- inline-signing yes;
- dnssec-policy "enable-dnssec";
-};
-
-/*
- * Zones for testing ZSK Pre-Publication steps.
- */
-zone "step1.zsk-prepub.autosign" {
- type primary;
- file "step1.zsk-prepub.autosign.db";
- inline-signing yes;
- dnssec-policy "zsk-prepub";
-};
-zone "step2.zsk-prepub.autosign" {
- type primary;
- file "step2.zsk-prepub.autosign.db";
- inline-signing yes;
- dnssec-policy "zsk-prepub";
-};
-zone "step3.zsk-prepub.autosign" {
- type primary;
- file "step3.zsk-prepub.autosign.db";
- inline-signing yes;
- dnssec-policy "zsk-prepub";
-};
-zone "step4.zsk-prepub.autosign" {
- type primary;
- file "step4.zsk-prepub.autosign.db";
- inline-signing yes;
- dnssec-policy "zsk-prepub";
-};
-zone "step5.zsk-prepub.autosign" {
- type primary;
- file "step5.zsk-prepub.autosign.db";
- inline-signing yes;
- dnssec-policy "zsk-prepub";
-};
-zone "step6.zsk-prepub.autosign" {
- type primary;
- file "step6.zsk-prepub.autosign.db";
- inline-signing yes;
- dnssec-policy "zsk-prepub";
-};
-
-/*
- * Zones for testing KSK Double-KSK steps.
- */
-zone "step1.ksk-doubleksk.autosign" {
- type primary;
- file "step1.ksk-doubleksk.autosign.db";
- inline-signing yes;
- dnssec-policy "ksk-doubleksk";
-};
-zone "step2.ksk-doubleksk.autosign" {
- type primary;
- file "step2.ksk-doubleksk.autosign.db";
- inline-signing yes;
- dnssec-policy "ksk-doubleksk";
-};
-zone "step3.ksk-doubleksk.autosign" {
- type primary;
- file "step3.ksk-doubleksk.autosign.db";
- inline-signing yes;
- dnssec-policy "ksk-doubleksk";
-};
-zone "step4.ksk-doubleksk.autosign" {
- type primary;
- file "step4.ksk-doubleksk.autosign.db";
- inline-signing yes;
- dnssec-policy "ksk-doubleksk";
-};
-zone "step5.ksk-doubleksk.autosign" {
- type primary;
- file "step5.ksk-doubleksk.autosign.db";
- inline-signing yes;
- dnssec-policy "ksk-doubleksk";
-};
-zone "step6.ksk-doubleksk.autosign" {
- type primary;
- file "step6.ksk-doubleksk.autosign.db";
- inline-signing yes;
- dnssec-policy "ksk-doubleksk";
-};
-
-/*
- * Zones for testing CSK rollover steps.
- */
-zone "step1.csk-roll.autosign" {
- type primary;
- file "step1.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step2.csk-roll.autosign" {
- type primary;
- file "step2.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step3.csk-roll.autosign" {
- type primary;
- file "step3.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step4.csk-roll.autosign" {
- type primary;
- file "step4.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step5.csk-roll.autosign" {
- type primary;
- file "step5.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step6.csk-roll.autosign" {
- type primary;
- file "step6.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step7.csk-roll.autosign" {
- type primary;
- file "step7.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-zone "step8.csk-roll.autosign" {
- type primary;
- file "step8.csk-roll.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll";
-};
-
-zone "step1.csk-roll2.autosign" {
- type primary;
- file "step1.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
-zone "step2.csk-roll2.autosign" {
- type primary;
- file "step2.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
-zone "step3.csk-roll2.autosign" {
- type primary;
- file "step3.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
-zone "step4.csk-roll2.autosign" {
- type primary;
- file "step4.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
-zone "step5.csk-roll2.autosign" {
- type primary;
- file "step5.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
-zone "step6.csk-roll2.autosign" {
- type primary;
- file "step6.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
-zone "step7.csk-roll2.autosign" {
- type primary;
- file "step7.csk-roll2.autosign.db";
- inline-signing yes;
- dnssec-policy "csk-roll2";
-};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
new file mode 100644
index 00000000000..90a92a223c6
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "unlimited" {
+ dnskey-ttl 1234;
+
+ keys {
+ csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "manual-rollover" {
+ dnskey-ttl 3600;
+
+ keys {
+ ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "multisigner-model2" {
+ dnskey-ttl 3600;
+
+ keys {
+ ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "migrate-to-dnssec-policy" {
+ dnskey-ttl 1234;
+
+ keys {
+ ksk key-directory lifetime P6M algorithm 8;
+ zsk key-directory lifetime P6M algorithm 8;
+ };
+};
+
+dnssec-policy "rsasha256" {
+ dnskey-ttl 1234;
+
+ keys {
+ ksk key-directory lifetime P10Y algorithm 8;
+ zsk key-directory lifetime P5Y algorithm 8;
+ zsk key-directory lifetime P1Y algorithm 8 3072;
+ };
+};
+
+dnssec-policy "rsasha512" {
+ dnskey-ttl 1234;
+
+ keys {
+ ksk key-directory lifetime P10Y algorithm 10;
+ zsk key-directory lifetime P5Y algorithm 10;
+ zsk key-directory lifetime P1Y algorithm 10 3072;
+ };
+};
+
+dnssec-policy "ecdsa256" {
+ dnskey-ttl 1234;
+
+ keys {
+ ksk key-directory lifetime P10Y algorithm 13;
+ zsk key-directory lifetime P5Y algorithm 13;
+ zsk key-directory lifetime P1Y algorithm 13 256;
+ };
+};
+
+dnssec-policy "ecdsa384" {
+ dnskey-ttl 1234;
+
+ keys {
+ ksk key-directory lifetime P10Y algorithm 14;
+ zsk key-directory lifetime P5Y algorithm 14;
+ zsk key-directory lifetime P1Y algorithm 14 384;
+ };
+};
+
+dnssec-policy "checkds-ksk" {
+ dnskey-ttl 303;
+
+ keys {
+ ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "checkds-doubleksk" {
+ dnskey-ttl 303;
+
+ keys {
+ ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "checkds-csk" {
+ dnskey-ttl 303;
+
+ keys {
+ csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "ttl" {
+ max-zone-ttl 299;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp.conf.in
index 17b900c7b37..cb045bcb07a 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/kasp.conf.in
@@ -11,31 +11,7 @@
* information regarding copyright ownership.
*/
-dnssec-policy "unlimited" {
- dnskey-ttl 1234;
-
- keys {
- csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- };
-};
-
-dnssec-policy "manual-rollover" {
- dnskey-ttl 3600;
-
- keys {
- ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- };
-};
-
-dnssec-policy "multisigner-model2" {
- dnskey-ttl 3600;
-
- keys {
- ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- };
-};
+include "policies/kasp-fips.conf";
dnssec-policy "rsasha1" {
dnskey-ttl 1234;
@@ -47,15 +23,6 @@ dnssec-policy "rsasha1" {
};
};
-dnssec-policy "migrate-to-dnssec-policy" {
- dnskey-ttl 1234;
-
- keys {
- ksk key-directory lifetime P6M algorithm 5;
- zsk key-directory lifetime P6M algorithm 5;
- };
-};
-
dnssec-policy "rsasha1-nsec3" {
dnskey-ttl 1234;
@@ -65,74 +32,3 @@ dnssec-policy "rsasha1-nsec3" {
zsk key-directory lifetime P1Y algorithm 7 2000;
};
};
-
-dnssec-policy "rsasha256" {
- dnskey-ttl 1234;
-
- keys {
- ksk key-directory lifetime P10Y algorithm 8;
- zsk key-directory lifetime P5Y algorithm 8;
- zsk key-directory lifetime P1Y algorithm 8 2000;
- };
-};
-
-dnssec-policy "rsasha512" {
- dnskey-ttl 1234;
-
- keys {
- ksk key-directory lifetime P10Y algorithm 10;
- zsk key-directory lifetime P5Y algorithm 10;
- zsk key-directory lifetime P1Y algorithm 10 2000;
- };
-};
-
-dnssec-policy "ecdsa256" {
- dnskey-ttl 1234;
-
- keys {
- ksk key-directory lifetime P10Y algorithm 13;
- zsk key-directory lifetime P5Y algorithm 13;
- zsk key-directory lifetime P1Y algorithm 13 256;
- };
-};
-
-dnssec-policy "ecdsa384" {
- dnskey-ttl 1234;
-
- keys {
- ksk key-directory lifetime P10Y algorithm 14;
- zsk key-directory lifetime P5Y algorithm 14;
- zsk key-directory lifetime P1Y algorithm 14 384;
- };
-};
-
-dnssec-policy "checkds-ksk" {
- dnskey-ttl 303;
-
- keys {
- ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- };
-};
-
-dnssec-policy "checkds-doubleksk" {
- dnskey-ttl 303;
-
- keys {
- ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- };
-};
-
-dnssec-policy "checkds-csk" {
- dnskey-ttl 303;
-
- keys {
- csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- };
-};
-
-dnssec-policy "ttl" {
- max-zone-ttl 299;
-};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/setup.sh b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/setup.sh
index bc4a0fc11d6..21e63562676 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns3/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns3/setup.sh
@@ -42,8 +42,8 @@ U="UNRETENTIVE"
#
# Set up zones that will be initially signed.
#
-for zn in default rsasha1 dnssec-keygen some-keys legacy-keys pregenerated \
- rumoured rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 \
+for zn in default dnssec-keygen some-keys legacy-keys pregenerated \
+ rumoured rsasha256 rsasha512 ecdsa256 ecdsa384 \
dynamic dynamic-inline-signing inline-signing \
checkds-ksk checkds-doubleksk checkds-csk inherit unlimited \
manual-rollover multisigner-model2
@@ -52,6 +52,22 @@ do
cp template.db.in "$zonefile"
done
+#
+# Set up RSASHA1 based zones
+#
+for zn in rsasha1 rsasha1-nsec3
+do
+ if (cd ..; $SHELL ../testcrypto.sh -q RSASHA1)
+ then
+ setup "${zn}.kasp"
+ cp template.db.in "$zonefile"
+ else
+ # don't add to zones.
+ echo_i "setting up zone: ${zn}.kasp"
+ cp template.db.in "${zn}.kasp.db"
+ fi
+done
+
if [ -f ../ed25519-supported.file ]; then
setup "ed25519.kasp"
cp template.db.in "$zonefile"
@@ -78,31 +94,31 @@ done
# Some of these zones already have keys.
zone="dnssec-keygen.kasp"
echo_i "setting up zone: $zone"
-$KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
zone="some-keys.kasp"
echo_i "setting up zone: $zone"
-$KEYGEN -G -a RSASHA1 -b 2000 -L 1234 $zone > keygen.out.$zone.1 2>&1
-$KEYGEN -G -a RSASHA1 -f KSK -L 1234 $zone > keygen.out.$zone.2 2>&1
+$KEYGEN -G -a RSASHA256 -b 2048 -L 1234 $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -G -a RSASHA256 -f KSK -L 1234 $zone > keygen.out.$zone.2 2>&1
zone="legacy-keys.kasp"
echo_i "setting up zone: $zone"
-ZSK=$($KEYGEN -a RSASHA1 -b 2048 -L 1234 $zone 2> keygen.out.$zone.1)
-KSK=$($KEYGEN -a RSASHA1 -f KSK -L 1234 $zone 2> keygen.out.$zone.2)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 1234 $zone 2> keygen.out.$zone.1)
+KSK=$($KEYGEN -a RSASHA256 -f KSK -L 1234 $zone 2> keygen.out.$zone.2)
echo $ZSK > legacy-keys.kasp.zsk
echo $KSK > legacy-keys.kasp.ksk
# Predecessor keys:
Tact="now-9mo"
Tret="now-3mo"
-ZSK=$($KEYGEN -a RSASHA1 -b 2048 -L 1234 $zone 2> keygen.out.$zone.3)
-KSK=$($KEYGEN -a RSASHA1 -f KSK -L 1234 $zone 2> keygen.out.$zone.4)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 1234 $zone 2> keygen.out.$zone.3)
+KSK=$($KEYGEN -a RSASHA256 -f KSK -L 1234 $zone 2> keygen.out.$zone.4)
$SETTIME -P $Tact -A $Tact -I $Tret -D $Tret "$ZSK" > settime.out.$zone.1 2>&1
$SETTIME -P $Tact -A $Tact -I $Tret -D $Tret "$KSK" > settime.out.$zone.2 2>&1
zone="pregenerated.kasp"
echo_i "setting up zone: $zone"
-$KEYGEN -G -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
-$KEYGEN -G -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1
+$KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1
zone="multisigner-model2.kasp"
echo_i "setting up zone: $zone"
@@ -122,9 +138,9 @@ echo_i "setting up zone: $zone"
Tpub="now"
Tact="now+1d"
keytimes="-P ${Tpub} -A ${Tact}"
-KSK=$($KEYGEN -a RSASHA1 -f KSK -L 1234 $keytimes $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -b 2000 -L 1234 $keytimes $zone 2> keygen.out.$zone.2)
-ZSK2=$($KEYGEN -a RSASHA1 -L 1234 $keytimes $zone 2> keygen.out.$zone.3)
+KSK=$($KEYGEN -a RSASHA256 -f KSK -L 1234 $keytimes $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -b 3072 -L 1234 $keytimes $zone 2> keygen.out.$zone.2)
+ZSK2=$($KEYGEN -a RSASHA256 -L 1234 $keytimes $zone 2> keygen.out.$zone.3)
$SETTIME -s -g $O -k $R $Tpub -r $R $Tpub -d $H $Tpub "$KSK" > settime.out.$zone.1 2>&1
$SETTIME -s -g $O -k $R $Tpub -z $R $Tpub "$ZSK1" > settime.out.$zone.2 2>&1
$SETTIME -s -g $O -k $R $Tpub -z $R $Tpub "$ZSK2" > settime.out.$zone.2 2>&1
@@ -145,7 +161,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -PS -x -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# These signatures are set to expire long in the past, update immediately.
setup expired-sigs.autosign
@@ -159,7 +176,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -PS -x -s now-2mo -e now-1mo -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -s now-2mo -e now-1mo -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# These signatures are still good, and can be reused.
setup fresh-sigs.autosign
@@ -173,7 +191,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# These signatures are still good, but not fresh enough, update immediately.
setup unfresh-sigs.autosign
@@ -187,7 +206,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# These signatures are still good, but the private KSK is missing.
setup ksk-missing.autosign
@@ -201,7 +221,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
echo "KSK: yes" >> "${KSK}".state
echo "ZSK: no" >> "${KSK}".state
echo "Lifetime: 63072000" >> "${KSK}".state # PT2Y
@@ -219,7 +240,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
echo "KSK: no" >> "${ZSK}".state
echo "ZSK: yes" >> "${ZSK}".state
echo "Lifetime: 31536000" >> "${ZSK}".state # PT1Y
@@ -237,7 +259,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
$SETTIME -s -g HIDDEN "$ZSK" > settime.out.$zone.3 2>&1
#
@@ -270,7 +293,8 @@ CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keyg
$SETTIME -s -g $O -k $R $TpubN -r $R $TpubN -d $H $TpubN -z $R $TpubN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# The zone signatures have been published long enough to become OMNIPRESENT.
@@ -286,7 +310,8 @@ CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keyg
$SETTIME -s -g $O -k $O $TcotN -r $O $TcotN -d $H $TpubN -z $R $TpubN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# The DS has been submitted long enough ago to become OMNIPRESENT.
@@ -305,7 +330,8 @@ CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keyg
$SETTIME -s -g $O -P ds $TsbmN -k $O $TcotN -r $O $TcotN -d $R $TsbmN -z $O $TsbmN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
setup step4.enable-dnssec.autosign
#
@@ -326,7 +352,8 @@ $SETTIME -s -g $O -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$z
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# It is time to pre-publish the successor ZSK.
@@ -365,7 +392,8 @@ $SETTIME -s -g $O -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$z
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# After the publication interval has passed the DNSKEY of the successor ZSK
@@ -427,7 +455,8 @@ cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# After the retire interval has passed the predecessor DNSKEY can be
@@ -486,7 +515,8 @@ $SETTIME -s -g $O -k $O $TactN1 -z $R $TactN1 "$ZSK2" > settime.out.
key_successor $ZSK1 $ZSK2
# Sign zone.
cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
-$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 5:
# The predecessor DNSKEY is removed long enough that is has become HIDDEN.
@@ -524,7 +554,8 @@ cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 6:
# The predecessor DNSKEY can be purged.
@@ -562,7 +593,8 @@ cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
#
# The zones at ksk-doubleksk.autosign represent the various steps of a KSK
@@ -580,7 +612,8 @@ ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 $zsktimes $zone 2> keygen.out
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN "$KSK" > settime.out.$zone.1 2>&1
$SETTIME -s -g $O -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# It is time to submit the introduce the new KSK.
@@ -631,7 +664,8 @@ $SETTIME -s -g $O -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$z
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# It is time to submit the DS.
@@ -697,7 +731,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# The DS should be swapped now.
@@ -757,7 +792,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 5:
# The predecessor DNSKEY is removed long enough that is has become HIDDEN.
@@ -795,7 +831,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 6:
# The predecessor DNSKEY can be purged.
@@ -833,7 +870,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
#
# The zones at csk-roll.autosign represent the various steps of a CSK rollover
@@ -849,7 +887,8 @@ CSK=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.ou
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# It is time to introduce the new CSK.
@@ -876,7 +915,8 @@ CSK=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.ou
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# It is time to submit the DS and to roll signatures.
@@ -930,7 +970,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# Some time later all the ZRRSIG records should be from the new CSK, and the
@@ -976,7 +1017,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 5:
# After the DS is swapped in step 4, also the KRRSIG records can be removed.
@@ -1011,7 +1053,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 6:
# After the retire interval has passed the predecessor DNSKEY can be
@@ -1054,7 +1097,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 7:
# Some time later the predecessor DNSKEY enters the HIDDEN state.
@@ -1088,7 +1132,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 8:
# The predecessor DNSKEY can be purged.
@@ -1122,7 +1167,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
#
# The zones at csk-roll2.autosign represent the various steps of a CSK rollover
@@ -1140,7 +1186,8 @@ CSK=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.o
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# It is time to introduce the new CSK.
@@ -1167,7 +1214,8 @@ CSK=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.o
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# It is time to submit the DS and to roll signatures.
@@ -1221,7 +1269,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# Some time later all the ZRRSIG records should be from the new CSK, and the
@@ -1268,7 +1317,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 5:
# Some time later the DS can be swapped and the old DNSKEY can be removed from
@@ -1304,7 +1354,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 6:
# Some time later the predecessor DNSKEY enters the HIDDEN state.
@@ -1339,7 +1390,8 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 7:
# The predecessor DNSKEY can be purged, but purge-keys is disabled.
@@ -1373,4 +1425,5 @@ key_successor $CSK1 $CSK2
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns4/named.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns4/named.conf.in
index 66e6a9c58c1..fff45ab6985 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns4/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns4/named.conf.in
@@ -38,17 +38,17 @@ key "sha256" {
};
key "keyforview1" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
};
key "keyforview2" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
};
key "keyforview3" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "C1Azf+gGPMmxrUg/WQINP6eV9Y0=";
};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named.conf.in
index cf9900ff00c..cb9bd27b299 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named.conf.in
@@ -38,6 +38,14 @@ controls {
inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
+/* This zone switch from dynamic to inline-signing. */
+zone "dynamic2inline.kasp" {
+ type primary;
+ file "dynamic2inline.kasp.db";
+ allow-update { any; };
+ dnssec-policy "default";
+};
+
/* These zones are going insecure. */
zone "step1.going-insecure.kasp" {
type master;
@@ -65,7 +73,7 @@ zone "step1.algorithm-roll.kasp" {
type primary;
file "step1.algorithm-roll.kasp.db";
inline-signing yes;
- dnssec-policy "rsasha1";
+ dnssec-policy "rsasha256";
};
zone "step1.csk-algorithm-roll.kasp" {
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named2.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named2.conf.in
index 03079f34999..5f4097ebd05 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named2.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/named2.conf.in
@@ -37,6 +37,15 @@ controls {
inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
+/* This zone switch from dynamic to inline-signing. */
+zone "dynamic2inline.kasp" {
+ type primary;
+ file "dynamic2inline.kasp.db";
+ allow-update { any; };
+ inline-signing yes;
+ dnssec-policy "default";
+};
+
/* Zones for testing going insecure. */
zone "step1.going-insecure.kasp" {
type master;
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/csk1.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/csk1.conf.in
index ebaca8835b4..a5ff042db80 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/csk1.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/csk1.conf.in
@@ -17,7 +17,7 @@ dnssec-policy "csk-algoroll" {
signatures-validity-dnskey 30d;
keys {
- csk lifetime unlimited algorithm rsasha1;
+ csk lifetime unlimited algorithm rsasha256;
};
dnskey-ttl 1h;
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in
new file mode 100644
index 00000000000..810b91d6ada
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "unsigning" {
+ dnskey-ttl 7200;
+
+ keys {
+ ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+ zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
+ };
+};
+
+dnssec-policy "nsec3" {
+ nsec3param iterations 0 optout no salt-length 0;
+};
+
+dnssec-policy "rsasha256" {
+ signatures-refresh P5D;
+ signatures-validity 30d;
+ signatures-validity-dnskey 30d;
+
+ keys {
+ ksk lifetime unlimited algorithm rsasha256;
+ zsk lifetime unlimited algorithm rsasha256;
+ };
+
+ dnskey-ttl 1h;
+ publish-safety PT1H;
+ retire-safety 2h;
+ zone-propagation-delay 3600;
+ max-zone-ttl 6h;
+ parent-propagation-delay pt1h;
+ parent-ds-ttl 7200;
+};
+
+dnssec-policy "ecdsa256" {
+ signatures-refresh P5D;
+ signatures-validity 30d;
+ signatures-validity-dnskey 30d;
+
+ keys {
+ ksk lifetime unlimited algorithm ecdsa256;
+ zsk lifetime unlimited algorithm ecdsa256;
+ };
+
+ dnskey-ttl 1h;
+ publish-safety PT1H;
+ retire-safety 2h;
+ zone-propagation-delay 3600;
+ max-zone-ttl 6h;
+ parent-propagation-delay pt1h;
+ parent-ds-ttl 7200;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp.conf.in b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp.conf.in
index 2caae022d2c..d634b76ffe7 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp.conf.in
@@ -11,14 +11,7 @@
* information regarding copyright ownership.
*/
-dnssec-policy "unsigning" {
- dnskey-ttl 7200;
-
- keys {
- ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
- zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
- };
-};
+include "policies/kasp-fips.conf";
dnssec-policy "rsasha1" {
signatures-refresh P5D;
@@ -38,22 +31,3 @@ dnssec-policy "rsasha1" {
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
-
-dnssec-policy "ecdsa256" {
- signatures-refresh P5D;
- signatures-validity 30d;
- signatures-validity-dnskey 30d;
-
- keys {
- ksk lifetime unlimited algorithm ecdsa256;
- zsk lifetime unlimited algorithm ecdsa256;
- };
-
- dnskey-ttl 1h;
- publish-safety PT1H;
- retire-safety 2h;
- zone-propagation-delay 3600;
- max-zone-ttl 6h;
- parent-propagation-delay pt1h;
- parent-ds-ttl 7200;
-};
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/setup.sh b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/setup.sh
index e53c72a9e60..3a18750ef06 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/ns6/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/ns6/setup.sh
@@ -45,7 +45,8 @@ do
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
- $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+ cp $infile $zonefile
+ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# Set up a zone with dnssec-policy that is going insecure. Don't add
@@ -66,7 +67,8 @@ do
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
- $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+ cp $infile $zonefile
+ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
done
# This zone is going straight to "none" policy. This is undefined behavior.
@@ -78,7 +80,8 @@ CSK=$($KEYGEN -k default $csktimes $zone 2> keygen.out.$zone.1)
$SETTIME -s -g $O -k $O $TactN -z $O $TactN -r $O $TactN -d $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
#
# The zones at algorithm-roll.kasp represent the various steps of a ZSK/KSK
@@ -92,14 +95,15 @@ echo "$zone" >> zones
TactN="now"
ksktimes="-P ${TactN} -A ${TactN} -P sync ${TactN}"
zsktimes="-P ${TactN} -A ${TactN}"
-KSK=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -L 3600 $zsktimes $zone 2> keygen.out.$zone.2)
+KSK=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a RSASHA256 -L 3600 $zsktimes $zone 2> keygen.out.$zone.2)
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN "$KSK" > settime.out.$zone.1 2>&1
$SETTIME -s -g $O -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$zone.2 2>&1
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone 5 "$KSK" >> "$infile"
-private_type_record $zone 5 "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+private_type_record $zone 8 "$KSK" >> "$infile"
+private_type_record $zone 8 "$ZSK" >> "$infile"
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# After the publication interval has passed the DNSKEY is OMNIPRESENT.
@@ -114,8 +118,8 @@ ksk1times="-P ${TactN} -A ${TactN} -P sync ${TactN} -I now"
zsk1times="-P ${TactN} -A ${TactN} -I now"
ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsk2times $zone 2> keygen.out.$zone.4)
$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $O $TactN "$KSK1" > settime.out.$zone.1 2>&1
@@ -126,11 +130,12 @@ $SETTIME -s -g $O -k $R $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.ou
echo "Lifetime: 0" >> "${KSK1}.state"
echo "Lifetime: 0" >> "${ZSK1}.state"
cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5 "$KSK1" >> "$infile"
-private_type_record $zone 5 "$ZSK1" >> "$infile"
+private_type_record $zone 8 "$KSK1" >> "$infile"
+private_type_record $zone 8 "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# The zone signatures are also OMNIPRESENT.
@@ -144,8 +149,8 @@ ksk1times="-P ${TactN} -A ${TactN} -P sync ${TactN} -I ${TretN}"
zsk1times="-P ${TactN} -A ${TactN} -I ${TretN}"
ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsk2times $zone 2> keygen.out.$zone.4)
$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $O $TactN "$KSK1" > settime.out.$zone.1 2>&1
@@ -156,11 +161,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.ou
echo "Lifetime: 0" >> "${KSK1}.state"
echo "Lifetime: 0" >> "${ZSK1}.state"
cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5 "$KSK1" >> "$infile"
-private_type_record $zone 5 "$ZSK1" >> "$infile"
+private_type_record $zone 8 "$KSK1" >> "$infile"
+private_type_record $zone 8 "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# The DS is swapped and can become OMNIPRESENT.
@@ -175,8 +181,8 @@ ksk1times="-P ${TactN} -A ${TactN} -P sync ${TactN} -I ${TretN}"
zsk1times="-P ${TactN} -A ${TactN} -I ${TretN}"
ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsk2times $zone 2> keygen.out.$zone.4)
$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $U $TactN1 -D ds $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -187,11 +193,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2
echo "Lifetime: 0" >> "${KSK1}.state"
echo "Lifetime: 0" >> "${ZSK1}.state"
cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5 "$KSK1" >> "$infile"
-private_type_record $zone 5 "$ZSK1" >> "$infile"
+private_type_record $zone 8 "$KSK1" >> "$infile"
+private_type_record $zone 8 "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 5:
# The DNSKEY is removed long enough to be HIDDEN.
@@ -207,8 +214,8 @@ ksk1times="-P ${TactN} -A ${TactN} -P sync ${TactN} -I ${TretN}"
zsk1times="-P ${TactN} -A ${TactN} -I ${TretN}"
ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsk2times $zone 2> keygen.out.$zone.4)
$SETTIME -s -g $H -k $U $TremN -r $U $TremN -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -219,11 +226,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.ou
echo "Lifetime: 0" >> "${KSK1}.state"
echo "Lifetime: 0" >> "${ZSK1}.state"
cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5 "$KSK1" >> "$infile"
-private_type_record $zone 5 "$ZSK1" >> "$infile"
+private_type_record $zone 8 "$KSK1" >> "$infile"
+private_type_record $zone 8 "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 6:
# The RRSIGs have been removed long enough to be HIDDEN.
@@ -240,8 +248,8 @@ ksk1times="-P ${TactN} -A ${TactN} -P sync ${TactN} -I ${TretN}"
zsk1times="-P ${TactN} -A ${TactN} -I ${TretN}"
ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -L 3600 $zsk1times $zone 2> keygen.out.$zone.2)
KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsk2times $zone 2> keygen.out.$zone.4)
$SETTIME -s -g $H -k $H $TremN -r $U $TdeaN -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -252,11 +260,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.ou
echo "Lifetime: 0" >> "${KSK1}.state"
echo "Lifetime: 0" >> "${ZSK1}.state"
cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5 "$KSK1" >> "$infile"
-private_type_record $zone 5 "$ZSK1" >> "$infile"
+private_type_record $zone 8 "$KSK1" >> "$infile"
+private_type_record $zone 8 "$ZSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
#
# The zones at csk-algorithm-roll.kasp represent the various steps of a CSK
@@ -273,7 +282,8 @@ CSK=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $csktimes $zone 2> keygen.ou
$SETTIME -s -g $O -k $O $TactN -r $O $TactN -z $O $TactN -d $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone 5 "$CSK" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 2:
# After the publication interval has passed the DNSKEY is OMNIPRESENT.
@@ -292,7 +302,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone 5 "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 3:
# The zone signatures are also OMNIPRESENT.
@@ -313,7 +324,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone 5 "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 4:
# The DS is swapped and can become OMNIPRESENT.
@@ -335,7 +347,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone 5 "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 5:
# The DNSKEY is removed long enough to be HIDDEN.
@@ -358,7 +371,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone 5 "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
# Step 6:
# The RRSIGs have been removed long enough to be HIDDEN.
@@ -382,10 +396,14 @@ echo "Lifetime: 0" >> "${CSK1}.state"
cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
private_type_record $zone 5 "$CSK1" >> "$infile"
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
#
# Reload testing
#
echo "example" >> zones
cp example.db.in example.db
+
+setup "dynamic2inline.kasp"
+cp template.db.in $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/setup.sh b/external/mpl/bind/dist/bin/tests/system/kasp/setup.sh
index 3b4b26a4a70..d3f4329ac7f 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/setup.sh
@@ -21,7 +21,13 @@ $SHELL clean.sh
mkdir keys
copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
+if ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+ copy_setports ns3/named-fips.conf.in ns3/named.conf
+else
+ copy_setports ns3/named-fips.conf.in ns3/named-fips.conf
+ copy_setports ns3/named.conf.in ns3/named.conf
+fi
copy_setports ns4/named.conf.in ns4/named.conf
copy_setports ns5/named.conf.in ns5/named.conf
copy_setports ns6/named.conf.in ns6/named.conf
@@ -35,11 +41,21 @@ if $SHELL ../testcrypto.sh ed448; then
fi
copy_setports ns3/policies/autosign.conf.in ns3/policies/autosign.conf
+copy_setports ns3/policies/kasp-fips.conf.in ns3/policies/kasp-fips.conf
copy_setports ns3/policies/kasp.conf.in ns3/policies/kasp.conf
+if ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+ cp ns3/policies/kasp-fips.conf ns3/policies/kasp.conf
+fi
copy_setports ns6/policies/csk1.conf.in ns6/policies/csk1.conf
copy_setports ns6/policies/csk2.conf.in ns6/policies/csk2.conf
+copy_setports ns6/policies/kasp-fips.conf.in ns6/policies/kasp-fips.conf
copy_setports ns6/policies/kasp.conf.in ns6/policies/kasp.conf
+if ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+ cp ns6/policies/kasp-fips.conf ns6/policies/kasp.conf
+fi
# Setup zones
(
diff --git a/external/mpl/bind/dist/bin/tests/system/kasp/tests.sh b/external/mpl/bind/dist/bin/tests/system/kasp/tests.sh
index ff4d32cc7bd..33db173936d 100644
--- a/external/mpl/bind/dist/bin/tests/system/kasp/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/kasp/tests.sh
@@ -84,13 +84,13 @@ set_zonesigning "KEY2" "no"
set_keyrole "KEY3" "zsk"
set_keylifetime "KEY3" "2592000"
-set_keyalgorithm "KEY3" "8" "RSASHA256" "1024"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "2048"
set_keysigning "KEY3" "no"
set_zonesigning "KEY3" "yes"
set_keyrole "KEY4" "zsk"
set_keylifetime "KEY4" "16070400"
-set_keyalgorithm "KEY4" "8" "RSASHA256" "2000"
+set_keyalgorithm "KEY4" "8" "RSASHA256" "3072"
set_keysigning "KEY4" "no"
set_zonesigning "KEY4" "yes"
@@ -251,8 +251,6 @@ retry_quiet 30 _wait_for_done_apexnsec || ret=1
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
-next_key_event_threshold=$((next_key_event_threshold+i))
-
# Test max-zone-ttl rejects zones with too high TTL.
n=$((n+1))
echo_i "check that max-zone-ttl rejects zones with too high TTL ($n)"
@@ -788,55 +786,58 @@ set_keytimes_algorithm_policy() {
#
# Zone: rsasha1.kasp.
#
-set_zone "rsasha1.kasp"
-set_policy "rsasha1" "3" "1234"
-set_server "ns3" "10.53.0.3"
-# Key properties.
-key_clear "KEY1"
-set_keyrole "KEY1" "ksk"
-set_keylifetime "KEY1" "315360000"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
-set_keysigning "KEY1" "yes"
-set_zonesigning "KEY1" "no"
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+ set_zone "rsasha1.kasp"
+ set_policy "rsasha1" "3" "1234"
+ set_server "ns3" "10.53.0.3"
+ # Key properties.
+ key_clear "KEY1"
+ set_keyrole "KEY1" "ksk"
+ set_keylifetime "KEY1" "315360000"
+ set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+ set_keysigning "KEY1" "yes"
+ set_zonesigning "KEY1" "no"
-key_clear "KEY2"
-set_keyrole "KEY2" "zsk"
-set_keylifetime "KEY2" "157680000"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
-set_keysigning "KEY2" "no"
-set_zonesigning "KEY2" "yes"
+ key_clear "KEY2"
+ set_keyrole "KEY2" "zsk"
+ set_keylifetime "KEY2" "157680000"
+ set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+ set_keysigning "KEY2" "no"
+ set_zonesigning "KEY2" "yes"
-key_clear "KEY3"
-set_keyrole "KEY3" "zsk"
-set_keylifetime "KEY3" "31536000"
-set_keyalgorithm "KEY3" "5" "RSASHA1" "2000"
-set_keysigning "KEY3" "no"
-set_zonesigning "KEY3" "yes"
+ key_clear "KEY3"
+ set_keyrole "KEY3" "zsk"
+ set_keylifetime "KEY3" "31536000"
+ set_keyalgorithm "KEY3" "5" "RSASHA1" "2000"
+ set_keysigning "KEY3" "no"
+ set_zonesigning "KEY3" "yes"
-# KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
-# ZSK: DNSKEY, RRSIG (zsk) published.
-set_keystate "KEY1" "GOAL" "omnipresent"
-set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
-set_keystate "KEY1" "STATE_DS" "hidden"
+ # KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
+ # ZSK: DNSKEY, RRSIG (zsk) published.
+ set_keystate "KEY1" "GOAL" "omnipresent"
+ set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+ set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+ set_keystate "KEY1" "STATE_DS" "hidden"
-set_keystate "KEY2" "GOAL" "omnipresent"
-set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
+ set_keystate "KEY2" "GOAL" "omnipresent"
+ set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
+ set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
-set_keystate "KEY3" "GOAL" "omnipresent"
-set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
-# Three keys only.
-key_clear "KEY4"
+ set_keystate "KEY3" "GOAL" "omnipresent"
+ set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
+ set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
+ # Three keys only.
+ key_clear "KEY4"
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-set_keytimes_algorithm_policy
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
+ check_keys
+ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+ set_keytimes_algorithm_policy
+ check_keytimes
+ check_apex
+ check_subdomain
+ dnssec_verify
+fi
#
# Zone: unsigned.kasp.
@@ -910,28 +911,28 @@ dnssec_verify
# Zone: inherit.kasp.
#
set_zone "inherit.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
set_server "ns3" "10.53.0.3"
# Key properties.
key_clear "KEY1"
set_keyrole "KEY1" "ksk"
set_keylifetime "KEY1" "315360000"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keysigning "KEY1" "yes"
set_zonesigning "KEY1" "no"
key_clear "KEY2"
set_keyrole "KEY2" "zsk"
set_keylifetime "KEY2" "157680000"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
set_keysigning "KEY2" "no"
set_zonesigning "KEY2" "yes"
key_clear "KEY3"
set_keyrole "KEY3" "zsk"
set_keylifetime "KEY3" "31536000"
-set_keyalgorithm "KEY3" "5" "RSASHA1" "2000"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "3072"
set_keysigning "KEY3" "no"
set_zonesigning "KEY3" "yes"
# KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
@@ -963,7 +964,7 @@ dnssec_verify
# Zone: dnssec-keygen.kasp.
#
set_zone "dnssec-keygen.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
@@ -979,7 +980,7 @@ dnssec_verify
# Zone: some-keys.kasp.
#
set_zone "some-keys.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
@@ -997,7 +998,7 @@ dnssec_verify
# There are more pregenerated keys than needed, hence the number of keys is
# six, not three.
set_zone "pregenerated.kasp"
-set_policy "rsasha1" "6" "1234"
+set_policy "rsasha256" "6" "1234"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
@@ -1014,7 +1015,7 @@ dnssec_verify
#
# There are three keys in rumoured state.
set_zone "rumoured.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
@@ -1040,7 +1041,7 @@ dnssec_verify
# Zone: secondary.kasp.
#
set_zone "secondary.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
@@ -1084,22 +1085,25 @@ status=$((status+ret))
#
# Zone: rsasha1-nsec3.kasp.
#
-set_zone "rsasha1-nsec3.kasp"
-set_policy "rsasha1-nsec3" "3" "1234"
-set_server "ns3" "10.53.0.3"
-# Key properties.
-set_keyalgorithm "KEY1" "7" "NSEC3RSASHA1" "2048"
-set_keyalgorithm "KEY2" "7" "NSEC3RSASHA1" "2048"
-set_keyalgorithm "KEY3" "7" "NSEC3RSASHA1" "2000"
-# Key timings and states same as above.
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+ set_zone "rsasha1-nsec3.kasp"
+ set_policy "rsasha1-nsec3" "3" "1234"
+ set_server "ns3" "10.53.0.3"
+ # Key properties.
+ set_keyalgorithm "KEY1" "7" "NSEC3RSASHA1" "2048"
+ set_keyalgorithm "KEY2" "7" "NSEC3RSASHA1" "2048"
+ set_keyalgorithm "KEY3" "7" "NSEC3RSASHA1" "2000"
+ # Key timings and states same as above.
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-set_keytimes_algorithm_policy
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
+ check_keys
+ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+ set_keytimes_algorithm_policy
+ check_keytimes
+ check_apex
+ check_subdomain
+ dnssec_verify
+fi
#
# Zone: rsasha256.kasp.
@@ -1110,7 +1114,7 @@ set_server "ns3" "10.53.0.3"
# Key properties.
set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
-set_keyalgorithm "KEY3" "8" "RSASHA256" "2000"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "3072"
# Key timings and states same as above.
check_keys
@@ -1130,7 +1134,7 @@ set_server "ns3" "10.53.0.3"
# Key properties.
set_keyalgorithm "KEY1" "10" "RSASHA512" "2048"
set_keyalgorithm "KEY2" "10" "RSASHA512" "2048"
-set_keyalgorithm "KEY3" "10" "RSASHA512" "2000"
+set_keyalgorithm "KEY3" "10" "RSASHA512" "3072"
# Key timings and states same as above.
check_keys
@@ -1370,9 +1374,10 @@ check_rrsig_reuse() {
dig_with_opts "$ZONE" "@${SERVER}" "$_qtype" > "dig.out.$DIR.test$n" || log_error "dig ${ZONE} ${_qtype} failed"
grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"
grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" > "rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
- # If this exact RRSIG is also in the zone file it is not refreshed.
+ # If this exact RRSIG is also in the signed zone file it is not refreshed.
_rrsig=$(awk '{print $5, $6, $7, $8, $9, $10, $11, $12, $13, $14;}' < "rrsig.out.$ZONE.$_qtype")
- grep "${_rrsig}" "${DIR}/${ZONE}.db" > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
+ $CHECKZONE -f raw -F text -s full -o zone.out.${ZONE}.test$n "${ZONE}" "${DIR}/${ZONE}.db.signed" > /dev/null
+ grep "${_rrsig}" zone.out.${ZONE}.test$n > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
done
@@ -1390,8 +1395,10 @@ check_rrsig_reuse() {
dig_with_opts "${_label}.${ZONE}" "@${SERVER}" "$_qtype" > "dig.out.$DIR.test$n" || log_error "dig ${_label}.${ZONE} ${_qtype} failed"
grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"
grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" > "rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
+ # If this exact RRSIG is also in the signed zone file it is not refreshed.
_rrsig=$(awk '{print $5, $6, $7, $8, $9, $10, $11, $12, $13, $14;}' < "rrsig.out.$ZONE.$_qtype")
- grep "${_rrsig}" "${DIR}/${ZONE}.db" > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
+ $CHECKZONE -f raw -F text -s full -o zone.out.${ZONE}.test$n "${ZONE}" "${DIR}/${ZONE}.db.signed" > /dev/null
+ grep "${_rrsig}" zone.out.${ZONE}.test$n > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
done
@@ -1530,14 +1537,14 @@ set_server "ns3" "10.53.0.3"
key_clear "KEY1"
set_keyrole "KEY1" "ksk"
set_keylifetime "KEY1" "16070400"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keysigning "KEY1" "yes"
set_zonesigning "KEY1" "no"
key_clear "KEY2"
set_keyrole "KEY2" "zsk"
set_keylifetime "KEY2" "16070400"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
set_keysigning "KEY2" "no"
set_zonesigning "KEY2" "yes"
# KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
@@ -1882,7 +1889,7 @@ dnssec_verify
# Test with views.
set_zone "example.net"
set_server "ns4" "10.53.0.4"
-TSIG="hmac-sha1:keyforview1:$VIEW1"
+TSIG="$DEFAULT_HMAC:keyforview1:$VIEW1"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example1"
@@ -1909,7 +1916,7 @@ check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
-TSIG="hmac-sha1:keyforview2:$VIEW2"
+TSIG="$DEFAULT_HMAC:keyforview2:$VIEW2"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example2"
@@ -1934,7 +1941,7 @@ check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
-TSIG="hmac-sha1:keyforview3:$VIEW3"
+TSIG="$DEFAULT_HMAC:keyforview3:$VIEW3"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example3"
@@ -3535,6 +3542,34 @@ set_policy "default" "1" "3600"
set_server "ns3" "10.53.0.3"
# TODO (GL #2471).
+# Test dynamic zones that switch to inline-signing.
+set_zone "dynamic2inline.kasp"
+set_policy "default" "1" "3600"
+set_server "ns6" "10.53.0.6"
+# Key properties.
+key_clear "KEY1"
+set_keyrole "KEY1" "csk"
+set_keylifetime "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY1" "yes"
+set_zonesigning "KEY1" "yes"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+# The CSK is rumoured.
+set_keystate "KEY1" "GOAL" "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS" "hidden"
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
#
# Testing algorithm rollover.
#
@@ -3547,20 +3582,20 @@ IretZSK=0
# Zone: step1.algorithm-roll.kasp
#
set_zone "step1.algorithm-roll.kasp"
-set_policy "rsasha1" "2" "3600"
+set_policy "rsasha256" "2" "3600"
set_server "ns6" "10.53.0.6"
# Key properties.
key_clear "KEY1"
set_keyrole "KEY1" "ksk"
set_keylifetime "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keysigning "KEY1" "yes"
set_zonesigning "KEY1" "no"
key_clear "KEY2"
set_keyrole "KEY2" "zsk"
set_keylifetime "KEY2" "0"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
set_keysigning "KEY2" "no"
set_zonesigning "KEY2" "yes"
key_clear "KEY3"
@@ -3601,7 +3636,7 @@ set_server "ns6" "10.53.0.6"
key_clear "KEY1"
set_keyrole "KEY1" "csk"
set_keylifetime "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keysigning "KEY1" "yes"
set_zonesigning "KEY1" "yes"
key_clear "KEY2"
@@ -3802,6 +3837,34 @@ wait_for_done_signing() {
status=$((status+ret))
}
+# Test dynamic zones that switch to inline-signing.
+set_zone "dynamic2inline.kasp"
+set_policy "default" "1" "3600"
+set_server "ns6" "10.53.0.6"
+# Key properties.
+key_clear "KEY1"
+set_keyrole "KEY1" "csk"
+set_keylifetime "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY1" "yes"
+set_zonesigning "KEY1" "yes"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+# The CSK is rumoured.
+set_keystate "KEY1" "GOAL" "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS" "hidden"
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
#
# Testing going insecure.
#
@@ -3969,8 +4032,6 @@ key_clear "KEY4"
# Various signing policy checks.
check_keys
check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-check_apex
-check_subdomain
dnssec_verify
#
@@ -3993,14 +4054,14 @@ set_server "ns6" "10.53.0.6"
key_clear "KEY1"
set_keyrole "KEY1" "ksk"
set_keylifetime "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keysigning "KEY1" "yes"
set_zonesigning "KEY1" "no"
key_clear "KEY2"
set_keyrole "KEY2" "zsk"
set_keylifetime "KEY2" "0"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
set_keysigning "KEY2" "no"
set_zonesigning "KEY2" "yes"
# New ECDSAP256SHA256 keys.
@@ -4395,7 +4456,7 @@ set_server "ns6" "10.53.0.6"
key_clear "KEY1"
set_keyrole "KEY1" "csk"
set_keylifetime "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
set_keysigning "KEY1" "yes"
set_zonesigning "KEY1" "yes"
# New ECDSAP256SHA256 key.
@@ -4725,12 +4786,12 @@ echo_i "Check that restart with zone changes and deleted journal works ($n)"
TSIG=
ret=0
dig_with_opts @10.53.0.6 example SOA > dig.out.ns6.test$n.soa1 || ret=1
-stop_server --use-rndc --port ${CONTROLPORT} kasp ns6
+stop_server --use-rndc --port ${CONTROLPORT} ns6
# TTL of all records change from 300 to 400
cp ns6/example3.db.in ns6/example.db || ret=1
rm ns6/example.db.jnl
nextpart ns6/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} kasp ns6
+start_server --noclean --restart --port ${PORT} ns6
wait_for_log 3 "all zones loaded" ns6/named.run
# Check that the SOA SERIAL increases and check the TTLs (should be changed
# from 300 to 400 as defined in ns6/example3.db.in).
diff --git a/external/mpl/bind/dist/bin/tests/system/keepalive/clean.sh b/external/mpl/bind/dist/bin/tests/system/keepalive/clean.sh
index 07c571137f7..9ccbd121b18 100644
--- a/external/mpl/bind/dist/bin/tests/system/keepalive/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keepalive/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr/18-nonstd-prepub/policy.conf.in b/external/mpl/bind/dist/bin/tests/system/keymgr/18-nonstd-prepub/policy.conf.in
new file mode 100644
index 00000000000..757311af85d
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr/18-nonstd-prepub/policy.conf.in
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+policy default {
+ policy global;
+ algorithm @DEFAULT_ALGORITHM@;
+ pre-publish zsk 2w;
+ roll-period zsk 6mo;
+ coverage 364d;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr/19-old-keys/policy.conf.in b/external/mpl/bind/dist/bin/tests/system/keymgr/19-old-keys/policy.conf.in
new file mode 100644
index 00000000000..757311af85d
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr/19-old-keys/policy.conf.in
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+policy default {
+ policy global;
+ algorithm @DEFAULT_ALGORITHM@;
+ pre-publish zsk 2w;
+ roll-period zsk 6mo;
+ coverage 364d;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr/clean.sh b/external/mpl/bind/dist/bin/tests/system/keymgr/clean.sh
index c63919c9fa8..d8cad324089 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr/clean.sh
@@ -11,8 +11,11 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
+rm -f 18-nonstd-prepub/policy.conf
+rm -f 19-old-keys/policy.conf
rm -f K*.key */K*.key
rm -f K*.private */K*.private
rm -f coverage.* keymgr.* settime.*
rm -f ns*/managed-keys.bind*
+rm -f policy.conf
rm -f policy.out
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr/policy.conf.in b/external/mpl/bind/dist/bin/tests/system/keymgr/policy.conf.in
new file mode 100644
index 00000000000..d6bc92533c4
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr/policy.conf.in
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+policy default {
+ policy global;
+ algorithm @DEFAULT_ALGORITHM@;
+ key-size zsk 1024;
+ pre-publish zsk 6w;
+ post-publish zsk 6w;
+ roll-period zsk 6mo;
+ roll-period ksk 0;
+ coverage 364d;
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr/setup.sh b/external/mpl/bind/dist/bin/tests/system/keymgr/setup.sh
index 32d16e0bde1..d7cef0c0331 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr/setup.sh
@@ -19,117 +19,117 @@ KEYGEN="$KEYGEN -q"
# Test 1: KSK goes inactive before successor is active
dir=01-ksk-inactive
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
$SETTIME -K $dir -I +7mo $ksk1 > /dev/null 2>&1
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
# Test 2: ZSK goes inactive before successor is active
dir=02-zsk-inactive
echo_i "set up $dir"
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
$SETTIME -K $dir -I +7mo $zsk1 > /dev/null 2>&1
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
# Test 3: KSK is unpublished before its successor is published
dir=03-ksk-unpublished
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
$SETTIME -K $dir -D +6mo $ksk1 > /dev/null 2>&1
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
# Test 4: ZSK is unpublished before its successor is published
dir=04-zsk-unpublished
echo_i "set up $dir"
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
$SETTIME -K $dir -D +6mo $zsk1 > /dev/null 2>&1
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
# Test 5: KSK deleted and successor published before KSK is deactivated
# and successor activated.
dir=05-ksk-unpub-active
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
$SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
# Test 6: ZSK deleted and successor published before ZSK is deactivated
# and successor activated.
dir=06-zsk-unpub-active
echo_i "set up $dir"
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
# Test 7: KSK rolled with insufficient delay after prepublication.
dir=07-ksk-ttl
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
$SETTIME -K $dir -P +269d $ksk2 > /dev/null 2>&1
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
# Test 8: ZSK rolled with insufficient delay after prepublication.
dir=08-zsk-ttl
echo_i "set up $dir"
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
# allow only 1 day between publication and activation
$SETTIME -K $dir -P +269d $zsk2 > /dev/null 2>&1
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
# Test 9: No special preparation needed
# Test 10: Valid key set, but rollover period has changed
dir=10-change-roll
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -I +3mo -D +4mo $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
# Test 11: Many keys all simultaneously scheduled to be active in the future
dir=11-many-simul
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -q3fk -P now+1mo -A now+1mo example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
-z2=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
-z3=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
-z4=`$KEYGEN -K $dir -a rsasha1 -q3 -P now+1mo -A now+1mo example.com`
+k1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk -P now+1mo -A now+1mo example.com`
+z1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 -P now+1mo -A now+1mo example.com`
+z2=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 -P now+1mo -A now+1mo example.com`
+z3=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 -P now+1mo -A now+1mo example.com`
+z4=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 -P now+1mo -A now+1mo example.com`
# Test 12: Many keys all simultaneously scheduled to be active in the past
dir=12-many-active
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
-z2=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
-z3=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
-z4=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
+k1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk example.com`
+z1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
+z2=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
+z3=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
+z4=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
# Test 13: Multiple simultaneous keys with no configured roll period
dir=13-noroll
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
-k2=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
-k3=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
+k1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk example.com`
+k2=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk example.com`
+k3=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk example.com`
+z1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
# Test 14: Keys exist but have the wrong algorithm
dir=14-wrongalg
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -qfk example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q example.com`
+k1=`$KEYGEN -K $dir -a ${ALTERNATIVE_ALGORITHM} -qfk example.com`
+z1=`$KEYGEN -K $dir -a ${ALTERNATIVE_ALGORITHM} -q example.com`
$SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
z2=`$KEYGEN -K $dir -q -S ${z1}.key`
$SETTIME -K $dir -I now+1y -D now+14mo $z2 > /dev/null
@@ -140,8 +140,8 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
# Test 15: No zones specified; just search the directory for keys
dir=15-unspec
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
+k1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk example.com`
+z1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
$SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
z2=`$KEYGEN -K $dir -q -S ${z1}.key`
$SETTIME -K $dir -I now+1y -D now+14mo $z2 > /dev/null
@@ -153,8 +153,8 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
# keys have the wrong algorithm for their policies
dir=16-wrongalg-unspec
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -qfk example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q example.com`
+k1=`$KEYGEN -K $dir -a ${ALTERNATIVE_ALGORITHM} -qfk example.com`
+z1=`$KEYGEN -K $dir -a ${ALTERNATIVE_ALGORITHM} -q example.com`
$SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
z2=`$KEYGEN -K $dir -q -S ${z1}.key`
$SETTIME -K $dir -I now+1y -D now+14mo $z2 > /dev/null
@@ -166,23 +166,27 @@ z4=`$KEYGEN -K $dir -q -S ${z3}.key`
# flag (this should fail)
dir=17-noforce
echo_i "set up $dir"
-k1=`$KEYGEN -K $dir -a rsasha1 -q3fk example.com`
-z1=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
-z2=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
-z3=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
-z4=`$KEYGEN -K $dir -a rsasha1 -q3 example.com`
+k1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3fk example.com`
+z1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
+z2=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
+z3=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
+z4=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -q3 example.com`
# Test 18: Prepublication interval is set to a nonstandard value
dir=18-nonstd-prepub
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -I now+2mo -D now+3mo $zsk1 > /dev/null
# Test 19: Key has been published/active a long time
dir=19-old-keys
echo_i "set up $dir"
-ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
-zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
+ksk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3fk example.com`
+zsk1=`$KEYGEN -K $dir -a ${DEFAULT_ALGORITHM} -3 example.com`
$SETTIME -K $dir -P now-2y -A now-2y $ksk1 > /dev/null
$SETTIME -K $dir -P now-2y -A now-2y $zsk1 > /dev/null
+
+copy_setports policy.conf.in policy.conf
+copy_setports 18-nonstd-prepub/policy.conf.in 18-nonstd-prepub/policy.conf
+copy_setports 19-old-keys/policy.conf.in 19-old-keys/policy.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/clean.sh b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/clean.sh
index cc4ffe3f8b9..1fe2bb946d5 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/clean.sh
@@ -30,4 +30,5 @@ rm -f ./python.out.*
rm -f ./retired.*
rm -f ./rndc.dnssec.*
rm -f ./unused.key*
+rm -f ./verify.out.*
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in
index d43b62953c4..0dae201728c 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in
@@ -63,15 +63,15 @@ dnssec-policy "migrate-nomatch-algnum" {
};
/*
- * This policy tests migration from existing keys with 1024 bits RSASHA1 keys
- * to 2048 bits RSASHA1 keys.
+ * This policy tests migration from existing keys with 2048 bits RSASHA256 keys
+ * to 3072 bits RSASHA256 keys.
*/
dnssec-policy "migrate-nomatch-alglen" {
dnskey-ttl 300;
keys {
- ksk key-directory lifetime unlimited algorithm rsasha1 2048;
- zsk key-directory lifetime P60D algorithm rsasha1 2048;
+ ksk key-directory lifetime unlimited algorithm rsasha256 3072;
+ zsk key-directory lifetime P60D algorithm rsasha256 3072;
};
// Together 12h
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/setup.sh b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/setup.sh
index 4378a46b4cc..6c1d0a5dcce 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/setup.sh
@@ -62,7 +62,7 @@ $SIGNER -S -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this
# time the existing keys do not match the policy. The existing keys are
-# RSASHA1 keys, and will be migrated to a dnssec-policy that dictates
+# RSASHA256 keys, and will be migrated to a dnssec-policy that dictates
# ECDSAP256SHA256 keys.
setup migrate-nomatch-algnum.kasp
echo "$zone" >> zones
@@ -71,8 +71,8 @@ Tkey="now-3900s" # DNSKEY TTL + propagation delay
Tsig="now-12h" # Zone's maximum TTL + propagation delay
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
zsktimes="-P ${Tkey} -A ${Tsig}"
-KSK=$($KEYGEN -a RSASHA1 -b 2048 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
+KSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone 5 "$KSK" >> "$infile"
private_type_record $zone 5 "$ZSK" >> "$infile"
@@ -80,8 +80,8 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this
# time the existing keys do not match the policy. The existing keys are
-# 1024 bits RSASHA1 keys, and will be migrated to a dnssec-policy that
-# dictates 2048 bits RSASHA1 keys.
+# 2048 bits RSASHA256 keys, and will be migrated to a dnssec-policy that
+# dictates 3072 bits RSASHA256 keys.
setup migrate-nomatch-alglen.kasp
echo "$zone" >> zones
Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
@@ -89,8 +89,8 @@ Tkey="now-3900s" # DNSKEY TTL + propagation delay
Tsig="now-12h" # Zone's maximum TTL + propagation delay
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
zsktimes="-P ${Tkey} -A ${Tsig}"
-KSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
+KSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
private_type_record $zone 5 "$KSK" >> "$infile"
private_type_record $zone 5 "$ZSK" >> "$infile"
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named.conf.in b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named.conf.in
index 701c0f7ea64..e478404eefa 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named.conf.in
@@ -36,12 +36,12 @@ controls {
};
key "external" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
};
key "internal" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
};
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named2.conf.in b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
index 46165376bc6..538aedcbe2d 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
@@ -37,7 +37,7 @@ controls {
dnssec-policy "rsasha256" {
keys {
- zsk key-directory lifetime P3M algorithm 8 1024;
+ zsk key-directory lifetime P3M algorithm 8 2048;
ksk key-directory lifetime P1Y algorithm 8 2048;
};
@@ -57,12 +57,12 @@ dnssec-policy "rsasha256" {
};
key "external" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
};
key "internal" {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
};
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/setup.sh b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/setup.sh
index b23344c4cbd..63121a06270 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/setup.sh
@@ -33,7 +33,7 @@ echo "$zone" >> zones
ksktimes="-P -186d -A -186d -P sync -186d"
zsktimes="-P -186d -A -186d"
KSK=$($KEYGEN -a $algo -L 300 -b 2048 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $algo -L 300 -b 1024 $zsktimes $zone 2> keygen.out.$zone.2)
+ZSK=$($KEYGEN -a $algo -L 300 -b 2048 $zsktimes $zone 2> keygen.out.$zone.2)
echo_i "setting up zone $zone (external)"
view="ext"
diff --git a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/tests.sh b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/tests.sh
index a75dd806390..62b58a7d781 100644
--- a/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/keymgr2kasp/tests.sh
@@ -278,7 +278,7 @@ set_zone "migrate-nomatch-algnum.kasp"
set_policy "none" "2" "300"
set_server "ns3" "10.53.0.3"
-init_migration_keys "5" "RSASHA1" "2048" "1024"
+init_migration_keys "8" "RSASHA256" "2048" "2048"
init_migration_states "omnipresent" "omnipresent"
# Make sure the zone is signed with legacy keys.
@@ -315,7 +315,7 @@ set_zone "migrate-nomatch-alglen.kasp"
set_policy "none" "2" "300"
set_server "ns3" "10.53.0.3"
-init_migration_keys "5" "RSASHA1" "1024" "1024"
+init_migration_keys "8" "RSASHA256" "2048" "2048"
init_migration_states "omnipresent" "omnipresent"
# Make sure the zone is signed with legacy keys.
@@ -567,7 +567,7 @@ set_policy "migrate-nomatch-algnum" "4" "300"
set_server "ns3" "10.53.0.3"
# The legacy keys need to be retired, but otherwise stay present until the
# new keys are omnipresent, and can be used to construct a chain of trust.
-init_migration_keys "5" "RSASHA1" "2048" "1024"
+init_migration_keys "8" "RSASHA256" "2048" "2048"
init_migration_states "hidden" "omnipresent"
key_set "KEY1" "LEGACY" "no"
key_set "KEY2" "LEGACY" "no"
@@ -683,20 +683,20 @@ set_server "ns3" "10.53.0.3"
# The legacy keys need to be retired, but otherwise stay present until the
# new keys are omnipresent, and can be used to construct a chain of trust.
-init_migration_keys "5" "RSASHA1" "1024" "1024"
+init_migration_keys "8" "RSASHA256" "2048" "2048"
init_migration_states "hidden" "omnipresent"
key_set "KEY1" "LEGACY" "no"
key_set "KEY2" "LEGACY" "no"
set_keyrole "KEY3" "ksk"
set_keylifetime "KEY3" "0"
-set_keyalgorithm "KEY3" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "3072"
set_keysigning "KEY3" "yes"
set_zonesigning "KEY3" "no"
set_keyrole "KEY4" "zsk"
set_keylifetime "KEY4" "5184000"
-set_keyalgorithm "KEY4" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY4" "8" "RSASHA256" "3072"
set_keysigning "KEY4" "no"
# This key is considered to be prepublished, so it is not yet signing.
set_zonesigning "KEY4" "no"
@@ -956,8 +956,8 @@ set_policy "rsasha256" "2" "300"
set_server "ns4" "10.53.0.4"
init_view_migration
set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
-set_keyalgorithm "KEY2" "8" "RSASHA256" "1024"
-TSIG="hmac-sha1:external:$VIEW1"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
+TSIG="$DEFAULT_HMAC:external:$VIEW1"
wait_for_nsec
# Make sure the zone is signed with legacy keys.
check_keys
@@ -986,8 +986,8 @@ set_policy "rsasha256" "2" "300"
set_server "ns4" "10.53.0.4"
init_view_migration
set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
-set_keyalgorithm "KEY2" "8" "RSASHA256" "1024"
-TSIG="hmac-sha1:internal:$VIEW2"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
+TSIG="$DEFAULT_HMAC:internal:$VIEW2"
wait_for_nsec
# Make sure the zone is signed with legacy keys.
check_keys
@@ -1026,7 +1026,7 @@ echo_i "${time_passed} seconds passed between start of tests and reconfig"
set_zone "view-rsasha256.kasp"
set_policy "rsasha256" "3" "300"
set_server "ns4" "10.53.0.4"
-init_migration_keys "8" "RSASHA256" "2048" "1024"
+init_migration_keys "8" "RSASHA256" "2048" "2048"
init_migration_states "omnipresent" "rumoured"
# Key properties, timings and metadata should be the same as legacy keys above.
# However, because the keys have a lifetime, kasp will set the retired time.
@@ -1045,14 +1045,14 @@ set_keystate "KEY2" "GOAL" "hidden"
set_keystate "KEY3" "GOAL" "omnipresent"
set_keyrole "KEY3" "zsk"
set_keylifetime "KEY3" "8035200"
-set_keyalgorithm "KEY3" "8" "RSASHA256" "1024"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "2048"
set_keysigning "KEY3" "no"
set_zonesigning "KEY3" "no" # not yet
set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
# Various signing policy checks (external).
-TSIG="hmac-sha1:external:$VIEW1"
+TSIG="$DEFAULT_HMAC:external:$VIEW1"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "ext"
@@ -1113,7 +1113,7 @@ check_apex
dnssec_verify
# Various signing policy checks (internal).
-TSIG="hmac-sha1:internal:$VIEW2"
+TSIG="$DEFAULT_HMAC:internal:$VIEW2"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "int"
diff --git a/external/mpl/bind/dist/bin/tests/system/legacy/clean.sh b/external/mpl/bind/dist/bin/tests/system/legacy/clean.sh
index 4a077bb8c71..4c65a2da260 100644
--- a/external/mpl/bind/dist/bin/tests/system/legacy/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/legacy/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/legacy/tests.sh b/external/mpl/bind/dist/bin/tests/system/legacy/tests.sh
index ea7d5813fce..13e7b97f27f 100755
--- a/external/mpl/bind/dist/bin/tests/system/legacy/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/legacy/tests.sh
@@ -255,9 +255,9 @@ fi
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} legacy ns1
+stop_server --use-rndc --port ${CONTROLPORT} ns1
copy_setports ns1/named2.conf.in ns1/named.conf
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} legacy ns1
+start_server --noclean --restart --port ${PORT} ns1
n=`expr $n + 1`
echo_i "checking recursive lookup to edns 512 + no tcp + trust anchor fails ($n)"
diff --git a/external/mpl/bind/dist/bin/tests/system/logfileconfig/tests.sh b/external/mpl/bind/dist/bin/tests/system/logfileconfig/tests.sh
index cd478375185..c36fca946d9 100644
--- a/external/mpl/bind/dist/bin/tests/system/logfileconfig/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/logfileconfig/tests.sh
@@ -162,7 +162,7 @@ fi
# files while controlling the stop/start of the server.
# Have to stop the stock server because it uses "-g"
#
-$PERL ../../stop.pl logfileconfig ns1
+stop_server ns1
$myNAMED > /dev/null 2>&1
@@ -272,7 +272,7 @@ n=`expr $n + 1`
echo_i "testing default logfile using named -L file ($n)"
# Now stop the server again and test the -L option
rm -f $DLFILE
-$PERL ../../stop.pl logfileconfig ns1
+stop_server --use-rndc --port ${CONTROLPORT} ns1
if ! test -f $PIDFILE; then
copy_setports $PLAINCONF named.conf
$myNAMED -L $DLFILE > /dev/null 2>&1
diff --git a/external/mpl/bind/dist/bin/tests/system/masterformat/tests.sh b/external/mpl/bind/dist/bin/tests/system/masterformat/tests.sh
index 20986e38f67..d78cf37633e 100755
--- a/external/mpl/bind/dist/bin/tests/system/masterformat/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/masterformat/tests.sh
@@ -83,7 +83,7 @@ stomp () {
restart () {
sleep 1
- $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "${PORT}" masterformat ns3
+ start_server --noclean --restart --port "${PORT}" ns3
}
dig_with_opts() {
@@ -237,7 +237,7 @@ grep "added text" "dig.out.dynamic1.ns3.test$n" > /dev/null 2>&1 || ret=1
dig_with_opts +comm @10.53.0.3 added.dynamic txt > "dig.out.dynamic2.ns3.test$n"
grep "NXDOMAIN" "dig.out.dynamic2.ns3.test$n" > /dev/null 2>&1 || ret=1
# using "rndc halt" ensures that we don't dump the zone file
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} masterformat ns3
+stop_server --use-rndc --halt --port ${CONTROLPORT} ns3
restart
check_added_text() {
dig_with_opts @10.53.0.3 newtext.dynamic txt > "dig.out.dynamic3.ns3.test$n" || return 1
@@ -262,7 +262,7 @@ END
dig_with_opts @10.53.0.3 moretext.dynamic txt > "dig.out.dynamic1.ns3.test$n"
grep "more text" "dig.out.dynamic1.ns3.test$n" > /dev/null 2>&1 || ret=1
# using "rndc stop" will cause the zone file to flush before shutdown
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} masterformat ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
rm ns3/*.jnl
restart
#shellcheck disable=SC2034
diff --git a/external/mpl/bind/dist/bin/tests/system/metadata/setup.sh b/external/mpl/bind/dist/bin/tests/system/metadata/setup.sh
index fbaadbe5cf2..fd9ac603134 100644
--- a/external/mpl/bind/dist/bin/tests/system/metadata/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/metadata/setup.sh
@@ -20,42 +20,42 @@ czone=child.parent.nil
echo_i "generating keys"
# active zsk
-zsk=`$KEYGEN -q -a rsasha1 $czone`
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $czone)
echo $zsk > zsk.key
# not yet published or active
-pending=`$KEYGEN -q -a rsasha1 -P none -A none $czone`
+pending=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P none -A none $czone)
echo $pending > pending.key
# published but not active
-standby=`$KEYGEN -q -a rsasha1 -A none $czone`
+standby=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A none $czone)
echo $standby > standby.key
# inactive
-inact=`$KEYGEN -q -a rsasha1 -P now-24h -A now-24h -I now $czone`
+inact=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P now-24h -A now-24h -I now $czone)
echo $inact > inact.key
# active ksk
-ksk=`$KEYGEN -q -a rsasha1 -fk $czone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
echo $ksk > ksk.key
# published but not YET active; will be active in 15 seconds
-rolling=`$KEYGEN -q -a rsasha1 -fk $czone`
+rolling=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
$SETTIME -A now+15s $rolling > /dev/null
echo $rolling > rolling.key
# revoked
-revoke1=`$KEYGEN -q -a rsasha1 -fk $czone`
+revoke1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
echo $revoke1 > prerev.key
-revoke2=`$REVOKE $revoke1`
+revoke2=$($REVOKE $revoke1)
echo $revoke2 | sed -e 's#\./##' -e "s/\.key.*$//" > postrev.key
-pzsk=`$KEYGEN -q -a rsasha1 $pzone`
+pzsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $pzone)
echo $pzsk > parent.zsk.key
-pksk=`$KEYGEN -q -a rsasha1 -fk $pzone`
+pksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $pzone)
echo $pksk > parent.ksk.key
-oldstyle=`$KEYGEN -Cq -a rsasha1 $pzone`
+oldstyle=$($KEYGEN -Cq -a ${DEFAULT_ALGORITHM} $pzone)
echo $oldstyle > oldstyle.key
diff --git a/external/mpl/bind/dist/bin/tests/system/metadata/tests.sh b/external/mpl/bind/dist/bin/tests/system/metadata/tests.sh
index aa0206751c7..626559de910 100644
--- a/external/mpl/bind/dist/bin/tests/system/metadata/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/metadata/tests.sh
@@ -20,7 +20,7 @@ status=0
n=1
echo_i "setting key timers"
-$SETTIME -A now+15s `cat rolling.key` > /dev/null
+$SETTIME -A now+15s $(cat rolling.key) > /dev/null
inact=$(keyfile_to_key_id "$(cat inact.key)")
ksk=$(keyfile_to_key_id "$(cat ksk.key)")
@@ -56,62 +56,62 @@ echo_i "checking that KSK signed DNSKEY only ($n)"
ret=0
grep "DNSKEY $ksk"'$' sigs > /dev/null || ret=1
grep "SOA $ksk"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that ZSK signed ($n)"
ret=0
grep "SOA $zsk"'$' sigs > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that standby ZSK did not sign ($n)"
ret=0
grep " $standby"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that inactive key did not sign ($n)"
ret=0
grep " $inact"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that pending key was not published ($n)"
ret=0
grep " $pending"'$' keys > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that standby KSK did not sign but is delegated ($n)"
ret=0
grep " $rolling"'$' sigs > /dev/null && ret=1
grep " $rolling"'$' keys > /dev/null || ret=1
-egrep "DS[ ]*$rolling[ ]" ${pfile}.signed > /dev/null || ret=1
-n=`expr $n + 1`
+grep -E "DS[ ]*$rolling[ ]" ${pfile}.signed > /dev/null || ret=1
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that key was revoked ($n)"
ret=0
grep " $prerev"'$' keys > /dev/null && ret=1
grep " $postrev"'$' keys > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking that revoked key self-signed ($n)"
ret=0
grep "DNSKEY $postrev"'$' sigs > /dev/null || ret=1
grep "SOA $postrev"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "waiting 20 seconds for key changes to occur"
sleep 20
@@ -122,92 +122,92 @@ $SIGNER -Sg -o $czone -f ${cfile}.new ${cfile}.signed > /dev/null
echo_i "checking that standby KSK is now active ($n)"
ret=0
grep "DNSKEY $rolling"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking update of an old-style key ($n)"
ret=0
# printing metadata should not work with an old-style key
-$SETTIME -pall `cat oldstyle.key` > /dev/null 2>&1 && ret=1
-$SETTIME -f `cat oldstyle.key` > /dev/null 2>&1 || ret=1
+$SETTIME -pall $(cat oldstyle.key) > /dev/null 2>&1 && ret=1
+$SETTIME -f $(cat oldstyle.key) > /dev/null 2>&1 || ret=1
# but now it should
-$SETTIME -pall `cat oldstyle.key` > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+$SETTIME -pall $(cat oldstyle.key) > /dev/null 2>&1 || ret=1
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking warning about permissions change on key with dnssec-settime ($n)"
-uname=`uname -o 2> /dev/null`
+uname=$(uname -o 2> /dev/null)
if [ Cygwin = "$uname" ]; then
echo_i "Cygwin detected, skipping"
else
ret=0
# settime should print a warning about changing the permissions
- chmod 644 `cat oldstyle.key`.private
- $SETTIME -P none `cat oldstyle.key` > settime1.test$n 2>&1 || ret=1
+ chmod 644 $(cat oldstyle.key).private
+ $SETTIME -P none $(cat oldstyle.key) > settime1.test$n 2>&1 || ret=1
grep "warning: Permissions on the file.*have changed" settime1.test$n > /dev/null 2>&1 || ret=1
- $SETTIME -P none `cat oldstyle.key` > settime2.test$n 2>&1 || ret=1
+ $SETTIME -P none $(cat oldstyle.key) > settime2.test$n 2>&1 || ret=1
grep "warning: Permissions on the file.*have changed" settime2.test$n > /dev/null 2>&1 && ret=1
- n=`expr $n + 1`
+ n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
echo_i "checking warning about delete date < inactive date with dnssec-settime ($n)"
ret=0
# settime should print a warning about delete < inactive
-$SETTIME -I now+15s -D now `cat oldstyle.key` > tmp.out 2>&1 || ret=1
+$SETTIME -I now+15s -D now $(cat oldstyle.key) > tmp.out 2>&1 || ret=1
grep "warning" tmp.out > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking no warning about delete date < inactive date with dnssec-settime when delete date is unset ($n)"
ret=0
-$SETTIME -D none `cat oldstyle.key` > tmp.out 2>&1 || ret=1
-$SETTIME -p all `cat oldstyle.key` > tmp.out 2>&1 || ret=1
+$SETTIME -D none $(cat oldstyle.key) > tmp.out 2>&1 || ret=1
+$SETTIME -p all $(cat oldstyle.key) > tmp.out 2>&1 || ret=1
grep "warning" tmp.out > /dev/null 2>&1 && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking warning about delete date < inactive date with dnssec-keygen ($n)"
ret=0
# keygen should print a warning about delete < inactive
-$KEYGEN -q -a rsasha1 -I now+15s -D now $czone > tmp.out 2>&1 || ret=1
+$KEYGEN -q -a ${DEFAULT_ALGORITHM} -I now+15s -D now $czone > tmp.out 2>&1 || ret=1
grep "warning" tmp.out > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking correct behavior setting activation without publication date ($n)"
ret=0
-key=`$KEYGEN -q -a rsasha1 -A +1w $czone`
-pub=`$SETTIME -upP $key | awk '{print $2}'`
-act=`$SETTIME -upA $key | awk '{print $2}'`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A +1w $czone)
+pub=$($SETTIME -upP $key | awk '{print $2}')
+act=$($SETTIME -upA $key | awk '{print $2}')
[ $pub -eq $act ] || ret=1
-key=`$KEYGEN -q -a rsasha1 -A +1w -i 1d $czone`
-pub=`$SETTIME -upP $key | awk '{print $2}'`
-act=`$SETTIME -upA $key | awk '{print $2}'`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A +1w -i 1d $czone)
+pub=$($SETTIME -upP $key | awk '{print $2}')
+act=$($SETTIME -upA $key | awk '{print $2}')
[ $pub -lt $act ] || ret=1
-key=`$KEYGEN -q -a rsasha1 -A +1w -P never $czone`
-pub=`$SETTIME -upP $key | awk '{print $2}'`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A +1w -P never $czone)
+pub=$($SETTIME -upP $key | awk '{print $2}')
[ $pub = "UNSET" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking calculation of dates for a successor key ($n)"
ret=0
-oldkey=`$KEYGEN -a RSASHA1 -q $czone`
-newkey=`$KEYGEN -a RSASHA1 -q $czone`
+oldkey=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $czone)
+newkey=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $czone)
$SETTIME -A -2d -I +2d $oldkey > settime1.test$n 2>&1 || ret=1
$SETTIME -i 1d -S $oldkey $newkey > settime2.test$n 2>&1 || ret=1
$SETTIME -pA $newkey | grep "1970" > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/mirror/clean.sh b/external/mpl/bind/dist/bin/tests/system/mirror/clean.sh
index d6fdc11bc79..2e0218351b1 100644
--- a/external/mpl/bind/dist/bin/tests/system/mirror/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mirror/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/mirror/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/mirror/ns1/sign.sh
index 29b993c3036..c3affbf6857 100644
--- a/external/mpl/bind/dist/bin/tests/system/mirror/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mirror/ns1/sign.sh
@@ -22,8 +22,8 @@ zone=.
infile=root.db.in
zonefile=root.db
-keyname1=`$KEYGEN -a RSASHA256 -f KSK $zone 2> /dev/null`
-keyname2=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -f KSK $zone 2> /dev/null)
+keyname2=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/mirror/ns2/sign.sh b/external/mpl/bind/dist/bin/tests/system/mirror/ns2/sign.sh
index 6981f3c6959..2c48f22c868 100644
--- a/external/mpl/bind/dist/bin/tests/system/mirror/ns2/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mirror/ns2/sign.sh
@@ -21,8 +21,8 @@ for zonename in sub.example example initially-unavailable; do
infile=$zonename.db.in
zonefile=$zonename.db
- keyname1=`$KEYGEN -a RSASHA256 -f KSK $zone 2> /dev/null`
- keyname2=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+ keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -f KSK $zone 2> /dev/null)
+ keyname2=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
@@ -40,23 +40,23 @@ zone=verify-csk
infile=verify.db.in
zonefile=verify-csk.db
-keyname=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
cat $infile $keyname.key > $zonefile
$SIGNER -P -o $zone $zonefile > /dev/null
keys_to_trust="$keys_to_trust $keyname"
# Prepare remaining zones used in the test.
-ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' verify.db.in`
-UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
-UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`
+ORIGINAL_SERIAL=$(awk '$2 == "SOA" {print $5}' verify.db.in)
+UPDATED_SERIAL_BAD=$((ORIGINAL_SERIAL + 1))
+UPDATED_SERIAL_GOOD=$((ORIGINAL_SERIAL + 2))
for variant in addzone axfr ixfr load reconfig untrusted; do
zone=verify-$variant
infile=verify.db.in
zonefile=verify-$variant.db
- keyname1=`$KEYGEN -a RSASHA256 -f KSK $zone 2> /dev/null`
- keyname2=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+ keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -f KSK $zone 2> /dev/null)
+ keyname2=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/mirror/tests.sh b/external/mpl/bind/dist/bin/tests/system/mirror/tests.sh
index 1e40a39b878..c93c58d99f4 100644
--- a/external/mpl/bind/dist/bin/tests/system/mirror/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mirror/tests.sh
@@ -70,11 +70,11 @@ reload_zone() {
status=0
n=0
-ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' ns2/verify.db.in`
-UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
-UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`
+ORIGINAL_SERIAL=$(awk '$2 == "SOA" {print $5}' ns2/verify.db.in)
+UPDATED_SERIAL_BAD=$((ORIGINAL_SERIAL + 1))
+UPDATED_SERIAL_GOOD=$((ORIGINAL_SERIAL + 2))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that an unsigned mirror zone is rejected ($n)"
ret=0
wait_for_transfer verify-unsigned
@@ -84,9 +84,9 @@ grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
nextpartpeek ns3/named.run | grep "verify-unsigned.*Zone contains no DNSSEC keys" > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-unsigned.*mirror zone is now in use" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that a mirror zone signed using an untrusted key is rejected ($n)"
ret=0
nextpartreset ns3/named.run
@@ -97,9 +97,9 @@ grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
nextpartpeek ns3/named.run | grep "verify-untrusted.*No trusted DNSKEY found" > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-untrusted.*mirror zone is now in use" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that a mirror zone signed using a CSK without the SEP bit set is accepted ($n)"
ret=0
nextpartreset ns3/named.run
@@ -109,9 +109,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-csk.*mirror zone is now in use" > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that an AXFR of an incorrectly signed mirror zone is rejected ($n)"
ret=0
nextpartreset ns3/named.run
@@ -119,12 +119,12 @@ wait_for_transfer verify-axfr
$DIG $DIGOPTS @10.53.0.3 +norec verify-axfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-axfr SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-axfr SOA" > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-axfr.*mirror zone is now in use" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that an AXFR of an updated, correctly signed mirror zone is accepted ($n)"
ret=0
nextpart ns3/named.run > /dev/null
@@ -137,9 +137,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-axfr.*mirror zone is now in use" > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that an IXFR of an incorrectly signed mirror zone is rejected ($n)"
nextpartreset ns3/named.run
ret=0
@@ -160,7 +160,7 @@ cp ns2/verify-ixfr.db.signed.jnl ns3/verify-journal.db.bad.mirror.jnl
$RNDCCMD 10.53.0.3 refresh verify-ixfr > /dev/null 2>&1
wait_for_transfer verify-ixfr
# Ensure the transfer was incremental as expected.
-if [ `nextpartpeek ns3/named.run | grep "verify-ixfr.*got incremental response" | wc -l` -eq 0 ]; then
+if [ $(nextpartpeek ns3/named.run | grep "verify-ixfr.*got incremental response" | wc -l) -eq 0 ]; then
echo_i "failed: did not get an incremental response"
ret=1
fi
@@ -170,14 +170,14 @@ $DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret
# zone should have been successfully verified.
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-ixfr SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-ixfr SOA" > /dev/null || ret=1
# Despite the verification failure for this IXFR, this mirror zone should still
# be in use as its previous version should have been verified successfully.
nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is no longer in use" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that an IXFR of an updated, correctly signed mirror zone is accepted after AXFR failover ($n)"
ret=0
nextpart ns3/named.run > /dev/null
@@ -200,9 +200,9 @@ grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
# already be in use before this test case is checked.
nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that loading an incorrectly signed mirror zone from disk fails ($n)"
ret=0
nextpartreset ns3/named.run
@@ -210,38 +210,38 @@ wait_for_load verify-load ${UPDATED_SERIAL_BAD} ns3/named.run
$DIG $DIGOPTS @10.53.0.3 +norec verify-load SOA > dig.out.ns3.test$n 2>&1 || ret=1
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-load SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-load SOA" > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "ensuring trust anchor telemetry queries are sent upstream for a mirror zone ($n)"
ret=0
# ns3 is started with "-T tat=3", so TAT queries should have already been sent.
grep "_ta-[-0-9a-f]*/NULL" ns1/named.run > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that loading a correctly signed mirror zone from disk succeeds ($n)"
ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
cat ns2/verify-load.db.good.signed > ns3/verify-load.db.mirror
nextpart ns3/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
wait_for_load verify-load ${UPDATED_SERIAL_GOOD} ns3/named.run
$DIG $DIGOPTS @10.53.0.3 +norec verify-load SOA > dig.out.ns3.test$n 2>&1 || ret=1
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that loading a journal for an incorrectly signed mirror zone fails ($n)"
ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
cp ns3/verify-journal.db.mirror ns3/verify-ixfr.db.mirror
cp ns3/verify-journal.db.bad.mirror.jnl ns3/verify-ixfr.db.mirror.jnl
# Temporarily disable transfers of the "verify-ixfr" zone on ns2. This is
@@ -256,12 +256,12 @@ sed '/^zone "verify-ixfr" {$/,/^};$/ {
mv ns2/named.conf.modified ns2/named.conf
rndc_reconfig ns2 10.53.0.2
nextpart ns3/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
wait_for_load verify-ixfr ${UPDATED_SERIAL_BAD} ns3/named.run
$DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-ixfr SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-ixfr SOA" > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null && ret=1
# Restore transfers for the "verify-ixfr" zone on ns2.
# (NOTE: Keep the embedded newline in the sed function list below.)
@@ -271,25 +271,25 @@ sed '/^zone "verify-ixfr" {$/,/^};$/ {
mv ns2/named.conf.modified ns2/named.conf
rndc_reconfig ns2 10.53.0.2
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that loading a journal for a correctly signed mirror zone succeeds ($n)"
ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
cp ns3/verify-journal.db.mirror ns3/verify-ixfr.db.mirror
cp ns3/verify-journal.db.good.mirror.jnl ns3/verify-ixfr.db.mirror.jnl
nextpart ns3/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
wait_for_load verify-ixfr ${UPDATED_SERIAL_GOOD} ns3/named.run
$DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking delegations sourced from a mirror zone ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 foo.example A +norec > dig.out.ns3.test$n 2>&1 || ret=1
@@ -302,9 +302,9 @@ grep "example.*IN.*NS" dig.out.ns3.test$n > /dev/null || ret=1
grep "example.*IN.*DS" dig.out.ns3.test$n > /dev/null || ret=1
grep "ns2.example.*A.*10.53.0.2" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that resolution involving a mirror zone works as expected ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 foo.example A > dig.out.ns3.test$n 2>&1 || ret=1
@@ -314,9 +314,9 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
# Ensure ns1 was not queried.
grep "query 'foo.example/A/IN'" ns1/named.run > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that non-recursive queries for names below mirror zone get responded from cache ($n)"
ret=0
# Issue a non-recursive query for an RRset which is expected to be in cache.
@@ -328,9 +328,9 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
grep "foo.example.*IN.*A.*127.0.0.1" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that delegations from cache which improve mirror zone delegations are properly handled ($n)"
ret=0
# First, issue a recursive query in order to cache an RRset which is not within
@@ -349,9 +349,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n.2 > /dev/null || ret=1
grep "sub.example.*IN.*NS" dig.out.ns3.test$n.2 > /dev/null || ret=1
grep "sub.example.*IN.*DS" dig.out.ns3.test$n.2 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking flags set in a DNSKEY response sourced from a mirror zone ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 . DNSKEY > dig.out.ns3.test$n 2>&1 || ret=1
@@ -360,9 +360,9 @@ grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking flags set in a SOA response sourced from a mirror zone ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 . SOA > dig.out.ns3.test$n 2>&1 || ret=1
@@ -371,9 +371,9 @@ grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that resolution succeeds with unavailable mirror zone data ($n)"
ret=0
wait_for_transfer initially-unavailable
@@ -404,9 +404,9 @@ grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null || ret=1
# Ensure the authoritative server was not queried.
nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that resolution succeeds with expired mirror zone data ($n)"
ret=0
# Reconfigure ns2 so that the zone from the previous test can no longer be
@@ -418,10 +418,10 @@ mv ns2/named.conf.modified ns2/named.conf
rndc_reconfig ns2 10.53.0.2
# Stop ns3, update the timestamp of the zone file to one far in the past, then
# restart ns3.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
touch -t 200001010000 ns3/initially-unavailable.db.mirror
nextpart ns3/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
# Ensure named attempts to retransfer the zone due to its expiry.
wait_for_transfer initially-unavailable
# Ensure the expected messages were logged.
@@ -435,9 +435,9 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
# Sanity check: the authoritative server should have been queried.
nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that clients without cache access cannot retrieve mirror zone data ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 -b 10.53.0.3 +norec . SOA > dig.out.ns3.test$n 2>&1 || ret=1
@@ -445,32 +445,32 @@ $DIG $DIGOPTS @10.53.0.3 -b 10.53.0.3 +norec . SOA > dig.out.ns3.test$n 2>&1 ||
grep "REFUSED" dig.out.ns3.test$n > /dev/null || ret=1
grep "flags:.* ad" dig.out.ns3.test$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that outgoing transfers of mirror zones are disabled by default ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 . AXFR > dig.out.ns3.test$n 2>&1 || ret=1
grep "; Transfer failed" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that notifies are disabled by default for mirror zones ($n)"
ret=0
grep "initially-unavailable.*sending notifies" ns3/named.run > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking output of \"rndc zonestatus\" for a mirror zone ($n)"
ret=0
$RNDCCMD 10.53.0.3 zonestatus . > rndc.out.ns3.test$n 2>&1
grep "type: mirror" rndc.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that \"rndc reconfig\" properly handles a mirror -> secondary zone type change ($n)"
ret=0
# Sanity check before we start.
@@ -495,9 +495,9 @@ grep "NOERROR" dig.out.ns3.test$n.2 > /dev/null || ret=1
grep "flags:.* aa" dig.out.ns3.test$n.2 > /dev/null || ret=1
grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that \"rndc reconfig\" properly handles a secondary -> mirror zone type change ($n)"
ret=0
# Put an incorrectly signed version of the zone in the zone file used by ns3.
@@ -514,11 +514,11 @@ rndc_reconfig ns3 10.53.0.3
wait_for_load verify-reconfig ${UPDATED_SERIAL_BAD} ns3/named.run
$DIG $DIGOPTS @10.53.0.3 +norec verify-reconfig SOA > dig.out.ns3.test$n 2>&1 || ret=1
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpart ns3/named.run | grep "No correct RSASHA256 signature for verify-reconfig SOA" > /dev/null || ret=1
+nextpart ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-reconfig SOA" > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that a mirror zone can be added using rndc ($n)"
ret=0
# Sanity check: the zone should not exist in the root zone.
@@ -536,9 +536,9 @@ grep "NOERROR" dig.out.ns3.test$n.2 > /dev/null || ret=1
grep "flags:.* aa" dig.out.ns3.test$n.2 > /dev/null && ret=1
grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "checking that a mirror zone can be deleted using rndc ($n)"
ret=0
# Remove the mirror zone added in the previous test.
@@ -551,7 +551,7 @@ grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/mkeys/clean.sh b/external/mpl/bind/dist/bin/tests/system/mkeys/clean.sh
index 677e09715aa..102cb3710f7 100644
--- a/external/mpl/bind/dist/bin/tests/system/mkeys/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mkeys/clean.sh
@@ -15,6 +15,7 @@ rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
rm -f */managed-keys.bind* */named.secroots
rm -f */named.conf
+rm -f ns3/broken.conf
rm -f */named.memstats */named.run */named.run.prev
rm -f dig.out* delv.out* rndc.out* signer.out*
rm -f dsset-. ns1/dsset-.
diff --git a/external/mpl/bind/dist/bin/tests/system/mkeys/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/mkeys/ns1/sign.sh
index 5a89cd049fb..908429f7aca 100644
--- a/external/mpl/bind/dist/bin/tests/system/mkeys/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mkeys/ns1/sign.sh
@@ -17,8 +17,8 @@ SYSTEMTESTTOP=../..
zone=.
zonefile=root.db
-keyname=`$KEYGEN -a rsasha256 -qfk $zone`
-zskkeyname=`$KEYGEN -a rsasha256 -q $zone`
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk $zone)
+zskkeyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $zone)
$SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null
@@ -28,6 +28,39 @@ cp managed.conf ../ns2/managed.conf
cp managed.conf ../ns4/managed.conf
cp managed.conf ../ns5/managed.conf
+# Configure broken trust anchor for ns3
+# Rotate each nibble in the digest by -1
+$DSFROMKEY $keyname.key |
+awk '!/^; /{
+ printf "trust-anchors {\n"
+ printf "\t\""$1"\" initial-ds "
+ printf $4 " " $5 " " $6 " \""
+ for (i=7; i<=NF; i++) {
+ # rotate digest
+ digest=$i
+ gsub("0", ":", digest)
+ gsub("1", "0", digest)
+ gsub("2", "1", digest)
+ gsub("3", "2", digest)
+ gsub("4", "3", digest)
+ gsub("5", "4", digest)
+ gsub("6", "5", digest)
+ gsub("7", "6", digest)
+ gsub("8", "7", digest)
+ gsub("9", "8", digest)
+ gsub("A", "9", digest)
+ gsub("B", "A", digest)
+ gsub("C", "B", digest)
+ gsub("D", "C", digest)
+ gsub("E", "D", digest)
+ gsub("F", "E", digest)
+ gsub(":", "F", digest)
+ printf digest
+ }
+ printf "\";\n"
+ printf "};\n"
+ }' > ../ns3/broken.conf
+
# Configure a static key to be used by delv.
keyfile_to_static_ds $keyname > trusted.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/mkeys/ns3/named.conf.in b/external/mpl/bind/dist/bin/tests/system/mkeys/ns3/named.conf.in
index 7ad8419a93c..d5e483f2fe1 100644
--- a/external/mpl/bind/dist/bin/tests/system/mkeys/ns3/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/mkeys/ns3/named.conf.in
@@ -42,7 +42,4 @@ zone "." {
file "../../common/root.hint";
};
-# purposely broken key for testing
-trust-anchors {
- "." initial-key 257 3 5 "PURPOSELYBROKEN/xs9iVj7QekClcpzjCf0JrvXW1z07hNMqMm6Q2FtIXMbRgfvTtHF3/ZNvcewT9hpfczC+JACHsQSYYdr7UI8oe4nJfal9+2F3pz4a+HR6CqkgrR6WLWQI1Q==";
-};
+include "broken.conf";
diff --git a/external/mpl/bind/dist/bin/tests/system/mkeys/ns6/setup.sh b/external/mpl/bind/dist/bin/tests/system/mkeys/ns6/setup.sh
index dd0d979fbca..1bfdc7f0d19 100644
--- a/external/mpl/bind/dist/bin/tests/system/mkeys/ns6/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mkeys/ns6/setup.sh
@@ -17,18 +17,18 @@ SYSTEMTESTTOP=../..
zone=.
zonefile=root.db
-# an RSA key
-rsakey=`$KEYGEN -a rsasha256 -qfk rsasha256.`
+# a key for a trust island
+islandkey=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk island.)
# a key with unsupported algorithm
unsupportedkey=Kunknown.+255+00000
cp unsupported-managed.key "${unsupportedkey}.key"
# root key
-rootkey=`cat ../ns1/managed.key`
+rootkey=$(cat ../ns1/managed.key)
cp "../ns1/${rootkey}.key" .
# Configure the resolving server with an initializing key.
# (We use key-format trust anchors here because otherwise the
# unsupported algorithm test won't work.)
-keyfile_to_initial_keys $unsupportedkey $rsakey $rootkey > managed.conf
+keyfile_to_initial_keys $unsupportedkey $islandkey $rootkey > managed.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/mkeys/setup.sh b/external/mpl/bind/dist/bin/tests/system/mkeys/setup.sh
index bc4520eecdc..6b361de8c7e 100644
--- a/external/mpl/bind/dist/bin/tests/system/mkeys/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mkeys/setup.sh
@@ -12,8 +12,16 @@
# information regarding copyright ownership.
SYSTEMTESTTOP=..
+
+export ALGORITHM_SET="ecc_default"
. $SYSTEMTESTTOP/conf.sh
+# Ensure the selected algorithm set is okay.
+if [ "$ALGORITHM_SET" = "error" ]; then
+ echofail "Algorithm selection failed." >&2
+ exit 1
+fi
+
copy_setports ns1/named1.conf.in ns1/named.conf
copy_setports ns2/named.conf.in ns2/named.conf
copy_setports ns3/named.conf.in ns3/named.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/mkeys/tests.sh b/external/mpl/bind/dist/bin/tests/system/mkeys/tests.sh
index 48127573217..330b37d54c2 100644
--- a/external/mpl/bind/dist/bin/tests/system/mkeys/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/mkeys/tests.sh
@@ -14,6 +14,7 @@
set -e
SYSTEMTESTTOP=..
+export ALGORITHM_SET="ecc_default"
#shellcheck source=conf.sh
. "$SYSTEMTESTTOP/conf.sh"
@@ -134,7 +135,7 @@ status=$((status+ret))
n=$((n+1))
echo_i "check new trust anchor can be added ($n)"
ret=0
-standby1=$($KEYGEN -a rsasha256 -qfk -K ns1 .)
+standby1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk -K ns1 .)
mkeys_loadkeys_on 1 || ret=1
mkeys_refresh_on 2 || ret=1
mkeys_status_on 2 > rndc.out.$n 2>&1 || ret=1
@@ -301,11 +302,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "reinitialize trust anchors, add second key to bind.keys"
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns2
+stop_server --use-rndc --port "${CONTROLPORT}" ns2
rm -f ns2/managed-keys.bind*
keyfile_to_initial_ds ns1/"$original" ns1/"$standby1" > ns2/managed.conf
nextpart ns2/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns2
+start_server --noclean --restart --port "${PORT}" ns2
n=$((n+1))
echo_i "check that no key from bind.keys is marked as an initializing key ($n)"
@@ -317,11 +318,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "reinitialize trust anchors, revert to one key in bind.keys"
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns2
+stop_server --use-rndc --port "${CONTROLPORT}" ns2
rm -f ns2/managed-keys.bind*
mv ns2/managed1.conf ns2/managed.conf
nextpart ns2/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns2
+start_server --noclean --restart --port "${PORT}" ns2
n=$((n+1))
echo_i "check that standby key is now trusted ($n)"
@@ -343,7 +344,7 @@ status=$((status+ret))
n=$((n+1))
echo_i "revoke original key, add new standby ($n)"
ret=0
-standby2=$($KEYGEN -a rsasha256 -qfk -K ns1 .)
+standby2=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk -K ns1 .)
$SETTIME -R now -K ns1 "$original" > /dev/null
mkeys_loadkeys_on 1 || ret=1
mkeys_refresh_on 2 || ret=1
@@ -375,7 +376,7 @@ status=$((status+ret))
n=$((n+1))
echo_i "revoke standby before it is trusted ($n)"
ret=0
-standby3=$($KEYGEN -a rsasha256 -qfk -K ns1 .)
+standby3=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk -K ns1 .)
mkeys_loadkeys_on 1 || ret=1
mkeys_refresh_on 2 || ret=1
mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
@@ -480,10 +481,10 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "reinitialize trust anchors"
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns2
+stop_server --use-rndc --port "${CONTROLPORT}" ns2
rm -f ns2/managed-keys.bind*
nextpart ns2/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns2
+start_server --noclean --restart --port "${PORT}" ns2
n=$((n+1))
echo_i "check positive validation ($n)"
@@ -579,11 +580,11 @@ ret=0
mkeys_refresh_on 2 || ret=1
mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
t1=$(grep 'next refresh:' rndc.out.1.$n) || true
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns1
+stop_server --use-rndc --port "${CONTROLPORT}" ns1
rm -f ns1/root.db.signed.jnl
cp ns1/root.db ns1/root.db.signed
nextpart ns1/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns1
+start_server --noclean --restart --port "${PORT}" ns1
wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
mkeys_refresh_on 2 || ret=1
mkeys_status_on 2 > rndc.out.2.$n 2>&1 || ret=1
@@ -613,11 +614,11 @@ ret=0
mkeys_refresh_on 2 || ret=1
mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
t1=$(grep 'next refresh:' rndc.out.1.$n) || true
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns1
+stop_server --use-rndc --port "${CONTROLPORT}" ns1
rm -f ns1/root.db.signed.jnl
cat ns1/K*.key >> ns1/root.db.signed
nextpart ns1/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns1
+start_server --noclean --restart --port "${PORT}" ns1
wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
# Less than a second may have passed since the last time ns2 received a
# ./DNSKEY response from ns1. Ensure keys are refreshed at a different
@@ -691,7 +692,7 @@ ret=0
# compare against the known key.
tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/') || true
tatkey=$($PERL -e 'printf("%d\n", hex(@ARGV[0]));' "$tathex")
-realkey=$(rndccmd 10.53.0.2 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p')
+realkey=$(rndccmd 10.53.0.2 secroots - | sed -n "s#.*${DEFAULT_ALGORITHM}/\([0-9][0-9]*\) ; .*managed.*#\1#p")
[ "$tatkey" -eq "$realkey" ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
@@ -715,9 +716,9 @@ ret=0
# ensure key refresh retry will be scheduled to one actual hour after the first
# key refresh failure instead of just a few seconds, in order to prevent races
# between the next scheduled key refresh time and startup time of restarted ns5.
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns5
+stop_server --use-rndc --port "${CONTROLPORT}" ns5
nextpart ns5/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns5
+start_server --noclean --restart --port "${PORT}" ns5
wait_for_log 20 "Returned from key fetch in keyfetch_done()" ns5/named.run || ret=1
# ns5/named.run will contain logs from both the old instance and the new
# instance. In order for the test to pass, both must attempt a fetch.
@@ -729,14 +730,14 @@ status=$((status+ret))
n=$((n+1))
echo_i "check key refreshes are resumed after root servers become available ($n)"
ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns5
+stop_server --use-rndc --port "${CONTROLPORT}" ns5
# Prevent previous check from affecting this one
rm -f ns5/managed-keys.bind*
# named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
# an "hour" until keys are refreshed again after initial failure
cp ns5/named2.args ns5/named.args
nextpart ns5/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns5
+start_server --noclean --restart --port "${PORT}" ns5
wait_for_log 20 "Returned from key fetch in keyfetch_done() for '.': failure" ns5/named.run || ret=1
mkeys_secroots_on 5 || ret=1
grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
@@ -765,10 +766,10 @@ status=$((status+ret))
n=$((n+1))
echo_i "reinitialize trust anchors, add unsupported algorithm ($n)"
ret=0
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns6
+stop_server --use-rndc --port "${CONTROLPORT}" ns6
rm -f ns6/managed-keys.bind*
nextpart ns6/named.run > /dev/null
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port "${PORT}" mkeys ns6
+start_server --noclean --restart --port "${PORT}" ns6
# log when an unsupported algorithm is encountered during startup
wait_for_log 20 "ignoring initial-key for 'unsupported.': algorithm is unsupported" ns6/named.run || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -778,7 +779,7 @@ n=$((n+1))
echo_i "ignoring unsupported algorithm in managed-keys ($n)"
ret=0
mkeys_status_on 6 > rndc.out.$n 2>&1 || ret=1
-# there should still be only two keys listed (for . and rsasha256.)
+# there should still be only two keys listed (for . and island.)
count=$(grep -c "keyid: " rndc.out.$n) || true
[ "$count" -eq 2 ] || ret=1
# two lines indicating trust status
@@ -805,7 +806,7 @@ ret=0
mkeys_reload_on 1 || ret=1
mkeys_refresh_on 6 || ret=1
mkeys_status_on 6 > rndc.out.$n 2>&1 || ret=1
-# there should still be only two keys listed (for . and rsasha256.)
+# there should still be only two keys listed (for . and island.)
count=$(grep -c "keyid: " rndc.out.$n) || true
[ "$count" -eq 2 ] || ret=1
# two lines indicating trust status
diff --git a/external/mpl/bind/dist/bin/tests/system/names/setup.sh b/external/mpl/bind/dist/bin/tests/system/names/setup.sh
index 30f638bb90a..e46affa98d7 100644
--- a/external/mpl/bind/dist/bin/tests/system/names/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/names/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/notify/tests.sh b/external/mpl/bind/dist/bin/tests/system/notify/tests.sh
index 80f0e808bec..c02654e78b9 100644
--- a/external/mpl/bind/dist/bin/tests/system/notify/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/notify/tests.sh
@@ -143,12 +143,12 @@ digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
status=`expr $ret + $status`
echo_i "stopping master and restarting with example4 then waiting up to 45 seconds"
-$PERL $SYSTEMTESTTOP/stop.pl notify ns2
+stop_server ns2
rm -f ns2/example.db
cp -f ns2/example4.db ns2/example.db
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} notify ns2
+start_server --noclean --restart --port "${PORT}" ns2
try=0
while test $try -lt 45
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/clean.sh b/external/mpl/bind/dist/bin/tests/system/nsec3/clean.sh
index 6383f29beae..b8e83179ce9 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsec3/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/clean.sh
@@ -13,7 +13,7 @@
set -e
-rm -f dig.out.* rndc.signing.*
+rm -f dig.out.* rndc.signing.* update.out.* verify.out.*
rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
rm -f ns*/*.jnl ns*/*.jbk ns*/managed-keys.bind
rm -f ns*/K*.private ns*/K*.key ns*/K*.state
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/named.conf.in b/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/named.conf.in
new file mode 100644
index 00000000000..d6caf15615e
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/named.conf.in
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+dnssec-policy "nsec3" {
+ nsec3param;
+};
+
+options {
+ query-source address 10.53.0.2;
+ notify-source 10.53.0.2;
+ transfer-source 10.53.0.2;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.2; };
+ listen-on-v6 { none; };
+ allow-transfer { any; };
+ recursion no;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+ inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "nsec3-xfr-inline.kasp" {
+ type primary;
+ file "nsec3-xfr-inline.kasp.db";
+ inline-signing yes;
+ dnssec-policy "nsec3";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/setup.sh b/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/setup.sh
new file mode 100644
index 00000000000..1cbe02f9c03
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns2/setup.sh"
+
+zone="nsec3-xfr-inline.kasp"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+cp template.db.in "$zonefile"
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/template.db.in b/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/template.db.in
new file mode 100644
index 00000000000..8379c37213b
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/ns2/template.db.in
@@ -0,0 +1,28 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@ IN SOA mname1. . (
+ 1 ; serial
+ 20 ; refresh (20 seconds)
+ 20 ; retry (20 seconds)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+ )
+
+ NS ns2
+ns2 A 10.53.0.2
+ns3 A 10.53.0.3
+
+a A 10.0.0.1
+b A 10.0.0.2
+c A 10.0.0.3
+
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named.conf.in b/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named.conf.in
index 85bc591b075..4324f2d4f2b 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named.conf.in
@@ -128,3 +128,35 @@ zone "nsec3-fails-to-load.kasp" {
dnssec-policy "nsec3";
allow-update { any; };
};
+
+/* These zones switch from dynamic to inline-signing or vice versa. */
+zone "nsec3-dynamic-to-inline.kasp" {
+ type primary;
+ file "nsec3-dynamic-to-inline.kasp.db";
+ dnssec-policy "nsec3";
+ allow-update { any; };
+};
+
+zone "nsec3-inline-to-dynamic.kasp" {
+ type primary;
+ file "nsec3-inline-to-dynamic.kasp.db";
+ inline-signing yes;
+ dnssec-policy "nsec3";
+};
+
+/* Test adding a NSEC3 record to an inline-signing dnssec-policy zone. */
+zone "nsec3-dynamic-update-inline.kasp" {
+ type primary;
+ file "nsec3-dynamic-update-inline.kasp.db";
+ inline-signing yes;
+ allow-update { any; };
+ dnssec-policy "nsec";
+};
+
+zone "nsec3-xfr-inline.kasp" {
+ type secondary;
+ file "nsec3-xfr-inline.kasp.db";
+ inline-signing yes;
+ dnssec-policy "nsec";
+ primaries { 10.53.0.2; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named2.conf.in b/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named2.conf.in
index c593e60db13..5c3b9705711 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named2.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named2.conf.in
@@ -134,3 +134,20 @@ zone "nsec3-fails-to-load.kasp" {
dnssec-policy "nsec3";
allow-update { any; };
};
+
+/* These zones switch from dynamic to inline-signing or vice versa. */
+zone "nsec3-dynamic-to-inline.kasp" {
+ type primary;
+ file "nsec3-dynamic-to-inline.kasp.db";
+ inline-signing yes;
+ dnssec-policy "nsec3";
+ allow-update { any; };
+};
+
+zone "nsec3-inline-to-dynamic.kasp" {
+ type primary;
+ file "nsec3-inline-to-dynamic.kasp.db";
+ inline-signing no;
+ dnssec-policy "nsec3";
+ allow-update { any; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/setup.sh b/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/setup.sh
index cbaf84ce8d4..b7c449aefcf 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/ns3/setup.sh
@@ -25,7 +25,9 @@ setup() {
}
for zn in nsec-to-nsec3 nsec3 nsec3-other nsec3-change nsec3-to-nsec \
- nsec3-to-optout nsec3-from-optout nsec3-dynamic nsec3-dynamic-change
+ nsec3-to-optout nsec3-from-optout nsec3-dynamic \
+ nsec3-dynamic-change nsec3-dynamic-to-inline \
+ nsec3-inline-to-dynamic nsec3-dynamic-update-inline
do
setup "${zn}.kasp"
done
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/setup.sh b/external/mpl/bind/dist/bin/tests/system/nsec3/setup.sh
index 66320529b75..bdd1ae9a817 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsec3/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/setup.sh
@@ -18,8 +18,12 @@ set -e
$SHELL clean.sh
+copy_setports ns2/named.conf.in ns2/named.conf
+(
+ cd ns2
+ $SHELL setup.sh
+)
copy_setports ns3/named.conf.in ns3/named.conf
-
(
cd ns3
$SHELL setup.sh
diff --git a/external/mpl/bind/dist/bin/tests/system/nsec3/tests.sh b/external/mpl/bind/dist/bin/tests/system/nsec3/tests.sh
index 1cd6ff17500..6b3eb7adeab 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsec3/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsec3/tests.sh
@@ -187,6 +187,18 @@ echo_i "initial check zone ${ZONE}"
check_nsec3
dnssec_verify
+# Zone: nsec3-dynamic-to-inline.kasp.
+set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600
+set_nsec3param "0" "5" "8"
+echo_i "initial check zone ${ZONE}"
+check_nsec3
+
+# Zone: nsec3-inline-to-dynamic.kasp.
+set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600
+set_nsec3param "0" "5" "8"
+echo_i "initial check zone ${ZONE}"
+check_nsec3
+
# Zone: nsec3-to-nsec.kasp.
set_zone_policy "nsec3-to-nsec.kasp" "nsec3"
set_nsec3param "0" "5" "8"
@@ -215,7 +227,33 @@ echo_i "initial check zone ${ZONE}"
check_nsec3
dnssec_verify
+# Zone: nsec3-xfr-inline.kasp.
+# This is a secondary zone, where the primary is signed with NSEC3 but
+# the dnssec-policy dictates NSEC.
+set_zone_policy "nsec3-xfr-inline.kasp" "nsec" 1 3600
+set_key_default_values "KEY1"
+echo_i "initial check zone ${ZONE}"
+check_nsec
+
+# Zone: nsec3-dynamic-update-inline.kasp.
+set_zone_policy "nsec3-dynamic-update-inline.kasp" "nsec" 1 3600
+echo_i "initial check zone ${ZONE}"
+check_nsec
+
+n=$((n+1))
+echo_i "dynamic update dnssec-policy zone ${ZONE} with NSEC3 ($n)"
+ret=0
+$NSUPDATE > update.out.$ZONE.test$n 2>&1 << END || ret=1
+server 10.53.0.3 ${PORT}
+zone ${ZONE}.
+update add 04O18462RI5903H8RDVL0QDT5B528DUJ.${ZONE}. 3600 NSEC3 0 0 0 408A4B2D412A4E95 1JMDDPMTFF8QQLIOINSIG4CR9OTICAOC A RRSIG
+send
+END
+wait_for_log 10 "updating zone '${ZONE}/IN': update failed: explicit NSEC3 updates are not allowed in secure zones (REFUSED)" ns3/named.run || ret=1
+check_nsec
+
# Reconfig named.
+ret=0
echo_i "reconfig dnssec-policy to trigger nsec3 rollovers"
copy_setports ns3/named2.conf.in ns3/named.conf
rndc_reconfig ns3 10.53.0.3
@@ -255,6 +293,18 @@ echo_i "check zone ${ZONE} after reconfig"
check_nsec3
dnssec_verify
+# Zone: nsec3-dynamic-to-inline.kasp. (same)
+set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600
+set_nsec3param "0" "5" "8"
+echo_i "check zone ${ZONE} after reconfig"
+check_nsec3
+
+# Zone: nsec3-inline-to-dynamic.kasp. (same)
+set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600
+set_nsec3param "0" "5" "8"
+echo_i "initial check zone ${ZONE}"
+check_nsec3
+
# Zone: nsec3-to-nsec.kasp. (reconfigured)
set_zone_policy "nsec3-to-nsec.kasp" "nsec"
set_nsec3param "1" "11" "0"
@@ -307,13 +357,13 @@ dnssec_verify
# Restart named, NSEC3 should stay the same.
ret=0
echo "stop ns3"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} nsec3 ${DIR} || ret=1
+stop_server --use-rndc --port ${CONTROLPORT} ${DIR} || ret=1
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
ret=0
echo "start ns3"
-start_server --noclean --restart --port ${PORT} nsec3 ${DIR}
+start_server --noclean --restart --port ${PORT} ${DIR}
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
diff --git a/external/mpl/bind/dist/bin/tests/system/nslookup/clean.sh b/external/mpl/bind/dist/bin/tests/system/nslookup/clean.sh
index 5aad8dda5a3..439f90d95e0 100644
--- a/external/mpl/bind/dist/bin/tests/system/nslookup/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nslookup/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/nsupdate/krb/setup.sh b/external/mpl/bind/dist/bin/tests/system/nsupdate/krb/setup.sh
index 178693288ec..5ac116c41d2 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsupdate/krb/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsupdate/krb/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/nsupdate/ns1/named.conf.in b/external/mpl/bind/dist/bin/tests/system/nsupdate/ns1/named.conf.in
index 81d0c99af8e..a5cc36dec5a 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsupdate/ns1/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -23,6 +23,7 @@ options {
recursion no;
notify yes;
minimal-responses no;
+ update-quota 1;
};
acl named-acl {
@@ -83,6 +84,7 @@ zone "other.nil" {
check-integrity no;
check-mx warn;
update-policy local;
+ allow-query { !10.53.0.2; any; };
allow-query-on { 10.53.0.1; 127.0.0.1; };
allow-transfer { any; };
};
diff --git a/external/mpl/bind/dist/bin/tests/system/nsupdate/ns3/sign.sh b/external/mpl/bind/dist/bin/tests/system/nsupdate/ns3/sign.sh
index 491dfd46bca..c3db402a530 100644
--- a/external/mpl/bind/dist/bin/tests/system/nsupdate/ns3/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsupdate/ns3/sign.sh
@@ -18,8 +18,8 @@ zone=nsec3param.test.
infile=nsec3param.test.db.in
zonefile=nsec3param.test.db
-keyname1=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
cat $infile $keyname1.key $keyname2.key >$zonefile
@@ -29,8 +29,8 @@ zone=dnskey.test.
infile=dnskey.test.db.in
zonefile=dnskey.test.db
-keyname1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
cat $infile $keyname1.key $keyname2.key >$zonefile
@@ -40,8 +40,8 @@ zone=delegation.test.
infile=delegation.test.db.in
zonefile=delegation.test.db
-keyname1=`$KEYGEN -q -a RSASHA256 -3 -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -3 $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 $zone)
cat $infile $keyname1.key $keyname2.key >$zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh b/external/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh
index e4f96eb1268..67ffc27c1b4 100755
--- a/external/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh
@@ -20,7 +20,7 @@ RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
#
# Uncomment when creating credential cache files.
#
-# KRB5_CONFIG=`pwd`/krb/krb5.conf
+# KRB5_CONFIG="$(pwd)/krb/krb5.conf"
#
# Cd krb and run krb/setup.sh to create new keys.
# Run nsupdate system test.
@@ -50,7 +50,7 @@ while true; do
break
else
echo_i "zones are not fully loaded, waiting..."
- tries=`expr $tries + 1`
+ tries=$((tries + 1))
sleep 1
fi
done
@@ -144,7 +144,7 @@ digcomp knowngood.ns1.after dig.out.ns2 || ret=1
ret=0
echo_i "testing local update policy"
-pre=`$DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a` || ret=1
+pre=$($DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a) || ret=1
[ -z "$pre" ] || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
@@ -163,7 +163,7 @@ sleep 5
ret=0
echo_i "checking result of update"
-post=`$DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a` || ret=1
+post=$($DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a) || ret=1
[ "$post" = "10.10.10.1" ] || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
@@ -251,11 +251,11 @@ grep "mx03.update.nil/MX:.*MX is an address" ns1/named.run > /dev/null 2>&1 || r
ret=0
echo_i "check SIG(0) key is accepted"
-key=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -T KEY -n ENTITY xxx`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -T KEY -n ENTITY xxx)
echo "" | $NSUPDATE -k ${key}.private > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check TYPE=0 update is rejected by nsupdate ($n)"
$NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -267,7 +267,7 @@ END
grep "unknown class/type" nsupdate.out > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check TYPE=0 prerequisite is handled ($n)"
$NSUPDATE -k ns1/ddns.key <<END > nsupdate.out 2>&1 || ret=1
@@ -279,7 +279,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that TYPE=0 update is handled ($n)"
echo "a0e4280000010000000100000000060001c00c000000fe000000000000" |
@@ -288,7 +288,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that TYPE=0 additional data is handled ($n)"
echo "a0e4280000010000000000010000060001c00c000000fe000000000000" |
@@ -297,7 +297,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that update to undefined class is handled ($n)"
echo "a0e4280000010001000000000000060101c00c000000fe000000000000" |
@@ -306,7 +306,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that address family mismatch is handled ($n)"
$NSUPDATE <<END > /dev/null 2>&1 && ret=1
@@ -318,22 +318,22 @@ END
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that unixtime serial number is correctly generated ($n)"
$DIG $DIGOPTS +short unixtime.nil. soa @10.53.0.1 > dig.out.old.test$n || ret=1
-oldserial=`awk '{print $3}' dig.out.old.test$n` || ret=1
-start=`$PERL -e 'print time()."\n";'`
+oldserial=$(awk '{print $3}' dig.out.old.test$n) || ret=1
+start=$($PERL -e 'print time()."\n";')
$NSUPDATE <<END > /dev/null 2>&1 || ret=1
server 10.53.0.1 ${PORT}
ttl 600
update add new.unixtime.nil in a 1.2.3.4
send
END
-now=`$PERL -e 'print time()."\n";'`
+now=$($PERL -e 'print time()."\n";')
sleep 1
$DIG $DIGOPTS +short unixtime.nil. soa @10.53.0.1 > dig.out.new.test$n || ret=1
-serial=`awk '{print $3}' dig.out.new.test$n` || ret=1
+serial=$(awk '{print $3}' dig.out.new.test$n) || ret=1
[ "$oldserial" = "$serial" ] && { echo_i "oldserial == serial"; ret=1; }
if [ "$serial" -lt "$start" ]; then
echo_i "out-of-range serial=$serial < start=$start"; ret=1;
@@ -344,7 +344,7 @@ fi
if $PERL -e 'use Net::DNS;' 2>/dev/null
then
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "running update.pl test ($n)"
$PERL update_test.pl -s 10.53.0.1 -p ${PORT} update.nil. > perl.update_test.out || ret=1
@@ -352,7 +352,7 @@ then
if $PERL -e 'use Net::DNS; die "Net::DNS too old ($Net::DNS::VERSION < 1.01)" if ($Net::DNS::VERSION < 1.01)' > /dev/null
then
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check for too many NSEC3 iterations log ($n)"
grep "updating zone 'update.nil/IN': too many NSEC3 iterations (151)" ns1/named.run > /dev/null || ret=1
@@ -362,21 +362,21 @@ else
echo_i "The second part of this test requires the Net::DNS library." >&2
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "fetching first copy of test zone ($n)"
$DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
@10.53.0.1 axfr > dig.out.ns1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "fetching second copy of test zone ($n)"
$DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
@10.53.0.2 axfr > dig.out.ns2 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "comparing zones ($n)"
digcomp dig.out.ns1 dig.out.ns2 || ret=1
@@ -384,12 +384,12 @@ digcomp dig.out.ns1 dig.out.ns2 || ret=1
echo_i "SIGKILL and restart server ns1"
cd ns1
-$KILL -KILL `cat named.pid`
+$KILL -KILL $(cat named.pid)
rm named.pid
cd ..
sleep 10
if
- $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} nsupdate ns1
+ start_server --noclean --restart --port ${PORT} ns1
then
echo_i "restarted server ns1"
else
@@ -398,14 +398,14 @@ else
fi
sleep 10
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "fetching ns1 after hard restart ($n)"
$DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
@10.53.0.1 axfr > dig.out.ns1.after || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "comparing zones ($n)"
digcomp dig.out.ns1 dig.out.ns1.after || ret=1
@@ -413,7 +413,7 @@ digcomp dig.out.ns1 dig.out.ns1.after || ret=1
echo_i "begin RT #482 regression test"
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "update primary ($n)"
$NSUPDATE -k ns1/ddns.key <<END > /dev/null || ret=1
@@ -429,7 +429,7 @@ sleep 5
if [ ! "$CYGWIN" ]; then
echo_i "SIGHUP secondary"
- $KILL -HUP `cat ns2/named.pid`
+ $KILL -HUP $(cat ns2/named.pid)
else
echo_i "reload secondary"
rndc_reload ns2 10.53.0.2
@@ -437,7 +437,7 @@ fi
sleep 5
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "update primary again ($n)"
$NSUPDATE -k ns1/ddns.key <<END > /dev/null || ret=1
@@ -453,7 +453,7 @@ sleep 5
if [ ! "$CYGWIN" ]; then
echo_i "SIGHUP secondary again"
- $KILL -HUP `cat ns2/named.pid`
+ $KILL -HUP $(cat ns2/named.pid)
else
echo_i "reload secondary again"
rndc_reload ns2 10.53.0.2
@@ -461,7 +461,7 @@ fi
sleep 5
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check to 'out of sync' message ($n)"
if grep "out of sync" ns2/named.run
then
@@ -471,7 +471,7 @@ fi
echo_i "end RT #482 regression test"
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "start NSEC3PARAM changes via UPDATE on a unsigned zone test ($n)"
$NSUPDATE << EOF
@@ -488,7 +488,7 @@ grep "ANSWER: 0," dig.out.ns3.$n > /dev/null || ret=1
grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "change the NSEC3PARAM ttl via update ($n)"
$NSUPDATE << EOF
@@ -504,7 +504,7 @@ grep "3600.*NSEC3PARAM" dig.out.ns3.$n > /dev/null || ret=1
grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "add a new NSEC3PARAM via update ($n)"
$NSUPDATE << EOF
@@ -526,9 +526,9 @@ done
if [ $_ret -ne 0 ]; then ret=1; fi
grep "NSEC3PARAM 1 0 4 -" dig.out.ns3.$n > /dev/null || ret=1
grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $ret + $status`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((ret + status)); fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "add, delete and change the ttl of the NSEC3PARAM rrset via update ($n)"
$NSUPDATE << EOF
@@ -559,7 +559,7 @@ grep "add nsec3param.test. 7200 IN NSEC3PARAM 1 0 1 -" jp.out.ns3.$n > /dev/null
grep "add nsec3param.test. 0 IN TYPE65534 .# 6 000180000500" jp.out.ns3.$n > /dev/null || ret=1
grep "add nsec3param.test. 0 IN TYPE65534 .# 6 000140000100" jp.out.ns3.$n > /dev/null || ret=1
grep "add nsec3param.test. 0 IN TYPE65534 .# 6 000140000400" jp.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $ret + $status`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((ret + status)); fi
ret=0
@@ -570,13 +570,13 @@ update add updated4.example.nil. 600 A 10.10.10.3
send
END
sleep 3
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} nsupdate ns1
+stop_server --use-rndc --port ${CONTROLPORT} ns1
sleep 3
# Removing the journal file and restarting the server means
# that the data served by the new server process are exactly
# those dumped to the file by "rndc stop".
rm -f ns1/*jnl
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} nsupdate ns1
+start_server --noclean --restart --port ${PORT} ns1
for try in 0 1 2 3 4 5 6 7 8 9; do
iret=0
$DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
@@ -597,7 +597,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy local' works from localhost address ($n)"
$NSUPDATE -k ns5/session.key > nsupdate.out.$n 2>&1 << END || ret=1
@@ -616,7 +616,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy local' fails from non-localhost address ($n)"
grep 'match on session key not from localhost' ns5/named.run > /dev/null && ret=1
@@ -637,7 +637,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy tcp-self' refuses update of records via UDP ($n)"
$NSUPDATE > nsupdate.out.$n 2>&1 << END
@@ -656,7 +656,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy tcp-self' permits update of records for the client's own address via TCP ($n)"
$NSUPDATE -v > nsupdate.out.$n 2>&1 << END || ret=1
@@ -675,7 +675,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy tcp-self' refuses update of records for a different address from the client's own address via TCP ($n)"
$NSUPDATE -v > nsupdate.out.$n 2>&1 << END
@@ -694,7 +694,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy subdomain' is properly enforced ($n)"
# "restricted.example.nil" matches "grant ... subdomain restricted.example.nil"
@@ -719,7 +719,7 @@ $DIG $DIGOPTS +tcp @10.53.0.1 example.nil TXT > dig.out.2.test$n || ret=1
grep "TXT.*everywhere" dig.out.2.test$n > /dev/null && ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that 'update-policy zonesub' is properly enforced ($n)"
# grant zonesub-key.example.nil zonesub TXT;
@@ -746,7 +746,7 @@ grep "ANSWER: 1," dig.out.2.test$n > /dev/null || ret=1
grep "TXT.*everywhere" dig.out.2.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check 'grant' in deny name + grant subdomain ($n)"
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 || ret=1
@@ -760,7 +760,7 @@ $DIG $DIGOPTS +tcp @10.53.0.9 foo.denyname.example TXT > dig.out.ns9.test$n
grep "added" dig.out.ns9.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check 'deny' in deny name + grant subdomain ($n)"
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
@@ -774,7 +774,7 @@ $DIG $DIGOPTS +tcp @10.53.0.9 denyname.example TXT > dig.out.ns9.test$n
grep "added" dig.out.ns9.test$n > /dev/null && ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that changes to the DNSKEY RRset TTL do not have side effects ($n)"
$DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
@@ -794,7 +794,7 @@ then
echo_i "failed"; status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check notify with TSIG worked ($n)"
# if the alternate view received a notify--meaning, the notify was
@@ -806,7 +806,7 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check type list options ($n)"
$NSUPDATE -T > typelist.out.T.${n} || { ret=1; echo_i "nsupdate -T failed"; }
@@ -826,7 +826,7 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check command list ($n)"
(
@@ -849,7 +849,7 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
for alg in md5 sha1 sha224 sha256 sha384 sha512; do
@@ -868,7 +868,7 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
for alg in md5 sha1 sha224 sha256 sha384 sha512; do
@@ -888,7 +888,7 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that ttl is capped by max-ttl ($n)"
$NSUPDATE <<END > /dev/null || ret=1
@@ -905,7 +905,7 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "add a record which is truncated when logged. ($n)"
$NSUPDATE verylarge || ret=1
@@ -917,19 +917,19 @@ if [ $ret -ne 0 ]; then
status=1
fi
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that yyyymmddvv serial number is correctly generated ($n)"
-oldserial=`$DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}'` || ret=1
+oldserial=$($DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}') || ret=1
$NSUPDATE <<END > /dev/null 2>&1 || ret=1
server 10.53.0.1 ${PORT}
ttl 600
update add new.yyyymmddvv.nil in a 1.2.3.4
send
END
-now=`$PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];'`
+now=$($PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];')
sleep 1
-serial=`$DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}'` || ret=1
+serial=$($DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}') || ret=1
[ "$oldserial" -ne "$serial" ] || ret=1
[ "$serial" -eq "$now" ] || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
@@ -939,7 +939,7 @@ serial=`$DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}'`
#
if false
then
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "send many simultaneous updates via a update forwarder ($n)"
ret=0
for i in 0 1 2 3 4 5 6 7
@@ -961,12 +961,12 @@ EOF
done
wait
dig axfr many.test @10.53.0.1 > dig.out.test$n
-lines=`awk '$4 == "A" { l++ } END { print l }' dig.out.test$n`
+lines=$(awk '$4 == "A" { l++ } END { print l }' dig.out.test$n)
test ${lines:-0} -eq 64 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
fi
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check max-journal-size limits ($n)"
ret=0
rm -f nsupdate.out1-$n
@@ -996,18 +996,18 @@ send
EOF
done
# check that the journal is big enough to require truncation.
-size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
+size=$($PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl)
[ "$size" -gt 6000 ] || ret=1
sleep 1
$RNDCCMD 10.53.0.1 sync maxjournal.test
check_size_lt_5000() (
- size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
+ size=$($PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl)
[ "$size" -lt 5000 ]
)
retry_quiet 20 check_size_lt_5000 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check check-names processing ($n)"
ret=0
$NSUPDATE << EOF > nsupdate.out1-$n 2>&1
@@ -1034,7 +1034,7 @@ grep "bad name" nsupdate.out4-$n > /dev/null && ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check adding of delegating NS records processing ($n)"
ret=0
$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
@@ -1049,7 +1049,7 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
grep "AUTHORITY: 2" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check deleting of delegating NS records processing ($n)"
ret=0
$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
@@ -1063,7 +1063,7 @@ $DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test > dig.out.ns1.test$n
grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
echo_i "check that adding too many records is blocked ($n)"
ret=0
$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 && ret=1
@@ -1078,7 +1078,7 @@ grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
grep "records in zone (4) exceeds max-records (3)" ns3/named.run > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check whether valid addresses are used for primary failover ($n)"
$NSUPDATE -t 1 <<END > nsupdate.out-$n 2>&1 && ret=1
@@ -1091,7 +1091,7 @@ grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out-$n
grep "not implemented" nsupdate.out-$n > /dev/null 2>&1 && ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "ensure bad owner name is fatal in non-interactive mode ($n)"
$NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -1101,7 +1101,7 @@ grep "invalid owner name: empty label" nsupdate.out > /dev/null || ret=1
grep "syntax error" nsupdate.out > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "ensure bad owner name is not fatal in interactive mode ($n)"
$NSUPDATE -i <<END > nsupdate.out 2>&1 || ret=1
@@ -1110,7 +1110,7 @@ END
grep "invalid owner name: empty label" nsupdate.out > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "ensure invalid key type is fatal in non-interactive mode ($n)"
$NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -1120,7 +1120,7 @@ grep "unknown key type 'badkeytype'" nsupdate.out > /dev/null || ret=1
grep "syntax error" nsupdate.out > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "ensure invalid key type is not fatal in interactive mode ($n)"
$NSUPDATE -i <<END > nsupdate.out 2>&1 || ret=1
@@ -1129,7 +1129,7 @@ END
grep "unknown key type 'badkeytype'" nsupdate.out > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "ensure unresolvable server name is fatal in non-interactive mode ($n)"
$NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -1139,7 +1139,7 @@ grep "couldn't get address for 'unresolvable..':" nsupdate.out > /dev/null || re
grep "syntax error" nsupdate.out > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "ensure unresolvable server name is not fatal in interactive mode ($n)"
$NSUPDATE -i <<END > nsupdate.out 2>&1 || ret=1
@@ -1149,7 +1149,7 @@ grep "couldn't get address for 'unresolvable..':" nsupdate.out > /dev/null || re
grep "syntax error" nsupdate.out > /dev/null && ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check nsupdate -4 -6 ($n)"
$NSUPDATE -4 -6 <<END > nsupdate.out-$n 2>&1 && ret=1
@@ -1162,7 +1162,7 @@ END
grep "only one of -4 and -6 allowed" nsupdate.out-$n > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check nsupdate -4 with an IPv6 server address ($n)"
$NSUPDATE -4 <<END > nsupdate.out-$n 2>&1 && ret=1
@@ -1175,7 +1175,7 @@ END
grep "address family not supported" nsupdate.out-$n > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that TKEY in a update is rejected ($n)"
$NSUPDATE -d <<END > nsupdate.out-$n 2>&1 && ret=1
@@ -1187,9 +1187,7 @@ grep "UPDATE, status: NOERROR" nsupdate.out-$n > /dev/null 2>&1 || ret=1
grep "UPDATE, status: FORMERR" nsupdate.out-$n > /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-
-
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that DS to the zone apex is ignored ($n)"
$DIG $DIGOPTS +tcp +norec example DS @10.53.0.3 > dig.out.pre.test$n || ret=1
@@ -1210,7 +1208,7 @@ grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that CDS with mismatched algorithm to DNSSEC multisigner zone is not allowed ($n)"
$DIG $DIGOPTS +tcp +norec multisigner.test CDS @10.53.0.3 > dig.out.pre.test$n || ret=1
@@ -1229,7 +1227,7 @@ grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that CDNSKEY with mismatched algorithm to DNSSEC multisigner zone is not allowed ($n)"
$DIG $DIGOPTS +tcp +norec multisigner.test CDNSKEY @10.53.0.3 > dig.out.pre.test$n || ret=1
@@ -1249,7 +1247,7 @@ grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that CDS to DNSSEC multisigner zone is allowed ($n)"
$DIG $DIGOPTS +tcp +norec multisigner.test CDS @10.53.0.3 > dig.out.pre.test$n || ret=1
@@ -1264,7 +1262,7 @@ END
retry_quiet 5 has_positive_response multisigner.test CDS 10.53.0.3 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that CDNSKEY to DNSSEC multisigner zone is allowed ($n)"
$DIG $DIGOPTS +tcp +norec multisigner.test CDNSKEY @10.53.0.3 > dig.out.pre.test$n || ret=1
@@ -1279,7 +1277,7 @@ END
retry_quiet 5 has_positive_response multisigner.test CDNSKEY 10.53.0.3 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
-n=`expr $n + 1`
+n=$((n + 1))
ret=0
echo_i "check that excessive NSEC3PARAM iterations are rejected by nsupdate ($n)"
$NSUPDATE -d <<END > nsupdate.out-$n 2>&1 && ret=1
@@ -1290,13 +1288,41 @@ END
grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
+n=$((n + 1))
+ret=0
+echo_i "check that update is rejected if query is not allowed ($n)"
+{
+ $NSUPDATE -d <<END
+ local 10.53.0.2
+ server 10.53.0.1 ${PORT}
+ update add reject.other.nil 3600 IN TXT Whatever
+ send
+END
+} > nsupdate.out.test$n 2>&1
+grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that update is rejected if quota is exceeded ($n)"
+for loop in 1 2 3 4 5 6 7 8 9 10; do
+{
+ $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 <<END
+ update add txt-$loop.other.nil 3600 IN TXT Whatever
+ send
+END
+} &
+done
+wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
if ! $FEATURETEST --gssapi ; then
echo_i "SKIPPED: GSSAPI tests"
else
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check krb5-self match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 || ret=1
gsstsig
@@ -1311,10 +1337,10 @@ EOF
grep "machine.example.com..*A.*10.53.0.7" dig.out.ns7.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check krb5-self no-match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
gsstsig
@@ -1329,10 +1355,10 @@ EOF
grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check krb5-subdomain match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
export KRB5CCNAME
$NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
gsstsig
@@ -1347,10 +1373,10 @@ EOF
grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check krb5-subdomain no-match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
gsstsig
@@ -1365,10 +1391,10 @@ EOF
grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n+1))
ret=0
echo_i "check krb5-selfsub match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns8/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns8/machine.ccache"
export KRB5CCNAME
$NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
gsstsig
@@ -1383,10 +1409,10 @@ EOF
grep "xxx.machine.example.com..*A.*10.53.0.8" dig.out.ns8.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check krb5-selfsub no-match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns8/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns8/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
gsstsig
@@ -1401,11 +1427,11 @@ EOF
grep "status: NXDOMAIN" dig.out.ns8.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check ms-self match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 || ret=1
gsstsig
@@ -1420,10 +1446,10 @@ EOF
grep "machine.example.com..*A.*10.53.0.9" dig.out.ns9.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check ms-self no-match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
gsstsig
@@ -1438,10 +1464,10 @@ EOF
grep "status: NXDOMAIN" dig.out.ns9.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check ms-subdomain match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
export KRB5CCNAME
$NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
gsstsig
@@ -1456,10 +1482,10 @@ EOF
grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns9.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check ms-subdomain no-match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
gsstsig
@@ -1474,10 +1500,10 @@ EOF
grep "status: NXDOMAIN" dig.out.ns9.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n+1))
ret=0
echo_i "check ms-selfsub match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns10/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
export KRB5CCNAME
$NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
gsstsig
@@ -1492,10 +1518,10 @@ EOF
grep "xxx.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n > /dev/null || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
- n=`expr $n + 1`
+ n=$((n + 1))
ret=0
echo_i "check ms-selfsub no-match ($n)"
- KRB5CCNAME="FILE:"`pwd`/ns10/machine.ccache
+ KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
export KRB5CCNAME
$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
gsstsig
diff --git a/external/mpl/bind/dist/bin/tests/system/nzd2nzf/prereq.sh b/external/mpl/bind/dist/bin/tests/system/nzd2nzf/prereq.sh
index 7fe5a050ea3..5498945d9f0 100644
--- a/external/mpl/bind/dist/bin/tests/system/nzd2nzf/prereq.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nzd2nzf/prereq.sh
@@ -12,7 +12,7 @@
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
echo_i "This test requires LMDB support (--with-lmdb)"
exit 255
fi
diff --git a/external/mpl/bind/dist/bin/tests/system/nzd2nzf/tests.sh b/external/mpl/bind/dist/bin/tests/system/nzd2nzf/tests.sh
index 874b918eed2..9f86d4af7fc 100644
--- a/external/mpl/bind/dist/bin/tests/system/nzd2nzf/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/nzd2nzf/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -28,8 +30,7 @@ status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "adding a new zone into default NZD using rndc addzone ($n)"
-$RNDCCMD 10.53.0.1 addzone "added.example { type master; file \"added.db\";
-};" 2>&1 | sed 's/^/I:ns1 /' | cat_i
+$RNDCCMD 10.53.0.1 addzone "added.example { type master; file \"added.db\"; };" 2>&1 | sed 's/^/I:ns1 /' | cat_i
sleep 2
n=`expr $n + 1`
@@ -41,7 +42,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
echo_i "stopping ns1"
-$PERL $SYSTEMTESTTOP/stop.pl nzd2nzf ns1
+stop_server ns1
n=`expr $n + 1`
echo_i "dumping _default.nzd to _default.nzf ($n)"
@@ -59,7 +60,7 @@ echo_i "deleting _default.nzd database"
rm -f ns1/_default.nzd
echo_i "starting ns1 which should migrate the .nzf to .nzd"
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} nzd2nzf ns1
+start_server --noclean --restart --port ${PORT} ns1
n=`expr $n + 1`
echo_i "querying for zone data from migrated zone config ($n)"
diff --git a/external/mpl/bind/dist/bin/tests/system/padding/clean.sh b/external/mpl/bind/dist/bin/tests/system/padding/clean.sh
index 518c132df2e..eef21748c31 100644
--- a/external/mpl/bind/dist/bin/tests/system/padding/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/padding/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/pending/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/pending/ns1/sign.sh
index 421dc58e0ab..c29ebe2aed2 100644
--- a/external/mpl/bind/dist/bin/tests/system/pending/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/pending/ns1/sign.sh
@@ -23,8 +23,8 @@ zonefile=root.db
cp ../ns2/dsset-example$TP .
cp ../ns2/dsset-example.com$TP .
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
cat $infile $keyname1.key $keyname2.key > $zonefile
$SIGNER -g -o $zone $zonefile > /dev/null
diff --git a/external/mpl/bind/dist/bin/tests/system/pending/ns2/sign.sh b/external/mpl/bind/dist/bin/tests/system/pending/ns2/sign.sh
index ff3a316dfec..df408f8ce7d 100644
--- a/external/mpl/bind/dist/bin/tests/system/pending/ns2/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/pending/ns2/sign.sh
@@ -19,8 +19,8 @@ for domain in example example.com; do
infile=${domain}.db.in
zonefile=${domain}.db
- keyname1=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
- keyname2=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -f KSK -n zone $zone`
+ keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+ keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
cat $infile $keyname1.key $keyname2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/pytest_custom_markers.py b/external/mpl/bind/dist/bin/tests/system/pytest_custom_markers.py
index 55b02f6c58a..9714c0fbf5a 100644
--- a/external/mpl/bind/dist/bin/tests/system/pytest_custom_markers.py
+++ b/external/mpl/bind/dist/bin/tests/system/pytest_custom_markers.py
@@ -12,6 +12,7 @@
# information regarding copyright ownership.
import os
+import subprocess
import pytest
@@ -19,3 +20,23 @@ import pytest
long_test = pytest.mark.skipif(
not os.environ.get("CI_ENABLE_ALL_TESTS"), reason="CI_ENABLE_ALL_TESTS not set"
)
+
+
+def feature_test(feature):
+ feature_test_bin = os.environ["FEATURETEST"]
+ try:
+ subprocess.run([feature_test_bin, feature], check=True)
+ except subprocess.CalledProcessError as exc:
+ if exc.returncode != 1:
+ raise
+ return False
+ return True
+
+
+have_libxml2 = pytest.mark.skipif(
+ feature_test("--have-libxml2"), reason="libxml2 support disabled in the build"
+)
+
+have_json_c = pytest.mark.skipif(
+ feature_test("--have-json-c"), reason="json-c support disabled in the build"
+)
diff --git a/external/mpl/bind/dist/bin/tests/system/qmin/ans3/ans.py b/external/mpl/bind/dist/bin/tests/system/qmin/ans3/ans.py
index b2883a1b7d6..079c3d2cdac 100755
--- a/external/mpl/bind/dist/bin/tests/system/qmin/ans3/ans.py
+++ b/external/mpl/bind/dist/bin/tests/system/qmin/ans3/ans.py
@@ -57,6 +57,7 @@ def create_response(msg):
qname = m.question[0].name.to_text()
lqname = qname.lower()
labels = lqname.split(".")
+ suffix = ""
# get qtype
rrtype = m.question[0].rdtype
diff --git a/external/mpl/bind/dist/bin/tests/system/redirect/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/redirect/ns1/sign.sh
index b5b97b5ccd0..500dee6c82d 100644
--- a/external/mpl/bind/dist/bin/tests/system/redirect/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/redirect/ns1/sign.sh
@@ -18,8 +18,8 @@ zone=signed
infile=example.db
zonefile=signed.db
-key1=`$KEYGEN -q -a rsasha256 $zone`
-key2=`$KEYGEN -q -a rsasha256 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $zone)
cat $infile $key1.key $key2.key > $zonefile
@@ -29,8 +29,8 @@ zone=nsec3
infile=example.db
zonefile=nsec3.db
-key1=`$KEYGEN -q -a rsasha256 -3 $zone`
-key2=`$KEYGEN -q -a rsasha256 -3 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 -fk $zone)
cat $infile $key1.key $key2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/redirect/ns3/sign.sh b/external/mpl/bind/dist/bin/tests/system/redirect/ns3/sign.sh
index b5b97b5ccd0..500dee6c82d 100644
--- a/external/mpl/bind/dist/bin/tests/system/redirect/ns3/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/redirect/ns3/sign.sh
@@ -18,8 +18,8 @@ zone=signed
infile=example.db
zonefile=signed.db
-key1=`$KEYGEN -q -a rsasha256 $zone`
-key2=`$KEYGEN -q -a rsasha256 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $zone)
cat $infile $key1.key $key2.key > $zonefile
@@ -29,8 +29,8 @@ zone=nsec3
infile=example.db
zonefile=nsec3.db
-key1=`$KEYGEN -q -a rsasha256 -3 $zone`
-key2=`$KEYGEN -q -a rsasha256 -3 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 -fk $zone)
cat $infile $key1.key $key2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/redirect/ns5/sign.sh b/external/mpl/bind/dist/bin/tests/system/redirect/ns5/sign.sh
index aeeada0f265..efa986a59a1 100644
--- a/external/mpl/bind/dist/bin/tests/system/redirect/ns5/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/redirect/ns5/sign.sh
@@ -22,8 +22,8 @@ zone=signed.
infile=signed.db.in
zonefile=signed.db
-key1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null`
-key2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null`
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null)
cat $infile $key1.key $key2.key > $zonefile
@@ -36,8 +36,8 @@ zone=.
infile=root.db.in
zonefile=root.db
-key1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null`
-key2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null`
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null)
# cat $infile $key1.key $key2.key > $zonefile
cat $infile dsset-signed. $key1.key $key2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ans2/ans.pl b/external/mpl/bind/dist/bin/tests/system/resolver/ans2/ans.pl
index ef5d85df569..7876508fd84 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ans2/ans.pl
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ans2/ans.pl
@@ -73,6 +73,15 @@ for (;;) {
# Data for the "cname + other data / 2" test: same RRs in opposite order
$packet->push("answer", new Net::DNS::RR("cname2.example.com 300 A 1.2.3.4"));
$packet->push("answer", new Net::DNS::RR("cname2.example.com 300 CNAME cname2.example.com"));
+ } elsif ($qname =~ /redirect\.com/) {
+ $packet->push("authority", new Net::DNS::RR("redirect.com 300 NS ns.redirect.com"));
+ $packet->push("additional", new Net::DNS::RR("ns.redirect.com 300 A 10.53.0.6"));
+ } elsif ($qname =~ /\.tld1/) {
+ $packet->push("authority", new Net::DNS::RR("tld1 300 NS ns.tld1"));
+ $packet->push("additional", new Net::DNS::RR("ns.tld1 300 A 10.53.0.6"));
+ } elsif ($qname =~ /\.tld2/) {
+ $packet->push("authority", new Net::DNS::RR("tld2 300 NS ns.tld2"));
+ $packet->push("additional", new Net::DNS::RR("ns.tld2 300 A 10.53.0.7"));
} elsif ($qname eq "org" && $qtype eq "NS") {
$packet->header->aa(1);
$packet->push("answer", new Net::DNS::RR("org 300 NS a.root-servers.nil."));
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ans3/ans.pl b/external/mpl/bind/dist/bin/tests/system/resolver/ans3/ans.pl
index 055a0afbf97..d4d7ae7ca34 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ans3/ans.pl
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ans3/ans.pl
@@ -20,11 +20,21 @@ use IO::Socket;
use Net::DNS;
use Net::DNS::Packet;
+# Ignore SIGPIPE so we won't fail if peer closes a TCP socket early
+local $SIG{PIPE} = 'IGNORE';
+
+# Flush logged output after every line
+local $| = 1;
+
my $localport = int($ENV{'PORT'});
if (!$localport) { $localport = 5300; }
-my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.3",
- LocalPort => $localport, Proto => "udp") or die "$!";
+my $server_addr = "10.53.0.3";
+
+my $udpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+ LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
+my $tcpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+ LocalPort => $localport, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
print $pidf "$$\n" or die "cannot write pid file: $!";
@@ -34,11 +44,8 @@ sub rmpid { unlink "ans.pid"; exit 1; };
$SIG{INT} = \&rmpid;
$SIG{TERM} = \&rmpid;
-for (;;) {
- $sock->recv($buf, 512);
-
- print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n";
-
+sub handleQuery {
+ my $buf = shift;
my $packet;
if ($Net::DNS::VERSION > 0.68) {
@@ -100,6 +107,13 @@ for (;;) {
} elsif ($qname =~ /^nxdomain\.example\.net$/i) {
$packet->header->aa(1);
$packet->header->rcode(NXDOMAIN);
+ } elsif ($qname eq "large-referral.example.net") {
+ for (my $i = 1; $i < 1000; $i++) {
+ $packet->push("authority", new Net::DNS::RR("large-referral.example.net 300 NS ns" . $i . ".fake.redirect.com"));
+ }
+ # No glue records
+ } elsif ($qname eq "foo.bar.sub.tld1") {
+ $packet->push("answer", new Net::DNS::RR("$qname 300 TXT baz"));
} elsif ($qname eq "cname.sub.example.org") {
$packet->push("answer",
new Net::DNS::RR($qname .
@@ -124,9 +138,46 @@ for (;;) {
$packet->push("answer", new Net::DNS::RR("www.example.com 300 A 1.2.3.4"));
}
- $sock->send($packet->data);
-
print "RESPONSE:\n";
$packet->print;
- print "\n";
+
+ return $packet->data;
+}
+
+# Main
+my $rin;
+my $rout;
+for (;;) {
+ $rin = '';
+ vec($rin, fileno($tcpsock), 1) = 1;
+ vec($rin, fileno($udpsock), 1) = 1;
+
+ select($rout = $rin, undef, undef, undef);
+
+ if (vec($rout, fileno($udpsock), 1)) {
+ printf "UDP request\n";
+ my $buf;
+ $udpsock->recv($buf, 512);
+ my $result = handleQuery($buf);
+ my $num_chars = $udpsock->send($result);
+ print " Sent $num_chars bytes via UDP\n";
+ } elsif (vec($rout, fileno($tcpsock), 1)) {
+ my $conn = $tcpsock->accept;
+ my $buf;
+ for (;;) {
+ my $lenbuf;
+ my $n = $conn->sysread($lenbuf, 2);
+ last unless $n == 2;
+ my $len = unpack("n", $lenbuf);
+ $n = $conn->sysread($buf, $len);
+ last unless $n == $len;
+ print "TCP request\n";
+ my $result = handleQuery($buf);
+ $len = length($result);
+ $conn->syswrite(pack("n", $len), 2);
+ $n = $conn->syswrite($result, $len);
+ print " Sent: $n chars via TCP\n";
+ }
+ $conn->close;
+ }
}
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns1/named.conf.in b/external/mpl/bind/dist/bin/tests/system/resolver/ns1/named.conf.in
index 89625f8139d..7ca1cafd38e 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns1/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns1/named.conf.in
@@ -31,6 +31,10 @@ options {
attach-cache "globalcache";
};
+server 10.53.0.3 {
+ tcp-only yes;
+};
+
server 10.42.23.3/32 {
notify-source 10.42.22.1;
query-source address 10.42.22.1 port 0;
@@ -64,3 +68,12 @@ view "default" {
file "root.hint";
};
};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+ inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/named.conf.in b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/named.conf.in
index 75c9c53d026..74a4066934e 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/named.conf.in
@@ -57,6 +57,11 @@ zone "sourcens" {
file "sourcens.db";
};
+zone "v4only.net" {
+ type primary;
+ file "v4only.net.db";
+};
+
key rndc_key {
secret "1234abcd8765";
algorithm hmac-sha256;
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld1.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld1.db
index 4bcfcf5f024..03d79088feb 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld1.db
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld1.db
@@ -30,3 +30,6 @@ edns-version.tld. NS ns.edns-version.tld.
ns.edns-version.tld. A 10.53.0.7
cname CNAME ns7
ns7 A 10.53.0.7
+mixedttl 10 A 10.0.0.1
+mixedttl 15 TXT a TXT record
+mixedttl 20 AAAA 2001:db8::1
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld2.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld2.db
index 2d8f428cb9c..c3a96d9f4fe 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld2.db
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/tld2.db
@@ -21,12 +21,15 @@ $TTL 300
ns A 10.53.0.4
fetch.tld. NS ns.fetch.tld.
ns.fetch.tld. A 10.53.0.6
-fetchall 10 TXT A short ttl
fetchall 10 A 1.2.3.4
-fetchall 10 AAAA ::1
+fetchall 10 AAAA ::1
+fetchall 10 TXT A short ttl
no-edns-version.tld. NS ns.no-edns-version.tld.
ns.no-edns-version.tld. A 10.53.0.6
edns-version.tld. NS ns.edns-version.tld.
ns.edns-version.tld. A 10.53.0.7
cname CNAME ns7
ns7 A 10.53.0.7
+mixedttl 10 A 10.0.0.1
+mixedttl 15 TXT a TXT record
+mixedttl 20 AAAA 2001:db8::1
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns4/v4only.net.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/v4only.net.db
new file mode 100644
index 00000000000..b097f3a3056
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns4/v4only.net.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@ IN SOA marka.isc.org. ns.server. (
+ 2010 ; serial
+ 600 ; refresh
+ 600 ; retry
+ 1200 ; expire
+ 600 ; minimum
+ )
+@ NS v4.nameserver.
+ A 10.0.0.1
+* CNAME @
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/keygen.sh b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/keygen.sh
index 1793eb3da88..e992154f71f 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/keygen.sh
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/keygen.sh
@@ -14,12 +14,15 @@
SYSTEMTESTTOP=../..
. $SYSTEMTESTTOP/conf.sh
+#
+# We use rsasha256 here to get a ZSK + KSK that don't fit in 512 bytes.
+#
zone=ds.example.net
zonefile="${zone}.db"
infile="${zonefile}.in"
cp $infile $zonefile
-ksk=`$KEYGEN -q -a rsasha256 -fk $zone`
-zsk=`$KEYGEN -q -a rsasha256 -b 2048 $zone`
+ksk=$($KEYGEN -q -a rsasha256 -fk $zone)
+zsk=$($KEYGEN -q -a rsasha256 -b 2048 $zone)
cat $ksk.key $zsk.key >> $zonefile
$SIGNER -P -o $zone $zonefile > /dev/null
@@ -27,8 +30,8 @@ zone=example.net
zonefile="${zone}.db"
infile="${zonefile}.in"
cp $infile $zonefile
-ksk=`$KEYGEN -q -a rsasha256 -fk $zone`
-zsk=`$KEYGEN -q -a rsasha256 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
cat $ksk.key $zsk.key dsset-ds.example.net$TP >> $zonefile
$SIGNER -P -o $zone $zonefile > /dev/null
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/named.conf.in b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/named.conf.in
index 60543474173..9ed68be66d4 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/named.conf.in
@@ -20,7 +20,7 @@ options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.6; };
- listen-on-v6 { none; };
+ listen-on-v6 { fd92:7065:b8e:ffff::6; };
recursion no;
dnssec-validation no;
querylog yes;
@@ -61,6 +61,16 @@ zone "broken" {
allow-update { any; };
};
+zone "redirect.com" {
+ type primary;
+ file "redirect.com.db";
+};
+
+zone "tld1" {
+ type primary;
+ file "tld1.db";
+};
+
zone "no-edns-version.tld" {
type primary;
file "no-edns-version.tld.db";
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/redirect.com.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/redirect.com.db
new file mode 100644
index 00000000000..f79f6dd0a83
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/redirect.com.db
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@ IN SOA ns hostmaster 1 1800 900 604800 600
+@ IN NS ns
+ns IN A 10.53.0.6
+
+; 10.53.1.* are non-responsive IP addresses
+$GENERATE 1-100 ns$.fake IN A 10.53.1.$
+$GENERATE 101-200 ns$.fake IN A 10.53.1.${-100}
+$GENERATE 201-300 ns$.fake IN A 10.53.1.${-200}
+$GENERATE 301-400 ns$.fake IN A 10.53.1.${-300}
+$GENERATE 401-500 ns$.fake IN A 10.53.1.${-400}
+$GENERATE 501-600 ns$.fake IN A 10.53.1.${-500}
+$GENERATE 601-700 ns$.fake IN A 10.53.1.${-600}
+$GENERATE 701-800 ns$.fake IN A 10.53.1.${-700}
+$GENERATE 801-900 ns$.fake IN A 10.53.1.${-800}
+$GENERATE 901-1000 ns$.fake IN A 10.53.1.${-900}
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/root.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/root.db
index 55e9ba86f33..096381c3ce9 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/root.db
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/root.db
@@ -19,6 +19,7 @@ $TTL 300
)
. NS a.root-servers.nil.
a.root-servers.nil. A 10.53.0.6
+a.root-servers.nil. AAAA fd92:7065:b8e:ffff::6
moves. NS ns.server.
server. NS ns7.server.
ns7.server. A 10.53.0.7
@@ -31,3 +32,5 @@ no-edns-version.tld. NS ns.no-edns-version.tld.
ns.no-edns-version.tld. A 10.53.0.6
edns-version.tld. NS ns.edns-version.tld.
ns.edns-version.tld. A 10.53.0.7
+v4only.net. NS v4.nameserver.
+v4.nameserver. A 10.53.0.4
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns6/tld1.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/tld1.db
new file mode 100644
index 00000000000..412509b3c59
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns6/tld1.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@ IN SOA ns hostmaster 1 1800 900 604800 600
+@ IN NS ns
+ns IN A 10.53.0.6
+
+$GENERATE 1-21 sub IN NS sub-ns$.tld2.
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named1.conf.in b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named1.conf.in
index a6fa4d64523..2070ffa7f21 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named1.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named1.conf.in
@@ -20,7 +20,7 @@ options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.7; };
- listen-on-v6 { none; };
+ listen-on-v6 { fd92:7065:b8e:ffff::7; };
recursion yes;
dnssec-validation yes;
empty-zones-enable yes;
@@ -62,3 +62,13 @@ zone "all-cnames" {
type primary;
file "all-cnames.db";
};
+
+zone "tld2" {
+ type primary;
+ file "tld2.db";
+};
+
+zone "sub.tld1" {
+ type primary;
+ file "sub.tld1.db";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named2.conf.in b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named2.conf.in
index a6fa4d64523..2070ffa7f21 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named2.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/named2.conf.in
@@ -20,7 +20,7 @@ options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.7; };
- listen-on-v6 { none; };
+ listen-on-v6 { fd92:7065:b8e:ffff::7; };
recursion yes;
dnssec-validation yes;
empty-zones-enable yes;
@@ -62,3 +62,13 @@ zone "all-cnames" {
type primary;
file "all-cnames.db";
};
+
+zone "tld2" {
+ type primary;
+ file "tld2.db";
+};
+
+zone "sub.tld1" {
+ type primary;
+ file "sub.tld1.db";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns7/sub.tld1.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/sub.tld1.db
new file mode 100644
index 00000000000..b2d46c6a873
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/sub.tld1.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@ IN SOA ns hostmaster 1 1800 900 604800 600
+
+$GENERATE 1-21 @ IN NS sub-ns$.tld2.
+
+$GENERATE 1-21 bar IN NS bar-sub-ns$.tld2.
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns7/tld2.db b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/tld2.db
new file mode 100644
index 00000000000..1f31b51c6c6
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns7/tld2.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@ IN SOA ns hostmaster 1 1800 900 604800 600
+@ IN NS ns
+ns IN A 10.53.0.7
+
+$GENERATE 1-21 sub-ns$ IN A 10.53.0.7
+$GENERATE 1-21 bar-sub-ns$ IN A 10.53.0.3
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.args b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.args
new file mode 100644
index 00000000000..0c66bc06083
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.args
@@ -0,0 +1,2 @@
+# this server is IPv6 only
+-6 -m record -c named.conf -d 99 -D resolver-ns9 -X named.lock -g -T maxcachesize=2097152
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.conf.in b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.conf.in
new file mode 100644
index 00000000000..3be31db6f82
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.conf.in
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS9
+
+options {
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { none; };
+ listen-on-v6 { fd92:7065:b8e:ffff::9; };
+ recursion yes;
+ dnssec-validation yes;
+ dual-stack-servers { fd92:7065:b8e:ffff::7; };
+ qname-minimization off;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+ inet fd92:7065:b8e:ffff::9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+ type hint;
+ file "root.hint";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.ipv6-only b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.ipv6-only
new file mode 100644
index 00000000000..e69de29bb2d
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/named.ipv6-only
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/ns9/root.hint b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/root.hint
new file mode 100644
index 00000000000..f74fbf17d1a
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/ns9/root.hint
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 999999
+. IN NS a.root-servers.nil.
+a.root-servers.nil. IN A 10.53.0.6
+a.root-servers.nil. IN AAAA fd92:7065:b8e:ffff::6;
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/setup.sh b/external/mpl/bind/dist/bin/tests/system/resolver/setup.sh
index 4567f306de3..0f0832cb3fb 100644
--- a/external/mpl/bind/dist/bin/tests/system/resolver/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/setup.sh
@@ -23,5 +23,6 @@ copy_setports ns4/named.conf.in ns4/named.conf
copy_setports ns5/named.conf.in ns5/named.conf
copy_setports ns6/named.conf.in ns6/named.conf
copy_setports ns7/named1.conf.in ns7/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
(cd ns6 && $SHELL keygen.sh)
diff --git a/external/mpl/bind/dist/bin/tests/system/resolver/tests.sh b/external/mpl/bind/dist/bin/tests/system/resolver/tests.sh
index 630a3d722c0..eec56a8aed5 100755
--- a/external/mpl/bind/dist/bin/tests/system/resolver/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/resolver/tests.sh
@@ -14,323 +14,331 @@
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
-DIGOPTS="-p ${PORT}"
-RESOLVOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
+dig_with_opts() {
+ "${DIG}" -p "${PORT}" "${@}"
+}
+
+resolve_with_opts() {
+ "${RESOLVE}" -p "${PORT}" "${@}"
+}
+
+rndccmd() {
+ "${RNDC}" -c "${SYSTEMTESTTOP}/common/rndc.conf" -p "${CONTROLPORT}" -s "${@}"
+}
status=0
n=0
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking non-cachable NXDOMAIN response handling ($n)"
ret=0
-$DIG $DIGOPTS +tcp nxdomain.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp nxdomain.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NXDOMAIN" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking non-cachable NXDOMAIN response handling using dns_client ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 nxdomain.example.net 2> resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 nxdomain.example.net 2> resolve.out.ns1.test${n} || ret=1
grep "resolution failed: ncache nxdomain" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking that local bound address can be set (Can't query from a denied address) ($n)"
ret=0
- ${RESOLVE} -b 10.53.0.8 $RESOLVOPTS -t a -s 10.53.0.1 www.example.org 2> resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -b 10.53.0.8 -t a -s 10.53.0.1 www.example.org 2> resolve.out.ns1.test${n} || ret=1
grep "resolution failed: SERVFAIL" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking that local bound address can be set (Can query from an allowed address) ($n)"
ret=0
- ${RESOLVE} -b 10.53.0.1 $RESOLVOPTS -t a -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -b 10.53.0.1 -t a -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
grep "www.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking non-cachable NODATA response handling ($n)"
ret=0
-$DIG $DIGOPTS +tcp nodata.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp nodata.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking non-cachable NODATA response handling using dns_client ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 nodata.example.net 2> resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 nodata.example.net 2> resolve.out.ns1.test${n} || ret=1
grep "resolution failed: ncache nxrrset" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking handling of bogus referrals ($n)"
# If the server has the "INSIST(!external)" bug, this query will kill it.
-$DIG $DIGOPTS +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking handling of bogus referrals using dns_client ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 www.example.com 2> resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 www.example.com 2> resolve.out.ns1.test${n} || ret=1
grep "resolution failed: SERVFAIL" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check handling of cname + other data / 1 ($n)"
-$DIG $DIGOPTS +tcp cname1.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp cname1.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check handling of cname + other data / 2 ($n)"
-$DIG $DIGOPTS +tcp cname2.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp cname2.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that server is still running ($n)"
-$DIG $DIGOPTS +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking answer IPv4 address filtering (deny) ($n)"
ret=0
-$DIG $DIGOPTS +tcp www.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking answer IPv6 address filtering (deny) ($n)"
ret=0
-$DIG $DIGOPTS +tcp www.example.net @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.net @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking answer IPv4 address filtering (accept) ($n)"
ret=0
-$DIG $DIGOPTS +tcp www.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking answer IPv4 address filtering using dns_client (accept) ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
grep "www.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking answer IPv6 address filtering (accept) ($n)"
ret=0
-$DIG $DIGOPTS +tcp www.example.org @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.org @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking answer IPv6 address filtering using dns_client (accept) ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t aaaa -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t aaaa -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
grep "www.example.org..*.2001:db8:beef::1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking CNAME target filtering (deny) ($n)"
ret=0
-$DIG $DIGOPTS +tcp badcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp badcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking CNAME target filtering (accept) ($n)"
ret=0
-$DIG $DIGOPTS +tcp goodcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp goodcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking CNAME target filtering using dns_client (accept) ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 goodcname.example.net > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 goodcname.example.net > resolve.out.ns1.test${n} || ret=1
grep "goodcname.example.net..*.goodcname.example.org." resolve.out.ns1.test${n} > /dev/null || ret=1
grep "goodcname.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking CNAME target filtering (accept due to subdomain) ($n)"
ret=0
-$DIG $DIGOPTS +tcp cname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp cname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking CNAME target filtering using dns_client (accept due to subdomain) ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 cname.sub.example.org > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 cname.sub.example.org > resolve.out.ns1.test${n} || ret=1
grep "cname.sub.example.org..*.ok.sub.example.org." resolve.out.ns1.test${n} > /dev/null || ret=1
grep "ok.sub.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking DNAME target filtering (deny) ($n)"
ret=0
-$DIG $DIGOPTS +tcp foo.baddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp foo.baddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "DNAME target foo.baddname.example.org denied for foo.baddname.example.net/IN" ns1/named.run >/dev/null || ret=1
grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking DNAME target filtering (accept) ($n)"
ret=0
-$DIG $DIGOPTS +tcp foo.gooddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp foo.gooddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking DNAME target filtering using dns_client (accept) ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 foo.gooddname.example.net > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 foo.gooddname.example.net > resolve.out.ns1.test${n} || ret=1
grep "foo.gooddname.example.net..*.gooddname.example.org" resolve.out.ns1.test${n} > /dev/null || ret=1
grep "foo.gooddname.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking DNAME target filtering (accept due to subdomain) ($n)"
ret=0
-$DIG $DIGOPTS +tcp www.dname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.dname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ -x ${RESOLVE} ] ; then
- n=`expr $n + 1`
+ n=$((n+1))
echo_i "checking DNAME target filtering using dns_client (accept due to subdomain) ($n)"
ret=0
- $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 www.dname.sub.example.org > resolve.out.ns1.test${n} || ret=1
+ resolve_with_opts -t a -s 10.53.0.1 www.dname.sub.example.org > resolve.out.ns1.test${n} || ret=1
grep "www.dname.sub.example.org..*.ok.sub.example.org." resolve.out.ns1.test${n} > /dev/null || ret=1
grep "www.ok.sub.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that the resolver accepts a referral response with a non-empty ANSWER section ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.1 foo.glue-in-answer.example.org. A > dig.ns1.out.${n} || ret=1
+dig_with_opts @10.53.0.1 foo.glue-in-answer.example.org. A > dig.ns1.out.${n} || ret=1
grep "status: NOERROR" dig.ns1.out.${n} > /dev/null || ret=1
grep "foo.glue-in-answer.example.org.*192.0.2.1" dig.ns1.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that the resolver limits the number of NS records it follows in a referral response ($n)"
# ns5 is the recusor being tested. ns4 holds the sourcens zone containing names with varying numbers of NS
# records pointing to non-existent nameservers in the targetns zone on ns6.
ret=0
-$RNDCCMD 10.53.0.5 flush || ret=1 # Ensure cache is empty before doing this test
+rndccmd 10.53.0.5 flush || ret=1 # Ensure cache is empty before doing this test
for nscount in 1 2 3 4 5 6 7 8 9 10
do
# Verify number of NS records at source server
- $DIG $DIGOPTS +norecurse @10.53.0.4 target${nscount}.sourcens ns > dig.ns4.out.${nscount}.${n}
- sourcerecs=`grep NS dig.ns4.out.${nscount}.${n} | grep -v ';' | wc -l`
- test $sourcerecs -eq $nscount || ret=1
- test $sourcerecs -eq $nscount || echo_i "NS count incorrect for target${nscount}.sourcens"
+ dig_with_opts +norecurse @10.53.0.4 target${nscount}.sourcens ns > dig.ns4.out.${nscount}.${n}
+ sourcerecs=$(grep NS dig.ns4.out.${nscount}.${n} | grep -v ';' | wc -l)
+ test "${sourcerecs}" -eq "${nscount}" || ret=1
+ test "${sourcerecs}" -eq "${nscount}" || echo_i "NS count incorrect for target${nscount}.sourcens"
# Expected queries = 2 * number of NS records, up to a maximum of 10.
- expected=`expr 2 \* $nscount`
- if [ $expected -gt 10 ]; then expected=10; fi
+ expected=$((nscount*2))
+ if [ "$expected" -gt 10 ]; then expected=10; fi
# Work out the queries made by checking statistics on the target before and after the test
- $RNDCCMD 10.53.0.6 stats || ret=1
- initial_count=`awk '/responses sent/ {print $1}' ns6/named.stats`
+ rndccmd 10.53.0.6 stats || ret=1
+ initial_count=$(awk '/responses sent/ {print $1}' ns6/named.stats)
mv ns6/named.stats ns6/named.stats.initial.${nscount}.${n}
- $DIG $DIGOPTS @10.53.0.5 target${nscount}.sourcens A > dig.ns5.out.${nscount}.${n} || ret=1
- $RNDCCMD 10.53.0.6 stats || ret=1
- final_count=`awk '/responses sent/ {print $1}' ns6/named.stats`
+ dig_with_opts @10.53.0.5 target${nscount}.sourcens A > dig.ns5.out.${nscount}.${n} || ret=1
+ rndccmd 10.53.0.6 stats || ret=1
+ final_count=$(awk '/responses sent/ {print $1}' ns6/named.stats)
mv ns6/named.stats ns6/named.stats.final.${nscount}.${n}
# Check number of queries during the test is as expected
- actual=`expr $final_count - $initial_count`
- if [ $actual -ne $expected ]; then
+ actual=$((final_count - initial_count))
+ if [ "$actual" -ne "$expected" ]; then
echo_i "query count error: $nscount NS records: expected queries $expected, actual $actual"
ret=1
fi
done
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "RT21594 regression test check setup ($n)"
ret=0
# Check that "aa" is not being set by the authoritative server.
-$DIG $DIGOPTS +tcp . @10.53.0.4 soa > dig.ns4.out.${n} || ret=1
+dig_with_opts +tcp . @10.53.0.4 soa > dig.ns4.out.${n} || ret=1
grep 'flags: qr rd;' dig.ns4.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "RT21594 regression test positive answers ($n)"
ret=0
# Check that resolver accepts the non-authoritative positive answers.
-$DIG $DIGOPTS +tcp . @10.53.0.5 soa > dig.ns5.out.${n} || ret=1
+dig_with_opts +tcp . @10.53.0.5 soa > dig.ns5.out.${n} || ret=1
grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "RT21594 regression test NODATA answers ($n)"
ret=0
# Check that resolver accepts the non-authoritative nodata answers.
-$DIG $DIGOPTS +tcp . @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
+dig_with_opts +tcp . @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "RT21594 regression test NXDOMAIN answers ($n)"
ret=0
# Check that resolver accepts the non-authoritative positive answers.
-$DIG $DIGOPTS +tcp noexistent @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
+dig_with_opts +tcp noexistent @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
ret=0
-$DIG $DIGOPTS +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=1
+dig_with_opts +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=1
grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=1
if [ $ret = 1 ]; then echo_i "mx priming failed"; fi
$NSUPDATE << EOF
@@ -340,25 +348,25 @@ update delete mail.example.net A
update add mail.example.net 0 AAAA ::1
send
EOF
-$DIG $DIGOPTS +tcp a mail.example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
+dig_with_opts +tcp a mail.example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=2
grep "ANSWER: 0" dig.ns7.out.${n} > /dev/null || ret=2
if [ $ret = 2 ]; then echo_i "ncache priming failed"; fi
-$DIG $DIGOPTS +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=3
+dig_with_opts +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=3
grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=3
-$DIG $DIGOPTS +tcp rrsig mail.example.net +norec @10.53.0.7 > dig.ns7.out.${n} || ret=4
+dig_with_opts +tcp rrsig mail.example.net +norec @10.53.0.7 > dig.ns7.out.${n} || ret=4
grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=4
grep "ANSWER: 0" dig.ns7.out.${n} > /dev/null || ret=4
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking that update a nameservers address has immediate effects ($n)"
ret=0
-$DIG $DIGOPTS +tcp TXT foo.moves @10.53.0.7 > dig.ns7.foo.${n} || ret=1
+dig_with_opts +tcp TXT foo.moves @10.53.0.7 > dig.ns7.foo.${n} || ret=1
grep "From NS 5" dig.ns7.foo.${n} > /dev/null || ret=1
$NSUPDATE << EOF
server 10.53.0.7 ${PORT}
@@ -368,15 +376,15 @@ update add ns.server 300 A 10.53.0.4
send
EOF
sleep 1
-$DIG $DIGOPTS +tcp TXT bar.moves @10.53.0.7 > dig.ns7.bar.${n} || ret=1
+dig_with_opts +tcp TXT bar.moves @10.53.0.7 > dig.ns7.bar.${n} || ret=1
grep "From NS 4" dig.ns7.bar.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking that update a nameservers glue has immediate effects ($n)"
ret=0
-$DIG $DIGOPTS +tcp TXT foo.child.server @10.53.0.7 > dig.ns7.foo.${n} || ret=1
+dig_with_opts +tcp TXT foo.child.server @10.53.0.7 > dig.ns7.foo.${n} || ret=1
grep "From NS 5" dig.ns7.foo.${n} > /dev/null || ret=1
$NSUPDATE << EOF
server 10.53.0.7 ${PORT}
@@ -386,59 +394,59 @@ update add ns.child.server 300 A 10.53.0.4
send
EOF
sleep 1
-$DIG $DIGOPTS +tcp TXT bar.child.server @10.53.0.7 > dig.ns7.bar.${n} || ret=1
+dig_with_opts +tcp TXT bar.child.server @10.53.0.7 > dig.ns7.bar.${n} || ret=1
grep "From NS 4" dig.ns7.bar.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking empty RFC 1918 reverse zones ($n)"
ret=0
# Check that "aa" is being set by the resolver for RFC 1918 zones
# except the one that has been deliberately disabled
-$DIG $DIGOPTS @10.53.0.7 -x 10.1.1.1 > dig.ns4.out.1.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 10.1.1.1 > dig.ns4.out.1.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.1.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 192.168.1.1 > dig.ns4.out.2.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 192.168.1.1 > dig.ns4.out.2.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.2.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.16.1.1 > dig.ns4.out.3.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.16.1.1 > dig.ns4.out.3.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.3.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.17.1.1 > dig.ns4.out.4.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.17.1.1 > dig.ns4.out.4.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.4.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.18.1.1 > dig.ns4.out.5.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.18.1.1 > dig.ns4.out.5.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.5.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.19.1.1 > dig.ns4.out.6.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.19.1.1 > dig.ns4.out.6.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.6.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.21.1.1 > dig.ns4.out.7.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.21.1.1 > dig.ns4.out.7.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.7.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.22.1.1 > dig.ns4.out.8.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.22.1.1 > dig.ns4.out.8.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.8.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.23.1.1 > dig.ns4.out.9.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.23.1.1 > dig.ns4.out.9.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.9.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.24.1.1 > dig.ns4.out.11.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.24.1.1 > dig.ns4.out.11.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.11.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.25.1.1 > dig.ns4.out.12.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.25.1.1 > dig.ns4.out.12.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.12.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.26.1.1 > dig.ns4.out.13.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.26.1.1 > dig.ns4.out.13.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.13.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.27.1.1 > dig.ns4.out.14.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.27.1.1 > dig.ns4.out.14.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.14.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.28.1.1 > dig.ns4.out.15.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.28.1.1 > dig.ns4.out.15.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.15.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.29.1.1 > dig.ns4.out.16.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.29.1.1 > dig.ns4.out.16.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.16.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.30.1.1 > dig.ns4.out.17.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.30.1.1 > dig.ns4.out.17.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.17.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.31.1.1 > dig.ns4.out.18.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.31.1.1 > dig.ns4.out.18.${n} || ret=1
grep 'flags: qr aa rd ra;' dig.ns4.out.18.${n} > /dev/null || ret=1
# but this one should NOT be authoritative
-$DIG $DIGOPTS @10.53.0.7 -x 172.20.1.1 > dig.ns4.out.19.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.20.1.1 > dig.ns4.out.19.${n} || ret=1
grep 'flags: qr rd ra;' dig.ns4.out.19.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking that removal of a delegation is honoured ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.5 www.to-be-removed.tld A > dig.ns5.prime.${n}
+dig_with_opts @10.53.0.5 www.to-be-removed.tld A > dig.ns5.prime.${n}
grep "status: NOERROR" dig.ns5.prime.${n} > /dev/null || { ret=1; echo_i "priming failed"; }
cp ns4/tld2.db ns4/tld.db
rndc_reload ns4 10.53.0.4 tld
@@ -446,8 +454,8 @@ old=
for i in 0 1 2 3 4 5 6 7 8 9
do
foo=0
- $DIG $DIGOPTS @10.53.0.5 ns$i.to-be-removed.tld A > /dev/null
- $DIG $DIGOPTS @10.53.0.5 www.to-be-removed.tld A > dig.ns5.out.${n}
+ dig_with_opts @10.53.0.5 ns$i.to-be-removed.tld A > /dev/null
+ dig_with_opts @10.53.0.5 www.to-be-removed.tld A > dig.ns5.out.${n}
grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || foo=1
[ $foo = 0 ] && break
$NSUPDATE << EOF
@@ -463,74 +471,74 @@ done
[ $ret = 0 ] && ret=$foo;
if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check for improved error message with SOA mismatch ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.1 www.sub.broken aaaa > dig.out.ns1.test${n} || ret=1
+dig_with_opts @10.53.0.1 www.sub.broken aaaa > dig.out.ns1.test${n} || ret=1
grep "not subdomain of zone" ns1/named.run > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
copy_setports ns7/named2.conf.in ns7/named.conf
-$RNDCCMD 10.53.0.7 reconfig 2>&1 | sed 's/^/ns7 /' | cat_i
+rndccmd 10.53.0.7 reconfig 2>&1 | sed 's/^/ns7 /' | cat_i
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check resolution on the listening port ($n)"
ret=0
-$DIG $DIGOPTS +tcp +tries=2 +time=5 mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
+dig_with_opts +tcp +tries=2 +time=5 mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=1
grep "ANSWER: 1" dig.ns7.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check prefetch (${n})"
ret=0
# read prefetch value from config.
-PREFETCH=`sed -n "s/[[:space:]]*prefetch \([0-9]\).*/\1/p" ns5/named.conf`
-$DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n}`
+PREFETCH=$(sed -n "s/[[:space:]]*prefetch \([0-9]\).*/\1/p" ns5/named.conf)
+dig_with_opts @10.53.0.5 fetch.tld txt > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n})
interval=$((ttl1 - PREFETCH + 1))
# sleep so we are in prefetch range
sleep ${interval:-0}
# trigger prefetch
-$DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.2.${n} || ret=1
-ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+dig_with_opts @10.53.0.5 fetch.tld txt > dig.out.2.${n} || ret=1
+ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
sleep 1
# check that prefetch occurred
-$DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.3.${n} || ret=1
-ttl=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.3.${n}`
-test ${ttl:-0} -gt ${ttl2:-1} || ret=1
+dig_with_opts @10.53.0.5 fetch.tld txt > dig.out.3.${n} || ret=1
+ttl=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.3.${n})
+test "${ttl:-0}" -gt "${ttl2:-1}" || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check prefetch of validated DS's RRSIG TTL is updated (${n})"
ret=0
-$DIG $DIGOPTS +dnssec @10.53.0.5 ds.example.net ds > dig.out.1.${n} || ret=1
-dsttl1=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.1.${n}`
+dig_with_opts +dnssec @10.53.0.5 ds.example.net ds > dig.out.1.${n} || ret=1
+dsttl1=$(awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.1.${n})
interval=$((dsttl1 - PREFETCH + 1))
# sleep so we are in prefetch range
sleep ${interval:-0}
# trigger prefetch
-$DIG $DIGOPTS @10.53.0.5 ds.example.net ds > dig.out.2.${n} || ret=1
-dsttl2=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.2.${n}`
+dig_with_opts @10.53.0.5 ds.example.net ds > dig.out.2.${n} || ret=1
+dsttl2=$(awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.2.${n})
sleep 1
# check that prefetch occurred
-$DIG $DIGOPTS @10.53.0.5 ds.example.net ds +dnssec > dig.out.3.${n} || ret=1
-dsttl=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.3.${n}`
-sigttl=`awk '$4 == "RRSIG" && $5 == "DS" { print $2 }' dig.out.3.${n}`
-test ${dsttl:-0} -gt ${dsttl2:-1} || ret=1
-test ${sigttl:-0} -gt ${dsttl2:-1} || ret=1
-test ${dsttl:-0} -eq ${sigttl:-1} || ret=1
+dig_with_opts @10.53.0.5 ds.example.net ds +dnssec > dig.out.3.${n} || ret=1
+dsttl=$(awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.3.${n})
+sigttl=$(awk '$4 == "RRSIG" && $5 == "DS" { print $2 }' dig.out.3.${n})
+test "${dsttl:-0}" -gt "${dsttl2:-1}" || ret=1
+test "${sigttl:-0}" -gt "${dsttl2:-1}" || ret=1
+test "${dsttl:-0}" -eq "${sigttl:-1}" || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check prefetch disabled (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n}`
+dig_with_opts @10.53.0.7 fetch.example.net txt > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n})
interval=$((ttl1 - PREFETCH + 1))
# sleep so we are in expire range
sleep ${interval:-0}
@@ -539,98 +547,102 @@ no_prefetch() {
# fetch record and ensure its ttl is in range 0 < ttl < tmp_ttl.
# since prefetch is disabled, updated ttl must be a lower value than
# the previous one.
- $DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.2.${n} || return 1
- ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+ dig_with_opts @10.53.0.7 fetch.example.net txt > dig.out.2.${n} || return 1
+ ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
# check that prefetch has not occurred
- if [ $ttl2 -ge $tmp_ttl ]; then
+ if [ "$ttl2" -ge "${tmp_ttl}" ]; then
return 1
fi
tmp_ttl=$ttl2
}
retry_quiet 3 no_prefetch || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check prefetch qtype * (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n}`
+dig_with_opts @10.53.0.5 fetchall.tld any > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n})
# sleep so we are in prefetch range
-sleep ${ttl1:-0}
+sleep "${ttl1:-0}"
# trigger prefetch
-$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.2.${n} || ret=1
-ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+dig_with_opts @10.53.0.5 fetchall.tld any > dig.out.2.${n} || ret=1
+ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
sleep 1
-# check that the nameserver is still alive
-$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.3.${n} || ret=1
+# check that prefetch occurred;
+# note that only one record is prefetched, which is the TXT record in this case,
+# because of the order of the records in the cache
+dig_with_opts @10.53.0.5 fetchall.tld any > dig.out.3.${n} || ret=1
+ttl3=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.3.${n})
+test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that E was logged on EDNS queries in the query log (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.5 +edns edns.fetchall.tld any > dig.out.2.${n} || ret=1
+dig_with_opts @10.53.0.5 +edns edns.fetchall.tld any > dig.out.2.${n} || ret=1
grep "query: edns.fetchall.tld IN ANY +E" ns5/named.run > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.5 +noedns noedns.fetchall.tld any > dig.out.2.${n} || ret=1
+dig_with_opts @10.53.0.5 +noedns noedns.fetchall.tld any > dig.out.2.${n} || ret=1
grep "query: noedns.fetchall.tld IN ANY" ns5/named.run > /dev/null || ret=1
grep "query: noedns.fetchall.tld IN ANY +E" ns5/named.run > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that '-t aaaa' in .digrc does not have unexpected side effects ($n)"
ret=0
echo "-t aaaa" > .digrc
-env HOME=`pwd` $DIG $DIGOPTS @10.53.0.4 . > dig.out.1.${n} || ret=1
-env HOME=`pwd` $DIG $DIGOPTS @10.53.0.4 . A > dig.out.2.${n} || ret=1
-env HOME=`pwd` $DIG $DIGOPTS @10.53.0.4 -x 127.0.0.1 > dig.out.3.${n} || ret=1
+HOME="$(pwd)" dig_with_opts @10.53.0.4 . > dig.out.1.${n} || ret=1
+HOME="$(pwd)" dig_with_opts @10.53.0.4 . A > dig.out.2.${n} || ret=1
+HOME="$(pwd)" dig_with_opts @10.53.0.4 -x 127.0.0.1 > dig.out.3.${n} || ret=1
grep ';\..*IN.*AAAA$' dig.out.1.${n} > /dev/null || ret=1
grep ';\..*IN.*A$' dig.out.2.${n} > /dev/null || ret=1
grep 'extra type option' dig.out.2.${n} > /dev/null && ret=1
grep ';1\.0\.0\.127\.in-addr\.arpa\..*IN.*PTR$' dig.out.3.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-edns=`$FEATURETEST --edns-version`
+edns=$($FEATURETEST --edns-version)
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that EDNS version is logged (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.5 +edns edns0.fetchall.tld any > dig.out.2.${n} || ret=1
+dig_with_opts @10.53.0.5 +edns edns0.fetchall.tld any > dig.out.2.${n} || ret=1
grep "query: edns0.fetchall.tld IN ANY +E(0)" ns5/named.run > /dev/null || ret=1
-if test ${edns:-0} != 0; then
- $DIG $DIGOPTS @10.53.0.5 +edns=1 edns1.fetchall.tld any > dig.out.2.${n} || ret=1
+if test "${edns:-0}" != 0; then
+ dig_with_opts @10.53.0.5 +edns=1 edns1.fetchall.tld any > dig.out.2.${n} || ret=1
grep "query: edns1.fetchall.tld IN ANY +E(1)" ns5/named.run > /dev/null || ret=1
fi
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-if test ${edns:-0} != 0; then
- n=`expr $n + 1`
+if test "${edns:-0}" != 0; then
+ n=$((n+1))
echo_i "check that edns-version is honoured (${n})"
ret=0
- $DIG $DIGOPTS @10.53.0.5 +edns no-edns-version.tld > dig.out.1.${n} || ret=1
+ dig_with_opts @10.53.0.5 +edns no-edns-version.tld > dig.out.1.${n} || ret=1
grep "query: no-edns-version.tld IN A -E(1)" ns6/named.run > /dev/null || ret=1
- $DIG $DIGOPTS @10.53.0.5 +edns edns-version.tld > dig.out.2.${n} || ret=1
+ dig_with_opts @10.53.0.5 +edns edns-version.tld > dig.out.2.${n} || ret=1
grep "query: edns-version.tld IN A -E(0)" ns7/named.run > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
+ status=$((status + ret))
fi
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that CNAME nameserver is logged correctly (${n})"
ret=0
-$DIG $DIGOPTS soa all-cnames @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa all-cnames @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: SERVFAIL" dig.out.ns5.test${n} > /dev/null || ret=1
grep "skipping nameserver 'cname.tld' because it is a CNAME, while resolving 'all-cnames/SOA'" ns5/named.run > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that unexpected opcodes are handled correctly (${n})"
ret=0
-$DIG $DIGOPTS soa all-cnames @10.53.0.5 +opcode=15 +cd +rec +ad +zflag > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa all-cnames @10.53.0.5 +opcode=15 +cd +rec +ad +zflag > dig.out.ns5.test${n} || ret=1
grep "status: NOTIMP" dig.out.ns5.test${n} > /dev/null || ret=1
grep "flags:[^;]* qr[; ]" dig.out.ns5.test${n} > /dev/null || ret=1
grep "flags:[^;]* ra[; ]" dig.out.ns5.test${n} > /dev/null && ret=1
@@ -639,214 +651,277 @@ grep "flags:[^;]* cd[; ]" dig.out.ns5.test${n} > /dev/null && ret=1
grep "flags:[^;]* ad[; ]" dig.out.ns5.test${n} > /dev/null && ret=1
grep "flags:[^;]*; MBZ: " dig.out.ns5.test${n} > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that EDNS client subnet with non-zeroed bits is handled correctly (${n})"
ret=0
# 0001 (IPv4) 1f (31 significant bits) 00 (0) ffffffff (255.255.255.255)
-$DIG $DIGOPTS soa . @10.53.0.5 +ednsopt=8:00011f00ffffffff > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa . @10.53.0.5 +ednsopt=8:00011f00ffffffff > dig.out.ns5.test${n} || ret=1
grep "status: FORMERR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "; EDNS: version:" dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that dig +subnet zeros address bits correctly (${n})"
ret=0
-$DIG $DIGOPTS soa . @10.53.0.5 +subnet=255.255.255.255/23 > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa . @10.53.0.5 +subnet=255.255.255.255/23 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "CLIENT-SUBNET: 255.255.254.0/23/0" dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that SOA query returns data for delegation-only apex (${n})"
ret=0
-$DIG $DIGOPTS soa delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n+1))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that NS query returns data for delegation-only apex (${n})"
ret=0
-$DIG $DIGOPTS ns delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts ns delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that A query returns data for delegation-only A apex (${n})"
ret=0
-$DIG $DIGOPTS a delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts a delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that CDS query returns data for delegation-only apex (${n})"
ret=0
-$DIG $DIGOPTS cds delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts cds delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that AAAA query returns data for delegation-only AAAA apex (${n})"
ret=0
-$DIG $DIGOPTS a delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts a delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n+1))
echo_i "check that DNSKEY query returns data for delegation-only apex (${n})"
ret=0
-$DIG $DIGOPTS dnskey delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts dnskey delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that CDNSKEY query returns data for delegation-only apex (${n})"
ret=0
-$DIG $DIGOPTS cdnskey delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts cdnskey delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that NXDOMAIN is returned for delegation-only non-apex A data (${n})"
ret=0
-$DIG $DIGOPTS a a.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts a a.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that NXDOMAIN is returned for delegation-only non-apex CDS data (${n})"
ret=0
-$DIG $DIGOPTS cds cds.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts cds cds.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that NXDOMAIN is returned for delegation-only non-apex AAAA data (${n})"
ret=0
-$DIG $DIGOPTS aaaa aaaa.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts aaaa aaaa.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n+1))
echo_i "check that NXDOMAIN is returned for delegation-only non-apex CDNSKEY data (${n})"
ret=0
-$DIG $DIGOPTS cdnskey cdnskey.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts cdnskey cdnskey.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check zero ttl not returned for learnt non zero ttl records (${n})"
ret=0
# use prefetch disabled server
-$DIG $DIGOPTS @10.53.0.7 non-zero.example.net txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.1.${n}`
+dig_with_opts @10.53.0.7 non-zero.example.net txt > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.1.${n})
# sleep so we are in expire range
-sleep ${ttl1:-0}
+sleep "${ttl1:-0}"
# look for ttl = 1, allow for one miss at getting zero ttl
zerotonine="0 1 2 3 4 5 6 7 8 9"
zerotonine="$zerotonine $zerotonine $zerotonine"
for i in $zerotonine $zerotonine $zerotonine $zerotonine
do
- $DIG $DIGOPTS @10.53.0.7 non-zero.example.net txt > dig.out.2.${n} || ret=1
- ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
- test ${ttl2:-1} -eq 0 && break
- test ${ttl2:-1} -ge ${ttl1:-0} && break
- $PERL -e 'select(undef, undef, undef, 0.05);'
+ dig_with_opts @10.53.0.7 non-zero.example.net txt > dig.out.2.${n} || ret=1
+ ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
+ test "${ttl2:-1}" -eq 0 && break
+ test "${ttl2:-1}" -ge "${ttl1:-0}" && break
+ "${PERL}" -e 'select(undef, undef, undef, 0.05);'
done
-test ${ttl2:-1} -eq 0 && ret=1
-test ${ttl2:-1} -ge ${ttl1:-0} || break
+test "${ttl2:-1}" -eq 0 && ret=1
+test "${ttl2:-1}" -ge "${ttl1:-0}" || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check zero ttl is returned for learnt zero ttl records (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.7 zero.example.net txt > dig.out.1.${n} || ret=1
-ttl=`awk '/"A" "zero" "ttl"/ { print $2 }' dig.out.1.${n}`
-test ${ttl:-1} -eq 0 || ret=1
+dig_with_opts @10.53.0.7 zero.example.net txt > dig.out.1.${n} || ret=1
+ttl=$(awk '/"A" "zero" "ttl"/ { print $2 }' dig.out.1.${n})
+test "${ttl:-1}" -eq 0 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that 'ad' in not returned in truncated answer with empty answer and authority sections to request with +ad (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.6 dnskey ds.example.net +bufsize=512 +ad +nodnssec +ignore +norec > dig.out.$n
+dig_with_opts @10.53.0.6 dnskey ds.example.net +bufsize=512 +ad +nodnssec +ignore +norec > dig.out.$n
grep "flags: qr aa tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0" dig.out.$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that 'ad' in not returned in truncated answer with empty answer and authority sections to request with +dnssec (${n})"
ret=0
-$DIG $DIGOPTS @10.53.0.6 dnskey ds.example.net +bufsize=512 +noad +dnssec +ignore +norec > dig.out.$n
+dig_with_opts @10.53.0.6 dnskey ds.example.net +bufsize=512 +noad +dnssec +ignore +norec > dig.out.$n
grep "flags: qr aa tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0" dig.out.$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that the resolver accepts a reply with empty question section with TC=1 and retries over TCP ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.5 truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
+dig_with_opts @10.53.0.5 truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null || ret=1
grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check that the resolver rejects a reply with empty question section with TC=0 ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.5 not-truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
+dig_with_opts @10.53.0.5 not-truncated.no-questions. a +tries=3 +time=5 > dig.ns5.out.${n} || ret=1
grep "status: NOERROR" dig.ns5.out.${n} > /dev/null && ret=1
grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null && ret=1
grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking SERVFAIL is returned when all authoritative servers return FORMERR ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.5 ns.formerr-to-all. a > dig.ns5.out.${n} || ret=1
+dig_with_opts @10.53.0.5 ns.formerr-to-all. a > dig.ns5.out.${n} || ret=1
grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "check logged command line ($n)"
ret=0
grep "running as: .* -m record,size,mctx " ns1/named.run > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
-n=`expr $n + 1`
+n=$((n+1))
echo_i "checking NXDOMAIN is returned when querying non existing domain in CH class ($n)"
ret=0
-$DIG $DIGOPTS @10.53.0.1 id.hostname txt ch > dig.ns1.out.${n} || ret=1
+dig_with_opts @10.53.0.1 id.hostname txt ch > dig.ns1.out.${n} || ret=1
grep "status: NXDOMAIN" dig.ns1.out.${n} > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "check handling of large referrals to unresponsive name servers ($n)"
+ret=0
+dig_with_opts +timeout=15 large-referral.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
+# Check the total number of findname() calls triggered by a single query
+# for large-referral.example.net/A.
+findname_call_count="$(grep -c "large-referral\.example\.net.*FINDNAME" ns1/named.run)"
+if [ "${findname_call_count}" -gt 1000 ]; then
+ echo_i "failed: ${findname_call_count} (> 1000) findname() calls detected for large-referral.example.net"
+ ret=1
+fi
+# Check whether the limit of NS RRs processed for any delegation
+# encountered was not exceeded.
+if grep -Eq "dns_adb_createfind: started (A|AAAA) fetch for name ns21.fake.redirect.com" ns1/named.run; then
+ echo_i "failed: unexpected address fetch(es) were triggered for ns21.fake.redirect.com"
+ ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "checking query resolution for a domain with a valid glueless delegation chain ($n)"
+ret=0
+rndccmd 10.53.0.1 flush || ret=1
+dig_with_opts foo.bar.sub.tld1 @10.53.0.1 TXT > dig.out.ns1.test${n} || ret=1
+grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
+grep "IN.*TXT.*baz" dig.out.ns1.test${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "check that correct namespace is chosen for dual-stack-servers ($n)"
+ret=0
+#
+# The two priming queries are needed until we fix dual-stack-servers fully
+#
+dig_with_opts @fd92:7065:b8e:ffff::9 v4.nameserver A > dig.out.prime1.${n} || ret=1
+dig_with_opts @fd92:7065:b8e:ffff::9 v4.nameserver AAAA > dig.out.prime2.${n} || ret=1
+dig_with_opts @fd92:7065:b8e:ffff::9 foo.v4only.net A > dig.out.ns9.${n} || ret=1
+grep "status: NOERROR" dig.out.ns9.${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "check expired TTLs with qtype * (${n})"
+ret=0
+dig_with_opts +tcp @10.53.0.5 mixedttl.tld any > dig.out.1.${n} || ret=1
+ttl1=$(awk '$1 == "mixedttl.tld." && $4 == "A" { print $2 + 1 }' dig.out.1.${n})
+# sleep TTL + 1 so that record has expired
+sleep "${ttl1:-0}"
+dig_with_opts +tcp @10.53.0.5 mixedttl.tld any > dig.out.2.${n} || ret=1
+# check preconditions
+grep "ANSWER: 3," dig.out.1.${n} > /dev/null || ret=1
+lines=$(awk '$1 == "mixedttl.tld." && $2 > 30 { print }' dig.out.1.${n} | wc -l)
+test ${lines:-1} -ne 0 && ret=1
+# check behaviour (there may be 1 answer on very slow machines)
+grep "ANSWER: [12]," dig.out.2.${n} > /dev/null || ret=1
+lines=$(awk '$1 == "mixedttl.tld." && $2 > 30 { print }' dig.out.2.${n} | wc -l)
+test ${lines:-1} -ne 0 && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/rndc/ns7/named.conf.in b/external/mpl/bind/dist/bin/tests/system/rndc/ns7/named.conf.in
index b72122353a5..adca73113af 100644
--- a/external/mpl/bind/dist/bin/tests/system/rndc/ns7/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/rndc/ns7/named.conf.in
@@ -24,12 +24,12 @@ key rndc_key {
};
key int {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
};
key ext {
- algorithm "hmac-sha1";
+ algorithm @DEFAULT_HMAC@;
secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
};
diff --git a/external/mpl/bind/dist/bin/tests/system/rndc/setup.sh b/external/mpl/bind/dist/bin/tests/system/rndc/setup.sh
index 5626eeba123..e7df6e4933b 100644
--- a/external/mpl/bind/dist/bin/tests/system/rndc/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rndc/setup.sh
@@ -36,7 +36,7 @@ copy_setports ns7/named.conf.in ns7/named.conf
make_key () {
$RNDCCONFGEN -k key$1 -A $3 -s 10.53.0.4 -p $2 \
> ns4/key${1}.conf 2> /dev/null
- egrep -v '(^# Start|^# End|^# Use|^[^#])' ns4/key$1.conf | cut -c3- | \
+ grep -E -v '(^# Start|^# End|^# Use|^[^#])' ns4/key$1.conf | cut -c3- | \
sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
}
diff --git a/external/mpl/bind/dist/bin/tests/system/rndc/tests.sh b/external/mpl/bind/dist/bin/tests/system/rndc/tests.sh
index b40b50ed6b5..43e89d308d1 100644
--- a/external/mpl/bind/dist/bin/tests/system/rndc/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rndc/tests.sh
@@ -460,13 +460,13 @@ $DIG @10.53.0.4 -p ${PORT} -c ch -t txt foo12345.bind +qr > dig.out.1.test$n 2>&
grep "query: foo12345.bind CH TXT.*(.*)$" ns4/named.run > /dev/null || ret=1
# query for another builtin zone and check if query was logged (with +subnet=127.0.0.1)
$DIG +subnet=127.0.0.1 @10.53.0.4 -p ${PORT} -c ch -t txt foo12346.bind +qr > dig.out.2.test$n 2>&1 || ret=1
-grep "query: foo12346.bind CH TXT.*\[ECS 127\.0\.0\.1\/32\/0]" ns4/named.run > /dev/null || ret=1
+grep "query: foo12346.bind CH TXT.*\[ECS 127\.0\.0\.1/32/0]" ns4/named.run > /dev/null || ret=1
# query for another builtin zone and check if query was logged (with +subnet=127.0.0.1/24)
$DIG +subnet=127.0.0.1/24 @10.53.0.4 -p ${PORT} -c ch -t txt foo12347.bind +qr > dig.out.3.test$n 2>&1 || ret=1
-grep "query: foo12347.bind CH TXT.*\[ECS 127\.0\.0\.0\/24\/0]" ns4/named.run > /dev/null || ret=1
+grep "query: foo12347.bind CH TXT.*\[ECS 127\.0\.0\.0/24/0]" ns4/named.run > /dev/null || ret=1
# query for another builtin zone and check if query was logged (with +subnet=::1)
$DIG +subnet=::1 @10.53.0.4 -p ${PORT} -c ch -t txt foo12348.bind +qr > dig.out.4.test$n 2>&1 || ret=1
-grep "query: foo12348.bind CH TXT.*\[ECS \:\:1\/128\/0]" ns4/named.run > /dev/null || ret=1
+grep "query: foo12348.bind CH TXT.*\[ECS ::1/128/0]" ns4/named.run > /dev/null || ret=1
# toggle query logging and check again
$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf querylog > /dev/null 2>&1 || ret=1
grep "query logging is now off" ns4/named.run > /dev/null || ret=1
@@ -766,10 +766,10 @@ status=$((status+ret))
n=$((n+1))
echo_i "checking initial in-view zone file is loaded ($n)"
ret=0
-TSIG="hmac-sha1:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.1.test$n
grep 'include 1' dig.out.1.test$n >/dev/null || ret=1
-TSIG="hmac-sha1:ext:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+TSIG="$DEFAULT_HMAC:ext:FrSt77yPTFx6hTs4i2tKLB9LmE0="
$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.2.test$n
grep 'include 1' dig.out.2.test$n >/dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -777,7 +777,7 @@ status=$((status+ret))
echo_i "update in-view zone ($n)"
ret=0
-TSIG="hmac-sha1:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
$NSUPDATE -p ${PORT} -y "$TSIG" > /dev/null 2>&1 <<END || ret=1
server 10.53.0.7
zone test.
@@ -792,7 +792,7 @@ status=$((status+ret))
echo_i "checking update ($n)"
ret=0
-TSIG="hmac-sha1:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
$DIGCMD @10.53.0.7 -y "$TSIG" text2.test. TXT > dig.out.1.test$n
grep 'addition 1' dig.out.1.test$n >/dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -822,10 +822,10 @@ wait_for_log 3 "all zones loaded" ns7/named.run
n=$((n+1))
echo_i "checking zone file edits are loaded ($n)"
ret=0
-TSIG="hmac-sha1:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.1.test$n
grep 'include 2' dig.out.1.test$n >/dev/null || ret=1
-TSIG="hmac-sha1:ext:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+TSIG="$DEFAULT_HMAC:ext:FrSt77yPTFx6hTs4i2tKLB9LmE0="
$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.2.test$n
grep 'include 2' dig.out.2.test$n >/dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
diff --git a/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns1/sign.sh
index 949adcd1def..4a1770ec3bf 100644
--- a/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns1/sign.sh
@@ -18,8 +18,8 @@ zone=.
infile=root.db.in
zonefile=root.db
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyid=`expr ${keyname} : 'K.+008+\(.*\)'`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyid=$(expr ${keyname} : 'K.+[0-9][0-9][0-9]+\(.*\)')
(cd ../ns2 && $SHELL sign.sh ${keyid:-00000} )
diff --git a/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns2/sign.sh b/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns2/sign.sh
index 38c891bdb15..bae212efb6b 100644
--- a/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns2/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rootkeysentinel/ns2/sign.sh
@@ -11,11 +11,13 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
+# leave as expr as expr treats arguments with leading 0's as base 10
+# handle exit code 1 from expr when the result is 0
oldid=${1:-00000}
-newid=`expr \( ${oldid} + 1000 \) % 65536`
-newid=`expr "0000${newid}" : '.*\(.....\)$'`
-badid=`expr \( ${oldid} + 7777 \) % 65536`
-badid=`expr "0000${badid}" : '.*\(.....\)$'`
+newid=$(expr \( ${oldid} + 1000 \) % 65536 || true)
+newid=$(expr "0000${newid}" : '.*\(.....\)$') # prepend leading 0's
+badid=$(expr \( ${oldid} + 7777 \) % 65536 || true)
+badid=$(expr "0000${badid}" : '.*\(.....\)$') # prepend leading 0's
SYSTEMTESTTOP=../..
. $SYSTEMTESTTOP/conf.sh
@@ -24,8 +26,8 @@ zone=example.
infile=example.db.in
zonefile=example.db
-keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+keyname2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
cat $infile $keyname1.key $keyname2.key >$zonefile
echo root-key-sentinel-is-ta-$oldid A 10.53.0.1 >> $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/clean.sh b/external/mpl/bind/dist/bin/tests/system/rpz/clean.sh
index 8b7cad861e5..1a3127cffd2 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -30,7 +32,7 @@ fi
# from the first test pass so the second pass can be set up correctly.
# remove those files first, then decide whether to remove the others.
rm -f ns*/*.key ns*/*.private
-rm -f ns2/tld2s.db ns2/bl.tld2.db
+rm -f ns2/tld2s.db */bl.tld2.db */bl.tld2s.db
rm -f ns3/bl*.db ns3/fast-expire.db ns*/empty.db
rm -f ns3/manual-update-rpz.db
rm -f ns3/mixed-case-rpz.db
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/ns2/base-tld2s.db b/external/mpl/bind/dist/bin/tests/system/rpz/ns2/base-tld2s.db
index 6235b49b39a..77114ec9286 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/ns2/base-tld2s.db
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/ns2/base-tld2s.db
@@ -23,3 +23,4 @@ a0-1-scname CNAME a0-1.tld2.
a3-5 A 192.168.3.5
+a7-2 A 192.168.7.2
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/ns2/tld2.db b/external/mpl/bind/dist/bin/tests/system/rpz/ns2/tld2.db
index 63e985d34af..c6f2556db59 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/ns2/tld2.db
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/ns2/tld2.db
@@ -120,3 +120,6 @@ a6-2 A 192.168.6.2
a7-1 A 192.168.7.1
TXT "a7-1 tld2 text"
+
+a7-2 A 192.168.7.2
+ TXT "a7-2 tld2 text"
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/ns6/bl.tld2s.db.in b/external/mpl/bind/dist/bin/tests/system/rpz/ns6/bl.tld2s.db.in
new file mode 100644
index 00000000000..45380504b4a
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/ns6/bl.tld2s.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+@ SOA rpz.tld2. hostmaster.ns.tld2. ( 3 3600 1200 604800 60 )
+ NS ns2
+ NS ns3
+ns2 A 10.53.0.2
+ns3 A 10.53.0.3
+
+32.2.7.168.192.rpz-ip A 1.1.1.1
+ AAAA ::1
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/ns6/named.conf.in b/external/mpl/bind/dist/bin/tests/system/rpz/ns6/named.conf.in
index 308b7bf458c..4c0520712f5 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/ns6/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/ns6/named.conf.in
@@ -30,6 +30,7 @@ options {
response-policy {
zone "policy1" min-update-interval 0;
+ zone "bl.tld2s" policy given;
} qname-wait-recurse yes
// add-soa yes # leave add-soa as default for unset test
nsip-enable yes
@@ -59,3 +60,8 @@ zone "policy1" {
notify-delay 0;
allow-transfer { any; };
};
+
+zone "bl.tld2s." {
+ type primary;
+ file "bl.tld2s.db";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/qperf.sh b/external/mpl/bind/dist/bin/tests/system/rpz/qperf.sh
index b0e417e2cdd..0b1d3fff1a8 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/qperf.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/qperf.sh
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/setup.sh b/external/mpl/bind/dist/bin/tests/system/rpz/setup.sh
index fea43bdc365..10ab738723e 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/setup.sh
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
@@ -18,7 +18,7 @@ set -e
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
-QPERF=`$SHELL qperf.sh`
+QPERF=$($SHELL qperf.sh)
USAGE="$0: [-DNx]"
DEBUG=
@@ -30,7 +30,7 @@ while getopts "DNx" c; do
*) echo "$USAGE" 1>&2; exit 1 ;;
esac
done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
if test "$#" -ne 0; then
echo "$USAGE" 1>&2
exit 1
@@ -62,7 +62,7 @@ copy_setports dnsrpzd.conf.in dnsrpzd.conf
# Note that dnsrps.conf and dnsrps-slave.conf are included in named.conf
# and differ from dnsrpz.conf which is used by dnsrpzd.
$SHELL ../ckdnsrps.sh -A $TEST_DNSRPS $DEBUG
-test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
+test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS=
# set up test policy zones.
# bl is the main test zone
@@ -88,7 +88,7 @@ cp ns5/expire.conf.in ns5/expire.conf
# $3=input zone file
# $4=output file
signzone () {
- KEYNAME=`$KEYGEN -q -a rsasha256 -K $1 $2`
+ KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2)
cat $1/$3 $1/$KEYNAME.key > $1/tmp
$SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
@@ -169,10 +169,11 @@ $PERL -e 'for ($cnt = $val = 1; $cnt <= 3000; ++$cnt) {
cp ns2/bl.tld2.db.in ns2/bl.tld2.db
cp ns5/empty.db.in ns5/empty.db
cp ns5/empty.db.in ns5/policy2.db
+cp ns6/bl.tld2s.db.in ns6/bl.tld2s.db
# Run dnsrpzd to get the license and prime the static policy zones
if test -n "$TEST_DNSRPS"; then
- DNSRPZD="`../rpz/dnsrps -p`"
+ DNSRPZD="$(../rpz/dnsrps -p)"
cd ns3
"$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \
-w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
diff --git a/external/mpl/bind/dist/bin/tests/system/rpz/tests.sh b/external/mpl/bind/dist/bin/tests/system/rpz/tests.sh
index 9fc5d08cf23..6505082b2c4 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpz/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rpz/tests.sh
@@ -220,7 +220,7 @@ restart () {
done
fi
fi
- $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpz ns$1
+ start_server --noclean --restart --port ${PORT} ns$1
load_db
dnsrps_loaded
sleep 1
@@ -482,7 +482,7 @@ for mode in native dnsrps; do
continue
fi
echo_i "attempting to configure servers with DNSRPS..."
- $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz
+ stop_server --use-rndc --port ${CONTROLPORT}
$SHELL ./setup.sh -N -D $DEBUG
for server in ns*; do
resetstats $server
@@ -497,7 +497,7 @@ for mode in native dnsrps; do
continue
else
echo_i "running DNSRPS sub-test"
- $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpz
+ start_server --noclean --restart --port ${PORT}
sleep 3
fi
;;
@@ -819,7 +819,7 @@ EOF
# restart the main test RPZ server to see if that creates a core file
if test -z "$HAVE_CORE"; then
- $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+ stop_server --use-rndc --port ${CONTROLPORT} ns3
restart 3 "rebuild-bl-rpz"
HAVE_CORE=`find ns* -name '*core*' -print`
test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
@@ -827,10 +827,10 @@ EOF
# look for complaints from lib/dns/rpz.c and bin/name/query.c
for runfile in ns*/named.run; do
- EMSGS=`nextpart $runfile | egrep -l 'invalid rpz|rpz.*failed'`
+ EMSGS=`nextpart $runfile | grep -E -l 'invalid rpz|rpz.*failed'`
if test -n "$EMSGS"; then
setret "error messages in $runfile starting with:"
- egrep 'invalid rpz|rpz.*failed' ns*/named.run | \
+ grep -E 'invalid rpz|rpz.*failed' ns*/named.run | \
sed -e '10,$d' -e 's/^//' | cat_i
fi
done
@@ -839,11 +839,11 @@ EOF
# restart the main test RPZ server with a bad zone.
t=`expr $t + 1`
echo_i "checking that ns3 with broken rpz does not crash (${t})"
- $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+ stop_server --use-rndc --port ${CONTROLPORT} ns3
cp ns3/broken.db.in ns3/bl.db
restart 3 # do not rebuild rpz zones
nocrash a3-1.tld2 -tA
- $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+ stop_server --use-rndc --port ${CONTROLPORT} ns3
restart 3 "rebuild-bl-rpz"
# reload a RPZ zone that is now deliberately broken.
@@ -918,7 +918,18 @@ EOF
if [ native = "$mode" ]; then
t=`expr $t + 1`
- echo_i "checking that "add-soa unset" works (${t})"
+ echo_i "reconfiguring server with 'add-soa no' (${t})"
+ cp ns3/named.conf ns3/named.conf.tmp
+ sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf
+ rndc_reconfig ns3 $ns3
+ echo_i "checking that 'add-soa no' at response-policy level works (${t})"
+ $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
+ grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed"
+ fi
+
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "checking that 'add-soa unset' works (${t})"
$DIG walled.tld2 -p ${PORT} +noall +add @$ns8 > dig.out.${t}
grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
fi
@@ -965,6 +976,15 @@ EOF
done
done
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "checking that rewriting CD=1 queries handles pending data correctly (${t})"
+ $RNDCCMD $ns3 flush
+ $RNDCCMD $ns6 flush
+ $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd > dig.out.${t}
+ grep -w "1.1.1.1" dig.out.${t} > /dev/null || setret "failed"
+ fi
+
[ $status -ne 0 ] && pf=fail || pf=pass
case $mode in
native)
diff --git a/external/mpl/bind/dist/bin/tests/system/rpzrecurse/clean.sh b/external/mpl/bind/dist/bin/tests/system/rpzrecurse/clean.sh
index d14d536dcb1..7b1a8a9274e 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpzrecurse/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rpzrecurse/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/rpzrecurse/tests.sh b/external/mpl/bind/dist/bin/tests/system/rpzrecurse/tests.sh
index 6ecc56331b1..950b610182e 100644
--- a/external/mpl/bind/dist/bin/tests/system/rpzrecurse/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rpzrecurse/tests.sh
@@ -48,13 +48,13 @@ run_server() {
TESTNAME=$1
echo_i "stopping resolver"
- $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpzrecurse ns2
+ stop_server --use-rndc --port ${CONTROLPORT} ns2
sleep 1
echo_i "starting resolver using named.$TESTNAME.conf"
cp -f ns2/named.$TESTNAME.conf ns2/named.conf
- $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpzrecurse ns2
+ start_server --noclean --restart --port ${PORT} ns2
sleep 3
}
@@ -124,7 +124,7 @@ for mode in native dnsrps; do
continue
fi
echo_i "attempting to configure servers with DNSRPS..."
- $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpzrecurse
+ stop_server --use-rndc --port ${CONTROLPORT}
$SHELL ./setup.sh -N -D $DEBUG
sed -n 's/^## //p' dnsrps.conf | cat_i
if grep '^#fail' dnsrps.conf >/dev/null; then
@@ -136,7 +136,7 @@ for mode in native dnsrps; do
continue
else
echo_i "running DNSRPS sub-test"
- $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpzrecurse
+ start_server --noclean --restart --port ${PORT}
sleep 3
fi
;;
@@ -500,7 +500,7 @@ for mode in native dnsrps; do
echo_i "test ${t} failed"
status=1
}
-
+
t=`expr $t + 1`
echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)"
add_test_marker 10.53.0.2 10.53.0.3
diff --git a/external/mpl/bind/dist/bin/tests/system/rrchecker/clean.sh b/external/mpl/bind/dist/bin/tests/system/rrchecker/clean.sh
index 8a7ef708ee6..166247d40c9 100644
--- a/external/mpl/bind/dist/bin/tests/system/rrchecker/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rrchecker/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/rrl/broken.conf.in b/external/mpl/bind/dist/bin/tests/system/rrl/broken.conf.in
new file mode 100644
index 00000000000..020542cfe74
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/rrl/broken.conf.in
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.5;
+ notify-source 10.53.0.5;
+ transfer-source 10.53.0.5;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ listen-on { 10.53.0.5; };
+ listen-on-v6 { none; };
+ notify no;
+
+ rate-limit {
+ responses-per-second 2;
+ all-per-second 50;
+ slip 3;
+ exempt-clients { 10.53.0.7; };
+ log-only yes;
+
+ min-table-size 0;
+ max-table-size 0;
+ };
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
diff --git a/external/mpl/bind/dist/bin/tests/system/rrl/clean.sh b/external/mpl/bind/dist/bin/tests/system/rrl/clean.sh
index abb10bd7449..739366a3f7f 100644
--- a/external/mpl/bind/dist/bin/tests/system/rrl/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rrl/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -16,5 +18,6 @@ rm -f */named.memstats */named.run */named.stats */log-* */session.key
rm -f ns3/bl*.db */*.jnl */*.core */*.pid
rm -f ns*/named.lock
rm -f ns*/named.conf
+rm -f broken.conf
rm -f broken.out
rm -f ns*/managed-keys.bind*
diff --git a/external/mpl/bind/dist/bin/tests/system/rrl/setup.sh b/external/mpl/bind/dist/bin/tests/system/rrl/setup.sh
index 064230aa46c..be63ed9225c 100644
--- a/external/mpl/bind/dist/bin/tests/system/rrl/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rrl/setup.sh
@@ -16,6 +16,7 @@ SYSTEMTESTTOP=..
$SHELL clean.sh
+copy_setports broken.conf.in broken.conf
copy_setports ns1/named.conf.in ns1/named.conf
copy_setports ns2/named.conf.in ns2/named.conf
copy_setports ns3/named.conf.in ns3/named.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/rrl/tests.sh b/external/mpl/bind/dist/bin/tests/system/rrl/tests.sh
index 911ccd11d4a..d4d2a83cd00 100644
--- a/external/mpl/bind/dist/bin/tests/system/rrl/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rrl/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -110,14 +112,14 @@ ck_result() {
# wait to the background mdig calls to complete.
wait
BAD=no
- ADDRS=`egrep "^$2$" mdig.out-$1 2>/dev/null | wc -l`
+ ADDRS=`grep -E "^$2$" mdig.out-$1 2>/dev/null | wc -l`
# count simple truncated and truncated NXDOMAIN as TC
- TC=`egrep "^TC|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l`
- DROP=`egrep "^drop$" mdig.out-$1 2>/dev/null | wc -l`
+ TC=`grep -E "^TC|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l`
+ DROP=`grep -E "^drop$" mdig.out-$1 2>/dev/null | wc -l`
# count NXDOMAIN and truncated NXDOMAIN as NXDOMAIN
- NXDOMAIN=`egrep "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l`
- SERVFAIL=`egrep "^SERVFAIL$" mdig.out-$1 2>/dev/null | wc -l`
- NOERROR=`egrep "^NOERROR$" mdig.out-$1 2>/dev/null | wc -l`
+ NXDOMAIN=`grep -E "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l`
+ SERVFAIL=`grep -E "^SERVFAIL$" mdig.out-$1 2>/dev/null | wc -l`
+ NOERROR=`grep -E "^NOERROR$" mdig.out-$1 2>/dev/null | wc -l`
range $ADDRS "$3" 1 ||
setret "$ADDRS instead of $3 '$2' responses for $1" &&
diff --git a/external/mpl/bind/dist/bin/tests/system/rrsetorder/tests.sh b/external/mpl/bind/dist/bin/tests/system/rrsetorder/tests.sh
index d9dedc3cff8..0f5ce8ac52c 100644
--- a/external/mpl/bind/dist/bin/tests/system/rrsetorder/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rrsetorder/tests.sh
@@ -271,7 +271,7 @@ status=$((status + ret))
echo_i "Shutting down secondary"
-(cd ..; $SHELL stop.sh rrsetorder ns2 )
+stop_server ns2
echo_i "Checking for secondary's on disk copy of zone"
@@ -283,7 +283,7 @@ fi
echo_i "Re-starting secondary"
-$PERL $SYSTEMTESTTOP/start.pl --noclean --port ${PORT} rrsetorder ns2
+start_server --noclean --restart --port ${PORT} ns2
#
#
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/README.md b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/README.md
index 3390e63c23f..44afdbd4212 100644
--- a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/README.md
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/README.md
@@ -29,3 +29,11 @@ Do **not** remove `bigkey.c` as it may be needed to generate a new
`bigkey` is used to both test that we are not running under PKCS#11 and
generate a `DNSKEY` key with a large RSA exponent.
+
+To regenerate `ns2/example.db.bad` comment out the range test in
+opensslrsa_parse before signing the zone with a ZSK key generated
+by `bigkey`.
+
+ if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+ DST_RET(ISC_R_RANGE);
+ }
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns1/sign.sh
index 0e5dc227046..d045fe24521 100755
--- a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns1/sign.sh
@@ -20,7 +20,7 @@ zonefile=root.db
cp ../ns2/dsset-example.in dsset-example$TP
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+keyname=`$KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone`
cat $infile $keyname.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key
new file mode 100644
index 00000000000..60ff1879cb1
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 51650, for example.
+; Created: 20220721024334 (Thu Jul 21 12:43:34 2022)
+; Publish: 20220721024334 (Thu Jul 21 12:43:34 2022)
+; Activate: 20220721024334 (Thu Jul 21 12:43:34 2022)
+example. IN DNSKEY 257 3 8 AwEAAeeXAGBcXxSNj5X/PWT8XDBk4U9OUkZ7YKQBf2IN3V6OZomt/s3F UWIh70Wot+z1Ld3Rfswq1DjCaWNRFOMhs+9j3Fhc46wMZ4pnsDW1nLHk 2TnQRdrbiuhLkQy5oNMjSRxu924XLw5ylsuqjxE7vXcCeKSFe674roSq wo39atWsTJMDz0FQGxlPucnXai0nHoCeC7+u1s+wLaGcpNSZlsab7Zny FD4HZ3HKUCJw/Jjr5CZjqal9KdmWSC1SINRtlAN6PX5VSiNEncnYMCdj iv+ZhRGn+aHh1BmEWomGbAm2Jjw5mrYMgDs9lJRc5Vtg0YXb9OkYvxNF V4QGw1oeF+M=
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private
new file mode 100644
index 00000000000..d38a0b3e857
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: 55cAYFxfFI2Plf89ZPxcMGThT05SRntgpAF/Yg3dXo5mia3+zcVRYiHvRai37PUt3dF+zCrUOMJpY1EU4yGz72PcWFzjrAxnimewNbWcseTZOdBF2tuK6EuRDLmg0yNJHG73bhcvDnKWy6qPETu9dwJ4pIV7rviuhKrCjf1q1axMkwPPQVAbGU+5yddqLScegJ4Lv67Wz7AtoZyk1JmWxpvtmfIUPgdnccpQInD8mOvkJmOpqX0p2ZZILVIg1G2UA3o9flVKI0SdydgwJ2OK/5mFEaf5oeHUGYRaiYZsCbYmPDmatgyAOz2UlFzlW2DRhdv06Ri/E0VXhAbDWh4X4w==
+PublicExponent: AQAB
+PrivateExponent: QaMgBa+YeRxIElS1g14tCMBGxXHmyrgkI0eTYWiZkbedYy8v1QU0NDJ2/NC9VEkHF2PNYrNO08lyEiaEW32NYG92n4qwMm6PmAAcRpSzFQ5N7N9VNRrdK0pjkW45IS5Shd8DfK3QdfFPQOkVxGYgpE7Mf6Cfde9gkxRMsO6erXEud6KyBm8kwBR/ipDeUQvpyGkZEQPjLxJG6REjMVhPKTzCV+82DWEf+Ok/3Uxa94+ocAbySHAV3j4YcWpVGWT002gc6CGk8c6TsPYnDkfKQ3moPQZijH7F8zrARtoobCX9TsMFhBqReceZrbzN7en2cZGR5MSISzoTNSr4rGo6aQ==
+Prime1: 8AV9EllWtclD62XHo95Z3h7JJ9t2gY7fUFG0WMbkI0Wj6kcr7k3bFfLj7GEJ1qgVW4Qpu7XnBvPB9hnqoCkbHLzc8ws1D2tY+PsXzvw9IxoXNM/eCobeulu/rYhJl2PcpY9bPcaaR0hldGoCHdFYSo8oi+C5hfRtIMVjnDtHSmk=
+Prime2: 9wHRxgyHjtl8ro9HAkvujxFkhChm4xLxIRM8pfZ+D1VHpzFRD3/RK8CVYVRB8GsQoFRygHBMOW1oHqynN9jddvJrQbHOqFZAbQQlesp0jRPd9Mm6q0cDwYcD4apscB2CUrUswMzoD3H4saIjGnitCsG/t+sLTvuK/giuMdS2Tms=
+Exponent1: pnSH+pOuiL+dtMCPJVvsoxhilJukodD9mewv0GmOic+gD7dwBgJEcAJUgvgBJLbIqQENGDrcj3u5Bf2PM6eOP+3SpVMeZyUhPPqV1lwj4hYUBfIqoM5L5J4AXk5oCu+cc8zpj/wNvmW8xnFGKnumaX7Ctc8Rmo6ap+F8ZTrPBBE=
+Exponent2: txXZKIRnAkJAwZ6f0pr3w4Hv0GmmAZArvQlmPdncDH94sfvDCssB/v0rfE4Y5hxl4YFWsc8LINHwiDQPajzLwvvi9nnWJT5xWJznLwHbrCparbPNMmFb7lmmTeGlqOCmlamG942qQLCI1xnIDTn/gWalNaz539xhZPSIMZVqX+s=
+Coefficient: eK9cQKFRLaU4udqB8t8KSQxlNl0x9J+9bcaEzn0+579LrZUZvspfiR4DNGwr9qK+PWk+CU7/6xsWbq2zbKIEWucoR97t+E8Zhx00GCDbiu/QI2wviEcYbB2udznRv1WSIDoCWf2TXeh5G2E2ugt5F4+b56qMXmT7IudxYGPtQCY=
+Created: 20220721024334
+Publish: 20220721024334
+Activate: 20220721024334
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key
new file mode 100644
index 00000000000..a1f14c9cce1
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key
@@ -0,0 +1,2 @@
+; This is a zone-signing key, keyid 52810, for example.
+example. IN DNSKEY 256 3 8 BwEAAAAAAAHYYy161+wCg6yFHRlyex8oVkcK+K2SBUryI1+DEKzjusH6 yLfzzlJCPGrubmD+jseKYwXfzelJkRQbMDjWbMYLHKytuPtwnJMSeVh+ a/Ore6oVPXy716EYpsEBSmVjfQyS0mGHpwrYk4QaKjJDM7Q173EFl/sE eXjHqInlzOgJbXqsCrSfA94anSt42DGhJeeIfQ8b3vqD/nCnA6C7khIt AWlfJto7d42Ev8tckjr3CrTW9tn9pHb2DKeh85rKeJBBLMYQU3jfF5KH EEsjztLGMnPLlXTteh8wKrk/0IJrot17w0FR0H2v8oG3xDXxfhJ0OeTW 7dtBHD6ISgqeJ9zt
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private
new file mode 100644
index 00000000000..bbb5ad96534
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private
@@ -0,0 +1,10 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: 2GMtetfsAoOshR0ZcnsfKFZHCvitkgVK8iNfgxCs47rB+si3885SQjxq7m5g/o7HimMF383pSZEUGzA41mzGCxysrbj7cJyTEnlYfmvzq3uqFT18u9ehGKbBAUplY30MktJhh6cK2JOEGioyQzO0Ne9xBZf7BHl4x6iJ5czoCW16rAq0nwPeGp0reNgxoSXniH0PG976g/5wpwOgu5ISLQFpXybaO3eNhL/LXJI69wq01vbZ/aR29gynofOayniQQSzGEFN43xeShxBLI87SxjJzy5V07XofMCq5P9CCa6Lde8NBUdB9r/KBt8Q18X4SdDnk1u3bQRw+iEoKnifc7Q==
+PublicExponent: AQAAAAAAAQ==
+PrivateExponent: aD+JLNdCtAk1++UwcGdPslSoWq2szZHGrY+I+YfhfcBZrPP13exC40hgUgRNuYJOaJ3WMpgsKI4p8YDVNttF6LI7WNBURQhmBSwquB5BWWkoh7uR4PfKWGB0ZkDwUQcA2IdMVS4+QAKVQMmUXGnXhQI1p8duAORZp0gE71VsHTEzwf5AIEG2+f/oCjDsMJN0J7X3qktJr5ho64aMHyHf5+yKk6fFcy7wfC175SkIZ53uBfpCsFXkgq8YukXfcyoG5o4FUHheGnDwkVOzviEUHk8xweJnNNRbV6n/ck9AXzq3VSA9BbrXtRzZmre/L6tJvEnbH0EycwDkxCMlOSqGbQ==
+Prime1: /hnW5M2vzAoAjx2wum98YZZ6gv1IpV88c4HDLA3vY79Qxd8FYanldxPNjgQJEPjHD5hG6tGN+cjZdXv/X+sk5j3fmCB7RKwMKcoD8A/jyH2JaQLTbXm6EBd1BCMIN+w3W+A2E6evYYyINLwMUwqRlUcAaD8HoDLK8iz6iAUhFss=
+Prime2: 2gEuuug1PDnbWWFVzzMUrVXiRiFqJVTTvR3AjJVJNZPwAL4FMenh98rtI3s1zSB6P4RSyvRJ6YMOAT0ZrMxviJy76EExGgCB5F4w7g67I7VGPuA1tLn5kt5j9j5wQmdq1yMG5QpCJWr7bxjSDYvIzy2sZjZ/KTuHGtUzFUnHrCc=
+Exponent1: MaDlpmDYxZ2QvM+cp58Bj160u+21qIA/UZ2ysh6102uQmYHm92481z2+AvCJuq2PpkuROMd/4i2w7L0RbfZ2MYzUFndLZ8NgmNDjNDfUzeRQl2KQdAOLK4DNXmf3mKwLO0Sbj/pxgj0vYAe9gcU4Pe8ukVuSX0nkehbDi4cjfr0=
+Exponent2: cNHFlVCwvEPNVnpQCZS3iqF/D3HN8FtP2st0CrYbjQI8DYpcQUWVMqUqdqFOkYM0/qadpkX+JMlPJTjJZ8YDYYWIZGSC2ruMPIxB7DayVDBbgugmsC1isZjyApdQ44xtdNVyMYmcYeHUz5gR1x/eWdGNyjzMEvfbEjXIKbRykAM=
+Coefficient: ovH/7MP64Dai8draXD3t+jl6UTchig+LDwXA2GvlZY0HVP+9yvE49VSKhoYxolL/ZmabIgzzOAyJ66SyYq31ozxbpKrBGiFdzAbgkJgFIbdYMgfLHXNkH1vissGeY0KdS5ee6sKDfk1VmE94UOVHi11oslvnTiG2RF/I3koYV7Q=
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/dsset-example.in b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/dsset-example.in
index 06bc89aac68..9ad254ba428 100644
--- a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/dsset-example.in
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/dsset-example.in
@@ -1,2 +1 @@
-example. IN DS 5896 5 1 07766192DA7BDE32F6DC719B9F5A3476686F8758
-example. IN DS 5896 5 2 CFBFD9C06EA15B0A984566573A18ACEC234FDC9C09103C0C53E75989 088A8FB4
+example. IN DS 51650 8 2 F225122667540159A30620B2D0888036BDF76276D245DE3453C883F0C3276705
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/example.db.bad b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/example.db.bad
index 449e474ac29..b105978f6a4 100644
--- a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/example.db.bad
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/example.db.bad
@@ -16,97 +16,141 @@ example. 300 IN SOA mname1. . (
604800 ; expire (1 week)
3600 ; minimum (1 hour)
)
- 300 RRSIG SOA 5 1 300 (
- 20361231235959 20000101000000 51829 example.
- HW8O/KHJEObWSYtQD14+3MRtD6rasy/AeIAo
- 1HmtELxeUoMvVcQzm7z1RoeV6S7+r/SrUjAz
- PwtlE4TpyTEj9sfTr4mJhU0DwrNW6dN6qHCw
- vB3nuURVOKzU8V26PdFcjJB+/HnJT2LyLUqr
- KAzHwU1tAXkgx0FOwfyOs2rxooo= )
+ 300 RRSIG SOA 8 1 300 (
+ 20361231235959 20000101000000 52810 example.
+ IfZrUTjdr4Ull5MSQW4eHxrub6X5O8VWB3vG
+ kg6TBT8f2Aw4hLcwT0X47xRqL9nU1kKA3qpu
+ mi71wqiZPbYI+suHYGuqRO/V6YujdQRpLhGS
+ gTpLmETa46unkMDY6sze41AlCyzR79yaDxVS
+ +pS2V1AVYzQzzeswJXHwSLO5HKtClPL3izpV
+ AJD1+dL0UZRs9yOqbxU1RgvASPFEt+1Wd2p6
+ qwyeadJ7PB0PL7QQXSDsQ09Ms1BGoKq5p6Os
+ HtgXPo+aZQR2gczm3Yals9I1tZnk/ZM86aS0
+ 63NrEEUQycMNCr100WgWzYQzO90SmJMqpdeZ
+ fxzlRQbY7jN4qRbM7A== )
300 NS ns2.example.
- 300 RRSIG NS 5 1 300 (
- 20361231235959 20000101000000 51829 example.
- EO8/KzfhppvhD2b0hGCdEN8/WTNexK6zkC1Z
- oW3vu0cFVvac+wrV9Vox90lHI0jTce/R+bvT
- T9RbpZiZcBKLVyBuHIdFPOdc3ogHMPwaPNkD
- pvVvLfV6auHCvINiVw+jWinBpTjqoROH/yTC
- 03BQ41vewKsz3fYZ03XUr2xga5Q= )
- 3600 NSEC a.example. NS SOA RRSIG NSEC DNSKEY
- 3600 RRSIG NSEC 5 1 3600 (
- 20361231235959 20000101000000 51829 example.
- FiUyrwO7MV9Lhg6yu0XN/hLZPOiDg/NqIIUc
- HfA9Yix90Z9G/yzn8NBC92Yp5EPiI4HiE24T
- t1p4YwHe6n/IJA4KZUIpCxEY5xhQL/mVMeuj
- dlFA2LaiDwbOh//42zdocaeGPrcV+u6OmXoU
- xkQIuWeJ1QCaD5FXJdN6zELZsnw= )
- 300 DNSKEY 256 3 5 (
- BwEAAAAAAAGfDKVFak/2o446xOsi39QnfZmR
- idaRyg3LaCxDBM6kVqCHQKI3a2lEf4FWVSbp
- +dYjGavsqWJ/Z7poMRy9JJol2bMLhtsZhESK
- 5EYRaR/2dLw5H10SR+wb/qRVVYovWlk67sql
- 7XYc3x5cjc4XaMVziBBrQMiWqkQS2oGQLwKC
- Lw==
- ) ; ZSK; alg = RSASHA1; key id = 51829
- 300 DNSKEY 257 3 5 (
- AwEAAaLNbgMfH/XUwZC9DBVG4OpYVUVyCyZE
- Bqhk3k6WziIAY+2f7MN3L9CoZR9GqfqM+/c6
- g8gfkIaZZ2YP/YUUaN73xH/nxtHYkrP5Rqe/
- dw7qONnsVwvf3HJ8HvURG3wjaOrPoe207+Hp
- NTNhe/sT2usKhokSU8yKB0DKlnrKQvp9vScs
- IB/RsIxOXWmYgOMkSXtpI3lQ07l1i2Tv6Une
- cD9s8rukfl/gPbRBketLYACrqpb2j/1f7ciQ
- v+rz1GnN9ma8XK1Yw8173/hrVL1S/ZqTGczw
- deA3AVyiHThOZ15EPhSuL7jaJusHOi43Aa8Z
- fCMCeimT73F5epktGomAxFU=
- ) ; KSK; alg = RSASHA1; key id = 5896
- 300 RRSIG DNSKEY 5 1 300 (
- 20361231235959 20000101000000 5896 example.
- b07impYEH+uW8iPCVE0QXqYSs6Yyu7Nb8q1f
- rXv+NgE5wbsIvdo4PDdSfScP41WgVKdLPipH
- gaTyk4CKAuGSvIBMzlc3yib03zdvzBDgn3Yi
- lONpl2yH47vhvn5iXYcVV4kbuYE9+SFVoVO8
- m6xvihm1D17m8emivnG6DuJSpJJM09v0toSd
- 3yGI3bgUtki85ehOPU0ZkvA20InVgP5kKUgw
- /M4vP4VkcwenNO7koMZOorI02KFOH3vvZSI4
- hzuwJVaQZ35IBBVmSSMAD+0LTBk6sMPSpcmP
- Pff75NLhU+4+UflWie6mzWIvm3ovcG3fveq0
- W4G3TCriTIKSjY3Jqg== )
- 300 RRSIG DNSKEY 5 1 300 (
- 20361231235959 20000101000000 51829 example.
- a7WU2WcHEpDfM5NBUzN7t4WXEwldn1EM/HkH
- XEo9NnZhFV16414qbuwWMlUsc5MTii+T4OFZ
- p2+XHj9M8glM1d98o+EDSYT7LdrrE7AqdtSO
- gcXdeY6WRI9R5wkLP3cP6kADp5WIOcQ78IPb
- pRJ4jhxqMPFV3cqCWH/Lp8JPghY= )
+ 300 RRSIG NS 8 1 300 (
+ 20361231235959 20000101000000 52810 example.
+ VUPhDucH6rlx93V13b7OSAQ6fE/9jlxhCTXv
+ peBD69WOa4jZHMZf60gqy10gLVMx35gZdEaU
+ cJqaBcAniSwPY3a7mxclMja7fmuCB9wcSbiP
+ pwk5KIYSgIvoWp3ro2I19C0IDQDVWtH1xqdQ
+ Dv+3MV39Zpf0AnXB05mBopI2DQI9mYHCnmis
+ F3pfcfs+h/ipyodE5kccBBRvtfKWHly342Xe
+ azHKM4eyuGj9NLwuwsoVgnyQ3I9hrKVAiUjS
+ fQ4cxyBVhh+Wb1/VrVSbX+X9VNzQ04mcREHS
+ yXIPoIQBNju3dyOSTQ+VIeasRvRU8nqMS/1f
+ oeqj5ehTjtfejF6Jfw== )
+ 300 NSEC a.example. NS SOA RRSIG NSEC DNSKEY
+ 300 RRSIG NSEC 8 1 300 (
+ 20361231235959 20000101000000 52810 example.
+ bG90DOCaN7BhihvtCUs2eJhSHkRaV582ROQi
+ AbamawevX8NQGJeVpHb3t5ekQuK5EWjLFr6i
+ bga5TpeP8HOv3lDb8w7kb7xOrHycw5Sizws5
+ PZTvtuty9nT6dZ9h4pfLNTbW+SBV904xv3JT
+ ZlXoxtm4JAdmKUcGiCFLjMvwbQ5SKEZq27uN
+ 9xCeY0CPkQmiGbTrySYFyNZsBBsL2OI5ec2V
+ TbQVSDhnnEhbVdMb8Yh2sTt9H/CT1yG2s4U9
+ a9ccxguFzt6mk+f5ZL+WKgxkTOMOrZW3dyiI
+ x53dNQyZN/tczibox/LLG/SaET5wR/V5gDsh
+ 9DObfc9u1+of/H0lhg== )
+ 300 DNSKEY 257 3 8 (
+ AwEAAeeXAGBcXxSNj5X/PWT8XDBk4U9OUkZ7
+ YKQBf2IN3V6OZomt/s3FUWIh70Wot+z1Ld3R
+ fswq1DjCaWNRFOMhs+9j3Fhc46wMZ4pnsDW1
+ nLHk2TnQRdrbiuhLkQy5oNMjSRxu924XLw5y
+ lsuqjxE7vXcCeKSFe674roSqwo39atWsTJMD
+ z0FQGxlPucnXai0nHoCeC7+u1s+wLaGcpNSZ
+ lsab7ZnyFD4HZ3HKUCJw/Jjr5CZjqal9KdmW
+ SC1SINRtlAN6PX5VSiNEncnYMCdjiv+ZhRGn
+ +aHh1BmEWomGbAm2Jjw5mrYMgDs9lJRc5Vtg
+ 0YXb9OkYvxNFV4QGw1oeF+M=
+ ) ; KSK; alg = RSASHA256 ; key id = 51650
+ 300 DNSKEY 256 3 8 (
+ BwEAAAAAAAHYYy161+wCg6yFHRlyex8oVkcK
+ +K2SBUryI1+DEKzjusH6yLfzzlJCPGrubmD+
+ jseKYwXfzelJkRQbMDjWbMYLHKytuPtwnJMS
+ eVh+a/Ore6oVPXy716EYpsEBSmVjfQyS0mGH
+ pwrYk4QaKjJDM7Q173EFl/sEeXjHqInlzOgJ
+ bXqsCrSfA94anSt42DGhJeeIfQ8b3vqD/nCn
+ A6C7khItAWlfJto7d42Ev8tckjr3CrTW9tn9
+ pHb2DKeh85rKeJBBLMYQU3jfF5KHEEsjztLG
+ MnPLlXTteh8wKrk/0IJrot17w0FR0H2v8oG3
+ xDXxfhJ0OeTW7dtBHD6ISgqeJ9zt
+ ) ; ZSK; alg = RSASHA256 ; key id = 52810
+ 300 RRSIG DNSKEY 8 1 300 (
+ 20361231235959 20000101000000 52810 example.
+ O4q1oueEgPoWHhrLiobGvMQLS2KHN+xxSddf
+ y6fqksqivRLgj0633fnEZrFtc44YueV+L4gQ
+ kaoWCCpR0yQH4BOw4p3FVjEgl+jXLzIc7amw
+ ZfKAnSOtMoTaBCQ2hN8b2ducUHgKV7ta9bca
+ lO0wuqqp2OOO/n9S3YMBVfrCW4jL2w1QPC+b
+ lm/4ka8OwqKKGAcO0d/nGeOPJZnfbddSzqEQ
+ C3j1tGavwBC4RAGilxw3XoyoICDp0LQR7M9a
+ tWAxYmMfilEEfpip9R3HhCa+ynIVsHP8yTXE
+ dlWM3LUZePm44aV38YeObJpRMkb8sO5VrbZn
+ 8hJoIs3eyguC4HKKTg== )
+ 300 RRSIG DNSKEY 8 1 300 (
+ 20361231235959 20000101000000 51650 example.
+ Eaw79mOoImGg+ymMJ+9paoanUgR/Od0Pxv/X
+ mevid1TRbssSc2KynAToxSXRcOQwRQjto9sC
+ qj0pOekPPmW1I6DRlMOGDS6l0Uuk51GvUuRD
+ Xbr19BG73mcPuKfYHNbx6cUHvBlPilnjM803
+ m9E8DK6Ba9uo/MNhgtWoWj8wQxqP2YS+HW3v
+ bOv/p4en9Dc5ft6ATtSYj84ejuPAKnfVbleI
+ fJW+qIQ7q9A24xEZ4QlWuRovjsoASVsuLnX+
+ X4sQYlWBIPMQYQ8RIN1CgSRPGb603pAq9ru6
+ ySpjlxHQRtdOGBNJleg9Wz612rHRd3x7BM+8
+ /Lvz31Ot/JSh3u4DSQ== )
a.example. 300 IN A 10.0.0.1
- 300 RRSIG A 5 2 300 (
- 20361231235959 20000101000000 51829 example.
- h4WyY0hUkZobUbt2xWC4lJLEbGvzxGczH/mN
- WHZBpgg+1tuoTAdVbt6a2TfQcJV/iPQGAHte
- Vu/U6tD8KzP08krlqrcefwvR5LDAQygWRdjt
- Rx105w9F0GiL6kpDH6S9T8xCw3aF5Rl1lu/u
- 8eiUzDIMIBTijhXmM96Nde18RdA= )
- 3600 NSEC ns2.example. A RRSIG NSEC
- 3600 RRSIG NSEC 5 2 3600 (
- 20361231235959 20000101000000 51829 example.
- LbzeWbk9r119I95TVCebEPfnCCk9zBRq4nAR
- swliQVQ84bCjwVJfakvlD4mgilSPtypxpyXC
- DQaiOQWOz9LFzro5u71VuSS5fY7U4elp/lq6
- 5BJB6o/dmk5xASAHHbOO6e5dcoQ5vRxcnJaE
- 0vE1jGppo2FiQzkVi7Zbrghoolg= )
+ 300 RRSIG A 8 2 300 (
+ 20361231235959 20000101000000 52810 example.
+ zp4L0Um0guehtT+4GQaMeYx5PiwEbSRyi7sg
+ Xv2uFn/wFML/Df0PgCxCYkWKL2Db/j15IZON
+ uz2CNRG7lDMZsb+JgyLZ6R3OuSKjwzA++kUu
+ 8ExPpdrFHxZFMPefkU1vjf7E1yt4/aSaO23T
+ m0F6yFHcVfBE1DElG1vLWO6cWtSIMKjXOo15
+ Zy2hHhT/7jKhqcHnwwCBHLuV9/e9OmI34H7I
+ Sd3Ik8dnNEjRTVbLem3tQMfQ9ZfYDHPHli+z
+ Z5dGgPmpyNPq5bfs7O5uCO5cNCbouFdEnc6O
+ DA9QiyOGba8w7vI1gHMvA+rWPpA+fTGgrVRq
+ 7bTfa0jTOsybR8rZjg== )
+ 300 NSEC ns2.example. A RRSIG NSEC
+ 300 RRSIG NSEC 8 2 300 (
+ 20361231235959 20000101000000 52810 example.
+ oh6oqdC9OIoO0jIN0x9MIBlYlzAg2LFYffrP
+ QlgPAtPn8A9cPCxU2i6hJ1ubqc6o1LVD7LH6
+ GVj842Ytys1uO2Nwf9xXS4gbchJ6NE9IjQh6
+ IoBNmlgdfprzJEJlEFx73dytakfcjc+hIj8t
+ b14Lu2/5BBDSamw+uVyeV8Wg2jNdrN7UEqyA
+ ccnhLPWHAOtspzxrmCrBDPc6Geelu8KzARs5
+ qOZ/p9CKffmKL/65K/N8WWKQWVNI22tAbiWT
+ J1t3BNkOLUSKMvEVLFcgStV4QtFcQrSB96Hu
+ D2rSbAGsH5Ujmz4GTxhOSqd8OJ7XDEWlhZod
+ LhUBltfjmakorhGqqg== )
ns2.example. 300 IN A 10.53.0.2
- 300 RRSIG A 5 2 300 (
- 20361231235959 20000101000000 51829 example.
- Jfp3xzrym5GksbZ+a2rjOXzV/Ct+eX2DCo8a
- lSbriEhuK9OR3WUnXoDqp1X/d7adNL2lI9c+
- B3UVL+EOCyvNxt9kECcN8KgQdXKExZEQUwnN
- UB51QESM9pW6akavhXJu98sjnhtpdTwrtKbg
- nMJkfYe5Mw3e/8RFY+wpEq/8cHw= )
- 3600 NSEC example. A RRSIG NSEC
- 3600 RRSIG NSEC 5 2 3600 (
- 20361231235959 20000101000000 51829 example.
- Wxkz4nY5rty6O90QhFZguyqbaz9njnJKUs7m
- qYF9u7dDk8vUf3yS97fw3e0N13X5zGZa7hTr
- +65U4NKEOqYDBbvWaXSVFxrzVfSVXqY6l4jX
- kWjA6q4q5TTgcjOUJ0MfvcjtgxcaKUiPGmPJ
- RWdOV7t9YMWnf7QAbPI55QN9sfY= )
+ 300 RRSIG A 8 2 300 (
+ 20361231235959 20000101000000 52810 example.
+ sDlETJwDoWqYZdcwYBW/l+Ot4Tb3mSXJvW3R
+ 1fsoiq/obWZeC+bU2MszckcZKPET2CRqBD+c
+ uLCcOhZrcH0m25Y02SAzOOG2V12KNvWVznSz
+ bZw+/+ucYhxhiNKherdwpHOAdjlhG//zFHDy
+ sAxmrtjWO2DT9pv1Hd/Hm3aGgAYTs0ryyeyo
+ k05sTgdr43APFkX4SNoNXGUEt8E0uMghIvhi
+ mgKSQ45fZFsZeUiEfwvtQ8uAuDNOLWK49Bw5
+ 184QrQ/NZ3YVyJercg7wm/jFMVkgxggiOl2q
+ ZCLadaSQNnsvtbwgyTktRJb5YovzZEQrH7O0
+ vW/DAN1Cqa1nXw/kZA== )
+ 300 NSEC example. A RRSIG NSEC
+ 300 RRSIG NSEC 8 2 300 (
+ 20361231235959 20000101000000 52810 example.
+ DyLuymW3Bv6irCLzfUGnz2cy1XctqfW7ycLc
+ 7wgDzDLNvJ6tqr8tjHKMdCODJDiG+lR5oFo7
+ 8RA604OYcmJjLIAMj3fCxzBkIlH5SXRcJ86X
+ a8U6oXrgt6IvUMC2crdWMVgVnSWlqBS4TNNg
+ QhUa+vt+Em8ce3fveqh1tXm1hzysSroOQtMk
+ HOPAtwYR9XP4mTdbC43AU/67jsYPqXq59lm4
+ sE1tmnVdhXuOk7yNAt8O2CSZGGZl5bYMC4On
+ IgWZP7liebXAmhmXpHbBf5/BaE9dVfvWzYTT
+ 4wUch+f8TDwwyTqumrlrPsVnvkQ9V0LwODox
+ PxWWxFAznmUMEtlo3g== )
diff --git a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/sign.sh b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/sign.sh
index 2f3fa05492d..015f6a90ad7 100755
--- a/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/rsabigexponent/ns2/sign.sh
@@ -18,12 +18,12 @@ zone=example.
infile=example.db.in
outfile=example.db.bad
-for i in Xexample.+005+51829.key Xexample.+005+51829.private \
- Xexample.+005+05896.key Xexample.+005+05896.private
+for i in Xexample.+008+51650.key Xexample.+008+51650.private \
+ Xexample.+008+52810.key Xexample.+008+52810.private
do
cp $i `echo $i | sed s/X/K/`
done
$SIGNER -g -s 20000101000000 -e 20361231235959 -o $zone \
- $infile Kexample.+005+51829 Kexample.+005+51829 \
+ $infile Kexample.+008+52810.key \
> /dev/null 2> signer.err || true
diff --git a/external/mpl/bind/dist/bin/tests/system/run.sh b/external/mpl/bind/dist/bin/tests/system/run.sh
index 14a10670fa8..650ae7f9742 100644
--- a/external/mpl/bind/dist/bin/tests/system/run.sh
+++ b/external/mpl/bind/dist/bin/tests/system/run.sh
@@ -18,7 +18,7 @@
SYSTEMTESTTOP="$(cd -P -- "$(dirname -- "$0")" && pwd -P)"
. $SYSTEMTESTTOP/conf.sh
-if [ "$(id -u)" -eq "0" ] && ! ${NAMED} -V | grep -q -F -- "enable-developer"; then
+if [ "$CI_SERVER" != "yes" ] && [ "$(id -u)" -eq "0" ] && ! ${NAMED} -V | grep -q -F -- "enable-developer"; then
echofail "Refusing to run test as root. Build with --enable-developer to override." >&2
exit 1
fi
diff --git a/external/mpl/bind/dist/bin/tests/system/serve-stale/ans2/ans.pl b/external/mpl/bind/dist/bin/tests/system/serve-stale/ans2/ans.pl
index 0af055a4fb1..f14ae67fe8f 100644
--- a/external/mpl/bind/dist/bin/tests/system/serve-stale/ans2/ans.pl
+++ b/external/mpl/bind/dist/bin/tests/system/serve-stale/ans2/ans.pl
@@ -58,6 +58,8 @@ my $CAA = "othertype.example 2 IN CAA 0 issue \"ca1.example.net\"";
my $negSOA = "example 2 IN SOA . . 0 0 0 0 300";
my $CNAME = "cname.example 7 IN CNAME target.example";
my $TARGET = "target.example 9 IN A $localaddr";
+my $SHORTCNAME = "shortttl.cname.example 1 IN CNAME longttl.target.example";
+my $LONGTARGET = "longttl.target.example 600 IN A $localaddr";
sub reply_handler {
my ($qname, $qclass, $qtype) = @_;
@@ -166,6 +168,28 @@ sub reply_handler {
push @auth, $rr;
}
$rcode = "NOERROR";
+ } elsif ($qname eq "shortttl.cname.example") {
+ if ($qtype eq "A") {
+ my $rr = new Net::DNS::RR($SHORTCNAME);
+ push @ans, $rr;
+ } else {
+ my $rr = new Net::DNS::RR($negSOA);
+ push @auth, $rr;
+ }
+ $rcode = "NOERROR";
+ } elsif ($qname eq "longttl.target.example") {
+ if ($slow_response) {
+ print " Sleeping 3 seconds\n";
+ sleep(3);
+ }
+ if ($qtype eq "A") {
+ my $rr = new Net::DNS::RR($LONGTARGET);
+ push @ans, $rr;
+ } else {
+ my $rr = new Net::DNS::RR($negSOA);
+ push @auth, $rr;
+ }
+ $rcode = "NOERROR";
} elsif ($qname eq "longttl.example") {
if ($qtype eq "TXT") {
my $rr = new Net::DNS::RR($LONGTXT);
diff --git a/external/mpl/bind/dist/bin/tests/system/serve-stale/clean.sh b/external/mpl/bind/dist/bin/tests/system/serve-stale/clean.sh
index 9f718492390..b4a0d5070e2 100644
--- a/external/mpl/bind/dist/bin/tests/system/serve-stale/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/serve-stale/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named3.conf.in b/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named3.conf.in
index 263baa095c8..23f1baaa46c 100644
--- a/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named3.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named3.conf.in
@@ -41,3 +41,8 @@ zone "." {
type primary;
file "root.db";
};
+
+zone "stale.test" {
+ type primary;
+ file "stale.test.db";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/stale.test.db b/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/stale.test.db
new file mode 100644
index 00000000000..d389e7c6a6c
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/stale.test.db
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN stale.test.
+stale.test. 300 SOA . . 0 0 0 0 0
+stale.test. 300 NS ns.stale.test.
+ns.stale.test. 300 A 10.53.0.1
+cname1.stale.test. 1 CNAME a1.stale.test.
+a1.stale.test. 1 A 192.0.2.1
+cname2.stale.test. 1 CNAME a2.stale.test.
+a2.stale.test. 300 A 192.0.2.2
diff --git a/external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named6.conf.in b/external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named6.conf.in
index 78a3e03fd82..6e468d5b3ff 100644
--- a/external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named6.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named6.conf.in
@@ -11,10 +11,6 @@
* information regarding copyright ownership.
*/
-/*
- * Test stale-answer-client-timeout 0.
- */
-
key rndc_key {
secret "1234abcd8765";
algorithm hmac-sha256;
diff --git a/external/mpl/bind/dist/bin/tests/system/serve-stale/tests.sh b/external/mpl/bind/dist/bin/tests/system/serve-stale/tests.sh
index 59e8a1de740..29faa30b00e 100755
--- a/external/mpl/bind/dist/bin/tests/system/serve-stale/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/serve-stale/tests.sh
@@ -29,7 +29,7 @@ n=0
echo_i "test server with serve-stale options set"
n=$((n+1))
-echo_i "prime cache longttl.example ($n)"
+echo_i "prime cache longttl.example TXT ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 longttl.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -38,7 +38,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example ($n)"
+echo_i "prime cache data.example TXT ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -47,7 +47,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache othertype.example ($n)"
+echo_i "prime cache othertype.example CAA ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -56,7 +56,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example ($n)"
+echo_i "prime cache nodata.example TXT ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -65,7 +65,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nxdomain.example ($n)"
+echo_i "prime cache nxdomain.example TXT ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -132,7 +132,7 @@ $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+5))
wait
n=$((n+1))
-echo_i "check stale data.example ($n)"
+echo_i "check stale data.example TXT ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -141,7 +141,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check non-stale longttl.example ($n)"
+echo_i "check non-stale longttl.example TXT ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -150,7 +150,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale othertype.example ($n)"
+echo_i "check stale othertype.example CAA ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -159,7 +159,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example ($n)"
+echo_i "check stale nodata.example TXT ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -168,7 +168,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nxdomain.example ($n)"
+echo_i "check stale nxdomain.example TXT ($n)"
ret=0
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -222,7 +222,7 @@ echo_i "sending query for test ($n)"
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
# Step 5.
-echo_i "check stale data.example (stale-refresh-time) ($n)"
+echo_i "check stale data.example TXT (stale-refresh-time) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -246,7 +246,7 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
# Step 8.
n=$((n+1))
-echo_i "check stale data.example comes from cache (stale-refresh-time) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-refresh-time) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -290,28 +290,28 @@ $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check stale data.example (serve-stale off) ($n)"
+echo_i "check stale data.example TXT (serve-stale off) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale othertype.example (serve-stale off) ($n)"
+echo_i "check stale othertype.example CAA (serve-stale off) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example (serve-stale off) ($n)"
+echo_i "check stale nodata.example TXT (serve-stale off) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nxdomain.example (serve-stale off) ($n)"
+echo_i "check stale nxdomain.example TXT (serve-stale off) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -344,7 +344,7 @@ $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check stale data.example (serve-stale on) ($n)"
+echo_i "check stale data.example TXT (serve-stale on) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -353,7 +353,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale othertype.example (serve-stale on) ($n)"
+echo_i "check stale othertype.example CAA (serve-stale on) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -362,7 +362,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example (serve-stale on) ($n)"
+echo_i "check stale nodata.example TXT (serve-stale on) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -371,7 +371,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nxdomain.example (serve-stale on) ($n)"
+echo_i "check stale nxdomain.example TXT (serve-stale on) ($n)"
ret=0
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -410,7 +410,7 @@ $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check stale data.example (serve-stale reset) ($n)"
+echo_i "check stale data.example TXT (serve-stale reset) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -419,7 +419,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale othertype.example (serve-stale reset) ($n)"
+echo_i "check stale othertype.example CAA (serve-stale reset) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -428,7 +428,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example (serve-stale reset) ($n)"
+echo_i "check stale nodata.example TXT (serve-stale reset) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -437,7 +437,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nxdomain.example (serve-stale reset) ($n)"
+echo_i "check stale nxdomain.example TXT (serve-stale reset) ($n)"
ret=0
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -517,7 +517,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache longttl.example (low max-stale-ttl) ($n)"
+echo_i "prime cache longttl.example TXT (low max-stale-ttl) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 longttl.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -526,7 +526,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example (low max-stale-ttl) ($n)"
+echo_i "prime cache data.example TXT (low max-stale-ttl) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -535,7 +535,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache othertype.example (low max-stale-ttl) ($n)"
+echo_i "prime cache othertype.example CAA (low max-stale-ttl) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -544,7 +544,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example (low max-stale-ttl) ($n)"
+echo_i "prime cache nodata.example TXT (low max-stale-ttl) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -553,7 +553,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nxdomain.example (low max-stale-ttl) ($n)"
+echo_i "prime cache nxdomain.example TXT (low max-stale-ttl) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -602,7 +602,7 @@ $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check stale data.example (low max-stale-ttl) ($n)"
+echo_i "check stale data.example TXT (low max-stale-ttl) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -611,7 +611,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale othertype.example (low max-stale-ttl) ($n)"
+echo_i "check stale othertype.example CAA (low max-stale-ttl) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -620,7 +620,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example (low max-stale-ttl) ($n)"
+echo_i "check stale nodata.example TXT (low max-stale-ttl) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -629,7 +629,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nxdomain.example (low max-stale-ttl) ($n)"
+echo_i "check stale nxdomain.example TXT (low max-stale-ttl) ($n)"
ret=0
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -680,7 +680,7 @@ $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check ancient data.example (low max-stale-ttl) ($n)"
+echo_i "check ancient data.example TXT (low max-stale-ttl) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -688,7 +688,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check ancient othertype.example (low max-stale-ttl) ($n)"
+echo_i "check ancient othertype.example CAA (low max-stale-ttl) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -696,7 +696,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check ancient nodata.example (low max-stale-ttl) ($n)"
+echo_i "check ancient nodata.example TXT (low max-stale-ttl) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -704,7 +704,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check ancient nxdomain.example (low max-stale-ttl) ($n)"
+echo_i "check ancient nxdomain.example TXT (low max-stale-ttl) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -742,7 +742,7 @@ status=$((status+ret))
# Step 1.
n=$((n+1))
-echo_i "prime cache data.example (stale-refresh-time rndc) ($n)"
+echo_i "prime cache data.example TXT (stale-refresh-time rndc) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -770,7 +770,7 @@ echo_i "sending query for test ($n)"
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
# Step 5.
-echo_i "check stale data.example (stale-refresh-time rndc) ($n)"
+echo_i "check stale data.example TXT (stale-refresh-time rndc) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -794,7 +794,7 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
# Step 8.
n=$((n+1))
-echo_i "check stale data.example comes from cache (stale-refresh-time rndc) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-refresh-time rndc) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -846,7 +846,7 @@ status=$((status+ret))
# Step 1.
n=$((n+1))
-echo_i "prime cache data.example (stale-refresh-time disabled) ($n)"
+echo_i "prime cache data.example TXT (stale-refresh-time disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -874,7 +874,7 @@ echo_i "sending query for test ($n)"
$DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
# Step 5.
-echo_i "check stale data.example (stale-refresh-time disabled) ($n)"
+echo_i "check stale data.example TXT (stale-refresh-time disabled) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -898,7 +898,7 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
# Step 8.
n=$((n+1))
-echo_i "check data.example comes from authoritative (stale-refresh-time disabled) ($n)"
+echo_i "check data.example TXT comes from authoritative (stale-refresh-time disabled) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -921,7 +921,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache longttl.example (max-stale-ttl default) ($n)"
+echo_i "prime cache longttl.example TXT (max-stale-ttl default) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 longttl.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -930,7 +930,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example (max-stale-ttl default) ($n)"
+echo_i "prime cache data.example TXT (max-stale-ttl default) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -940,7 +940,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache othertype.example (max-stale-ttl default) ($n)"
+echo_i "prime cache othertype.example CAA (max-stale-ttl default) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 othertype.example CAA > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -950,7 +950,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example (max-stale-ttl default) ($n)"
+echo_i "prime cache nodata.example TXT (max-stale-ttl default) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -960,7 +960,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nxdomain.example (max-stale-ttl default) ($n)"
+echo_i "prime cache nxdomain.example TXT (max-stale-ttl default) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -1014,7 +1014,7 @@ $DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check fail of data.example (max-stale-ttl default) ($n)"
+echo_i "check fail of data.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1022,7 +1022,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of othertype.example (max-stale-ttl default) ($n)"
+echo_i "check fail of othertype.example CAA (max-stale-ttl default) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1030,7 +1030,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of nodata.example (max-stale-ttl default) ($n)"
+echo_i "check fail of nodata.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1038,7 +1038,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of nxdomain.example (max-stale-ttl default) ($n)"
+echo_i "check fail of nxdomain.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1085,7 +1085,7 @@ sleep 2
# Check that if we don't have stale data for a domain name, we will
# not answer anything until the resolver query timeout.
n=$((n+1))
-echo_i "check notincache.example times out (max-stale-ttl default) ($n)"
+echo_i "check notincache.example TXT times out (max-stale-ttl default) ($n)"
ret=0
$DIG -p ${PORT} +tries=1 +timeout=3 @10.53.0.3 notfound.example TXT > dig.out.test$n 2>&1
grep "connection timed out" dig.out.test$n > /dev/null || ret=1
@@ -1102,7 +1102,7 @@ $DIG -p ${PORT} @10.53.0.3 notfound.example TXT > dig.out.test$((n+5))
wait
n=$((n+1))
-echo_i "check data.example (max-stale-ttl default) ($n)"
+echo_i "check data.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -1111,7 +1111,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check othertype.example (max-stale-ttl default) ($n)"
+echo_i "check othertype.example CAA (max-stale-ttl default) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -1120,7 +1120,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check nodata.example (max-stale-ttl default) ($n)"
+echo_i "check nodata.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1129,7 +1129,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check nxdomain.example (max-stale-ttl default) ($n)"
+echo_i "check nxdomain.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1140,7 +1140,7 @@ status=$((status+ret))
# The notfound.example check is different than nxdomain.example because
# we didn't send a prime query to add notfound.example to the cache.
n=$((n+1))
-echo_i "check notfound.example (max-stale-ttl default) ($n)"
+echo_i "check notfound.example TXT (max-stale-ttl default) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1162,7 +1162,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache longttl.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache longttl.example TTL (serve-stale answers disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.4 longttl.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1171,7 +1171,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache data.example TTL (serve-stale answers disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.4 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1181,7 +1181,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache othertype.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache othertype.example CAA (serve-stale answers disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.4 othertype.example CAA > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1191,7 +1191,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache nodata.example TXT (serve-stale answers disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.4 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1201,7 +1201,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nxdomain.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache nxdomain.example TXT (serve-stale answers disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.4 nxdomain.example TXT > dig.out.test$n
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -1255,7 +1255,7 @@ $DIG -p ${PORT} @10.53.0.4 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check fail of data.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of data.example TXT (serve-stale answers disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1263,7 +1263,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of othertype.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of othertype.example TXT (serve-stale answers disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1271,7 +1271,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of nodata.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of nodata.example TXT (serve-stale answers disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1279,7 +1279,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of nxdomain.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of nxdomain.example TXT (serve-stale answers disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1314,7 +1314,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "stop ns4"
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns4
+stop_server --use-rndc --port ${CONTROLPORT} ns4
# Load the cache as if it was five minutes (RBTDB_VIRTUAL) older. Since
# max-stale-ttl defaults to a week, we need to adjust the date by one week and
@@ -1333,7 +1333,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "start ns4"
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} serve-stale ns4
+start_server --noclean --restart --port ${PORT} ns4
n=$((n+1))
echo_i "verify ancient cache statistics (serve-stale answers disabled) ($n)"
@@ -1367,7 +1367,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache longttl.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache longttl.example TXT (serve-stale cache disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.5 longttl.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1376,7 +1376,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache data.example TXT (serve-stale cache disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.5 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1386,7 +1386,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache othertype.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache othertype.example CAA (serve-stale cache disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.5 othertype.example CAA > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1396,7 +1396,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache nodata.example TXT (serve-stale cache disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.5 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1406,7 +1406,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nxdomain.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache nxdomain.example TXT (serve-stale cache disabled) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.5 nxdomain.example TXT > dig.out.test$n
grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -1461,7 +1461,7 @@ $DIG -p ${PORT} @10.53.0.5 nxdomain.example TXT > dig.out.test$((n+4))
wait
n=$((n+1))
-echo_i "check fail of data.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of data.example TXT (serve-stale cache disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1469,7 +1469,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of othertype.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of othertype.example CAA (serve-stale cache disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1477,7 +1477,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of nodata.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of nodata.example TXT (serve-stale cache disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1485,7 +1485,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check fail of nxdomain.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of nxdomain.example TXT (serve-stale cache disabled) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
@@ -1550,7 +1550,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "stop ns5"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns5
+stop_server --use-rndc --port ${CONTROLPORT} ns5
# Load the cache as if it was five minutes (RBTDB_VIRTUAL) older.
cp ns5/named_dump.db.test$n ns5/named_dump.db
@@ -1568,7 +1568,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "start ns5"
-start_server --noclean --restart --port ${PORT} serve-stale ns5
+start_server --noclean --restart --port ${PORT} ns5
n=$((n+1))
echo_i "verify ancient cache statistics (serve-stale cache disabled) ($n)"
@@ -1600,8 +1600,8 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "restart ns3"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns3
-start_server --noclean --restart --port ${PORT} serve-stale ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
+start_server --noclean --restart --port ${PORT} ns3
n=$((n+1))
echo_i "check 'rndc serve-stale status' ($n)"
@@ -1621,7 +1621,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout) ($n)"
+echo_i "prime cache data.example TXT (stale-answer-client-timeout) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1630,7 +1630,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example (stale-answer-client-timeout) ($n)"
+echo_i "prime cache nodata.example TXT (stale-answer-client-timeout) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1663,7 +1663,7 @@ t2=`$PERL -e 'print time()'`
# That should give us enough time to receive an stale answer from cache
# after stale-answer-client-timeout timer of 1.8 sec triggers.
n=$((n+1))
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 1.8) ($n)"
ret=0
wait_for_log 5 "data.example client timeout, stale answer used" ns3/named.run || ret=1
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1676,7 +1676,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example comes from cache (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 1.8) ($n)"
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
@@ -1705,7 +1705,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check not in cache longttl.example times out (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check not in cache longttl.example TXT times out (stale-answer-client-timeout 1.8) ($n)"
ret=0
wait_for_log 4 "longttl.example client timeout, stale answer unavailable" ns3/named.run || ret=1
check_results() {
@@ -1718,7 +1718,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check not in cache longttl.example comes from authoritative (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check not in cache longttl.example TXT comes from authoritative (stale-answer-client-timeout 1.8) ($n)"
ret=0
check_results() {
[ -s "$1" ] || return 1
@@ -1770,13 +1770,86 @@ status=$((status+ret))
wait
n=$((n+1))
-echo_i "check data.example comes from authoritative server (stale-answer-client-timeout off) ($n)"
+echo_i "check data.example TXT comes from authoritative server (stale-answer-client-timeout off) ($n)"
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
+##############################################################
+# Test for stale-answer-client-timeout off and CNAME record. #
+##############################################################
+echo_i "test stale-answer-client-timeout (0) and CNAME record"
+
+n=$((n+1))
+echo_i "prime cache shortttl.cname.example (stale-answer-client-timeout off) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 shortttl.cname.example A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "shortttl\.cname\.example\..*1.*IN.*CNAME.*longttl\.target\.example\." dig.out.test$n > /dev/null || ret=1
+grep "longttl\.target\.example\..*600.*IN.*A.*10\.53\.0\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 1
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+ret=0
+echo_i "check stale shortttl.cname.example comes from cache (stale-answer-client-timeout off) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 shortttl.cname.example A > dig.out.test$n
+wait_for_log 5 "shortttl.cname.example resolver failure, stale answer used" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "shortttl\.cname\.example\..*3.*IN.*CNAME.*longttl\.target\.example\." dig.out.test$n > /dev/null || ret=1
+# We can't reliably test the TTL of the longttl.target.example A record.
+grep "longttl\.target\.example\..*IN.*A.*10\.53\.0\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+ echo_i "failed"
+ echo_i "restart ns3"
+ start_server --noclean --restart --port ${PORT} serve-stale ns3
+fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+ echo_i "failed"
+ echo_i "restart ns3"
+ start_server --noclean --restart --port ${PORT} serve-stale ns3
+fi
+status=$((status+ret))
+
#############################################
# Test for stale-answer-client-timeout 0. #
#############################################
@@ -1790,11 +1863,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "restart ns3"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns3
-start_server --noclean --restart --port ${PORT} serve-stale ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
+start_server --noclean --restart --port ${PORT} ns3
n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout 0)"
+echo_i "prime cache data.example TXT (stale-answer-client-timeout 0)"
ret=0
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1803,7 +1876,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache nodata.example (stale-answer-client-timeout 0)"
+echo_i "prime cache nodata.example TXT (stale-answer-client-timeout 0)"
ret=0
$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1825,7 +1898,7 @@ sleep 2
n=$((n+1))
ret=0
-echo_i "check stale nodata.example comes from cache (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
wait_for_log 5 "nodata.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
@@ -1837,7 +1910,7 @@ status=$((status+ret))
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
@@ -1866,7 +1939,7 @@ wait_for_rrset_refresh() {
# the RRset to be updated.
n=$((n+1))
ret=0
-echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale data.example TXT was refreshed (stale-answer-client-timeout 0) ($n)"
retry_quiet 10 wait_for_rrset_refresh || ret=1
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1885,11 +1958,93 @@ wait_for_nodata_refresh() {
n=$((n+1))
ret=0
-echo_i "check stale nodata.example was refreshed (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale nodata.example TXT was refreshed (stale-answer-client-timeout 0) ($n)"
retry_quiet 10 wait_for_nodata_refresh || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
+############################################################
+# Test for stale-answer-client-timeout 0 and CNAME record. #
+############################################################
+echo_i "test stale-answer-client-timeout (0) and CNAME record"
+
+n=$((n+1))
+echo_i "prime cache cname1.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname1.stale.test A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname1\.stale\.test\..*1.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+grep "a1\.stale\.test\..*1.*IN.*A.*192\.0\.2\.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 1
+
+n=$((n+1))
+ret=0
+echo_i "check stale cname1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 cname1.stale.test A > dig.out.test$n
+wait_for_log 5 "cname1.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname1\.stale\.test\..*3.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+grep "a1\.stale\.test\..*3.*IN.*A.*192\.0\.2\.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+ echo_i "failed"
+ echo_i "restart ns3"
+ start_server --noclean --restart --port ${PORT} ns3
+fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache cname2.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname2.stale.test A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname2\.stale\.test\..*1.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+grep "a2\.stale\.test\..*300.*IN.*A.*192\.0\.2\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow CNAME record in the RRSET to become stale.
+sleep 1
+
+n=$((n+1))
+ret=0
+echo_i "check stale cname2.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 cname2.stale.test A > dig.out.test$n
+wait_for_log 5 "cname2.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname2\.stale\.test\..*3.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+# We can't reliably test the TTL of the a2.stale.test A record.
+grep "a2\.stale\.test\..*IN.*A.*192\.0\.2\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+ echo_i "failed"
+ echo_i "restart ns3"
+ start_server --noclean --restart --port ${PORT} ns3
+fi
+status=$((status+ret))
+
####################################################################
# Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
####################################################################
@@ -1920,7 +2075,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout 0, stale-refresh-time 4) ($n)"
+echo_i "prime cache data.example TXT (stale-answer-client-timeout 0, stale-refresh-time 4) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1943,7 +2098,7 @@ status=$((status+ret))
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
@@ -1967,7 +2122,7 @@ status=$((status+ret))
# the RRset to be updated.
n=$((n+1))
ret=0
-echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
retry_quiet 10 wait_for_rrset_refresh || ret=1
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1990,7 +2145,7 @@ status=$((status+ret))
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
@@ -2010,7 +2165,7 @@ status=$((status+ret))
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache within stale-refresh-time (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache within stale-refresh-time (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example query within stale refresh time" ns3/named.run || ret=1
@@ -2036,7 +2191,7 @@ sleep 1
n=$((n+1))
ret=0
-echo_i "check stale data.example was not refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT was not refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example query within stale refresh time" ns3/named.run || ret=1
@@ -2051,7 +2206,7 @@ sleep 4
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -2062,7 +2217,7 @@ status=$((status+ret))
n=$((n+1))
ret=0
-echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -2156,7 +2311,7 @@ status=$((status+ret))
# 'data.example/TXT' that can be used.
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache (fetch-limits) ($n)"
+echo_i "check stale data.example TXT comes from cache (fetch-limits) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
@@ -2169,7 +2324,7 @@ status=$((status+ret))
# The previous query should not have started the stale-refresh-time window.
n=$((n+1))
ret=0
-echo_i "check stale data.example comes from cache again (fetch-limits) ($n)"
+echo_i "check stale data.example TXT comes from cache again (fetch-limits) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
wait_for_log 5 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
@@ -2223,28 +2378,28 @@ wait
# Expect SERVFAIL for the entries not in cache.
n=$((n+1))
-echo_i "check stale data.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale data.example TXT (fetch-limits dual-mode) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale othertype.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale othertype.example CAA (fetch-limits dual-mode) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nodata.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale nodata.example TXT (fetch-limits dual-mode) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
-echo_i "check stale nxdomain.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale nxdomain.example TXT (fetch-limits dual-mode) ($n)"
ret=0
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2313,7 +2468,7 @@ status=$((status+ret))
# prime the cache with CNAME and A; CNAME expires sooner
n=$((n+1))
-echo_i "prime cache cname.example (stale-answer-client-timeout 1.8) ($n)"
+echo_i "prime cache cname.example A (stale-answer-client-timeout 1.8) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 cname.example A > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
diff --git a/external/mpl/bind/dist/bin/tests/system/shutdown/clean.sh b/external/mpl/bind/dist/bin/tests/system/shutdown/clean.sh
index 89a7aaa4389..d958521541b 100644
--- a/external/mpl/bind/dist/bin/tests/system/shutdown/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/shutdown/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/shutdown/setup.sh b/external/mpl/bind/dist/bin/tests/system/shutdown/setup.sh
index 05bb6f38b8e..575abc6a96a 100644
--- a/external/mpl/bind/dist/bin/tests/system/shutdown/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/shutdown/setup.sh
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
diff --git a/external/mpl/bind/dist/bin/tests/system/shutdown/tests_shutdown.py b/external/mpl/bind/dist/bin/tests/system/shutdown/tests_shutdown.py
new file mode 100755
index 00000000000..2c8c446971d
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/shutdown/tests_shutdown.py
@@ -0,0 +1,207 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from concurrent.futures import ThreadPoolExecutor, as_completed
+import os
+import random
+import signal
+import subprocess
+from string import ascii_lowercase as letters
+import time
+
+import pytest
+
+pytest.importorskip("dns")
+import dns.exception
+import dns.resolver
+
+
+def do_work(named_proc, resolver, rndc_cmd, kill_method, n_workers, n_queries):
+ """Creates a number of A queries to run in parallel
+ in order simulate a slightly more realistic test scenario.
+
+ The main idea of this function is to create and send a bunch
+ of A queries to a target named instance and during this process
+ a request for shutting down named will be issued.
+
+ In the process of shutting down named, a couple control connections
+ are created (by launching rndc) to ensure that the crash was fixed.
+
+ if kill_method=="rndc" named will be asked to shutdown by
+ means of rndc stop.
+ if kill_method=="sigterm" named will be killed by SIGTERM on
+ POSIX systems or by TerminateProcess() on Windows systems.
+
+ :param named_proc: named process instance
+ :type named_proc: subprocess.Popen
+
+ :param resolver: target resolver
+ :type resolver: dns.resolver.Resolver
+
+ :param rndc_cmd: rndc command with default arguments
+ :type rndc_cmd: list of strings, e.g. ["rndc", "-p", "23750"]
+
+ :kill_method: "rndc" or "sigterm"
+ :type kill_method: str
+
+ :param n_workers: Number of worker threads to create
+ :type n_workers: int
+
+ :param n_queries: Total number of queries to send
+ :type n_queries: int
+ """
+ # pylint: disable-msg=too-many-arguments
+ # pylint: disable-msg=too-many-locals
+
+ # helper function, args must be a list or tuple with arguments to rndc.
+ def launch_rndc(args):
+ return subprocess.call(rndc_cmd + args, timeout=10)
+
+ # We're going to execute queries in parallel by means of a thread pool.
+ # dnspython functions block, so we need to circunvent that.
+ with ThreadPoolExecutor(n_workers + 1) as executor:
+
+ # Helper dict, where keys=Future objects and values are tags used
+ # to process results later.
+ futures = {}
+
+ # 50% of work will be A queries.
+ # 1 work will be rndc stop.
+ # Remaining work will be rndc status (so we test parallel control
+ # connections that were crashing named).
+ shutdown = True
+ for i in range(n_queries):
+ if i < (n_queries // 2):
+ # Half work will be standard A queries.
+ # Among those we split 50% queries relname='www',
+ # 50% queries relname=random characters
+ if random.randrange(2) == 1:
+ tag = "good"
+ relname = "www"
+ else:
+ tag = "bad"
+ length = random.randint(4, 10)
+ relname = "".join(
+ letters[random.randrange(len(letters))] for i in range(length)
+ )
+
+ qname = relname + ".test"
+ futures[executor.submit(resolver.query, qname, "A")] = tag
+ elif shutdown: # We attempt to stop named in the middle
+ shutdown = False
+ if kill_method == "rndc":
+ futures[executor.submit(launch_rndc, ["stop"])] = "stop"
+ else:
+ futures[executor.submit(named_proc.terminate)] = "kill"
+ else:
+ # We attempt to send couple rndc commands while named is
+ # being shutdown
+ futures[executor.submit(launch_rndc, ["status"])] = "status"
+
+ ret_code = -1
+ for future in as_completed(futures):
+ try:
+ result = future.result()
+ # If tag is "stop", result is an instance of
+ # subprocess.CompletedProcess, then we check returncode
+ # attribute to know if rncd stop command finished successfully.
+ #
+ # if tag is "kill" then the main function will check if
+ # named process exited gracefully after SIGTERM signal.
+ if futures[future] == "stop":
+ ret_code = result
+
+ except (
+ dns.resolver.NXDOMAIN,
+ dns.resolver.NoNameservers,
+ dns.exception.Timeout,
+ ):
+ pass
+
+ if kill_method == "rndc":
+ assert ret_code == 0
+
+
+def test_named_shutdown(named_port, control_port):
+ # pylint: disable-msg=too-many-locals
+ cfg_dir = os.path.join(os.getcwd(), "resolver")
+ assert os.path.isdir(cfg_dir)
+
+ cfg_file = os.path.join(cfg_dir, "named.conf")
+ assert os.path.isfile(cfg_file)
+
+ named = os.getenv("NAMED")
+ assert named is not None
+
+ rndc = os.getenv("RNDC")
+ assert rndc is not None
+
+ systest_dir = os.getenv("SYSTEMTESTTOP")
+ assert systest_dir is not None
+
+ # rndc configuration resides in $SYSTEMTESTTOP/common/rndc.conf
+ rndc_cfg = os.path.join(systest_dir, "common", "rndc.conf")
+ assert os.path.isfile(rndc_cfg)
+
+ # rndc command with default arguments.
+ rndc_cmd = [rndc, "-c", rndc_cfg, "-p", str(control_port), "-s", "10.53.0.3"]
+
+ # We create a resolver instance that will be used to send queries.
+ resolver = dns.resolver.Resolver()
+ resolver.nameservers = ["10.53.0.3"]
+ resolver.port = named_port
+
+ # We test named shutting down using two methods:
+ # Method 1: using rndc ctop
+ # Method 2: killing with SIGTERM
+ # In both methods named should exit gracefully.
+ for kill_method in ("rndc", "sigterm"):
+ named_cmdline = [named, "-c", cfg_file, "-f"]
+ with subprocess.Popen(named_cmdline, cwd=cfg_dir) as named_proc:
+ # Ensure named is running
+ assert named_proc.poll() is None
+ # wait for named to finish loading
+ for _ in range(10):
+ try:
+ resolver.query("version.bind", "TXT", "CH")
+ break
+ except (dns.resolver.NoNameservers, dns.exception.Timeout):
+ time.sleep(1)
+
+ do_work(
+ named_proc, resolver, rndc_cmd, kill_method, n_workers=12, n_queries=16
+ )
+
+ # Wait named to exit for a maximum of MAX_TIMEOUT seconds.
+ MAX_TIMEOUT = 10
+ is_dead = False
+ for _ in range(MAX_TIMEOUT):
+ if named_proc.poll() is not None:
+ is_dead = True
+ break
+ time.sleep(1)
+
+ if not is_dead:
+ named_proc.send_signal(signal.SIGABRT)
+ for _ in range(MAX_TIMEOUT):
+ if named_proc.poll() is not None:
+ is_dead = True
+ break
+ time.sleep(1)
+ if not is_dead:
+ named_proc.kill()
+
+ assert is_dead
+ # Ensures that named exited gracefully.
+ # If it crashed (abort()) exitcode will be non zero.
+ assert named_proc.returncode == 0
diff --git a/external/mpl/bind/dist/bin/tests/system/smartsign/tests.sh b/external/mpl/bind/dist/bin/tests/system/smartsign/tests.sh
index 64bc7fd6506..ffde69e1c33 100644
--- a/external/mpl/bind/dist/bin/tests/system/smartsign/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/smartsign/tests.sh
@@ -24,55 +24,55 @@ cfile=child.db
echo_i "generating child's keys"
# active zsk
-czsk1=`$KEYGEN -q -a rsasha1 -L 30 $czone`
+czsk1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -L 30 $czone)
# not yet published or active
-czsk2=`$KEYGEN -q -a rsasha1 -P none -A none $czone`
+czsk2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P none -A none $czone)
# published but not active
-czsk3=`$KEYGEN -q -a rsasha1 -A none $czone`
+czsk3=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A none $czone)
# inactive
-czsk4=`$KEYGEN -q -a rsasha1 -P now-24h -A now-24h -I now $czone`
+czsk4=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P now-24h -A now-24h -I now $czone)
# active in 12 hours, inactive 12 hours after that...
-czsk5=`$KEYGEN -q -a rsasha1 -P now+12h -A now+12h -I now+24h $czone`
+czsk5=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P now+12h -A now+12h -I now+24h $czone)
# explicit successor to czk5
# (suppressing warning about lack of removal date)
-czsk6=`$KEYGEN -q -S $czsk5 -i 6h 2>/dev/null`
+czsk6=$($KEYGEN -q -S $czsk5 -i 6h 2>/dev/null)
# active ksk
-cksk1=`$KEYGEN -q -a rsasha1 -fk -L 30 $czone`
+cksk1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk -L 30 $czone)
# published but not YET active; will be active in 20 seconds
-cksk2=`$KEYGEN -q -a rsasha1 -fk $czone`
+cksk2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
# $SETTIME moved after other $KEYGENs
echo_i "revoking key"
# revoking key changes its ID
-cksk3=`$KEYGEN -q -a rsasha1 -fk $czone`
-cksk4=`$REVOKE $cksk3`
+cksk3=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
+cksk4=$($REVOKE $cksk3)
echo_i "setting up sync key"
-cksk5=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now $czone`
+cksk5=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk -P now+1mo -A now+1mo -Psync now $czone)
echo_i "and future sync key"
-cksk6=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now+1mo $czone`
+cksk6=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk -P now+1mo -A now+1mo -Psync now+1mo $czone)
echo_i "generating parent keys"
-pzsk=`$KEYGEN -q -a rsasha1 $pzone`
-pksk=`$KEYGEN -q -a rsasha1 -fk $pzone`
+pzsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $pzone)
+pksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $pzone)
echo_i "setting child's activation time"
# using now+30s to fix RT 24561
$SETTIME -A now+30s $cksk2 > /dev/null
echo_i "signing child zone"
-czoneout=`$SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile`
+czoneout=$($SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile)
echo_i "signing parent zone"
-pzoneout=`$SIGNER -Sg -o $pzone $pfile`
+pzoneout=$($SIGNER -Sg -o $pzone $pfile)
czactive=$(keyfile_to_key_id $czsk1)
czgenerated=$(keyfile_to_key_id $czsk2)
@@ -99,13 +99,13 @@ if [ $ret != 0 ]; then
echo_i "child $czoneout"
echo_i "failed";
fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "rechecking dnssec-signzone output with -x"
ret=0
# use an alternate output file so -x doesn't interfere with later checks
-pzoneout=`$SIGNER -Sxg -o $pzone -f ${pfile}2.signed $pfile`
-czoneout=`$SIGNER -Sxg -e now+1d -X now+2d -o $czone -f ${cfile}2.signed $cfile`
+pzoneout=$($SIGNER -Sxg -o $pzone -f ${pfile}2.signed $pfile)
+czoneout=$($SIGNER -Sxg -e now+1d -X now+2d -o $czone -f ${cfile}2.signed $cfile)
echo "$pzoneout" | grep 'KSKs: 1 active, 0 stand-by, 0 revoked' > /dev/null || ret=1
echo "$pzoneout" | grep 'ZSKs: 1 active, 0 present, 0 revoked' > /dev/null || ret=1
echo "$czoneout" | grep 'KSKs: 1 active, 1 stand-by, 1 revoked' > /dev/null || ret=1
@@ -115,7 +115,7 @@ if [ $ret != 0 ]; then
echo_i "child $czoneout"
echo_i "failed";
fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking parent zone DNSKEY set"
ret=0
@@ -128,7 +128,7 @@ grep "key id = $pkid" $pfile.signed > /dev/null || {
echo_i "missing expected parent KSK id = $pkid"
}
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking parent zone DS records"
ret=0
@@ -139,7 +139,7 @@ grep -w "$ckpublished" dsset.out > /dev/null || ret=1
grep -w "$ckprerevoke" dsset.out > /dev/null && ret=1
grep -w "$ckrevoked" dsset.out > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking child zone DNSKEY set"
ret=0
@@ -185,7 +185,7 @@ grep "key id = $czsuccessor\$" $cfile.signed > /dev/null && {
#grep "key id = $czpredecessor\$" $cfile.signed > /dev/null && ret=1
#grep "key id = $czsuccessor\$" $cfile.signed > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking key TTLs are correct"
ret=0
@@ -197,23 +197,23 @@ grep "${czone}. 45 IN" ${czsk2}.key > /dev/null 2>&1 || ret=1
$SETTIME -L 0 ${czsk2} > /dev/null
grep "${czone}. IN" ${czsk2}.key > /dev/null 2>&1 || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking key TTLs were imported correctly"
ret=0
awk 'BEGIN {r = 0} $2 == "DNSKEY" && $1 != 30 {r = 1} END {exit r}' \
${cfile}.signed || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "re-signing and checking imported TTLs again"
ret=0
$SETTIME -L 15 ${czsk2} > /dev/null
-czoneout=`$SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile`
+czoneout=$($SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile)
awk 'BEGIN {r = 0} $2 == "DNSKEY" && $1 != 15 {r = 1} END {exit r}' \
${cfile}.signed || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# There is some weirdness in Solaris 10 (Generic_120011-14), which
# is why the next section has all those echo $ret > /dev/null;sync
@@ -314,44 +314,44 @@ if [ $ret != 0 ]; then
sed 's/^/I:other sigs: /' < other.sigs
echo_i "failed";
fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking RRSIG expiry date correctness"
-dnskey_expiry=`$CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
+dnskey_expiry=$($CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
awk '$4 == "RRSIG" && $5 == "DNSKEY" {print $9; exit}' |
- cut -c1-10`
-soa_expiry=`$CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
+ cut -c1-10)
+soa_expiry=$($CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
awk '$4 == "RRSIG" && $5 == "SOA" {print $9; exit}' |
- cut -c1-10`
+ cut -c1-10)
[ $dnskey_expiry -gt $soa_expiry ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "waiting 30 seconds for key activation"
sleep 30
echo_i "re-signing child zone"
-czoneout2=`$SIGNER -Sg -o $czone -f $cfile.new $cfile.signed`
+czoneout2=$($SIGNER -Sg -o $czone -f $cfile.new $cfile.signed)
mv $cfile.new $cfile.signed
echo_i "checking dnssec-signzone output matches expectations"
ret=0
echo "$czoneout2" | grep 'KSKs: 2 active, 0 stand-by, 1 revoked' > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking child zone signatures again"
ret=0
awk '$2 == "RRSIG" && $3 == "DNSKEY" { getline; print $3 }' $cfile.signed > dnskey.sigs
grep -w "$ckpublished" dnskey.sigs > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "checking sync record publication"
ret=0
awk 'BEGIN { r=1 } $2 == "CDNSKEY" { r=0 } END { exit r }' $cfile.signed || ret=1
awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
# this also checks that the future sync record is not yet published
echo_i "checking sync record deletion"
@@ -362,7 +362,7 @@ mv $cfile.new $cfile.signed
awk 'BEGIN { r=1 } $2 == "CDNSKEY" { r=0 } END { exit r }' $cfile.signed && ret=1
awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/sortlist/tests.sh b/external/mpl/bind/dist/bin/tests/system/sortlist/tests.sh
index 5d88d1d8339..b290a99efbd 100644
--- a/external/mpl/bind/dist/bin/tests/system/sortlist/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/sortlist/tests.sh
@@ -39,13 +39,13 @@ b.example. 300 IN A 10.53.0.$n
EOF
$DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.2 | sed 1q | \
- egrep '10.53.0.(2|3)$' > test2.out &&
+ grep -E '10.53.0.(2|3)$' > test2.out &&
$DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.3 | sed 1q | \
- egrep '10.53.0.(2|3)$' >> test2.out &&
+ grep -E '10.53.0.(2|3)$' >> test2.out &&
$DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.4 | sed 1q | \
- egrep '10.53.0.4$' >> test2.out &&
+ grep -E '10.53.0.4$' >> test2.out &&
$DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.5 | sed 1q | \
- egrep '10.53.0.5$' >> test2.out || status=1
+ grep -E '10.53.0.5$' >> test2.out || status=1
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/spf/clean.sh b/external/mpl/bind/dist/bin/tests/system/spf/clean.sh
index c7a532fab13..90dc7b61a9f 100644
--- a/external/mpl/bind/dist/bin/tests/system/spf/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/spf/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/start.pl b/external/mpl/bind/dist/bin/tests/system/start.pl
index 657d9880807..80d25eea82f 100755
--- a/external/mpl/bind/dist/bin/tests/system/start.pl
+++ b/external/mpl/bind/dist/bin/tests/system/start.pl
@@ -126,9 +126,10 @@ if ($server_arg) {
# Start the servers we found.
foreach my $name(@ns) {
+ my $instances_so_far = count_running_lines($name);
&check_ns_port($name);
&start_ns_server($name, $options_arg);
- &verify_ns_server($name);
+ &verify_ns_server($name, $instances_so_far);
}
foreach my $name(@ans) {
@@ -372,24 +373,28 @@ sub start_ans_server {
start_server($server, $command, $pid_file);
}
-sub verify_ns_server {
+sub count_running_lines {
my ( $server ) = @_;
- my $tries = 0;
-
my $runfile = "$testdir/$server/named.run";
- while (1) {
- # the shell *ought* to have created the file immediately, but this
- # logic allows the creation to be delayed without issues
- if (open(my $fh, "<", $runfile)) {
- # the two non-whitespace blobs should be the date and time
- # but we don't care about them really, only that they are there
- if (grep /^\S+ \S+ running\R/, <$fh>) {
- last;
- }
- }
+ # the shell *ought* to have created the file immediately, but this
+ # logic allows the creation to be delayed without issues
+ if (open(my $fh, "<", $runfile)) {
+ # the two non-whitespace blobs should be the date and time
+ # but we don't care about them really, only that they are there
+ return scalar(grep /^\S+ \S+ running\R/, <$fh>);
+ } else {
+ return 0;
+ }
+}
+
+sub verify_ns_server {
+ my ( $server, $instances_so_far ) = @_;
+ my $tries = 0;
+
+ while (count_running_lines($server) < $instances_so_far + 1) {
$tries++;
if ($tries >= 30) {
@@ -420,8 +425,13 @@ sub verify_ns_server {
$tcp = "";
}
+ my $ip = "10.53.0.$n";
+ if (-e "$testdir/$server/named.ipv6-only") {
+ $ip = "fd92:7065:b8e:ffff::$n";
+ }
+
while (1) {
- my $return = system("$DIG $tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noedns -p $port version.bind. chaos txt \@10.53.0.$n > /dev/null");
+ my $return = system("$DIG $tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noedns -p $port version.bind. chaos txt \@$ip > /dev/null");
last if ($return == 0);
diff --git a/external/mpl/bind/dist/bin/tests/system/staticstub/ns3/sign.sh b/external/mpl/bind/dist/bin/tests/system/staticstub/ns3/sign.sh
index 84a9eb8066e..111ffaf0de0 100755
--- a/external/mpl/bind/dist/bin/tests/system/staticstub/ns3/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/staticstub/ns3/sign.sh
@@ -22,8 +22,8 @@ zonefile=example.db
cp ../ns4/dsset-sub.example$TP .
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
cat $infile $keyname1.key $keyname2.key > $zonefile
$SIGNER -g -o $zone $zonefile > /dev/null
@@ -34,8 +34,8 @@ keyfile_to_static_ds $keyname2 > trusted.conf
zone=undelegated
infile=undelegated.db.in
zonefile=undelegated.db
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
cat $infile $keyname1.key $keyname2.key > $zonefile
$SIGNER -g -o $zone $zonefile > /dev/null
diff --git a/external/mpl/bind/dist/bin/tests/system/staticstub/ns4/sign.sh b/external/mpl/bind/dist/bin/tests/system/staticstub/ns4/sign.sh
index 4082b7c2905..14c5072d584 100755
--- a/external/mpl/bind/dist/bin/tests/system/staticstub/ns4/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/staticstub/ns4/sign.sh
@@ -18,8 +18,8 @@ zone=sub.example
infile=${zone}.db.in
zonefile=${zone}.db
-keyname1=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
cat $infile $keyname1.key $keyname2.key > $zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/statschannel/tests.sh b/external/mpl/bind/dist/bin/tests/system/statschannel/tests.sh
index 3b1e19165ed..0480b01a5c5 100644
--- a/external/mpl/bind/dist/bin/tests/system/statschannel/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/statschannel/tests.sh
@@ -18,7 +18,7 @@ SYSTEMTESTTOP=..
DIGCMD="$DIG @10.53.0.2 -p ${PORT}"
RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
-if [ ! "$HAVEJSONSTATS" ]
+if ! $FEATURETEST --have-json-c
then
unset PERL_JSON
echo_i "JSON was not configured; skipping" >&2
@@ -30,7 +30,7 @@ else
echo_i "JSON tests require JSON library; skipping" >&2
fi
-if [ ! "$HAVEXMLSTATS" ]
+if ! $FEATURETEST --have-libxml2
then
unset PERL_XML
echo_i "XML was not configured; skipping" >&2
@@ -138,7 +138,7 @@ n=`expr $n + 1`
echo_i "checking consistency between regular and compressed output ($n)"
for i in 1 2 3 4 5; do
ret=0
- if [ "$HAVEXMLSTATS" ];
+ if $FEATURETEST --have-libxml2;
then
URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
filter_str='s#<current-time>.*</current-time>##g'
@@ -164,7 +164,7 @@ n=`expr $n + 1`
ret=0
echo_i "checking if compressed output is really compressed ($n)"
-if [ "$HAVEZLIB" ];
+if $FEATURETEST --with-zlib;
then
REGSIZE=`cat regular.headers | \
grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
@@ -278,6 +278,7 @@ ksk13_id=`cat ns2/$zone.ksk13.id`
zsk13_id=`cat ns2/$zone.zsk13.id`
ksk14_id=`cat ns2/$zone.ksk14.id`
zsk14_id=`cat ns2/$zone.zsk14.id`
+num_ids=$( (echo $ksk8_id; echo $zsk8_id; echo $ksk13_id; echo $zsk13_id; echo $ksk14_id; echo $zsk14_id;) | sort -u | wc -l)
# The dnssec zone has 10 RRsets to sign (including NSEC) with the ZSKs and one
# RRset (DNSKEY) with the KSKs. So starting named with signatures that expire
# almost right away, this should trigger 10 zsk and 1 ksk sign operations per
@@ -298,15 +299,20 @@ cat zones.expect | sort > zones.expect.$n
rm -f zones.expect
# Fetch and check the dnssec sign statistics.
echo_i "fetching zone '$zone' stats data after zone maintenance at startup ($n)"
-if [ $PERL_XML ]; then
- getzones xml $zone x$n || ret=1
- cmp zones.out.x$n zones.expect.$n || ret=1
-fi
-if [ $PERL_JSON ]; then
- getzones json 2 j$n || ret=1
- cmp zones.out.j$n zones.expect.$n || ret=1
+if test $num_ids -eq 6
+then
+ if [ $PERL_XML ]; then
+ getzones xml $zone x$n || ret=1
+ cmp zones.out.x$n zones.expect.$n || ret=1
+ fi
+ if [ $PERL_JSON ]; then
+ getzones json 2 j$n || ret=1
+ cmp zones.out.j$n zones.expect.$n || ret=1
+ fi
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+else
+ echo_i "skipped: duplicate key id detected (fixed in BIND 9.19)"
fi
-if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
@@ -336,15 +342,20 @@ cat zones.expect | sort > zones.expect.$n
rm -f zones.expect
# Fetch and check the dnssec sign statistics.
echo_i "fetching zone '$zone' stats data after dynamic update ($n)"
-if [ $PERL_XML ]; then
- getzones xml $zone x$n || ret=1
- cmp zones.out.x$n zones.expect.$n || ret=1
-fi
-if [ $PERL_JSON ]; then
- getzones json 2 j$n || ret=1
- cmp zones.out.j$n zones.expect.$n || ret=1
+if test $num_ids -eq 6
+then
+ if [ $PERL_XML ]; then
+ getzones xml $zone x$n || ret=1
+ cmp zones.out.x$n zones.expect.$n || ret=1
+ fi
+ if [ $PERL_JSON ]; then
+ getzones json 2 j$n || ret=1
+ cmp zones.out.j$n zones.expect.$n || ret=1
+ fi
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+else
+ echo_i "skipped: duplicate key id detected (fixed in BIND 9.19)"
fi
-if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
diff --git a/external/mpl/bind/dist/bin/tests/system/statschannel/tests_json.py b/external/mpl/bind/dist/bin/tests/system/statschannel/tests_json.py
new file mode 100755
index 00000000000..312c6830a6b
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/statschannel/tests_json.py
@@ -0,0 +1,108 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from datetime import datetime
+
+import pytest
+
+import generic
+import pytest_custom_markers
+
+pytestmark = pytest_custom_markers.have_json_c
+requests = pytest.importorskip("requests")
+
+
+# JSON helper functions
+def fetch_zones_json(statsip, statsport):
+
+ r = requests.get(
+ "http://{}:{}/json/v1/zones".format(statsip, statsport), timeout=600
+ )
+ assert r.status_code == 200
+
+ data = r.json()
+ return data["views"]["_default"]["zones"]
+
+
+def fetch_traffic_json(statsip, statsport):
+
+ r = requests.get(
+ "http://{}:{}/json/v1/traffic".format(statsip, statsport), timeout=600
+ )
+ assert r.status_code == 200
+
+ data = r.json()
+
+ return data["traffic"]
+
+
+def load_timers_json(zone, primary=True):
+
+ name = zone["name"]
+
+ # Check if the primary zone timer exists
+ assert "loaded" in zone
+ loaded = datetime.strptime(zone["loaded"], generic.fmt)
+
+ if primary:
+ # Check if the secondary zone timers does not exist
+ assert "expires" not in zone
+ assert "refresh" not in zone
+ expires = None
+ refresh = None
+ else:
+ assert "expires" in zone
+ assert "refresh" in zone
+ expires = datetime.strptime(zone["expires"], generic.fmt)
+ refresh = datetime.strptime(zone["refresh"], generic.fmt)
+
+ return (name, loaded, expires, refresh)
+
+
+def load_zone_json(zone):
+ name = zone["name"]
+
+ return name
+
+
+def test_zone_timers_primary_json(statsport):
+ generic.test_zone_timers_primary(
+ fetch_zones_json,
+ load_timers_json,
+ statsip="10.53.0.1",
+ statsport=statsport,
+ zonedir="ns1",
+ )
+
+
+def test_zone_timers_secondary_json(statsport):
+ generic.test_zone_timers_secondary(
+ fetch_zones_json,
+ load_timers_json,
+ statsip="10.53.0.3",
+ statsport=statsport,
+ zonedir="ns3",
+ )
+
+
+def test_zone_with_many_keys_json(statsport):
+ generic.test_zone_with_many_keys(
+ fetch_zones_json, load_zone_json, statsip="10.53.0.2", statsport=statsport
+ )
+
+
+def test_traffic_json(named_port, statsport):
+ generic_dnspython = pytest.importorskip("generic_dnspython")
+ generic_dnspython.test_traffic(
+ fetch_traffic_json, statsip="10.53.0.2", statsport=statsport, port=named_port
+ )
diff --git a/external/mpl/bind/dist/bin/tests/system/statschannel/tests_xml.py b/external/mpl/bind/dist/bin/tests/system/statschannel/tests_xml.py
new file mode 100755
index 00000000000..5b187b0f49f
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/statschannel/tests_xml.py
@@ -0,0 +1,137 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from datetime import datetime
+import xml.etree.ElementTree as ET
+
+import pytest
+
+import generic
+import pytest_custom_markers
+
+pytestmark = pytest_custom_markers.have_libxml2
+requests = pytest.importorskip("requests")
+
+
+# XML helper functions
+def fetch_zones_xml(statsip, statsport):
+
+ r = requests.get(
+ "http://{}:{}/xml/v3/zones".format(statsip, statsport), timeout=600
+ )
+ assert r.status_code == 200
+
+ root = ET.fromstring(r.text)
+
+ default_view = None
+ for view in root.find("views").iter("view"):
+ if view.attrib["name"] == "_default":
+ default_view = view
+ break
+ assert default_view is not None
+
+ return default_view.find("zones").findall("zone")
+
+
+def fetch_traffic_xml(statsip, statsport):
+ def load_counters(data):
+ out = {}
+ for counter in data.findall("counter"):
+ out[counter.attrib["name"]] = int(counter.text)
+
+ return out
+
+ r = requests.get(
+ "http://{}:{}/xml/v3/traffic".format(statsip, statsport), timeout=600
+ )
+ assert r.status_code == 200
+
+ root = ET.fromstring(r.text)
+
+ traffic = {}
+ for ip in ["ipv4", "ipv6"]:
+ for proto in ["udp", "tcp"]:
+ proto_root = root.find("traffic").find(ip).find(proto)
+ for counters in proto_root.findall("counters"):
+ if counters.attrib["type"] == "request-size":
+ key = "dns-{}-requests-sizes-received-{}".format(proto, ip)
+ else:
+ key = "dns-{}-responses-sizes-sent-{}".format(proto, ip)
+
+ values = load_counters(counters)
+ traffic[key] = values
+
+ return traffic
+
+
+def load_timers_xml(zone, primary=True):
+
+ name = zone.attrib["name"]
+
+ loaded_el = zone.find("loaded")
+ assert loaded_el is not None
+ loaded = datetime.strptime(loaded_el.text, generic.fmt)
+
+ expires_el = zone.find("expires")
+ refresh_el = zone.find("refresh")
+ if primary:
+ assert expires_el is None
+ assert refresh_el is None
+ expires = None
+ refresh = None
+ else:
+ assert expires_el is not None
+ assert refresh_el is not None
+ expires = datetime.strptime(expires_el.text, generic.fmt)
+ refresh = datetime.strptime(refresh_el.text, generic.fmt)
+
+ return (name, loaded, expires, refresh)
+
+
+def load_zone_xml(zone):
+ name = zone.attrib["name"]
+
+ return name
+
+
+def test_zone_timers_primary_xml(statsport):
+ generic.test_zone_timers_primary(
+ fetch_zones_xml,
+ load_timers_xml,
+ statsip="10.53.0.1",
+ statsport=statsport,
+ zonedir="ns1",
+ )
+
+
+def test_zone_timers_secondary_xml(statsport):
+ generic.test_zone_timers_secondary(
+ fetch_zones_xml,
+ load_timers_xml,
+ statsip="10.53.0.3",
+ statsport=statsport,
+ zonedir="ns3",
+ )
+
+
+def test_zone_with_many_keys_xml(statsport):
+ generic.test_zone_with_many_keys(
+ fetch_zones_xml, load_zone_xml, statsip="10.53.0.2", statsport=statsport
+ )
+
+
+def test_traffic_xml(named_port, statsport):
+ generic_dnspython = pytest.importorskip("generic_dnspython")
+ generic_dnspython.test_traffic(
+ fetch_traffic_xml, statsip="10.53.0.2", statsport=statsport, port=named_port
+ )
diff --git a/external/mpl/bind/dist/bin/tests/system/stop.pl b/external/mpl/bind/dist/bin/tests/system/stop.pl
index abed0bc6bfe..6783b852353 100644
--- a/external/mpl/bind/dist/bin/tests/system/stop.pl
+++ b/external/mpl/bind/dist/bin/tests/system/stop.pl
@@ -183,6 +183,10 @@ sub stop_rndc {
}
my $ip = "10.53.0.$n";
+ if (-e "$testdir/$server/named.ipv6-only") {
+ $ip = "fd92:7065:b8e:ffff::$n";
+ }
+
my $how = $halt ? "halt" : "stop";
# Ugly, but should work.
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/clean.sh b/external/mpl/bind/dist/bin/tests/system/stress/clean.sh
index 0f8403c83a3..b365d7cc77e 100644
--- a/external/mpl/bind/dist/bin/tests/system/stress/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/stress/clean.sh
@@ -17,9 +17,12 @@ rm -f ns?/zones.conf
rm -f ns?/zone*.bk
rm -f ns1/delegations.db
+rm -f ns1/root.db
rm -f ns2/zone0*.db
rm -f ns2/zone0*.jnl
rm -f */named.memstats
rm -f ns*/named.lock
rm -f ns*/managed-keys.bind*
+rm -f ns*/named.run
+rm -f ns*/named.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/ns1/named.conf.in b/external/mpl/bind/dist/bin/tests/system/stress/ns1/named.conf.in
new file mode 100644
index 00000000000..2b54a36eb93
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/stress/ns1/named.conf.in
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.1;
+ notify-source 10.53.0.1;
+ transfer-source 10.53.0.1;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.1; };
+ listen-on-v6 { none; };
+ recursion no;
+ dnssec-validation no;
+ notify yes;
+};
+
+zone "." {
+ type master;
+ file "root.db";
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/ns2/named.conf.in b/external/mpl/bind/dist/bin/tests/system/stress/ns2/named.conf.in
new file mode 100644
index 00000000000..5bbea78acac
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/stress/ns2/named.conf.in
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.2;
+ notify-source 10.53.0.2;
+ transfer-source 10.53.0.2;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.2; };
+ listen-on-v6 { none; };
+ recursion no;
+ dnssec-validation no;
+ notify yes;
+};
+
+zone "." {
+ type hint;
+ file "../../common/root.hint";
+};
+
+include "zones.conf";
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/ns3/named.conf.in b/external/mpl/bind/dist/bin/tests/system/stress/ns3/named.conf.in
new file mode 100644
index 00000000000..b504abba0bd
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/stress/ns3/named.conf.in
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.3;
+ notify-source 10.53.0.3;
+ transfer-source 10.53.0.3;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ recursion yes;
+ dnssec-validation yes;
+ notify yes;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+ type hint;
+ file "../../common/root.hint";
+};
+
+server 10.53.0.4 {
+ provide-ixfr no;
+};
+server 10.53.0.2 {
+ request-ixfr no;
+};
+
+include "zones.conf";
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/ns4/named.conf.in b/external/mpl/bind/dist/bin/tests/system/stress/ns4/named.conf.in
new file mode 100644
index 00000000000..57f7e40fddc
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/stress/ns4/named.conf.in
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+ query-source address 10.53.0.4;
+ notify-source 10.53.0.4;
+ transfer-source 10.53.0.4;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.4; };
+ listen-on-v6 { none; };
+ recursion yes;
+ dnssec-validation yes;
+ notify yes;
+};
+
+zone "." {
+ type hint;
+ file "../../common/root.hint";
+};
+
+include "zones.conf";
+
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/setup.sh b/external/mpl/bind/dist/bin/tests/system/stress/setup.sh
index d166e8e2c36..ebf3a8e7f9d 100644
--- a/external/mpl/bind/dist/bin/tests/system/stress/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/stress/setup.sh
@@ -19,3 +19,8 @@
#
$PERL setup.pl
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
diff --git a/external/mpl/bind/dist/bin/tests/system/stress/tests.sh b/external/mpl/bind/dist/bin/tests/system/stress/tests.sh
index ad7a5e8edc3..9d36c6c5f57 100644
--- a/external/mpl/bind/dist/bin/tests/system/stress/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/stress/tests.sh
@@ -18,7 +18,7 @@ status=0
(
$SHELL -c "while true
- do $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reload 2>&1 |
+ do $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p $CONTROLPORT reload 2>&1 |
sed 's/^/I:ns3 /';
sleep 1
done" & echo $! >reload.pid
@@ -26,7 +26,7 @@ $SHELL -c "while true
for i in 0 1 2 3 4
do
- $PERL update.pl -s 10.53.0.2 -p 5300 zone00000$i.example. &
+ $PERL update.pl -s 10.53.0.2 -p $PORT zone00000$i.example. &
done
echo_i "waiting for background processes to finish"
@@ -35,5 +35,9 @@ wait
echo_i "killing reload loop"
kill `cat reload.pid`
+# If the test has run to completion without named crashing, it has succeeded.
+# Otherwise, the crash will be detected by the test framework and the test will
+# fail.
+
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/stub/tests.sh b/external/mpl/bind/dist/bin/tests/system/stub/tests.sh
index 1b7979df891..6d5d110acc0 100644
--- a/external/mpl/bind/dist/bin/tests/system/stub/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/stub/tests.sh
@@ -55,10 +55,10 @@ digcomp knowngood.dig.out.rec dig.out.ns3 || ret=1
[ $pass = 1 ] && {
echo_i "stopping stub server"
- $PERL $SYSTEMTESTTOP/stop.pl stub ns3
+ stop_server ns3
echo_i "re-starting stub server"
- $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} stub ns3
+ start_server --noclean --restart --port ${PORT} ns3
}
done
diff --git a/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns1/sign.sh
index f2122efb2ba..22407679c49 100644
--- a/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns1/sign.sh
@@ -18,7 +18,7 @@ zone=example
infile=example.db.in
zonefile=example.db
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
cat "$infile" "$keyname.key" > "$zonefile"
$SIGNER -P -o $zone $zonefile > /dev/null
@@ -27,7 +27,7 @@ zone=dnamed
infile=dnamed.db.in
zonefile=dnamed.db
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
cat "$infile" "$keyname.key" > "$zonefile"
$SIGNER -P -o $zone $zonefile > /dev/null
diff --git a/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns4/named.conf.in b/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns4/named.conf.in
index e1620418439..9ecdd0e9c1d 100644
--- a/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns4/named.conf.in
+++ b/external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns4/named.conf.in
@@ -33,4 +33,3 @@ zone "." {
};
include "../ns1/trusted.conf";
-// include "../../common/controls.conf";
diff --git a/external/mpl/bind/dist/bin/tests/system/system-test-driver.sh b/external/mpl/bind/dist/bin/tests/system/system-test-driver.sh
index 275a3efcd44..cf4d5f2732a 100755
--- a/external/mpl/bind/dist/bin/tests/system/system-test-driver.sh
+++ b/external/mpl/bind/dist/bin/tests/system/system-test-driver.sh
@@ -27,7 +27,7 @@ if [ "$?" -ne 4 ]; then
exit 1
fi
-OPTS=$(getopt --shell sh --name "$(basename "$0")" --options '' --longoptions test-name:,log-file:,trs-file:,color-tests:,expect-failure:,enable-hard-errors: -- "$@")
+OPTS=$(getopt --shell "sh" --name "$(basename "$0")" --options '' --longoptions test-name:,log-file:,trs-file:,color-tests:,expect-failure:,enable-hard-errors: -- "$@")
if [ "$?" != 0 ] ; then echo "Failed parsing options." >&2 ; exit 1 ; fi
@@ -74,6 +74,7 @@ fi
echo "Running $TEST_PROGRAM"
-./run.sh -p "$(($RANDOM%32000+32000))" "$@" "$TEST_PROGRAM"
+random=$(awk 'BEGIN { srand(); print int(rand()*32768) }' /dev/null)
+./run.sh -p "$((random%32000+32000))" "$@" "$TEST_PROGRAM"
exit $?
diff --git a/external/mpl/bind/dist/bin/tests/system/tcp/tests_tcp.py b/external/mpl/bind/dist/bin/tests/system/tcp/tests_tcp.py
new file mode 100644
index 00000000000..95553336ccd
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/tcp/tests_tcp.py
@@ -0,0 +1,72 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# pylint: disable=unused-variable
+
+import socket
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.message
+import dns.query
+
+TIMEOUT = 10
+
+
+def create_msg(qname, qtype, edns=-1):
+ msg = dns.message.make_query(qname, qtype, use_edns=edns)
+ return msg
+
+
+def timeout():
+ return time.time() + TIMEOUT
+
+
+def create_socket(host, port):
+ sock = socket.create_connection((host, port), timeout=10)
+ sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, True)
+ return sock
+
+
+# Regression test for CVE-2022-0396
+def test_close_wait(named_port):
+ with create_socket("10.53.0.7", named_port) as sock:
+
+ msg = create_msg("a.example.", "A")
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ msg = dns.message.make_query("a.example.", "A", use_edns=0, payload=1232)
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+ # Shutdown the socket, but ignore the other side closing the socket
+ # first because we sent DNS message with EDNS0
+ try:
+ sock.shutdown(socket.SHUT_RDWR)
+ except ConnectionError:
+ pass
+ except OSError:
+ pass
+
+ # BIND allows one TCP client, the part above sends DNS messaage with EDNS0
+ # after the first query. BIND should react adequately because of
+ # ns7/named.dropedns and close the socket, making room for the next
+ # request. If it gets stuck in CLOSE_WAIT state, there is no connection
+ # available for the query below and it will time out.
+ with create_socket("10.53.0.7", named_port) as sock:
+
+ msg = create_msg("a.example.", "A")
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
diff --git a/external/mpl/bind/dist/bin/tests/system/testcrypto.sh b/external/mpl/bind/dist/bin/tests/system/testcrypto.sh
index 9d1b03b296e..dd1d583527d 100644
--- a/external/mpl/bind/dist/bin/tests/system/testcrypto.sh
+++ b/external/mpl/bind/dist/bin/tests/system/testcrypto.sh
@@ -12,57 +12,69 @@
# information regarding copyright ownership.
SYSTEMTESTTOP=${SYSTEMTESTTOP:=..}
-. $SYSTEMTESTTOP/conf.sh
-
prog=$0
-
args=""
-alg="-a $DEFAULT_ALGORITHM -b $DEFAULT_BITS"
quiet=0
-
msg="cryptography"
+
+if test -z "$KEYGEN"; then
+ . $SYSTEMTESTTOP/conf.sh
+ alg="-a $DEFAULT_ALGORITHM -b $DEFAULT_BITS"
+else
+ alg=""
+ quiet=1
+ args="-q"
+fi
+
while test "$#" -gt 0; do
- case $1 in
- -q)
- args="$args -q"
- quiet=1
- ;;
- rsa|RSA)
- alg="-a RSASHA1"
- msg="RSA cryptography"
- ;;
- rsasha256|RSASHA256)
- alg="-a RSASHA256"
- msg="RSA cryptography"
- ;;
- rsasha512|RSASHA512)
- alg="-a RSASHA512"
- msg="RSA cryptography"
- ;;
- ecdsa|ECDSA|ecdsap256sha256|ECDSAP256SHA256)
- alg="-a ECDSAP256SHA256"
- msg="ECDSA cryptography"
- ;;
- ecdsap384sha384|ECDSAP384SHA384)
- alg="-a ECDSAP384SHA384"
- msg="ECDSA cryptography"
- ;;
- eddsa|EDDSA|ed25519|ED25519)
- alg="-a ED25519"
- msg="EDDSA cryptography"
- ;;
- ed448|ED448)
- alg="-a ED448"
- msg="EDDSA cryptography"
- ;;
- *)
- echo "${prog}: unknown argument"
- exit 1
- ;;
- esac
- shift
+ case $1 in
+ -q)
+ if test $quiet -eq 0; then
+ args="$args -q"
+ quiet=1
+ fi
+ ;;
+ rsa|RSA|rsasha1|RSASHA1)
+ alg="-a RSASHA1"
+ msg="RSA cryptography"
+ ;;
+ rsasha256|RSASHA256)
+ alg="-a RSASHA256"
+ msg="RSA cryptography"
+ ;;
+ rsasha512|RSASHA512)
+ alg="-a RSASHA512"
+ msg="RSA cryptography"
+ ;;
+ ecdsa|ECDSA|ecdsap256sha256|ECDSAP256SHA256)
+ alg="-a ECDSAP256SHA256"
+ msg="ECDSA cryptography"
+ ;;
+ ecdsap384sha384|ECDSAP384SHA384)
+ alg="-a ECDSAP384SHA384"
+ msg="ECDSA cryptography"
+ ;;
+ eddsa|EDDSA|ed25519|ED25519)
+ alg="-a ED25519"
+ msg="EDDSA cryptography"
+ ;;
+ ed448|ED448)
+ alg="-a ED448"
+ msg="EDDSA cryptography"
+ ;;
+ *)
+ echo "${prog}: unknown argument"
+ exit 1
+ ;;
+ esac
+ shift
done
+if test -z "$alg"; then
+ echo "${prog}: no algorithm selected"
+ exit 1
+fi
+
if $KEYGEN $args $alg foo > /dev/null 2>&1
then
rm -f Kfoo*
diff --git a/external/mpl/bind/dist/bin/tests/system/timeouts/tests_tcp_timeouts.py b/external/mpl/bind/dist/bin/tests/system/timeouts/tests_tcp_timeouts.py
new file mode 100644
index 00000000000..0aa7c167c52
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/timeouts/tests_tcp_timeouts.py
@@ -0,0 +1,283 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# pylint: disable=unused-variable
+
+import socket
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.edns
+import dns.message
+import dns.name
+import dns.query
+import dns.rdataclass
+import dns.rdatatype
+
+import pytest_custom_markers # pylint: disable=import-error
+
+
+TIMEOUT = 10
+
+
+def create_msg(qname, qtype):
+ msg = dns.message.make_query(
+ qname, qtype, want_dnssec=True, use_edns=0, payload=4096
+ )
+ return msg
+
+
+def timeout():
+ return time.time() + TIMEOUT
+
+
+def test_initial_timeout(named_port):
+ #
+ # The initial timeout is 2.5 seconds, so this should timeout
+ #
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ time.sleep(3)
+
+ msg = create_msg("example.", "A")
+
+ with pytest.raises(EOFError):
+ try:
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+ except ConnectionError as e:
+ raise EOFError from e
+
+
+def test_idle_timeout(named_port):
+ #
+ # The idle timeout is 5 seconds, so the third message should fail
+ #
+ msg = create_msg("example.", "A")
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ time.sleep(1)
+
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ time.sleep(2)
+
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ time.sleep(6)
+
+ with pytest.raises(EOFError):
+ try:
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+ except ConnectionError as e:
+ raise EOFError from e
+
+
+def test_keepalive_timeout(named_port):
+ #
+ # Keepalive is 7 seconds, so the third message should succeed.
+ #
+ msg = create_msg("example.", "A")
+ kopt = dns.edns.GenericOption(11, b"\x00")
+ msg.use_edns(edns=True, payload=4096, options=[kopt])
+
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ time.sleep(1)
+
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ time.sleep(2)
+
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ time.sleep(6)
+
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+
+def test_pipelining_timeout(named_port):
+ #
+ # The pipelining should only timeout after the last message is received
+ #
+ msg = create_msg("example.", "A")
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ time.sleep(1)
+
+ # Send and receive 25 DNS queries
+ for n in range(25):
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ for n in range(25):
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ time.sleep(3)
+
+ # Send and receive 25 DNS queries
+ for n in range(25):
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ for n in range(25):
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ time.sleep(6)
+
+ with pytest.raises(EOFError):
+ try:
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+ except ConnectionError as e:
+ raise EOFError from e
+
+
+def test_long_axfr(named_port):
+ #
+ # The timers should not fire during AXFR, thus the connection should not
+ # close abruptly
+ #
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ name = dns.name.from_text("example.")
+ msg = create_msg("example.", "AXFR")
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+ # Receive the initial DNS message with SOA
+ (response, rtime) = dns.query.receive_tcp(
+ sock, timeout(), one_rr_per_rrset=True
+ )
+ soa = response.get_rrset(
+ dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+ )
+ assert soa is not None
+
+ # Pull DNS message from wire until the second SOA is received
+ while True:
+ (response, rtime) = dns.query.receive_tcp(
+ sock, timeout(), one_rr_per_rrset=True
+ )
+ soa = response.get_rrset(
+ dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+ )
+ if soa is not None:
+ break
+ assert soa is not None
+
+
+# This test relies on the maximum socket send buffer size (wmem_max) being set
+# to 212992 bytes (the typical default value on Linux systems). Environments
+# that use a different value for this setting (for example, FreeBSD defaults to
+# 32768 bytes) may need their system-level settings to be tweaked in order for
+# this test to pass.
+def test_send_timeout(named_port):
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ # Send and receive single large RDATA over TCP
+ msg = create_msg("large.example.", "TXT")
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+ # Send and receive 28 large (~32k) DNS queries that should
+ # fill the default maximum 208k TCP send buffer
+ for n in range(28):
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+ # configure idle interval is 5 seconds, sleep 6 to make sure we are
+ # above the interval
+ time.sleep(6)
+
+ with pytest.raises(EOFError):
+ try:
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+ (response, rtime) = dns.query.receive_tcp(sock, timeout())
+ except ConnectionError as e:
+ raise EOFError from e
+
+
+@pytest_custom_markers.long_test
+def test_max_transfer_idle_out(named_port):
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ name = dns.name.from_text("example.")
+ msg = create_msg("example.", "AXFR")
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+ # Receive the initial DNS message with SOA
+ (response, rtime) = dns.query.receive_tcp(
+ sock, timeout(), one_rr_per_rrset=True
+ )
+ soa = response.get_rrset(
+ dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+ )
+ assert soa is not None
+
+ time.sleep(61) # max-transfer-idle-out is 1 minute
+
+ with pytest.raises(ConnectionResetError):
+ # Process queued TCP messages
+ while True:
+ (response, rtime) = dns.query.receive_tcp(
+ sock, timeout(), one_rr_per_rrset=True
+ )
+ soa = response.get_rrset(
+ dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+ )
+ if soa is not None:
+ break
+ assert soa is None
+
+
+@pytest_custom_markers.long_test
+def test_max_transfer_time_out(named_port):
+ with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+ sock.connect(("10.53.0.1", named_port))
+
+ name = dns.name.from_text("example.")
+ msg = create_msg("example.", "AXFR")
+ (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+ # Receive the initial DNS message with SOA
+ (response, rtime) = dns.query.receive_tcp(
+ sock, timeout(), one_rr_per_rrset=True
+ )
+ soa = response.get_rrset(
+ dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+ )
+ assert soa is not None
+
+ # The loop should timeout at the 5 minutes (max-transfer-time-out)
+ with pytest.raises(EOFError):
+ while True:
+ time.sleep(1)
+ (response, rtime) = dns.query.receive_tcp(
+ sock, timeout(), one_rr_per_rrset=True
+ )
+ soa = response.get_rrset(
+ dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+ )
+ if soa is not None:
+ break
+ assert soa is None
diff --git a/external/mpl/bind/dist/bin/tests/system/tsiggss/tests.sh b/external/mpl/bind/dist/bin/tests/system/tsiggss/tests.sh
index c090d33b2e6..2d5dc8e06ed 100644
--- a/external/mpl/bind/dist/bin/tests/system/tsiggss/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/tsiggss/tests.sh
@@ -55,7 +55,7 @@ EOF
return 1
}
- out=`$DIG $DIGOPTS -t $type -q $host | egrep "^${host}"`
+ out=`$DIG $DIGOPTS -t $type -q $host | grep -E "^${host}"`
lines=`echo "$out" | grep "$digout" | wc -l`
[ $lines -eq 1 ] || {
echo_i "dig output incorrect for $host $type $cmd: $out"
diff --git a/external/mpl/bind/dist/bin/tests/system/unknown/ns3/sign.sh b/external/mpl/bind/dist/bin/tests/system/unknown/ns3/sign.sh
index d83181d8d87..76063a74463 100644
--- a/external/mpl/bind/dist/bin/tests/system/unknown/ns3/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/unknown/ns3/sign.sh
@@ -17,5 +17,5 @@ SYSTEMTESTTOP=../..
zone=example
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
diff --git a/external/mpl/bind/dist/bin/tests/system/unknown/setup.sh b/external/mpl/bind/dist/bin/tests/system/unknown/setup.sh
index feaa1a7bbb5..9b65d053a76 100644
--- a/external/mpl/bind/dist/bin/tests/system/unknown/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/unknown/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/unknown/tests.sh b/external/mpl/bind/dist/bin/tests/system/unknown/tests.sh
index 4c4776d4f76..e324faeaf17 100644
--- a/external/mpl/bind/dist/bin/tests/system/unknown/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/unknown/tests.sh
@@ -158,8 +158,8 @@ done
status=`expr $status + $ret`
echo_i "stop and restart secondary"
-$PERL $SYSTEMTESTTOP/stop.pl unknown ns2
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} unknown ns2
+stop_server ns2
+start_server --noclean --restart --port ${PORT} ns2
# server may be answering queries before zones are loaded,
# so retry a few times if this query fails
@@ -184,8 +184,8 @@ $DIFF large.out dig.out.test$n > /dev/null || { ret=1 ; echo_i "$DIFF failed"; }
status=`expr $status + $ret`
echo_i "stop and restart inline secondary"
-$PERL $SYSTEMTESTTOP/stop.pl unknown ns3
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} unknown ns3
+stop_server ns3
+start_server --noclean --restart --port ${PORT} ns3
# server may be answering queries before zones are loaded,
# so retry a few times if this query fails
diff --git a/external/mpl/bind/dist/bin/tests/system/upforwd/clean.sh b/external/mpl/bind/dist/bin/tests/system/upforwd/clean.sh
index 9370bc8d702..14a7d295f8f 100644
--- a/external/mpl/bind/dist/bin/tests/system/upforwd/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/upforwd/clean.sh
@@ -31,3 +31,5 @@ rm -f keyname keyname.err
rm -f ns*/named.lock
rm -f ns1/example2.db
rm -f ns*/managed-keys.bind*
+rm -f nsupdate.out.*
+rm -f ns*/named.run.prev
diff --git a/external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named1.conf.in b/external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named1.conf.in
new file mode 100644
index 00000000000..61d42c89544
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named1.conf.in
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.3;
+ notify-source 10.53.0.3;
+ transfer-source 10.53.0.3;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ recursion no;
+ notify yes;
+ include "dnstap.conf";
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "example" {
+ type secondary;
+ file "example.bk";
+ allow-update-forwarding { 10.53.0.1; };
+ primaries { 10.53.0.1; };
+};
+
+zone "example2" {
+ type secondary;
+ file "example2.bk";
+ allow-update-forwarding { 10.53.0.1; };
+ primaries { 10.53.0.1; };
+};
+
+zone "example3" {
+ type secondary;
+ file "example3.bk";
+ allow-update-forwarding { 10.53.0.1; };
+ primaries { 10.53.0.1; };
+};
+
+zone "nomaster" {
+ type secondary;
+ file "nomaster1.db";
+ allow-update-forwarding { any; };
+ masterfile-format text;
+ primaries { 10.53.0.4; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named2.conf.in b/external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named2.conf.in
new file mode 100644
index 00000000000..86d7469601e
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/upforwd/ns3/named2.conf.in
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.3;
+ notify-source 10.53.0.3;
+ transfer-source 10.53.0.3;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ recursion no;
+ notify yes;
+ update-quota 1;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "example" {
+ type secondary;
+ file "example.bk";
+ allow-update-forwarding { any; };
+ primaries { 10.53.0.1; };
+};
diff --git a/external/mpl/bind/dist/bin/tests/system/upforwd/setup.sh b/external/mpl/bind/dist/bin/tests/system/upforwd/setup.sh
index f0ed50c7186..c7c9afc6035 100644
--- a/external/mpl/bind/dist/bin/tests/system/upforwd/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/upforwd/setup.sh
@@ -19,7 +19,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
copy_setports ns1/named.conf.in ns1/named.conf
copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns3/named1.conf.in ns3/named.conf
if $FEATURETEST --enable-dnstap
then
@@ -37,7 +37,7 @@ fi
#
# SIG(0) required cryptographic support which may not be configured.
#
-keyname=`$KEYGEN -q -n HOST -a RSASHA1 -b 1024 -T KEY sig0.example2 2>keyname.err`
+keyname=$($KEYGEN -q -n HOST -a ${DEFAULT_ALGORITHM} -b 1024 -T KEY sig0.example2 2>keyname.err)
if test -n "$keyname"
then
cat ns1/example1.db $keyname.key > ns1/example2.db
diff --git a/external/mpl/bind/dist/bin/tests/system/upforwd/tests.sh b/external/mpl/bind/dist/bin/tests/system/upforwd/tests.sh
index c0293b3132e..35c55880b3a 100644
--- a/external/mpl/bind/dist/bin/tests/system/upforwd/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/upforwd/tests.sh
@@ -82,6 +82,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
echo_i "updating zone (signed) ($n)"
ret=0
$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
+local 10.53.0.1
server 10.53.0.3 ${PORT}
update add updated.example. 600 A 10.10.10.1
update add updated.example. 600 TXT Foo
@@ -140,6 +141,7 @@ fi
echo_i "updating zone (unsigned) ($n)"
ret=0
$NSUPDATE -- - <<EOF || ret=1
+local 10.53.0.1
server 10.53.0.3 ${PORT}
update add unsigned.example. 600 A 10.10.10.1
update add unsigned.example. 600 TXT Foo
@@ -196,6 +198,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
do
(
$NSUPDATE -- - <<EOF
+local 10.53.0.1
server 10.53.0.3 ${PORT}
zone nomaster
update add unsigned.nomaster. 600 A 10.10.10.1
@@ -227,6 +230,7 @@ then
ret=0
keyname=`cat keyname`
$NSUPDATE -k $keyname.private -- - <<EOF
+ local 10.53.0.1
server 10.53.0.3 ${PORT}
zone example2
update add unsigned.example2. 600 A 10.10.10.1
@@ -251,5 +255,40 @@ EOF
fi
fi
+echo_i "attempting an update that should be rejected by ACL ($n)"
+ret=0
+{
+ $NSUPDATE -- - << EOF
+ local 10.53.0.2
+ server 10.53.0.3 ${PORT}
+ update add another.unsigned.example. 600 A 10.10.10.2
+ update add another.unsigned.example. 600 TXT Bar
+ send
+EOF
+} > nsupdate.out.$n 2>&1
+grep REFUSED nsupdate.out.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+n=`expr $n + 1`
+
+n=$((n + 1))
+ret=0
+echo_i "attempting updates that should exceed quota ($n)"
+# lower the update quota to 1.
+copy_setports ns3/named2.conf.in ns3/named.conf
+rndc_reconfig ns3 10.53.0.3
+nextpart ns3/named.run > /dev/null
+for loop in 1 2 3 4 5 6 7 8 9 10; do
+{
+ $NSUPDATE -- - > /dev/null 2>&1 <<END
+ local 10.53.0.1
+ server 10.53.0.3 ${PORT}
+ update add txt-$loop.unsigned.example 300 IN TXT Whatever
+ send
+END
+} &
+done
+wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/external/mpl/bind/dist/bin/tests/system/verify/clean.sh b/external/mpl/bind/dist/bin/tests/system/verify/clean.sh
index c1d692e95a7..767ca771907 100644
--- a/external/mpl/bind/dist/bin/tests/system/verify/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/verify/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/verify/tests.sh b/external/mpl/bind/dist/bin/tests/system/verify/tests.sh
index d53bb37eee9..cda891a925e 100644
--- a/external/mpl/bind/dist/bin/tests/system/verify/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/verify/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/verify/zones/genzones.sh b/external/mpl/bind/dist/bin/tests/system/verify/zones/genzones.sh
index e8ac9aaa139..d0ab4e5b86b 100644
--- a/external/mpl/bind/dist/bin/tests/system/verify/zones/genzones.sh
+++ b/external/mpl/bind/dist/bin/tests/system/verify/zones/genzones.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
@@ -18,12 +20,13 @@ dumpit () {
echo_d "${debug}: dumping ${1}"
cat "${1}" | cat_d
}
+
setup () {
echo_i "setting up $2 zone: $1"
debug="$1"
zone="$1"
file="$1.$2"
- n=`expr ${n:-0} + 1`
+ n=$((${n:-0} + 1))
}
# A unsigned zone should fail validation.
@@ -32,47 +35,47 @@ cp unsigned.db unsigned.bad
# A set of nsec zones.
setup zsk-only.nsec good
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -SP -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk-only.nsec good
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -SPz -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.nsec good
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
$SIGNER -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.nsec.apex-dname good
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cp unsigned.db ${file}.tmp
echo "@ DNAME data" >> ${file}.tmp
$SIGNER -SP -o ${zone} -f ${file} ${file}.tmp > s.out$n || dumpit s.out$n
# A set of nsec3 zones.
setup zsk-only.nsec3 good
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -3 - -SP -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk-only.nsec3 good
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -3 - -SPz -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.nsec3 good
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
$SIGNER -3 - -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.optout good
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
$SIGNER -3 - -A -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.nsec3.apex-dname good
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cp unsigned.db ${file}.tmp
echo "@ DNAME data" >> ${file}.tmp
$SIGNER -3 - -SP -o ${zone} -f ${file} ${file}.tmp > s.out$n || dumpit s.out$n
@@ -84,8 +87,8 @@ $SIGNER -3 - -SP -o ${zone} -f ${file} ${file}.tmp > s.out$n || dumpit s.out$n
# becomes foo when the zone is loaded.
#
setup nsec-next-name-case-mismatch good
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat << EOF > ${zone}.tmp
\$TTL 0
@ IN SOA foo . ( 1 28800 7200 604800 1800 )
@@ -101,71 +104,71 @@ sed 's/^FOO\./foo\./' < ${file}.tmp > ${file}
# A set of zones with only DNSKEY records.
setup zsk-only.dnskeyonly bad
-key1=`$KEYGEN -a rsasha256 ${zone} 2>kg.out` || dumpit kg.out$n
+key1=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2>kg.out) || dumpit kg.out$n
cat unsigned.db $key1.key > ${file}
setup ksk-only.dnskeyonly bad
-key1=`$KEYGEN -a rsasha256 -fK ${zone} 2>kg.out` || dumpit kg.out$n
+key1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2>kg.out) || dumpit kg.out$n
cat unsigned.db $key1.key > ${file}
setup ksk+zsk.dnskeyonly bad
-key1=`$KEYGEN -a rsasha256 ${zone} 2>kg.out` || dumpit kg.out$n
-key2=`$KEYGEN -a rsasha256 -fK ${zone} 2>kg.out` || dumpit kg.out$n
+key1=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2>kg.out) || dumpit kg.out$n
+key2=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2>kg.out) || dumpit kg.out$n
cat unsigned.db $key1.key $key2.key > ${file}
# A set of zones with expired records
s="-s -2678400"
setup zsk-only.nsec.expired bad
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -SP ${s} -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk-only.nsec.expired bad
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -SPz ${s} -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.nsec.expired bad
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
$SIGNER -SP ${s} -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup zsk-only.nsec3.expired bad
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -3 - ${s} -SP -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk-only.nsec3.expired bad
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
$SIGNER -3 - ${s} -SPz -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
setup ksk+zsk.nsec3.expired bad
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
$SIGNER -3 - ${s} -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
# ksk expired
setup ksk+zsk.nsec.ksk-expired bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -Px -o ${zone} -f ${file} ${file} $zsk > s.out$n || dumpit s.out$n
$SIGNER ${s} -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
-now=`date -u +%Y%m%d%H%M%S`
-exp=`awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file}`
+now=$(date -u +%Y%m%d%H%M%S)
+exp=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file})
[ "${exp:-40001231246060}" -lt ${now:-0} ] || dumpit $file
setup ksk+zsk.nsec3.ksk-expired bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -3 - -Px -o ${zone} -f ${file} ${file} $zsk > s.out$n || dumpit s.out$n
$SIGNER -3 - ${s} -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
-now=`date -u +%Y%m%d%H%M%S`
-exp=`awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file}`
+now=$(date -u +%Y%m%d%H%M%S)
+exp=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file})
[ "${exp:-40001231246060}" -lt ${now:-0} ] || dumpit $file
# broken nsec chain
setup ksk+zsk.nsec.broken-chain bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
awk '$4 == "NSEC" { $5 = "'$zone'."; print } { print }' ${file} > ${file}.tmp
@@ -173,8 +176,8 @@ $SIGNER -Px -Z nonsecify -o ${zone} -f ${file} ${file}.tmp $zsk > s.out$n || dum
# bad nsec bitmap
setup ksk+zsk.nsec.bad-bitmap bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
awk '$4 == "NSEC" && /SOA/ { $6=""; print } { print }' ${file} > ${file}.tmp
@@ -182,8 +185,8 @@ $SIGNER -Px -Z nonsecify -o ${zone} -f ${file} ${file}.tmp $zsk > s.out$n || dum
# extra NSEC record out side of zone
setup ksk+zsk.nsec.out-of-zone-nsec bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
echo "out-of-zone. 3600 IN NSEC ${zone}. A" >> ${file}
@@ -191,8 +194,8 @@ $SIGNER -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n ||
# extra NSEC record below bottom of zone
setup ksk+zsk.nsec.below-bottom-of-zone-nsec bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
echo "ns.sub.${zone}. 3600 IN NSEC ${zone}. A AAAA" >> ${file}
@@ -202,8 +205,8 @@ awk '$1 ~ /^ns.sub/ && $4 == "RRSIG" && $5 != "NSEC" { next; } { print; }' ${fil
# extra NSEC record below DNAME
setup ksk+zsk.nsec.below-dname-nsec bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
echo "sub.dname.${zone}. 3600 IN NSEC ${zone}. TXT" >> ${file}
@@ -213,12 +216,12 @@ $SIGNER -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n ||
# extract the hash fields from the empty node's NSEC 3 record then fix up
# the NSEC3 chain to remove it
setup ksk+zsk.nsec3.missing-empty bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -3 - -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
-a=`awk '$4 == "NSEC3" && NF == 9 { split($1, a, "."); print a[1]; }' ${file}`
-b=`awk '$4 == "NSEC3" && NF == 9 { print $9; }' ${file}`
+a=$(awk '$4 == "NSEC3" && NF == 9 { split($1, a, "."); print a[1]; }' ${file})
+b=$(awk '$4 == "NSEC3" && NF == 9 { print $9; }' ${file})
awk '
$4 == "NSEC3" && $9 == "'$a'" { $9 = "'$b'"; print; next; }
$4 == "NSEC3" && NF == 9 { next; }
@@ -227,8 +230,8 @@ $SIGNER -3 - -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file}.tmp $zsk > s
# extra NSEC3 record
setup ksk+zsk.nsec3.extra-nsec3 bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
cat unsigned.db $ksk.key $zsk.key > $file
$SIGNER -3 - -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
awk '
diff --git a/external/mpl/bind/dist/bin/tests/system/views/setup.sh b/external/mpl/bind/dist/bin/tests/system/views/setup.sh
index 180851a2516..278cb4d5533 100644
--- a/external/mpl/bind/dist/bin/tests/system/views/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/views/setup.sh
@@ -29,11 +29,11 @@ copy_setports ns5/named.conf.in ns5/named.conf
# same source of "random" data and we want different keys for
# internal and external instances of inline.
#
-$KEYGEN -K ns2/internal -a rsasha256 -q inline > /dev/null 2>&1
-$KEYGEN -K ns2/internal -a rsasha256 -qfk inline > /dev/null 2>&1
-k1=$($KEYGEN -K ns2/external -a rsasha256 -q inline 2> /dev/null)
-k2=$($KEYGEN -K ns2/external -a rsasha256 -qfk inline 2> /dev/null)
-$KEYGEN -K ns2/external -a rsasha256 -q inline > /dev/null 2>&1
-$KEYGEN -K ns2/external -a rsasha256 -qfk inline > /dev/null 2>&1
+$KEYGEN -K ns2/internal -a ${DEFAULT_ALGORITHM} -q inline > /dev/null 2>&1
+$KEYGEN -K ns2/internal -a ${DEFAULT_ALGORITHM} -qfk inline > /dev/null 2>&1
+k1=$($KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -q inline 2> /dev/null)
+k2=$($KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -qfk inline 2> /dev/null)
+$KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -q inline > /dev/null 2>&1
+$KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -qfk inline > /dev/null 2>&1
test -n "$k1" && rm -f ns2/external/"$k1".*
test -n "$k2" && rm -f ns2/external/"$k2".*
diff --git a/external/mpl/bind/dist/bin/tests/system/wildcard/ns1/sign.sh b/external/mpl/bind/dist/bin/tests/system/wildcard/ns1/sign.sh
index 89d07943b6a..493b05794f2 100755
--- a/external/mpl/bind/dist/bin/tests/system/wildcard/ns1/sign.sh
+++ b/external/mpl/bind/dist/bin/tests/system/wildcard/ns1/sign.sh
@@ -28,8 +28,8 @@ zonefile=nsec.db
outfile=nsec.db.signed
dssets="$dssets dsset-${zone}${TP}"
-keyname1=`$KEYGEN -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
@@ -41,8 +41,8 @@ infile=private.nsec.db.in
zonefile=private.nsec.db
outfile=private.nsec.db.signed
-keyname1=`$KEYGEN -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
@@ -57,8 +57,8 @@ zonefile=nsec3.db
outfile=nsec3.db.signed
dssets="$dssets dsset-${zone}${TP}"
-keyname1=`$KEYGEN -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
@@ -70,8 +70,8 @@ infile=private.nsec3.db.in
zonefile=private.nsec3.db
outfile=private.nsec3.db.signed
-keyname1=`$KEYGEN -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key > $zonefile
@@ -85,8 +85,8 @@ infile=root.db.in
zonefile=root.db
outfile=root.db.signed
-keyname1=`$KEYGEN -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
cat $infile $keyname1.key $keyname2.key $dssets >$zonefile
diff --git a/external/mpl/bind/dist/bin/tests/system/wildcard/tests.sh b/external/mpl/bind/dist/bin/tests/system/wildcard/tests.sh
index 16533a554c2..f93150cc9f8 100644
--- a/external/mpl/bind/dist/bin/tests/system/wildcard/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/wildcard/tests.sh
@@ -243,7 +243,7 @@ do
$DIG $DIGOPTS @10.53.0.1 "\\$x.example" TXT > dig.out.ns1.$x.test$n
if test $i -le 32 -o $i -ge 127
then
- grep '^\\'"$x"'\.example\..*TXT.*\"this is a wildcard\"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
+ grep '^\\'"$x"'\.example\..*TXT.*"this is a wildcard"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
# "=34 $=36 (=40 )=41 .=46 ;=59 \=92 @=64
elif test $i -eq 34 -o $i -eq 36 -o $i -eq 40 -o $i -eq 41 -o \
$i -eq 46 -o $i -eq 59 -o $i -eq 64 -o $i -eq 92
diff --git a/external/mpl/bind/dist/bin/tests/system/wildcard/tests_wildcard.py b/external/mpl/bind/dist/bin/tests/system/wildcard/tests_wildcard.py
new file mode 100755
index 00000000000..66166f2a9e7
--- /dev/null
+++ b/external/mpl/bind/dist/bin/tests/system/wildcard/tests_wildcard.py
@@ -0,0 +1,112 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+"""
+Example property-based test for wildcard synthesis.
+Verifies that otherwise-empty zone with single wildcard record * A 192.0.2.1
+produces synthesized answers for <random_label>.test. A, and returns NODATA for
+<random_label>.test. when rdtype is not A.
+
+Limitations - untested properties:
+ - expansion works with multiple labels
+ - asterisk in qname does not cause expansion
+ - empty non-terminals prevent expansion
+ - or more generally any existing node prevents expansion
+ - DNSSEC record inclusion
+ - possibly others, see RFC 4592 and company
+ - content of authority & additional sections
+ - flags beyond RCODE
+ - special behavior of rdtypes like CNAME
+"""
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.name
+import dns.query
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+import dns.rrset
+
+pytest.importorskip("hypothesis")
+from hypothesis import given
+from hypothesis.strategies import binary, integers
+
+
+# labels of a zone with * A 192.0.2.1 wildcard
+WILDCARD_ZONE = ("allwild", "test", "")
+WILDCARD_RDTYPE = dns.rdatatype.A
+WILDCARD_RDATA = "192.0.2.1"
+IPADDR = "10.53.0.1"
+TIMEOUT = 5 # seconds, just a sanity check
+
+
+# Helpers
+def is_nonexpanding_rdtype(rdtype):
+ """skip meta types to avoid weird rcodes caused by AXFR etc.; RFC 6895"""
+ return not (
+ rdtype == WILDCARD_RDTYPE
+ or dns.rdatatype.is_metatype(rdtype) # known metatypes: OPT ...
+ or 128 <= rdtype <= 255
+ ) # unknown meta types
+
+
+def tcp_query(where, port, qname, qtype):
+ querymsg = dns.message.make_query(qname, qtype)
+ assert len(querymsg.question) == 1
+ return querymsg, dns.query.tcp(querymsg, where, port=port, timeout=TIMEOUT)
+
+
+def query(where, port, label, rdtype):
+ labels = (label,) + WILDCARD_ZONE
+ qname = dns.name.Name(labels)
+ return tcp_query(where, port, qname, rdtype)
+
+
+# Tests
+@given(
+ label=binary(min_size=1, max_size=63),
+ rdtype=integers(min_value=0, max_value=65535).filter(is_nonexpanding_rdtype),
+)
+def test_wildcard_rdtype_mismatch(label, rdtype, named_port):
+ """any label non-matching rdtype must result in to NODATA"""
+ check_answer_nodata(*query(IPADDR, named_port, label, rdtype))
+
+
+def check_answer_nodata(querymsg, answer):
+ assert querymsg.is_response(answer), str(answer)
+ assert answer.rcode() == dns.rcode.NOERROR, str(answer)
+ assert answer.answer == [], str(answer)
+
+
+@given(label=binary(min_size=1, max_size=63))
+def test_wildcard_match(label, named_port):
+ """any label with maching rdtype must result in wildcard data in answer"""
+ check_answer_noerror(*query(IPADDR, named_port, label, WILDCARD_RDTYPE))
+
+
+def check_answer_noerror(querymsg, answer):
+ assert querymsg.is_response(answer), str(answer)
+ assert answer.rcode() == dns.rcode.NOERROR, str(answer)
+ assert len(querymsg.question) == 1, str(answer)
+ expected_answer = [
+ dns.rrset.from_text(
+ querymsg.question[0].name,
+ 300, # TTL, ignored by dnspython comparison
+ dns.rdataclass.IN,
+ WILDCARD_RDTYPE,
+ WILDCARD_RDATA,
+ )
+ ]
+ assert answer.answer == expected_answer, str(answer)
diff --git a/external/mpl/bind/dist/bin/tests/system/xfer/tests.sh b/external/mpl/bind/dist/bin/tests/system/xfer/tests.sh
index 0987bf0b184..607d68a0098 100755
--- a/external/mpl/bind/dist/bin/tests/system/xfer/tests.sh
+++ b/external/mpl/bind/dist/bin/tests/system/xfer/tests.sh
@@ -465,8 +465,8 @@ echo_i "test mapped zone with out of zone data ($n)"
tmp=0
$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.test$n
grep "status: NOERROR," dig.out.1.test$n > /dev/null || tmp=1
-$PERL $SYSTEMTESTTOP/stop.pl xfer ns3
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} xfer ns3
+stop_server ns3
+start_server --noclean --restart --port ${PORT} ns3
check_mapped () {
$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.test$n
grep "status: NOERROR," dig.out.2.test$n > /dev/null || return 1
diff --git a/external/mpl/bind/dist/bin/tests/system/zero/clean.sh b/external/mpl/bind/dist/bin/tests/system/zero/clean.sh
index b19b0d7ef50..2ef5727abf6 100644
--- a/external/mpl/bind/dist/bin/tests/system/zero/clean.sh
+++ b/external/mpl/bind/dist/bin/tests/system/zero/clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/zero/setup.sh b/external/mpl/bind/dist/bin/tests/system/zero/setup.sh
index be8b0c6bff6..592034c83d2 100644
--- a/external/mpl/bind/dist/bin/tests/system/zero/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/zero/setup.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
diff --git a/external/mpl/bind/dist/bin/tests/system/zonechecks/setup.sh b/external/mpl/bind/dist/bin/tests/system/zonechecks/setup.sh
index 9808751d488..a6cbb6f0b27 100644
--- a/external/mpl/bind/dist/bin/tests/system/zonechecks/setup.sh
+++ b/external/mpl/bind/dist/bin/tests/system/zonechecks/setup.sh
@@ -25,8 +25,8 @@ cp bigserial.db ns1/
cd ns1
touch primary.db.signed
echo '$INCLUDE "primary.db.signed"' >> primary.db
-$KEYGEN -a rsasha256 -q primary.example > /dev/null 2>&1
-$KEYGEN -a rsasha256 -qfk primary.example > /dev/null 2>&1
+$KEYGEN -a ${DEFAULT_ALGORITHM} -q primary.example > /dev/null 2>&1
+$KEYGEN -a ${DEFAULT_ALGORITHM} -qfk primary.example > /dev/null 2>&1
$SIGNER -SD -o primary.example primary.db > /dev/null \
2> signer.err || cat signer.err
echo '$INCLUDE "soa.db"' > reload.db
diff --git a/external/mpl/bind/dist/configure.ac b/external/mpl/bind/dist/configure.ac
index 21b087adbf8..eaad0097ece 100644
--- a/external/mpl/bind/dist/configure.ac
+++ b/external/mpl/bind/dist/configure.ac
@@ -1701,7 +1701,7 @@ AS_IF([test "$enable_tcp_fastopen" = "yes"],
#
# Check for some other useful functions that are not ever-present.
#
-AC_CHECK_FUNCS([strlcpy strlcat])
+AC_CHECK_FUNCS([strlcpy strlcat strnstr])
AC_SUBST(READLINE_LIB)
diff --git a/external/mpl/bind/dist/contrib/dlz/modules/perl/Makefile b/external/mpl/bind/dist/contrib/dlz/modules/perl/Makefile
index f423d17bcd5..ec99e0008d8 100644
--- a/external/mpl/bind/dist/contrib/dlz/modules/perl/Makefile
+++ b/external/mpl/bind/dist/contrib/dlz/modules/perl/Makefile
@@ -57,3 +57,7 @@ $(LIBNAME): dlz_perl_driver.o dlz_perl_callback_clientinfo.o dlz_perl_callback.o
clean:
rm -f dlz_perl_driver.o dlz_perl_driver.so dlz_perl_callback_clientinfo.c dlz_perl_callback_clientinfo.o dlz_perl_callback.c dlz_perl_callback.o
+
+install: dlz_perl_driver.so
+ mkdir -p $(DESTDIR)$(libdir)
+ install dlz_perl_driver.so $(DESTDIR)$(libdir)
diff --git a/external/mpl/bind/dist/dangerfile.py b/external/mpl/bind/dist/dangerfile.py
index 1eecc6b72f9..4652df2ee59 100644
--- a/external/mpl/bind/dist/dangerfile.py
+++ b/external/mpl/bind/dist/dangerfile.py
@@ -9,8 +9,11 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
+import os
import re
+import gitlab
+
# Helper functions and variables
@@ -41,6 +44,15 @@ release_notes_regex = re.compile(r"doc/(arm|notes)/notes-.*\.(rst|xml)")
modified_files = danger.git.modified_files
mr_labels = danger.gitlab.mr.labels
target_branch = danger.gitlab.mr.target_branch
+is_backport = "Backport" in mr_labels or "Backport::Partial" in mr_labels
+is_full_backport = is_backport and "Backport::Partial" not in mr_labels
+
+gl = gitlab.Gitlab(
+ url=f"https://{os.environ['CI_SERVER_HOST']}",
+ private_token=os.environ["DANGER_GITLAB_API_TOKEN"],
+)
+proj = gl.projects.get(os.environ["CI_PROJECT_ID"])
+mr = proj.mergerequests.get(os.environ["CI_MERGE_REQUEST_IID"])
###############################################################################
# COMMIT MESSAGES
@@ -50,6 +62,9 @@ target_branch = danger.gitlab.mr.target_branch
#
# * The subject line starts with "fixup!" or "Apply suggestion".
#
+# * The subject line starts with a prohibited word indicating a work in
+# progress commit (e.g. "WIP").
+#
# * The subject line contains a trailing dot.
#
# * There is no empty line between the subject line and the log message.
@@ -75,6 +90,9 @@ target_branch = danger.gitlab.mr.target_branch
# "[2]", etc.) which allows e.g. long URLs to be included in the
# commit log message.
+PROHIBITED_WORDS_RE = re.compile(
+ "^(WIP|wip|DROP|drop|DROPME|checkpoint|experiment|TODO|todo)[^a-zA-Z]"
+)
fixup_error_logged = False
for commit in danger.git.commits:
message_lines = commit.message.splitlines()
@@ -87,6 +105,12 @@ for commit in danger.git.commits:
"Please squash them before merging."
)
fixup_error_logged = True
+ match = PROHIBITED_WORDS_RE.search(subject)
+ if match:
+ fail(
+ f"Prohibited keyword `{match.groups()[0]}` detected "
+ f"at the start of a subject line in commit {commit.sha}."
+ )
if len(subject) > 72 and not subject.startswith("Merge branch "):
warn(
f"Subject line for commit {commit.sha} is too long: "
@@ -124,34 +148,97 @@ if not danger.gitlab.mr.milestone:
fail("Please assign this merge request to a milestone.")
###############################################################################
-# VERSION LABELS
+# BACKPORT & VERSION LABELS
###############################################################################
#
# FAIL if any of the following is true for the merge request:
#
-# * The "Backport" label is set and the number of version labels set is
+# * The MR is marked as Backport and the number of version labels set is
# different than 1. (For backports, the version label is used for indicating
# its target branch. This is a rather ugly attempt to address a UI
# deficiency - the target branch for each MR is not visible on milestone
# dashboards.)
#
-# * Neither the "Backport" label nor any version label is set. (If the merge
-# request is not a backport, version labels are used for indicating
+# * The MR is not marked as "Backport" nor any version label is set. (If the
+# merge request is not a backport, version labels are used for indicating
# backporting preferences.)
+#
+# * The Backport MR doesn't have target branch in the merge request title.
+#
+# * The Backport MR doesn't link to the original MR is its description.
+#
+# * The original MR linked to from Backport MR hasn't been merged.
-backport_label_set = "Backport" in mr_labels
+BACKPORT_OF_RE = re.compile(
+ r"Backport\s+of.*(merge_requests/|!)([0-9]+)", flags=re.IGNORECASE
+)
+VERSION_LABEL_RE = re.compile(r"v9.([0-9]+)(-S)?")
+backport_desc = BACKPORT_OF_RE.search(danger.gitlab.mr.description)
version_labels = [l for l in mr_labels if l.startswith("v9.")]
-if backport_label_set and len(version_labels) != 1:
- fail(
- "The *Backport* label is set for this merge request. "
- "Please also set exactly one version label (*v9.x*)."
- )
-if not backport_label_set and not version_labels:
- fail(
- "If this merge request is a backport, set the *Backport* label and "
- "a single version label (*v9.x*) indicating the target branch. "
- "If not, set version labels for all targeted backport branches."
- )
+affects_labels = [l for l in mr_labels if l.startswith("Affects v9.")]
+if is_backport:
+ if len(version_labels) != 1:
+ fail(
+ "This MR was marked as *Backport*. "
+ "Please also set exactly one version label (*v9.x*)."
+ )
+ else:
+ minor_ver, edition = VERSION_LABEL_RE.search(version_labels[0]).groups()
+ edition = "" if edition is None else edition
+ title_re = f"^\\[9.{minor_ver}{edition}\\]"
+ match = re.search(title_re, danger.gitlab.mr.title)
+ if match is None:
+ fail(
+ "Backport MRs must have their target version in the title. "
+ f"Please put `[9.{minor_ver}{edition}]` at the start of the MR title."
+ )
+ if backport_desc is None:
+ fail(
+ "Backport MRs must link to the original MR. Please put "
+ "`Backport of MR !XXXX` in the MR description."
+ )
+ else: # backport MR is linked to original MR
+ original_mr_id = backport_desc.groups()[1]
+ original_mr = proj.mergerequests.get(original_mr_id)
+ if original_mr.state != "merged":
+ fail(
+ f"Original MR !{original_mr_id} has not been merged. "
+ "Please re-run `danger` check once it's merged."
+ )
+ else: # check for commit IDs once original MR is merged
+ original_mr_commits = list(original_mr.commits(all=True))
+ backport_mr_commits = list(mr.commits(all=True))
+ for orig_commit in original_mr_commits:
+ for backport_commit in backport_mr_commits:
+ if orig_commit.id in backport_commit.message:
+ break
+ else:
+ msg = (
+ f"Commit {orig_commit.id} from original MR !{original_mr_id} "
+ "is not referenced in any of the backport commits."
+ )
+ if not is_full_backport:
+ message(msg)
+ else:
+ msg += (
+ " Please use `-x` when cherry-picking to include "
+ "the full original commit ID. Alternately, use the "
+ "`Backport::Partial` label if not all original "
+ "commits are meant to be backported."
+ )
+ fail(msg)
+else:
+ if not version_labels:
+ fail(
+ "If this merge request is a backport, set the *Backport* label and "
+ "a single version label (*v9.x*) indicating the target branch. "
+ "If not, set version labels for all targeted backport branches."
+ )
+ if not affects_labels:
+ warn(
+ "Set `Affects v9.` label(s) for all versions that are affected by "
+ "the issue which this MR addresses."
+ )
###############################################################################
# OTHER LABELS
@@ -165,15 +252,16 @@ if not backport_label_set and not version_labels:
# remind developers about the need to set the latter on merge requests which
# passed review.)
+approved = mr.approvals.get().approved
if "Review" not in mr_labels:
warn(
"This merge request does not have the *Review* label set. "
"Please set it if you would like the merge request to be reviewed."
)
-elif "LGTM (Merge OK)" not in mr_labels:
+elif not approved:
warn(
"This merge request is currently in review. "
- "It should not be merged until it is marked with the *LGTM* label."
+ "It should not be merged until it is approved."
)
###############################################################################
diff --git a/external/mpl/bind/dist/doc/arm/conf.py b/external/mpl/bind/dist/doc/arm/conf.py
index 504e348adbf..ba52bed0cde 100644
--- a/external/mpl/bind/dist/doc/arm/conf.py
+++ b/external/mpl/bind/dist/doc/arm/conf.py
@@ -9,8 +9,6 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
-# flake8: noqa: E501
-
import re
from typing import List, Tuple
@@ -110,7 +108,7 @@ def setup(app):
project = "BIND 9"
# pylint: disable=redefined-builtin
-copyright = "2022, Internet Systems Consortium"
+copyright = "2023, Internet Systems Consortium"
author = "Internet Systems Consortium"
version_vars = {}
diff --git a/external/mpl/bind/dist/doc/arm/dnssec.inc.rst b/external/mpl/bind/dist/doc/arm/dnssec.inc.rst
index dab187f0289..f2b66aa3198 100644
--- a/external/mpl/bind/dist/doc/arm/dnssec.inc.rst
+++ b/external/mpl/bind/dist/doc/arm/dnssec.inc.rst
@@ -99,9 +99,13 @@ up-to-date DNSSEC practices:
type primary;
file "dnssec.example.db";
dnssec-policy default;
+ inline-signing yes;
};
-This single line is sufficient to create the necessary signing keys, and generate
+The ``dnssec-policy`` statement requires dynamic DNS to be set up, or
+``inline-signing`` to be enabled. In the example above we use the latter.
+
+This is sufficient to create the necessary signing keys, and generate
``DNSKEY``, ``RRSIG``, and ``NSEC`` records for the zone. BIND also takes
care of any DNSSEC maintenance for this zone, including replacing signatures
that are about to expire and managing :ref:`key_rollovers`.
@@ -171,6 +175,7 @@ by configuring parental agents:
type primary;
file "dnssec.example.db";
dnssec-policy default;
+ inline-signing yes;
parental-agents { 192.0.2.1; };
};
@@ -282,7 +287,7 @@ NSEC3
To sign using :ref:`NSEC3 <advanced_discussions_nsec3>` instead of :ref:`NSEC
<advanced_discussions_nsec>`, add an NSEC3PARAM record to the initial update
-request. The :term:`OPTOUT <opt-out>` bit in the NSEC3
+request. The :term:`OPTOUT <Opt-out>` bit in the NSEC3
chain can be set in the flags field of the
NSEC3PARAM record.
diff --git a/external/mpl/bind/dist/doc/arm/notes.rst b/external/mpl/bind/dist/doc/arm/notes.rst
index 1d8355eb872..e944d1caf4a 100644
--- a/external/mpl/bind/dist/doc/arm/notes.rst
+++ b/external/mpl/bind/dist/doc/arm/notes.rst
@@ -44,6 +44,12 @@ https://www.isc.org/download/. There you will find additional
information about each release, source code, and pre-compiled versions
for Microsoft Windows operating systems.
+.. include:: ../notes/notes-known-issues.rst
+
+.. include:: ../notes/notes-9.16.37.rst
+.. include:: ../notes/notes-9.16.36.rst
+.. include:: ../notes/notes-9.16.35.rst
+.. include:: ../notes/notes-9.16.34.rst
.. include:: ../notes/notes-9.16.33.rst
.. include:: ../notes/notes-9.16.32.rst
.. include:: ../notes/notes-9.16.31.rst
diff --git a/external/mpl/bind/dist/doc/arm/platforms.rst b/external/mpl/bind/dist/doc/arm/platforms.rst
index 6054f3a9eb6..a78f400b956 100644
--- a/external/mpl/bind/dist/doc/arm/platforms.rst
+++ b/external/mpl/bind/dist/doc/arm/platforms.rst
@@ -47,10 +47,10 @@ following systems:
- Debian 10, 11
- Ubuntu LTS 18.04, 20.04, 22.04
-- Fedora 35
-- Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8
+- Fedora 37
+- Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8, 9
- FreeBSD 12.3, 13.1
-- OpenBSD 7.1
+- OpenBSD 7.2
- Alpine Linux 3.16
The amd64, i386, armhf and arm64 CPU architectures are all fully
diff --git a/external/mpl/bind/dist/doc/arm/reference.rst b/external/mpl/bind/dist/doc/arm/reference.rst
index 14c13987cf4..703663d0ba6 100644
--- a/external/mpl/bind/dist/doc/arm/reference.rst
+++ b/external/mpl/bind/dist/doc/arm/reference.rst
@@ -1729,11 +1729,16 @@ Boolean Options
``minimal-responses``
This option controls the addition of records to the authority and
additional sections of responses. Such records may be included in
- responses to be helpful to clients; for example, NS or MX records may
+ responses to be helpful to clients; for example, MX records may
have associated address records included in the additional section,
obviating the need for a separate address lookup. However, adding
these records to responses is not mandatory and requires additional
database lookups, causing extra latency when marshalling responses.
+
+ Responses to DNSKEY, DS, CDNSKEY, and CDS requests will never have
+ optional additional records added. Responses to NS requests will
+ always have additional section processing.
+
``minimal-responses`` takes one of four values:
- ``no``: the server is as complete as possible when generating
@@ -3146,6 +3151,11 @@ system.
value as ``tcp-keepalive-timeout``. This value can be updated at
runtime by using ``rndc tcp-timeouts``.
+``update-quota``
+ This is the maximum number of simultaneous DNS UPDATE messages that
+ the server will accept for updating local authoritiative zones or
+ forwarding to a primary server. The default is ``100``.
+
.. _intervals:
Periodic Task Intervals
@@ -3656,7 +3666,7 @@ Tuning
``prefetch`` specifies the "trigger" TTL value at which prefetch
of the current query takes place; when a cache record with a
- lower TTL value is encountered during query processing, it is
+ lower or equal TTL value is encountered during query processing, it is
refreshed. Valid trigger TTL values are 1 to 10 seconds. Values
larger than 10 seconds are silently reduced to 10. Setting a
trigger TTL to zero causes prefetch to be disabled. The default
@@ -4694,9 +4704,21 @@ If no port is specified, port 80 is used for HTTP channels. The asterisk
Attempts to open a statistics channel are restricted by the
optional ``allow`` clause. Connections to the statistics channel are
permitted based on the ``address_match_list``. If no ``allow`` clause is
-present, ``named`` accepts connection attempts from any address; since
-the statistics may contain sensitive internal information, it is highly
-recommended to restrict the source of connection requests appropriately.
+present, ``named`` accepts connection attempts from any address. Since
+the statistics may contain sensitive internal information, the source of
+connection requests must be restricted appropriately so that only
+trusted parties can access the statistics channel.
+
+Gathering data exposed by the statistics channel locks various subsystems in
+``named``, which could slow down query processing if statistics data is
+requested too often.
+
+An issue in the statistics channel would be considered a security issue
+only if it could be exploited by unprivileged users circumventing the access
+control list. In other words, any issue in the statistics channel that could be
+used to access information unavailable otherwise, or to crash ``named``, is
+not considered a security issue if it can be avoided through the
+use of a secure configuration.
If no ``statistics-channels`` statement is present, ``named`` does not
open any communication channels.
@@ -4904,12 +4926,16 @@ Multiple key and signing policies can be configured. To attach a policy
to a zone, add a ``dnssec-policy`` option to the ``zone`` statement,
specifying the name of the policy that should be used.
-By default, ``dnssec-policy`` assumes ``inline-signing``. This means that
-a signed version of the zone is maintained separately and is written out to
-a different file on disk (the zone's filename plus a ``.signed`` extension).
+The ``dnssec-policy`` statement requires dynamic DNS to be set up, or
+``inline-signing`` to be enabled.
+
+If ``inline-signing`` is enabled, this means that a signed version of the
+zone is maintained separately and is written out to a different file on disk
+(the zone's filename plus a ``.signed`` extension).
If the zone is dynamic because it is configured with an ``update-policy`` or
-``allow-update``, the DNSSEC records are written to the filename set in the original zone's ``file``, unless ``inline-signing`` is explicitly set.
+``allow-update``, the DNSSEC records are written to the filename set in the
+original zone's ``file``, unless ``inline-signing`` is explicitly set.
Key rollover timing is computed for each key according to the key
lifetime defined in the KASP. The lifetime may be modified by zone TTLs
@@ -5079,8 +5105,8 @@ The following options can be specified in a ``dnssec-policy`` statement:
of the indicated length.
.. warning::
- Do not use extra :term:`iterations`, :term:`salt`, and
- :term:`opt-out` unless their implications are fully understood.
+ Do not use extra :term:`iterations <Iterations>`, :term:`salt <Salt>`, and
+ :term:`opt-out <Opt-out>` unless their implications are fully understood.
A higher number of iterations causes interoperability problems and opens
servers to CPU-exhausting DoS attacks.
@@ -6018,6 +6044,8 @@ The ruletype field has 16 values: ``name``, ``subdomain``, ``zonesub``, ``wildca
The daemon replies with a four-byte value in network byte order, containing either 0 or 1; 0 indicates that the specified update is not permitted, and 1 indicates that it is.
+ .. warning:: The external daemon must not delay communication. This policy is evaluated synchronously; any wait period negatively affects :iscman:`named` performance.
+
.. _multiple_views:
Multiple Views
@@ -6814,6 +6842,11 @@ Name Server Statistics Counters
``UpdateBadPrereq``
This indicates the number of dynamic updates rejected due to a prerequisite failure.
+``UpdateQuota``
+ This indicates the number of times a dynamic update or update
+ forwarding request was rejected because the number of pending
+ requests exceeded ``update-quota``.
+
``RateDropped``
This indicates the number of responses dropped due to rate limits.
diff --git a/external/mpl/bind/dist/doc/arm/requirements.txt b/external/mpl/bind/dist/doc/arm/requirements.txt
index e9ea383a8cf..31c4a447598 100644
--- a/external/mpl/bind/dist/doc/arm/requirements.txt
+++ b/external/mpl/bind/dist/doc/arm/requirements.txt
@@ -1,5 +1,5 @@
# Make Read the Docs use the exact same package versions as in
# registry.gitlab.isc.org/isc-projects/images/bind9:debian-bullseye-amd64
-Sphinx==4.5.0
+Sphinx==5.3.0
docutils==0.17.1
sphinx_rtd_theme==1.0.0
diff --git a/external/mpl/bind/dist/doc/dnssec-guide/introduction.rst b/external/mpl/bind/dist/doc/dnssec-guide/introduction.rst
index 4acc0e08a7b..e8f6cf9c656 100644
--- a/external/mpl/bind/dist/doc/dnssec-guide/introduction.rst
+++ b/external/mpl/bind/dist/doc/dnssec-guide/introduction.rst
@@ -250,7 +250,7 @@ at a very high level, looking up the name ``www.isc.org`` :
Let's take a quick break here and look at what we've got so far...
how can our server trust this answer? If a clever attacker had taken over
- the ``isc.org`` name server(s), or course she would send matching
+ the ``isc.org`` name server(s), of course she would send matching
keys and signatures. We need to ask someone else to have confidence
that we are really talking to the real ``isc.org`` name server. This
is a critical part of DNSSEC: at some point, the DNS administrators
diff --git a/external/mpl/bind/dist/doc/dnssec-guide/recipes.rst b/external/mpl/bind/dist/doc/dnssec-guide/recipes.rst
index 54b94ecab7a..a4bdffaa0aa 100644
--- a/external/mpl/bind/dist/doc/dnssec-guide/recipes.rst
+++ b/external/mpl/bind/dist/doc/dnssec-guide/recipes.rst
@@ -63,6 +63,7 @@ what the ``named.conf`` zone statement looks like on the primary server, 192.168
file "db/example.com.db";
key-directory "keys/example.com";
dnssec-policy default;
+ inline-signing yes;
allow-transfer { 192.168.1.2; 192.168.1.3; 192.168.1.4; };
};
@@ -142,6 +143,7 @@ signed data via zone transfer to the other three DNS secondaries. Its
file "db/example.com.db";
key-directory "keys/example.com";
dnssec-policy default;
+ inline-signing yes;
allow-transfer { 192.168.1.2; 192.168.1.3; 192.168.1.4; };
};
@@ -995,6 +997,7 @@ Here is what :iscman:`named.conf` looks like when it is signed:
type primary;
file "db/example.com.db";
dnssec-policy "default";
+ inline-signing yes;
};
To indicate the reversion to unsigned, change the ``dnssec-policy`` line:
@@ -1006,6 +1009,7 @@ To indicate the reversion to unsigned, change the ``dnssec-policy`` line:
type primary;
file "db/example.com.db";
dnssec-policy "insecure";
+ inline-signing yes;
};
Then use :option:`rndc reload` to reload the zone.
diff --git a/external/mpl/bind/dist/doc/dnssec-guide/signing.rst b/external/mpl/bind/dist/doc/dnssec-guide/signing.rst
index ca66204e813..9bd537199fe 100644
--- a/external/mpl/bind/dist/doc/dnssec-guide/signing.rst
+++ b/external/mpl/bind/dist/doc/dnssec-guide/signing.rst
@@ -66,6 +66,7 @@ To sign a zone, add the following statement to its
zone "example.com" in {
...
dnssec-policy default;
+ inline-signing yes;
...
};
@@ -77,6 +78,17 @@ for most situations. We cover the creation of a custom policy in
:ref:`signing_custom_policy`, but for the moment we are accepting the
default values.
+Using ``dnssec-policy`` requires dynamic DNS or ``inline-signing``
+to be enabled.
+
+.. note::
+
+ Previously, if a zone with a ``dnssec-policy`` did not have dynamic
+ DNS set up and ``inline-signing`` was not explicity set, BIND 9 used
+ inline-signing implicitly. But this caused a lot of problems when operators
+ switched on or off dynamic DNS for their zones. Therefor, you now have to
+ configure it explicitly.
+
When the configuration file is updated, tell ``named`` to
reload the configuration file by running ``rndc reconfig``:
@@ -823,6 +835,7 @@ this example, we'll add it to the ``zone`` statement:
zone "example.net" in {
...
dnssec-policy standard;
+ inline-signing yes;
...
};
@@ -904,6 +917,7 @@ presence. Let's look at the following configuration excerpt:
zone "example.net" in {
...
dnssec-policy standard;
+ inline-signing yes;
parental-agents { "net"; };
...
};
@@ -1525,9 +1539,8 @@ repeated here. A few points are worth noting, though:
With ``dnssec-keymgr``, this is split between two configuration files
and two programs.
-- When using ``dnssec-policy``, there is no need to set the
- ``auto-dnssec`` and ``inline-signing`` options for a zone. The zone's
- ``policy`` statement implicitly does this.
+- The ``dnssec-policy`` statement requires to zone to use dynamic DNS,
+ or that ``inline-signing`` is enabled.
- It is possible to manage some zones served by an instance of BIND
through ``dnssec-policy`` and others through ``dnssec-keymgr``, but
diff --git a/external/mpl/bind/dist/doc/man/Makefile.in b/external/mpl/bind/dist/doc/man/Makefile.in
index db25228aa71..75794f77413 100644
--- a/external/mpl/bind/dist/doc/man/Makefile.in
+++ b/external/mpl/bind/dist/doc/man/Makefile.in
@@ -158,9 +158,10 @@ BIND9_VERSIONSTRING=@BIND9_VERSIONSTRING@
# You can set these variables from the command line.
SPHINXBUILD = @SPHINX_BUILD@
SPHINXBUILDDIR = ${builddir}/_build
+SPHINX_W = -W
common_SPHINXOPTS = \
- -W \
+ $(SPHINX_W) \
-a \
-v \
-c "${abs_srcdir}"
diff --git a/external/mpl/bind/dist/doc/man/arpaname.1in b/external/mpl/bind/dist/doc/man/arpaname.1in
index e8bbc9d3efc..2c2539975d4 100644
--- a/external/mpl/bind/dist/doc/man/arpaname.1in
+++ b/external/mpl/bind/dist/doc/man/arpaname.1in
@@ -43,6 +43,6 @@ BIND 9 Administrator Reference Manual.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/conf.py b/external/mpl/bind/dist/doc/man/conf.py
index 8a52d7704ea..266dfbbe574 100644
--- a/external/mpl/bind/dist/doc/man/conf.py
+++ b/external/mpl/bind/dist/doc/man/conf.py
@@ -9,7 +9,6 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
-# flake8: noqa: E501
import datetime
from docutils.parsers.rst import roles
diff --git a/external/mpl/bind/dist/doc/man/ddns-confgen.8in b/external/mpl/bind/dist/doc/man/ddns-confgen.8in
index 158bc6b2eb9..1f12ae95788 100644
--- a/external/mpl/bind/dist/doc/man/ddns-confgen.8in
+++ b/external/mpl/bind/dist/doc/man/ddns-confgen.8in
@@ -97,6 +97,6 @@ This option cannot be used with the \fB\-s\fP option.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/delv.1in b/external/mpl/bind/dist/doc/man/delv.1in
index 9086f59346f..836499b7193 100644
--- a/external/mpl/bind/dist/doc/man/delv.1in
+++ b/external/mpl/bind/dist/doc/man/delv.1in
@@ -340,6 +340,6 @@ This option prints response data in YAML format.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dig.1in b/external/mpl/bind/dist/doc/man/dig.1in
index 0e460e8d90c..245a9c6574b 100644
--- a/external/mpl/bind/dist/doc/man/dig.1in
+++ b/external/mpl/bind/dist/doc/man/dig.1in
@@ -517,9 +517,11 @@ This option sets [or does not set] the TC (TrunCation) bit in the query. The def
\fB+notcflag\fP\&. This bit is ignored by the server for QUERY.
.TP
.B \fB+[no]tcp\fP
-This option uses [or does not use] TCP when querying name servers. The default behavior
-is to use UDP unless a type \fBany\fP or \fBixfr=N\fP query is requested,
-in which case the default is TCP. AXFR queries always use TCP.
+This option uses [or does not use] TCP when querying name servers.
+The default behavior is to use UDP unless a type \fBany\fP or
+\fBixfr=N\fP query is requested, in which case the default is TCP.
+AXFR queries always use TCP. To prevent retry over TCP when TC=1
+is returned from a UDP query, use \fB+ignore\fP\&.
.TP
.B \fB+timeout=T\fP
This option sets the timeout for a query to \fBT\fP seconds. The default timeout is
@@ -663,6 +665,6 @@ There are probably too many query options.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-cds.8in b/external/mpl/bind/dist/doc/man/dnssec-cds.8in
index 58656ec4234..f915c35d37c 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-cds.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-cds.8in
@@ -224,6 +224,6 @@ Reference Manual, \fI\%RFC 7344\fP\&.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-checkds.8in b/external/mpl/bind/dist/doc/man/dnssec-checkds.8in
index 3f0fe6042ad..8a1328b7379 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-checkds.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-checkds.8in
@@ -91,6 +91,6 @@ Specifies a path to a \fBdnssec\-dsfromkey\fP binary. Used for testing.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-coverage.8in b/external/mpl/bind/dist/doc/man/dnssec-coverage.8in
index 9323c1038b0..1dde5bc1847 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-coverage.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-coverage.8in
@@ -187,6 +187,6 @@ Specifies a path to a \fBnamed\-compilezone\fP binary. Used for testing.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-dsfromkey.8in b/external/mpl/bind/dist/doc/man/dnssec-dsfromkey.8in
index e4f750c4d08..b22ba567ef9 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-dsfromkey.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-dsfromkey.8in
@@ -148,6 +148,6 @@ A keyfile error may return "file not found," even if the file exists.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-importkey.8in b/external/mpl/bind/dist/doc/man/dnssec-importkey.8in
index e853b2249ef..fcca54c3c54 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-importkey.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-importkey.8in
@@ -121,6 +121,6 @@ or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as generated by
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-keyfromlabel.8in b/external/mpl/bind/dist/doc/man/dnssec-keyfromlabel.8in
index 475927077e8..7bedc453170 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-keyfromlabel.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-keyfromlabel.8in
@@ -272,6 +272,6 @@ security reasons, this file does not have general read permission.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-keygen.8in b/external/mpl/bind/dist/doc/man/dnssec-keygen.8in
index 9ba403834cb..f3ceeca2f09 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-keygen.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-keygen.8in
@@ -326,6 +326,6 @@ To generate a matching key\-signing key, issue the command:
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-keymgr.8in b/external/mpl/bind/dist/doc/man/dnssec-keymgr.8in
index b5114e35bf1..23c8beac2e8 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-keymgr.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-keymgr.8in
@@ -292,6 +292,6 @@ keys that use RFC 5011 semantics.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-revoke.8in b/external/mpl/bind/dist/doc/man/dnssec-revoke.8in
index 51b350de1c5..2b405870986 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-revoke.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-revoke.8in
@@ -81,6 +81,6 @@ revoke the key.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-settime.8in b/external/mpl/bind/dist/doc/man/dnssec-settime.8in
index e09ebe497ed..7ecaf492718 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-settime.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-settime.8in
@@ -241,6 +241,6 @@ metadata, use \fBall\fP\&.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-signzone.8in b/external/mpl/bind/dist/doc/man/dnssec-signzone.8in
index e0821e2ceb1..4ae4e1e86d3 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-signzone.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-signzone.8in
@@ -433,6 +433,6 @@ db.example.com.signed
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnssec-verify.8in b/external/mpl/bind/dist/doc/man/dnssec-verify.8in
index 761ca285532..6413884e062 100644
--- a/external/mpl/bind/dist/doc/man/dnssec-verify.8in
+++ b/external/mpl/bind/dist/doc/man/dnssec-verify.8in
@@ -108,6 +108,6 @@ This option indicates the file containing the zone to be signed.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/dnstap-read.1in b/external/mpl/bind/dist/doc/man/dnstap-read.1in
index 2eea3555281..c6dc0d0cec1 100644
--- a/external/mpl/bind/dist/doc/man/dnstap-read.1in
+++ b/external/mpl/bind/dist/doc/man/dnstap-read.1in
@@ -62,6 +62,6 @@ This option prints \fBdnstap\fP data in a detailed YAML format.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/filter-aaaa.8in b/external/mpl/bind/dist/doc/man/filter-aaaa.8in
index c944a24a1d2..2061fdbd8d3 100644
--- a/external/mpl/bind/dist/doc/man/filter-aaaa.8in
+++ b/external/mpl/bind/dist/doc/man/filter-aaaa.8in
@@ -105,6 +105,6 @@ BIND 9 Administrator Reference Manual.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/host.1in b/external/mpl/bind/dist/doc/man/host.1in
index a2f0a28b4fe..4f90de3ebca 100644
--- a/external/mpl/bind/dist/doc/man/host.1in
+++ b/external/mpl/bind/dist/doc/man/host.1in
@@ -177,6 +177,6 @@ when \fBhost\fP runs.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/mdig.1in b/external/mpl/bind/dist/doc/man/mdig.1in
index bcbd3a09115..1191da58e33 100644
--- a/external/mpl/bind/dist/doc/man/mdig.1in
+++ b/external/mpl/bind/dist/doc/man/mdig.1in
@@ -336,6 +336,6 @@ This flag is off by default.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named-checkconf.8in b/external/mpl/bind/dist/doc/man/named-checkconf.8in
index ce9aca2851a..e8899ffc23b 100644
--- a/external/mpl/bind/dist/doc/man/named-checkconf.8in
+++ b/external/mpl/bind/dist/doc/man/named-checkconf.8in
@@ -103,6 +103,6 @@ and 0 otherwise.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named-checkzone.8in b/external/mpl/bind/dist/doc/man/named-checkzone.8in
index 06ba6966a38..0f39c75b0d3 100644
--- a/external/mpl/bind/dist/doc/man/named-checkzone.8in
+++ b/external/mpl/bind/dist/doc/man/named-checkzone.8in
@@ -199,6 +199,6 @@ and 0 otherwise.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named-compilezone.8in b/external/mpl/bind/dist/doc/man/named-compilezone.8in
index 3841f3ddb72..76cac706b3f 100644
--- a/external/mpl/bind/dist/doc/man/named-compilezone.8in
+++ b/external/mpl/bind/dist/doc/man/named-compilezone.8in
@@ -201,6 +201,6 @@ and 0 otherwise.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named-journalprint.8in b/external/mpl/bind/dist/doc/man/named-journalprint.8in
index fd6b26bdd17..6f8d89ac2ed 100644
--- a/external/mpl/bind/dist/doc/man/named-journalprint.8in
+++ b/external/mpl/bind/dist/doc/man/named-journalprint.8in
@@ -74,6 +74,6 @@ bug in that release.) Note that these options \fImust not\fP be used while
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named-nzd2nzf.8in b/external/mpl/bind/dist/doc/man/named-nzd2nzf.8in
index dd680f49927..f245015ee43 100644
--- a/external/mpl/bind/dist/doc/man/named-nzd2nzf.8in
+++ b/external/mpl/bind/dist/doc/man/named-nzd2nzf.8in
@@ -52,6 +52,6 @@ BIND 9 Administrator Reference Manual.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named-rrchecker.1in b/external/mpl/bind/dist/doc/man/named-rrchecker.1in
index c0628578126..3348558c846 100644
--- a/external/mpl/bind/dist/doc/man/named-rrchecker.1in
+++ b/external/mpl/bind/dist/doc/man/named-rrchecker.1in
@@ -65,6 +65,6 @@ and private type mnemonics, respectively.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named.8in b/external/mpl/bind/dist/doc/man/named.8in
index 51e121bd816..b501b46657c 100644
--- a/external/mpl/bind/dist/doc/man/named.8in
+++ b/external/mpl/bind/dist/doc/man/named.8in
@@ -133,10 +133,15 @@ This option turns on memory usage debugging flags. Possible flags are \fBusage\f
\fBISC_MEM_DEBUGXXXX\fP flags described in \fB<isc/mem.h>\fP\&.
.TP
.B \fB\-n #cpus\fP
-This option creates \fB#cpus\fP worker threads to take advantage of multiple CPUs. If
-not specified, \fBnamed\fP tries to determine the number of CPUs
-present and creates one thread per CPU. If it is unable to determine
-the number of CPUs, a single worker thread is created.
+This option controls the number of CPUs that \fBnamed\fP assumes the
+presence of. If not specified, \fBnamed\fP tries to determine the
+number of CPUs present automatically; if it fails, a single CPU is
+assumed to be present.
+.sp
+\fBnamed\fP creates two threads per each CPU present (one thread for
+receiving and sending client traffic and another thread for sending
+and receiving resolver traffic) and then on top of that a single
+thread for handling time\-based events.
.TP
.B \fB\-p port\fP
This option listens for queries on \fBport\fP\&. If not specified, the default is
@@ -227,7 +232,8 @@ previous kernels did not allow privileges to be retained after
This option reports the version number and exits.
.TP
.B \fB\-V\fP
-This option reports the version number and build options, and exits.
+This option reports the version number, build options, supported
+cryptographics algorithms, and exits.
.TP
.B \fB\-X lock\-file\fP
This option acquires a lock on the specified file at runtime; this helps to
@@ -285,6 +291,6 @@ The default process\-id file.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/named.conf.5in b/external/mpl/bind/dist/doc/man/named.conf.5in
index 676e4447b96..c87afa28813 100644
--- a/external/mpl/bind/dist/doc/man/named.conf.5in
+++ b/external/mpl/bind/dist/doc/man/named.conf.5in
@@ -231,7 +231,7 @@ options {
answer\-cookie boolean;
attach\-cache string;
auth\-nxdomain boolean; // default changed
- auto\-dnssec ( allow | maintain | off );
+ auto\-dnssec ( allow | maintain | off );// deprecated
automatic\-interface\-scan boolean;
avoid\-v4\-udp\-ports { portrange; ... };
avoid\-v6\-udp\-ports { portrange; ... };
@@ -498,6 +498,7 @@ options {
trust\-anchor\-telemetry boolean; // experimental
try\-tcp\-refresh boolean;
update\-check\-ksk boolean;
+ update\-quota integer;
use\-alt\-transfer\-source boolean;
use\-v4\-udp\-ports { portrange; ... };
use\-v6\-udp\-ports { portrange; ... };
@@ -668,7 +669,7 @@ view string [ class ] {
* ) ] [ dscp integer ];
attach\-cache string;
auth\-nxdomain boolean; // default changed
- auto\-dnssec ( allow | maintain | off );
+ auto\-dnssec ( allow | maintain | off );// deprecated
cache\-file quoted_string;// deprecated
catalog\-zones { zone string [ default\-masters [ port integer ]
[ dscp integer ] { ( remote\-servers | ipv4_address [ port
@@ -943,7 +944,7 @@ view string [ class ] {
integer | * ) ] [ dscp integer ];
alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port (
integer | * ) ] [ dscp integer ];
- auto\-dnssec ( allow | maintain | off );
+ auto\-dnssec ( allow | maintain | off );// deprecated
check\-dup\-records ( fail | warn | ignore );
check\-integrity boolean;
check\-mx ( fail | warn | ignore );
@@ -1034,7 +1035,7 @@ view string [ class ] {
6to4\-self | external | krb5\-self | krb5\-selfsub |
krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
name | self | selfsub | selfwild | subdomain | tcp\-self
- | wildcard | zonesub ) [ string ] rrtypelist; ... };
+ | wildcard | zonesub ) [ string ] rrtypelist; ... } );
use\-alt\-transfer\-source boolean;
zero\-no\-soa\-ttl boolean;
zone\-statistics ( full | terse | none | boolean );
@@ -1065,7 +1066,7 @@ zone string [ class ] {
] [ dscp integer ];
alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
* ) ] [ dscp integer ];
- auto\-dnssec ( allow | maintain | off );
+ auto\-dnssec ( allow | maintain | off );// deprecated
check\-dup\-records ( fail | warn | ignore );
check\-integrity boolean;
check\-mx ( fail | warn | ignore );
@@ -1151,7 +1152,7 @@ zone string [ class ] {
external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
| ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
| subdomain | tcp\-self | wildcard | zonesub ) [ string ]
- rrtypelist; ... };
+ rrtypelist; ... } );
use\-alt\-transfer\-source boolean;
zero\-no\-soa\-ttl boolean;
zone\-statistics ( full | terse | none | boolean );
@@ -1169,6 +1170,6 @@ zone string [ class ] {
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/nsec3hash.8in b/external/mpl/bind/dist/doc/man/nsec3hash.8in
index f28559922ba..d73b66ec7f0 100644
--- a/external/mpl/bind/dist/doc/man/nsec3hash.8in
+++ b/external/mpl/bind/dist/doc/man/nsec3hash.8in
@@ -73,6 +73,6 @@ BIND 9 Administrator Reference Manual, \fI\%RFC 5155\fP\&.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/nslookup.1in b/external/mpl/bind/dist/doc/man/nslookup.1in
index 473ccb5b409..f009105c152 100644
--- a/external/mpl/bind/dist/doc/man/nslookup.1in
+++ b/external/mpl/bind/dist/doc/man/nslookup.1in
@@ -220,6 +220,6 @@ when \fBnslookup\fP runs, or when the standard output is not a tty.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/nsupdate.1in b/external/mpl/bind/dist/doc/man/nsupdate.1in
index 0c3a296ce59..5a2d02f2193 100644
--- a/external/mpl/bind/dist/doc/man/nsupdate.1in
+++ b/external/mpl/bind/dist/doc/man/nsupdate.1in
@@ -195,6 +195,13 @@ zone\(aqs SOA record identify the primary server for that zone.
\fBport\fP is the port number on \fBservername\fP where the dynamic
update requests are sent. If no port number is specified, the default
DNS port number of 53 is used.
+.sp
+\fBNOTE:\fP
+.INDENT 7.0
+.INDENT 3.5
+This command has no effect when GSS\-TSIG is in use.
+.UNINDENT
+.UNINDENT
.TP
.B \fBlocal address port\fP
This command sends all dynamic update requests using the local \fBaddress\fP\&. When
@@ -373,6 +380,6 @@ operations, and may change in future releases.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/pkcs11-destroy.8in b/external/mpl/bind/dist/doc/man/pkcs11-destroy.8in
index f4695c2f45d..be5941edc1e 100644
--- a/external/mpl/bind/dist/doc/man/pkcs11-destroy.8in
+++ b/external/mpl/bind/dist/doc/man/pkcs11-destroy.8in
@@ -69,6 +69,6 @@ immediate.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/pkcs11-keygen.8in b/external/mpl/bind/dist/doc/man/pkcs11-keygen.8in
index 364f3e20a25..8ea542e1add 100644
--- a/external/mpl/bind/dist/doc/man/pkcs11-keygen.8in
+++ b/external/mpl/bind/dist/doc/man/pkcs11-keygen.8in
@@ -90,6 +90,6 @@ This option opens the session with the given PKCS#11 slot. The default is slot 0
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/pkcs11-list.8in b/external/mpl/bind/dist/doc/man/pkcs11-list.8in
index 3c4cdcdba47..e833db73671 100644
--- a/external/mpl/bind/dist/doc/man/pkcs11-list.8in
+++ b/external/mpl/bind/dist/doc/man/pkcs11-list.8in
@@ -68,6 +68,6 @@ line, \fBpkcs11\-list\fP prompts for it.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/pkcs11-tokens.8in b/external/mpl/bind/dist/doc/man/pkcs11-tokens.8in
index 67fb5fc478c..4c2920157a9 100644
--- a/external/mpl/bind/dist/doc/man/pkcs11-tokens.8in
+++ b/external/mpl/bind/dist/doc/man/pkcs11-tokens.8in
@@ -53,6 +53,6 @@ This option makes the PKCS#11 libisc initialization verbose.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/rndc-confgen.8in b/external/mpl/bind/dist/doc/man/rndc-confgen.8in
index 5abba763a57..fb7f6aa1b9e 100644
--- a/external/mpl/bind/dist/doc/man/rndc-confgen.8in
+++ b/external/mpl/bind/dist/doc/man/rndc-confgen.8in
@@ -114,6 +114,6 @@ To print a sample \fBrndc.conf\fP file and the corresponding \fBcontrols\fP and
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/rndc.8in b/external/mpl/bind/dist/doc/man/rndc.8in
index f0973e43432..71636fb0dcc 100644
--- a/external/mpl/bind/dist/doc/man/rndc.8in
+++ b/external/mpl/bind/dist/doc/man/rndc.8in
@@ -618,6 +618,6 @@ Reference Manual.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/rndc.conf.5in b/external/mpl/bind/dist/doc/man/rndc.conf.5in
index f59510663d5..059abf060f1 100644
--- a/external/mpl/bind/dist/doc/man/rndc.conf.5in
+++ b/external/mpl/bind/dist/doc/man/rndc.conf.5in
@@ -191,6 +191,6 @@ details.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/man/tsig-keygen.8in b/external/mpl/bind/dist/doc/man/tsig-keygen.8in
index dda1fab6aad..bd45eb4faa6 100644
--- a/external/mpl/bind/dist/doc/man/tsig-keygen.8in
+++ b/external/mpl/bind/dist/doc/man/tsig-keygen.8in
@@ -59,6 +59,6 @@ This option prints a short summary of options and arguments.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
-2022, Internet Systems Consortium
+2023, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
diff --git a/external/mpl/bind/dist/doc/misc/master.zoneopt b/external/mpl/bind/dist/doc/misc/master.zoneopt
index cc8a33b56f8..953e3a2829f 100644
--- a/external/mpl/bind/dist/doc/misc/master.zoneopt
+++ b/external/mpl/bind/dist/doc/misc/master.zoneopt
@@ -7,7 +7,7 @@ zone <string> [ <class> ] {
also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
@@ -55,7 +55,7 @@ zone <string> [ <class> ] {
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
update-check-ksk <boolean>;
- update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+ update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};
diff --git a/external/mpl/bind/dist/doc/misc/master.zoneopt.rst b/external/mpl/bind/dist/doc/misc/master.zoneopt.rst
index 8fe18c6db0c..346d59813ee 100644
--- a/external/mpl/bind/dist/doc/misc/master.zoneopt.rst
+++ b/external/mpl/bind/dist/doc/misc/master.zoneopt.rst
@@ -20,7 +20,7 @@
also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
@@ -68,7 +68,7 @@
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
update-check-ksk <boolean>;
- update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+ update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};
diff --git a/external/mpl/bind/dist/doc/misc/options b/external/mpl/bind/dist/doc/misc/options
index 1e90b555347..0dbcf101e1c 100644
--- a/external/mpl/bind/dist/doc/misc/options
+++ b/external/mpl/bind/dist/doc/misc/options
@@ -104,7 +104,7 @@ options {
answer-cookie <boolean>;
attach-cache <string>;
auth-nxdomain <boolean>; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
automatic-interface-scan <boolean>;
avoid-v4-udp-ports { <portrange>; ... };
avoid-v6-udp-ports { <portrange>; ... };
@@ -177,7 +177,7 @@ options {
<size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
increment | timestamp ) ];
dnstap-version ( <quoted_string> | none );
- dscp <integer>;
+ dscp <integer>; // deprecated
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
<integer> ] [ dscp <integer> ] | <ipv6_address> [ port
@@ -404,6 +404,7 @@ options {
trust-anchor-telemetry <boolean>; // experimental
try-tcp-refresh <boolean>;
update-check-ksk <boolean>;
+ update-quota <integer>;
use-alt-transfer-source <boolean>;
use-id-pool <boolean>; // ancient
use-ixfr <boolean>; // obsolete
@@ -510,7 +511,7 @@ view <string> [ <class> ] {
* ) ] [ dscp <integer> ];
attach-cache <string>;
auth-nxdomain <boolean>; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
cache-file <quoted_string>; // deprecated
catalog-zones { zone <string> [ default-masters [ port <integer> ]
[ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port
@@ -809,7 +810,7 @@ view <string> [ <class> ] {
<integer> | * ) ] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
<integer> | * ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
@@ -908,7 +909,7 @@ view <string> [ <class> ] {
6to4-self | external | krb5-self | krb5-selfsub |
krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
name | self | selfsub | selfwild | subdomain | tcp-self
- | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+ | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
use-alt-transfer-source <boolean>;
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
@@ -930,7 +931,7 @@ zone <string> [ <class> ] {
] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
* ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
@@ -1022,7 +1023,7 @@ zone <string> [ <class> ] {
external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
| ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
| subdomain | tcp-self | wildcard | zonesub ) [ <string> ]
- <rrtypelist>; ... };
+ <rrtypelist>; ... } );
use-alt-transfer-source <boolean>;
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
diff --git a/external/mpl/bind/dist/doc/misc/options.active b/external/mpl/bind/dist/doc/misc/options.active
index 8fec88e0fe1..eb75a86eae9 100644
--- a/external/mpl/bind/dist/doc/misc/options.active
+++ b/external/mpl/bind/dist/doc/misc/options.active
@@ -96,7 +96,7 @@ options {
answer-cookie <boolean>;
attach-cache <string>;
auth-nxdomain <boolean>; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
automatic-interface-scan <boolean>;
avoid-v4-udp-ports { <portrange>; ... };
avoid-v6-udp-ports { <portrange>; ... };
@@ -163,7 +163,7 @@ options {
<size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
increment | timestamp ) ];
dnstap-version ( <quoted_string> | none );
- dscp <integer>;
+ dscp <integer>; // deprecated
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
<integer> ] [ dscp <integer> ] | <ipv6_address> [ port
@@ -363,6 +363,7 @@ options {
trust-anchor-telemetry <boolean>; // experimental
try-tcp-refresh <boolean>;
update-check-ksk <boolean>;
+ update-quota <integer>;
use-alt-transfer-source <boolean>;
use-v4-udp-ports { <portrange>; ... };
use-v6-udp-ports { <portrange>; ... };
@@ -459,7 +460,7 @@ view <string> [ <class> ] {
* ) ] [ dscp <integer> ];
attach-cache <string>;
auth-nxdomain <boolean>; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
cache-file <quoted_string>; // deprecated
catalog-zones { zone <string> [ default-masters [ port <integer> ]
[ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port
@@ -734,7 +735,7 @@ view <string> [ <class> ] {
<integer> | * ) ] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
<integer> | * ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
@@ -825,7 +826,7 @@ view <string> [ <class> ] {
6to4-self | external | krb5-self | krb5-selfsub |
krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
name | self | selfsub | selfwild | subdomain | tcp-self
- | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+ | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
use-alt-transfer-source <boolean>;
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
@@ -847,7 +848,7 @@ zone <string> [ <class> ] {
] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
* ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
@@ -933,7 +934,7 @@ zone <string> [ <class> ] {
external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
| ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
| subdomain | tcp-self | wildcard | zonesub ) [ <string> ]
- <rrtypelist>; ... };
+ <rrtypelist>; ... } );
use-alt-transfer-source <boolean>;
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
diff --git a/external/mpl/bind/dist/doc/misc/options.grammar.rst b/external/mpl/bind/dist/doc/misc/options.grammar.rst
index 438072c95c4..beef35341a1 100644
--- a/external/mpl/bind/dist/doc/misc/options.grammar.rst
+++ b/external/mpl/bind/dist/doc/misc/options.grammar.rst
@@ -33,7 +33,7 @@
answer-cookie <boolean>;
attach-cache <string>;
auth-nxdomain <boolean>; // default changed
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
automatic-interface-scan <boolean>;
avoid-v4-udp-ports { <portrange>; ... };
avoid-v6-udp-ports { <portrange>; ... };
@@ -300,6 +300,7 @@
trust-anchor-telemetry <boolean>; // experimental
try-tcp-refresh <boolean>;
update-check-ksk <boolean>;
+ update-quota <integer>;
use-alt-transfer-source <boolean>;
use-v4-udp-ports { <portrange>; ... };
use-v6-udp-ports { <portrange>; ... };
diff --git a/external/mpl/bind/dist/doc/misc/slave.zoneopt b/external/mpl/bind/dist/doc/misc/slave.zoneopt
index 8cb7c3143f5..c46202dc581 100644
--- a/external/mpl/bind/dist/doc/misc/slave.zoneopt
+++ b/external/mpl/bind/dist/doc/misc/slave.zoneopt
@@ -8,7 +8,7 @@ zone <string> [ <class> ] {
also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-names ( fail | warn | ignore );
database <string>;
dialup ( notify | notify-passive | passive | refresh | <boolean> );
diff --git a/external/mpl/bind/dist/doc/misc/slave.zoneopt.rst b/external/mpl/bind/dist/doc/misc/slave.zoneopt.rst
index cc72dcbf677..468a7f4d9a3 100644
--- a/external/mpl/bind/dist/doc/misc/slave.zoneopt.rst
+++ b/external/mpl/bind/dist/doc/misc/slave.zoneopt.rst
@@ -21,7 +21,7 @@
also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
- auto-dnssec ( allow | maintain | off );
+ auto-dnssec ( allow | maintain | off ); // deprecated
check-names ( fail | warn | ignore );
database <string>;
dialup ( notify | notify-passive | passive | refresh | <boolean> );
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.0.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.0.rst
index 861d4d3b5b1..1b4e92f2358 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.0.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.0.rst
@@ -12,8 +12,10 @@
Notes for BIND 9.16.0
---------------------
-*Note: this section only lists changes from BIND 9.14 (the previous
-stable branch of BIND).*
+.. note::
+
+ This section only lists changes from BIND 9.14 (the previous
+ stable branch of BIND).
New Features
~~~~~~~~~~~~
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.1.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.1.rst
index 25acde20529..ac3668bb99a 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.1.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.1.rst
@@ -24,6 +24,9 @@ Known Issues
dispatch for reserved port") on some of them. There are currently no
plans to make such a combination of settings work again.
+- See :ref:`above <relnotes_known_issues>` for a list of all known
+ issues affecting this BIND 9 branch.
+
Feature Changes
~~~~~~~~~~~~~~~
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.10.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.10.rst
index 86d5a37fddd..782011ae542 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.10.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.10.rst
@@ -49,3 +49,10 @@ Bug Fixes
- Building with native PKCS#11 support for AEP Keyper has been broken
since BIND 9.16.6. This has been fixed. :gl:`#2315`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.11.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.11.rst
index 02f1a8ec1cf..70a6658d3e3 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.11.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.11.rst
@@ -65,3 +65,10 @@ Bug Fixes
those releases were published, there have been no new reports of
assertion failures matching this issue, but also no further diagnostic
input, so we have closed the issue. :gl:`#2091`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.12.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.12.rst
index 5bfed051350..d236f5e6dbd 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.12.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.12.rst
@@ -114,3 +114,10 @@ Bug Fixes
- Performance of the DNSSEC verification code (used by
``dnssec-signzone``, ``dnssec-verify``, and mirror zones) has been
improved. :gl:`#2073`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.13.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.13.rst
index 90a252543a4..d7650eee3c6 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.13.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.13.rst
@@ -70,3 +70,10 @@ Bug Fixes
- An invalid direction field (not one of ``N``, ``S``, ``E``, ``W``) in
a LOC record resulted in an INSIST failure when a zone file containing
such a record was loaded. :gl:`#2499`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.15.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.15.rst
index 91c5853c661..0cc0f494a49 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.15.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.15.rst
@@ -103,3 +103,10 @@ Bug Fixes
- Previously, a memory leak could occur when ``named`` failed to bind a
UDP socket to a network interface. This has been fixed. :gl:`#2575`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.16.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.16.rst
index 1157f23d6aa..721546c2836 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.16.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.16.rst
@@ -67,3 +67,10 @@ Bug Fixes
- When generating zone signing keys, KASP now also checks for key ID
conflicts among newly created keys, rather than just between new and
existing ones. :gl:`#2628`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.17.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.17.rst
index a1239051f9f..9f2bd7a9ba0 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.17.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.17.rst
@@ -58,3 +58,10 @@ Bug Fixes
- A race condition could occur when reading and writing key files for
zones using KASP and configured in multiple views. This has been
fixed. :gl:`#1875`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.18.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.18.rst
index e55542c853f..c2ebda8eeff 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.18.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.18.rst
@@ -24,3 +24,10 @@ Bug Fixes
the code detecting ``key-directory`` conflicts for zones using KASP
incorrectly reported unique key directories as being reused. This has
been fixed. :gl:`#2778`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.19.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.19.rst
index 1505ad2c390..2f964ff2ed5 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.19.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.19.rst
@@ -59,3 +59,10 @@ Bug Fixes
- A race condition could occur where two threads were competing for the
same set of key file locks, leading to a deadlock. This has been
fixed. :gl:`#2786`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.2.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.2.rst
index d1ab435ab92..ab484a158b3 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.2.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.2.rst
@@ -17,7 +17,7 @@ Security Fixes
- DNS rebinding protection was ineffective when BIND 9 is configured as
a forwarding DNS server. Found and responsibly reported by Tobias
- Klein.:gl:`#1574`
+ Klein. :gl:`#1574`
Known Issues
~~~~~~~~~~~~
@@ -30,6 +30,9 @@ Known Issues
used in the hash calculation). These are being investigated.
:gl:`#1685`
+- See :ref:`above <relnotes_known_issues>` for a list of all known
+ issues affecting this BIND 9 branch.
+
Feature Changes
~~~~~~~~~~~~~~~
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.20.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.20.rst
index d9e7561a348..b1ae9b21187 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.20.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.20.rst
@@ -48,3 +48,10 @@ Bug Fixes
- Authentication of ``rndc`` messages could fail if a ``controls``
statement was configured with multiple key algorithms for the same
listener. This has been fixed. :gl:`#2756`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.21.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.21.rst
index 623f1252998..b3d55679398 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.21.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.21.rst
@@ -59,3 +59,10 @@ Bug Fixes
``in-view`` statement, running ``rndc freeze`` always reported an
``already frozen`` error even though the zone was successfully
frozen. This has been fixed. :gl:`#2844`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.22.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.22.rst
index aa6d52ddb2f..3403ee6463e 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.22.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.22.rst
@@ -77,3 +77,10 @@ Bug Fixes
- When new IP addresses were set up by the operating system during
``named`` startup, it could fail to listen for TCP connections on the
newly added interfaces. :gl:`#2852`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.23.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.23.rst
index 11ec05ef871..3f715aa50bb 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.23.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.23.rst
@@ -18,3 +18,10 @@ Bug Fixes
- Reloading a catalog zone which referenced a missing/deleted member
zone triggered a runtime check failure, causing ``named`` to exit
prematurely. This has been fixed. :gl:`#2308`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.24.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.24.rst
index 6895fcd5b50..eda9a7b3cfd 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.24.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.24.rst
@@ -34,3 +34,10 @@ Bug Fixes
running ``rndc reconfig``, then bringing back the removed
``catalog-zone`` clause and running ``rndc reconfig`` again caused
``named`` to crash. This has been fixed. :gl:`#1608`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.25.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.25.rst
index 14c86676b8e..a024a93b5ff 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.25.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.25.rst
@@ -39,3 +39,10 @@ Bug Fixes
contents after ``named`` restarted, if the unsigned zone file was
modified while ``named`` was not running. This has been fixed.
:gl:`#3071`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.26.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.26.rst
index 854e18d4794..92ba18de47c 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.26.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.26.rst
@@ -37,3 +37,10 @@ Bug Fixes
- Build errors were introduced in some DLZ modules due to an incomplete
change in the previous release. This has been fixed. :gl:`#3111`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.27.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.27.rst
index 13f07535e67..842a1c4e1bd 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.27.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.27.rst
@@ -56,3 +56,10 @@ Bug Fixes
miscalculated in certain resolution scenarios, potentially causing the
value of the counter to drop below zero. This has been fixed.
:gl:`#3147`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.28.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.28.rst
index 31fb50e4b5e..54dfc17b8d0 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.28.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.28.rst
@@ -31,3 +31,10 @@ Bug Fixes
- Handling of TCP write timeouts has been improved to track the timeout
for each TCP write separately, leading to a faster connection teardown
in case the other party is not reading the data. :gl:`#3200`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.29.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.29.rst
index 289586659dc..9e1cc4aa1b3 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.29.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.29.rst
@@ -18,3 +18,10 @@ Bug Fixes
- Previously, CDS and CDNSKEY DELETE records were removed from the zone
when configured with the ``auto-dnssec maintain;`` option. This has
been fixed. :gl:`#2931`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.3.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.3.rst
index 388f7d1ee35..773bfd8b9b2 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.3.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.3.rst
@@ -39,6 +39,9 @@ Known Issues
against either libuv 1.35 or libuv 1.37+; libuv 1.36 is still not
usable with BIND. :gl:`#1761` :gl:`#1797`
+- See :ref:`above <relnotes_known_issues>` for a list of all known
+ issues affecting this BIND 9 branch.
+
Feature Changes
~~~~~~~~~~~~~~~
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.30.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.30.rst
index 37c79fe2ab1..2d375c1f4da 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.30.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.30.rst
@@ -28,3 +28,10 @@ Bug Fixes
ran, whether the metadata had changed or not. :iscman:`named` now
checks whether changes were applied before writing out the key files.
:gl:`#3302`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.31.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.31.rst
index 30a13e553ad..150694d2b2c 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.31.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.31.rst
@@ -22,3 +22,10 @@ Bug Fixes
- :iscman:`named` could crash during a very rare situation that could
arise when validating a query which had timed out at that exact
moment. This has been fixed. :gl:`#3398`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.32.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.32.rst
index 2754cfeea1a..542051eb9f9 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.32.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.32.rst
@@ -47,3 +47,10 @@ Bug Fixes
- ``rndc dumpdb -expired`` was fixed to include
expired RRsets, even if ``stale-cache-enable`` is set to ``no`` and
the cache-cleaning time window has passed. :gl:`#3462`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.33.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.33.rst
index 94a984eea0e..876aab8bfe3 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.33.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.33.rst
@@ -59,3 +59,10 @@ Bug Fixes
from cache for lookups that received duplicate queries or queries that
would be dropped. This bug resulted in premature SERVFAIL responses,
and has now been resolved. :gl:`#2982`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.34.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.34.rst
new file mode 100644
index 00000000000..b1eedacf9e6
--- /dev/null
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.34.rst
@@ -0,0 +1,46 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0. If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.16.34
+----------------------
+
+Known Issues
+~~~~~~~~~~~~
+
+- Upgrading from BIND 9.16.32 or any older version may require a manual
+ configuration change. The following configurations are affected:
+
+ - ``type primary`` zones configured with ``dnssec-policy`` but without
+ either ``allow-update`` or ``update-policy``,
+ - ``type secondary`` zones configured with ``dnssec-policy``.
+
+ In these cases please add ``inline-signing yes;`` to the individual
+ zone configuration(s). Without applying this change, :iscman:`named`
+ will fail to start. For more details, see
+ https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
+
+- See :ref:`above <relnotes_known_issues>` for a list of all known
+ issues affecting this BIND 9 branch.
+
+New Features
+~~~~~~~~~~~~
+
+- Support for parsing and validating the ``dohpath`` service parameter
+ in SVCB records was added. :gl:`#3544`
+
+- :iscman:`named` now logs the supported cryptographic algorithms during
+ startup and in the output of ``named -V``. :gl:`#3541`
+
+Bug Fixes
+~~~~~~~~~
+
+- Changing just the TSIG key names for primaries in catalog zones'
+ member zones was not effective. This has been fixed. :gl:`#3557`
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.35.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.35.rst
new file mode 100644
index 00000000000..23ccf86edff
--- /dev/null
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.35.rst
@@ -0,0 +1,56 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0. If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.16.35
+----------------------
+
+Bug Fixes
+~~~~~~~~~
+
+- A crash was fixed that happened when a ``dnssec-policy`` zone that
+ used NSEC3 was reconfigured to enable ``inline-signing``. :gl:`#3591`
+
+- In certain resolution scenarios, quotas could be erroneously reached
+ for servers, including any configured forwarders, resulting in
+ SERVFAIL answers being sent to clients. This has been fixed.
+ :gl:`#3598`
+
+- ``rpz-ip`` rules in ``response-policy`` zones could be ineffective in
+ some cases if a query had the CD (Checking Disabled) bit set to 1.
+ This has been fixed. :gl:`#3247`
+
+- Previously, if Internet connectivity issues were experienced during
+ the initial startup of :iscman:`named`, a BIND resolver with
+ ``dnssec-validation`` set to ``auto`` could enter into a state where
+ it would not recover without stopping :iscman:`named`, manually
+ deleting the ``managed-keys.bind`` and ``managed-keys.bind.jnl``
+ files, and starting :iscman:`named` again. This has been fixed.
+ :gl:`#2895`
+
+- The statistics counter representing the current number of clients
+ awaiting recursive resolution results (``RecursClients``) could
+ overflow in certain resolution scenarios. This has been fixed.
+ :gl:`#3584`
+
+- Previously, BIND failed to start on Solaris-based systems with
+ hundreds of CPUs. This has been fixed. :gl:`#3563`
+
+- When a DNS resource record's TTL value was equal to the resolver's
+ configured ``prefetch`` "eligibility" value, the record was
+ erroneously not treated as eligible for prefetching. This has been
+ fixed. :gl:`#3603`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.36.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.36.rst
new file mode 100644
index 00000000000..d73df017eee
--- /dev/null
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.36.rst
@@ -0,0 +1,49 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0. If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.16.36
+----------------------
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The ``auto-dnssec`` option has been deprecated and will be removed in
+ a future BIND 9.19.x release. Please migrate to ``dnssec-policy``.
+ :gl:`#3667`
+
+Bug Fixes
+~~~~~~~~~
+
+- When a catalog zone was removed from the configuration, in some cases
+ a dangling pointer could cause the :iscman:`named` process to crash.
+ This has been fixed. :gl:`#3683`
+
+- When a zone was deleted from a server, a key management object related
+ to that zone was inadvertently kept in memory and only released upon
+ shutdown. This could lead to constantly increasing memory use on
+ servers with a high rate of changes affecting the set of zones being
+ served. This has been fixed. :gl:`#3727`
+
+- In certain cases, :iscman:`named` waited for the resolution of
+ outstanding recursive queries to finish before shutting down. This was
+ unintended and has been fixed. :gl:`#3183`
+
+- The ``zone <name>/<class>: final reference detached`` log message was
+ moved from the INFO log level to the DEBUG(1) log level to prevent the
+ :iscman:`named-checkzone` tool from superfluously logging this message
+ in non-debug mode. :gl:`#3707`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.37.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.37.rst
new file mode 100644
index 00000000000..9b0393ca045
--- /dev/null
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.37.rst
@@ -0,0 +1,80 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0. If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.16.37
+----------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- An UPDATE message flood could cause :iscman:`named` to exhaust all
+ available memory. This flaw was addressed by adding a new
+ ``update-quota`` option that controls the maximum number of
+ outstanding DNS UPDATE messages that :iscman:`named` can hold in a
+ queue at any given time (default: 100). (CVE-2022-3094)
+
+ ISC would like to thank Rob Schulhof from Infoblox for bringing this
+ vulnerability to our attention. :gl:`#3523`
+
+- :iscman:`named` could crash with an assertion failure when an RRSIG
+ query was received and ``stale-answer-client-timeout`` was set to a
+ non-zero value. This has been fixed. (CVE-2022-3736)
+
+ ISC would like to thank Borja Marcos from Sarenet (with assistance by
+ Iratxe Niño from Fundación Sarenet) for bringing this vulnerability to
+ our attention. :gl:`#3622`
+
+- :iscman:`named` running as a resolver with the
+ ``stale-answer-client-timeout`` option set to any value greater than
+ ``0`` could crash with an assertion failure, when the
+ ``recursive-clients`` soft quota was reached. This has been fixed.
+ (CVE-2022-3924)
+
+ ISC would like to thank Maksym Odinintsev from AWS for bringing this
+ vulnerability to our attention. :gl:`#3619`
+
+New Features
+~~~~~~~~~~~~
+
+- The new ``update-quota`` option can be used to control the number of
+ simultaneous DNS UPDATE messages that can be processed to update an
+ authoritative zone on a primary server, or forwarded to the primary
+ server by a secondary server. The default is 100. A new statistics
+ counter has also been added to record events when this quota is
+ exceeded, and the version numbers for the XML and JSON statistics
+ schemas have been updated. :gl:`#3523`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The Differentiated Services Code Point (DSCP) feature in BIND has been
+ deprecated. Configuring DSCP values in ``named.conf`` now causes a
+ warning to be logged. Note that this feature has only been partly
+ operational since the new Network Manager was introduced in BIND
+ 9.16.0. :gl:`#3773`
+
+- The catalog zone implementation has been optimized to work with
+ hundreds of thousands of member zones. :gl:`#3744`
+
+Bug Fixes
+~~~~~~~~~
+
+- In certain query resolution scenarios (e.g. when following CNAME
+ records), :iscman:`named` configured to answer from stale cache could
+ return a SERVFAIL response despite a usable, non-stale answer being
+ present in the cache. This has been fixed. :gl:`#3678`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.4.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.4.rst
index 0318317b352..6dd03f6fd78 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.4.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.4.rst
@@ -102,12 +102,19 @@ Bug Fixes
of the current active key (the predecessor) was not changed and thus
never removed from the zone. :gl:`#1846`
-- ``named-checkconf -p`` could include spurious text in
- ``server-addresses`` statements due to an uninitialized DSCP value.
- This has been fixed. :gl:`#1812`
+- ``named-checkconf -p`` could include spurious text in
+ ``server-addresses`` statements due to an uninitialized DSCP value.
+ This has been fixed. :gl:`#1812`
- The ARM has been updated to indicate that the TSIG session key is
generated when named starts, regardless of whether it is needed.
:gl:`#1842`
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting
+ this BIND 9 branch.
+
.. _Read the Docs: https://bind9.readthedocs.io/
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.5.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.5.rst
index e5555e6634a..613dcf71366 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.5.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.5.rst
@@ -63,3 +63,10 @@ Bug Fixes
- The ``blackhole`` ACL was inadvertently disabled for client queries.
Blocked IP addresses were not used for upstream queries but queries
from those addresses could still be answered. :gl:`#1936`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.6.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.6.rst
index 756bac0fe9f..1357f1de3a3 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.6.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.6.rst
@@ -112,3 +112,10 @@ Bug Fixes
- LMDB locking code was revised to make ``rndc reconfig`` work properly
on FreeBSD and with LMDB >= 0.9.26. :gl:`#1976`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.7.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.7.rst
index 3ed408ea13f..ed04df29117 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.7.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.7.rst
@@ -53,4 +53,11 @@ Bug Fixes
- Several problems found by `OSS-Fuzz`_ were fixed. (None of these are
security issues.) :gl:`!3953` :gl:`!3975`
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
+
.. _OSS-Fuzz: https://github.com/google/oss-fuzz
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.8.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.8.rst
index 814f7f31b0a..e441e426840 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.8.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.8.rst
@@ -54,3 +54,10 @@ Bug Fixes
- Updating contents of an RPZ zone which contained names spelled using
varying letter case could cause some processing rules in that RPZ zone
to be erroneously ignored. :gl:`#2169`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-9.16.9.rst b/external/mpl/bind/dist/doc/notes/notes-9.16.9.rst
index b4d7f26434f..5ce2b37d083 100644
--- a/external/mpl/bind/dist/doc/notes/notes-9.16.9.rst
+++ b/external/mpl/bind/dist/doc/notes/notes-9.16.9.rst
@@ -41,3 +41,10 @@ Bug Fixes
- ``UV_EOF`` is no longer treated as a ``TCP4RecvErr`` or a
``TCP6RecvErr``. :gl:`#2208`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+ <relnotes_known_issues>` for a list of all known issues affecting this
+ BIND 9 branch.
diff --git a/external/mpl/bind/dist/doc/notes/notes-known-issues.rst b/external/mpl/bind/dist/doc/notes/notes-known-issues.rst
new file mode 100644
index 00000000000..d9000cbe0c1
--- /dev/null
+++ b/external/mpl/bind/dist/doc/notes/notes-known-issues.rst
@@ -0,0 +1,46 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0. If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _relnotes_known_issues:
+
+Known Issues
+------------
+
+- Upgrading from BIND 9.16.32 or any older version may require a manual
+ configuration change. The following configurations are affected:
+
+ - ``type primary`` zones configured with ``dnssec-policy`` but without
+ either ``allow-update`` or ``update-policy``,
+ - ``type secondary`` zones configured with ``dnssec-policy``.
+
+ In these cases please add ``inline-signing yes;`` to the individual
+ zone configuration(s). Without applying this change, :iscman:`named`
+ will fail to start. For more details, see
+ https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
+
+- BIND crashes on startup when linked against libuv 1.36. This issue is
+ related to ``recvmmsg()`` support in libuv, which was first included
+ in libuv 1.35. The problem was addressed in libuv 1.37, but the
+ relevant libuv code change requires a special flag to be set during
+ library initialization in order for ``recvmmsg()`` support to be
+ enabled. This BIND release sets that special flag when required, so
+ ``recvmmsg()`` support is now enabled when BIND is compiled against
+ either libuv 1.35 or libuv 1.37+; libuv 1.36 is still not usable with
+ BIND. :gl:`#1761` :gl:`#1797`
+
+- UDP network ports used for listening can no longer simultaneously be
+ used for sending traffic. An example configuration which triggers this
+ issue would be one which uses the same address:port pair for
+ ``listen-on(-v6)`` statements as for ``notify-source(-v6)`` or
+ ``transfer-source(-v6)``. While this issue affects all operating
+ systems, it only triggers log messages (e.g. "unable to create
+ dispatch for reserved port") on some of them. There are currently no
+ plans to make such a combination of settings work again.
diff --git a/external/mpl/bind/dist/lib/dns/tests/Krsa.+008+29238.key b/external/mpl/bind/dist/lib/dns/tests/Krsa.+008+29238.key
new file mode 100644
index 00000000000..8a090671973
--- /dev/null
+++ b/external/mpl/bind/dist/lib/dns/tests/Krsa.+008+29238.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 29235, for rsa.
+; Created: 20160819191802 (Fri Aug 19 21:18:02 2016)
+; Publish: 20160819191802 (Fri Aug 19 21:18:02 2016)
+; Activate: 20160819191802 (Fri Aug 19 21:18:02 2016)
+rsa. IN DNSKEY 256 3 8 AwEAAdLT1R3qiqCqll3Xzh2qFMvehQ9FODsPftw5U4UjB3QwnJ/3+dph 9kZBBeaJagUBVYzoArk6XNydpp3HhSCFDcIiepL6r8XAifW3SqI1KCne OD38kSCl/Qm9P0+3CFWokGVubsSQ+3dpQZxqx5bzOXthbuzAr6X+gDUE LAyHtCQNmJ+4ktdCoj3DNYW0z/xLvrcB2Lns7H+/qWnGPL4f3hr7Vbak Oeay+4J4KGdY2LFxJUVts6QrgAA8gz4mV9YIJFP+C4B3b/Z7qgqZRxmT 0pic+fJC5+sq0l8KwavPn0n+HqVuJNvppVKMdTbsmmuk69RFGMjbFkP7 tnCiqC9Zi6s=
diff --git a/external/mpl/bind/dist/lib/isc/win32/libisc.def.in b/external/mpl/bind/dist/lib/isc/win32/libisc.def.in
index 56358f3c646..a98ae707c67 100644
--- a/external/mpl/bind/dist/lib/isc/win32/libisc.def.in
+++ b/external/mpl/bind/dist/lib/isc/win32/libisc.def.in
@@ -778,6 +778,7 @@ pkcs_C_VerifyUpdate
@END PKCS11
strlcat
strlcpy
+strnstr
syslog
@IF NOLONGER
diff --git a/external/mpl/bind/dist/lib/ns/win32/libns.def b/external/mpl/bind/dist/lib/ns/win32/libns.def
index eadd940a9ce..50edf86730b 100644
--- a/external/mpl/bind/dist/lib/ns/win32/libns.def
+++ b/external/mpl/bind/dist/lib/ns/win32/libns.def
@@ -42,6 +42,7 @@ ns_client_shuttingdown
ns_client_sourceip
ns_clientmgr_create
ns_clientmgr_destroy
+ns_clientmgr_shutdown
ns_hook_add
ns_hooktable_create
ns_hooktable_free
diff --git a/external/mpl/bind/dist/srcid b/external/mpl/bind/dist/srcid
index 338409fbe9f..948e68dc8a3 100644
--- a/external/mpl/bind/dist/srcid
+++ b/external/mpl/bind/dist/srcid
@@ -1 +1 @@
-SRCID=35e9c6e
+SRCID=2b2afb2
diff --git a/external/mpl/bind/dist/version b/external/mpl/bind/dist/version
index b0565e22a9d..8b47c66ab26 100644
--- a/external/mpl/bind/dist/version
+++ b/external/mpl/bind/dist/version
@@ -5,7 +5,7 @@ PRODUCT=BIND
DESCRIPTION="(Extended Support Version)"
MAJORVER=9
MINORVER=16
-PATCHVER=33
+PATCHVER=37
RELEASETYPE=
RELEASEVER=
EXTENSIONS=