tests: addzone: retry when checking for things, to allow for timing problems

test: autosign: wait a bit longer for the zone to be signed, it might take time on a loaded system
test: forward: retry checking logs for evidence of priming queries not being forwarded
2019-12-09 09:39:38 +01:00 · 2019-12-09 09:39:38 +01:00 · 2019-12-09 09:39:31 +01:00 · 2019-12-09 08:22:56 +00:00 · 2019-12-09 07:25:20 +00:00 · 2019-12-09 07:25:20 +00:00
98 changed files with 338 additions and 502 deletions
@@ -1,3 +1,9 @@
+5334.	[doc]		Update documentation with dnssec-policy clarifications.
+			Also change some defaults.
+
+5333.	[bug]		Fix duration printing on Solaris when value is not
+			an ISO 8601 duration. [GL #1460]
+
 5332.	[func]		Renamed "dnssec-keys" configuration statement
 			to the more descriptive "trust-anchors".

@@ -1017,7 +1017,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {

    <literallayout class="normal">
 dnssec-policy <replaceable>string</replaceable> {
-	dnskey-ttl <replaceable>ttlval</replaceable>;
+	dnskey-ttl <replaceable>duration</replaceable>;
 	keys { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
 	parent-ds-ttl <replaceable>duration</replaceable>;
 	parent-propagation-delay <replaceable>duration</replaceable>;
@@ -5,7 +5,7 @@ named.lock
 named.pid
 named.run
 /feature-test
-**/test.output
+/test.output.*
 /systests.output
 /random.data
 parallel.mk
@@ -64,7 +64,7 @@ parallel.mk:

 test: parallel.mk subdirs
 	@$(MAKE) -f parallel.mk check
-	@$(SHELL) ./runsequential.sh -r
+	@$(SHELL) ./runsequential.sh
 	@$(SHELL) ./testsummary.sh

 check: test
@@ -98,19 +98,6 @@ Optional flags are:
                    ports 7900 through 7999).  If not specified, the test will
                    have ports 5000 to 5099 available to it.

-    -r              The "runall" flag.  This is related to cleaning up after
-                    the tests (see "Maintenance Notes" below).  If specified,
-                    it prevents a copy of the test's output listing from being
-                    deleted when the directory is cleaned up after the test
-                    completes.  (The test's output listing comprises messages
-                    produced by the test during its execution; it does not
-                    include the output files produced by utilities such as
-                    "dig" or "rndc", nor any logging output from named itself.)
-                    It is usually only used when "run.sh" is being called
-                    during a run of the entire test suite.  Note that if "-n"
-                    is specified on the "run.sh" command line, the test output
-                    is retained even if this option is omitted.
-
 Arguments are:

    test-name       Mandatory.  The name of the test, which is the name of the
@@ -253,22 +240,12 @@ Re-Running the Tests
 ---
 If there is a requirement to re-run a test (or the entire test suite), the
 files produced by the tests should be deleted first.  Normally, these files are
-deleted if the test succeeds but are retained on error.
-
-Deletion of files produced by an individual test can be done with the command:
-
-    sh clean.sh [-r] <test-name>
-
-The optional flag is:
-
-    -r              The "runall" flag.  This is related to cleaning up after
-                    the tests (see "Maintenance Notes" below).  If specified,
-                    it prevents a copy of the test's output listing from being
-                    deleted when the directory is cleaned after the test
-                    completes.
+deleted if the test succeeds but are retained on error.  The run.sh script
+automatically calls a given test's clean.sh script before invoking its setup.sh
+script.

 Deletion of the files produced by the set of tests (e.g. after the execution
-of "runall.sh") can be deleted by the command:
+of "runall.sh") can be carried out using the command:

    sh cleanall.sh

@@ -709,7 +686,7 @@ the ports are assigned when the tests are run.  This is achieved by having the
 when "make check" is run, and contains a target for each test of the form:

    <test-name>:
-        @$(SHELL) run.sh -r -p <baseport> <test-name>
+        @$(SHELL) run.sh -p <baseport> <test-name>

 The <baseport> is unique and the values of <baseport> for each test are
 separated by at least 100 ports.
@@ -717,52 +694,27 @@ separated by at least 100 ports.

 Cleaning Up From Tests
 ---
-When a test is run, files are created in the test directory.  These files fall
-into three categories:
+When a test is run, up to three different types of files are created:

-1. Files generated by the test itself, e.g. output from "dig" and "rndc".
+1. Files generated by the test itself, e.g. output from "dig" and "rndc", are
+stored in the test directory.

 2. Files produced by named which may not be cleaned up if named exits
-abnormally, e.g. core files, PID files etc.
+abnormally, e.g. core files, PID files etc., are stored in the test directory.

-3. The file "test.output" containing the text written to stdout by the test.
-This is only produced when the test is run as part of the entire test suite
-(e.g. via "runall.sh").
+3. A file "test.output.<test-name>" containing the text written to stdout by the
+test is written to bin/tests/system/.  This file is only produced when the test
+is run as part of the entire test suite (e.g. via "runall.sh").

 If the test fails, all these files are retained.  But if the test succeeds,
 they are cleaned up at different times:

 1. Files generated by the test itself are cleaned up by the test's own
-"clean.sh".  This is called from the system's "clean.sh", which in turn is
-called from "run.sh".
+"clean.sh", which is called from "run.sh".

-2. Files that may not be cleaned up if named exits abnormally are removed
-by the system's "clean.sh".
+2. Files that may not be cleaned up if named exits abnormally can be removed
+using the "cleanall.sh" script.

-3. "test.output" files are deleted when the test suite ends.  At this point,
-the file "testsummary.sh" is called which concatenates all the "test.output"
-files into a single "systest.output" file before deleting them.
-
-A complication arises with the "test.output" file however:
-
-1. "clean.sh" is called by "run.sh" if the test ends successfully.  For
-this reason, "clean.sh" cannot delete "test.output" as, if the test is
-being run as part of a test suite, the file must be retained.
-
-2. If the deletion of "test.output" were to be solely the responsibility of
-"testsummary.sh", should a test suite terminate abnormally, cleaning up a test
-directory with "sh clean.sh <test-directory>" would leave the file present.
-
-3. An additional step could be added to "cleanall.sh" (which calls the
-system's "clean.sh" for each test) to remove the "test.output" file.  However,
-although the file would be deleted should all test directories be cleaned,
-it would still mean that running "clean.sh" on a particular test directory
-could leave the file present.
-
-To get round this, the system's "clean.sh" script takes an optional flag, "-r"
-(the "runall" flag).  When the test suite is run, each invocation of "run.sh"
-is passed the runall flag.  In turn, "run.sh" passes the flag to "clean.sh",
-which causes that script not to delete the "tests.output" file.  In other
-words, when the system's "clean.sh" is invoked standalone on a test directory
-(or as part of a run of "cleanall.sh"), it will delete the "test.output" if it
-is present.  When invoked during a run of the entire test suite, it won't.
+3. "test.output.*" files are deleted when the test suite ends.  At this point,
+the file "testsummary.sh" is called which concatenates all the "test.output.*"
+files into a single "systests.output" file before deleting them.
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cp -f ns1/redirect.db.1 ns1/redirect.db
 cp -f ns2/redirect.db.1 ns2/redirect.db
 cp -f ns3/redirect.db.1 ns3/redirect.db
@@ -18,6 +18,15 @@ RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 status=0
 n=0

+_wait_for_message() (
+	nextpartpeek "$1" > wait_for_message.$n
+	grep -F "$2" wait_for_message.$n >/dev/null
+)
+
+wait_for_message() (
+	retry_quiet 20 _wait_for_message "$@"
+)
+
 echo_i "checking normally loaded zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
@@ -49,25 +58,30 @@ fi
 echo_i "adding new zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'added.example { type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.added.example' dig.out.ns2.$n > /dev/null || ret=1
+_check_adding_new_zone () {
+	$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.added.example' dig.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_adding_new_zone || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+nextpart ns2/named.run >/dev/null
 echo_i "checking addzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 addzone bad.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
-grep "addzone: 'mister' unexpected" ns2/named.run >/dev/null 2>&1 || ret=1
+wait_for_message ns2/named.run "addzone: 'mister' unexpected" || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+nextpart ns2/named.run >/dev/null
 echo_i "checking modzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 modzone added.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
-grep "modzone: 'mister' unexpected" ns2/named.run >/dev/null 2>&1 || ret=1
+wait_for_message ns2/named.run "modzone: 'mister' unexpected" || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -75,9 +89,12 @@ status=`expr $status + $ret`
 echo_i "adding a zone that requires quotes ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"32/1.0.0.127-in-addr.added.example" { check-names ignore; type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.2 "a.32/1.0.0.127-in-addr.added.example" a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.32/1.0.0.127-in-addr.added.example' dig.out.ns2.$n > /dev/null || ret=1
+_check_zone_that_requires_quotes() {
+	$DIG $DIGOPTS @10.53.0.2 "a.32/1.0.0.127-in-addr.added.example" a > dig.out.ns2.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.32/1.0.0.127-in-addr.added.example' dig.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_zone_that_requires_quotes || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -85,9 +102,12 @@ status=`expr $status + $ret`
 echo_i "adding a zone with a quote in the name ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"foo\"bar.example" { check-names ignore; type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.foo\\"bar.example' dig.out.ns2.$n > /dev/null || ret=1
+_check_zone_with_a_quote() {
+	$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.foo\\"bar.example' dig.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_zone_with_a_quote || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -135,9 +155,13 @@ fi
 echo_i "deleting previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone previous.example 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.2 a.previous.example a > dig.out.ns2.$n
-grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.previous.example' dig.out.ns2.$n > /dev/null && ret=1
+_check_deleting_previously_added_zone() {
+	$DIG $DIGOPTS @10.53.0.2 a.previous.example a > dig.out.ns2.$n
+	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.previous.example' dig.out.ns2.$n > /dev/null && return 1
+	return 0
+}
+retry_quiet 10 _check_deleting_previously_added_zone || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -167,9 +191,13 @@ fi
 echo_i "deleting newly added zone added.example ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone added.example 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n
-grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
+_check_deleting_newly_added_zone() {
+	$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n
+	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.added.example' dig.out.ns2.$n > /dev/null && return 1
+	return 0
+}
+retry_quiet 10 _check_deleting_newly_added_zone || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -177,9 +205,13 @@ status=`expr $status + $ret`
 echo_i "deleting newly added zone with escaped quote ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone "foo\\\"bar.example" 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n
-grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
-grep "^a.foo\"bar.example" dig.out.ns2.$n > /dev/null && ret=1
+_check_deleting_newly_added_zone_quote() {
+	$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n
+	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || return 1
+	grep "^a.foo\"bar.example" dig.out.ns2.$n > /dev/null && return 1
+	return 0
+}
+retry_quiet 10 _check_deleting_newly_added_zone_quote || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -225,12 +257,12 @@ ret=0
 sleep 1
 cp -f ns1/redirect.db.2 ns1/redirect.db
 $RNDCCMD 10.53.0.1 reload -redirect > rndc.out.ns1.$n
-_check_zonestatus() {
+_check_rndc_reload_with_a_normal_zone() {
    $RNDCCMD 10.53.0.1 zonestatus -redirect > zonestatus.out.ns1.$n || return 1
    grep "type: redirect" zonestatus.out.ns1.$n > /dev/null || return 1
    grep "serial: 1" zonestatus.out.ns1.$n > /dev/null || return 1
 }
-retry 5 _check_zonestatus || ret=1
+retry 5 _check_rndc_reload_with_a_normal_zone || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -238,27 +270,27 @@ status=`expr $status + $ret`
 echo_i "delete a normally-loaded zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone normal.example > rndc.out.ns2.$n 2>&1
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n
-grep "is no longer active and will be deleted" rndc.out.ns2.$n > /dev/null || ret=1
+grep "is no longer active and will be deleted" rndc.out.ns2.$n > /dev/null || ret=11
 grep "To keep it from returning when the server is restarted" rndc.out.ns2.$n > /dev/null || ret=1
 grep "must also be removed from named.conf." rndc.out.ns2.$n > /dev/null || ret=1
+_check_delete_normally_loaded_zone() {
+	$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n
+	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || return 1
+}
+retry 5 _check_delete_normally_loaded_zone || ret=1

-grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 echo_i "attempting to add master zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inline.example { type master; file "inline.db"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
-for i in 1 2 3 4 5
-do
-ret=0
-$DIG $DIGOPTS @10.53.0.2 a.inline.example a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.inline.example' dig.out.ns2.$n > /dev/null || ret=1
-[ $ret = 0 ] && break
-sleep 1
-done
+_check_add_master_zone_with_inline() {
+	$DIG $DIGOPTS @10.53.0.2 a.inline.example a > dig.out.ns2.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.inline.example' dig.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 5 _check_add_master_zone_with_inline || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -273,15 +305,12 @@ status=`expr $status + $ret`

 echo_i "attempting to add slave zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlineslave.example { type slave; masters { 10.53.0.1; }; file "inlineslave.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
-for i in 1 2 3 4 5
-do
-ret=0
-$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null || ret=1
-[ $ret = 0 ] && break
-sleep 1
-done
+_check_add_slave_with_inline() {
+	$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 5 _check_add_slave_with_inline || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -307,15 +336,12 @@ status=`expr $status + $ret`

 echo_i "restoring slave zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlineslave.example { type slave; masters { 10.53.0.1; }; file "inlineslave.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
-for i in 1 2 3 4 5
-do
-ret=0
-$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null || ret=1
-[ $ret = 0 ] && break
-sleep 1
-done
+_check_restoring_slave_with_inline() {
+	$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 5 _check_restoring_slave_with_inline || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -367,11 +393,14 @@ status=`expr $status + $ret`
 echo_i "check that adding a 'master redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"." { type redirect; file "redirect.db"; };' > rndc.out.ns2.$n 2>&1 || ret=1
-$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || ret=1
-grep "type redirect;" showzone.out.ns2.$n > /dev/null || ret=1
-$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
-grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
-grep "serial: 0" zonestatus.out.ns2.$n > /dev/null || ret=1
+_check_add_master_redirect() {
+	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || return 1
+	grep "type redirect;" showzone.out.ns2.$n > /dev/null || return 1
+	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || return 1
+	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || return 1
+	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_add_master_redirect || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -381,9 +410,12 @@ ret=0
 sleep 1
 cp -f ns2/redirect.db.2 ns2/redirect.db
 $RNDCCMD 10.53.0.2 reload -redirect > rndc.out.ns2.$n
-$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
-grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
-grep "serial: 1" zonestatus.out.ns2.$n > /dev/null || ret=1
+_check_reload_master_redirect() {
+	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || return 1
+	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || return 1
+	grep "serial: 1" zonestatus.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_reload_master_redirect || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -398,8 +430,11 @@ status=`expr $status + $ret`
 echo_i "check that deleting a 'master redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone -redirect > rndc.out.ns2.$n 2>&1 || ret=1
-$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1
-grep 'not found' showzone.out.ns2.$n > /dev/null || ret=1
+_check_deleting_master_redirect() {
+	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1
+	grep 'not found' showzone.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_deleting_master_redirect || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -407,12 +442,14 @@ status=`expr $status + $ret`
 echo_i "check that adding a 'slave redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"." { type redirect; masters { 10.53.0.3;}; file "redirect.bk"; };' > rndc.out.ns2.$n 2>&1 || ret=1
-$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || ret=1
-grep "type redirect;" showzone.out.ns2.$n > /dev/null || ret=1
-sleep 1
-$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
-grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
-grep "serial: 0" zonestatus.out.ns2.$n > /dev/null || ret=1
+_check_adding_slave_redirect() {
+	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || return 1
+	grep "type redirect;" showzone.out.ns2.$n > /dev/null || return 1
+	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || return 1
+	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || return 1
+	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_adding_slave_redirect || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -421,12 +458,13 @@ echo_i "check that retransfering a added 'slave redirect' zone works ($n)"
 ret=0
 cp -f ns3/redirect.db.2 ns3/redirect.db
 $RNDCCMD 10.53.0.3 reload . > showzone.out.ns3.$n 2>&1 || ret=1
-sleep 1
-$RNDCCMD 10.53.0.2 retransfer -redirect > rndc.out.ns2.$n 2>&1 || ret=1
-sleep 1
-$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
-grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
-grep "serial: 1" zonestatus.out.ns2.$n > /dev/null || ret=1
+_check_retransfering_slave_redirect() {
+	$RNDCCMD 10.53.0.2 retransfer -redirect > rndc.out.ns2.$n 2>&1 || return 1
+	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || return 1
+	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || return 1
+	grep "serial: 1" zonestatus.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_retransfering_slave_redirect || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -434,8 +472,11 @@ status=`expr $status + $ret`
 echo_i "check that deleting a 'slave redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone -redirect > rndc.out.ns2.$n 2>&1 || ret=1
-$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1
-grep 'not found' showzone.out.ns2.$n > /dev/null || ret=1
+_check_deleting_slave_redirect() {
+	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1
+	grep 'not found' showzone.out.ns2.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_deleting_slave_redirect || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -521,30 +562,29 @@ fi
 echo_i "checking rndc reload causes named to reload the external view's new zone config ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/I:ns2 /'
-$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
-$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
-grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
+_check_rndc_reload_external_view_config() {
+	$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || return 1
+	$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || return 1
+	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_rndc_reload_external_view_config || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 echo_i "checking rndc showzone with newly added zone ($n)"
-# loop because showzone may complain if zones are still being
-# loaded from the NZDB at this point.
-for try in 0 1 2 3 4 5; do
-    ret=0
-$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null
-    if [ -z "$NZD" ]; then
-      expected='zone "added.example" in external { type master; file "added.db"; };'
-    else
-      expected='zone "added.example" { type master; file "added.db"; };'
-    fi
-    [ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-    [ $ret -eq 0 ] && break
-    sleep 1
-done
+_check_rndc_showzone_newly_added() {
+	$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null
+	if [ -z "$NZD" ]; then
+		expected='zone "added.example" in external { type master; file "added.db"; };'
+	else
+		expected='zone "added.example" { type master; file "added.db"; };'
+	fi
+	[ "`cat rndc.out.ns2.$n`" = "$expected" ] || return 1
+}
+retry_quiet 10  _check_rndc_showzone_newly_added || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -552,9 +592,13 @@ status=`expr $status + $ret`
 echo_i "deleting newly added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone 'added.example in external' 2>&1 | sed 's/^/I:ns2 /'
-$DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.$n || ret=1
-grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
+_check_deleting_newly_added_zone() {
+	$DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.$n || return1
+	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || return 1
+	grep '^a.added.example' dig.out.ns2.$n > /dev/null && return 1
+	return 0
+}
+retry_quiet 10 _check_deleting_newly_added_zone || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -584,11 +628,14 @@ status=`expr $status + $ret`
 echo_i "adding new zone again to external view ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'added.example in external { type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
-$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
-grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
+_check_adding_new_zone_again_external() {
+	$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || return 1
+	$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || return 1
+	grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || return 1
+	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || return 1
+}
+retry_quiet 10 _check_adding_new_zone_again_external || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ../common/controls.conf.in ns2/controls.conf
 copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf
@@ -12,6 +12,5 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -1041,7 +1041,7 @@ check_if_nsec3param_exists() {
 	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
 	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
 }
-retry_quiet 20 check_if_nsec3param_exists || ret=1
+retry_quiet 50 check_if_nsec3param_exists || ret=1
 $DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
 # Check jitter distribution.
 checkjitter dig.out.ns3.2.test$n || ret=1
@@ -12,7 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,6 +12,5 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -10,8 +10,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cp -f ns1/dynamic.db.in ns1/dynamic.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -24,3 +24,4 @@ rm -f ns[123]/catalog[1234].example.db
 rm -rf ns2/zonedir
 rm -f ns*/*.nzd ns*/*.nzd-lock
 rm -f ns*/managed-keys.bind*
+rm -f wait_for_message.*
@@ -24,11 +24,12 @@ rndccmd() (
 )

 _wait_for_message() (
-	nextpartpeek "$1" | grep -F "$2" >/dev/null
+	nextpartpeek "$1" > wait_for_message.$n
+	grep -F "$2" wait_for_message.$n >/dev/null
 )

 wait_for_message() (
-	retry_quiet 10 _wait_for_message "$@"
+	retry_quiet 20 _wait_for_message "$@"
 )

 _wait_for_rcode() (
@@ -14,8 +14,6 @@ set -eu
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 touch empty

 Z=cds.test
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. "$SYSTEMTESTTOP/conf.sh"
-
-$SHELL clean.sh
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-$SHELL clean.sh
@@ -10,8 +10,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 ln -s $CHECKZONE named-compilezone

 ./named-compilezone -D -F raw -o good1.db.raw example \
@@ -1,53 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after a specified system test.
-#
-
-SYSTEMTESTTOP="$(cd -P -- "$(dirname -- "$0")" && pwd -P)"
-. $SYSTEMTESTTOP/conf.sh
-
-export SYSTEMTESTTOP
-
-# See if the "-r" flag is present.  This will usually be set when all the tests
-# are run (e.g. from "runall.sh") and tells the script not to delete the
-# test.output file created by run.sh.  This is because the script running all
-# the tests will call "testsummary.sh", which will concatenate all test output
-# files into a single systests.output.
-
-runall=0
-
-while getopts "r" flag; do
-    case $flag in
-	r) runall=1 ;;
-    esac
-done
-shift `expr $OPTIND - 1`
-
-if [ $# -eq 0 ]; then
-    echo "usage: $0 [-r] test-directory" >&2
-    exit 1
-fi
-
-systest=$1
-shift
-
-if [ $runall -eq 0 ]; then
-    rm -f $systest/test.output
-fi
-
-if [ -f $systest/clean.sh ]; then
-    ( cd $systest && $SHELL clean.sh "$@" )
-else
-    echo "Test directory $systest does not exist" >&2
-    exit 1
-fi
@@ -30,6 +30,6 @@ rm -f $SYSTEMTESTTOP/random.data
 for d in $SUBDIRS
 do
   test ! -f $d/clean.sh || ( cd $d && $SHELL clean.sh )
-   test -f $d/test.output && rm $d/test.output
+   rm -f test.output.$d
   test -d $d && find $d -type d -exec rmdir '{}' \; 2> /dev/null
 done
@@ -12,7 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
@@ -1,13 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. "$SYSTEMTESTTOP/conf.sh"
-
-$SHELL clean.sh
@@ -14,7 +14,6 @@

 set -e

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 $DDNSCONFGEN -q -z example.nil > ns1/ddns.key

 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

@@ -12,7 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,7 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,6 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cd ns1 && $SHELL sign.sh
@@ -12,6 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cd ns1 && $SHELL sign.sh
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh 
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -155,12 +155,15 @@ status=`expr $status + $ret`
 echo_i "checking that priming queries are not forwarded"
 ret=0
 $DIG $DIGOPTS +noadd +noauth txt.example1. txt @10.53.0.7 > dig.out.f7 || ret=1
-sent=`tr -d '\r' < ns7/named.run | sed -n '/sending packet to 10.53.0.1/,/^$/p' | grep ";.*IN.*NS" | wc -l`
-[ $sent -eq 1 ] || ret=1
-sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run | wc -l`
-[ $sent -eq 0 ] || ret=1
-sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns1/named.run | wc -l`
-[ $sent -eq 1 ] || ret=1
+check_priming_queries () {
+	sent=`tr -d '\r' < ns7/named.run | sed -n '/sending packet to 10.53.0.1/,/^$/p' | grep ";.*IN.*NS" | wc -l`
+	[ $sent -eq 1 ] || return 1
+	sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run | wc -l`
+	[ $sent -eq 0 ] || return 1
+	sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns1/named.run | wc -l`
+	[ $sent -eq 1 ] || return 1
+}
+retry_quiet 20 check_priming_queries || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -10,8 +10,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cp ns1/root.db.in ns1/root.db

 touch ns2/trusted.conf
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cat <<EOF >ns1/named.conf
 options {
 	query-source address 10.53.0.1;
@@ -724,7 +724,7 @@ status=$((status+ret))
 #
 zone_properties "ns3" "rsasha1.kasp" "rsasha1" "1234" "3" "10.53.0.3"
 key_properties "KEY1" "ksk" "315360000" "5" "RSASHA1" "2048" "no" "yes"
-key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "1024" "yes" "no"
+key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "2048" "yes" "no"
 key_properties "KEY3" "zsk" "31536000" "5" "RSASHA1" "2000" "yes" "no"
 # The first keys are immediately published and activated.
 # Because lifetime > 0, retired timing is also set.
@@ -997,7 +997,7 @@ check_subdomain
 #
 zone_properties "ns3" "inherit.kasp" "rsasha1" "1234" "3" "10.53.0.3"
 key_properties "KEY1" "ksk" "315360000" "5" "RSASHA1" "2048" "no" "yes"
-key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "1024" "yes" "no"
+key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "2048" "yes" "no"
 key_properties "KEY3" "zsk" "31536000" "5" "RSASHA1" "2000" "yes" "no"
 # The first keys are immediately published and activated.
 # Because lifetime > 0, retired timing is also set.
@@ -1107,7 +1107,7 @@ status=$((status+ret))
 #
 zone_properties "ns3" "rsasha1-nsec3.kasp" "rsasha1-nsec3" "1234" "3" "10.53.0.3"
 key_properties "KEY1" "ksk" "315360000" "7" "NSEC3RSASHA1" "2048" "no" "yes"
-key_properties "KEY2" "zsk" "157680000" "7" "NSEC3RSASHA1" "1024" "yes" "no"
+key_properties "KEY2" "zsk" "157680000" "7" "NSEC3RSASHA1" "2048" "yes" "no"
 key_properties "KEY3" "zsk" "31536000" "7" "NSEC3RSASHA1" "2000" "yes" "no"
 # key_timings and key_states same as above.
 check_keys
@@ -1120,7 +1120,7 @@ dnssec_verify
 #
 zone_properties "ns3" "rsasha256.kasp" "rsasha256" "1234" "3" "10.53.0.3"
 key_properties "KEY1" "ksk" "315360000" "8" "RSASHA256" "2048" "no" "yes"
-key_properties "KEY2" "zsk" "157680000" "8" "RSASHA256" "1024" "yes" "no"
+key_properties "KEY2" "zsk" "157680000" "8" "RSASHA256" "2048" "yes" "no"
 key_properties "KEY3" "zsk" "31536000" "8" "RSASHA256" "2000" "yes" "no"
 # key_timings and key_states same as above.
 check_keys
@@ -1133,7 +1133,7 @@ dnssec_verify
 #
 zone_properties "ns3" "rsasha512.kasp" "rsasha512" "1234" "3" "10.53.0.3"
 key_properties "KEY1" "ksk" "315360000" "10" "RSASHA512" "2048" "no" "yes"
-key_properties "KEY2" "zsk" "157680000" "10" "RSASHA512" "1024" "yes" "no"
+key_properties "KEY2" "zsk" "157680000" "10" "RSASHA512" "2048" "yes" "no"
 key_properties "KEY3" "zsk" "31536000" "10" "RSASHA512" "2000" "yes" "no"
 # key_timings and key_states same as above.
 check_keys
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -14,8 +14,6 @@ SYSTEMTESTTOP=..

 KEYGEN="$KEYGEN -q"

-$SHELL clean.sh
-
 # Test 1: KSK goes inactive before successor is active
 dir=01-ksk-inactive
 echo_i "set up $dir"
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 pzone=parent.nil
 czone=child.parent.nil

@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -10,6 +10,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,6 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -29,6 +29,6 @@ port=${STARTPORT:-5000}
 for directory in $PARALLELDIRS ; do
        echo
        echo "test-`echo $directory | tr _ -`: check_interfaces"
-        echo "	@${SHELL} ./run.sh -r -p $port $directory 2>&1 | tee $directory/test.output"
+        echo "	@${SHELL} ./run.sh -p $port $directory 2>&1 | tee test.output.$directory"
        port=`expr $port + 100`
 done
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 infile=ns1/example.db.in

 /bin/echo -n ${HSMPIN:-1234}> pin
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
@@ -12,6 +12,5 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cp ns4/tld1.db ns4/tld.db
 cp ns6/to-be-removed.tld.db.in ns6/to-be-removed.tld.db
 cp ns7/server.db.in ns7/server.db
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 $SHELL ../genzone.sh 2 >ns2/nil.db
 $SHELL ../genzone.sh 2 >ns2/other.db
 $SHELL ../genzone.sh 2 >ns2/static.db
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. "$SYSTEMTESTTOP/conf.sh"
-
-$SHELL clean.sh
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -37,13 +37,12 @@ while getopts "knp:r-:" flag; do
 	k) stopservers=false ;;
 	n) clean=false ;;
 	p) baseport=$OPTARG ;;
-	r) runall="-r" ;;
    esac
 done
 shift `expr $OPTIND - 1`

 if [ $# -eq 0 ]; then
-    echofail "Usage: $0 [-k] [-n] [-p <PORT>] [-r] test-directory [test-options]" >&2;
+    echofail "Usage: $0 [-k] [-n] [-p <PORT>] test-directory [test-options]" >&2;
    exit 1
 fi

@@ -155,6 +154,12 @@ else
    exit 0
 fi

+# Clean up files left from any potential previous runs
+if test -f $systest/clean.sh
+then
+   ( cd $systest && $SHELL clean.sh "$@" )
+fi
+
 # Set up any dynamically generated test data
 if test -f $systest/setup.sh
 then
@@ -219,7 +224,7 @@ else
        echopass "R:$systest:PASS"
        if $clean
        then
-            $SHELL clean.sh $runall $systest "$@"
+            ( cd $systest && $SHELL clean.sh "$@" )
            if test -d ../../../.git
            then
                git status -su --ignored $systest 2>/dev/null | \
@@ -80,7 +80,7 @@ if [ "$NOPARALLEL" = "" ]; then
        # of parallel execution of system tests, and use that.
        $SHELL parallel.sh > parallel.mk
        make -f parallel.mk -j $numproc check
-        $SHELL ./runsequential.sh -r
+        $SHELL ./runsequential.sh
        $SHELL ./testsummary.sh || status=1
    fi
 else
@@ -21,5 +21,5 @@ SYSTEMTESTTOP=.

 for d in $SEQUENTIALDIRS
 do
-    $SHELL run.sh "${@}" $d 2>&1 | tee $d/test.output
+    $SHELL run.sh "${@}" $d 2>&1 | tee test.output.$d
 done
@@ -14,8 +14,6 @@

 set -e

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
@@ -1,15 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-$SHELL clean.sh
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,5 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in tmp
 sed 's/SERVER_CONFIG_PLACEHOLDER/server-names { "ns.example.net"; };/' tmp > ns2/named.conf
@@ -12,7 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 # shellcheck source=conf.sh
 . "$SYSTEMTESTTOP/conf.sh"

-$SHELL clean.sh
-
 copy_setports ns2/named.conf.in ns2/named.conf

 (
@@ -12,8 +12,6 @@
 # shellcheck source=conf.sh
 . "$SYSTEMTESTTOP/conf.sh"

-$SHELL clean.sh
-
 #
 # Set up test data for zone transfer quota tests.
 #
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -14,8 +14,6 @@

 set -e

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# Creates the system tests output file from the various test.output files.  It
+# Creates the system tests output file from the various test.output.* files.  It
 # then searches that file and prints the number of tests passed, failed, not
 # run.  It also checks whether the IP addresses 10.53.0.[1-8] were set up and,
 # if not, prints a warning.
@@ -17,7 +17,7 @@
 # Usage:
 #    testsummary.sh [-n]
 #
-# -n	Do NOT delete the individual test.output files after concatenating
+# -n	Do NOT delete the individual test.output.* files after concatenating
 #	them into systests.output.
 #
 # Status return:
@@ -35,13 +35,13 @@ while getopts "n" flag; do
    esac
 done

-if [ `ls */test.output 2> /dev/null | wc -l` -eq 0 ]; then
-    echowarn "I:No 'test.output' files were found."
+if [ `ls test.output.* 2> /dev/null | wc -l` -eq 0 ]; then
+    echowarn "I:No 'test.output.*' files were found."
    echowarn "I:Printing summary from pre-existing 'systests.output'."
 else
-    cat */test.output > systests.output
+    cat test.output.* > systests.output
    if [ $keepfile -eq 0 ]; then
-        rm -f */test.output
+        rm -f test.output.*
    fi
 fi

@@ -56,4 +56,11 @@ if [ -n "${FAILED_TESTS}" ]; then
 	status=1
 fi

+RESULTS_FOUND=`grep -c 'R:[a-z0-9_-][a-z0-9_-]*:[A-Z][A-Z]*' systests.output`
+TESTS_RUN=`echo "${SUBDIRS}" | wc -w`
+if [ "${RESULTS_FOUND}" -ne "${TESTS_RUN}" ]; then
+	echofail "I:Found ${RESULTS_FOUND} test results, but ${TESTS_RUN} tests were run"
+	status=1
+fi
+
 exit $status
@@ -12,6 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cd ns1 && $SHELL setup.sh
@@ -10,8 +10,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh 
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cp -f ns1/example1.db ns1/example.db
 cp -f ns3/nomaster.db ns3/nomaster1.db

@@ -12,6 +12,4 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh 
-
 (cd zones && $SHELL genzones.sh)
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 cp -f ns2/example1.db ns2/example.db

 copy_setports ns1/named.conf.in ns1/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 $SHELL ../genzone.sh 1 6 7 >ns1/slave.db
 $SHELL ../genzone.sh 1 6 7 >ns1/edns-expire.db
 $SHELL ../genzone.sh 2 3 >ns2/example.db
@@ -16,8 +16,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 $PERL setup.pl

 cp -f ns1/changing1.db ns1/changing.db
@@ -10,8 +10,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -0,0 +1,26 @@
+dnssec-policy "default" {
+
+	// Keys
+	keys {
+		csk key-directory lifetime 0 algorithm 13;
+	};
+
+	// Key timings
+	dnskey-ttl 3600;
+	publish-safety 1h;
+	retire-safety 1h;
+
+	// Signature timings
+	signatures-refresh 5d;
+	signatures-validity 14d;
+	signatures-validity-dnskey 14d;
+	
+	// Zone parameters
+	zone-max-ttl 86400;
+	zone-propagation-delay 300;
+
+	// Parent parameters
+	parent-ds-ttl 86400;
+	parent-registration-delay 24h;
+	parent-propagation-delay 1h;
+};
@@ -4467,9 +4467,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 		    The number of seconds to wait between attempts to
 		    reopen a closed output stream. The minimum is 1 second,
 		    the maximum is 600 seconds (10 minutes), and the default
-		    is 5 seconds.
-		    For convenience, TTL-style time unit suffixes may be
-		    used to specify the value.
+		    is 5 seconds.  For convenience, TTL-style time unit
+		    suffixes may be used to specify the value.  It also
+		    accepts ISO 8601 duration formats.
 		  </simpara>
 		</listitem>
 	      </itemizedlist>
@@ -5271,8 +5271,11 @@ options {
 		<para>
 		  For convenience, TTL-style time unit suffixes can be
 		  used to specify the NTA lifetime in seconds, minutes
-		  or hours.  <option>nta-lifetime</option> defaults to
-		  one hour.  It cannot exceed one week.
+		  or hours.  It also accepts ISO 8601 duration formats.
+		</para>
+		<para>
+		 <option>nta-lifetime</option> defaults to one hour.  It
+		 cannot exceed one week.
 		</para>
 	    </listitem>
 	  </varlistentry>
@@ -5305,9 +5308,13 @@ options {
 		<para>
 		  For convenience, TTL-style time unit suffixes can be
 		  used to specify the NTA recheck interval in seconds,
-		  minutes or hours.  The default is five minutes.  It
-		  cannot be longer than <option>nta-lifetime</option>
-		  (which cannot be longer than a week).
+		  minutes or hours.  It also accepts ISO 8601 duration
+		  formats.
+		</para>
+		<para>
+		  The default is five minutes.  It cannot be longer than
+		  <option>nta-lifetime</option> (which cannot be longer
+		  than a week).
 		</para>
 	    </listitem>
 	  </varlistentry>
@@ -5318,7 +5325,10 @@ options {
 	      <para>
 		Specifies a maximum permissible TTL value in seconds.
 		For convenience, TTL-style time unit suffixes may be
-		used to specify the maximum value.
+		used to specify the maximum value. It also
+                accepts ISO 8601 duration formats.
+	      </para>
+	      <para>
 		When loading a zone file using a
 		<option>masterfile-format</option> of
 		<constant>text</constant> or <constant>raw</constant>,
@@ -8463,7 +8473,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  <command>listen-on</command> configuration), and
 		  will stop listening on interfaces that have gone away.
 		  For convenience, TTL-style time unit suffixes may be
-		  used to specify the value.
+		  used to specify the value.  It also accepts ISO 8601
+		  duration formats.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -8744,9 +8755,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  stores negative answers. <command>min-ncache-ttl</command> is
 		  used to set a minimum retention time for these answers in the
 		  server in seconds.  For convenience, TTL-style time unit
-		  suffixes may be used to specify the value.  The default
-		  <command>min-ncache-ttl</command> is <literal>0</literal>
-		  seconds.  <command>min-ncache-ttl</command> cannot exceed 90
+		  suffixes may be used to specify the value.  It also
+                  accepts ISO 8601 duration formats.
+		</para>
+		<para>
+		  The default <command>min-ncache-ttl</command> is
+		  <literal>0</literal> seconds.
+		  <command>min-ncache-ttl</command> cannot exceed 90
 		  seconds and will be truncated to 90 seconds if set to a
 		  greater value.
 		</para>
@@ -8758,10 +8773,14 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      <listitem>
 		<para>
 		  Sets the minimum time for which the server will cache ordinary
-		  (positive) answers in seconds. For convenience, TTL-style time
-		  unit suffixes may be used to specify the value. The default
-		  <command>min-cache-ttl</command> is <literal>0</literal>
-		  seconds. <command>min-cache-ttl</command> cannot exceed 90
+		  (positive) answers in seconds.  For convenience, TTL-style
+		  time unit suffixes may be used to specify the value.  It also
+                  accepts ISO 8601 duration formats.
+		</para>
+		<para>
+		  The default <command>min-cache-ttl</command> is
+		  <literal>0</literal> seconds.
+		  <command>min-cache-ttl</command> cannot exceed 90
 		  seconds and will be truncated to 90 seconds if set to a
 		  greater value.
 		</para>
@@ -8773,15 +8792,19 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      <listitem>
 		<para>
 		  To reduce network traffic and increase performance,
-		  the server stores negative answers. <command>max-ncache-ttl</command> is
+		  the server stores negative answers.
+		  <command>max-ncache-ttl</command> is
 		  used to set a maximum retention time for these answers in
-		  the server in seconds.
-		  For convenience, TTL-style time unit suffixes may be
-		  used to specify the value.  The default
-		  <command>max-ncache-ttl</command> is <literal>10800</literal> seconds (3 hours).
-		  <command>max-ncache-ttl</command> cannot exceed
-		  7 days and will
-		  be silently truncated to 7 days if set to a greater value.
+		  the server in seconds.  For convenience, TTL-style time unit
+		  suffixes may be used to specify the value.  It also accepts
+		  ISO 8601 duration formats.
+		</para>
+		<para>
+		  The default <command>max-ncache-ttl</command> is
+		  <literal>10800</literal> seconds (3 hours).
+		  <command>max-ncache-ttl</command> cannot exceed 7 days and
+		  will be silently truncated to 7 days if set to a greater
+		  value.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -8793,7 +8816,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  Sets the maximum time for which the server will
 		  cache ordinary (positive) answers in seconds.
 		  For convenience, TTL-style time unit suffixes may be
-		  used to specify the value.
+		  used to specify the value.  It also accepts ISO 8601
+		  duration formats.
+		</para>
+		<para>
 		  The default is 604800 (one week).
 		  A value of zero may cause all queries to return
 		  SERVFAIL, because of lost caches of intermediate
@@ -10099,7 +10125,9 @@ deny-answer-aliases { "example.net"; };
 	    The <command>max-policy-ttl</command> clause changes the
 	    maximum seconds from its default of 5.
 	    For convenience, TTL-style time unit suffixes may be
-	    used to specify the value.
+	    used to specify the value.  It also accepts ISO 8601 duration
+	    formats.
+
 	  </para>

 	  <para>
@@ -10195,7 +10223,8 @@ example.com                 CNAME   rpz-tcp-only.
 	    recent update, then the changes will not be carried out until this
 	    interval has elapsed.  The default is <literal>60</literal> seconds.
 	    For convenience, TTL-style time unit suffixes may be
-	    used to specify the value.
+	    used to specify the value.  It also accepts ISO 8601 duration
+	    formats.
 	  </para>
 	</section>

@@ -11117,8 +11146,8 @@ example.com                 CNAME   rpz-tcp-only.
 		<para>
 		  A margin that is added to the publish interval in key
 		  timing equations to give some extra time to cover
-		  unforeseen events.  Default is <constant>PT5M</constant>
-		  (5 minutes).
+		  unforeseen events.  Default is <constant>PT1H</constant>
+		  (1 hour).
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -11129,8 +11158,8 @@ example.com                 CNAME   rpz-tcp-only.
 		<para>
 		  A margin that is added to the retire interval in key
 		  timing equations to give some extra time to cover
-		  unforeseen events.  Default is <constant>PT5M</constant>
-		  (5 minutes).
+		  unforeseen events.  Default is <constant>PT1H</constant>
+		  (1 hour).
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -11222,7 +11251,7 @@ example.com                 CNAME   rpz-tcp-only.
 	      <listitem>
 		<para>
 		  The TTL of the DS RRset that the parent uses.  Default is
-		  <constant>PT1H</constant> (1 hour).
+		  <constant>P1D</constant> (1 day).
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -12131,9 +12160,13 @@ view "external" {
 		<term><command>dnssec-policy</command></term>
 		<listitem>
 		  <para>
-		    The key and signing policy for this zone.  Set to
-		    <userinput>"default"</userinput> if you want to make use
-		    of the default policy.
+		    The key and signing policy for this zone.  This is a string
+		    referring to a <command>dnssec-policy</command> statement.
+		    There are two built-in policies:
+		    <userinput>"default"</userinput> allows you to use the
+		    default policy, and <userinput>"none"</userinput> means
+		    not to use any DNSSEC policy, keeping the zone unsigned.
+		    The default is <userinput>"none"</userinput>.
 		  </para>
 		</listitem>
 	      </varlistentry>
@@ -13,8 +13,8 @@

 <programlisting>
 <command>dnssec-policy</command> <replaceable>string</replaceable> {
-    <command>dnskey-ttl</command> <replaceable>ttlval</replaceable>;
-    <command>keys</command> { ( csk | ksk | zsk ) key-directory <replaceable>duration</replaceable> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
+    <command>dnskey-ttl</command> <replaceable>duration</replaceable>;
+    <command>keys</command> { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
    <command>parent-ds-ttl</command> <replaceable>duration</replaceable>;
    <command>parent-propagation-delay</command> <replaceable>duration</replaceable>;
    <command>parent-registration-delay</command> <replaceable>duration</replaceable>;
@@ -128,7 +128,7 @@ dns_acl_isanyornone(dns_acl_t *acl, bool pos)
 	    acl->iptable->radix->head->prefix == NULL)
 		return (false);

-	if (acl->length != 0 || acl->node_count != 1)
+	if (acl->length != 0 || dns_acl_node_count(acl) != 1)
 		return (false);

 	if (acl->iptable->radix->head->prefix->bitlen == 0 &&
@@ -299,7 +299,7 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos)

 		/* Adjust node numbering. */
 		dest->elements[nelem + i].node_num =
-			source->elements[i].node_num + dest->node_count;
+			source->elements[i].node_num + dns_acl_node_count(dest);

 		/* Duplicate nested acl. */
 		if (source->elements[i].type == dns_aclelementtype_nestedacl &&
@@ -335,12 +335,12 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos)
 	 * Merge the iptables.  Make sure the destination ACL's
 	 * node_count value is set correctly afterward.
 	 */
-	nodes = max_node + dest->node_count;
+	nodes = max_node + dns_acl_node_count(dest);
 	result = dns_iptable_merge(dest->iptable, source->iptable, pos);
 	if (result != ISC_R_SUCCESS)
 		return (result);
-	if (nodes > dest->node_count)
-		dest->node_count = nodes;
+	if (nodes > dns_acl_node_count(dest))
+		dns_acl_node_count(dest) = nodes;

 	return (ISC_R_SUCCESS);
 }
@@ -71,18 +71,19 @@ struct dns_aclelement {
 	int			node_num;
 };

+#define dns_acl_node_count(acl) acl->iptable->radix->num_added_node
+
 struct dns_acl {
 	unsigned int		magic;
 	isc_mem_t		*mctx;
 	isc_refcount_t		refcount;
 	dns_iptable_t		*iptable;
-#define node_count		iptable->radix->num_added_node
 	dns_aclelement_t	*elements;
-	bool 		has_negatives;
-	unsigned int 		alloc;		/*%< Elements allocated */
-	unsigned int 		length;		/*%< Elements initialized */
-	char 			*name;		/*%< Temporary use only */
-	ISC_LINK(dns_acl_t) 	nextincache;	/*%< Ditto */
+	bool			has_negatives;
+	unsigned int		alloc;		/*%< Elements allocated */
+	unsigned int		length;		/*%< Elements initialized */
+	char			*name;		/*%< Temporary use only */
+	ISC_LINK(dns_acl_t)	nextincache;	/*%< Ditto */
 };

 struct dns_aclenv {
@@ -99,9 +99,9 @@ struct dns_kasp {
 #define DNS_KASP_SIG_VALIDITY		(86400*14)
 #define DNS_KASP_SIG_VALIDITY_DNSKEY	(86400*14)
 #define DNS_KASP_KEY_TTL		(3600)
-#define DNS_KASP_DS_TTL			(3600)
-#define DNS_KASP_PUBLISH_SAFETY		(300)
-#define DNS_KASP_RETIRE_SAFETY		(300)
+#define DNS_KASP_DS_TTL			(86400)
+#define DNS_KASP_PUBLISH_SAFETY		(3600)
+#define DNS_KASP_RETIRE_SAFETY		(3600)
 #define DNS_KASP_ZONE_MAXTTL		(86400)
 #define DNS_KASP_ZONE_PROPDELAY		(300)
 #define DNS_KASP_PARENT_PROPDELAY	(3600)
@@ -395,10 +395,8 @@ dns_kasp_key_size(dns_kasp_key_t *key) {
 			if (size > 4096) {
 				size = 4096;
 			}
-		} else if (key->role & DNS_KASP_KEY_ROLE_KSK) {
-			size = 2048;
 		} else {
-			size = 1024;
+			size = 2048;
 		}
 		break;
 	case DNS_KEYALG_ECDSA256:
@@ -103,8 +103,8 @@ dns_acl_isinsecure_test(void **state) {
 	de->type = dns_aclelementtype_geoip;
 	de->negative = false;
 	assert_true(geoip->length < geoip->alloc);
-	geoip->node_count++;
-	de->node_num = geoip->node_count;
+	dns_acl_node_count(geoip)++;
+	de->node_num = dns_acl_node_count(geoip);
 	geoip->length++;

 	result = dns_acl_create(dt_mctx, 1, &notgeoip);
@@ -921,8 +921,8 @@ nested_acl:
 			dns_acl_detach(&de->nestedacl);
 		}

-		dacl->node_count++;
-		de->node_num = dacl->node_count;
+		dns_acl_node_count(dacl)++;
+		de->node_num = dns_acl_node_count(dacl);

 		dacl->length++;
 		de++;
@@ -421,7 +421,6 @@
 ./bin/tests/system/checkconf/dnssec.2		X	2011,2016,2018,2019
 ./bin/tests/system/checkconf/dnssec.3		X	2011,2016,2017,2018,2019
 ./bin/tests/system/checkconf/good.zonelist	X	2016,2017,2018,2019
-./bin/tests/system/checkconf/setup.sh		SH	2019
 ./bin/tests/system/checkconf/tests.sh		SH	2005,2007,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./bin/tests/system/checkds/clean.sh		SH	2012,2013,2014,2016,2017,2018,2019
 ./bin/tests/system/checkds/dig.bat		BAT	2016,2018,2019
@@ -435,7 +434,6 @@
 ./bin/tests/system/checkds/ok.example.ds.db	X	2012,2018,2019
 ./bin/tests/system/checkds/prep.example.db	X	2017,2018,2019
 ./bin/tests/system/checkds/prep.example.ds.db	X	2017,2018,2019
-./bin/tests/system/checkds/setup.sh		SH	2012,2013,2014,2016,2018,2019
 ./bin/tests/system/checkds/tests.sh		SH	2012,2013,2014,2016,2017,2018,2019
 ./bin/tests/system/checkds/wrong.example.dnskey.db	X	2012,2018,2019
 ./bin/tests/system/checkds/wrong.example.ds.db	X	2012,2018,2019
@@ -447,7 +445,6 @@
 ./bin/tests/system/checkzone/tests.sh		SH	2011,2012,2013,2014,2015,2016,2017,2018,2019
 ./bin/tests/system/checkzone/zones/.gitattributes	X	2015,2018,2019
 ./bin/tests/system/checkzone/zones/bad-badclass.raw	X	2015,2018,2019
-./bin/tests/system/clean.sh			SH	2015,2016,2018,2019
 ./bin/tests/system/cleanall.sh			SH	2000,2001,2004,2007,2012,2014,2015,2016,2017,2018,2019
 ./bin/tests/system/cleanpkcs11.sh		SH	2010,2012,2014,2016,2018,2019
 ./bin/tests/system/common/rndc.key		X	2011,2013,2016,2018,2019
@@ -492,7 +489,6 @@
 ./bin/tests/system/delzone/setup.sh		SH	2016,2018,2019
 ./bin/tests/system/delzone/tests.sh		SH	2016,2018,2019
 ./bin/tests/system/dialup/clean.sh		SH	2019
-./bin/tests/system/dialup/setup.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019
 ./bin/tests/system/dialup/tests.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019
 ./bin/tests/system/digcomp.pl			PERL	2000,2001,2004,2007,2012,2013,2016,2018,2019
 ./bin/tests/system/digdelv/ans4/startme		X	2017,2018,2019
@@ -956,7 +952,6 @@
 ./bin/tests/system/rrchecker/classlist.good	X	2013,2018,2019
 ./bin/tests/system/rrchecker/clean.sh		SH	2013,2014,2016,2017,2018,2019
 ./bin/tests/system/rrchecker/privatelist.good	X	2013,2018,2019
-./bin/tests/system/rrchecker/setup.sh		SH	2019
 ./bin/tests/system/rrchecker/tests.sh		SH	2013,2014,2015,2016,2017,2018,2019
 ./bin/tests/system/rrchecker/typelist.good	X	2013,2014,2015,2016,2017,2018,2019
 ./bin/tests/system/rrl/clean.sh			SH	2012,2013,2014,2016,2018,2019
@@ -1027,7 +1022,6 @@
 ./bin/tests/system/sfcache/setup.sh		SH	2014,2016,2017,2018,2019
 ./bin/tests/system/sfcache/tests.sh		SH	2014,2016,2017,2018,2019
 ./bin/tests/system/smartsign/clean.sh		SH	2010,2012,2014,2016,2018,2019
-./bin/tests/system/smartsign/setup.sh		SH	2010,2012,2014,2016,2017,2018,2019
 ./bin/tests/system/smartsign/tests.sh		SH	2010,2011,2012,2014,2016,2017,2018,2019
 ./bin/tests/system/sortlist/clean.sh		SH	2000,2001,2004,2007,2009,2012,2014,2015,2016,2018,2019
 ./bin/tests/system/sortlist/setup.sh		SH	2018,2019
Author	SHA1	Message	Date
Witold Kręcicki	d8acfe3277	tests: addzone: retry when checking for things, to allow for timing problems	2019-12-09 09:39:38 +01:00
Witold Kręcicki	d7d17d4ad8	test: autosign: wait a bit longer for the zone to be signed, it might take time on a loaded system	2019-12-09 09:39:38 +01:00
Witold Kręcicki	1b8ff5d92e	test: forward: retry checking logs for evidence of priming queries not being forwarded	2019-12-09 09:39:31 +01:00
Matthijs Mekking	edd6a084f0	Merge branch 'misc-fixes-kasp' into 'master' Miscellaneous fixes kasp See merge request isc-projects/bind9!2711	2019-12-09 08:22:56 +00:00
Matthijs Mekking	4b66c0ebf4	Change some dnssec-policy defaults Suggested by Tony Finch, these seem to be more reasonable defaults.	2019-12-09 07:25:20 +00:00
Matthijs Mekking	0f9d45a5b8	Default key size 2048 The default size for RSA keys is 2048 bits, for both ZSKs and KSKs.	2019-12-09 07:25:20 +00:00
Matthijs Mekking	a339a6df48	Update docs with durations, built-in dnssec-policy Clarify in the ARM that TTL-style options can also now take ISO 8601 durations. Mention the built-in dnssec policies "default" and "none". Mention that "none" is the default. Add a file documenting the default dnssec-policy configuration options. Fix dnssec-policy syntax in ARM (dnssec-policy.grammar.xml).	2019-12-09 07:25:20 +00:00
Ondřej Surý	6f096f5245	Merge branch 'ondrej/remove-too-generic-node_count-macro-from-dns_acl' into 'master' Change the (acl)->node_count macro to dns_acl_node_count(acl) macro to clean the global namespace See merge request isc-projects/bind9!2725	2019-12-09 06:49:00 +00:00
Ondřej Surý	8120088ec7	Change the (acl)->node_count macro to dns_acl_node_count(acl) macro to clean the global namespace	2019-12-06 15:47:39 +01:00
Mark Andrews	fe31fedc31	Merge branch '1401-intermittent-failures-in-the-catz-system-test' into 'master' Debug "Intermittent failures in the catz system test" See merge request isc-projects/bind9!2715	2019-12-06 14:16:03 +00:00
Mark Andrews	4dd9ec8919	Increase wait_for_message attempts to 20.	2019-12-06 13:40:46 +00:00
Mark Andrews	1334daaec0	save wait_for_message contents	2019-12-06 13:40:46 +00:00
Michał Kępień	dd6f9391c3	Merge branch '1452-system-test-framework-cleanup-tweaks' into 'master' System test framework: cleanup tweaks Closes #1452 See merge request isc-projects/bind9!2717	2019-12-06 13:32:07 +00:00
Michał Kępień	34fb70b17c	Merge branch '1452-detect-missing-system-test-results' into 'master' Detect missing system test results See merge request isc-projects/bind9!2708	2019-12-06 13:24:26 +00:00
Michał Kępień	d8905b7a9c	Automatically run clean.sh from run.sh The first step in all existing setup.sh scripts is to call clean.sh. To reduce code duplication and ensure all system tests added in the future behave consistently with existing ones, invoke clean.sh from run.sh before calling setup.sh.	2019-12-06 14:11:01 +01:00
Michał Kępień	3c3085be3c	Detect missing system test results At the end of each system test suite run, the system test framework collects all existing test.output files from system test subdirectories and produces bin/tests/system/systests.output from those files. However, it does not check whether a test.output file was found for every executed test. Thus, if the test.output file is accidentally deleted by the system test itself (e.g. due to an overly broad file removal wildcard present in clean.sh), its output will not be included in bin/tests/system/systests.output. Since the result of each system test suite run is determined by bin/tests/system/testsummary.sh, which only operates on the contents of bin/tests/system/systests.output, this can lead to test failures being ignored. Fix by ensuring the number of test results found in bin/tests/system/systests.output is equal to the number of tests run and triggering a system test suite failure in case of a discrepancy between these two values.	2019-12-06 14:11:01 +01:00
Michał Kępień	bf3eeac067	Remove bin/tests/system/clean.sh Since the role of the bin/tests/system/clean.sh script has now been reduced to calling a given system test's clean.sh script, remove the former altogether and replace its only use with a direct invocation of the latter.	2019-12-06 14:11:01 +01:00
Michał Kępień	b4d37878f6	Remove the -r switch from system test scripts Since files containing system test output are no longer stored in test subdirectories, bin/tests/system/clean.sh no longer needs to take care of removing the test.output file for a given test as testsummary.sh already takes care of that and even if a test suite terminates abnormally and another one is started, tee invoked without the -a command line switch overwrites the destination file if it exists, so leftover test.output.* files from previous test suite runs are not a concern. Remove the -r command line switch and the code associated with it from the relevant scripts.	2019-12-06 14:11:01 +01:00
Michał Kępień	b0916bba41	Store system test output in bin/tests/system/ Some clean.sh scripts contain overly broad file deletion wildcards which cause the test.output file (used by the system test framework for collecting output) in a given system test's directory to be erroneously removed immediately after the test is started (due to setup.sh scripts calling clean.sh at the beginning). This prevents the test's output from being placed in bin/tests/system/systests.output at the end of a test suite run and thus can lead to test failures being ignored. Fix by storing each test's output in a test.output.<test-name> file in bin/tests/system/, which prevents clean.sh scripts from removing it (as they should only ever affect files contained in a given system test's directory).	2019-12-06 14:11:01 +01:00
Matthijs Mekking	26ee43da1b	Merge branch '1460-duration-ttlval-print-bug' into 'master' Resolve "checkconf test failure on Solaris" Closes #1460 See merge request isc-projects/bind9!2718	2019-12-06 13:03:14 +00:00
Ondřej SurýandMatthijs Mekking	9dfa33050b	Add semantic patch to find void f() { ... return ((void)g())); ... } When a function returns void, it can be used as an argument to return in function returning also void, e.g.: void in(void) { return; } void out(void) { return (in()); } while this is legal, it should be rewritten as: void out(void) { in(); return; } The semantic patch just find the occurrences, and they need to be fixed by hand.	2019-12-06 13:42:18 +01:00
Matthijs Mekking	60fa5fc760	Fix duration printing on Solaris	2019-12-06 13:12:06 +01:00
Matthijs Mekking	8fd8404e16	Replace two leftover ttlval with duration Since the introduction of durations, all ttlval configuration types are replaced with durations. Duration is an ISO 8601 duration, a TTL-style value, or a number. These two references were missed and are now also replaced.	2019-12-06 12:28:40 +01:00