EXP: Always keep at least 600 handles

The isc_astack API is now completely unused, just remove it.

.gitlab-ci.yml

@@ -7,6 +7,9 @@ variables:
   CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
   CCACHE_DIR: "/ccache"
   SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+  OPENSSL_ENGINES: "/usr/lib/x86_64-linux-gnu/engines-1.1"
+  DEFAULT_OPENSSL_CONF: "/etc/ssl/openssl.cnf"
+  OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
 
   GIT_DEPTH: 1
   BUILD_PARALLEL_JOBS: 6
@@ -309,15 +312,10 @@ stages:
         sudo sh -x bin/tests/system/ifconfig.sh up;
       fi
 
-.setup_softhsm: &setup_softhsm
-    - export SLOT=$(sh -x bin/tests/prepare-softhsm2.sh)
-    - test -n "${SLOT}" && test "${SLOT}" -gt 0
-
 .system_test_common: &system_test_common
   <<: *default_triggering_rules
   stage: system
   before_script:
-    - *setup_softhsm
     - *retrieve_out_of_tree_workspace
     - *setup_interfaces
   script:
@@ -358,7 +356,6 @@ stages:
   <<: *default_triggering_rules
   stage: unit
   before_script:
-    - *setup_softhsm
     - *retrieve_out_of_tree_workspace
   script:
     - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
@@ -679,6 +676,7 @@ unit:gcc:buster:amd64:
       artifacts: true
 
 # Jobs for regular GCC builds on Debian 11 "bullseye" (amd64)
+# (The second unit test job also executes unstable unit tests.)
 
 gcc:bullseye:amd64:
   variables:
@@ -702,6 +700,20 @@ unit:gcc:bullseye:amd64:
     - job: gcc:bullseye:amd64
       artifacts: true
 
+unit:gcc:bullseye:unstable:amd64:
+  <<: *debian_bullseye_amd64_image
+  <<: *unit_test_job
+  variables:
+    CI_ENABLE_ALL_TESTS: 1
+  needs:
+    - job: gcc:bullseye:amd64
+      artifacts: true
+  only:
+    - api
+    - schedules
+    - triggers
+    - web
+
 # Jobs for cross-compiled GCC builds on Debian 11 "bullseye" (amd64) with
 # 32-bit libraries
 
@@ -930,13 +942,17 @@ unit:gcc:focal:amd64:
 gcc:asan:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -Wno-error=stringop-overread"
     LDFLAGS: "-fsanitize=address,undefined"
+    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
     EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
   <<: *fedora_35_amd64_image
   <<: *build_job
 
 system:gcc:asan:
+  variables:
+    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
+    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *fedora_35_amd64_image
   <<: *system_test_job
   needs:
@@ -980,12 +996,14 @@ gcc:tsan:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
     LDFLAGS: "-fsanitize=thread"
+    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
   <<: *fedora_35_amd64_image
   <<: *build_job
 
 system:gcc:tsan:
   variables:
+    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
     TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
   <<: *fedora_35_amd64_image
   <<: *system_test_tsan_job
@@ -1186,10 +1204,10 @@ release:
     )
   - test "$(md5sum cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat cov-analysis-linux64.md5)"
   - tar --extract --gzip --file=cov-analysis-linux64.tgz
-  - test -d cov-analysis-linux64-2020.09
+  - test -d cov-analysis-linux64-2021.12.1
 
 .coverity_build: &coverity_build
-  - cov-analysis-linux64-2020.09/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
+  - cov-analysis-linux64-2021.12.1/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
   - tar --create --gzip --file=cov-int.tar.gz cov-int/
   - curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
         --form token=$COVERITY_SCAN_TOKEN
@@ -1225,7 +1243,7 @@ coverity:
       - $COVERITY_SCAN_PROJECT_NAME
       - $COVERITY_SCAN_TOKEN
   cache:
-    key: cov-analysis-linux64-2020.09
+    key: cov-analysis-linux64-2021.12.1
     paths:
       - cov-analysis-linux64.md5
       - cov-analysis-linux64.tgz
@@ -1297,7 +1315,6 @@ respdiff-third-party:
   script:
     - *configure
     - *setup_interfaces
-    - *setup_softhsm
     - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - make DESTDIR="${INSTALL_PATH}" install
     - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git

CHANGES

@@ -1,3 +1,61 @@
+5814.	[bug]		The RecursClients statistics counter could underflow
+			in certain resolution scenarios. [GL #3147]
+
+5813.	[func]		The "keep-response-order" ACL has been declared
+			obsolete, and is now non-operational. [GL #3140]
+
+5812.	[func]		Drop the artificial limit on the number of queries
+			processed in a single TCP read callback. [GL #3141]
+
+5811.	[bug]		Reimplement the maximum and idle timeouts for outgoing
+			zone tranfers. [GL #1897]
+
+5810.	[func]		New option '-J' for dnssec-signzone and dnssec-verify
+			allows loading journal files. [GL #2486]
+
+5809.	[bug]		Reset client TCP connection when data received cannot
+			be parsed as a valid DNS request. [GL #3149]
+
+5808.	[bug]		Certain TCP failures were not caught and handled
+			correctly by the dispatch manager, causing
+			connections to time out rather than returning
+			SERVFAIL. [GL #3133]
+
+5807.	[bug]		Add a TCP "write" timer, and time out writing
+			connections after the "tcp-idle-timeout" period
+			has elapsed. [GL #3132]
+
+5806.	[bug]		An error in checking the "blackhole" ACL could cause
+			DNS requests sent by named to fail if the
+			destination address or prefix was specifically
+			excluded from the ACL. [GL #3157]
+
+5805.	[func]		The result of each resolver priming attempt is now
+			included in the "resolver priming query complete" log
+			message. [GL #3139]
+
+5804.	[func]		Add a debug log message when starting and ending
+			the task exclusive mode. [GL #3137]
+
+5803.	[func]		Use compile-time paths in the documentation.
+			[GL #2717]
+
+5802.	[test]		Add system test to test engine_pkcs11. [GL !5727]
+
+5801.	[bug]		Log "quota reached" message when hard quota
+			is reached when accepting a connection. [GL #3125]
+
+5800.	[func]		Add ECS support to the DLZ interface. [GL #3082]
+
+5799.	[bug]		Use L1 cache-line size detected at runtime. [GL #3108]
+
+5798.	[test]		Add system test to test dnssec-keyfromlabel. [GL #3092]
+
+5797.	[bug]		A failed view configuration during a named
+			reconfiguration procedure could cause inconsistencies
+			in BIND internal structures, causing a crash or other
+			unexpected errors. [GL #3060]
+
 5796.	[bug]		Ignore the invalid (<= 0) values returned
 			by the sysconf() check for the L1 cache line
 			size.  [GL #3108]

Makefile.docs

@@ -9,6 +9,16 @@ AM_V_SPHINX_0 = @echo "  SPHINX   $@";
 
 SPHINXBUILDDIR = $(builddir)/_build
 
+LF = \n
+RNDC_CONF = .. |rndc_conf| replace:: ``$(sysconfdir)/rndc.conf``
+RNDC_KEY = .. |rndc_key| replace:: ``$(sysconfdir)/rndc.key``
+NAMED_CONF = .. |named_conf| replace:: ``$(sysconfdir)/named.conf``
+BIND_KEYS = .. |bind_keys| replace:: ``$(sysconfdir)/bind.keys``
+NAMED_PID = .. |named_pid| replace:: ``$(runstatedir)/named.pid``
+SESSION_KEY = .. |session_key| replace:: ``$(runstatedir)/session.key``
+
+export RST_EPILOG = $(RNDC_CONF)$(LF)$(RNDC_KEY)$(LF)$(NAMED_CONF)$(LF)$(BIND_KEYS)$(LF)$(NAMED_PID)$(LF)$(SESSION_KEY)
+
 common_SPHINXOPTS =			\
 	-W				\
 	-c $(srcdir)			\
@@ -17,18 +27,30 @@ common_SPHINXOPTS =			\
 
 # The "today" variable set below is not directly used in the ARM, but its value
 # is implicitly inserted on the title page of the PDF file produced by Sphinx.
-ALLSPHINXOPTS =				\
-	$(common_SPHINXOPTS)		\
-	-D today="$(RELEASE_DATE)"	\
-	$(SPHINXOPTS)			\
+ALLSPHINXOPTS =					\
+	$(common_SPHINXOPTS)			\
+	-D today="$(RELEASE_DATE)"		\
+	-D rst_epilog="$$(printf "$${RST_EPILOG}")"	\
+	$(SPHINXOPTS)				\
 	$(srcdir)
 
-man_SPHINXOPTS =			\
-	$(common_SPHINXOPTS)		\
-	-D version="@""PACKAGE_VERSION@"\
-	-D today="@""RELEASE_DATE@"	\
-	-D release="@""PACKAGE_VERSION@"\
-	$(SPHINXOPTS)			\
+_ = @
+man_RNDC_CONF = .. |rndc_conf| replace:: ``$(_)sysconfdir$(_)/rndc.conf``
+man_RNDC_KEY = .. |rndc_key| replace:: ``$(_)sysconfdir$(_)/rndc.key``
+man_NAMED_CONF = .. |named_conf| replace:: ``$(_)sysconfdir$(_)/named.conf``
+man_BIND_KEYS = .. |bind_keys| replace:: ``$(_)sysconfdir$(_)/bind.keys``
+man_NAMED_PID = .. |named_pid| replace:: ``$(_)runstatedir$(_)/named.pid``
+man_SESSION_KEY = .. |session_key| replace:: ``$(_)runstatedir$(_)/session.key``
+
+export man_RST_EPILOG = $(man_RNDC_CONF)$(LF)$(man_RNDC_KEY)$(LF)$(man_NAMED_CONF)$(LF)$(man_BIND_KEYS)$(LF)$(man_NAMED_PID)$(LF)$(man_SESSION_KEY)
+
+man_SPHINXOPTS =				\
+	$(common_SPHINXOPTS)			\
+	-D version="@""PACKAGE_VERSION@"	\
+	-D today="@""RELEASE_DATE@"		\
+	-D release="@""PACKAGE_VERSION@"	\
+	-D rst_epilog="$$(printf "$${man_RST_EPILOG}")"	\
+	$(SPHINXOPTS)				\
 	$(srcdir)
 
 AM_V_SED = $(AM_V_SED_@AM_V@)

PLATFORMS.md

@@ -1,119 +0,0 @@
-<!--
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0.  If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
--->
-## Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
-IPv6 support, and POSIX-compliant threads, plus the following mandatory
-libraries:
-
-- `libuv` for asynchronous I/O operations and event loops
-- `libssl` and `libcrypto` from OpenSSL for cryptography
-
-Use of the following libraries is optional:
-
-- `libjemalloc` for improved memory allocation performance
-- `libnghttp2` for DNS-over-HTTPS (DoH) support
-
-The following C11 features are used in BIND 9:
-
-* Atomic operations support, either in the form of C11 atomics or
-  `__atomic` builtin operations.
-
-* Thread Local Storage support, either in the form of C11
-  `_Thread_local`/`thread_local`, or the `__thread` GCC extension.
-
-The C11 variants are preferred.
-
-BIND 9.17 requires a fairly recent version of `libuv` (at least 1.x).  For
-some of the older systems listed below, you will have to install an updated
-`libuv` package from sources such as EPEL, PPA, or other native sources for
-updated packages. The other option is to build and install `libuv` from
-source.
-
-Certain optional BIND features have additional library dependencies.
-These include:
-
-* `libfstrm` and `libprotobuf-c` for DNSTAP
-* `libidn2` for display of internationalized domain names in `dig`
-* `libjson-c` for JSON statistics
-* `libmaxminddb` for geolocation
-* `libnghttp2` for DNS over HTTPS
-* `libxml2` for XML statistics
-* `libz` for compression of the HTTP statistics channel
-* `readline` for line editing in `nsupdate` and `nslookup`
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-### Regularly tested platforms
-
-As of Dec 2021, BIND 9.17 is fully supported and regularly tested on the
-following systems:
-
-* Debian 9, 10, 11
-* Ubuntu LTS 18.04, 20.04
-* Fedora 35
-* Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8
-* FreeBSD 12.3, 13.0
-* OpenBSD 7.0
-* Alpine Linux 3.15
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
-
-### Best effort
-
-The following are platforms on which BIND is known to build and run.
-ISC makes every effort to fix bugs on these platforms, but may be unable
-to do so quickly due to lack of hardware, less familiarity on the part
-of engineering staff, and other constraints. None of these are tested
-regularly by ISC.
-
-* macOS 10.12+
-* Solaris 11
-* NetBSD
-* Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 20.10+
-    * Gentoo
-    * Arch Linux
-* OpenWRT/LEDE 17.01+
-* Other CPU architectures (mips, mipsel, sparc, ...)
-
-### Community maintained
-
-These systems may not all have the required dependencies for building BIND
-easily available, although it will be possible in many cases to compile
-those directly from source. The community and interested parties may wish
-to help with maintenance, and we welcome patch contributions, although we
-cannot guarantee that we will accept them.  All contributions will be
-assessed against the risk of adverse effect on officially supported
-platforms.
-
-* Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
-    * CentOS 6
-    * Debian Jessie
-    * FreeBSD 10.x, 11.x
-
-## Unsupported platforms
-
-These are platforms on which BIND 9.17 is known *not* to build or run:
-
-* Platforms without at least OpenSSL 1.0.2
-* Windows
-* Solaris 10 and older
-* Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
-* Platforms that don't support atomic operations (via compiler or library)
-* Linux without NPTL (Native POSIX Thread Library)
-* Platforms on which `libuv` cannot be compiled

README.md

@@ -18,9 +18,6 @@ information regarding copyright ownership.
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
 1. [Building BIND](#build)
-1. [macOS](#macos)
-1. [Dependencies](#dependencies)
-1. [Compile-time options](#opts)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
 1. [Change log](#changes)
@@ -58,7 +55,9 @@ CHANGES file format.
 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
 
-For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
+For information about supported platforms, see the
+["Supported Platforms"](doc/arm/platforms.rst) section in the BIND 9
+Administrator Reference Manual.
 
 ### <a name="help"/> Reporting bugs and getting help
 
@@ -125,142 +124,9 @@ including your patch as an attachment, preferably generated by
 
 ### <a name="build"/> Building BIND 9
 
-At a minimum, BIND requires a Unix or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. BIND also requires the
-`libuv` asynchronous I/O library, the `nghttp2` HTTP/2 library, the
-`jemalloc` memory allocation library, and the OpenSSL cryptography
-library.  On Linux, BIND requires the `libcap` library to set process
-privileges, though this requirement can be overridden by disabling
-capability support at compile time. See [Compile-time options](#opts)
-below for details on other libraries that may be required to support
-optional features.
-
-Successful builds have been observed on many versions of Linux and Unix,
-including RHEL/CentOS/Oracle Linux, Fedora, Debian, Ubuntu, SLES, openSUSE,
-Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana,
-OmniOS CE, HP-UX, and OpenWRT.
-
-To build on a Unix or Linux system, use:
-
-		$ autoreconf -fi (if you are building in the git repository)
-		$ ./configure
-		$ make
-
-If you're using Emacs, you might find `make tags` helpful.
-
-Several environment variables, which can be set before running `configure`,
-affect compilation.  Significant ones are:
-
-|Variable|Description |
-|--------------------|-----------------------------------------------|
-|`CC`|The C compiler to use.  `configure` tries to figure out the right one for supported systems.|
-|`CFLAGS`|C compiler flags.  Defaults to include -g and/or -O2 as supported by the compiler.  Please include '-g' if you need to set `CFLAGS`. |
-|`LDFLAGS`|Linker flags. Defaults to empty string.|
-
-Additional environment variables affecting the build are listed at the
-end of the `configure` help text, which can be obtained by running the
-command:
-
-    $ ./configure --help
-
-#### <a name="macos"> macOS
-
-Building on macOS assumes that the "Command Tools for Xcode" are installed.
-These can be downloaded from
-[https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
-or, if you have Xcode already installed, you can run `xcode-select --install`.
-(Note that an Apple ID may be required to access the download page.)
-
-#### <a name="dependencies"> Dependencies
-
-To build BIND you need to have the following packages installed:
-
-    libuv
-    pkg-config / pkgconfig / pkgconf
-
-To build BIND from the git repository, you need the following tools
-installed:
-
-    autoconf (includes autoreconf)
-    automake
-    libtool
-
-#### <a name="opts"/> Compile-time options
-
-To see a full list of configuration options, run `configure --help`.
-
-For the server to support DNSSEC, you need to build it with crypto support.
-To use OpenSSL, you must have OpenSSL 1.0.2e or newer installed. If the
-OpenSSL library is installed in a nonstandard location, specify the prefix
-using `--with-openssl=<PREFIX>` on the configure command line. To use a
-PKCS#11 hardware service module for cryptographic operations, it will
-be necessary to compile and use engine_pkcs11 from the OpenSC project.
-
-To support DNS over HTTPS, the server must be linked with `libnghttp2`.
-
-To support the HTTP statistics channel, the server must be linked with at
-least one of the following libraries: `libxml2`
-[http://xmlsoft.org](http://xmlsoft.org) or `json-c`
-[https://github.com/json-c/json-c](https://github.com/json-c/json-c).
-If these are installed at a nonstandard location, then:
-
-* for `libxml2`, specify the prefix using `--with-libxml2=/prefix`.
-* for `json-c`, adjust `PKG_CONFIG_PATH`.
-
-To support compression on the HTTP statistics channel, the server must be
-linked against `libzlib`. If this is installed in a nonstandard location,
-specify the prefix using `--with-zlib=/prefix`.
-
-To support storing configuration data for runtime-added zones in an LMDB
-database, the server must be linked with `liblmdb`. If this is installed in a
-nonstandard location, specify the prefix using `with-lmdb=/prefix`.
-
-To support MaxMind GeoIP2 location-based ACLs, the server must be linked
-with `libmaxminddb`. This is turned on by default if the library is
-found; if the library is installed in a nonstandard location,
-specify the prefix using `--with-maxminddb=/prefix`. GeoIP2 support
-can be switched off with `--disable-geoip`.
-
-For DNSTAP packet logging, you must have installed `libfstrm`
-[https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
-and `libprotobuf-c`
-[https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
-and BIND must be configured with `--enable-dnstap`.
-
-Certain compiled-in constants and default settings can be decreased to
-values better suited to small machines, e.g. OpenWRT boxes, by specifying
-`--with-tuning=small` on the `configure` command line. This decreases
-memory usage by using smaller structures, but degrades performance.
-
-On Linux, process capabilities are managed in user space using
-the `libcap` library, which can be installed on most Linux systems via
-the `libcap-dev` or `libcap-devel` package. Process capability support can
-also be disabled by configuring with `--disable-linux-caps`.
-
-On some platforms it is necessary to explicitly request large file support
-to handle files bigger than 2GB.  This can be done by using
-`--enable-largefile` on the `configure` command line.
-
-Support for the "fixed" rrset-order option can be enabled or disabled by
-specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
-configure command line. By default, fixed rrset-order is disabled to
-reduce memory footprint.
-
-The `--enable-querytrace` option causes `named` to log every step of
-processing every query. The `--enable-singletrace` option turns on the
-same verbose tracing, but allows an individual query to be separately
-traced by setting its query ID to 0. These options should only be enabled
-when debugging, because they have a significant negative impact on query
-performance.
-
-`make install` installs `named` and the various BIND 9 libraries. By
-default, installation is into /usr/local, but this can be changed with the
-`--prefix` option when running `configure`.
-
-You may specify the option `--sysconfdir` to set the directory where
-configuration files like `named.conf` go by default, and `--localstatedir`
-to set the default parent directory of `run/named.pid`. `--sysconfdir`
-defaults to `$prefix/etc` and `--localstatedir` defaults to `$prefix/var`.
+For information about building BIND 9, see the
+["Building BIND 9"](doc/arm/build.rst) section in the BIND 9
+Administrator Reference Manual.
 
 ### <a name="testing"/> Automated testing
 

bin/check/named-checkconf.rst

@@ -27,7 +27,7 @@ Description
 ``named-checkconf`` checks the syntax, but not the semantics, of a
 ``named`` configuration file. The file, along with all files included by it, is parsed and checked for syntax
 errors. If no file is specified,
-``/etc/named.conf`` is read by default.
+|named_conf| is read by default.
 
 Note: files that ``named`` reads in separate parser contexts, such as
 ``rndc.key`` and ``bind.keys``, are not automatically read by
@@ -81,7 +81,7 @@ Options
 
 ``filename``
    This indicates the name of the configuration file to be checked. If not specified,
-   it defaults to ``/etc/named.conf``.
+   it defaults to |named_conf|.
 
 Return Values
 ~~~~~~~~~~~~~

bin/confgen/rndc-confgen.rst

@@ -35,9 +35,8 @@ Options
 ~~~~~~~
 
 ``-a``
-   This option sets automatic ``rndc`` configuration, which creates a file ``rndc.key``
-   in ``/etc`` (or a different ``sysconfdir`` specified when BIND
-   was built) that is read by both ``rndc`` and ``named`` on startup.
+   This option sets automatic ``rndc`` configuration, which creates a file
+   |rndc_key| that is read by both ``rndc`` and ``named`` on startup.
    The ``rndc.key`` file defines a default command channel and
    authentication key allowing ``rndc`` to communicate with ``named`` on
    the local host with no further configuration.

bin/delv/delv.rst

@@ -97,7 +97,7 @@ Options
 
 ``-a anchor-file``
    This option specifies a file from which to read DNSSEC trust anchors. The default
-   is ``/etc/bind.keys``, which is included with BIND 9 and contains one
+   is |bind_keys|, which is included with BIND 9 and contains one
    or more trust anchors for the root zone (".").
 
    Keys that do not match the root zone name are ignored. An alternate
@@ -107,8 +107,8 @@ Options
    ``initial-key``, and ``static-key`` identically. That is, for a managed key,
    it is the *initial* key that is trusted; :rfc:`5011` key management is not
    supported. ``delv`` does not consult the managed-keys database maintained by
-   ``named``, which means that if either of the keys in ``/etc/bind.keys`` is
-   revoked and rolled over, ``/etc/bind.keys`` must be updated to
+   ``named``, which means that if either of the keys in |bind_keys| is
+   revoked and rolled over, |bind_keys| must be updated to
    use DNSSEC validation in ``delv``.
 
 ``-b address``
@@ -316,7 +316,7 @@ assign values to options like the timeout interval. They have the form
 Files
 ~~~~~
 
-``/etc/bind.keys``
+|bind_keys|
 
 ``/etc/resolv.conf``
 

bin/dig/nslookup.c

@@ -621,8 +621,6 @@ static void
 setoption(char *opt) {
 	size_t l = strlen(opt);
 
-	debugging = true;
-
 #define CHECKOPT(A, N) \
 	((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))
 

bin/dnssec/dnssec-signzone.c

@@ -417,17 +417,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, directory, mctx, &privkey);
 	if (result == ISC_R_SUCCESS) {
 		dst_key_free(&pubkey);
-		result = dns_dnsseckey_create(mctx, &privkey, &key);
+		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
-		result = dns_dnsseckey_create(mctx, &pubkey, &key);
+		dns_dnsseckey_create(mctx, &pubkey, &key);
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		key->force_publish = false;
-		key->force_sign = false;
-		key->index = keycount++;
-		ISC_LIST_APPEND(keylist, key, link);
-	}
+	key->force_publish = false;
+	key->force_sign = false;
+	key->index = keycount++;
+	ISC_LIST_APPEND(keylist, key, link);
 
 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
 	return (key);
@@ -3359,9 +3357,9 @@ main(int argc, char *argv[]) {
 	atomic_init(&finished, false);
 
 	/* Unused letters: Bb G J q Yy (and F is reserved). */
-#define CMDLINE_FLAGS                                                         \
-	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:VX:" \
-	"xzZ:"
+#define CMDLINE_FLAGS                                                        \
+	"3:AaCc:Dd:E:e:f:FghH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	"VX:xzZ:"
 
 	/*
 	 * Process memory debugging argument first.
@@ -3509,6 +3507,10 @@ main(int argc, char *argv[]) {
 			}
 			break;
 
+		case 'J':
+			journal = isc_commandline_argument;
+			break;
+
 		case 'K':
 			directory = isc_commandline_argument;
 			break;
@@ -3812,6 +3814,9 @@ main(int argc, char *argv[]) {
 	gdb = NULL;
 	TIME_NOW(&timer_start);
 	loadzone(file, origin, rdclass, &gdb);
+	if (journal != NULL) {
+		loadjournal(mctx, gdb, journal);
+	}
 	gorigin = dns_db_origin(gdb);
 	gclass = dns_db_class(gdb);
 	get_soa_ttls();

bin/dnssec/dnssec-verify.c

@@ -70,10 +70,10 @@ const char *program = "dnssec-verify";
 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
-static dns_db_t *gdb;		  /* The database */
-static dns_dbversion_t *gversion; /* The database version */
-static dns_rdataclass_t gclass;	  /* The class */
-static dns_name_t *gorigin;	  /* The database origin */
+static dns_db_t *gdb = NULL;		 /* The database */
+static dns_dbversion_t *gversion = NULL; /* The database version */
+static dns_rdataclass_t gclass;		 /* The class */
+static dns_name_t *gorigin = NULL;	 /* The database origin */
 static bool ignore_kskflag = false;
 static bool keyset_kskonly = false;
 
@@ -180,7 +180,7 @@ main(int argc, char *argv[]) {
 	char *endp;
 	int ch;
 
-#define CMDLINE_FLAGS "c:E:hm:o:I:qv:Vxz"
+#define CMDLINE_FLAGS "c:E:hJ:m:o:I:qv:Vxz"
 
 	/*
 	 * Process memory debugging argument first.
@@ -226,6 +226,10 @@ main(int argc, char *argv[]) {
 			inputformatstr = isc_commandline_argument;
 			break;
 
+		case 'J':
+			journal = isc_commandline_argument;
+			break;
+
 		case 'm':
 			break;
 
@@ -319,6 +323,9 @@ main(int argc, char *argv[]) {
 	gdb = NULL;
 	report("Loading zone '%s' from file '%s'\n", origin, file);
 	loadzone(file, origin, rdclass, &gdb);
+	if (journal != NULL) {
+		loadjournal(mctx, gdb, journal);
+	}
 	gorigin = dns_db_origin(gdb);
 	gclass = dns_db_class(gdb);
 

bin/dnssec/dnssectool.c

@@ -39,6 +39,7 @@
 #include <dns/dbiterator.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
+#include <dns/journal.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/name.h>
@@ -64,6 +65,7 @@ static const char *keystates[KEYSTATES_NVALUES] = {
 
 int verbose = 0;
 bool quiet = false;
+const char *journal = NULL;
 dns_dsdigest_t dtype[8];
 
 static fatalcallback_t *fatalcallback = NULL;
@@ -564,3 +566,41 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 	}
 	return (false);
 }
+
+void
+loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *file) {
+	dns_journal_t *jnl = NULL;
+	isc_result_t result;
+
+	result = dns_journal_open(mctx, file, DNS_JOURNAL_READ, &jnl);
+	if (result == ISC_R_NOTFOUND) {
+		fprintf(stderr, "%s: journal file %s not found\n", program,
+			file);
+		goto cleanup;
+	} else if (result != ISC_R_SUCCESS) {
+		fatal("unable to open journal %s: %s\n", file,
+		      isc_result_totext(result));
+	}
+
+	if (dns_journal_empty(jnl)) {
+		dns_journal_destroy(&jnl);
+		return;
+	}
+
+	result = dns_journal_rollforward(jnl, db, 0);
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case DNS_R_UPTODATE:
+		break;
+
+	case ISC_R_NOTFOUND:
+	case ISC_R_RANGE:
+		fatal("journal %s out of sync with zone", file);
+
+	default:
+		fatal("journal %s: %s\n", file, isc_result_totext(result));
+	}
+
+cleanup:
+	dns_journal_destroy(&jnl);
+}

bin/dnssec/dnssectool.h

@@ -32,6 +32,9 @@ extern bool quiet;
 /*! program name, statically initialized in each program */
 extern const char *program;
 
+/*! journal file */
+extern const char *journal;
+
 /*!
  * List of DS digest types used by dnssec-cds and dnssec-dsfromkey,
  * defined in dnssectool.c. Filled in by add_dtype() from -a
@@ -102,3 +105,6 @@ key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
 
 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
+
+void
+loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);

bin/named/config.c

@@ -68,7 +68,6 @@ options {\n\
 			    "\
 	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
-#	keep-response-order {none;};\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
 #	lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\

bin/named/named.conf.rst

@@ -301,7 +301,6 @@ OPTIONS
   	ipv4only-server string;
   	ixfr-from-differences ( primary | master | secondary | slave |
   	    boolean );
-  	keep-response-order { address_match_element; ... };
   	key-directory quoted_string;
   	lame-ttl duration;
   	listen-on [ port integer ] [ dscp
@@ -1133,7 +1132,7 @@ ZONE
 Files
 ~~~~~
 
-``/etc/named.conf``
+|named_conf|
 
 See Also
 ~~~~~~~~

bin/named/named.rst

@@ -29,7 +29,7 @@ distribution from ISC. For more information on the DNS, see :rfc:`1033`,
 :rfc:`1034`, and :rfc:`1035`.
 
 When invoked without arguments, ``named`` reads the default
-configuration file ``/etc/named.conf``, reads any initial data, and
+configuration file |named_conf|, reads any initial data, and
 listens for queries.
 
 Options
@@ -45,7 +45,7 @@ Options
 
 ``-c config-file``
    This option tells ``named`` to use ``config-file`` as its configuration file instead of the default,
-   ``/etc/named.conf``. To ensure that the configuration file
+   |named_conf|. To ensure that the configuration file
    can be reloaded after the server has changed its working directory
    due to to a possible ``directory`` option in the configuration file,
    ``config-file`` should be an absolute pathname.
@@ -206,10 +206,10 @@ in the script used to start the ``named`` process.
 Files
 ~~~~~
 
-``/etc/named.conf``
+|named_conf|
    The default configuration file.
 
-``/var/run/named/named.pid``
+|named_pid|
    The default process-id file.
 
 See Also

bin/named/server.c

@@ -438,6 +438,10 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
 	       bool modify);
 
+static void
+configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
+			     dns_view_t *view);
+
 static isc_result_t
 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		   isc_mem_t *mctx, cfg_aclconfctx_t *actx);
@@ -2413,7 +2417,7 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 }
 
 static isc_result_t
-configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
+configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t **maps,
 	      const cfg_obj_t *rpz_obj, bool *old_rpz_okp) {
 	bool dnsrps_enabled;
 	const cfg_listelt_t *zone_element;
@@ -2427,7 +2431,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	uint32_t minupdateinterval_default;
 	dns_rpz_zones_t *zones;
 	const dns_rpz_zones_t *old;
-	dns_view_t *pview;
+	bool pview_must_detach = false;
 	const dns_rpz_zone_t *old_zone;
 	isc_result_t result;
 	int i;
@@ -2573,14 +2577,19 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		zones->p.nsip_wait_recurse = false;
 	}
 
-	pview = NULL;
-	result = dns_viewlist_find(&named_g_server->viewlist, view->name,
-				   view->rdclass, &pview);
-	if (result == ISC_R_SUCCESS) {
+	if (pview != NULL) {
 		old = pview->rpzs;
 	} else {
-		old = NULL;
+		result = dns_viewlist_find(&named_g_server->viewlist,
+					   view->name, view->rdclass, &pview);
+		if (result == ISC_R_SUCCESS) {
+			pview_must_detach = true;
+			old = pview->rpzs;
+		} else {
+			old = NULL;
+		}
 	}
+
 	if (old == NULL) {
 		*old_rpz_okp = false;
 	} else {
@@ -2602,7 +2611,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 			add_soa_default, ttl_default, minupdateinterval_default,
 			old_zone, old_rpz_okp);
 		if (result != ISC_R_SUCCESS) {
-			if (pview != NULL) {
+			if (pview_must_detach) {
 				dns_view_detach(&pview);
 			}
 			return (result);
@@ -2639,7 +2648,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 			    view->rpzs->rpz_ver);
 	}
 
-	if (pview != NULL) {
+	if (pview_must_detach) {
 		dns_view_detach(&pview);
 	}
 
@@ -2968,15 +2977,14 @@ catz_modzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin, dns_view_t *view,
 }
 
 static isc_result_t
-configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
-		    const cfg_listelt_t *element) {
+configure_catz_zone(dns_view_t *view, dns_view_t *pview,
+		    const cfg_obj_t *config, const cfg_listelt_t *element) {
 	const cfg_obj_t *catz_obj, *obj;
 	dns_catz_zone_t *zone = NULL;
 	const char *str;
 	isc_result_t result;
 	dns_name_t origin;
 	dns_catz_options_t *opts;
-	dns_view_t *pview = NULL;
 
 	dns_name_init(&origin, NULL);
 	catz_obj = cfg_listelt_value(element);
@@ -3007,9 +3015,7 @@ configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
 	if (result == ISC_R_EXISTS) {
 		isc_ht_iter_t *it = NULL;
 
-		result = dns_viewlist_find(&named_g_server->viewlist,
-					   view->name, view->rdclass, &pview);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		RUNTIME_CHECK(pview != NULL);
 
 		/*
 		 * xxxwpk todo: reconfigure the zone!!!!
@@ -3100,9 +3106,6 @@ configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
 	}
 
 cleanup:
-	if (pview != NULL) {
-		dns_view_detach(&pview);
-	}
 	dns_name_free(&origin, view->mctx);
 
 	return (result);
@@ -3114,11 +3117,11 @@ static dns_catz_zonemodmethods_t ns_catz_zonemodmethods = {
 };
 
 static isc_result_t
-configure_catz(dns_view_t *view, const cfg_obj_t *config,
+configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 	       const cfg_obj_t *catz_obj) {
 	const cfg_listelt_t *zone_element;
 	const dns_catz_zones_t *old = NULL;
-	dns_view_t *pview = NULL;
+	bool pview_must_detach = false;
 	isc_result_t result;
 
 	/* xxxwpk TODO do it cleaner, once, somewhere */
@@ -3133,10 +3136,15 @@ configure_catz(dns_view_t *view, const cfg_obj_t *config,
 				 view->mctx, named_g_taskmgr,
 				 named_g_timermgr));
 
-	result = dns_viewlist_find(&named_g_server->viewlist, view->name,
-				   view->rdclass, &pview);
-	if (result == ISC_R_SUCCESS) {
+	if (pview != NULL) {
 		old = pview->catzs;
+	} else {
+		result = dns_viewlist_find(&named_g_server->viewlist,
+					   view->name, view->rdclass, &pview);
+		if (result == ISC_R_SUCCESS) {
+			pview_must_detach = true;
+			old = pview->catzs;
+		}
 	}
 
 	if (old != NULL) {
@@ -3146,7 +3154,7 @@ configure_catz(dns_view_t *view, const cfg_obj_t *config,
 	}
 
 	while (zone_element != NULL) {
-		CHECK(configure_catz_zone(view, config, zone_element));
+		CHECK(configure_catz_zone(view, pview, config, zone_element));
 		zone_element = cfg_list_next(zone_element);
 	}
 
@@ -3157,7 +3165,7 @@ configure_catz(dns_view_t *view, const cfg_obj_t *config,
 	result = ISC_R_SUCCESS;
 
 cleanup:
-	if (pview != NULL) {
+	if (pview_must_detach) {
 		dns_view_detach(&pview);
 	}
 
@@ -4036,6 +4044,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
 	dns_dispatch_t *dispatch4 = NULL;
 	dns_dispatch_t *dispatch6 = NULL;
+	bool rpz_configured = false;
+	bool catz_configured = false;
+	bool zones_configured = false;
 	bool shared_cache = false;
 	int i = 0, j = 0, k = 0;
 	const char *str;
@@ -4106,14 +4117,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	if (view->rdclass == dns_rdataclass_in && need_hints &&
 	    named_config_get(maps, "response-policy", &obj) == ISC_R_SUCCESS)
 	{
-		CHECK(configure_rpz(view, maps, obj, &old_rpz_ok));
+		CHECK(configure_rpz(view, NULL, maps, obj, &old_rpz_ok));
+		rpz_configured = true;
 	}
 
 	obj = NULL;
 	if (view->rdclass == dns_rdataclass_in && need_hints &&
 	    named_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS)
 	{
-		CHECK(configure_catz(view, config, obj));
+		CHECK(configure_catz(view, NULL, config, obj));
+		catz_configured = true;
 	}
 
 	/*
@@ -4137,6 +4150,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 				     viewlist, kasplist, actx, false,
 				     old_rpz_ok, false));
 	}
+	zones_configured = true;
 
 	/*
 	 * Check that a primary or secondary zone was found for each
@@ -5951,6 +5965,91 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	result = ISC_R_SUCCESS;
 
 cleanup:
+	/*
+	 * Revert to the old view if there was an error.
+	 */
+	if (result != ISC_R_SUCCESS) {
+		isc_result_t result2;
+
+		result2 = dns_viewlist_find(&named_g_server->viewlist,
+					    view->name, view->rdclass, &pview);
+		if (result2 == ISC_R_SUCCESS) {
+			dns_view_thaw(pview);
+
+			obj = NULL;
+			if (rpz_configured &&
+			    pview->rdclass == dns_rdataclass_in && need_hints &&
+			    named_config_get(maps, "response-policy", &obj) ==
+				    ISC_R_SUCCESS)
+			{
+				/*
+				 * We are swapping the places of the `view` and
+				 * `pview` in the function's parameters list
+				 * because we are reverting the same operation
+				 * done previously in the "correct" order.
+				 */
+				result2 = configure_rpz(pview, view, maps, obj,
+							&old_rpz_ok);
+				if (result2 != ISC_R_SUCCESS) {
+					isc_log_write(named_g_lctx,
+						      NAMED_LOGCATEGORY_GENERAL,
+						      NAMED_LOGMODULE_SERVER,
+						      ISC_LOG_ERROR,
+						      "rpz configuration "
+						      "revert failed for view "
+						      "'%s'",
+						      pview->name);
+				}
+			}
+
+			obj = NULL;
+			if (catz_configured &&
+			    pview->rdclass == dns_rdataclass_in && need_hints &&
+			    named_config_get(maps, "catalog-zones", &obj) ==
+				    ISC_R_SUCCESS)
+			{
+				if (pview->catzs != NULL) {
+					dns_catz_catzs_detach(&pview->catzs);
+				}
+				/*
+				 * We are swapping the places of the `view` and
+				 * `pview` in the function's parameters list
+				 * because we are reverting the same operation
+				 * done previously in the "correct" order.
+				 */
+				result2 = configure_catz(pview, view, config,
+							 obj);
+				if (result2 != ISC_R_SUCCESS) {
+					isc_log_write(named_g_lctx,
+						      NAMED_LOGCATEGORY_GENERAL,
+						      NAMED_LOGMODULE_SERVER,
+						      ISC_LOG_ERROR,
+						      "catz configuration "
+						      "revert failed for view "
+						      "'%s'",
+						      pview->name);
+				}
+			}
+
+			dns_view_freeze(pview);
+		}
+
+		if (pview != NULL) {
+			dns_view_detach(&pview);
+		}
+
+		if (zones_configured) {
+			for (element = cfg_list_first(zonelist);
+			     element != NULL; element = cfg_list_next(element))
+			{
+				const cfg_obj_t *zconfig =
+					cfg_listelt_value(element);
+				configure_zone_setviewcommit(result, zconfig,
+							     view);
+			}
+		}
+	}
+
 	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
 	}
@@ -8599,15 +8698,6 @@ load_configuration(const char *filename, named_server_t *server,
 					     server->sctx->blackholeacl);
 	}
 
-	/*
-	 * Set "keep-response-order". Only legal at options or
-	 * global defaults level.
-	 */
-	CHECK(configure_view_acl(NULL, config, named_g_config,
-				 "keep-response-order", NULL,
-				 named_g_aclconfctx, named_g_mctx,
-				 &server->sctx->keepresporder));
-
 	obj = NULL;
 	result = named_config_get(maps, "match-mapped-addresses", &obj);
 	INSIST(result == ISC_R_SUCCESS);

bin/nsupdate/nsupdate.rst

@@ -46,7 +46,7 @@ described in :rfc:`3645`.
 
 TSIG relies on a shared secret that should only be known to ``nsupdate``
 and the name server. For instance, suitable ``key`` and ``server``
-statements are added to ``/etc/named.conf`` so that the name server
+statements are added to |named_conf| so that the name server
 can associate the appropriate secret key and algorithm with the IP
 address of the client application that is using TSIG
 authentication. ``ddns-confgen`` can generate suitable
@@ -97,7 +97,7 @@ Options
    This option sets local-host only mode, which sets the server address to localhost
    (disabling the ``server`` so that the server address cannot be
    overridden). Connections to the local server use a TSIG key
-   found in ``/var/run/named/session.key``, which is automatically
+   found in |session_key|, which is automatically
    generated by ``named`` if any local ``primary`` zone has set
    ``update-policy`` to ``local``. The location of this key file can be
    overridden with the ``-k`` option.
@@ -335,7 +335,7 @@ Files
 ``/etc/resolv.conf``
    Used to identify the default name server
 
-``/var/run/named/session.key``
+|session_key|
    Sets the default TSIG key for use in local-only mode
 
 ``K{name}.+157.+{random}.key``

bin/plugins/filter-a.rst

@@ -31,7 +31,7 @@ For example:
 
 ::
 
-   plugin query "/usr/local/lib/filter-a.so" {
+   plugin query "filter-a.so" {
            filter-a-on-v6 yes;
            filter-a-on-v4 yes;
            filter-a { 192.0.2.1; 2001:db8:2::1; };

bin/plugins/filter-aaaa.rst

@@ -35,7 +35,7 @@ enabled with the ``filter-aaaa`` ACL and the ``filter-aaaa-on-v4`` and
 
 ::
 
-   plugin query "/usr/local/lib/filter-aaaa.so" {
+   plugin query "filter-aaaa.so" {
            filter-aaaa-on-v4 yes;
            filter-aaaa-on-v6 yes;
            filter-aaaa { 192.0.2.1; 2001:db8:2::1; };

bin/rndc/rndc.rst

@@ -59,11 +59,11 @@ Options
 
 ``-c config-file``
    This option indicates ``config-file`` as the configuration file instead of the default,
-   ``/etc/rndc.conf``.
+   |rndc_conf|.
 
 ``-k key-file``
    This option indicates ``key-file`` as the key file instead of the default,
-   ``/etc/rndc.key``. The key in ``/etc/rndc.key`` is used to
+   |rndc_key|. The key in |rndc_key| is used to
    authenticate commands sent to the server if the config-file does not
    exist.
 

bin/tests/Makefile.am

@@ -31,5 +31,3 @@ wire_test_CPPFLAGS =		\
 wire_test_LDADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)
-
-EXTRA_DIST = prepare-softhsm2.sh

bin/tests/prepare-softhsm2.sh

@@ -1,22 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-if [ -n "${SOFTHSM2_CONF}" ] && command -v softhsm2-util >/dev/null; then
-    SOFTHSM2_DIR=$(dirname "$SOFTHSM2_CONF")
-    mkdir -p "${SOFTHSM2_DIR}/tokens"
-    echo "directories.tokendir = ${SOFTHSM2_DIR}/tokens" > "${SOFTHSM2_CONF}"
-    echo "objectstore.backend = file" >> "${SOFTHSM2_CONF}"
-    echo "log.level = DEBUG" >> "${SOFTHSM2_CONF}"
-    softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
-fi
-exit 0

bin/tests/system/.gitignore

@@ -8,11 +8,8 @@ named.lock
 named.pid
 named.run
 /feature-test
-/test.output.*
 /makejournal
-/systests.output
 /random.data
-parallel.mk
 /*.log
 /*.trs
 /resolve

bin/tests/system/Makefile.am

@@ -114,6 +114,7 @@ TESTS +=			\
 	eddsa			\
 	ednscompliance		\
 	emptyzones		\
+	engine_pkcs11		\
 	filter-aaaa		\
 	formerr			\
 	geoip2			\
@@ -125,6 +126,7 @@ TESTS +=			\
 	hooks			\
 	journal			\
 	keepalive		\
+	keyfromlabel		\
 	legacy			\
 	limits			\
 	logfileconfig		\

bin/tests/system/README

@@ -117,13 +117,7 @@ Running All The System Tests
 ---
 To run all the system tests, enter the command:
 
-    sh runall.sh [-c] [-n] [numproc]
-
-The optional flag "-c" forces colored output (by default system test output is
-not printed in color due to run.sh being piped through "tee").
-
-The optional flag "-n" has the same effect as it does for "run.sh" - it causes
-the retention of all output files from all tests.
+    make [-j numproc] test
 
 The optional "numproc" argument specifies the maximum number of tests that can
 run in parallel.  The default is 1, which means that all of the tests run
@@ -132,16 +126,7 @@ new tests being started as tests finish.  Each test will get a unique set of
 ports, so there is no danger of tests interfering with one another.  Parallel
 running will reduce the total time taken to run the BIND system tests, but will
 mean that the output from all the tests sent to the screen will be mixed up
-with one another.  However, the systests.output file produced at the end of the
-run (in the bin/tests/system directory) will contain the output from each test
-in sequential order.
-
-Note that it is not possible to pass arguments to tests though the "runall.sh"
-script.
-
-A run of all the system tests can also be initiated via make:
-
-    make [-j numproc] test
+with one another.
 
 In this case, retention of the output files after a test completes successfully
 is specified by setting the environment variable SYSTEMTEST_NO_CLEAN to 1 prior
@@ -153,38 +138,6 @@ while setting environment variable SYSTEMTEST_FORCE_COLOR to 1 forces system
 test output to be printed in color.
 
 
-Running Multiple System Test Suites Simultaneously
----
-In some cases it may be desirable to have multiple instances of the system test
-suite running simultaneously (e.g. from different terminal windows).  To do
-this:
-
-1. Each installation must have its own directory tree.  The system tests create
-files in the test directories, so separate directory trees are required to
-avoid interference between the same test running in the different
-installations.
-
-2. For one of the test suites, the starting port number must be specified by
-setting the environment variable STARTPORT before starting the test suite.
-Each test suite comprises about 100 tests, each being allocated a set of 100
-ports.  The port ranges for each test are allocated sequentially, so each test
-suite requires about 10,000 ports to itself.  By default, the port allocation
-starts at 5,000.  So the following set of commands:
-
-    Terminal Window 1:
-        cd <installation-1>/bin/tests/system
-        sh runall.sh 4
-
-    Terminal Window 2:
-        cd <installation-2>/bin/tests/system
-        STARTPORT=20000 sh runall.sh 4
-
-... will start the test suite for installation-1 using the default base port
-of 5,000, so the test suite will use ports 5,000 through 15,000 (or there
-abouts).  The use of "STARTPORT=20000" to prefix the run of the test suite for
-installation-2 will mean the test suite uses ports 20,000 through 30,000 or so.
-
-
 Format of Test Output
 ---
 All output from the system tests is in the form of lines with the following
@@ -247,8 +200,8 @@ deleted if the test succeeds but are retained on error.  The run.sh script
 automatically calls a given test's clean.sh script before invoking its setup.sh
 script.
 
-Deletion of the files produced by the set of tests (e.g. after the execution
-of "runall.sh") can be carried out using the command:
+Deletion of the files produced by the set of tests (e.g. after the execution of
+make) can be carried out using the command:
 
     sh cleanall.sh
 
@@ -337,7 +290,7 @@ port assignments would be:
     HIGHPORT = 5299
 
 When running tests in parallel (i.e. giving a value of "numproc" greater than 1
-in the "make" or "runall.sh" commands listed above), it is guaranteed that each
+in the "make" command listed above), it is guaranteed that each
 test will get a set of unique port numbers.
 
 
@@ -373,7 +326,7 @@ arguments, e.g.:
    (cd mytest ; sh clean.sh -D xyz)
 
 No arguments will be passed to the test scripts if the test is run as part of
-a run of the full test suite (e.g. the tests are started with "runall.sh").
+a run of the full test suite (e.g. the tests are started with make).
 
 3.  Each script should start with the following lines:
 
@@ -643,13 +596,10 @@ Adding a Test to the System Test Suite
 ---
 Once a test has been created, the following files should be edited:
 
-* conf.sh.in  The name of the test should be added to the PARALLELDIRS or
-SEQUENTIALDIRS variables as appropriate.  The former is used for tests that
-can run in parallel with other tests, the latter for tests that are unable to
-do so.
+* conf.sh.common The name of the test should be added to the PARALLEL_COMMON
+variable.
 
-* Makefile.in The name of the test should be added to one of the the PARALLEL
-or SEQUENTIAL variables.
+* Makefile.am The name of the test should be added to the TESTS variable.
 
 (It is likely that a future iteration of the system test suite will remove the
 need to edit multiple files to add a test.)
@@ -673,20 +623,12 @@ Notes on Parallel Execution
 Although execution of an individual test is controlled by "run.sh", which
 executes the above shell scripts (and starts the relevant servers) for each
 test, the running of all tests in the test suite is controlled by the Makefile.
-("runall.sh" does little more than invoke "make" on the Makefile.)
 
 All system tests are capable of being run in parallel.  For this to work, each
 test needs to use a unique set of ports.  To avoid the need to define which
 tests use which ports (and so risk port clashes as further tests are added),
-the ports are assigned when the tests are run.  This is achieved by having the
-"test" target in the Makefile depend on "parallel.mk".  That file is created
-when "make check" is run, and contains a target for each test of the form:
-
-    <test-name>:
-        @$(SHELL) run.sh -p <baseport> <test-name>
-
-The <baseport> is unique and the values of <baseport> for each test are
-separated by at least 100 ports.
+the ports are determined by "get_ports.sh", a port broker script which keeps
+track of ports given to each individual system test.
 
 
 Cleaning Up From Tests
@@ -699,10 +641,6 @@ stored in the test directory.
 2. Files produced by named which may not be cleaned up if named exits
 abnormally, e.g. core files, PID files etc., are stored in the test directory.
 
-3. A file "test.output.<test-name>" containing the text written to stdout by the
-test is written to bin/tests/system/.  This file is only produced when the test
-is run as part of the entire test suite (e.g. via "runall.sh").
-
 If the test fails, all these files are retained.  But if the test succeeds,
 they are cleaned up at different times:
 
@@ -711,7 +649,3 @@ they are cleaned up at different times:
 
 2. Files that may not be cleaned up if named exits abnormally can be removed
 using the "cleanall.sh" script.
-
-3. "test.output.*" files are deleted when the test suite ends.  At this point,
-the file "testsummary.sh" is called which concatenates all the "test.output.*"
-files into a single "systests.output" file before deleting them.

bin/tests/system/autosign/ns1/keygen.sh

@@ -19,7 +19,7 @@ infile=root.db.in
 
 (cd ../ns2 && $SHELL keygen.sh )
 
-cat $infile ../ns2/dsset-example$TP > $zonefile
+cat $infile ../ns2/dsset-example. > $zonefile
 
 zskact=`$KEYGEN -3 -a RSASHA1 -q $zone`
 zskvanish=`$KEYGEN -3 -a RSASHA1 -q $zone`

bin/tests/system/autosign/ns2/keygen.sh

@@ -19,18 +19,18 @@
 for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync \
     dname-at-apex-nsec3
 do
-	cp ../ns3/dsset-$subdomain.example$TP .
+	cp ../ns3/dsset-$subdomain.example. .
 done
 
 # Create keys and pass the DS to the parent.
 zone=example
 zonefile="${zone}.db"
 infile="${zonefile}.in"
-cat $infile dsset-*.example$TP > $zonefile
+cat $infile dsset-*.example. > $zonefile
 
 kskname=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
 $KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
-$DSFROMKEY $kskname.key > dsset-${zone}$TP
+$DSFROMKEY $kskname.key > dsset-${zone}.
 
 # Create keys for a private secure zone.
 zone=private.secure.example
@@ -53,4 +53,4 @@ do
 	cp $i `echo $i | sed s/X/K/`
 done
 $KEYGEN -a RSASHA1 -q $zone > /dev/null
-$DSFROMKEY Kbar.+005+30804.key > dsset-bar$TP
+$DSFROMKEY Kbar.+005+30804.key > dsset-bar.

bin/tests/system/autosign/ns3/keygen.sh

@@ -33,7 +33,7 @@ setup secure.example
 cp $infile $zonefile
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  NSEC3/NSEC test zone
@@ -42,7 +42,7 @@ setup secure.nsec3.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  NSEC3/NSEC3 test zone
@@ -51,7 +51,7 @@ setup nsec3.nsec3.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  Jitter/NSEC3 test zone
@@ -75,16 +75,16 @@ setup optout.nsec3.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A nsec3 zone (non-optout).
 #
 setup nsec3.example
-cat $infile dsset-*.${zone}$TP > $zonefile
+cat $infile dsset-*.${zone}. > $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # An NSEC3 zone, with NSEC3 parameters set prior to signing
@@ -95,7 +95,7 @@ ksk=`$KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.ou
 echo $ksk > ../autoksk.key
 zsk=`$KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out` || dumpit kg.out
 echo $zsk > ../autozsk.key
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  OPTOUT/NSEC test zone
@@ -104,7 +104,7 @@ setup secure.optout.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  OPTOUT/NSEC3 test zone
@@ -113,7 +113,7 @@ setup nsec3.optout.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  OPTOUT/OPTOUT test zone
@@ -122,16 +122,16 @@ setup optout.optout.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A optout nsec3 zone.
 #
 setup optout.example
-cat $infile dsset-*.${zone}$TP > $zonefile
+cat $infile dsset-*.${zone}. > $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A RSASHA256 zone.
@@ -140,7 +140,7 @@ setup rsasha256.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a RSASHA256 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A RSASHA512 zone.
@@ -149,7 +149,7 @@ setup rsasha512.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a RSASHA512 -b 2048 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a RSASHA512 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # NSEC-only zone.
@@ -158,7 +158,7 @@ setup nsec.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # Signature refresh test zone.  Signatures are set to expire long
@@ -301,7 +301,7 @@ setup sync.example
 cp $infile $zonefile
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 echo ns3/$ksk > ../sync.key
 
 #
@@ -311,7 +311,7 @@ setup kskonly.example
 cp $infile $zonefile
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A zone that has a published inactive key that is autosigned.
@@ -320,7 +320,7 @@ setup inacksk2.example
 cp $infile $zonefile
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -Pnow -A now+3600 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A zone that has a published inactive key that is autosigned.
@@ -329,7 +329,7 @@ setup inaczsk2.example
 cp $infile $zonefile
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  A zone that starts with a active KSK + ZSK and a inactive ZSK.
@@ -339,7 +339,7 @@ cp $infile $zonefile
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 -fk $zone > kg.out 2>&1 || dumpit kg.out
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  A zone that starts with a active KSK + ZSK and a inactive ZSK.
@@ -349,7 +349,7 @@ cp $infile $zonefile
 ksk=`$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A zone that starts with an active KSK + ZSK and an inactive ZSK, with the
@@ -369,4 +369,4 @@ setup dname-at-apex-nsec3.example
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.

bin/tests/system/catz/ns2/named1.conf.in

@@ -46,6 +46,14 @@ options {
 	};
 };
 
+# A faulty dlz configuration to check if named and catz survive a certain class
+# of failed configuration attempts (see GL#3060).
+# We use "dlz" because the dlz processing code is located in an ideal place in
+# the view configuration function for the test to cover the view reverting code.
+#T3dlz "bad-dlz" {
+#T3	database "dlopen bad-dlz.so example.org";
+#T3};
+
 zone "catalog1.example" {
 	type secondary;
 	file "catalog1.example.db";

bin/tests/system/catz/tests.sh

@@ -369,6 +369,30 @@ wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "reconfiguring secondary - checking if catz survives a certain class of failed reconfiguration attempts ($n)"
+ret=0
+sed -e "s/^#T3//" < ns2/named1.conf.in > ns2/named.conf.tmp
+copy_setports ns2/named.conf.tmp ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p "${CONTROLPORT}" reconfig > /dev/null 2>&1 && ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking again that dom3.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "reconfiguring secondary - reverting the bad configuration ($n)"
+ret=0
+copy_setports ns2/named1.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 n=$((n+1))
 echo_i "removing all records from catalog1 zone ($n)"
 ret=0
@@ -1213,7 +1237,7 @@ echo_i "reconfiguring secondary - removing catalog4 catalog zone, adding non-exi
 ret=0
 sed -e "s/^#T2//" < ns2/named1.conf.in > ns2/named.conf.tmp
 copy_setports ns2/named.conf.tmp ns2/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > /dev/null 2>&1 && ret=1
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p "${CONTROLPORT}" reconfig > /dev/null 2>&1 && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 

bin/tests/system/cds/tests.sh

@@ -52,7 +52,7 @@ check_stderr() {
 }
 
 check_stdout() {
-	$DIFF out.$n "${out:-empty}" >/dev/null && return
+	diff out.$n "${out:-empty}" >/dev/null && return
 	echo_d "stdout did not match '$out'"
 	(	echo "wanted"
 		cat "$out"
@@ -128,10 +128,10 @@ name='in-place backup correct modification time'
 testcase 0 $PERL checkmtime.pl 7200 DS.inplace.bak
 
 name='in-place correct output'
-testcase 0 $DIFF DS.1 DS.inplace
+testcase 0 diff DS.1 DS.inplace
 
 name='in-place backup unmodified'
-testcase 0 $DIFF DS.1 DS.inplace.bak
+testcase 0 diff DS.1 DS.inplace.bak
 
 name='one mangled DS'
 err='found RRSIG by key'

bin/tests/system/checkconf/bad-keep-response-order.conf

@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	keep-response-order {
-		does_not_exist;
-	};
-};

bin/tests/system/checkconf/good.conf

@@ -54,9 +54,6 @@ options {
 	heartbeat-interval 30;
 	hostname none;
 	interface-interval 30;
-	keep-response-order {
-		10.0.10.0/24;
-	};
 	listen-on port 90 {
 		"any";
 	};

bin/tests/system/checkds/ns2/setup.sh

@@ -21,7 +21,7 @@ for subdomain in dspublished reference missing-dspublished bad-dspublished \
 		 dswithdrawn missing-dswithdrawn bad-dswithdrawn \
 		 multiple-dswithdrawn incomplete-dswithdrawn bad2-dswithdrawn
 do
-	cp "../ns9/dsset-$subdomain.checkds$TP" .
+	cp "../ns9/dsset-$subdomain.checkds." .
 done
 
 zone="checkds"

bin/tests/system/checkzone/tests.sh

@@ -192,7 +192,7 @@ status=`expr $status + $ret`
 
 ret=0
 # Step 3: Ensure that output conversion from stdin is the same as the output conversion from a file.
-$DIFF zones/zone1_file.txt zones/zone1_stdin.txt >/dev/null 2>&1 || ret=1
+diff zones/zone1_file.txt zones/zone1_stdin.txt >/dev/null 2>&1 || ret=1
 status=`expr $status + $ret`
 
 if [ $ret != 0 ]; then echo_i "failed"; fi

bin/tests/system/cleanall.sh

@@ -31,6 +31,5 @@ rm -f ../random.data
 for d in $SUBDIRS
 do
    test ! -f $d/clean.sh || ( cd $d && $SHELL clean.sh )
-   rm -f test.output.$d
    test -d $d && find $d -type d -exec rmdir '{}' \; 2> /dev/null
 done

bin/tests/system/conf.sh.common

@@ -31,13 +31,6 @@ export LANG=C
 # The "dialup", "delzone", and "dupsigs" tests are also not run by
 # default because they take a very long time to complete.
 #
-# The following tests are hard-coded to use ports 5300 and 9953. For
-# this reason, these must be run sequentially.
-#
-# Sequential tests that only run on unix/linux should be added to
-# SEQUENTIAL_UNIX in conf.sh.in
-#
-SEQUENTIAL_COMMON=""
 
 #
 # These tests can use ports assigned by the caller (other than 5300
@@ -181,19 +174,19 @@ then
 		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
 	}
 	echo_i() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
+	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:$__LINE"
 	    done
 	}
 
 	echo_ic() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
+	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:  $__LINE"
 	    done
 	}
 
 	echo_d() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
+	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
 	       echoinfo "D:$SYSTESTDIR:$__LINE"
 	    done
 	}
@@ -218,32 +211,32 @@ else
 	}
 
 	echo_i() {
-	    echo "$@" | while read -r __LINE ; do
+	    echo "$@" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:$__LINE"
 	    done
 	}
 
 	echo_ic() {
-	    echo "$@" | while read -r __LINE ; do
+	    echo "$@" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:  $__LINE"
 	    done
 	}
 
 	echo_d() {
-	    echo "$@" | while read -r __LINE ; do
+	    echo "$@" | while IFS= read -r __LINE ; do
 	       echoinfo "D:$SYSTESTDIR:$__LINE"
 	    done
 	}
 fi
 
 cat_i() {
-    while read -r __LINE ; do
+    while IFS= read -r __LINE ; do
        echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 
 cat_d() {
-    while read -r __LINE ; do
+    while IFS= read -r __LINE ; do
        echoinfo "D:$SYSTESTDIR:$__LINE"
     done
 }
@@ -714,7 +707,6 @@ export ARPANAME
 export BIGKEY
 export CDS
 export CHECKZONE
-export CYGWIN
 export DESCRIPTION
 export DIG
 export FEATURETEST
@@ -738,7 +730,6 @@ export NSUPDATE
 export NZD2NZF
 export PERL
 export PIPEQUERIES
-export PSSUSPEND
 export PYTHON
 export RESOLVE
 export RNDC

bin/tests/system/conf.sh.in

@@ -23,9 +23,6 @@ TOP_SRCDIR=@abs_top_srcdir@
 # Provide TMPDIR variable for tests that need it.
 TMPDIR=${TMPDIR:-/tmp}
 
-# This is not the windows build.
-CYGWIN=""
-
 # Load common values
 . $TOP_SRCDIR/bin/tests/system/conf.sh.common
 
@@ -76,18 +73,17 @@ KRB5_KTNAME=dns.keytab
 #
 # Construct the lists of tests to run
 #
-SEQUENTIAL_UNIX=""
-SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_UNIX"
 
-PARALLEL_UNIX="@DNSTAP@
-chain
+PARALLEL_UNIX="chain
 checkds
 cookie
 dlzexternal
 dnssec
 dyndb
+engine_pkcs11
 filter-aaaa
 kasp
+keyfromlabel
 keymgr2kasp
 legacy
 logfileconfig
@@ -96,17 +92,7 @@ pipelined
 qmin
 shutdown
 tcp"
-PARALLELDIRS="$PARALLEL_COMMON $PARALLEL_UNIX"
-
-SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
-
-
-# Things that are different on Windows
-KILL=kill
-DIFF=diff
-DOS2UNIX=true
-# There's no trailing period on Windows
-TP=.
+SUBDIRS="$PARALLEL_COMMON $PARALLEL_UNIX"
 
 # Use the CONFIG_SHELL detected by configure for tests
 SHELL=@SHELL@
@@ -126,9 +112,6 @@ XSLTPROC=@XSLTPROC@
 # PERL will be an empty string if no perl interpreter was found.
 PERL=$(command -v "@PERL@")
 
-# Windows process management leave empty
-PSSUSPEND=
-
 PYTHON=$(command -v "@PYTHON@" || true)
 PYTEST=@PYTEST@
 

bin/tests/system/cookie/tests.sh

@@ -22,7 +22,7 @@ n=0
 getcookie() {
 	awk '$2 == "COOKIE:" {
 		print $3;
-	}' < $1 | tr -d '\r'
+	}' < $1
 }
 
 fullcookie() {

bin/tests/system/cpu/prereq.sh

@@ -1,37 +0,0 @@
-#!/bin/sh -e
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-case $(uname) in
-	Linux*)
-		;;
-	*)
-		echo_i "cpu test only runs on Linux"
-		exit 255
-		;;
-esac
-
-# TASKSET will be an empty string if no taskset program was found.
-TASKSET=$(command -v "taskset" || true)
-if ! test -x "$TASKSET" ; then
-	exit 255
-fi
-
-if ! $TASKSET fff0 true > /dev/null 2>&1; then
-        echo_i "taskset failed"
-        exit 255
-fi

bin/tests/system/cpu/tests.sh

@@ -1,48 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-status=0
-n=0
-
-n=$((n+1))
-echo_i "stop server ($n)"
-ret=0
-$PERL ../stop.pl cpu ns1 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "start server with taskset ($n)"
-ret=0
-start_server --noclean --taskset fff0 --restart --port "${PORT}" cpu ns1 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "check ps output ($n)"
-ret=0
-ps -T -o pid,psr,time,comm -e > ps.out
-pid=$(cat ns1/named.pid)
-echo_i "pid=$pid"
-psr=$(awk -v pid="$pid" '$1 == pid && $4 == "isc-net-0000" {print $2}' < ps.out)
-echo_i "psr=$psr"
-# The next available cpu relative to the existing affinity mask is 4.
-test "$psr" -eq 4 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1

bin/tests/system/digdelv/tests.sh

@@ -576,7 +576,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.3 +ednsopt=llq:0001000200001234567812345678fefefefe +qr a.example > dig.out.test$n 2>&1 || ret=1
   pat='LLQ: Version: 1, Opcode: 2, Error: 0, Identifier: 1311768465173141112, Lifetime: 4278124286$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -675,7 +675,7 @@ if [ -x "$DIG" ] ; then
   # First defined EDE code, additional text "foo".
   dig_with_opts @10.53.0.3 +ednsopt=ede:0000666f6f a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 0 (Other): (foo)$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -684,7 +684,7 @@ if [ -x "$DIG" ] ; then
   # Last defined EDE code, no additional text.
   dig_with_opts @10.53.0.3 +ednsopt=ede:0018 a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 24 (Invalid Data)$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -693,7 +693,7 @@ if [ -x "$DIG" ] ; then
   # First undefined EDE code, additional text "foo".
   dig_with_opts @10.53.0.3 +ednsopt=ede:0019666f6f a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 25: (foo)$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -702,7 +702,7 @@ if [ -x "$DIG" ] ; then
   # EDE payload is too short
   dig_with_opts @10.53.0.3 +ednsopt=ede a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE:$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -711,7 +711,7 @@ if [ -x "$DIG" ] ; then
   # EDE payload is too short
   dig_with_opts @10.53.0.3 +ednsopt=ede:00 a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 00 (".")$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -799,7 +799,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.3 -q -m > dig.out.test$n 2>&1
   pat='^;-m\..*IN.*A$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   grep "Dump of all outstanding memory allocations" dig.out.test$n > /dev/null && ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
@@ -913,7 +913,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.3 +short +expandaaaa AAAA ns2.example > dig.out.test$n 2>&1 || ret=1
   pat='^fd92:7065:0b8e:ffff:0000:0000:0000:0002$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 

bin/tests/system/dlzexternal/driver/driver.c

@@ -480,8 +480,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	 * If the DLZ only operates on 'live' data, then version
 	 * wouldn't necessarily be needed.
 	 */
-	if (clientinfo != NULL && clientinfo->version >= DNS_CLIENTINFO_VERSION)
-	{
+	if (clientinfo != NULL && clientinfo->version >= 2) {
 		dbversion = clientinfo->dbversion;
 		if (dbversion != NULL && *(bool *)dbversion) {
 			loginfo("dlz_example: lookup against live transaction");
@@ -489,6 +488,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	}
 
 	if (strcmp(name, "source-addr") == 0) {
+		char ecsbuf[DNS_ECS_FORMATSIZE] = "not supported";
 		strncpy(buf, "unknown", sizeof(buf));
 		if (methods != NULL && methods->sourceip != NULL &&
 		    (methods->version - methods->age <=
@@ -498,6 +498,17 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 			methods->sourceip(clientinfo, &src);
 			fmt_address(src, buf, sizeof(buf));
 		}
+		if (clientinfo != NULL && clientinfo->version >= 3) {
+			if (clientinfo->ecs.addr.family != AF_UNSPEC) {
+				dns_ecs_format(&clientinfo->ecs, ecsbuf,
+					       sizeof(ecsbuf));
+			} else {
+				snprintf(ecsbuf, sizeof(ecsbuf), "%s",
+					 "not present");
+			}
+		}
+		i = strlen(buf);
+		snprintf(buf + i, sizeof(buf) - i - 1, " ECS %s", ecsbuf);
 
 		loginfo("dlz_example: lookup connection from %s", buf);
 

bin/tests/system/dlzexternal/tests.sh

@@ -217,5 +217,13 @@ lookups=`grep "lookup #.*\.not\.there" ns1/named.run | wc -l`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+newtest "checking ECS data is passed to driver in clientinfo"
+$DIG $DIGOPTS +short +subnet=192.0/16 source-addr.example.nil txt > dig.out.ns1.test$n.1 || ret=1
+grep "192.0.0.0/16/0" dig.out.ns1.test$n.1 > /dev/null || ret=1
+$DIG $DIGOPTS +short source-addr.example.nil txt > dig.out.ns1.test$n.2 || ret=1
+grep "not.*present" dig.out.ns1.test$n.2 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/dnssec/clean.sh

@@ -112,6 +112,7 @@ rm -f ./signer/example.db.after ./signer/example.db.before
 rm -f ./signer/example.db.changed
 rm -f ./signer/general/dsset*
 rm -f ./signer/general/signed.zone
+rm -f ./signer/general/*.jnl
 rm -f ./signer/general/signer.out.*
 rm -f ./signer/nsec3param.out
 rm -f ./signer/signer.out.*

bin/tests/system/dnssec/ns1/sign.sh

@@ -26,12 +26,12 @@ zonefile=root.db
 
 echo_i "ns1/sign.sh"
 
-cp "../ns2/dsset-example$TP" .
-cp "../ns2/dsset-in-addr.arpa$TP" .
-cp "../ns2/dsset-too-many-iterations$TP" .
+cp "../ns2/dsset-example." .
+cp "../ns2/dsset-in-addr.arpa." .
+cp "../ns2/dsset-too-many-iterations." .
 
-grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll$TP" > "dsset-algroll$TP"
-cp "../ns6/dsset-optout-tld$TP" .
+grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." > "dsset-algroll."
+cp "../ns6/dsset-optout-tld." .
 
 ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")

bin/tests/system/dnssec/ns2/sign.sh

@@ -24,8 +24,8 @@ echo_i "ns2/sign.sh"
 # Get the DS records for the "trusted." and "managed." zones.
 for subdomain in secure unsupported disabled enabled
 do
-	cp "../ns3/dsset-$subdomain.managed$TP" .
-	cp "../ns3/dsset-$subdomain.trusted$TP" .
+	cp "../ns3/dsset-$subdomain.managed." .
+	cp "../ns3/dsset-$subdomain.trusted." .
 done
 
 # Sign the "trusted." and "managed." zones.
@@ -65,7 +65,7 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
 	dnskey-nsec3-unknown managed-future revkey \
 	dname-at-apex-nsec3 occluded
 do
-	cp "../ns3/dsset-$subdomain.example$TP" .
+	cp "../ns3/dsset-$subdomain.example." .
 done
 
 # Sign the "example." zone.
@@ -83,7 +83,6 @@ cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
 zonefiletmp=$(mktemp "$zonefile.XXXXXX") || exit 1
 "$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" |
-tr -d '\r' |
 awk '
 tolower($1) == "bad-cname.example." && $4 == "RRSIG" && $5 == "CNAME" {
 	for (i = 1; i <= NF; i++ ) {

bin/tests/system/dnssec/ns3/sign.sh

@@ -275,7 +275,7 @@ cat "$infile" "$keyname.key" > "$zonefile"
 
 awk '$4 == "DNSKEY" { $7 = 100 } $4 == "RRSIG" { $6 = 100 } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE="dsset-${zone}${TP}"
+DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
@@ -294,7 +294,7 @@ cat "$infile" "$keyname.key" > "$zonefile"
 
 awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE="dsset-${zone}${TP}"
+DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
@@ -328,7 +328,7 @@ cat "$infile" "$keyname.key" > "$zonefile"
 
 awk '$4 == "DNSKEY" { $7 = 100; print } $4 == "RRSIG" { $6 = 100; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE="dsset-${zone}${TP}"
+DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
@@ -606,7 +606,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 cat "$infile" "$keyname.key" > "$zonefile"
 
 "$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
-sed -e 's/bogus/badds/g' < dsset-bogus.example$TP > dsset-badds.example$TP
+sed -e 's/bogus/badds/g' < dsset-bogus.example. > dsset-badds.example.
 
 #
 # A zone with future signatures.
@@ -668,7 +668,7 @@ kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "$zone")
 zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" "$zone")
 dnskeyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "delegation.$zone")
 keyname=$("$KEYGEN" -q -a DH -b 1024 -n HOST -T KEY "delegation.$zone")
-$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
+$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}."
 cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
-    "${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
+    "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
 "$SIGNER" -P -o "$zone" "$zonefile" > /dev/null

bin/tests/system/dnssec/signer/general/test10.zone

@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+;	This is a zone which has two DNSKEY records, both of which have
+; existing private key files available.  They should be loaded automatically
+; and the zone correctly signed.
+;
+$TTL 3600
+example.com.	IN	SOA ns hostmaster 00100000 1200 3600 604800 300
+extra.example.com. IN   A   1.2.3.4
+$include Kexample.com.+008+63613.key
+$include Kexample.com.+008+15002.key

bin/tests/system/dnssec/tests.sh

@@ -109,12 +109,11 @@ stripns () {
 # Ensure there is not a blank line before "Secure roots:".
 #
 check_secroots_layout () {
-	tr -d '\r' < "$1" | \
 	awk '$0 == "" { if (empty) exit(1); empty=1; next }
 	     /Start view/ { if (!empty) exit(1) }
 	     /Secure roots:/ { if (empty) exit(1) }
 	     /Negative trust anchors:/ { if (!empty) exit(1) }
-	     { empty=0 }'
+	     { empty=0 }' $1
 	return $?
 }
 
@@ -1407,6 +1406,20 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_ic "check that dnssec-signzone -J loads journal files ($n)"
+ret=0
+(
+cd signer/general || exit 0
+rm -f signed.zone
+$MAKEJOURNAL example.com. test9.zone test10.zone test9.zone.jnl
+$SIGNER -f signed.zone -o example.com. -J test9.zone.jnl test9.zone > signer.out.$n
+grep -q extra signed.zone
+) || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+
 echo_ic "check that dnssec-signzone accepts maximum NSEC3 iterations ($n)"
 ret=0
 (
@@ -1422,7 +1435,6 @@ status=$((status+ret))
 get_rsasha1_key_ids_from_sigs() {
 	zone=$1
 
-	tr -d '\r' < signer/$zone.db.signed | \
 	awk '
 		NF < 8 { next }
 		$(NF-5) != "RRSIG" { next }
@@ -1432,8 +1444,7 @@ get_rsasha1_key_ids_from_sigs() {
 			getline;
 			print $3;
 		}
-	' | \
-	sort -u
+	' signer/$zone.db.signed | sort -u
 }
 
 # Test dnssec-signzone ZSK prepublish smooth rollover.
@@ -2152,7 +2163,7 @@ status=$((status+ret))
 ret=0
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f ns4/named.pid
 
 #
@@ -2214,7 +2225,7 @@ grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f ns4/named.pid
 
 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown"
@@ -2272,7 +2283,7 @@ grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f named.pid
 
 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown"
@@ -2320,7 +2331,7 @@ n=$((n+1))
 echo_i "testing loading out of bounds lifetime from NTA file ($n)"
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f ns4/named.pid
 
 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown"
@@ -2882,8 +2893,8 @@ awk '{
 	for (i=1;i<7;i++) printf("%s ", $i);
 	for (i=7;i<=NF;i++) printf("%s", $i);
 	printf("\n");
-}' < ns1/dsset-algroll$TP > canonical2.$n || ret=1
-$DIFF -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1
+}' < ns1/dsset-algroll. > canonical2.$n || ret=1
+diff -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -2942,7 +2953,7 @@ ret=0
 dig_with_answeropts +nottlid nosign.example ns @10.53.0.3 | \
         grep RRSIG | sed 's/[ 	][ 	]*/ /g' > dig.out.ns3.test$n 2>&1
 # the NS RRSIG should not be changed
-$DIFF nosign.before dig.out.ns3.test$n > /dev/null|| ret=1
+diff nosign.before dig.out.ns3.test$n > /dev/null|| ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -3460,7 +3471,7 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
+lines=$(awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -3532,7 +3543,7 @@ lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}'
 test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
+lines=$(awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -3673,7 +3684,7 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
+lines=$(awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -3750,7 +3761,7 @@ lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {pri
 test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
+lines=$(awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"

bin/tests/system/dsdigest/ns1/sign.sh

@@ -19,8 +19,8 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL sign.sh)
 
-cp ../ns2/dsset-good$TP .
-cp ../ns2/dsset-bad$TP .
+cp ../ns2/dsset-good. .
+cp ../ns2/dsset-bad. .
 
 key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
 key2=`$KEYGEN -q -a RSASHA1 -b 2048 -n zone -f KSK $zone`

bin/tests/system/dsdigest/ns2/sign.sh

@@ -31,8 +31,8 @@ cat $infile2 $keyname21.key $keyname22.key >$zonefile2
 $SIGNER -P -g -o $zone1 $zonefile1 > /dev/null
 $SIGNER -P -g -o $zone2 $zonefile2 > /dev/null
 
-DSFILENAME1=dsset-${zone1}${TP}
-DSFILENAME2=dsset-${zone2}${TP}
+DSFILENAME1=dsset-${zone1}.
+DSFILENAME2=dsset-${zone2}.
 $DSFROMKEY -a SHA-256 $keyname12 > $DSFILENAME1
 $DSFROMKEY -a SHA-256 $keyname22 > $DSFILENAME2
 

bin/tests/system/engine_pkcs11/2037-pk11_numbits-crash-test.pkt

@@ -0,0 +1,30 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+edda 2800 0001 0000 0001 0000 0972 7361
+7368 6132 3536 0765 7861 6d70 6c65 0000
+0600 01c0 0c00 3000 0100 0001 2c01 0801
+0003 0803 0100 0100 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 00

bin/tests/system/engine_pkcs11/clean.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+rm -f dig.out.*
+rm -f dsset-*
+rm -f pin
+rm -f keyfromlabel.out.*
+rm -f pkcs11-tool.out.*
+rm -f signer.out.*
+rm -f ns1/*.example.db ns1/*.example.db.signed
+rm -f ns1/*.kskid1 ns1/*.kskid2 ns1/*.zskid1 ns1/*.zskid2
+rm -f ns1/dig.out.*
+rm -f ns1/K*
+rm -f ns1/named.conf ns1/named.run ns1/named.memstats
+rm -f ns1/update.cmd.*
+rm -f ns1/update.log.*
+rm -f ns1/verify.out.*
+rm -f ns1/zone.*.signed.jnl ns1/zone.*.signed.jbk
+
+softhsm2-util --delete-token --token "softhsm2-engine_pkcs11" >/dev/null 2>&1 || echo_i "softhsm2-engine_pkcs11 token not found for cleaning"

bin/tests/system/engine_pkcs11/ns1/named.args

@@ -0,0 +1 @@
+-E pkcs11 -D engine_pkcs11-ns1 -X named.lock -m record -c named.conf -d 99 -U 4 -T maxcachesize=2097152

bin/tests/system/engine_pkcs11/ns1/named.conf.in

@@ -11,10 +11,26 @@
  * information regarding copyright ownership.
  */
 
+controls { /* empty */ };
+
 options {
 	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

bin/tests/system/engine_pkcs11/ns1/template.db.in

@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.1
+
+txt			TXT	"test"
+

bin/tests/system/engine_pkcs11/prereq.sh

@@ -1,21 +1,21 @@
 #!/bin/sh -e
-
+#
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-# shellcheck source=conf.sh
 . ../conf.sh
 
-set -e
+if [ -n "${SOFTHSM2_MODULE}" ] && command -v softhsm2-util >/dev/null; then
+	exit 0
+fi
 
-$SHELL clean.sh
-
-copy_setports ns1/named.conf.in ns1/named.conf
+echo_i "skip: softhsm2-util not available"
+exit 255

bin/tests/system/engine_pkcs11/setup.sh

@@ -0,0 +1,125 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2-engine_pkcs11" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
+
+printf '%s' "${HSMPIN:-1234}" > pin
+PWD=$(pwd)
+
+copy_setports ns1/named.conf.in ns1/named.conf
+
+keygen() {
+	type="$1"
+	bits="$2"
+	zone="$3"
+	id="$4"
+
+	label="${id}-${zone}"
+	p11id=$(echo "${label}" | sha1sum - | awk '{print $1}')
+	pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-engine_pkcs11" -l -k --key-type $type:$bits --label "${label}" --id "${p11id//$'\n'/}" --pin $(cat $PWD/pin) > pkcs11-tool.out.$zone.$id || return 1
+}
+
+keyfromlabel() {
+        alg="$1"
+        zone="$2"
+        id="$3"
+	dir="$4"
+        shift 4
+
+	$KEYFRLAB -K $dir -E pkcs11 -a $alg -l "token=softhsm2-engine_pkcs11;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >> keyfromlabel.out.$zone.$id 2>> /dev/null || return 1
+	cat keyfromlabel.out.$zone.$id
+}
+
+
+# Setup ns1.
+dir="ns1"
+infile="${dir}/template.db.in"
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+
+	if $SHELL ../testcrypto.sh $alg; then
+		zone="$alg.example"
+		zonefile="zone.$alg.example.db"
+		ret=0
+
+		echo_i "Generate keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone enginepkcs11-zsk || ret=1
+		keygen $type $bits $zone enginepkcs11-ksk || ret=1
+		test "$ret" -eq 0 || exit 1
+
+		echo_i "Get ZSK $alg $zone $type:$bits"
+		zsk1=$(keyfromlabel $alg $zone enginepkcs11-zsk $dir)
+		test -z "$zsk1" && exit 1
+
+		echo_i "Get KSK $alg $zone $type:$bits"
+		ksk1=$(keyfromlabel $alg $zone enginepkcs11-ksk $dir -f KSK)
+		test -z "$ksk1" && exit 1
+
+		(
+			cd $dir
+			zskid1=$(keyfile_to_key_id $zsk1)
+			kskid1=$(keyfile_to_key_id $ksk1)
+			echo "$zskid1" > $zone.zskid1
+			echo "$kskid1" > $zone.kskid1
+		)
+
+		echo_i "Sign zone with $ksk1 $zsk1"
+		cat "$infile" "${dir}/${ksk1}.key" "${dir}/${zsk1}.key" > "${dir}/${zonefile}"
+		$SIGNER -K $dir -E pkcs11 -S -a -g -O full -o "$zone" "${dir}/${zonefile}" > signer.out.$zone || ret=1
+		test "$ret" -eq 0 || exit 1
+
+		echo_i "Generate successor keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone enginepkcs11-zsk2 || ret=1
+		keygen $type $bits $zone enginepkcs11-ksk2 || ret=1
+		test "$ret" -eq 0 || exit 1
+
+		echo_i "Get ZSK $alg $id-$zone $type:$bits"
+		zsk2=$(keyfromlabel $alg $zone enginepkcs11-zsk2 $dir)
+		test -z "$zsk2" && exit 1
+
+		echo_i "Get KSK $alg $id-$zone $type:$bits"
+		ksk2=$(keyfromlabel $alg $zone enginepkcs11-ksk2 $dir -f KSK)
+		test -z "$ksk2" && exit 1
+
+		(
+			cd $dir
+			zskid2=$(keyfile_to_key_id $zsk2)
+			kskid2=$(keyfile_to_key_id $ksk2)
+			echo "$zskid2" > $zone.zskid2
+			echo "$kskid2" > $zone.kskid2
+			cp "${zsk2}.key" "${zsk2}.zsk2"
+			cp "${ksk2}.key" "${ksk2}.ksk2"
+		)
+
+		echo_i "Add zone $zone to named.conf"
+		cat >> "${dir}/named.conf" <<EOF
+zone "$zone" {
+	type primary;
+	file "${zonefile}.signed";
+	allow-update { any; };
+};
+
+EOF
+        fi
+done

bin/tests/system/engine_pkcs11/tests.sh

@@ -0,0 +1,174 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+PWD=$(pwd)
+
+status=0
+ret=0
+n=0
+
+dig_with_opts() (
+	$DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
+)
+
+# Perform tests inside ns1 dir
+cd ns1
+
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+	zone="${alg}.example"
+	zonefile="zone.${zone}.db.signed"
+
+        if [ ! -f $zonefile ]; then
+		echo_i "skipping test for ${alg}:${type}:${bits}, no signed zone file ${zonefile}"
+		continue
+	fi
+
+	# Basic checks if setup was successful.
+	n=$((n+1))
+	ret=0
+	echo_i "Test key generation was successful for $zone ($n)"
+	count=$(ls K*.key | grep "K${zone}" | wc -l)
+	test "$count" -eq 4 || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 4 keys, got $count)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test zone signing was successful for $zone ($n)"
+	$VERIFY -z -o $zone "${zonefile}" > verify.out.$zone.$n 2>&1 || ret=1
+	test "$ret" -eq 0 || echo_i "failed (dnssec-verify failed)"
+	status=$((status+ret))
+
+	# Test inline signing with keys stored in engine.
+	zskid1=$(cat "${zone}.zskid1")
+	zskid2=$(cat "${zone}.zskid2")
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test inline signing for $zone ($n)"
+	dig_with_opts "$zone" @10.53.0.1 SOA > dig.out.soa.$zone.$n || ret=1
+	awk '$4 == "RRSIG" { print $11 }' dig.out.soa.$zone.$n > dig.out.keyids.$zone.$n || return 1
+	numsigs=$(cat dig.out.keyids.$zone.$n | wc -l)
+	test $numsigs -eq 1 || return 1
+	grep -w "$zskid1" dig.out.keyids.$zone.$n > /dev/null || return 1
+	test "$ret" -eq 0 || echo_i "failed (SOA RRset not signed with key $zskid1)"
+	status=$((status+ret))
+
+
+	n=$((n+1))
+	ret=0
+	echo_i "Dynamically update $zone, add new zsk ($n)"
+	zsk2=$(grep -v ';' K${zone}.*.zsk2)
+	cat > "update.cmd.zsk.$zone.$n" <<EOF
+server 10.53.0.1 $PORT
+ttl 300
+zone $zone
+update add $zsk2
+send
+EOF
+
+	$NSUPDATE -v > "update.log.zsk.$zone.$n" < "update.cmd.zsk.$zone.$n" || ret=1
+	test "$ret" -eq 0 || echo_i "failed (update failed)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test DNSKEY response for $zone after inline signing ($n)"
+	_dig_dnskey() (
+		dig_with_opts "$zone" @10.53.0.1 DNSKEY > dig.out.dnskey.$zone.$n || return 1
+		count=$(awk 'BEGIN { count = 0 } $4 == "DNSKEY" { count++ } END {print count}' dig.out.dnskey.$zone.$n)
+		test $count -eq 3
+	)
+	retry_quiet 10 _dig_dnskey || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 3 DNSKEY records)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test SOA response for $zone after inline signing ($n)"
+	_dig_soa() (
+		dig_with_opts "$zone" @10.53.0.1 SOA > dig.out.soa.$zone.$n || return 1
+		awk '$4 == "RRSIG" { print $11 }' dig.out.soa.$zone.$n > dig.out.keyids.$zone.$n || return 1
+		numsigs=$(cat dig.out.keyids.$zone.$n | wc -l)
+		test $numsigs -eq 2 || return 1
+		grep -w "$zskid1" dig.out.keyids.$zone.$n > /dev/null || return 1
+		grep -w "$zskid2" dig.out.keyids.$zone.$n > /dev/null || return 1
+		return 0
+	)
+	retry_quiet 10 _dig_soa || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 2 SOA RRSIG records)"
+	status=$((status+ret))
+
+	# Test inline signing with keys stored in engine (key signing).
+	kskid1=$(cat "${zone}.kskid1")
+	kskid2=$(cat "${zone}.kskid2")
+
+	n=$((n+1))
+	ret=0
+	echo_i "Dynamically update $zone, add new ksk ($n)"
+	ksk2=$(grep -v ';' K${zone}.*.ksk2)
+	cat > "update.cmd.ksk.$zone.$n" <<EOF
+server 10.53.0.1 $PORT
+ttl 300
+zone $zone
+update add $ksk2
+send
+EOF
+
+	$NSUPDATE -v > "update.log.ksk.$zone.$n" < "update.cmd.ksk.$zone.$n" || ret=1
+	test "$ret" -eq 0 || echo_i "failed (update failed)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test DNSKEY response for $zone after inline signing (key signing) ($n)"
+	_dig_dnskey_ksk() (
+		dig_with_opts "$zone" @10.53.0.1 DNSKEY > dig.out.dnskey.$zone.$n || return 1
+		count=$(awk 'BEGIN { count = 0 } $4 == "DNSKEY" { count++ } END {print count}' dig.out.dnskey.$zone.$n)
+		test $count -eq 4 || return 1
+		awk '$4 == "RRSIG" { print $11 }' dig.out.dnskey.$zone.$n > dig.out.keyids.$zone.$n || return 1
+		numsigs=$(cat dig.out.keyids.$zone.$n | wc -l)
+		test $numsigs -eq 2 || return 1
+		grep -w "$kskid1" dig.out.keyids.$zone.$n > /dev/null || return 1
+		grep -w "$kskid2" dig.out.keyids.$zone.$n > /dev/null || return 1
+		return 0
+	)
+	retry_quiet 10 _dig_dnskey_ksk || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 4 DNSKEY records, 2 KSK signatures)"
+	status=$((status+ret))
+
+done
+
+# Go back to main test dir.
+cd ..
+
+n=$((n+1))
+ret=0
+echo_i "Checking for assertion failure in pk11_numbits()"
+$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
+dig_with_opts @10.53.0.1 version.bind. CH TXT > dig.out.pk11_numbits || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1

bin/tests/system/forward/tests.sh

@@ -166,7 +166,7 @@ count_sent() (
 	logfile="$1"
 	start_pattern="$2"
 	pattern="$3"
-	nextpartpeek "$logfile" | tr -d '\r' | sed -n "/$start_pattern/,/^\$/p" | grep -c "$pattern"
+	nextpartpeek "$logfile" | sed -n "/$start_pattern/,/^\$/p" | grep -c "$pattern"
 )
 
 check_sent() (

bin/tests/system/ifconfig.bat

@@ -1,49 +0,0 @@
-echo off
-rem
-rem Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-rem 
-rem SPDX-License-Identifier: MPL-2.0
-rem 
-rem This Source Code Form is subject to the terms of the Mozilla Public
-rem License, v. 2.0. If a copy of the MPL was not distributed with this
-rem file, you can obtain one at https://mozilla.org/MPL/2.0/.
-rem 
-rem See the COPYRIGHT file distributed with this work for additional
-rem information regarding copyright ownership.
-
-rem ifconfig.bat
-rem Set up interface aliases for bind9 system tests.
-rem
-rem IPv4: 10.53.0.{1..10}			RFC 1918
-rem       10.53.1.{1..2}
-rem       10.53.2.{1..2}
-rem IPv6: fd92:7065:b8e:ffff::{1..10}		ULA
-rem       fd92:7065:b8e:99ff::{1..2}
-rem       fd92:7065:b8e:ff::{1..2}
-rem
-echo Please adapt this script to your system
-rem remove the following line when the script is ready
-exit /b 1
-
-rem for IPv4 adding these static addresses to a physical interface
-rem will switch it from DHCP to static flushing DHCP setup.
-rem So it is highly recommended to install the loopback pseudo-interface
-rem and add IPv4 addresses to it.
-
-rem for IPv6 your interface can have a different name, e.g.,
-rem "Local Area Connection". Please update this script and remove the
-rem exit line
-
-echo on
-
-FOR %%I IN (1,2,3,4,5,6,7,8,9,10) DO (
-	netsh interface ipv4 add address name=Loopback 10.53.0.%%I 255.255.255.0
-	netsh interface ipv6 add address interface=Loopback fd92:7065:b8e:ffff::%%I/64
-)
-FOR %%I IN (1,2) DO (
-	netsh interface ipv4 add address name=Loopback 10.53.1.%%I 255.255.255.0
-	netsh interface ipv4 add address name=Loopback 10.53.2.%%I 255.255.255.0
-
-	netsh interface ipv6 add address interface=Loopback fd92:7065:b8e:99ff::%%I/64
-	netsh interface ipv6 add address interface=Loopback fd92:7065:b8e:ff::%%I/64
-)

bin/tests/system/inline/tests.sh

@@ -967,7 +967,7 @@ do
 done
 # Sanity check: the SOA record should be unchanged
 $DIG $DIGOPTS +short @10.53.0.3 primary SOA > dig.out.ns3.test$n.2 || ret=1
-$DIFF dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null || ret=1
+diff dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -991,7 +991,7 @@ _includefile_loaded() {
 retry_quiet 10 _includefile_loaded
 # Sanity check: the SOA record should be changed
 $DIG $DIGOPTS +short @10.53.0.3 primary SOA > dig.out.ns3.test$n.2 || ret=1
-$DIFF dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null && ret=1
+diff dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/kasp/tests.sh

@@ -161,7 +161,7 @@ cp "$STATE_FILE" "$CMP_FILE"
 $SETTIME -P +3600 "$BASE_FILE" > /dev/null || log_error "settime failed"
 grep "; Publish: " "$KEY_FILE" > /dev/null || log_error "mismatch published in $KEY_FILE"
 grep "Publish: " "$PRIVATE_FILE" > /dev/null || log_error "mismatch published in $PRIVATE_FILE"
-$DIFF "$CMP_FILE" "$STATE_FILE" || log_error "unexpected file change in $STATE_FILE"
+diff "$CMP_FILE" "$STATE_FILE" || log_error "unexpected file change in $STATE_FILE"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 

bin/tests/system/keepalive/tests.sh

@@ -71,7 +71,7 @@ echo_i "checking re-configured value ($n)"
 ret=0
 n=`expr $n + 1`
 $RNDCCMD tcp-timeouts 300 300 300 200 > output
-$DIFF -b output expected || ret=1
+diff -b output expected || ret=1
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 > dig.out.test$n
 grep "; TCP KEEPALIVE: 20.0 secs" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi

bin/tests/system/keyfromlabel/clean.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+rm -f K*
+rm -f pin
+rm -f dsset-*
+rm -f *.example.db *.example.db.signed
+rm -f keyfromlabel.out.*
+rm -f pkcs11-tool.out.*
+rm -f signer.out.*
+
+softhsm2-util --delete-token --token "softhsm2-keyfromlabel" >/dev/null 2>&1 || echo_i "softhsm2-keyfromlabel token not found for cleaning"

bin/tests/system/keyfromlabel/prereq.sh

@@ -1,23 +1,21 @@
-#!/bin/sh
-
+#!/bin/sh -e
+#
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-#
-# Stop all hanging processes from any system tests.
-#
+. ../conf.sh
 
-. ./conf.sh
+if [ -n "${SOFTHSM2_MODULE}" ] && command -v softhsm2-util >/dev/null; then
+	exit 0
+fi
 
-for d in $SUBDIRS
-do
-   $SHELL stop.sh $d
-done
+echo_i "skip: softhsm2-util not available"
+exit 255

bin/tests/system/keyfromlabel/setup.sh

@@ -1,17 +1,22 @@
 #!/bin/sh
-
+#
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+# shellcheck source=conf.sh
+. ../conf.sh
+
 set -e
 
-rm -f ps.out
-rm -f ns1/named.conf ns1/managed-keys.* ns1/named.run ns1/named.memstats
+softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2-keyfromlabel" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
+
+printf '%s' "${HSMPIN:-1234}" > pin
+PWD=$(pwd)

bin/tests/system/keyfromlabel/template.db.in

@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.1
+
+txt			TXT	"test"
+

bin/tests/system/keyfromlabel/tests.sh

@@ -0,0 +1,91 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+PWD=$(pwd)
+
+keygen() {
+	type="$1"
+	bits="$2"
+	zone="$3"
+	id="$4"
+
+	label="${id}-${zone}"
+	p11id=$(echo "${label}" | sha1sum - | awk '{print $1}')
+	pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-keyfromlabel" -l -k --key-type $type:$bits --label "${label}" --id "${p11id//$'\n'/}" --pin $(cat $PWD/pin) > pkcs11-tool.out.$zone.$id || return 1
+}
+
+keyfromlabel() {
+        alg="$1"
+        zone="$2"
+        id="$3"
+        shift 3
+
+	$KEYFRLAB -E pkcs11 -a $alg -l "token=softhsm2-keyfromlabel;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >> keyfromlabel.out.$zone.$id 2>> /dev/null || return 1
+	cat keyfromlabel.out.$zone.$id
+}
+
+infile="template.db.in"
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+
+	if $SHELL ../testcrypto.sh $alg; then
+		zone="$alg.example"
+		zonefile="zone.$alg.example.db"
+		ret=0
+
+		echo_i "Generate keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone keyfromlabel-zsk || ret=1
+		keygen $type $bits $zone keyfromlabel-ksk || ret=1
+		test "$ret" -eq 0 || echo_i "failed"
+		status=$((status+ret))
+
+		# Skip dnssec-keyfromlabel if key generation failed.
+		test $ret == 0 || continue
+
+		echo_i "Get ZSK $alg $zone $type:$bits"
+		ret=0
+		zsk=$(keyfromlabel $alg $zone keyfromlabel-zsk)
+		test -z "$zsk" && ret=1
+		test "$ret" -eq 0 || echo_i "failed (zsk=$zsk)"
+		status=$((status+ret))
+
+		echo_i "Get KSK $alg $zone $type:$bits"
+		ret=0
+		ksk=$(keyfromlabel $alg $zone keyfromlabel-ksk -f KSK)
+		test -z "$ksk" && ret=1
+		test "$ret" -eq 0 || echo_i "failed (ksk=$ksk)"
+		status=$((status+ret))
+
+		# Skip signing if dnssec-keyfromlabel failed.
+		test $ret == 0 || continue
+
+		echo_i "Sign zone with $ksk $zsk"
+		ret=0
+		cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+		$SIGNER -E pkcs11 -S -a -g -o "$zone" "$zonefile" > signer.out.$zone || ret=1
+		test "$ret" -eq 0 || echo_i "failed"
+		status=$((status+ret))
+	fi
+done
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1

bin/tests/system/makejournal.c

@@ -75,6 +75,9 @@ loadzone(dns_db_t **db, const char *origin, const char *filename) {
 	}
 
 	result = dns_db_load(*db, filename, dns_masterformat_text, 0);
+	if (result == DNS_R_SEENINCLUDE) {
+		result = ISC_R_SUCCESS;
+	}
 	return (result);
 }
 

bin/tests/system/masterfile/tests.sh

@@ -29,7 +29,7 @@ $DIG $DIGOPTS +nostats +nocmd ttl2. axfr @10.53.0.1 >>dig.out.$n
 echo_i "test of master file RFC1035 TTL and \$TTL semantics ($n)"
 $DIG $DIGOPTS +nostats +nocmd ttl2. axfr @10.53.0.1 >>dig.out.$n
 
-$DIFF dig.out.$n knowngood.dig.out || status=1
+diff dig.out.$n knowngood.dig.out || status=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -53,7 +53,7 @@ ret=0
 n=`expr $n + 1`
 echo_i "test owner inheritance after "'$INCLUDE'" ($n)"
 $CHECKZONE -Dq example zone/inheritownerafterinclude.db > checkzone.out$n
-$DIFF checkzone.out$n zone/inheritownerafterinclude.good || ret=1
+diff checkzone.out$n zone/inheritownerafterinclude.good || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/names/tests.sh

@@ -30,7 +30,7 @@ cat dig.compdis.test  |grep -v ';;' |sort > dig.compdis.sorted.test
 # the compression disabled message should be at least twice as large as with
 # compression disabled, but the content should be the same
 echo_i "Checking if responses are identical other than in message size"
-$DIFF dig.compdis.sorted.test dig.compen.sorted.test >/dev/null
+diff dig.compdis.sorted.test dig.compen.sorted.test >/dev/null
 ret=$?
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/notify/tests.sh

@@ -94,13 +94,8 @@ nextpart ns3/named.run > /dev/null
 sleep 1 # make sure filesystem time stamp is newer for reload.
 rm -f ns2/example.db
 cp -f ns2/example2.db ns2/example.db
-if [ ! "$CYGWIN" ]; then
-    echo_i "reloading with example2 using HUP and waiting up to 45 seconds"
-    $KILL -HUP `cat ns2/named.pid`
-else
-    echo_i "reloading with example2 using rndc and waiting up to 45 seconds"
-    rndc_reload ns2 10.53.0.2
-fi
+echo_i "reloading with example2 using HUP and waiting up to 45 seconds"
+kill -HUP `cat ns2/named.pid`
 
 try=0
 while test $try -lt 45

bin/tests/system/nslookup/clean.sh

@@ -11,6 +11,7 @@
 
 rm -f ns1/example.db
 rm -f nslookup.out*
+rm -f nslookup.err*
 rm -f ns*/named.lock
 rm -f ns*/named.memstats
 rm -f ns*/named.run

bin/tests/system/nslookup/tests.sh

@@ -11,101 +11,116 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+# shellcheck disable=SC2086
 . ../conf.sh
 
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "Check that domain names that are too big when applying a search list entry are handled cleanly ($n)"
 ret=0
 l=012345678901234567890123456789012345678901234567890123456789012
 t=0123456789012345678901234567890123456789012345678901234567890
 d=$l.$l.$l.$t
-$NSLOOKUP -port=${PORT} -domain=$d -type=soa example 10.53.0.1 > nslookup.out${n} || ret=1
+$NSLOOKUP -port=${PORT} -domain=$d -type=soa example 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
 grep "origin = ns1.example" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check A only lookup"
+n=$((n+1))
+echo_i "Check A only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} a-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep a-only.example.net nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} a-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c a-only.example.net nslookup.out${n})
+test $lines -eq 1 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check AAAA only lookup"
+n=$((n+1))
+echo_i "Check AAAA only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} aaaa-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep aaaa-only.example.net nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} aaaa-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c aaaa-only.example.net nslookup.out${n})
+test $lines -eq 1 || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check dual A + AAAA lookup"
+n=$((n+1))
+echo_i "Check dual A + AAAA lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} dual.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep dual.example.net nslookup.out${n} | wc -l`
-test $lines = 2 || ret=1
+$NSLOOKUP -port=${PORT} dual.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c dual.example.net nslookup.out${n})
+test $lines -eq 2 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check CNAME to A only lookup"
+n=$((n+1))
+echo_i "Check CNAME to A only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} cname-a-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep "canonical name" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep a-only.example.net nslookup.out${n} | grep -v "canonical name" | wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} cname-a-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "canonical name" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep a-only.example.net nslookup.out${n} | grep -cv "canonical name")
+test $lines -eq 1 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check CNAME to AAAA only lookup"
+n=$((n+1))
+echo_i "Check CNAME to AAAA only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} cname-aaaa-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep "canonical name" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep aaaa-only.example.net nslookup.out${n} | grep -v "canonical name" |wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} cname-aaaa-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "canonical name" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep aaaa-only.example.net nslookup.out${n} | grep -cv "canonical name")
+test $lines -eq 1 || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check CNAME to dual A + AAAA lookup"
+n=$((n+1))
+echo_i "Check CNAME to dual A + AAAA lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} cname-dual.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep "canonical name" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep dual.example.net nslookup.out${n} | grep -v "canonical name" | wc -l`
-test $lines = 2 || ret=1
+$NSLOOKUP -port=${PORT} cname-dual.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "canonical name" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep dual.example.net nslookup.out${n} | grep -cv "canonical name")
+test $lines -eq 2 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/nsupdate/tests.sh

@@ -357,7 +357,7 @@ digcomp dig.out.ns1 dig.out.ns2 || ret=1
 
 echo_i "SIGKILL and restart server ns1"
 cd ns1
-$KILL -KILL `cat named.pid`
+kill -KILL `cat named.pid`
 rm named.pid
 cd ..
 sleep 10
@@ -400,13 +400,8 @@ END
 
 sleep 5
 
-if [ ! "$CYGWIN" ]; then
-    echo_i "SIGHUP secondary"
-    $KILL -HUP `cat ns2/named.pid`
-else
-    echo_i "reload secondary"
-    rndc_reload ns2 10.53.0.2
-fi
+echo_i "SIGHUP secondary"
+kill -HUP `cat ns2/named.pid`
 
 sleep 5
 
@@ -424,13 +419,8 @@ END
 
 sleep 5
 
-if [ ! "$CYGWIN" ]; then
-    echo_i "SIGHUP secondary again"
-    $KILL -HUP `cat ns2/named.pid`
-else
-    echo_i "reload secondary again"
-    rndc_reload ns2 10.53.0.2
-fi
+echo_i "SIGHUP secondary again"
+kill -HUP `cat ns2/named.pid`
 
 sleep 5
 

bin/tests/system/parallel.sh

@@ -1,34 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ./conf.sh
-
-PARALLELS=$(echo "$PARALLELDIRS" | sed "s|\([^ ][^ ]*\)|test-\1|g;" | tr _ - | tr "\n" " ")
-
-echo ".PHONY: $PARALLELS"
-echo
-echo "check_interfaces:"
-echo "	@${PERL} testsock.pl > /dev/null 2>&1 || { \\"
-echo "		echo \"I:NOTE: System tests were skipped because they require the\"; \\"
-echo "		echo \"I:      test IP addresses 10.53.0.* to be configured as alias\"; \\"
-echo "		echo \"I:      addresses on the loopback interface.  Please run\"; \\"
-echo "		echo \"I:      \"bin/tests/system/ifconfig.sh up\" as root to configure them.\"; \\"
-echo "		exit 1; \\"
-echo "	}"
-echo
-echo "test check: $PARALLELS"
-for directory in $PARALLELDIRS ; do
-        echo
-        echo "test-$(echo "$directory" | tr _ -): check_interfaces"
-        echo "	@${SHELL} ./run.sh -r $directory 2>&1 | tee test.output.$directory"
-done

bin/tests/system/pending/ns1/sign.sh

@@ -19,8 +19,8 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL -e sign.sh )
 
-cp ../ns2/dsset-example$TP .
-cp ../ns2/dsset-example.com$TP .
+cp ../ns2/dsset-example. .
+cp ../ns2/dsset-example.com. .
 
 keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
 keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`

bin/tests/system/pipelined/clean.sh

@@ -11,9 +11,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run
-rm -f raw* output*
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run*
+rm -f raw* output* ./*.out.*
 rm -f ns*/named.lock
 rm -f ns*/managed-keys.bind*

bin/tests/system/pipelined/ns4/named.conf.in

@@ -20,7 +20,6 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
-	keep-response-order { 10.53.0.7/32; };
 	recursion yes;
 	dnssec-validation yes;
 	notify yes;

bin/tests/system/pipelined/tests.sh

@@ -13,68 +13,61 @@
 
 . ../conf.sh
 
-MDIGOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+mdig_with_opts() {
+	"$MDIG" -p "${PORT}" "${@}"
+}
+
+rndccmd() {
+	"$RNDC" -c ../common/rndc.conf -p "${CONTROLPORT}" -s "${@}"
+}
+
+pipequeries() {
+	"$PIPEQUERIES" -p "${PORT}"
+}
 
 status=0
-
-echo_i "check pipelined TCP queries"
+n=1
 ret=0
-$PIPEQUERIES -p ${PORT} < input > raw || ret=1
-awk '{ print $1 " " $5 }' < raw > output
-sort < output > output-sorted
-$DIFF ref output-sorted || { ret=1 ; echo_i "diff sorted failed"; }
-$DIFF ref output > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
 
-echo_i "check pipelined TCP queries using mdig"
-ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$MDIG $MDIGOPTS +noall +answer +vc -f input -b 10.53.0.4 @10.53.0.4 > raw.mdig
-awk '{ print $1 " " $5 }' < raw.mdig > output.mdig
-sort < output.mdig > output-sorted.mdig
-$DIFF ref output-sorted.mdig || { ret=1 ; echo_i "diff sorted failed"; }
-$DIFF ref output.mdig > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
+echo_i "check pipelined TCP queries ($n)"
+pipequeries < input > raw.$n || ret=1
+awk '{ print $1 " " $5 }' < raw.$n > output.$n
+sort < output.$n > output-sorted.$n
+diff ref output-sorted.$n || { ret=1 ; echo_i "diff sorted failed"; }
+diff ref output.$n > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))
+ret=0
 
-echo_i "check keep-response-order"
-ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$PIPEQUERIES -p ${PORT} ++ < inputb > rawb || ret=1
-awk '{ print $1 " " $5 }' < rawb > outputb
-$DIFF refb outputb || ret=1
+echo_i "check pipelined TCP queries using mdig ($n)"
+rndccmd 10.53.0.4 flush
+wait_for_log 10 "flushing caches in all views succeeded" ns4/named.run
+mdig_with_opts +noall +answer +vc -f input -b 10.53.0.4 @10.53.0.4 > raw.mdig.$n
+awk '{ print $1 " " $5 }' < raw.mdig.$n > output.mdig.$n
+sort < output.mdig.$n > output-sorted.mdig.$n
+diff ref output-sorted.mdig.$n || { ret=1 ; echo_i "diff sorted failed"; }
+diff ref output.mdig.$n > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))
+ret=0
 
-echo_i "check keep-response-order using mdig"
-ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$MDIG $MDIGOPTS +noall +answer +vc -f inputb -b 10.53.0.7 @10.53.0.4 > rawb.mdig
-awk '{ print $1 " " $5 }' < rawb.mdig > outputb.mdig
-$DIFF refb outputb.mdig || ret=1
+echo_i "check mdig -4 -6 ($n)"
+mdig_with_opts -4 -6 -f input @10.53.0.4 > output.mdig.$n 2>&1 && ret=1
+grep "only one of -4 and -6 allowed" output.mdig.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))
+ret=0
 
-echo_i "check mdig -4 -6"
-ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$MDIG $MDIGOPTS -4 -6 -f input @10.53.0.4 > output46.mdig 2>&1 && ret=1
-grep "only one of -4 and -6 allowed" output46.mdig > /dev/null || ret=1
+echo_i "check mdig -4 with an IPv6 server address ($n)"
+mdig_with_opts -4 -f input @fd92:7065:b8e:ffff::2 > output.mdig.$n 2>&1 && ret=1
+grep "address family not supported" output.mdig.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "check mdig -4 with an IPv6 server address"
+status=$((status+ret))
+n=$((n+1))
 ret=0
-$MDIG $MDIGOPTS -4 -f input @fd92:7065:b8e:ffff::2 > output4.mdig 2>&1 && ret=1
-grep "address family not supported" output4.mdig > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/qmin/tests.sh

@@ -28,15 +28,15 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.good. @10.53.0.5 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.good.
 ADDR ns3.good.
 ADDR ns3.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -50,15 +50,15 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.5 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
 ADDR ns3.bad.
 ADDR ns3.bad.
 ADDR a.bit.longer.ns.name.bad.
 ADDR a.bit.longer.ns.name.bad.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -73,15 +73,15 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.slow.
 ADDR ns3.slow.
 ADDR ns3.slow.
 ADDR a.bit.longer.ns.name.slow.
 ADDR a.bit.longer.ns.name.slow.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -96,15 +96,15 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.ugly.
 ADDR ns3.ugly.
 ADDR ns3.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -119,7 +119,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
@@ -129,12 +129,12 @@ NS boing.good.
 NS good.
 NS zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
 NS ptang.zoop.boing.good.
 NS icky.ptang.zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 NS icky.ptang.zoop.boing.good.
 NS icky.icky.ptang.zoop.boing.good.
 ADDR icky.icky.icky.ptang.zoop.boing.good.
@@ -153,7 +153,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR _.boing.good.
 ADDR _.zoop.boing.good.
 ADDR a.bit.longer.ns.name.good.
@@ -162,11 +162,11 @@ ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 ADDR _.ptang.zoop.boing.good.
 ADDR _.icky.ptang.zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 ADDR _.icky.icky.ptang.zoop.boing.good.
 ADDR icky.icky.icky.ptang.zoop.boing.good.
 __EOF
@@ -183,7 +183,7 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.6 > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR ns2.bad.
 NS bad.
 NS boing.bad.
@@ -202,7 +202,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR _.boing.bad.
 ADDR _.zoop.boing.bad.
 ADDR a.bit.longer.ns.name.bad.
@@ -211,11 +211,11 @@ ADDR ns2.bad.
 ADDR ns3.bad.
 ADDR ns3.bad.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 ADDR _.ptang.zoop.boing.bad.
 ADDR _.icky.ptang.zoop.boing.bad.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 ADDR _.icky.icky.ptang.zoop.boing.bad.
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
 __EOF
@@ -232,7 +232,7 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.6 > dig.out.test$n
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR ns2.ugly.
 NS boing.ugly.
 NS ugly.
@@ -253,7 +253,7 @@ grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /
 sleep 1
 
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR _.boing.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 ADDR a.bit.longer.ns.name.ugly.
@@ -262,8 +262,8 @@ ADDR ns2.ugly.
 ADDR ns3.ugly.
 ADDR ns3.ugly.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -286,7 +286,7 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.slow.
 ADDR a.bit.longer.ns.name.slow.
 ADDR ns2.slow.
@@ -296,12 +296,12 @@ NS boing.slow.
 NS slow.
 NS zoop.boing.slow.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.slow.
 NS ptang.zoop.boing.slow.
 NS icky.ptang.zoop.boing.slow.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 NS icky.ptang.zoop.boing.slow.
 NS icky.icky.ptang.zoop.boing.slow.
 ADDR icky.icky.icky.ptang.zoop.boing.slow.
@@ -320,7 +320,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. 1 IN PTR nee.com." dig.out.test$n > /dev/null || ret=1
 sleep 1
 grep -v ADDR ans2/query.log > ans2/query.log.trimmed
-cat << __EOF | $DIFF ans2/query.log.trimmed - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.trimmed - > /dev/null || ret=1
 NS 1.0.0.2.ip6.arpa.
 NS 8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
@@ -342,7 +342,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "more.icky.icky.icky.ptang.zoop.boing.good. 1 IN	A 192.0.2.2" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
@@ -352,13 +352,13 @@ NS boing.good.
 NS good.
 NS zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
 NS ptang.zoop.boing.good.
 NS icky.ptang.zoop.boing.good.
 __EOF
 # There's no NS icky.icky.icky.ptang.zoop.boing.good. query - we skipped it.
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 NS icky.ptang.zoop.boing.good.
 NS icky.icky.ptang.zoop.boing.good.
 ADDR more.icky.icky.icky.ptang.zoop.boing.good.
@@ -376,7 +376,7 @@ $DIG $DIGOPTS a.bit.longer.ns.name.fwd. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a.bit.longer.ns.name.fwd. 1	IN	A	10.53.0.4" dig.out.test$n >/dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.fwd.
 __EOF
 for ans in ans2; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
@@ -413,8 +413,8 @@ $DIG $DIGOPTS @10.53.0.5 txt a.b.stale. > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a\.b\.stale\..*1.*IN.*TXT.*peekaboo" dig.out.test$n > /dev/null || ret=1
 sleep 1
-echo "TXT a.b.stale." | $DIFF ans2/query.log - > /dev/null || ret=1
-echo "TXT a.b.stale." | $DIFF ans3/query.log - > /dev/null || ret=1
+echo "TXT a.b.stale." | diff ans2/query.log - > /dev/null || ret=1
+echo "TXT a.b.stale." | diff ans3/query.log - > /dev/null || ret=1
 test -f  ans4/query.log && ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -430,7 +430,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR ns.b.stale.
 ADDR ns2.stale.
 NS b.stale.
@@ -438,7 +438,7 @@ NS stale.
 __EOF
 test -f  ans3/query.log && ret=1
 sort ans4/query.log > ans4/query.log.sorted
-cat << __EOF | $DIFF ans4/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
 ADDR ns.b.stale.
 NS b.stale.
 TXT a.b.stale.
@@ -457,14 +457,14 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR _.b.stale.
 ADDR ns.b.stale.
 ADDR ns2.stale.
 __EOF
 test -f  ans3/query.log && ret=1
 sort ans4/query.log > ans4/query.log.sorted
-cat << __EOF | $DIFF ans4/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
 ADDR ns.b.stale.
 TXT a.b.stale.
 __EOF
@@ -483,8 +483,8 @@ $DIG $DIGOPTS @10.53.0.5 txt a.b.stale. > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a\.b\.stale\..*1.*IN.*TXT.*peekaboo" dig.out.test$n > /dev/null || ret=1
 sleep 1
-echo "TXT a.b.stale." | $DIFF ans2/query.log - > /dev/null || ret=1
-echo "TXT a.b.stale." | $DIFF ans3/query.log - > /dev/null || ret=1
+echo "TXT a.b.stale." | diff ans2/query.log - > /dev/null || ret=1
+echo "TXT a.b.stale." | diff ans3/query.log - > /dev/null || ret=1
 test -f  ans4/query.log && ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -499,13 +499,13 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 NS b.stale.
 NS stale.
 __EOF
 test -f  ans3/query.log && ret=1
 sort ans4/query.log > ans4/query.log.sorted
-cat << __EOF | $DIFF ans4/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
 NS b.stale.
 TXT a.b.stale.
 __EOF
@@ -522,12 +522,12 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR _.b.stale.
 __EOF
 test -f  ans3/query.log && ret=1
 sort ans4/query.log > ans4/query.log.sorted
-cat << __EOF | $DIFF ans4/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
 TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done

bin/tests/system/redirect/tests.sh

@@ -54,11 +54,11 @@ echo_i "checking A zone redirect updates statistics ($n)"
 ret=0
 rm ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
-PRE=`tr -d '\r' < ns2/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
+PRE=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats`
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
 rm ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
-POST=`tr -d '\r' < ns2/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
+POST=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats`
 if [ `expr $POST - $PRE` != 1 ]; then ret=1; fi
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -352,8 +352,8 @@ status=`expr $status + $ret`
 echo_i "checking that redirect zones reload correctly"
 ret=0
 sleep 1 # ensure file mtime will have changed
-tr -d '\r' < ns2/example.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' > ns2/example.db
-tr -d '\r' < ns2/redirect.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' -e 's/\.1$/.2/' > ns2/redirect.db
+cat ns2/example.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' > ns2/example.db
+cat ns2/redirect.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' -e 's/\.1$/.2/' > ns2/redirect.db
 rndc_reload ns2 10.53.0.2
 for i in 1 2 3 4 5 6 7 8 9; do
     tmp=0
@@ -384,8 +384,8 @@ echo_i "checking AAAA nxdomain-redirect works for nonexist ($n)"
 ret=0
 rm ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
-PRE_RED=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
-PRE_SUC=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p"`
+PRE_RED=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats`
+PRE_SUC=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats`
 $DIG $DIGOPTS nonexist. @10.53.0.4 -b 10.53.0.2 aaaa > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "nonexist.	.*2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null || ret=1
@@ -397,8 +397,8 @@ echo_i "checking AAAA nxdomain-redirect updates statistics ($n)"
 ret=0
 rm ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
-POST_RED=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
-POST_SUC=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p"`
+POST_RED=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats`
+POST_SUC=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats`
 if [ `expr $POST_RED - $PRE_RED` != 1 ]; then ret=1; fi
 if [ `expr $POST_SUC - $PRE_SUC` != 1 ]; then ret=1; fi
 n=`expr $n + 1`

bin/tests/system/resolver/ns6/keygen.sh

@@ -28,7 +28,7 @@ infile="${zonefile}.in"
 cp $infile $zonefile
 ksk=`$KEYGEN -q -a rsasha256 -fk $zone`
 zsk=`$KEYGEN -q -a rsasha256 $zone`
-cat $ksk.key $zsk.key dsset-ds.example.net$TP >> $zonefile
+cat $ksk.key $zsk.key dsset-ds.example.net. >> $zonefile
 $SIGNER -P -o $zone $zonefile > /dev/null
 
 # Configure a static key to be used by delv

bin/tests/system/rootkeysentinel/ns1/sign.sh

@@ -22,7 +22,7 @@ keyid=`expr ${keyname} : 'K.+008+\(.*\)'`
 
 (cd ../ns2 && $SHELL sign.sh ${keyid:-00000} )
 
-cp ../ns2/dsset-example$TP .
+cp ../ns2/dsset-example. .
 
 cat $infile $keyname.key > $zonefile
 

bin/tests/system/rpz/setup.sh

@@ -90,7 +90,7 @@ signzone () {
     cat $1/$3 $1/$KEYNAME.key > $1/tmp
     $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
     sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
-    DSFILENAME=dsset-${2}${TP}
+    DSFILENAME=dsset-${2}.
     rm $DSFILENAME $1/tmp
 }
 signzone ns2 tld2s base-tld2s.db tld2s.db

bin/tests/system/rpz/tests.sh

@@ -205,7 +205,7 @@ restart () {
 	    PID=`cat ns$1/named.pid 2>/dev/null`
 	    if test -n "$PID"; then
 		echo_i "killing ns$1 server $PID"
-		$KILL -9 $PID
+		kill -9 $PID
 	    fi
 	fi
     fi
@@ -381,7 +381,7 @@ addr () {
     digcmd $2 >$DIGNM
     #ckalive "$2" "server crashed by 'dig $2'" || return 1
     ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'`
-    ADDR_TTL=`tr -d '\r' < $DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p"`
+    ADDR_TTL=`sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p" $DIGNM`
     if test -z "$ADDR_TTL"; then
 	setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
 	return 1
@@ -768,7 +768,7 @@ EOF
   if [ "$mode" = dnsrps ]; then
     echo_i "checking that dnsrpzd is automatically restarted"
     OLD_PID=`cat dnsrpzd.pid`
-    $KILL "$OLD_PID"
+    kill "$OLD_PID"
     n=0
     while true; do
 	NEW_PID=`cat dnsrpzd.pid 2>/dev/null`

bin/tests/system/rpzrecurse/tests.sh

@@ -238,112 +238,89 @@ for mode in native dnsrps; do
   expect_recurse 5a 5
   expect_recurse 5a 6
 
-  if [ ! "$CYGWIN" -o -n "$PSSUSPEND" ]
-  then
-    # Group 6
-    echo_i "check recursive behavior consistency during policy update races"
-    run_server 6a
+  # Group 6
+  echo_i "check recursive behavior consistency during policy update races"
+  run_server 6a
+  sleep 1
+  t=`expr $t + 1`
+  echo_i "running dig to cache CNAME record (${t})"
+  add_test_marker 10.53.0.1 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
+  sleep 1
+  echo_i "suspending authority server"
+  PID=`cat ns1/named.pid`
+  kill -STOP $PID
+  echo_i "adding an NSDNAME policy"
+  cp ns2/db.6a.00.policy.local ns2/saved.policy.local
+  cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
+  $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
+  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid`
+  sleep 1
+  t=`expr $t + 1`
+  echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
+  add_test_marker 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
+  sleep 1
+  echo_i "removing the NSDNAME policy"
+  cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local
+  $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
+  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid`
+  sleep 1
+  echo_i "resuming authority server"
+  PID=`cat ns1/named.pid`
+  kill -CONT $PID
+  add_test_marker 10.53.0.1
+  for n in 1 2 3 4 5 6 7 8 9
+  do
     sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to cache CNAME record (${t})"
-    add_test_marker 10.53.0.1 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
-    sleep 1
-    echo_i "suspending authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND $PID
-    else
-      $KILL -STOP $PID
-    fi
-    echo_i "adding an NSDNAME policy"
-    cp ns2/db.6a.00.policy.local ns2/saved.policy.local
-    cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
-    $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
-    sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
-    add_test_marker 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
-    sleep 1
-    echo_i "removing the NSDNAME policy"
-    cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local
-    $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
-    sleep 1
-    echo_i "resuming authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND -r $PID
-    else
-      $KILL -CONT $PID
-    fi
-    add_test_marker 10.53.0.1
-    for n in 1 2 3 4 5 6 7 8 9
-    do
-      sleep 1
-      [ -s dig.out.${t} ] || continue
-      grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
-    done
-    grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
-      echo_i "test ${t} failed"
-      status=1
-    }
+    [ -s dig.out.${t} ] || continue
+    grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
+  done
+  grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
+    echo_i "test ${t} failed"
+    status=1
+  }
 
-    echo_i "check recursive behavior consistency during policy removal races"
-    cp ns2/saved.policy.local ns2/db.6a.00.policy.local
-    run_server 6a
+  echo_i "check recursive behavior consistency during policy removal races"
+  cp ns2/saved.policy.local ns2/db.6a.00.policy.local
+  run_server 6a
+  sleep 1
+  t=`expr $t + 1`
+  echo_i "running dig to cache CNAME record (${t})"
+  add_test_marker 10.53.0.1 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
+  sleep 1
+  echo_i "suspending authority server"
+  PID=`cat ns1/named.pid`
+  kill -STOP $PID
+  echo_i "adding an NSDNAME policy"
+  cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
+  $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
+  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid`
+  sleep 1
+  t=`expr $t + 1`
+  echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
+  add_test_marker 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
+  sleep 1
+  echo_i "removing the policy zone"
+  cp ns2/named.default.conf ns2/named.conf
+  rndc_reconfig ns2 10.53.0.2
+  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid`
+  sleep 1
+  echo_i "resuming authority server"
+  PID=`cat ns1/named.pid`
+  kill -CONT $PID
+  add_test_marker 10.53.0.1
+  for n in 1 2 3 4 5 6 7 8 9; do
     sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to cache CNAME record (${t})"
-    add_test_marker 10.53.0.1 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
-    sleep 1
-    echo_i "suspending authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND $PID
-    else
-      $KILL -STOP $PID
-    fi
-    echo_i "adding an NSDNAME policy"
-    cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
-    $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
-    sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
-    add_test_marker 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
-    sleep 1
-    echo_i "removing the policy zone"
-    cp ns2/named.default.conf ns2/named.conf
-    rndc_reconfig ns2 10.53.0.2
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
-    sleep 1
-    echo_i "resuming authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND -r $PID
-    else
-      $KILL -CONT $PID
-    fi
-    add_test_marker 10.53.0.1
-    for n in 1 2 3 4 5 6 7 8 9; do
-      sleep 1
-      [ -s dig.out.${t} ] || continue
-      grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
-    done
-    grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
-      echo_i "test ${t} failed"
-      status=1
-    }
-  fi
+    [ -s dig.out.${t} ] || continue
+    grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
+  done
+  grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
+    echo_i "test ${t} failed"
+    status=1
+  }
 
   # Check maximum number of RPZ zones (64)
   t=`expr $t + 1`

bin/tests/system/rrchecker/tests.sh

@@ -19,17 +19,17 @@ n=0
 n=`expr $n + 1`
 echo_i "class list ($n)"
 $RRCHECKER -C > classlist.out
-$DIFF classlist.out classlist.good || { echo_i "failed"; status=`expr $status + 1`; }
+diff classlist.out classlist.good || { echo_i "failed"; status=`expr $status + 1`; }
 
 n=`expr $n + 1`
 echo_i "type list ($n)"
 $RRCHECKER -T > typelist.out
-$DIFF typelist.out typelist.good || { echo_i "failed"; status=`expr $status + 1`; }
+diff typelist.out typelist.good || { echo_i "failed"; status=`expr $status + 1`; }
 
 n=`expr $n + 1`
 echo_i "private type list ($n)"
 $RRCHECKER -P > privatelist.out
-$DIFF privatelist.out privatelist.good || { echo_i "failed"; status=`expr $status + 1`; }
+diff privatelist.out privatelist.good || { echo_i "failed"; status=`expr $status + 1`; }
 
 myecho() {
 cat << EOF

bin/tests/system/rrl/tests.sh

@@ -84,7 +84,6 @@ burst () {
     done
     ARGS="+burst +nocookie +continue +time=1 +tries=1 -p ${PORT} $* @$ns2 $DOMS"
     $MDIG $ARGS 2>&1 |                                                  \
-        tr -d '\r' |                                                    \
         tee -a full-$FILENAME |                                         \
         sed -n -e '/^;; AUTHORITY/,/^$/d'			        \
 		-e '/^;; ADDITIONAL/,/^$/d'				\
@@ -152,7 +151,7 @@ ckstats () {
     LABEL="$1"; shift
     TYPE="$1"; shift
     EXPECTED="$1"; shift
-    C=`tr -d '\r' < ns2/named.stats |
+    C=`cat ns2/named.stats |
         sed -n -e "s/[	 ]*\([0-9]*\).responses $TYPE for rate limits.*/\1/p" |
         tail -1`
     C=`expr 0$C + 0`
@@ -284,7 +283,7 @@ sleep 2
 grep "min-table-size 1" broken.out > /dev/null || setret "min-table-size 0 was not changed to 1"
 
 if [ -f named.pid ]; then
-    $KILL `cat named.pid`
+    kill `cat named.pid`
     setret "named should not have started, but did"
 fi
 

bin/tests/system/rrsetorder/tests.sh

@@ -37,7 +37,7 @@ if $test_fixed; then
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
     $DIGCMD @10.53.0.1 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good >/dev/null || ret=1
+    diff dig.out.fixed dig.out.fixed.good >/dev/null || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
@@ -52,15 +52,15 @@ else
         if [ $i -le 4 ]; then
             cp dig.out.fixed dig.out.$j
         else
-            $DIFF dig.out.fixed dig.out.$j >/dev/null && matches=`expr $matches + 1`
+            diff dig.out.fixed dig.out.$j >/dev/null && matches=`expr $matches + 1`
         fi
     done
-    $DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-    $DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-    $DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-    $DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-    $DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-    $DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+    diff dig.out.0 dig.out.1 >/dev/null && ret=1
+    diff dig.out.0 dig.out.2 >/dev/null && ret=1
+    diff dig.out.0 dig.out.3 >/dev/null && ret=1
+    diff dig.out.1 dig.out.2 >/dev/null && ret=1
+    diff dig.out.1 dig.out.3 >/dev/null && ret=1
+    diff dig.out.2 dig.out.3 >/dev/null && ret=1
     if [ $matches -ne 16 ]; then ret=1; fi
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
@@ -79,15 +79,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -105,15 +105,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -129,7 +129,7 @@ do
     match=0
     for j in $GOOD_RANDOM
     do
-	eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+	eval "diff dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
 	if [ $match -eq 1 ]; then break; fi
     done
     if [ $match -eq 0 ]; then ret=1; fi
@@ -154,7 +154,7 @@ done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
 	$DIGCMD @10.53.0.1 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+	diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -168,7 +168,7 @@ if $test_fixed; then
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
     $DIGCMD @10.53.0.2 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good || ret=1
+    diff dig.out.fixed dig.out.fixed.good || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
@@ -187,15 +187,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -213,15 +213,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -238,7 +238,7 @@ do
     match=0
     for j in $GOOD_RANDOM
     do
-	eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+	eval "diff dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
 	if [ $match -eq 1 ]; then break; fi
     done
     if [ $match -eq 0 ]; then ret=1; fi
@@ -263,14 +263,14 @@ done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
 	$DIGCMD @10.53.0.2 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+	diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "Shutting down secondary"
 
-(cd ..; $SHELL stop.sh rrsetorder ns2 )
+stop_server rrsetorder ns2
 
 echo_i "Checking for secondary's on disk copy of zone"
 
@@ -293,7 +293,7 @@ if $test_fixed; then
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
     $DIGCMD @10.53.0.2 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good || ret=1
+    diff dig.out.fixed dig.out.fixed.good || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
@@ -312,15 +312,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -338,15 +338,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -363,7 +363,7 @@ do
 	match=0
 	for j in $GOOD_RANDOM
 	do
-		eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+		eval "diff dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
 		if [ $match -eq 1 ]; then break; fi
 	done
 	if [ $match -eq 0 ]; then ret=1; fi
@@ -388,7 +388,7 @@ done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
 	$DIGCMD @10.53.0.2 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+	diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -402,7 +402,7 @@ if $test_fixed; then
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
     $DIGCMD @10.53.0.3 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good || ret=1
+    diff dig.out.fixed dig.out.fixed.good || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
@@ -423,15 +423,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -451,15 +451,15 @@ do
     if [ $i -le 4 ]; then
         cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+        diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -476,7 +476,7 @@ do
 	match=0
 	for j in $GOOD_RANDOM
 	do
-		eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+		eval "diff dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
 		if [ $match -eq 1 ]; then break; fi
 	done
 	if [ $match -eq 0 ]; then ret=1; fi
@@ -500,7 +500,7 @@ done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
 	$DIGCMD @10.53.0.3 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+	diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -517,7 +517,7 @@ do
 	match=0
 	for j in $GOOD_RANDOM
 	do
-		eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+		eval "diff dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
 		if [ $match -eq 1 ]; then break; fi
 	done
 	if [ $match -eq 0 ]; then ret=1; fi
@@ -542,7 +542,7 @@ done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
 	$DIGCMD @10.53.0.4 nomatch.example > dig.out.test$i || ret=1
-	$DIFF dig.out.nomatch dig.out.test$i >/dev/null || ret=1
+	diff dig.out.nomatch dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/rsabigexponent/ns1/sign.sh

@@ -17,7 +17,7 @@ zone=.
 infile=root.db.in
 zonefile=root.db
 
-cp ../ns2/dsset-example.in dsset-example$TP
+cp ../ns2/dsset-example.in dsset-example.
 
 keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
 

bin/tests/system/run.sh.in

@@ -74,7 +74,22 @@ if ! $do_run; then
     if [ "$baseport" -eq 0 ]; then
         log_flags="$log_flags -p 5300"
     fi
-    env - CYGWIN="$CYGWIN" SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" SLOT="$SLOT" SOFTHSM2_CONF="$SOFTHSM2_CONF" PATH="$PATH" ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} TESTS="$*" TEST_SUITE_LOG=run.log LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" LOG_FLAGS="$log_flags" TEST_LARGE_MAP="${TEST_LARGE_MAP}" make -e check
+    env - \
+        SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" \
+        SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" \
+        SLOT="$SLOT" \
+        OPENSSL_CONF="$OPENSSL_CONF" \
+        SOFTHSM2_CONF="$SOFTHSM2_CONF" \
+        SOFTHSM2_MODULE="$SOFTHSM2_MODULE" \
+        PATH="$PATH" \
+        ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} \
+        TESTS="$*" \
+        TEST_SUITE_LOG=run.log \
+        LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" \
+        LOG_FLAGS="$log_flags" \
+        TEST_LARGE_MAP="${TEST_LARGE_MAP}" \
+        CI_ENABLE_ALL_TESTS="${CI_ENABLE_ALL_TESTS}" \
+        make -e check
     exit $?
 fi
 
@@ -117,9 +132,13 @@ fi
 # Determine which ports to use for this system test.
 eval "$(cd "${srcdir}" && ./get_ports.sh -p "$baseport" -t "$systest")"
 
+# Start all servers used by the system test.  Ensure all log files written
+# during a system test (tests.sh + potentially multiple *.py scripts) are
+# retained for each run by calling start.pl with the --restart command-line
+# option for all invocations except the first one.
 start_servers() {
     echoinfo "I:$systest:starting servers"
-    if $restart; then
+    if $restart || [ "$run" -gt 0 ]; then
         restart_opt="--restart"
     fi
     if ! $PERL start.pl ${restart_opt} --port "$PORT" "$systest"; then

bin/tests/system/runall.sh

@@ -1,111 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Run all the system tests.
-#
-# Usage:
-#    runall.sh [-c] [-n] [numprocesses]
-#
-#   -c          Force colored output.
-#
-#   -n          Noclean.  Keep all output files produced by all tests.  These
-#               can later be removed by running "cleanall.sh".
-#
-#   numprocess  Number of concurrent processes to use when running the tests.
-#               The default is one, which causes the tests to run sequentially.
-#               (This is ignored when running on Windows as the tests are always
-#               run sequentially on that platform.)
-
-. ./conf.sh
-
-usage="Usage: ./runall.sh [-c] [-n] [numprocesses]"
-
-# Preserve values of environment variables which are already set.
-
-SYSTEMTEST_FORCE_COLOR=${SYSTEMTEST_FORCE_COLOR:-0}
-SYSTEMTEST_NO_CLEAN=${SYSTEMTEST_NO_CLEAN:-0}
-
-# Handle command line switches if present.
-
-while getopts "cn-" flag; do
-    case "$flag" in
-        c) SYSTEMTEST_FORCE_COLOR=1 ;;
-        n) SYSTEMTEST_NO_CLEAN=1 ;;
-	-) break;;
-	*) exit 1;;
-    esac
-done
-export NOCLEAN
-shift $((OPTIND-1))
-
-# Obtain number of processes to use.
-
-if [ $# -eq 0 ]; then
-    numproc=1
-elif [ $# -eq 1 ]; then
-    if [ "$1" -ne "$1" ] 2>&1; then
-        # Value passed is not numeric
-        echo "$usage" >&2
-        exit 1
-    fi
-    numproc=$1
-else
-    echo "$usage" >&2
-    exit 1
-fi
-
-# Run the tests.
-
-export SYSTEMTEST_FORCE_COLOR
-export SYSTEMTEST_NO_CLEAN
-
-status=0
-
-if [ "$NOPARALLEL" = "" ]; then
-    if [ "$CYGWIN" = "" ]; then
-        # Running on Unix, use "make" to run tests in parallel.
-        make -j "$numproc" check
-        status=$?
-    else
-        # Running on Windows: Cygwin "make" is available, but isn't being
-        # used for the build. So we create a special makefile for the purpose
-        # of parallel execution of system tests, and use that.
-        $SHELL parallel.sh > parallel.mk
-        make -f parallel.mk -j "$numproc" check
-        $SHELL ./runsequential.sh
-        $SHELL ./testsummary.sh || status=1
-    fi
-else
-    # the NOPARALLEL environment variable indicates that tests must be
-    # run sequentially.
-    $PERL testsock.pl || {
-        cat <<-EOF
-	I:NOTE: System tests were skipped because they require the
-	I:      test IP addresses 10.53.0.* to be configured as alias
-	I:      addresses on the loopback interface.  Please run
-	I:      "bin/tests/system/ifconfig.sh up" as root to configure them.
-	EOF
-        exit 1
-    }
-    (
-	status=0
-        for testdir in $SUBDIRS; do
-            $SHELL run.sh -r "$testdir" || status=1
-        done
-	echo "$status" > systests.status
-    ) 2>&1 | tee "systests.output"
-    read -r status < systests.status
-    rm systests.status
-fi
-
-exit "$status"

bin/tests/system/runsequential.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Run system tests that must be run sequentially
-#
-# Note: Use "make check" (or runall.sh) to run all the system tests.  This
-# script will just run those tests that require that each of their nameservers
-# is the only one running on an IP address.
-#
-
-. ./conf.sh
-
-for d in $SEQUENTIALDIRS
-do
-    $SHELL run.sh "${@}" "$d" 2>&1 | tee "test.output.$d"
-done

bin/tests/system/runtime/setup.sh

@@ -26,10 +26,4 @@ copy_setports ns2/named-alt6.conf.in ns2/named-alt6.conf
 copy_setports ns2/named-alt7.conf.in ns2/named-alt7.conf
 
 mkdir ns2/nope
-
-if [ 1 = "${CYGWIN:-0}" ]
-then
-    setfacl -s user::r-x,group::r-x,other::r-x ns2/nope
-else
-    chmod 555 ns2/nope
-fi
+chmod 555 ns2/nope

bin/tests/system/runtime/tests.sh

@@ -27,10 +27,10 @@ kill_named() {
 
 	pid=$(cat "${pidfile}" 2>/dev/null)
 	if [ "${pid:+set}" = "set" ]; then
-		$KILL -15 "${pid}" >/dev/null 2>&1
+		kill -15 "${pid}" >/dev/null 2>&1
 		retries=10
 		while [ "$retries" -gt 0 ]; do
-			if ! $KILL -0 "${pid}" >/dev/null 2>&1; then
+			if ! kill -0 "${pid}" >/dev/null 2>&1; then
 				break
 			fi
 			sleep 1
@@ -63,7 +63,7 @@ run_named() (
 )
 
 check_pid() (
-	return $(! $KILL -0 "${1}" >/dev/null 2>&1)
+	return $(! kill -0 "${1}" >/dev/null 2>&1)
 )
 
 status=0
@@ -85,7 +85,7 @@ testpid=$(run_named ns2 named$n.run -c named-alt2.conf -D runtime-ns2-extra-2 -X
 test -n "$testpid" || ret=1
 retry_quiet 10 check_named_log "another named process" ns2/named$n.run || ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
-test -n "$testpid" && $KILL -15 $testpid > kill$n.out 2>&1 && ret=1
+test -n "$testpid" && kill -15 $testpid > kill$n.out 2>&1 && ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -223,13 +223,11 @@ status=$((status+ret))
 
 n=$((n+1))
 echo_i "verifying that named switches UID ($n)"
-if [ "$(id -u)" -eq 0 ] && [ -z "$CYGWIN" ]; then
+if [ "$(id -u)" -eq 0 ]; then
     ret=0
     TEMP_NAMED_DIR=$(mktemp -d "$(pwd)/ns2/tmp.XXXXXXXX")
     if [ "$?" -eq 0 ]; then
 	copy_setports ns2/named-alt9.conf.in "${TEMP_NAMED_DIR}/named-alt9.conf"
-	export SOFTHSM2_CONF="${TEMP_NAMED_DIR}/softhsm2.conf"
-	sh "$TOP_SRCDIR/bin/tests/prepare-softhsm2.sh"
 	chown -R nobody: "${TEMP_NAMED_DIR}"
 	chmod 0700 "${TEMP_NAMED_DIR}"
 	testpid=$(run_named "${TEMP_NAMED_DIR}" "${TEMP_NAMED_DIR}/named$n.run" -u nobody -c named-alt9.conf)

bin/tests/system/sfcache/ns1/sign.sh

@@ -22,7 +22,7 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL sign.sh )
 
-cp "../ns2/dsset-example$TP" .
+cp "../ns2/dsset-example." .
 
 keyname=$($KEYGEN -q -a "${DEFAULT_ALGORITHM}" -b "${DEFAULT_BITS}" -n zone $zone)