WIP use user+net namespace

WIP namespaces.py
2024-06-24 16:31:21 +02:00 · 2024-06-24 16:30:09 +02:00
263 changed files with 26259 additions and 33789 deletions
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/dtrace.sh		-export-ignore
+/util/mksymtbl.pl		-export-ignore
@@ -1 +0,0 @@
-contrib/gitchangelog/changelog.rc.py
@@ -64,13 +64,6 @@ default:
  # See: https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
  interruptible: true

-  # AWS can interrupt the spot instance anytime, so let's retry the job when
-  # the interruption event happens to avoid a pipeline failure.
-  retry:
-    max: 2
-    when:
-      - runner_system_failure
-
 stages:
  - autoconf
  - precheck
@@ -520,6 +513,18 @@ misc:
      - checklibs.out
    when: on_failure

+changes:
+  <<: *precheck_job
+  except:
+    - pipelines
+  script:
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - perl util/check-changes CHANGES
+    - sh util/check-line-length.sh CHANGES
+    - rm CHANGES.tmp
+  needs: []
+
 black:
  <<: *precheck_job
  needs: []
@@ -576,7 +581,7 @@ pylint:
  variables:
    PYTHONPATH: "${CI_PROJECT_DIR}/bin/tests/system"
  script:
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/|^contrib/)')
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
      # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')

@@ -719,7 +724,6 @@ cross-version-config-tests:
    untracked: true
    expire_in: "1 day"
    when: always
-  allow_failure: true  # GL !9201 removed a test script that v9.20.0 attempts to call in conf.sh

 # Jobs for regular GCC builds on Alpine Linux 3.20 (amd64)

@@ -1244,9 +1248,9 @@ unit:clang:asan:
 gcc:tsan:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread -Wl,-rpath=/usr/local/lib -Wl,--enable-new-dtags"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/usr/local/lib/pkgconfig"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
  <<: *tsan_fedora_40_amd64_image
  <<: *build_job

@@ -46,6 +46,7 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
@@ -191,8 +191,6 @@ Files: **/.clang-format
       .readthedocs.yaml
       .tsan-suppress
       .uncrustify.cfg
-       contrib/gitchangelog/changelog.rc.py
-       contrib/gitchangelog/relnotes.rc.py
       doc/misc/*.zoneopt
       doc/misc/options
       doc/misc/rndc.grammar
@@ -1 +0,0 @@
-doc/arm/changelog.rst
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -20,6 +20,7 @@ information regarding copyright ownership.
 1. [Building BIND](#build)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
+1. [Change log](#changes)
 1. [Acknowledgments](#ack)

 ### <a name="intro"/> Introduction
@@ -48,7 +49,8 @@ ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.

 For a detailed list of changes made throughout the history of BIND 9, see
-the [changelog](doc/arm/changelog.rst).
+the file [CHANGES](CHANGES). See [below](#changes) for details on the
+CHANGES file format.

 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
@@ -161,6 +163,35 @@ can be found in the ISC Knowledgebase at
 Additional information on various subjects can be found in other
 `README` files throughout the source tree.

+### <a name="changes"/> Change log
+
+A detailed list of all changes that have been made throughout the
+development of BIND 9 is included in the file CHANGES, with the most recent
+changes listed first. Change notes include tags indicating the category of
+the change that was made; these categories are:
+
+|Category	|Description	        			|
+|--------------	|-----------------------------------------------|
+| [func] | New feature |
+| [bug] | General bug fix |
+| [security] | Fix for a significant security flaw |
+| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
+| [port] | Portability enhancement |
+| [maint] | Updates to built-in data such as root server addresses and keys |
+| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
+| [performance] | Other changes to improve server performance |
+| [protocol] | Updates to the DNS protocol such as new RR types |
+| [test] | Changes to the automatic tests, not affecting server functionality |
+| [cleanup] | Minor corrections and refactoring |
+| [doc] | Documentation |
+| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
+| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
+
+In general, [func] and [experimental] tags only appear in new-feature
+releases (i.e., those with version numbers ending in zero). Some new
+functionality may be backported to older releases on a case-by-case basis.
+All other change types may be applied to all currently supported releases.
+
 #### Bug report identifiers

 Most notes in the CHANGES file include a reference to a bug report or
@@ -593,7 +593,7 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
-	bool cleanup_dst = false;
+	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
@@ -88,9 +88,6 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  32
-#define MAX_RESTARTS 11
-
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
@@ -133,9 +130,6 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

-static uint32_t maxqueries = MAX_QUERIES;
-static uint32_t restarts = MAX_RESTARTS;
-
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -1197,23 +1191,6 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a': /* maxqueries */
-			FULLCHECK("maxqueries");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&maxqueries, value, UINT_MAX,
-					    "maxqueries");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse maxqueries");
-			}
-			if (maxqueries == 0) {
-				fatal("maxqueries must be nonzero");
-			}
-			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1266,22 +1243,6 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'e': /* restarts */
-			FULLCHECK("restarts");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&restarts, value, 255, "restarts");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse restarts");
-			}
-			if (restarts == 0) {
-				fatal("restarts must be between 1..255");
-			}
-			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1409,7 +1370,10 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-	need_value:
+		/*
+		 * We can also add a "need_value:" case here if we ever
+		 * add a plus-option that requires a specified value
+		 */
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
@@ -1934,7 +1898,6 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
-	dns_client_setmaxrestarts(client, restarts);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2154,22 +2117,15 @@ cleanup:

 static isc_result_t
 matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, ns_server_t *lsctx,
-	  isc_loop_t *loop, isc_job_cb cb, void *cbarg,
-	  isc_result_t *sigresultp, isc_result_t *viewpatchresultp,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
 	  dns_view_t **viewp) {
 	UNUSED(srcaddr);
 	UNUSED(destaddr);
 	UNUSED(message);
 	UNUSED(env);
-	UNUSED(lsctx);
-	UNUSED(loop);
-	UNUSED(cb);
-	UNUSED(cbarg);
 	UNUSED(sigresultp);

 	*viewp = view;
-	*viewpatchresultp = ISC_R_SUCCESS;
 	return (ISC_R_SUCCESS);
 }

@@ -2191,7 +2147,7 @@ run_server(void *arg) {
 	isc_sockaddr_any(&any);
 	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
-				     NULL, &interfacemgr));
+				     NULL, false, &interfacemgr));

 	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
 			      &view));
@@ -2199,7 +2155,6 @@ run_server(void *arg) {
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
-	dns_view_setmaxrestarts(view, restarts);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2213,7 +2168,6 @@ run_server(void *arg) {

 	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
 				      dispatch, NULL));
-	dns_resolver_setmaxqueries(view->resolver, maxqueries);

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -337,18 +337,6 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

-.. option:: +restarts
-
-   When name server mode (``delv +ns``) is in use, this option sets the
-   maximum number of CNAME queries to follow before terminating resolution.
-   This prevents ``delv`` from hanging in the event of a CNAME loop.
-   The default is 11.
-
-.. option:: +maxqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 32.
-
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -748,7 +748,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		char *hash;
 		int pf;

-		printf("- type: MESSAGE\n");
+		printf("-\n");
+		printf("  type: MESSAGE\n");
 		printf("  message:\n");

 		if (isquery) {
@@ -3305,7 +3306,8 @@ dig_error(const char *format, ...) {
 	va_list args;

 	if (yaml) {
-		printf("- type: DIG_ERROR\n");
+		printf("-\n");
+		printf("  type: DIG_ERROR\n");

 		/*
 		 * Print an indent before a literal block quote.
@@ -3322,7 +3324,10 @@ dig_error(const char *format, ...) {
 	va_start(args, format);
 	vprintf(format, args);
 	va_end(args);
-	printf("\n"); /* We get the error without a newline */
+
+	if (!yaml) {
+		printf("\n");
+	}
 }

 static void
@@ -3231,7 +3231,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_udp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -3423,10 +3423,10 @@ force_next(dig_query_t *query) {
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));

-		dighost_error("no response from %s", buf);
+		dighost_error("no response from %s\n", buf);
 	} else {
 		printf("%s", l->cmdline);
-		dighost_error("no servers could be reached");
+		dighost_error("no servers could be reached\n");
 	}

 	if (exitcode < 9) {
@@ -3650,7 +3650,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_tcp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -4103,7 +4103,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 			 * and cancel the lookup.
 			 */
 			printf("%s", l->cmdline);
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");

 			if (exitcode < 9) {
 				exitcode = 9;
@@ -4237,15 +4237,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		goto keep_query;
 	}

-	if (msg->counts[DNS_SECTION_QUESTION] == 0) {
-		if (l->doing_xfr) {
-			if (query->msg_count == 0) {
-				dighost_warning("missing question section");
-			}
-		} else if (!l->header_only && msg->opcode == dns_opcode_query) {
-			dighost_warning("missing question section");
-		}
-	} else {
+	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 		     result == ISC_R_SUCCESS && match;
@@ -183,7 +183,6 @@ retry:
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
-		INSIST(bufsize <= (UINT_MAX / 2));
 		bufsize *= 2;
 		goto retry;
 	}
@@ -189,7 +189,6 @@ printrdata(dns_rdata_t *rdata) {
 			check_result(result, "dns_rdata_totext");
 		}
 		isc_buffer_free(&b);
-		INSIST(size <= (UINT_MAX / 2));
 		size *= 2;
 	}
 }
@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -89,11 +89,6 @@ Options
   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
   Only works in combination with smart signing (``-S``).

-.. option:: -J filename
-
-   This option tells :program:`dnssec-signzone` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -K directory

   This option specifies the directory to search for DNSSEC keys. If not
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -53,11 +53,6 @@ Options
   format containing updates can be verified independently.
   This option is not useful for non-dynamic zones.

-.. option:: -J filename
-
-   This option tells :program:`dnssec-verify` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -o origin

   This option indicates the zone origin. If not specified, the name of the zone file is
@@ -109,7 +109,6 @@ options {\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
-	sig0checks-quota 1;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -170,8 +169,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 32;\n\
-	max-query-restarts 11;\n\
+	max-recursion-queries 100;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -224,10 +222,8 @@ options {\n\
 	ixfr-from-differences false;\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
-	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
-	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
@@ -278,26 +278,6 @@ struct zonelistentry {
 	ISC_LINK(struct zonelistentry) link;
 };

-/*%
- * Message-to-view matching context to run message signature validation
- * asynchronously.
- */
-typedef struct matching_view_ctx {
-	isc_netaddr_t *srcaddr;
-	isc_netaddr_t *destaddr;
-	dns_message_t *message;
-	dns_aclenv_t *env;
-	ns_server_t *sctx;
-	isc_loop_t *loop;
-	isc_job_cb cb;
-	void *cbarg;
-	isc_result_t *sigresult;
-	isc_result_t *viewmatchresult;
-	isc_result_t quota_result;
-	dns_view_t **viewp;
-	dns_view_t *view;
-} matching_view_ctx_t;
-
 /*%
 * Configuration context to retain for each view that allows
 * new zones to be added at runtime.
@@ -342,12 +322,6 @@ typedef struct catz_chgzone {
 	bool mod;
 } catz_chgzone_t;

-typedef struct catz_reconfig_data {
-	dns_catz_zone_t *catz;
-	const cfg_obj_t *config;
-	catz_cb_data_t *cbd;
-} catz_reconfig_data_t;
-
 typedef enum {
 	CATZ_ADDZONE,
 	CATZ_MODZONE,
@@ -472,7 +446,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       const cfg_obj_t *vconfig, dns_view_t *view,
 	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
 	       dns_keystorelist_t *keystores, cfg_aclconfctx_t *aclconf,
-	       bool added, bool old_rpz_ok, bool is_catz_member, bool modify);
+	       bool added, bool old_rpz_ok, bool modify);

 static void
 configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
@@ -2686,13 +2660,13 @@ catz_addmodzone_cb(void *arg) {
 		goto cleanup;
 	}

-	/*
-	 * A non-empty 'catalog-zones' statement implies that 'allow-new-zones'
-	 * is true, so this is expected to be non-NULL.
-	 */
 	cfg = (ns_cfgctx_t *)cz->view->new_zone_config;
 	if (cfg == NULL) {
-		CHECK(ISC_R_FAILURE);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "catz: allow-new-zones statement missing from "
+			      "config; cannot add zone from the catalog");
+		goto cleanup;
 	}

 	name = dns_catz_entry_getname(cz->entry);
@@ -2801,7 +2775,7 @@ catz_addmodzone_cb(void *arg) {
 		isc_buffer_free(&confbuf);
 	}
 	/*
-	 * Fail if either dns_catz_generate_zonecfg() or cfg_parse_buffer()
+	 * Fail if either dns_catz_generate_zonecfg() or cfg_parse_buffer3()
 	 * failed.
 	 */
 	if (result != ISC_R_SUCCESS) {
@@ -2827,7 +2801,7 @@ catz_addmodzone_cb(void *arg) {
 				&cz->cbd->server->viewlist,
 				&cz->cbd->server->kasplist,
 				&cz->cbd->server->keystorelist, cfg->actx, true,
-				false, true, cz->mod);
+				false, cz->mod);
 	dns_view_freeze(cz->view);
 	isc_loopmgr_resume(named_g_loopmgr);

@@ -3039,88 +3013,6 @@ catz_changeview(dns_catz_entry_t *entry, void *arg1, void *arg2) {
 	dns_zone_detach(&zone);
 }

-static void
-catz_reconfigure(dns_catz_entry_t *entry, void *arg1, void *arg2) {
-	dns_view_t *view = arg1;
-	catz_reconfig_data_t *data = arg2;
-	isc_buffer_t namebuf;
-	isc_buffer_t *confbuf = NULL;
-	const cfg_obj_t *zlist = NULL;
-	char nameb[DNS_NAME_FORMATSIZE];
-	cfg_obj_t *zoneconf = NULL;
-	cfg_obj_t *zoneobj = NULL;
-	ns_cfgctx_t *cfg = NULL;
-	dns_zone_t *zone = NULL;
-	isc_result_t result;
-
-	isc_buffer_init(&namebuf, nameb, DNS_NAME_FORMATSIZE);
-	dns_name_totext(dns_catz_entry_getname(entry), DNS_NAME_OMITFINALDOT,
-			&namebuf);
-	isc_buffer_putuint8(&namebuf, 0);
-
-	result = dns_view_findzone(view, dns_catz_entry_getname(entry),
-				   DNS_ZTFIND_EXACT, &zone);
-	if (result != ISC_R_SUCCESS) {
-		return;
-	}
-
-	/*
-	 * A non-empty 'catalog-zones' statement implies that 'allow-new-zones'
-	 * is true, so this is expected to be non-NULL.
-	 */
-	cfg = (ns_cfgctx_t *)view->new_zone_config;
-	if (cfg == NULL) {
-		CHECK(ISC_R_FAILURE);
-	}
-
-	result = dns_catz_generate_zonecfg(data->catz, entry, &confbuf);
-	if (result == ISC_R_SUCCESS) {
-		cfg_parser_reset(cfg->add_parser);
-		result = cfg_parse_buffer(cfg->add_parser, confbuf, "catz", 0,
-					  &cfg_type_addzoneconf, 0, &zoneconf);
-		isc_buffer_free(&confbuf);
-	}
-	/*
-	 * Fail if either dns_catz_generate_zonecfg() or cfg_parse_buffer()
-	 * failed.
-	 */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "catz_reconfigure: error \"%s\" while trying to "
-			      "generate config for member zone '%s'",
-			      isc_result_totext(result), nameb);
-		goto cleanup;
-	}
-
-	CHECK(cfg_map_get(zoneconf, "zone", &zlist));
-	if (!cfg_obj_islist(zlist)) {
-		CHECK(ISC_R_FAILURE);
-	}
-	zoneobj = cfg_listelt_value(cfg_list_first(zlist));
-
-	result = configure_zone(data->config, zoneobj, cfg->vconfig, view,
-				&data->cbd->server->viewlist,
-				&data->cbd->server->kasplist,
-				&data->cbd->server->keystorelist, cfg->actx,
-				true, false, true, true);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "catz_reconfigure : error \"%s\" while trying to "
-			      "reconfigure member zone '%s'",
-			      isc_result_totext(result), nameb);
-		goto cleanup;
-	}
-
-cleanup:
-	if (zoneconf != NULL) {
-		cfg_obj_destroy(cfg->add_parser, &zoneconf);
-	}
-
-	dns_zone_detach(&zone);
-}
-
 static isc_result_t
 configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 		    const cfg_obj_t *config, const cfg_listelt_t *element) {
@@ -3150,21 +3042,12 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,

 	result = dns_catz_zone_add(view->catzs, &origin, &zone);
 	if (result == ISC_R_EXISTS) {
-		catz_reconfig_data_t data = {
-			.catz = zone,
-			.config = config,
-			.cbd = (catz_cb_data_t *)dns_catz_zones_get_udata(
-				view->catzs),
-		};
-
 		/*
-		 * We have to walk through all the member zones, re-attach
-		 * them to the current view and reconfigure
+		 * We have to walk through all the member zones and re-attach
+		 * them to current view
 		 */
 		dns_catz_zone_for_each_entry2(zone, catz_changeview, pview,
 					      view);
-		dns_catz_zone_for_each_entry2(zone, catz_reconfigure, view,
-					      &data);
 	}

 	dns_catz_zone_resetdefoptions(zone);
@@ -4255,7 +4138,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		CHECK(configure_zone(config, zconfig, vconfig, view, viewlist,
 				     kasplist, keystores, actx, false,
-				     old_rpz_ok, false, false));
+				     old_rpz_ok, false));
 		zone_element_latest = element;
 	}

@@ -5571,24 +5454,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	dns_resolver_setclientsperquery(view->resolver, cfg_obj_asuint32(obj),
 					max_clients_per_query);

-	/*
-	 * This is used for the cache and also as a default value
-	 * for zone databases.
-	 */
-	obj = NULL;
-	result = named_config_get(maps, "max-records-per-type", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	dns_view_setmaxrrperset(view, cfg_obj_asuint32(obj));
-
-	/*
-	 * This is used for the cache and also as a default value
-	 * for zone databases.
-	 */
-	obj = NULL;
-	result = named_config_get(maps, "max-types-per-name", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	dns_view_setmaxtypepername(view, cfg_obj_asuint32(obj));
-
 	obj = NULL;
 	result = named_config_get(maps, "max-recursion-depth", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -5599,11 +5464,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	dns_resolver_setmaxqueries(view->resolver, cfg_obj_asuint32(obj));

-	obj = NULL;
-	result = named_config_get(maps, "max-query-restarts", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	dns_view_setmaxrestarts(view, cfg_obj_asuint32(obj));
-
 	obj = NULL;
 	result = named_config_get(maps, "max-validations-per-fetch", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -6594,7 +6454,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       const cfg_obj_t *vconfig, dns_view_t *view,
 	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
 	       dns_keystorelist_t *keystores, cfg_aclconfctx_t *aclconf,
-	       bool added, bool old_rpz_ok, bool is_catz_member, bool modify) {
+	       bool added, bool old_rpz_ok, bool modify) {
 	dns_view_t *pview = NULL; /* Production view */
 	dns_zone_t *zone = NULL;  /* New or reused zone */
 	dns_zone_t *raw = NULL;	  /* New or reused raw zone */
@@ -6830,7 +6690,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		}
 	}

-	if (!is_catz_member && view->catzs != NULL &&
+	if (view->catzs != NULL &&
 	    dns_catz_zone_get(view->catzs, origin) != NULL)
 	{
 		zone_is_catz = true;
@@ -7966,7 +7826,7 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				     &named_g_server->viewlist,
 				     &named_g_server->kasplist,
 				     &named_g_server->keystorelist, actx, true,
-				     false, false, false));
+				     false, false));
 	}

 	result = ISC_R_SUCCESS;
@@ -8151,7 +8011,7 @@ configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
 	return (configure_zone(
 		config, zconfig, vconfig, view, &named_g_server->viewlist,
 		&named_g_server->kasplist, &named_g_server->keystorelist, actx,
-		true, false, false, false));
+		true, false, false));
 }

 /*%
@@ -8534,8 +8394,6 @@ load_configuration(const char *filename, named_server_t *server,
 	configure_server_quota(maps, "recursive-clients",
 			       &server->sctx->recursionquota);
 	configure_server_quota(maps, "update-quota", &server->sctx->updquota);
-	configure_server_quota(maps, "sig0checks-quota",
-			       &server->sctx->sig0checksquota);

 	max = isc_quota_getmax(&server->sctx->recursionquota);
 	if (max > 1000) {
@@ -8554,16 +8412,8 @@ load_configuration(const char *filename, named_server_t *server,
 	} else {
 		softquota = (max * 90) / 100;
 	}
-	isc_quota_soft(&server->sctx->recursionquota, softquota);

-	obj = NULL;
-	result = named_config_get(maps, "sig0checks-quota-exempt", &obj);
-	if (result == ISC_R_SUCCESS) {
-		result = cfg_acl_fromconfig(
-			obj, config, named_g_lctx, named_g_aclconfctx,
-			named_g_mctx, 0, &server->sctx->sig0checksquota_exempt);
-		INSIST(result == ISC_R_SUCCESS);
-	}
+	isc_quota_soft(&server->sctx->recursionquota, softquota);

 	/*
 	 * Set "blackhole". Only legal at options level; there is
@@ -8996,6 +8846,15 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "interface-interval", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	interface_interval = cfg_obj_asduration(obj);
+	if (server->interface_timer != NULL) {
+		if (interface_interval == 0) {
+			isc_timer_stop(server->interface_timer);
+		} else if (server->interface_interval != interface_interval) {
+			isc_interval_set(&interval, interface_interval, 0);
+			isc_timer_start(server->interface_timer,
+					isc_timertype_ticker, &interval);
+		}
+	}
 	server->interface_interval = interface_interval;

 	/*
@@ -9006,35 +8865,6 @@ load_configuration(const char *filename, named_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	server->sctx->interface_auto = cfg_obj_asboolean(obj);

-	if (server->sctx->interface_auto) {
-		if (ns_interfacemgr_dynamic_updates_are_reliable() &&
-		    server->interface_interval != 0)
-		{
-			/*
-			 * In some cases the user might expect a certain
-			 * behaviour from the rescan timer, let's try to deduce
-			 * that from the configuration options.
-			 */
-			isc_log_write(
-				named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				"Disabling periodic interface re-scans timer");
-			server->interface_interval = 0;
-		}
-
-		ns_interfacemgr_routeconnect(server->interfacemgr);
-	} else {
-		ns_interfacemgr_routedisconnect(server->interfacemgr);
-	}
-
-	if (server->interface_interval == 0) {
-		isc_timer_stop(server->interface_timer);
-	} else {
-		isc_interval_set(&interval, interface_interval, 0);
-		isc_timer_start(server->interface_timer, isc_timertype_ticker,
-				&interval);
-	}
-
 	/*
 	 * Configure the dialup heartbeat timer.
 	 */
@@ -10035,12 +9865,26 @@ run_server(void *arg) {

 	CHECKFATAL(ns_interfacemgr_create(named_g_mctx, server->sctx,
 					  named_g_loopmgr, named_g_netmgr,
-					  named_g_dispatchmgr, geoip,
+					  named_g_dispatchmgr, geoip, true,
 					  &server->interfacemgr),
 		   "creating interface manager");

-	isc_timer_create(named_g_mainloop, interface_timer_tick, server,
-			 &server->interface_timer);
+	/*
+	 * In some cases the user might expect a certain behaviour from
+	 * the rescan timer, let's try to deduce that from the
+	 * configuration options.
+	 */
+	if ((ns_interfacemgr_dynamic_updates_are_reliable() &&
+	     server->interface_auto) ||
+	    (server->interface_interval == 0))
+	{
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "Disabling periodic interface re-scans timer");
+	} else {
+		isc_timer_create(named_g_mainloop, interface_timer_tick, server,
+				 &server->interface_timer);
+	}

 	isc_timer_create(named_g_mainloop, heartbeat_timer_tick, server,
 			 &server->heartbeat_timer);
@@ -10155,7 +9999,9 @@ shutdown_server(void *arg) {
 		isc_mem_put(server->mctx, nsc, sizeof(*nsc));
 	}

-	isc_timer_destroy(&server->interface_timer);
+	if (server->interface_timer != NULL) {
+		isc_timer_destroy(&server->interface_timer);
+	}
 	isc_timer_destroy(&server->heartbeat_timer);
 	isc_timer_destroy(&server->pps_timer);
 	isc_timer_destroy(&server->tat_timer);
@@ -10179,19 +10025,18 @@ shutdown_server(void *arg) {
 	isc_loopmgr_resume(named_g_loopmgr);
 }

+/*%
+ * Find a view that matches the source and destination addresses of a query.
+ */
 static isc_result_t
-get_matching_view_sync(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		       dns_message_t *message, dns_aclenv_t *env,
-		       isc_result_t *sigresult, dns_view_t **viewp) {
+get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
+		  dns_message_t *message, dns_aclenv_t *env,
+		  isc_result_t *sigresult, dns_view_t **viewp) {
 	dns_view_t *view;

-	/*
-	 * We should not be running synchronous view matching if signature
-	 * checking involves SIG(0). TSIG has priority of SIG(0), so if TSIG
-	 * is set then we proceed anyway.
-	 */
-	INSIST(message->tsigkey != NULL || message->tsig != NULL ||
-	       message->sig0 == NULL);
+	REQUIRE(message != NULL);
+	REQUIRE(sigresult != NULL);
+	REQUIRE(viewp != NULL && *viewp == NULL);

 	for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
@@ -10201,10 +10046,12 @@ get_matching_view_sync(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		{
 			const dns_name_t *tsig = NULL;

-			dns_message_resetsig(message);
-			*sigresult = dns_message_checksig(message, view);
+			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
-				tsig = dns_tsigkey_identity(message->tsigkey);
+				dns_tsigkey_t *tsigkey;
+
+				tsigkey = message->tsigkey;
+				tsig = dns_tsigkey_identity(tsigkey);
 			}

 			if (dns_acl_allowed(srcaddr, tsig, view->matchclients,
@@ -10223,191 +10070,6 @@ get_matching_view_sync(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 	return (ISC_R_NOTFOUND);
 }

-static void
-get_matching_view_done(void *cbarg) {
-	matching_view_ctx_t *mvctx = cbarg;
-	dns_message_t *message = mvctx->message;
-
-	if (*mvctx->viewmatchresult == ISC_R_SUCCESS) {
-		INSIST(mvctx->view != NULL);
-		dns_view_attach(mvctx->view, mvctx->viewp);
-	}
-
-	mvctx->cb(mvctx->cbarg);
-
-	if (mvctx->quota_result == ISC_R_SUCCESS) {
-		isc_quota_release(&mvctx->sctx->sig0checksquota);
-	}
-	if (mvctx->view != NULL) {
-		dns_view_detach(&mvctx->view);
-	}
-	isc_loop_detach(&mvctx->loop);
-	ns_server_detach(&mvctx->sctx);
-	isc_mem_put(message->mctx, mvctx, sizeof(*mvctx));
-	dns_message_detach(&message);
-}
-
-static dns_view_t *
-get_matching_view_next(dns_view_t *view, dns_rdataclass_t rdclass) {
-	if (view == NULL) {
-		view = ISC_LIST_HEAD(named_g_server->viewlist);
-	} else {
-		view = ISC_LIST_NEXT(view, link);
-	}
-	while (true) {
-		if (view == NULL || rdclass == view->rdclass ||
-		    rdclass == dns_rdataclass_any)
-		{
-			return (view);
-		}
-		view = ISC_LIST_NEXT(view, link);
-	};
-}
-
-static void
-get_matching_view_continue(void *cbarg, isc_result_t result) {
-	matching_view_ctx_t *mvctx = cbarg;
-	dns_view_t *view = NULL;
-	const dns_name_t *tsig = NULL;
-
-	*mvctx->sigresult = result;
-
-	if (result == ISC_R_SUCCESS) {
-		tsig = dns_tsigkey_identity(mvctx->message->tsigkey);
-	}
-
-	if (dns_acl_allowed(mvctx->srcaddr, tsig, mvctx->view->matchclients,
-			    mvctx->env) &&
-	    dns_acl_allowed(mvctx->destaddr, tsig,
-			    mvctx->view->matchdestinations, mvctx->env) &&
-	    !(mvctx->view->matchrecursiveonly &&
-	      (mvctx->message->flags & DNS_MESSAGEFLAG_RD) == 0))
-	{
-		/*
-		 * A matching view is found.
-		 */
-		*mvctx->viewmatchresult = ISC_R_SUCCESS;
-		get_matching_view_done(cbarg);
-		return;
-	}
-
-	dns_message_resetsig(mvctx->message);
-
-	view = get_matching_view_next(mvctx->view, mvctx->message->rdclass);
-	dns_view_detach(&mvctx->view);
-	if (view != NULL) {
-		/*
-		 * Try the next view.
-		 */
-		dns_view_attach(view, &mvctx->view);
-		result = dns_message_checksig_async(
-			mvctx->message, view, mvctx->loop,
-			get_matching_view_continue, mvctx);
-		INSIST(result == DNS_R_WAIT);
-		return;
-	}
-
-	/*
-	 * No matching view is found.
-	 */
-	*mvctx->viewmatchresult = ISC_R_NOTFOUND;
-	get_matching_view_done(cbarg);
-}
-
-/*%
- * Find a view that matches the source and destination addresses of a query.
- */
-static isc_result_t
-get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		  dns_message_t *message, dns_aclenv_t *env, ns_server_t *sctx,
-		  isc_loop_t *loop, isc_job_cb cb, void *cbarg,
-		  isc_result_t *sigresult, isc_result_t *viewmatchresult,
-		  dns_view_t **viewp) {
-	dns_view_t *view = NULL;
-	isc_result_t result;
-
-	REQUIRE(message != NULL);
-	REQUIRE(sctx != NULL);
-	REQUIRE(loop == NULL || cb != NULL);
-	REQUIRE(sigresult != NULL);
-	REQUIRE(viewmatchresult != NULL);
-	REQUIRE(viewp != NULL && *viewp == NULL);
-
-	/* No offloading is requested if the loop is unset. */
-	if (loop == NULL) {
-		*viewmatchresult = get_matching_view_sync(
-			srcaddr, destaddr, message, env, sigresult, viewp);
-		return (*viewmatchresult);
-	}
-
-	/* Also no offloading when there is no view at all to match against. */
-	view = get_matching_view_next(NULL, message->rdclass);
-	if (view == NULL) {
-		*viewmatchresult = ISC_R_NOTFOUND;
-		return (*viewmatchresult);
-	}
-
-	dns_message_resetsig(message);
-
-	matching_view_ctx_t *mvctx = isc_mem_get(message->mctx, sizeof(*mvctx));
-	*mvctx = (matching_view_ctx_t){
-		.srcaddr = srcaddr,
-		.destaddr = destaddr,
-		.env = env,
-		.cb = cb,
-		.cbarg = cbarg,
-		.sigresult = sigresult,
-		.viewmatchresult = viewmatchresult,
-		.quota_result = ISC_R_UNSET,
-		.viewp = viewp,
-	};
-	ns_server_attach(sctx, &mvctx->sctx);
-	isc_loop_attach(loop, &mvctx->loop);
-	dns_message_attach(message, &mvctx->message);
-
-	/*
-	 * If the message has a SIG0 signature which we are going to
-	 * check, and the client is not exempt from the SIG(0) quota,
-	 * then acquire a quota. TSIG has priority over SIG(0), so if
-	 * TSIG is set then we don't care.
-	 */
-	if (message->tsigkey == NULL && message->tsig == NULL &&
-	    message->sig0 != NULL)
-	{
-		if (sctx->sig0checksquota_exempt != NULL) {
-			int exempt_match;
-
-			result = dns_acl_match(srcaddr, NULL,
-					       sctx->sig0checksquota_exempt,
-					       env, &exempt_match, NULL);
-			if (result == ISC_R_SUCCESS && exempt_match > 0) {
-				mvctx->quota_result = ISC_R_EXISTS;
-			}
-		}
-		if (mvctx->quota_result == ISC_R_UNSET) {
-			mvctx->quota_result =
-				isc_quota_acquire(&sctx->sig0checksquota);
-		}
-		if (mvctx->quota_result == ISC_R_SOFTQUOTA) {
-			isc_quota_release(&sctx->sig0checksquota);
-		}
-		if (mvctx->quota_result != ISC_R_SUCCESS &&
-		    mvctx->quota_result != ISC_R_EXISTS)
-		{
-			*mvctx->viewmatchresult = ISC_R_QUOTA;
-			isc_async_run(loop, get_matching_view_done, mvctx);
-			return (DNS_R_WAIT);
-		}
-	}
-
-	dns_view_attach(view, &mvctx->view);
-	result = dns_message_checksig_async(message, view, loop,
-					    get_matching_view_continue, mvctx);
-	INSIST(result == DNS_R_WAIT);
-
-	return (DNS_R_WAIT);
-}
-
 void
 named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	isc_result_t result;
@@ -10869,24 +10531,13 @@ isc_result_t
 named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 			       isc_buffer_t **text) {
 	isc_result_t result;
-	const char *arg = NULL;
 	dns_zone_t *zone = NULL;
 	dns_zone_t *raw = NULL;
 	dns_zonetype_t type;
-	bool force = false;

 	REQUIRE(text != NULL);

-	/* Skip the command name. */
-	(void)next_token(lex, text);
-
-	arg = next_token(lex, text);
-	if (arg != NULL && (strcmp(arg, "-force") == 0)) {
-		force = true;
-		arg = next_token(lex, text);
-	}
-
-	result = zone_from_args(server, lex, arg, &zone, NULL, text, false);
+	result = zone_from_args(server, lex, NULL, &zone, NULL, text, true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -10905,10 +10556,7 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 	    (type == dns_zone_redirect &&
 	     dns_zone_getredirecttype(zone) == dns_zone_secondary))
 	{
-		if (force) {
-			dns_zone_stopxfr(zone);
-		}
-		dns_zone_forcexfr(zone);
+		dns_zone_forcereload(zone);
 	} else {
 		(void)putstr(text, "retransfer: inappropriate zone type: ");
 		(void)putstr(text, dns_zonetype_name(type));
@@ -13802,7 +13450,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, view,
 				&server->viewlist, &server->kasplist,
 				&server->keystorelist, cfg->actx, true, false,
-				false, false);
+				false);
 	dns_view_freeze(view);

 	isc_loopmgr_resume(named_g_loopmgr);
@@ -13988,7 +13636,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, view,
 				&server->viewlist, &server->kasplist,
 				&server->keystorelist, cfg->actx, true, false,
-				false, true);
+				true);
 	dns_view_freeze(view);

 	isc_loopmgr_resume(named_g_loopmgr);
@@ -1074,22 +1074,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setmaxrecords(zone, 0);
 	}

-	obj = NULL;
-	result = named_config_get(maps, "max-records-per-type", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxrrperset(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxrrperset(zone, 0);
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "max-types-per-name", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxtypepername(zone, 0);
-	}
-
 	if (raw != NULL && filename != NULL) {
 #define SIGNED ".signed"
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
@@ -444,16 +444,14 @@ Currently supported commands are:

 .. program:: rndc

-.. option:: retransfer [-force] zone [class [view]]
+.. option:: retransfer zone [class [view]]

   This command retransfers the given secondary zone from the primary server.

   If the zone is configured to use ``inline-signing``, the signed
   version of the zone is discarded; after the retransfer of the
   unsigned version is complete, the signed version is regenerated
-   with new signatures. With the optional ``-force`` argument provided
-   if there is an ongoing zone transfer it will be aborted before a new zone
-   transfer is scheduled.
+   with new signatures.

 .. option:: scan

@@ -157,7 +157,10 @@ $DSFROMKEY $ksk.key >dsset-${zone}.
 # None of these algorithms are supported for signing in FIPS mode
 # as they are MD5 and SHA1 based.
 #
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if (
+  cd ..
+  $SHELL ../testcrypto.sh -q RSASHA1
+); then
  setup nsec-only.example
  cp $infile $zonefile
  ksk=$($KEYGEN -q -a RSASHA1 -fk $zone 2>kg.out) || dumpit kg.out
@@ -892,7 +892,7 @@ checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.optout.example 10.53.0.3 || ret=1
 checkprivate nsec3-to-nsec.example 10.53.0.3 2 || ret=1  # automatically removed
 checkprivate nsec3-to-nsec3.example 10.53.0.3 2 || ret=1 # automatically removed
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if $SHELL ../testcrypto.sh -q RSASHA1; then
  checkprivate nsec-only.example 10.53.0.3 || ret=1
 fi
 checkprivate oldsigs.example 10.53.0.3 2 || ret=1 # pre-signed
@@ -1252,7 +1252,7 @@ del=$(grep "DNSKEY .* is now deleted" ns2/named.run | wc -l)
 [ "$del" -eq 0 ] || ret=1
 pub=$(grep "DNSKEY .* is now published" ns3/named.run | grep -v "CDNSKEY" | wc -l)
 act=$(grep "DNSKEY .* is now active" ns3/named.run | wc -l)
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if $SHELL ../testcrypto.sh -q RSASHA1; then
  # Include two log lines for nsec-only zone.
  [ "$pub" -eq 53 ] || ret=1
  [ "$act" -eq 53 ] || ret=1
@@ -29,7 +29,6 @@ options {
 	notify no;
 	notify-delay 0;
 	recursion no;
-#T5	allow-query { 10.53.0.99; };
 	serial-query-rate 100;
 	dnssec-validation no;
 };
@@ -702,23 +702,6 @@ wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-# GL #4733
-n=$((n + 1))
-echo_i "reconfiguring secondary - checking if catz member zones are reconfigured ($n)"
-ret=0
-sed -e "s/^#T5//" <ns2/named1.conf.in >ns2/named.conf.tmp
-copy_setports ns2/named.conf.tmp ns2/named.conf
-rndccmd 10.53.0.2 reconfig || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "checking that dom3.example. is refused by secondary because of an activated allow-query ($n)"
-ret=0
-wait_for_no_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 n=$((n + 1))
 echo_i "reconfiguring secondary - reverting the bad configuration ($n)"
 ret=0
@@ -37,28 +37,11 @@ key rndc_key {
 	algorithm @DEFAULT_HMAC@;
 };

-key restart16 {
-	secret "1234abcd8765";
-	algorithm @DEFAULT_HMAC@;
-};
-
 controls {
 	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

-view restart16 {
-	match-clients { key restart16; none; };
-	max-query-restarts 16;
-
-	zone "." {
-		type hint;
-		file "root.hint";
-	};
-};
-
-view default {
-	zone "." {
-		type hint;
-		file "root.hint";
-	};
+zone "." {
+	type hint;
+	file "root.hint";
 };
@@ -439,24 +439,12 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
-echo_i "checking CNAME loops are detected (resolver) ($n)"
+echo_i "checking CNAME loops are detected ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
-$DIG $DIGOPTS @10.53.0.7 loop.example >dig.out.1.test$n
-grep "status: NOERROR" dig.out.1.test$n >/dev/null || ret=1
-grep "ANSWER: 12" dig.out.1.test$n >/dev/null || ret=1
-# also check with max-query-restarts 16:
-$DIG $DIGOPTS @10.53.0.7 -y "${DEFAULT_HMAC}:restart16:1234abcd8765" loop.example >dig.out.2.test$n
-grep "status: NOERROR" dig.out.2.test$n >/dev/null || ret=1
-grep "ANSWER: 17" dig.out.2.test$n >/dev/null || ret=1
-
-n=$((n + 1))
-echo_i "checking CNAME loops are detected (auth) ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 loop.example >dig.out.test$n
-grep "status: SERVFAIL" dig.out.test$n >/dev/null || ret=1
-grep "max. restarts reached" dig.out.test$n >/dev/null || ret=1
-grep "ANSWER: 12" dig.out.test$n >/dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.7 loop.example >dig.out.test$n
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 17" dig.out.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	sig0checks-quota-exempt { unknownacl; };
-};
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-acl goodacl {
-	192.168.0.1;
-};
-
-options {
-	sig0checks-quota-exempt { 10.0.0.0/8; 2001:db8::100; goodacl; };
-};
@@ -81,7 +81,6 @@ options {
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
-	max-query-restarts 10;
 	nta-lifetime 604800;
 	nta-recheck 604800;
 	validate-except {
@@ -113,7 +112,6 @@ view "first" {
 		max-ixfr-ratio unlimited;
 	};
 	dnssec-validation auto;
-	max-query-restarts 15;
 	zone-statistics terse;
 };
 view "second" {
@@ -642,7 +642,7 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
 ret=0
-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
  conf=kasp-bad-nsec3-iter-fips.conf
  expect=2
 else
@@ -660,7 +660,7 @@ n=$((n + 1))
 echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-alg.conf >checkconf.out$n 2>&1 && ret=1
-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
  grep "dnssec-policy: algorithm rsasha1 not supported" <checkconf.out$n >/dev/null || ret=1
 else
  grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" <checkconf.out$n >/dev/null || ret=1
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-; invalid zero length alpn (at start) due to missing double escape
-svcb		SVCB	1 . alpn=\,abc
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-; invalid zero length alpn (in midddle) due to missing double escape
-svcb            SVCB    1 . alpn=a\,\,abc
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-; invalid zero length alpn (at end) due to missing double escape
-svcb            SVCB    1 . alpn=abc\,
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-; invalid zero length alpn at start
-svcb		SVCB	1 . alpn=,abc
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-; invalid zero length alpn in midddle
-svcb            SVCB    1 . alpn=a,,abc
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-; invalid zero length alpn at end
-svcb            SVCB    1 . alpn=abc,
@@ -99,6 +99,42 @@ send() {
  $PERL "$TOP_SRCDIR/bin/tests/system/send.pl" "$@"
 }

+#
+# Useful variables in test scripts
+#
+
+# The following script sets the following algorithm-related variables. These
+# are selected randomly at runtime from a list of supported algorithms. The
+# randomization is deterministic and remains stable for a period of time for a
+# given platform.
+#
+# Default algorithm for testing.
+# DEFAULT_ALGORITHM
+# DEFAULT_ALGORITHM_NUMBER
+# DEFAULT_BITS
+#
+# This is an alternative algorithm for test cases that require more than one
+# algorithm (for example algorithm rollover). Must be different from
+# DEFAULT_ALGORITHM.
+# ALTERNATIVE_ALGORITHM
+# ALTERNATIVE_ALGORITHM_NUMBER
+# ALTERNATIVE_BITS
+#
+# This is an algorithm that is used for tests against the "disable-algorithms"
+# configuration option. Must be different from above algorithms.
+# DISABLED_ALGORITHM
+# DISABLED_ALGORITHM_NUMBER
+# DISABLED_BITS
+#
+# There are multiple algoritms sets to choose from (see get_algorithms.py). To
+# override the default choice, set the ALGORITHM_SET env var (see mkeys system
+# test for example).
+eval "$($PYTHON "$TOP_SRCDIR/bin/tests/system/get_algorithms.py")"
+
+# Default HMAC algorithm.
+# also update _common/rndc.conf and _common/rndc.key when updating DEFAULT_HMAC
+export DEFAULT_HMAC=hmac-sha256
+
 #
 # Useful functions in test scripts
 #
@@ -14,17 +14,20 @@ import os
 from pathlib import Path
 import re
 import shutil
+import socket
 import subprocess
 import tempfile
 import time
 from typing import Any, List, Optional

+import pyroute2  # TODO confitional
 import pytest

 pytest.register_assert_rewrite("isctest")

 import isctest
 from isctest.vars.dirs import SYSTEM_TEST_DIR_GIT_PATH
+from namespaces import Namespace


 # Silence warnings caused by passing a pytest fixture to another fixture.
@@ -87,6 +90,7 @@ def pytest_configure(config):
    # Ensure this hook only runs on the main pytest instance if xdist is
    # used to spawn other workers.
    if not XDIST_WORKER:
+        Namespace("user").__enter__()
        if config.pluginmanager.has_plugin("xdist") and config.option.numprocesses:
            # system tests depend on module scope for setup & teardown
            # enforce use "loadscope" scheduler or disable paralelism
@@ -277,17 +281,6 @@ def wait_for_zones_loaded(request, servers):
            watcher.wait_for_line("all zones loaded")


-@pytest.fixture(scope="module", autouse=True)
-def configure_algorithm_set(request):
-    """Configure the algorithm set to use in tests."""
-    mark = _get_marker(request.node, "algorithm_set")
-    if not mark:
-        name = None
-    else:
-        name = mark.args[0]
-    isctest.vars.set_algorithm_set(name)
-
-
@pytest.fixture(autouse=True)
 def logger(request, system_test_name):
    """Sets up logging facility specific to a particular test."""
@@ -470,12 +463,24 @@ def run_tests_sh(system_test_dir, shell):
    return run_tests


+@pytest.fixture(scope="module")
+def namespace(shell):
+    with Namespace("net"):
+        shell("ifconfig.sh", ["up"])
+        with pyroute2.IPRoute() as ipr:
+            lo = ipr.link_lookup(ifname="lo")[0]
+            ipr.route("add", gateway="127.0.0.1", oif=lo)
+            ipr.route("add", family=socket.AF_INET6, gateway="::1", oif=lo)
+        yield
+
+
@pytest.fixture(scope="module", autouse=True)
 def system_test(  # pylint: disable=too-many-arguments,too-many-statements
    request,
    system_test_dir,
    shell,
    perl,
+    namespace,
 ):
    """
    Driver of the test setup/teardown process. Used automatically for every test module.
@@ -49,42 +49,3 @@ hours		10800	A	10.53.0.2
 minutes		2700	A	10.53.0.2
 ;TTL of 45 seconds
 seconds		45	A	10.53.0.2
-; domain names with yaml special values and data with ': '
-yaml			TXT	"a: b"
-'.yaml			TXT	"a: b"
-[.yaml			TXT	"a: b"
-{.yaml			TXT	"a: b"
-&.yaml			TXT	"a: b"
-#.yaml			TXT	"a: b"
-all.yaml		TXT	( \000 \001 \002 \003 \004 \005 \006 \007
-				  \008 \009 \010 \011 \012 \013 \014 \015
-				  \016 \017 \018 \019 \020 \021 \022 \023
-				  \024 \025 \026 \027 \028 \029 \030 \031
-				  \032 \033 \034 \035 \036 \037 \038 \039
-				  \040 \041 \042 \043 \044 \045 \046 \047
-				  \048 \049 \050 \051 \052 \053 \054 \055
-				  \056 \057 \058 \059 \060 \061 \062 \063
-				  \064 \065 \066 \067 \068 \069 \070 \071
-				  \072 \073 \074 \075 \076 \077 \078 \079
-				  \080 \081 \082 \083 \084 \085 \086 \087
-				  \088 \089 \090 \091 \092 \093 \094 \095
-				  \096 \097 \098 \099 \100 \101 \102 \103
-				  \104 \105 \106 \107 \108 \109 \110 \111
-				  \112 \113 \114 \115 \116 \117 \118 \119
-				  \120 \121 \122 \123 \124 \125 \126 \127
-				  \128 \129 \130 \131 \132 \133 \134 \135
-				  \136 \137 \138 \139 \140 \141 \142 \143
-				  \144 \145 \146 \147 \148 \149 \150 \151
-				  \152 \153 \154 \155 \156 \157 \158 \159
-				  \160 \161 \162 \163 \164 \165 \166 \167
-				  \168 \169 \170 \171 \172 \173 \174 \175
-				  \176 \177 \178 \179 \180 \181 \182 \183
-				  \184 \185 \186 \187 \188 \189 \190 \191
-				  \192 \193 \194 \195 \196 \197 \198 \199
-				  \200 \201 \202 \203 \204 \205 \206 \207
-				  \208 \209 \210 \211 \212 \213 \214 \215
-				  \216 \217 \218 \219 \220 \221 \222 \223
-				  \224 \225 \226 \227 \228 \229 \230 \231
-				  \232 \233 \234 \235 \236 \237 \238 \239
-				  \240 \241 \242 \243 \244 \245 \246 \247
-				  \248 \249 \250 \251 \252 \253 \254 \255 )
@@ -681,7 +681,6 @@ if [ -x "$DIG" ]; then

  n=$((n + 1))
  echo_i "check that Extended DNS Error 0 is printed correctly ($n)"
-  ret=0
  # First defined EDE code, additional text "foo".
  dig_with_opts @10.53.0.3 +ednsopt=ede:0000666f6f a.example +qr >dig.out.test$n 2>&1 || ret=1
  pat='^; EDE: 0 (Other): (foo)$'
@@ -691,7 +690,6 @@ if [ -x "$DIG" ]; then

  n=$((n + 1))
  echo_i "check that Extended DNS Error 24 is printed correctly ($n)"
-  ret=0
  # Last defined EDE code, no additional text.
  dig_with_opts @10.53.0.3 +ednsopt=ede:0018 a.example +qr >dig.out.test$n 2>&1 || ret=1
  pat='^; EDE: 24 (Invalid Data)$'
@@ -701,7 +699,6 @@ if [ -x "$DIG" ]; then

  n=$((n + 1))
  echo_i "check that Extended DNS Error 25 is printed correctly ($n)"
-  ret=0
  # First undefined EDE code, additional text "foo".
  dig_with_opts @10.53.0.3 +ednsopt=ede:0019666f6f a.example +qr >dig.out.test$n 2>&1 || ret=1
  pat='^; EDE: 25: (foo)$'
@@ -711,7 +708,6 @@ if [ -x "$DIG" ]; then

  n=$((n + 1))
  echo_i "check that invalid Extended DNS Error (length 0) is printed ($n)"
-  ret=0
  # EDE payload is too short
  dig_with_opts @10.53.0.3 +ednsopt=ede a.example +qr >dig.out.test$n 2>&1 || ret=1
  pat='^; EDE:$'
@@ -721,7 +717,6 @@ if [ -x "$DIG" ]; then

  n=$((n + 1))
  echo_i "check that invalid Extended DNS Error (length 1) is printed ($n)"
-  ret=0
  # EDE payload is too short
  dig_with_opts @10.53.0.3 +ednsopt=ede:00 a.example +qr >dig.out.test$n 2>&1 || ret=1
  pat='^; EDE: 00 (".")$'
@@ -732,7 +727,6 @@ if [ -x "$DIG" ]; then
  if [ $HAS_PYYAML -ne 0 ]; then
    n=$((n + 1))
    echo_i "check that +yaml Extended DNS Error 0 is printed correctly ($n)"
-    ret=0
    # First defined EDE code, additional text "foo".
    dig_with_opts @10.53.0.3 +yaml +ednsopt=ede:0000666f6f a.example +qr >dig.out.test$n 2>&1 || ret=1
    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS EDE INFO-CODE >yamlget.out.test$n 2>&1 || ret=1
@@ -746,7 +740,6 @@ if [ -x "$DIG" ]; then

    n=$((n + 1))
    echo_i "check that +yaml Extended DNS Error 24 is printed correctly ($n)"
-    ret=0
    # Last defined EDE code, no additional text.
    dig_with_opts @10.53.0.3 +yaml +ednsopt=ede:0018 a.example +qr >dig.out.test$n 2>&1 || ret=1
    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS EDE INFO-CODE >yamlget.out.test$n 2>&1 || ret=1
@@ -758,7 +751,6 @@ if [ -x "$DIG" ]; then

    n=$((n + 1))
    echo_i "check that +yaml Extended DNS Error 25 is printed correctly ($n)"
-    ret=0
    # First undefined EDE code, additional text "foo".
    dig_with_opts @10.53.0.3 +yaml +ednsopt=ede:0019666f6f a.example +qr >dig.out.test$n 2>&1 || ret=1
    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS EDE INFO-CODE >yamlget.out.test$n 2>&1 || ret=1
@@ -772,7 +764,6 @@ if [ -x "$DIG" ]; then

    n=$((n + 1))
    echo_i "check that invalid Extended DNS Error (length 0) is printed ($n)"
-    ret=0
    # EDE payload is too short
    dig_with_opts @10.53.0.3 +yaml +ednsopt=ede a.example +qr >dig.out.test$n 2>&1 || ret=1
    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS EDE >yamlget.out.test$n 2>&1 || ret=1
@@ -783,7 +774,6 @@ if [ -x "$DIG" ]; then

    n=$((n + 1))
    echo_i "check that invalid +yaml Extended DNS Error (length 1) is printed ($n)"
-    ret=0
    # EDE payload is too short
    dig_with_opts @10.53.0.3 +yaml +ednsopt=ede:00 a.example +qr >dig.out.test$n 2>&1 || ret=1
    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data OPT_PSEUDOSECTION EDNS EDE >yamlget.out.test$n 2>&1 || ret=1
@@ -1485,60 +1475,5 @@ else
  echo_i "$DELV is needed, so skipping these delv tests"
 fi

-if [ $HAS_PYYAML -ne 0 ]; then
-  for qname in "yaml" "'.yaml" "[.yaml" "{.yaml" "&.yaml" "#.yaml"; do
-    n=$((n + 1))
-    echo_i "check yaml special '${yaml}.example' ($n)"
-    ret=0
-    dig_with_opts @10.53.0.3 +yaml "${qname}.example" TXT +qr >dig.out.test$n 2>&1 || ret=1
-    $PYTHON yamlget.py dig.out.test$n 0 message query_message_data QUESTION_SECTION 0 >yamlget.out.test$n 2>&1 || ret=1
-    read -r value <yamlget.out.test$n
-    [ "$value" = "${qname}.example. IN TXT" ] || ret=1
-    $PYTHON yamlget.py dig.out.test$n 1 message response_message_data ANSWER_SECTION 0 >yamlget.out.test$n 2>&1 || ret=1
-    read -r value <yamlget.out.test$n
-    [ "$value" = "${qname}"'.example. 300 IN TXT "a: b"' ] || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status + ret))
-  done
-
-  n=$((n + 1))
-  echo_i "check yaml character values ($n)"
-  ret=0
-  dig_with_opts @10.53.0.3 +yaml "all.yaml.example" TXT +qr >dig.out.test$n 2>&1 || ret=1
-  $PYTHON yamlget.py dig.out.test$n 1 message response_message_data ANSWER_SECTION 0 >yamlget.out.test$n 2>&1 || ret=1
-  read -r value <yamlget.out.test$n
-  expected='all.yaml.example. 300 IN TXT'
-  expected="$expected "'"\000" "\001" "\002" "\003" "\004" "\005" "\006" "\007"'
-  expected="$expected "'"\008" "\009" "\010" "\011" "\012" "\013" "\014" "\015"'
-  expected="$expected "'"\016" "\017" "\018" "\019" "\020" "\021" "\022" "\023"'
-  expected="$expected "'"\024" "\025" "\026" "\027" "\028" "\029" "\030" "\031"'
-  expected="$expected "'" " "!" "\"" "#" "$" "%" "&" "'"'"'" "(" ")" "*" "+" ","'
-  expected="$expected "'"-" "." "/" "0" "1" "2" "3" "4" "5" "6" "7" "8" "9" ":"'
-  expected="$expected "'";" "<" "=" ">" "?" "@" "A" "B" "C" "D" "E" "F" "G" "H"'
-  expected="$expected "'"I" "J" "K" "L" "M" "N" "O" "P" "Q" "R" "S" "T" "U" "V"'
-  expected="$expected "'"W" "X" "Y" "Z" "[" "\\" "]" "^" "_" "`" "a" "b" "c" "d"'
-  expected="$expected "'"e" "f" "g" "h" "i" "j" "k" "l" "m" "n" "o" "p" "q" "r"'
-  expected="$expected "'"s" "t" "u" "v" "w" "x" "y" "z" "{" "|" "}" "~" "\127"'
-  expected="$expected "'"\128" "\129" "\130" "\131" "\132" "\133" "\134" "\135"'
-  expected="$expected "'"\136" "\137" "\138" "\139" "\140" "\141" "\142" "\143"'
-  expected="$expected "'"\144" "\145" "\146" "\147" "\148" "\149" "\150" "\151"'
-  expected="$expected "'"\152" "\153" "\154" "\155" "\156" "\157" "\158" "\159"'
-  expected="$expected "'"\160" "\161" "\162" "\163" "\164" "\165" "\166" "\167"'
-  expected="$expected "'"\168" "\169" "\170" "\171" "\172" "\173" "\174" "\175"'
-  expected="$expected "'"\176" "\177" "\178" "\179" "\180" "\181" "\182" "\183"'
-  expected="$expected "'"\184" "\185" "\186" "\187" "\188" "\189" "\190" "\191"'
-  expected="$expected "'"\192" "\193" "\194" "\195" "\196" "\197" "\198" "\199"'
-  expected="$expected "'"\200" "\201" "\202" "\203" "\204" "\205" "\206" "\207"'
-  expected="$expected "'"\208" "\209" "\210" "\211" "\212" "\213" "\214" "\215"'
-  expected="$expected "'"\216" "\217" "\218" "\219" "\220" "\221" "\222" "\223"'
-  expected="$expected "'"\224" "\225" "\226" "\227" "\228" "\229" "\230" "\231"'
-  expected="$expected "'"\232" "\233" "\234" "\235" "\236" "\237" "\238" "\239"'
-  expected="$expected "'"\240" "\241" "\242" "\243" "\244" "\245" "\246" "\247"'
-  expected="$expected "'"\248" "\249" "\250" "\251" "\252" "\253" "\254" "\255"'
-  [ "$value" = "$expected" ] || ret=1
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status + ret))
-fi
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -1462,7 +1462,7 @@ echo_ic "check that 'dnssec-signzone -F' failed with disallowed algorithm ($n)"
 ret=0
 if ! $FEATURETEST --fips-provider; then
  echo_i "skipped no FIPS provider available"
-elif [ $RSASHA1_SUPPORTED = 0 ]; then
+elif ! $SHELL ../testcrypto.sh -q RSASHA1; then
  echo_i "skipped: RSASHA1 is not supported"
 else
  (
@@ -3417,7 +3417,7 @@ if $FEATURETEST --have-fips-mode; then
  echo_i "skipped: already in FIPS mode"
 elif ! $FEATURETEST --fips-provider; then
  echo_i "skipped no FIPS provider available"
-elif [ $RSASHA1_SUPPORTED = 0 ]; then
+elif ! $SHELL ../testcrypto.sh -q RSASHA1; then
  echo_i "skipped: RSASHA1 is not supported"
 else
  $KEYGEN -F -a rsasha1 example.fips 2>keygen.err$n || true
@@ -3433,7 +3433,7 @@ if $FEATURETEST --have-fips-mode; then
  echo_i "skipped: already in FIPS mode"
 elif ! $FEATURETEST --fips-provider; then
  echo_i "skipped: cannot switch to FIPS mode"
-elif [ $RSASHA1_SUPPORTED = 0 ]; then
+elif ! $SHELL ../testcrypto.sh -q RSASHA1; then
  echo_i "skipped: RSASHA1 is not supported"
 else
  $KEYGEN -F -a nsec3rsasha1 example.fips 2>keygen.err$n || true
@@ -4215,11 +4215,11 @@ mv ns2/$KSK.key.bak ns2/$KSK.key
 mv ns2/$KSK.private.bak ns2/$KSK.private

 # Roll the ZSK again.
+echo_i "delete old ZSK $ZSK_ID, schedule ZSK $ZSK_ID2 inactive, and new ZSK $ZSK_ID3 active for zone $zone ($n)"
 zsk3=$("$KEYGEN" -q -P none -A none -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
 ret=0
 keyfile_to_key_id "$zsk3" >ns2/$zone.zsk.id3
 ZSK_ID3=$(cat ns2/$zone.zsk.id3)
-echo_i "delete old ZSK $ZSK_ID, schedule ZSK $ZSK_ID2 inactive, and pre-publish ZSK $ZSK_ID3 for zone $zone ($n)"
 $SETTIME -s -k HIDDEN now -z HIDDEN now -D now -K ns2 $ZSK >/dev/null
 $SETTIME -s -k OMNIPRESENT now -z OMNIPRESENT now -K ns2 $zsk2 >/dev/null
 dnssec_loadkeys_on 2 $zone || ret=1
@@ -4228,18 +4228,6 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))

-# Wait for newest ZSK to become published.
-echo_i "wait until new ZSK $ZSK_ID3 published"
-for i in 1 2 3 4 5 6 7 8 9 10; do
-  ret=0
-  grep "DNSKEY $zone/$DEFAULT_ALGORITHM/$ZSK_ID3 (ZSK) is now published" ns2/named.run >/dev/null || ret=1
-  [ "$ret" -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status + ret))
-
 # Remove the KSK from disk.
 echo_i "remove the KSK $KSK_ID for zone $zone from disk"
 mv ns2/$KSK.key ns2/$KSK.key.bak
@@ -98,7 +98,6 @@ options {
 	tcp-initial-timeout 1200;
 	transfers-in 100;
 	transfers-out 100;
-	max-records-per-type 0;
 };

 trust-anchors { };
@@ -52,7 +52,6 @@ options {
 	ixfr-from-differences yes;
 	check-integrity no;
 	dnssec-validation yes;
-	max-records-per-type 0;
 	transfers-in 100;
 	transfers-out 100;
 };
@@ -44,7 +44,6 @@ options {
 	ixfr-from-differences yes;
 	check-integrity no;
 	dnssec-validation yes;
-	max-records-per-type 0;
 };

 trust-anchors { };
@@ -52,7 +52,6 @@ options {
 	ixfr-from-differences yes;
 	check-integrity no;
 	dnssec-validation yes;
-	max-records-per-type 0;
 };

 trust-anchors { };
@@ -40,7 +40,6 @@ options {
 	ixfr-from-differences yes;
 	check-integrity no;
 	dnssec-validation yes;
-	max-records-per-type 0;
 };

 trust-anchors { };
@@ -24,3 +24,4 @@ rm -f ns*/named.run
 rm -f ns*/root.db
 rm -f ns*/signer.err
 rm -f ns*/trusted.conf
+rm -f *-supported.file
@@ -23,14 +23,14 @@ echo_i "ns1/sign.sh"

 cp $infile $zonefile

-if [ $ECDSAP256SHA256_SUPPORTED = 1 ]; then
+if [ -f ../ecdsa256-supported.file ]; then
  zsk256=$($KEYGEN -q -a ECDSA256 -n zone "$zone")
  ksk256=$($KEYGEN -q -a ECDSA256 -n zone -f KSK "$zone")
  cat "$ksk256.key" "$zsk256.key" >>"$zonefile"
  $DSFROMKEY -a sha-256 "$ksk256.key" >>dsset-256
 fi

-if [ $ECDSAP384SHA384_SUPPORTED = 1 ]; then
+if [ -f ../ecdsa384-supported.file ]; then
  zsk384=$($KEYGEN -q -a ECDSA384 -n zone "$zone")
  ksk384=$($KEYGEN -q -a ECDSA384 -n zone -f KSK "$zone")
  cat "$ksk384.key" "$zsk384.key" >>"$zonefile"
@@ -38,7 +38,7 @@ if [ $ECDSAP384SHA384_SUPPORTED = 1 ]; then
 fi

 # Configure the resolving server with a static key.
-if [ $ECDSAP256SHA256_SUPPORTED = 1 ]; then
+if [ -f ../ecdsa256-supported.file ]; then
  keyfile_to_static_ds $ksk256 >trusted.conf
  cp trusted.conf ../ns2/trusted.conf
 else
@@ -46,7 +46,7 @@ else
  cp trusted.conf ../ns2/trusted.conf
 fi

-if [ $ECDSAP384SHA384_SUPPORTED = 1 ]; then
+if [ -f ../ecdsa384-supported.file ]; then
  keyfile_to_static_ds $ksk384 >trusted.conf
  cp trusted.conf ../ns3/trusted.conf
 else
@@ -15,6 +15,14 @@ set -e

 . ../conf.sh

+if $SHELL ../testcrypto.sh ecdsap256sha256; then
+  echo "yes" >ecdsa256-supported.file
+fi
+
+if $SHELL ../testcrypto.sh ecdsap384sha384; then
+  echo "yes" >ecdsa384-supported.file
+fi
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -22,7 +22,7 @@ dig_with_opts() {
  "$DIG" +tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
 }

-if [ $ECDSAP256SHA256_SUPPORTED = 1 ]; then
+if [ -f ecdsa256-supported.file ]; then
  n=$((n + 1))
  echo_i "checking that ECDSA256 positive validation works ($n)"
  ret=0
@@ -36,7 +36,7 @@ else
  echo_i "algorithm ECDSA256 not supported, skipping test"
 fi

-if [ $ECDSAP384SHA384_SUPPORTED = 1 ]; then
+if [ -f ecdsa384-supported.file ]; then
  n=$((n + 1))
  echo_i "checking that ECDSA384 positive validation works ($n)"
  ret=0
@@ -25,3 +25,4 @@ rm -f ns*/root.db
 rm -f ns*/signer.err
 rm -f ns*/trusted.conf
 rm -f ns*/example.com.db
+rm -f *-supported.file
@@ -23,14 +23,14 @@ echo_i "ns1/sign.sh"

 cp $infile $zonefile

-if [ $ED25519_SUPPORTED = 1 ]; then
+if [ -f ../ed25519-supported.file ]; then
  zsk25519=$($KEYGEN -q -a ED25519 -n zone "$zone")
  ksk25519=$($KEYGEN -q -a ED25519 -n zone -f KSK "$zone")
  cat "$ksk25519.key" "$zsk25519.key" >>"$zonefile"
  $DSFROMKEY -a sha-256 "$ksk25519.key" >>dsset-256
 fi

-if [ $ED448_SUPPORTED = 1 ]; then
+if [ -f ../ed448-supported.file ]; then
  zsk448=$($KEYGEN -q -a ED448 -n zone "$zone")
  ksk448=$($KEYGEN -q -a ED448 -n zone -f KSK "$zone")
  cat "$ksk448.key" "$zsk448.key" >>"$zonefile"
@@ -38,7 +38,7 @@ if [ $ED448_SUPPORTED = 1 ]; then
 fi

 # Configure the resolving server with a static key.
-if [ $ED25519_SUPPORTED = 1 ]; then
+if [ -f ../ed25519-supported.file ]; then
  keyfile_to_static_ds $ksk25519 >trusted.conf
  cp trusted.conf ../ns2/trusted.conf
 else
@@ -46,7 +46,7 @@ else
  cp trusted.conf ../ns2/trusted.conf
 fi

-if [ $ED448_SUPPORTED = 1 ]; then
+if [ -f ../ed448-supported.file ]; then
  keyfile_to_static_ds $ksk448 >trusted.conf
  cp trusted.conf ../ns3/trusted.conf
 else
@@ -25,7 +25,7 @@ echo_i "ns2/sign.sh"

 cp $infile $zonefile

-if [ $ED25519_SUPPORTED = 1 ]; then
+if [ -f ../ed25519-supported.file ]; then

  for i in Xexample.com.+015+03613 Xexample.com.+015+35217; do
    cp "$i.key" "$(echo $i.key | sed s/X/K/)"
@@ -25,7 +25,7 @@ echo_i "ns3/sign.sh"

 cp $infile $zonefile

-if [ $ED448_SUPPORTED = 1 ]; then
+if [ -f ../ed448-supported.file ]; then
  for i in Xexample.com.+016+09713 Xexample.com.+016+38353; do
    cp "$i.key" "$(echo $i.key | sed s/X/K/)"
    cp "$i.private" "$(echo $i.private | sed s/X/K/)"
@@ -15,6 +15,12 @@ set -e

 . ../conf.sh

-if [ $ED25519_SUPPORTED = 0 ] && [ $ED448_SUPPORTED = 0 ]; then
-  exit 1
+supported=0
+if $SHELL ../testcrypto.sh ed25519; then
+  supported=1
 fi
+if $SHELL ../testcrypto.sh ed448; then
+  supported=1
+fi
+
+[ "$supported" -eq 1 ] || exit 1
@@ -15,6 +15,14 @@ set -e

 . ../conf.sh

+if $SHELL ../testcrypto.sh ed25519; then
+  echo "yes" >ed25519-supported.file
+fi
+
+if $SHELL ../testcrypto.sh ed448; then
+  echo "yes" >ed448-supported.file
+fi
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -22,7 +22,7 @@ dig_with_opts() {
  "$DIG" +tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
 }

-if [ $ED25519_SUPPORTED = 1 ]; then
+if [ -f ed25519-supported.file ]; then
  # Check the example. domain
  n=$((n + 1))
  echo_i "checking that Ed25519 positive validation works ($n)"
@@ -50,7 +50,7 @@ fi

 n=$((n + 1))
 ret=0
-if [ $ED448_SUPPORTED = 1 ]; then
+if [ -f ed448-supported.file ]; then
  # Check the example. domain
  n=$((n + 1))
  echo_i "checking that Ed448 positive validation works ($n)"
@@ -59,11 +59,9 @@ for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
  alg=$(echo "$algtypebits" | cut -f 1 -d :)
  type=$(echo "$algtypebits" | cut -f 2 -d :)
  bits=$(echo "$algtypebits" | cut -f 3 -d :)
-  alg_upper=$(echo "$alg" | tr '[:lower:]' '[:upper:]')
-  supported=$(eval "echo \$${alg_upper}_SUPPORTED")

  tld="example"
-  if [ "${supported}" = 1 ]; then
+  if $SHELL ../testcrypto.sh $alg; then
    zone="$alg.$tld"
    zonefile="zone.$alg.$tld.db"
    ret=0
@@ -193,11 +191,9 @@ algtypebits="ecdsap256sha256:EC:prime256v1"
 alg=$(echo "$algtypebits" | cut -f 1 -d :)
 type=$(echo "$algtypebits" | cut -f 2 -d :)
 bits=$(echo "$algtypebits" | cut -f 3 -d :)
-alg_upper=$(echo "$alg" | tr '[:lower:]' '[:upper:]')
-supported=$(eval "echo \$${alg_upper}_SUPPORTED")
 tld="views"

-if [ "${supported}" = 1 ]; then
+if $SHELL ../testcrypto.sh $alg; then
  zone="$alg.$tld"
  zonefile1="zone.$alg.$tld.view1.db"
  zonefile2="zone.$alg.$tld.view2.db"
@@ -1,3 +1,5 @@
+#!/usr/bin/python3
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -9,43 +11,22 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+# This script is a 'port' broker.  It keeps track of ports given to the
+# individual system subtests, so every test is given a unique port range.
+
+import logging
 import os
+from pathlib import Path
 import platform
 import random
 import subprocess
-import tempfile
 import time
-from typing import Dict, List, NamedTuple, Optional, Union
+from typing import Dict, List, NamedTuple, Union

-from .basic import BASIC_VARS
-from .. import log
-
-# Algorithms are selected randomly at runtime from a list of supported
-# algorithms. The randomization is deterministic and remains stable for a
-# period of time for a given platform.
-ALG_VARS = {
-    # There are multiple algoritms sets to choose from (see ALGORITHM_SETS). To
-    # override the default choice, set the ALGORITHM_SET env var prior to
-    # loading this module or call set_algorithm_set().
-    "ALGORITHM_SET": "none",
-    "DEFAULT_ALGORITHM": "",
-    "DEFAULT_ALGORITHM_NUMBER": "",
-    "DEFAULT_BITS": "",
-    # Alternative algorithm for test cases that require more than one algorithm
-    # (for example algorithm rollover). Must be different from
-    # DEFAULT_ALGORITHM.
-    "ALTERNATIVE_ALGORITHM": "",
-    "ALTERNATIVE_ALGORITHM_NUMBER": "",
-    "ALTERNATIVE_BITS": "",
-    # Algorithm that is used for tests against the "disable-algorithms"
-    # configuration option. Must be different from above algorithms.
-    "DISABLED_ALGORITHM": "",
-    "DISABLED_ALGORITHM_NUMBER": "",
-    "DISABLED_BITS": "",
-    # Default HMAC algorithm. Must match the rndc configuration in
-    # bin/tests/system/_common (rndc.conf, rndc.key)
-    "DEFAULT_HMAC": "hmac-sha256",
-}
+# Uncomment to enable DEBUG logging
+# logging.basicConfig(
+#     format="get_algorithms.py %(levelname)s %(message)s", level=logging.DEBUG
+# )

 STABLE_PERIOD = 3600 * 3
 """number of secs during which algorithm selection remains stable"""
@@ -112,77 +93,57 @@ ALGORITHM_SETS = {
    # ),
 }

+TESTCRYPTO = Path(__file__).resolve().parent / "testcrypto.sh"

-def is_crypto_supported(alg: Algorithm) -> bool:
+KEYGEN = os.getenv("KEYGEN", "")
+if not KEYGEN:
+    raise RuntimeError("KEYGEN environment variable has to be set")
+
+ALGORITHM_SET = os.getenv("ALGORITHM_SET", "stable")
+assert ALGORITHM_SET in ALGORITHM_SETS, f'ALGORITHM_SET "{ALGORITHM_SET}" unknown'
+logging.debug('choosing from ALGORITHM_SET "%s"', ALGORITHM_SET)
+
+
+def is_supported(alg: Algorithm) -> bool:
    """Test whether a given algorithm is supported on the current platform."""
-    assert alg in ALL_ALGORITHMS, f"unknown algorithm: {alg}"
-    with tempfile.TemporaryDirectory() as tmpdir:
-        proc = subprocess.run(
-            [
-                BASIC_VARS["KEYGEN"],
-                "-a",
-                alg.name,
-                "-b",
-                str(alg.bits),
-                "foo",
-            ],
-            cwd=tmpdir,
-            check=False,
+    try:
+        subprocess.run(
+            f"{TESTCRYPTO} -q {alg.name}",
+            shell=True,
+            check=True,
+            env={
+                "KEYGEN": KEYGEN,
+                "TMPDIR": os.getenv("TMPDIR", "/tmp"),
+            },
            stdout=subprocess.DEVNULL,
-            stderr=subprocess.PIPE,
        )
-        if proc.returncode == 0:
-            return True
-        log.debug(f"dnssec-keygen stderr: {proc.stderr.decode('utf-8')}")
-        log.info("algorithm %s not supported", alg.name)
+    except subprocess.CalledProcessError as exc:
+        logging.debug(exc)
+        logging.info("algorithm %s not supported", alg.name)
        return False
+    return True


-# Indicate algorithm support on the current platform.
-CRYPTO_SUPPORTED_VARS = {
-    "RSASHA1_SUPPORTED": "0",
-    "RSASHA256_SUPPORTED": "0",
-    "RSASHA512_SUPPORTED": "0",
-    "ECDSAP256SHA256_SUPPORTED": "0",
-    "ECDSAP384SHA384_SUPPORTED": "0",
-    "ED25519_SUPPORTED": "0",
-    "ED448_SUPPORTED": "0",
-}
-
-SUPPORTED_ALGORITHMS: List[Algorithm] = []
-
-
-def init_crypto_supported():
-    """Initialize the environment variables indicating cryptography support."""
-    for alg in ALL_ALGORITHMS:
-        supported = is_crypto_supported(alg)
-        if supported:
-            SUPPORTED_ALGORITHMS.append(alg)
-        envvar = f"{alg.name}_SUPPORTED"
-        val = "1" if supported else "0"
-        CRYPTO_SUPPORTED_VARS[envvar] = val
-        os.environ[envvar] = val
-
-
-def _filter_supported(algs: AlgorithmSet) -> AlgorithmSet:
+def filter_supported(algs: AlgorithmSet) -> AlgorithmSet:
    """Select supported algorithms from the set."""
    filtered = {}
    for alg_type in algs._fields:
        candidates = getattr(algs, alg_type)
        if isinstance(candidates, Algorithm):
            candidates = [candidates]
-        supported = [alg for alg in candidates if alg in SUPPORTED_ALGORITHMS]
+        supported = list(filter(is_supported, candidates))
        if len(supported) == 1:
            supported = supported.pop()
        elif not supported:
            raise RuntimeError(
-                f"no {alg_type.upper()} algorithm " "supported on this platform"
+                f'no {alg_type.upper()} algorithm from "{ALGORITHM_SET}" set '
+                "supported on this platform"
            )
        filtered[alg_type] = supported
    return AlgorithmSet(**filtered)


-def _select_random(algs: AlgorithmSet, stable_period=STABLE_PERIOD) -> AlgorithmSet:
+def select_random(algs: AlgorithmSet, stable_period=STABLE_PERIOD) -> AlgorithmSet:
    """Select random DEFAULT, ALTERNATIVE and DISABLED algorithms from the set.

    The algorithm selection is deterministic for a given time period and
@@ -239,11 +200,9 @@ def _select_random(algs: AlgorithmSet, stable_period=STABLE_PERIOD) -> Algorithm
    return AlgorithmSet(default, alternative, disabled)


-def _algorithms_env(algs: AlgorithmSet, name: str) -> Dict[str, str]:
+def algorithms_env(algs: AlgorithmSet) -> Dict[str, str]:
    """Return environment variables with selected algorithms as a dict."""
-    algs_env = {
-        "ALGORITHM_SET": name,
-    }
+    algs_env: Dict[str, str] = {}

    def set_alg_env(alg: Algorithm, prefix):
        algs_env[f"{prefix}_ALGORITHM"] = alg.name
@@ -258,23 +217,25 @@ def _algorithms_env(algs: AlgorithmSet, name: str) -> Dict[str, str]:
    set_alg_env(algs.alternative, "ALTERNATIVE")
    set_alg_env(algs.disabled, "DISABLED")

-    log.info("selected algorithms: %s", algs_env)
+    logging.info("selected algorithms: %s", algs_env)
    return algs_env


-def set_algorithm_set(name: Optional[str]):
-    if name is None:
-        name = "stable"
-    assert name in ALGORITHM_SETS, f'ALGORITHM_SET "{name}" unknown'
-    if name == ALG_VARS["ALGORITHM_SET"]:
-        log.debug('algorithm set already configured: "%s"', name)
-        return
-    log.debug('choosing from ALGORITHM_SET "%s"', name)
+def main():
+    try:
+        algs = ALGORITHM_SETS[ALGORITHM_SET]
+        algs = filter_supported(algs)
+        algs = select_random(algs)
+        algs_env = algorithms_env(algs)
+    except Exception:
+        # if anything goes wrong, the conf.sh ignores error codes, so make sure
+        # we set an environment variable to an error value that can be checked
+        # later by the test runner and/or tests themselves
+        print("export ALGORITHM_SET=error")
+        raise
+    for name, value in algs_env.items():
+        print(f"export {name}={value}")

-    algs = ALGORITHM_SETS[name]
-    algs = _filter_supported(algs)
-    algs = _select_random(algs)
-    algs_env = _algorithms_env(algs, name)

-    ALG_VARS.update(algs_env)
-    os.environ.update(algs_env)
+if __name__ == "__main__":
+    main()
@@ -21,7 +21,6 @@
 #       fd92:7065:b8e:99ff::{1..2}
 #       fd92:7065:b8e:ff::{1..2}
 #       fd92:7065:b8e:fffe::10.53.0.4
-#       2002:0a35:0007::1                       6to4 for 10.53.0.7
 #
 # We also set the MTU on the 1500 bytes to match the default MTU on physical
 # interfaces, so we can properly test the cases with packets bigger than
@@ -242,7 +241,7 @@ sequence() (
 max=11
 case $1 in
  start | up | stop | down)
-    for i in $(sequence 0 4); do
+    for i in $(sequence 0 3); do
      case $i in
        0) ipv6="ff" ;;
        1) ipv6="99" ;;
@@ -262,11 +261,6 @@ case $1 in
            a=
            aaaa=fd92:7065:b8e:fffe::10.53.0.$ns
            ;;
-          4)
-            [ $ns -ne 1 ] && continue
-            a=
-            aaaa=2002:0a35:0007::$ns
-            ;;
        esac
        case "$1" in
          start | up) up ;;
@@ -9,16 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import logging
-
-from . import log
-from .vars import ALL, init_vars
+from .vars import ALL


 if __name__ == "__main__":
-    # use root logger as fallback - we're not interested in proper logs here
-    log.basic.LOGGERS["conftest"] = logging.getLogger()
-
-    init_vars()
    for name, value in ALL.items():
        print(f"export {name}={value}")
@@ -9,10 +9,5 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-try:
-    import hypothesis as _
-except ImportError:
-    pass
-else:
-    from . import settings
-    from . import strategies
+from . import settings
+from . import strategies
@@ -14,6 +14,7 @@ from pathlib import Path
 from typing import Dict, Optional


+CONFTEST_LOGGER = logging.getLogger("conftest")
 LOG_FORMAT = "%(asctime)s %(levelname)7s:%(name)s  %(message)s"

 LOGGERS = {
@@ -12,15 +12,12 @@
 import os

 from .all import ALL
-from .algorithms import init_crypto_supported, set_algorithm_set
 from .openssl import parse_openssl_config
 from .. import log


 def init_vars():
    """Initializes the environment variables."""
-    init_crypto_supported()
-    set_algorithm_set(os.getenv("ALGORITHM_SET"))
    parse_openssl_config(ALL["OPENSSL_CONF"])

    os.environ.update(ALL)
@@ -15,7 +15,6 @@ from collections import ChainMap
 from .autoconf import AC_VARS  # type: ignore

 # pylint: enable=import-error
-from .algorithms import ALG_VARS, CRYPTO_SUPPORTED_VARS
 from .basic import BASIC_VARS
 from .dirs import DIR_VARS
 from .openssl import OPENSSL_VARS
@@ -53,12 +52,4 @@ class VarLookup(ChainMap):
        return iter(self.keys())


-ALL = VarLookup(
-    AC_VARS,
-    BASIC_VARS,
-    OPENSSL_VARS,
-    PORT_VARS,
-    DIR_VARS,
-    ALG_VARS,
-    CRYPTO_SUPPORTED_VARS,
-)
+ALL = VarLookup(AC_VARS, BASIC_VARS, OPENSSL_VARS, PORT_VARS, DIR_VARS)
@@ -59,6 +59,6 @@ BASIC_VARS = {
        if not os.getenv("TSAN_OPTIONS", "")
        else ":"  # workaround for GL#4119
    ),
-    "LC_ALL": "C",
+    "LANG": "C",
    "ANS_LOG_LEVEL": "debug",
 }
@@ -33,6 +33,7 @@ rm -rf ns3/keys/
 rm -f *.created published.test* retired.test*
 rm -f rndc.dnssec.*.out.* rndc.zonestatus.out.*
 rm -f python.out.*
+rm -f *-supported.file
 rm -f created.key-* unused.key-*
 rm -f ns3/ksk/K* ns3/zsk/K*
 rm -rf ./ns3/ksk/ ./ns3/zsk/
@@ -66,7 +66,10 @@ cp template.db.in "i-am.special.kasp.db"
 # Set up RSASHA1 based zones
 #
 for zn in rsasha1 rsasha1-nsec3; do
-  if [ $RSASHA1_SUPPORTED = 1 ]; then
+  if (
+    cd ..
+    $SHELL ../testcrypto.sh -q RSASHA1
+  ); then
    setup "${zn}.kasp"
    cp template.db.in "$zonefile"
  else
@@ -76,13 +79,13 @@ for zn in rsasha1 rsasha1-nsec3; do
  fi
 done

-if [ $ED25519_SUPPORTED = 1 ]; then
+if [ -f ../ed25519-supported.file ]; then
  setup "ed25519.kasp"
  cp template.db.in "$zonefile"
  cat ed25519.conf >>named.conf
 fi

-if [ $ED448_SUPPORTED = 1 ]; then
+if [ -f ../ed448-supported.file ]; then
  setup "ed448.kasp"
  cp template.db.in "$zonefile"
  cat ed448.conf >>named.conf
@@ -94,32 +94,14 @@ zone "step1.csk-algorithm-roll.kasp" {
 	dnssec-policy "csk-algoroll";
 };

+dnssec-policy "modified" {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 2048;
+	};
+};
+
 zone example {
 	type primary;
 	file "example.db";
 	dnssec-policy modified;
 };
-
-zone longer-lifetime {
-	type primary;
-	file "longer-lifetime.db";
-	dnssec-policy short-lifetime;
-};
-
-zone shorter-lifetime {
-	type primary;
-	file "shorter-lifetime.db";
-	dnssec-policy long-lifetime;
-};
-
-zone limit-lifetime {
-	type primary;
-	file "limit-lifetime.db";
-	dnssec-policy unlimited-lifetime;
-};
-
-zone unlimit-lifetime {
-	type primary;
-	file "unlimit-lifetime.db";
-	dnssec-policy short-lifetime;
-};
@@ -172,32 +172,14 @@ zone "step6.csk-algorithm-roll.kasp" {
 	dnssec-policy "csk-algoroll";
 };

+dnssec-policy "modified" {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 2048;
+	};
+};
+
 zone example {
 	type primary;
 	file "example.db";
 	dnssec-policy modified;
 };
-
-zone longer-lifetime {
-	type primary;
-	file "longer-lifetime.db";
-	dnssec-policy long-lifetime;
-};
-
-zone shorter-lifetime {
-	type primary;
-	file "shorter-lifetime.db";
-	dnssec-policy short-lifetime;
-};
-
-zone limit-lifetime {
-	type primary;
-	file "limit-lifetime.db";
-	dnssec-policy short-lifetime;
-};
-
-zone unlimit-lifetime {
-	type primary;
-	file "unlimit-lifetime.db";
-	dnssec-policy unlimited-lifetime;
-};
@@ -24,29 +24,6 @@ dnssec-policy "nsec3" {
 	nsec3param iterations 0 optout no salt-length 0;
 };

-dnssec-policy "modified" {
-	keys {
-		csk lifetime unlimited algorithm rsasha256 2048;
-	};
-};
-
-dnssec-policy "unlimited-lifetime" {
-	keys {
-		csk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-dnssec-policy "short-lifetime" {
-	keys {
-		csk lifetime P6M algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "long-lifetime" {
-	keys {
-		csk lifetime P1Y algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
 dnssec-policy "rsasha256" {
 	signatures-refresh P5D;
 	signatures-validity 30d;
@@ -29,11 +29,6 @@ R="RUMOURED"
 O="OMNIPRESENT"
 U="UNRETENTIVE"

-for zn in shorter-lifetime longer-lifetime limit-lifetime unlimit-lifetime; do
-  setup $zn
-  cp template.db.in $zonefile
-done
-
 # The child zones (step1, step2) beneath these zones represent the various
 # steps of unsigning a zone.
 for zn in going-insecure.kasp going-insecure-dynamic.kasp; do
@@ -22,7 +22,7 @@ mkdir keys
 mkdir ns3/keys

 copy_setports ns2/named.conf.in ns2/named.conf
-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! $SHELL ../testcrypto.sh -q RSASHA1; then
  copy_setports ns3/named-fips.conf.in ns3/named.conf
 else
  copy_setports ns3/named-fips.conf.in ns3/named-fips.conf
@@ -32,10 +32,18 @@ copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf

+if $SHELL ../testcrypto.sh ed25519; then
+  echo "yes" >ed25519-supported.file
+fi
+
+if $SHELL ../testcrypto.sh ed448; then
+  echo "yes" >ed448-supported.file
+fi
+
 copy_setports ns3/policies/autosign.conf.in ns3/policies/autosign.conf
 copy_setports ns3/policies/kasp-fips.conf.in ns3/policies/kasp-fips.conf
 copy_setports ns3/policies/kasp.conf.in ns3/policies/kasp.conf
-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! $SHELL ../testcrypto.sh -q RSASHA1; then
  cp ns3/policies/kasp-fips.conf ns3/policies/kasp.conf
 fi

@@ -43,7 +51,7 @@ copy_setports ns6/policies/csk1.conf.in ns6/policies/csk1.conf
 copy_setports ns6/policies/csk2.conf.in ns6/policies/csk2.conf
 copy_setports ns6/policies/kasp-fips.conf.in ns6/policies/kasp-fips.conf
 copy_setports ns6/policies/kasp.conf.in ns6/policies/kasp.conf
-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! $SHELL ../testcrypto.sh -q RSASHA1; then
  cp ns6/policies/kasp-fips.conf ns6/policies/kasp.conf
 fi

@@ -826,7 +826,7 @@ set_keytimes_algorithm_policy() {
 #
 # Zone: rsasha1.kasp.
 #
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if $SHELL ../testcrypto.sh -q RSASHA1; then
  set_zone "rsasha1.kasp"
  set_policy "rsasha1" "3" "1234"
  set_server "ns3" "10.53.0.3"
@@ -1173,7 +1173,7 @@ status=$((status + ret))
 #
 # Zone: rsasha1-nsec3.kasp.
 #
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if $SHELL ../testcrypto.sh -q RSASHA1; then
  set_zone "rsasha1-nsec3.kasp"
  set_policy "rsasha1-nsec3" "3" "1234"
  set_server "ns3" "10.53.0.3"
@@ -1275,7 +1275,7 @@ dnssec_verify
 #
 # Zone: ed25519.kasp.
 #
-if [ $ED25519_SUPPORTED = 1 ]; then
+if [ -f ed25519-supported.file ]; then
  set_zone "ed25519.kasp"
  set_policy "ed25519" "3" "1234"
  set_server "ns3" "10.53.0.3"
@@ -1297,7 +1297,7 @@ fi
 #
 # Zone: ed448.kasp.
 #
-if [ $ED448_SUPPORTED = 1 ]; then
+if [ -f ed448-supported.file ]; then
  set_zone "ed448.kasp"
  set_policy "ed448" "3" "1234"
  set_server "ns3" "10.53.0.3"
@@ -2208,6 +2208,9 @@ active=$(key_get KEY1 ACTIVE)
 set_addkeytime "KEY1" "RETIRED" "${active}" 15552000
 retired=$(key_get KEY1 RETIRED)
 rndc_rollover "$SERVER" "$DIR" $(key_get KEY1 ID) "${retired}" "$ZONE"
+# Rollover starts in six months, but lifetime is set to six months plus
+# prepublication duration = 15552000 + 7500 = 15559500 seconds.
+set_keylifetime "KEY1" "15559500"
 set_addkeytime "KEY1" "RETIRED" "${active}" 15559500
 retired=$(key_get KEY1 RETIRED)
 # Retire interval of this policy is 26h (93600 seconds).
@@ -2223,6 +2226,9 @@ dnssec_verify
 # Schedule KSK rollover now.
 set_policy "manual-rollover" "3" "3600"
 set_keystate "KEY1" "GOAL" "hidden"
+# This key was activated one day ago, so lifetime is set to 1d plus
+# prepublication duration (7500 seconds) = 93900 seconds.
+set_keylifetime "KEY1" "93900"
 created=$(key_get KEY1 CREATED)
 set_keytime "KEY1" "RETIRED" "${created}"
 rndc_rollover "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "$ZONE"
@@ -2247,6 +2253,9 @@ dnssec_verify
 # Schedule ZSK rollover now.
 set_policy "manual-rollover" "4" "3600"
 set_keystate "KEY2" "GOAL" "hidden"
+# This key was activated one day ago, so lifetime is set to 1d plus
+# prepublication duration (7500 seconds) = 93900 seconds.
+set_keylifetime "KEY2" "93900"
 created=$(key_get KEY2 CREATED)
 set_keytime "KEY2" "RETIRED" "${created}"
 rndc_rollover "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "$ZONE"
@@ -3730,6 +3739,9 @@ check_apex
 check_subdomain
 dnssec_verify
 # Roll over KEY2.
+# Set expected key lifetime, which is DNSKEY TTL plus the zone propagation delay,
+# plus the publish-safety: 7200s + 1h + 1d = 97200 seconds.
+set_keylifetime "KEY2" "97200"
 created=$(key_get KEY2 CREATED)
 rndc_rollover "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "$ZONE"
 # Update expected number of keys and key states.
@@ -3781,65 +3793,6 @@ check_apex
 check_subdomain
 dnssec_verify

-# Test key lifetime changes
-set_keytimes_lifetime_update() {
-  if [ $1 -eq 0 ]; then
-    set_keytime "KEY1" "RETIRED" "none"
-    set_keytime "KEY1" "REMOVED" "none"
-  else
-    active=$(key_get KEY1 ACTIVE)
-    set_addkeytime "KEY1" "RETIRED" "${active}" $1
-    # The key is removed after the retire time plus max-zone-ttl (1d),
-    # sign delay (9d), zone propagation delay (5m), retire safety (1h) =
-    # 777600 + 86400 + 300 + 3600 = 867900
-    retired=$(key_get KEY1 RETIRED)
-    set_addkeytime "KEY1" "REMOVED" "${retired}" 867900
-  fi
-}
-
-check_key_lifetime() {
-  zone=$1
-  policy=$2
-  lifetime=$3
-
-  set_zone "$zone"
-  set_policy "$policy" "1" "3600"
-  set_server "ns6" "10.53.0.6"
-  # Key properties.
-  key_clear "KEY1"
-  set_keyrole "KEY1" "csk"
-  set_keylifetime "KEY1" "$lifetime"
-  set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
-  set_keysigning "KEY1" "yes"
-  set_zonesigning "KEY1" "yes"
-  key_clear "KEY2"
-  key_clear "KEY3"
-  key_clear "KEY4"
-
-  # The CSK is rumoured.
-  set_keystate "KEY1" "GOAL" "omnipresent"
-  set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
-  set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
-  set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
-  set_keystate "KEY1" "STATE_DS" "hidden"
-  check_keys
-
-  # Key timings.
-  set_keytimes_csk_policy
-  set_keytimes_lifetime_update $lifetime
-
-  # Variuous checks.
-  check_keytimes
-  check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-  check_apex
-  check_subdomain
-  dnssec_verify
-}
-check_key_lifetime "shorter-lifetime" "long-lifetime" "31536000"
-check_key_lifetime "longer-lifetime" "short-lifetime" "16070400"
-check_key_lifetime "limit-lifetime" "unlimited-lifetime" "0"
-check_key_lifetime "unlimit-lifetime" "short-lifetime" "16070400"
-
 #
 # Testing algorithm rollover.
 #
@@ -4173,12 +4126,6 @@ check_apex
 check_subdomain
 dnssec_verify

-# Test key lifetime updates.
-check_key_lifetime "shorter-lifetime" "short-lifetime" "16070400"
-check_key_lifetime "longer-lifetime" "long-lifetime" "31536000"
-check_key_lifetime "limit-lifetime" "short-lifetime" "16070400"
-check_key_lifetime "unlimit-lifetime" "unlimited-lifetime" "0"
-
 #
 # Testing going insecure.
 #
@@ -47,10 +47,8 @@ for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
  alg=$(echo "$algtypebits" | cut -f 1 -d :)
  type=$(echo "$algtypebits" | cut -f 2 -d :)
  bits=$(echo "$algtypebits" | cut -f 3 -d :)
-  alg_upper=$(echo "$alg" | tr '[:lower:]' '[:upper:]')
-  supported=$(eval "echo \$${alg_upper}_SUPPORTED")

-  if [ "${supported}" = 1 ]; then
+  if $SHELL ../testcrypto.sh $alg; then
    zone="$alg.example"
    zonefile="zone.$alg.example.db"
    ret=0
@@ -23,7 +23,6 @@ options {
 	notify yes;
 	minimal-responses no;
 	dnssec-validation no;
-	max-records-per-type 0;
 };

 zone "." {
@@ -26,12 +26,7 @@ $CHECKZONE -D -F raw=0 -o example.db.compat example-compat \
  example.db >/dev/null 2>&1
 $CHECKZONE -D -F raw -L 3333 -o example.db.serial.raw example \
  example.db >/dev/null 2>&1
-$CHECKZONE -D -F raw -o under-limit.db.raw under-limit under-limit.db >/dev/null 2>&1
-$CHECKZONE -D -F raw -o under-limit-kasp.db.raw under-limit-kasp under-limit-kasp.db >/dev/null 2>&1
-$CHECKZONE -D -F raw -o on-limit.db.raw on-limit on-limit.db >/dev/null 2>&1
-$CHECKZONE -D -F raw -o on-limit-kasp.db.raw on-limit-kasp on-limit-kasp.db >/dev/null 2>&1
-$CHECKZONE -D -F raw -o over-limit.db.raw over-limit over-limit.db >/dev/null 2>&1
-$CHECKZONE -D -F raw -o 255types.db.raw 255types 255types.db >/dev/null 2>&1
+$CHECKZONE -D -F raw -o large.db.raw large large.db >/dev/null 2>&1

 $KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK signed >/dev/null 2>&1
 $KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" signed >/dev/null 2>&1
@@ -23,8 +23,6 @@ options {
 	session-keyfile "session.key";
 	servfail-ttl 0;
 	dnssec-validation no;
-	max-records-per-type 2050;
-	max-types-per-name 500;
 };

 key rndc_key {
@@ -80,48 +78,9 @@ zone "transfer4" {
 };


-zone "under-limit" {
+zone "large" {
 	type primary;
-	file "under-limit.db.raw";
-	masterfile-format raw;
-	allow-transfer { any; };
-};
-
-zone "under-limit-kasp" {
-	type primary;
-	file "under-limit-kasp.db.raw";
-	masterfile-format raw;
-	dnssec-policy masterformat;
-	allow-transfer { any; };
-};
-
-zone "on-limit" {
-	type primary;
-	file "on-limit.db.raw";
-	masterfile-format raw;
-	allow-transfer { any; };
-};
-
-zone "on-limit-kasp" {
-	type primary;
-	file "on-limit-kasp.db.raw";
-	masterfile-format raw;
-	dnssec-policy masterformat;
-	inline-signing no;
-	allow-update { any; };
-	allow-transfer { any; };
-};
-
-zone "over-limit" {
-	type primary;
-	file "over-limit.db.raw";
-	masterfile-format raw;
-	allow-transfer { any; };
-};
-
-zone "255types" {
-	type primary;
-	file "255types.db.raw";
+	file "large.db.raw";
 	masterfile-format raw;
 	allow-transfer { any; };
 };
@@ -22,8 +22,6 @@ options {
 	notify no;
 	servfail-ttl 0;
 	dnssec-validation no;
-	max-records-per-type 2000;
-	max-types-per-name 200;
 };

 zone "example" {
@@ -58,37 +56,9 @@ zone "transfer4" {
 	file "transfer.db.full";
 };

-zone "under-limit" {
+zone "large" {
 	type secondary;
 	primaries { 10.53.0.1; };
 	masterfile-format raw;
-	file "under-limit.bk";
-};
-
-zone "under-limit-kasp" {
-	type secondary;
-	primaries { 10.53.0.1; };
-	masterfile-format raw;
-	file "under-limit-kasp.bk";
-};
-
-zone "on-limit" {
-	type secondary;
-	primaries { 10.53.0.1; };
-	masterfile-format raw;
-	file "on-limit.bk";
-};
-
-zone "on-limit-kasp" {
-	type secondary;
-	primaries { 10.53.0.1; };
-	masterfile-format raw;
-	file "on-limit-kasp.bk";
-};
-
-zone "255types" {
-	type secondary;
-	primaries { 10.53.0.1; };
-	masterfile-format raw;
-	file "255types.bk";
+	file "large.bk";
 };
@@ -1,28 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 1D
-
-@			IN SOA	ns hostmaster (
-				1
-				3600
-				1800
-				1814400
-				3
-				)
-			NS	ns
-ns			A	10.53.0.1
-mx			MX	10 mail
-a			A	10.53.0.1
-aaaa			AAAA	2001:db8::53
-cname			CNAME	cname-target
-dname			DNAME	dname-target
-txt			TXT	"this is text"
@@ -1,89 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS4
-
-options {
-	pid-file "named.pid";
-	listen-on port @PORT@ { 10.53.0.4; };
-	port @PORT@;
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	session-keyfile "session.key";
-	servfail-ttl 0;
-	dnssec-validation no;
-
-	/* Ridicously low on purpose */
-	max-records-per-type 1;
-	max-types-per-name 11;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm @DEFAULT_HMAC@;
-};
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-dnssec-policy "masterformat" {
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-/*
- * This one should be okay, since the default policy only introduces one DNSKEY
- * and each signature covering a different type is considered a separate RRset.
- */
-zone "kasp-max-records-per-type" {
-	type primary;
-	file "kasp-max-records-per-type.db.raw";
-	masterfile-format raw;
-	dnssec-policy "default";
-	inline-signing no;
-	allow-update { any; };
-	allow-transfer { any; };
-};
-
-/*
- * This one uses a ZSK / KSK, so that is two records in one RRset,
- * thus it should fail to sign.
- */
-zone "kasp-max-records-per-type-dnskey" {
-	type primary;
-	file "kasp-max-records-per-type-dnskey.db.raw";
-	masterfile-format raw;
-	dnssec-policy "masterformat";
-	inline-signing no;
-	allow-update { any; };
-	allow-transfer { any; };
-};
-
-/*
- * The template zone is fine and should be possible to sign, but when
- * adding an extra type to the apex the max-types-per-name will be exceeded,
- * meaning the update should fail.
- */
-zone "kasp-max-types-per-name" {
-	type primary;
-	file "kasp-max-types-per-name.db.raw";
-	masterfile-format raw;
-	dnssec-policy "default";
-	inline-signing no;
-	allow-update { any; };
-	allow-transfer { any; };
-};
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS4
-
-options {
-	pid-file "named.pid";
-	listen-on port @PORT@ { 10.53.0.4; };
-	port @PORT@;
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	session-keyfile "session.key";
-	servfail-ttl 0;
-	dnssec-validation no;
-
-	/* Ridicously low on purpose */
-	max-records-per-type 1;
-	max-types-per-name 9;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm @DEFAULT_HMAC@;
-};
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/*
- * The template zone is fine, but when adding the DNSSEC records to the apex,
- * the max-types-per-name will be exceeded, meaning signing should fail.
- */
-zone "kasp-max-types-per-name" {
-	type primary;
-	file "kasp-max-types-per-name.db.raw";
-	masterfile-format raw;
-	dnssec-policy "default";
-	inline-signing no;
-	allow-update { any; };
-	allow-transfer { any; };
-};
@@ -1,28 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 1D
-
-@			IN SOA	ns hostmaster (
-				1
-				3600
-				1800
-				1814400
-				3
-				)
-			NS	ns
-ns			A	10.53.0.1
-mx			MX	10 mail
-a			A	10.53.0.1
-aaaa			AAAA	2001:db8::53
-cname			CNAME	cname-target
-dname			DNAME	dname-target
-txt			TXT	"this is text"
@@ -19,44 +19,13 @@ $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
-copy_setports ns4/named1.conf.in ns4/named.conf

 cp ns1/example.db ns2/
 cp ns2/formerly-text.db.in ns2/formerly-text.db
-cp ns1/empty.db.in ns1/under-limit.db
-
-# counts are set with respect to these limits in named.conf:
-#	max-records-per-type 2050;
-#	max-types-per-name 500;
+cp ns1/large.db.in ns1/large.db
 awk 'END {
-	 for (i = 0; i < 500; i++ ) { print "500-txt TXT", i; }
-	 for (i = 0; i < 1000; i++ ) { print "1000-txt TXT", i; }
-	 for (i = 0; i < 2000; i++ ) { print "2000-txt TXT", i; }
-}' </dev/null >>ns1/under-limit.db
-cp ns1/under-limit.db ns1/under-limit-kasp.db
-
-cp ns1/empty.db.in ns1/on-limit.db
-awk 'END {
-	 for (i = 0; i < 500; i++ ) { print "500-txt TXT", i; }
-	 for (i = 0; i < 1000; i++ ) { print "1000-txt TXT", i; }
-	 for (i = 0; i < 2000; i++ ) { print "2000-txt TXT", i; }
-	 for (i = 0; i < 2050; i++ ) { print "2050-txt TXT", i; }
-}' </dev/null >>ns1/on-limit.db
-cp ns1/on-limit.db ns1/on-limit-kasp.db
-
-cp ns1/empty.db.in ns1/over-limit.db
-awk 'END {
-	 for (i = 0; i < 500; i++ ) { print "500-txt TXT", i; }
-	 for (i = 0; i < 1000; i++ ) { print "1000-txt TXT", i; }
-	 for (i = 0; i < 2000; i++ ) { print "2000-txt TXT", i; }
-	 for (i = 0; i < 2050; i++ ) { print "2050-txt TXT", i; }
-	 for (i = 0; i < 2100; i++ ) { print "2100-txt TXT", i; }
-}' </dev/null >>ns1/over-limit.db
-
-cp ns1/empty.db.in ns1/255types.db
-for ntype in $(seq 65280 65534); do
-  echo "m TYPE${ntype} \# 0"
-done >>ns1/255types.db
-echo "m TXT bunny" >>ns1/255types.db
-(cd ns1 && $SHELL compile.sh)
-(cd ns4 && $SHELL compile.sh)
+	 for (i = 0; i < 512; i++ ) { print "a TXT", i; }
+	 for (i = 0; i < 1024; i++ ) { print "b TXT", i; }
+	 for (i = 0; i < 2000; i++ ) { print "c TXT", i; }
+}' </dev/null >>ns1/large.db
+cd ns1 && $SHELL compile.sh
@@ -134,7 +134,7 @@ n=$((n + 1))
 status=$((status + ret))

 echo_i "waiting for transfers to complete"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
+for i in 0 1 2 3 4 5 6 7 8 9; do
  test -f ns2/transfer.db.raw -a -f ns2/transfer.db.txt && break
  sleep 1
 done
@@ -162,7 +162,7 @@ n=$((n + 1))
 status=$((status + ret))

 echo_i "checking that secondary formerly in text format is now raw ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
+for i in 0 1 2 3 4 5 6 7 8 9; do
  ret=0
  israw ns2/formerly-text.db >/dev/null 2>&1 || ret=1
  [ "$(rawversion ns2/formerly-text.db)" -eq 1 ] || ret=1
@@ -173,12 +173,12 @@ n=$((n + 1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))

-echo_i "checking that under-limit rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
+echo_i "checking that large rdatasets loaded ($n)"
+for i in 0 1 2 3 4 5 6 7 8 9; do
  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt; do
-    $DIG +tcp txt "${rrcount}.under-limit" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
+  for a in a b c; do
+    $DIG +tcp txt "${a}.large" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.test$n"
+    grep "status: NOERROR" "dig.out.ns2.test$n" >/dev/null || ret=1
  done
  [ $ret -eq 0 ] && break
  sleep 1
@@ -187,252 +187,6 @@ n=$((n + 1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))

-echo_i "checking that under-limit rdatasets transfered ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt; do
-    $DIG +tcp txt "${rrcount}.under-limit" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns2.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that under-limit-kasp dnskeys loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-
-  $DIG +tcp +dnssec dnskey "under-limit-kasp" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.dnskey.test$n"
-  grep "status: NOERROR" "dig.out.ns1.dnskey.test$n" >/dev/null || ret=1
-  grep "RRSIG" "dig.out.ns1.dnskey.test$n" >/dev/null || ret=1
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that under-limit-kasp rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt; do
-    $DIG +tcp +dnssec txt "${rrcount}.under-limit-kasp" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-    grep "RRSIG" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that under-limit-kasp rdatasets transfered ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt; do
-    $DIG +tcp +dnssec txt "${rrcount}.under-limit-kasp" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns2.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that on-limit rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt 2050-txt; do
-    $DIG +tcp txt "${rrcount}.on-limit" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that on-limit rdatasets not transfered ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt 2050-txt; do
-    $DIG +tcp txt "${rrcount}.on-limit" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.$rrcount.test$n"
-    grep "status: SERVFAIL" "dig.out.ns2.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that on-limit-kasp rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt 2050-txt; do
-    $DIG +tcp +dnssec txt "${rrcount}.on-limit-kasp" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-    grep "RRSIG" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that on-limit-kasp rdatasets not transfered ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt 2050-txt; do
-    $DIG +tcp +dnssec txt "${rrcount}.on-limit-kasp" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.$rrcount.test$n"
-    grep "status: SERVFAIL" "dig.out.ns2.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that over-limit rdatasets not loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt 2050-txt 2100-txt; do
-    $DIG +tcp txt "${rrcount}.over-limit" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$rrcount.test$n"
-    grep "status: SERVFAIL" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that kasp-max-records-per-type rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrtype in soa dnskey ns; do
-    $DIG +tcp +dnssec $rrtype "kasp-max-records-per-type" @10.53.0.4 -p "${PORT}" >"dig.out.ns4.$rrtype.test$n"
-    grep "status: NOERROR" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-    grep "RRSIG" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that kasp-max-records-per-type-dnskey rdatasets not signed ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrtype in soa dnskey ns; do
-    $DIG +tcp +dnssec $rrtype "kasp-max-records-per-type-dnskey" @10.53.0.4 -p "${PORT}" >"dig.out.ns4.$rrtype.test$n"
-    grep "status: NOERROR" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-    grep "RRSIG" "dig.out.ns4.$rrtype.test$n" >/dev/null && ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that kasp-max-types-per-name rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrtype in soa dnskey ns; do
-    $DIG +tcp +dnssec $rrtype "kasp-max-types-per-name" @10.53.0.4 -p "${PORT}" >"dig.out.ns4.$rrtype.test$n"
-    grep "status: NOERROR" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-    grep "RRSIG" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-# Update zone with nsupdate.
-echo_i "add new type to zone and check that it fails ($n)"
-ret=0
-(
-  echo zone kasp-max-types-per-name.
-  echo server 10.53.0.4 "$PORT"
-  echo update add kasp-max-types-per-name. 300 TXT KAPUTT
-  echo send
-) | $NSUPDATE && ret=1
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that kasp-max-types-per-name rdatasets loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrtype in soa dnskey ns txt; do
-    $DIG +tcp +dnssec $rrtype "kasp-max-types-per-name" @10.53.0.4 -p "${PORT}" >"dig.out.ns4.$rrtype.test$n"
-    grep "status: NOERROR" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-    grep "KAPUTT" "dig.out.ns4.$rrtype.test$n" >/dev/null && ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-# Reconfigure ns4
-echo_i "reconfigure ns4"
-stop_server ns4
-copy_setports ns4/named2.conf.in ns4/named.conf
-# Recompile zone
-$CHECKZONE -D -F raw -o ns4/kasp.db.raw kasp-max-types-per-name ns4/template.db >/dev/null 2>&1
-start_server --noclean --restart --port "${PORT}" ns4
-
-echo_i "checking that kasp-max-types-per-name rdatasets not loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrtype in soa dnskey ns; do
-    $DIG +tcp +dnssec $rrtype "kasp-max-types-per-name" @10.53.0.4 -p "${PORT}" >"dig.out.ns4.$rrtype.test$n"
-    grep "status: SERVFAIL" "dig.out.ns4.$rrtype.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that 255 types are loaded ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  $DIG +tcp TXT "m.255types" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.test$n"
-  grep "status: NOERROR" "dig.out.ns1.test$n" >/dev/null || ret=1
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-echo_i "checking that 255 types types are not transfered ($n)"
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  $DIG +tcp TXT "m.255types" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.test$n"
-  grep "status: SERVFAIL" "dig.out.ns2.test$n" >/dev/null || ret=1
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
 echo_i "checking format transitions: text->raw->text ($n)"
 ret=0
 $CHECKZONE -D -f text -F text -o baseline.txt example.nil ns1/example.db >/dev/null
@@ -486,7 +240,7 @@ stop_server --use-rndc --port ${CONTROLPORT} ns3
 rm ns3/*.jnl
 restart
 #shellcheck disable=SC2034
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
+for i in 0 1 2 3 4 5 6 7 8 9; do
  lret=0
  dig_with_opts +comm @10.53.0.3 moretext.dynamic txt >"dig.out.dynamic2.ns3.test$n"
  grep "more text" "dig.out.dynamic2.ns3.test$n" >/dev/null 2>&1 || lret=1
@@ -519,24 +273,5 @@ n=$((n + 1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))

-echo_i "checking that on-limit-kasp rdatasets loaded after re-sign and re-start ($n)"
-ret=0
-stop_server ns1
-start_server --noclean --restart --port "${PORT}" ns1
-
-for _attempt in 0 1 2 3 4 5 6 7 8 9; do
-  ret=0
-  for rrcount in 500-txt 1000-txt 2000-txt 2050-txt; do
-    $DIG +tcp +dnssec txt "${rrcount}.on-limit-kasp" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$rrcount.test$n"
-    grep "status: NOERROR" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-    grep "RRSIG" "dig.out.ns1.$rrcount.test$n" >/dev/null || ret=1
-  done
-  [ $ret -eq 0 ] && break
-  sleep 1
-done
-n=$((n + 1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -11,12 +11,15 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-# Explicitly setting ALGORITHM_SET is only needed is the script is executed
-# standalone without the pytest runner (e.g. for debugging).
 export ALGORITHM_SET="ecc_default"
-
 . ../conf.sh

+# Ensure the selected algorithm set is okay.
+if [ "$ALGORITHM_SET" = "error" ]; then
+  echofail "Algorithm selection failed." >&2
+  exit 1
+fi
+
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -13,6 +13,7 @@

 set -e

+export ALGORITHM_SET="ecc_default"
 #shellcheck source=conf.sh
 . ../conf.sh

@@ -9,10 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.algorithm_set("ecc_default")
-

 def test_mkeys(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,248 @@
+import contextlib
+import ctypes
+import errno
+import os
+import pyroute2
+import pytest
+import signal
+import multiprocessing
+
+# TODO move to contrib
+
+# All allowed namespace types
+NAMESPACE_FLAGS = dict(
+    mnt=0x00020000,
+    uts=0x04000000,
+    ipc=0x08000000,
+    user=0x10000000,
+    pid=0x20000000,
+    net=0x40000000,
+)
+STACKSIZE = 1024 * 1024
+
+libc = ctypes.CDLL("libc.so.6", use_errno=True)
+
+
+@contextlib.contextmanager
+def keep_directory():
+    """Restore the current directory on exit."""
+    pwd = os.getcwd()
+    try:
+        yield
+    finally:
+        os.chdir(pwd)
+
+
+def mount_sys(target="/sys"):
+    flags = [2 | 4 | 8]  # MS_NOSUID | MS_NODEV | MS_NOEXEC
+    flags.append(1 << 18)  # MS_PRIVATE
+    flags.append(1 << 19)  # MS_SLAVE
+    for fl in flags:
+        ret = libc.mount(b"none", target.encode("ascii"), b"sysfs", fl, None)
+        if ret == -1:
+            e = ctypes.get_errno()
+            raise OSError(e, os.strerror(e))
+
+
+def mount_tmpfs(target, private=False):
+    flags = [0]
+    if private:
+        flags.append(1 << 18)  # MS_PRIVATE
+        flags.append(1 << 19)  # MS_SLAVE
+    for fl in flags:
+        ret = libc.mount(b"none", target.encode("ascii"), b"tmpfs", fl, None)
+        if ret == -1:
+            e = ctypes.get_errno()
+            raise OSError(e, os.strerror(e))
+
+
+def _mount_proc(target):
+    flags = [2 | 4 | 8]  # MS_NOSUID | MS_NODEV | MS_NOEXEC
+    flags.append(1 << 18)  # MS_PRIVATE
+    flags.append(1 << 19)  # MS_SLAVE
+    for fl in flags:
+        ret = libc.mount(b"proc", target.encode("ascii"), b"proc", fl, None)
+        if ret == -1:
+            e = ctypes.get_errno()
+            raise OSError(e, os.strerror(e))
+
+
+def mount_proc(target="/proc"):
+    # We need to be sure /proc is correct. We do that in another
+    # process as this doesn't play well with setns().
+    if not os.path.isdir(target):
+        os.mkdir(target)
+    p = multiprocessing.Process(target=_mount_proc, args=(target,))
+    p.start()
+    p.join()
+
+
+class Namespace(object):
+    """Combine several namespaces into one.
+
+    This gets a list of namespace types to create and combine into one. The
+    combined namespace can be used as a context manager to enter all the
+    created namespaces and exit them at the end.
+    """
+
+    def __init__(self, *namespaces):
+        self.next = []
+        self.namespaces = namespaces
+        for ns in namespaces:
+            assert ns in NAMESPACE_FLAGS
+
+        # Get a pipe to signal the future child to exit
+        self.pipe = os.pipe()
+
+        # First, create a child in the given namespaces
+        child = ctypes.CFUNCTYPE(ctypes.c_int)(self.child)
+        child_stack = ctypes.create_string_buffer(STACKSIZE)
+        child_stack_pointer = ctypes.c_void_p(
+            ctypes.cast(child_stack, ctypes.c_void_p).value + STACKSIZE
+        )
+        flags = signal.SIGCHLD
+        for ns in namespaces:
+            flags |= NAMESPACE_FLAGS[ns]
+        self.pid = libc.clone(child, child_stack_pointer, flags)
+        if self.pid == -1:
+            e = ctypes.get_errno()
+            raise OSError(e, os.strerror(e))
+
+        # If a user namespace, map UID 0 to the current one
+        if "user" in namespaces:
+            uid_map = "0 {} 1".format(os.getuid())
+            gid_map = "0 {} 1".format(os.getgid())
+            print(uid_map)
+            with open("/proc/{}/uid_map".format(self.pid), "w") as f:
+                f.write(uid_map)
+            with open("/proc/{}/setgroups".format(self.pid), "w") as f:
+                f.write("deny")
+            with open("/proc/{}/gid_map".format(self.pid), "w") as f:
+                f.write(gid_map)
+
+        # Retrieve a file descriptor to this new namespace
+        self.next = [
+            os.open("/proc/{}/ns/{}".format(self.pid, x), os.O_RDONLY)
+            for x in namespaces
+        ]
+
+        # Keep a file descriptor to our old namespaces
+        self.previous = [
+            os.open("/proc/self/ns/{}".format(x), os.O_RDONLY) for x in namespaces
+        ]
+
+        # Tell the child all is done and let it die
+        os.close(self.pipe[0])
+        if "pid" not in self.namespaces:
+            os.close(self.pipe[1])
+            self.pipe = None
+            os.waitpid(self.pid, 0)
+
+    def __del__(self):
+        for fd in self.next:
+            os.close(fd)
+        for fd in self.previous:
+            os.close(fd)
+        if self.pipe is not None:
+            os.close(self.pipe[1])
+
+    def child(self):
+        """Cloned child.
+
+        Just be here until our parent extract the file descriptor from
+        us.
+
+        """
+        os.close(self.pipe[1])
+
+        # For a network namespace, enable lo
+        if "net" in self.namespaces:
+            with pyroute2.IPRoute() as ipr:
+                lo = ipr.link_lookup(ifname="lo")[0]
+                ipr.link("set", index=lo, state="up")
+        # For a mount namespace, make it private
+        if "mnt" in self.namespaces:
+            libc.mount(
+                b"none",
+                b"/",
+                None,
+                # MS_REC | MS_PRIVATE
+                16384 | (1 << 18),
+                None,
+            )
+
+        while True:
+            try:
+                os.read(self.pipe[0], 1)
+            except OSError as e:
+                if e.errno in [errno.EAGAIN, errno.EINTR]:
+                    continue
+            break
+
+        os._exit(0)
+
+    def fd(self, namespace):
+        """Return the file descriptor associated to a namespace"""
+        assert namespace in self.namespaces
+        return self.next[self.namespaces.index(namespace)]
+
+    def __enter__(self):
+        with keep_directory():
+            for n in self.next:
+                if libc.setns(n, 0) == -1:
+                    ns = self.namespaces[self.next.index(n)]  # NOQA
+                    e = ctypes.get_errno()
+                    raise OSError(e, os.strerror(e))
+
+    def __exit__(self, *exc):
+        # TODO remove -- we can't exit the namespaces anyway (yay user namespace!)
+        # with keep_directory():
+        #     err = None
+        #     for p in reversed(self.previous):
+        #         if libc.setns(p, 0) == -1 and err is None:
+        #             ns = self.namespaces[self.previous.index(p)]  # NOQA
+        #             e = ctypes.get_errno()
+        #             err = OSError(e, os.strerror(e))
+        #     if err:
+        #         raise err
+        pass
+
+    def __repr__(self):
+        return "Namespace({})".format(", ".join(self.namespaces))
+
+
+class NamespaceFactory(object):
+    """Dynamically create namespaces as they are created.
+
+    Those namespaces are namespaces for IPC, net, mount and UTS. PID
+    is a bit special as we have to keep a process for that. We don't
+    do that to ensure that everything is cleaned
+    automatically. Therefore, the child process is killed as soon as
+    we got a file descriptor to the namespace. We don't use a user
+    namespace either because we are unlikely to be able to exit it.
+
+    """
+
+    def __init__(self, tmpdir):
+        self.namespaces = {}
+        self.tmpdir = tmpdir
+
+    def __call__(self, ns):
+        """Return a namespace. Create it if it doesn't exist."""
+        if ns in self.namespaces:
+            return self.namespaces[ns]
+
+        self.namespaces[ns] = Namespace("ipc", "net", "mnt", "uts")
+        with self.namespaces[ns]:
+            mount_proc()
+            mount_sys()
+            # Also setup the "namespace-dependant" directory
+            self.tmpdir.join("ns").ensure(dir=True)
+            mount_tmpfs(str(self.tmpdir.join("ns")), private=True)
+
+        return self.namespaces[ns]
+
+
+@pytest.fixture
+def namespaces(tmpdir):
+    return NamespaceFactory(tmpdir)
@@ -31,7 +31,10 @@ for zn in nsec-to-nsec3 nsec3 nsec3-other nsec3-change nsec3-to-nsec \
  setup "${zn}.kasp"
 done

-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if (
+  cd ..
+  $SHELL ../testcrypto.sh -q RSASHA1
+); then
  for zn in rsasha1-to-nsec3 rsasha1-to-nsec3-wait nsec3-to-rsasha1 \
    nsec3-to-rsasha1-ds; do
    setup "${zn}.kasp"
@@ -24,7 +24,7 @@ copy_setports ns2/named.conf.in ns2/named.conf
  $SHELL setup.sh
 )

-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
  copy_setports ns3/named-fips.conf.in ns3/named.conf
 else
  copy_setports ns3/named-fips.conf.in ns3/named-fips.conf
@@ -242,7 +242,7 @@ set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec

-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if ($SHELL ../testcrypto.sh -q RSASHA1); then
  # Zone: rsasha1-to-nsec3.kasp.
  set_zone_policy "rsasha1-to-nsec3.kasp" "rsasha1" 1 3600
  set_server "ns3" "10.53.0.3"
@@ -391,7 +391,7 @@ check_nsec
 # Reconfig named.
 ret=0
 echo_i "reconfig dnssec-policy to trigger nsec3 rollovers"
-if [ $RSASHA1_SUPPORTED = 0 ]; then
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
  copy_setports ns3/named2-fips.conf.in ns3/named.conf
 else
  copy_setports ns3/named2-fips.conf.in ns3/named-fips.conf
@@ -407,7 +407,7 @@ set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3

-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if ($SHELL ../testcrypto.sh -q RSASHA1); then
  # Zone: rsasha1-to-nsec3.kasp.
  set_zone_policy "rsasha1-to-nsec3.kasp" "nsec3" 2 3600
  set_server "ns3" "10.53.0.3"
@@ -54,7 +54,6 @@ rm -f ns3/many.test.bk
 rm -f ns3/nsec3param.test.db
 rm -f ns3/too-big.test.db
 rm -f ns5/local.db
-rm -f ns6/2.0.0.2.ip6.addr.db
 rm -f ns6/in-addr.db
 rm -f ns7/_default.tsigkeys
 rm -f ns7/example.com.db
@@ -21,7 +21,6 @@ options {
 	session-keyfile "session.key";
 	listen-on { 10.53.0.10; };
 	listen-on tls ephemeral { 10.53.0.10; };
-	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
 	minimal-responses no;
@@ -19,7 +19,6 @@ options {
 	pid-file "named.pid";
 	session-keyfile "session.key";
 	listen-on { 10.53.0.5; };
-	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
 	minimal-responses no;
@@ -1,21 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@		IN SOA	ns5.local.nil. hostmaster.local.nil. (
-				1	   ; serial
-				2000       ; refresh (2000 seconds)
-				2000       ; retry (2000 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns6
-ns6			A	10.53.0.6
@@ -15,14 +15,10 @@ options {
 	query-source address 10.53.0.6;
 	notify-source 10.53.0.6;
 	transfer-source 10.53.0.6;
-	query-source-v6 address fd92:7065:b8e:ffff::6;
-	notify-source-v6 fd92:7065:b8e:ffff::6;
-	transfer-source-v6 fd92:7065:b8e:ffff::6;
 	port @PORT@;
 	pid-file "named.pid";
 	session-keyfile "session.key";
 	listen-on { 10.53.0.6; };
-	listen-on-v6 { fd92:7065:b8e:ffff::6; };
 	recursion no;
 	notify yes;
 	minimal-responses no;
@@ -43,9 +39,3 @@ zone "in-addr.arpa" {
 	file "in-addr.db";
 	update-policy {	grant * tcp-self . PTR(1) ANY(2) A; };
 };
-
-zone "2.0.0.2.ip6.arpa" {
-	type primary;
-	file "2.0.0.2.ip6.addr.db";
-	update-policy {	grant * 6to4-self . NS(10) DS(4); };
-};
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Nicki Křížek	8e2e0cd2d7	WIP use user+net namespace	2024-06-24 16:31:21 +02:00
Nicki Křížek	14a3012171	WIP namespaces.py	2024-06-24 16:30:09 +02:00