Disable thread sanitizer in problematic functions

Add a status line to rndc status notifying that server is being reloaded/reconfigured; use it in tests

See merge request isc-projects/bind9!1149

.gitlab-ci.yml

@@ -82,20 +82,6 @@ stages:
     - docker
     - i386
 
-.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
-  tags:
-    - linux
-    - docker
-    - i386
-
 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
   image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
   tags:
@@ -110,6 +96,20 @@ stages:
     - docker
     - i386
 
+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  tags:
+    - linux
+    - docker
+    - amd64
+
+.ubuntu-bionic-i386: &ubuntu_bionic_i386_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
+  tags:
+    - linux
+    - docker
+    - i386
+
 .build: &build_job
   stage: build
   before_script:
@@ -117,7 +117,7 @@ stages:
 #    - ./autogen.sh
   script:
     - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
-    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
   artifacts:
     paths:
     - doc/
@@ -133,6 +133,7 @@ stages:
 
 .system_test: &system_test_job
   stage: test
+  retry: 2
   before_script:
     - rm -rf .ccache
     - bash -x bin/tests/system/ifconfig.sh up
@@ -167,6 +168,9 @@ sid:amd64:precheck:
   stage: precheck
   script:
     - sh util/checklibs.sh > checklibs.out
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - rm CHANGES.tmp
     - perl util/check-changes CHANGES
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
@@ -226,8 +230,8 @@ docs:push:
 #  <<: *debian_buster_i386_image
 #  <<: *build_job
 #
-#build:ubuntu:trusty:amd64:
-#  <<: *ubuntu_trusty_amd64_image
+#build:ubuntu:bionic:amd64:
+#  <<: *ubuntu_bionic_amd64_image
 #  <<: *build_job
 #
 #build:ubuntu:xenial:i386:
@@ -254,6 +258,7 @@ clang:stretch:amd64:build:
   variables:
     CC: clang
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python3"
   <<: *debian_stretch_amd64_image
   <<: *build_job
 
@@ -261,7 +266,7 @@ jessie:amd64:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: --without-cmocka
+    EXTRA_CONFIGURE: "--without-cmocka --with-python"
   <<: *debian_jessie_amd64_image
   <<: *build_job
 
@@ -293,6 +298,7 @@ clang:stretch:i386:build:
   variables:
     CC: clang
     CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    EXTRA_CONFIGURE: "--with-python=python2"
   <<: *debian_stretch_i386_image
   <<: *build_job
 
@@ -300,7 +306,7 @@ sid:i386:build:
   variables:
     CC: gcc
     CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
   <<: *debian_sid_i386_image
   <<: *build_job
 
@@ -439,3 +445,42 @@ noassert:system:sid:amd64:
   <<: *system_test_job
   dependencies:
     - noassert:sid:amd64:build
+
+xenial:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *ubuntu_xenial_amd64_image
+  <<: *build_job
+
+unit:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - xenial:amd64:build
+
+system:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - xenial:amd64:build
+
+bionic:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+
+unit:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - bionic:amd64:build
+
+system:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - bionic:amd64:build

CHANGES

@@ -1,3 +1,62 @@
+5114.	[func]		Include a 'reconfig/reload in progress' status line
+			in rndc status, use it in tests.
+
+5113.	[port]		Fixed a Windows build error.
+
+5112.	[bug]		Named/named-checkconf could dump core if there was
+			a missing masters clause and a bad notify clause.
+			[GL #779]
+
+5111.	[bug]		Occluded DNSKEY records could make it into the
+			delegating NSEC/NSEC3 bitmap. [GL #742]
+
+5110.	[placeholder]
+
+5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]
+
+	--- 9.13.5 released ---
+
+5108.	[bug]		Named could fail to determine bottom of zone when
+			removing out of date keys leading to invalid NSEC
+			and NSEC3 records being added to the zone. [GL #771]
+
+5107.	[bug]		'host -U' did not work. [GL #769]
+
+5106.	[experimental]	A new "plugin" mechanism has been added to allow
+			extension of query processing functionality through
+			the use of dynamically loadable libraries. A
+			"filter-aaaa.so" plugin has been implemented,
+			replacing the filter-aaaa feature that was formerly
+			implemented as a native part of BIND.
+
+			The "filter-aaaa", "filter-aaaa-on-v4" and
+			"filter-aaaa-on-v6" options can no longer be
+			configured using native named.conf syntax. However,
+			loading the filter-aaaa.so plugin and setting its
+			parameters provides identical functionality.
+
+			Note that the plugin API is a work in progress and
+			is likely to evolve as further plugins are
+			implemented. [GL #15]
+
+5105.	[bug]		Fix a race between process_fd and socketclose in
+			unix socket code. [GL #744]
+
+5104.	[cleanup]	Log clearer informational message when a catz zone
+			is overridden by a zone in named.conf.
+			Thanks to Tony Finch. [GL !1157]
+
+5103.	[bug]		Add missing design by contract tests to dns_catz*.
+			[GL #748]
+
+5102.	[bug]		dnssec-coverage failed to use the default TTL when
+			checking KSK deletion times leading to a exception.
+			[GL #585]
+
+5101.	[bug]		Fix default installation path for Python modules and
+			remove the dnspython dependency accidentally introduced
+			by change 4970. [GL #730]
+
 5100.	[func]		Pin resolver tasks to specific task queues. [GL !1117]
 
 5099.	[func]		Failed mutex and conditional creations are always

README

@@ -104,6 +104,10 @@ BIND 9.13 features
 BIND 9.13 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.12 and earlier releases. New features include:
 
+  * A new "plugin" mechanism has been added to allow query functionality
+    to be extended using dynamically loadable libraries. The "filter-aaaa"
+    feature has been removed from named and is now implemented as a
+    plugin.
   * Socket and task code has been refactored to improve performance.
   * QNAME minimization, as described in RFC 7816, is now supported.
   * "Root key sentinel" support, enabling validating resolvers to indicate

README.md

@@ -122,6 +122,9 @@ BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
+* A new "plugin" mechanism has been added to allow query functionality
+  to be extended using dynamically loadable libraries. The "filter-aaaa"
+  feature has been removed from named and is now implemented as a plugin.
 * Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
 * "Root key sentinel" support, enabling validating resolvers to indicate

bin/Makefile.in

@@ -12,7 +12,7 @@ VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
 SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
+		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
 TARGETS =
 
 @BIND9_MAKE_RULES@

bin/check/Makefile.in

@@ -66,7 +66,7 @@ named-checkzone.@O@: named-checkzone.c
 named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
 		${NSDEPENDLIBS} ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
 	export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
-	export LIBS0="${NSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
+	export LIBS0="${BIND9LIBS} ${NSLIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
 named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} \

bin/check/named-checkconf.8

@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-chjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -79,6 +79,13 @@ When loading a zonefile read the journal if it exists\&.
 List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
 .RE
 .PP
+\-c
+.RS 4
+Check "core" configuration only\&. This suppresses the loading of plugin modules, and causes all parameters to
+\fBplugin\fR
+statements to be ignored\&.
+.RE
+.PP
 \-p
 .RS 4
 Print out the

bin/check/named-checkconf.c

@@ -46,6 +46,8 @@
 
 static const char *program = "named-checkconf";
 
+static bool loadplugins = true;
+
 isc_log_t *logc = NULL;
 
 #define CHECK(r)\
@@ -562,7 +564,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "dhjlm:t:pvxz"
+#define CMDLINE_FLAGS "cdhjlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -587,6 +589,10 @@ main(int argc, char **argv) {
 
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
+		case 'c':
+			loadplugins = false;
+			break;
+
 		case 'd':
 			debug++;
 			break;
@@ -677,9 +683,10 @@ main(int argc, char **argv) {
 	    ISC_R_SUCCESS)
 		exit(1);
 
-	result = bind9_check_namedconf(config, logc, mctx);
-	if (result != ISC_R_SUCCESS)
+	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	if (result != ISC_R_SUCCESS) {
 		exit_status = 1;
+	}
 
 	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
 		result = load_zones_fromconfig(config, mctx, list_zones);

bin/check/named-checkconf.docbook

@@ -52,7 +52,7 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>named-checkconf</command>
-      <arg choice="opt" rep="norepeat"><option>-hjlvz</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-chjlvz</option></arg>
       <arg choice="opt" rep="norepeat"><option>-p</option>
 	<arg choice="opt" rep="norepeat"><option>-x</option>
       </arg></arg>
@@ -114,6 +114,17 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-c</term>
+        <listitem>
+          <para>
+	    Check "core" configuration only. This suppresses the loading
+	    of plugin modules, and causes all parameters to
+	    <command>plugin</command> statements to be ignored.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-p</term>
         <listitem>

bin/check/named-checkconf.html

@@ -33,7 +33,7 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">named-checkconf</code> 
-       [<code class="option">-hjlvz</code>]
+       [<code class="option">-chjlvz</code>]
        [<code class="option">-p</code>
 	 [<code class="option">-x</code>
       ]]
@@ -88,6 +88,14 @@
             (e.g. master or slave).
           </p>
         </dd>
+<dt><span class="term">-c</span></dt>
+<dd>
+          <p>
+	    Check "core" configuration only. This suppresses the loading
+	    of plugin modules, and causes all parameters to
+	    <span class="command"><strong>plugin</strong></span> statements to be ignored.
+          </p>
+        </dd>
 <dt><span class="term">-p</span></dt>
 <dd>
           <p>

bin/dig/host.c

@@ -151,6 +151,7 @@ show_usage(void) {
 "       -s a SERVFAIL response should stop query\n"
 "       -t specifies the query type\n"
 "       -T enables TCP/IP mode\n"
+"       -U enables UDP mode\n"
 "       -v enables verbose output\n"
 "       -V print version number and exit\n"
 "       -w specifies to wait forever for a reply\n"
@@ -624,28 +625,29 @@ pre_parse_args(int argc, char **argv) {
 		case 'a': break;
 		case 'A': break;
 		case 'c': break;
+		case 'C': break;
 		case 'd': break;
+		case 'D':
+			if (debugging)
+				debugtiming = true;
+			debugging = true;
+			break;
 		case 'i': break;
 		case 'l': break;
 		case 'n': break;
+		case 'N': break;
 		case 'r': break;
+		case 'R': break;
 		case 's': break;
 		case 't': break;
+		case 'T': break;
+		case 'U': break;
 		case 'v': break;
 		case 'V':
 			  version();
 			  exit(0);
 			  break;
 		case 'w': break;
-		case 'C': break;
-		case 'D':
-			if (debugging)
-				debugtiming = true;
-			debugging = true;
-			break;
-		case 'N': break;
-		case 'R': break;
-		case 'T': break;
 		case 'W': break;
 		default:
 			show_usage();

bin/dnssec/dnssec-cds.c

@@ -573,7 +573,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		ki->algo = dnskey.algorithm;
 
 		dns_rdata_toregion(keyrdata, &r);
-		ki->tag = dst_region_computeid(&r, ki->algo);
+		ki->tag = dst_region_computeid(&r);
 
 		ki->dst = NULL;
 		if (!match_key_dsset(ki, dsset, strictness)) {

bin/dnssec/dnssec-dsfromkey.c

@@ -330,7 +330,7 @@ usage(void) {
 	fprintf(stderr, "    -K <directory>: directory in which to find "
 			"key file or keyset file\n");
 	fprintf(stderr, "    -a algorithm: digest algorithm "
-			"(SHA-1, SHA-256, GOST or SHA-384)\n");
+			"(SHA-1, SHA-256 or SHA-384)\n");
 	fprintf(stderr, "    -1: use SHA-1\n");
 	fprintf(stderr, "    -2: use SHA-256\n");
 	fprintf(stderr, "    -C: print CDS record\n");

bin/dnssec/dnssec-keyfromlabel.c

@@ -64,7 +64,7 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSA | RSAMD5 | DH | RSASHA1 |\n"
+			"        DH | RSASHA1 |\n"
 			"        NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
@@ -382,22 +382,14 @@ main(int argc, char **argv) {
 			fatal("no algorithm specified");
 		}
 
-		if (strcasecmp(algname, "RSA") == 0) {
-			fprintf(stderr, "The use of RSA (RSAMD5) is not "
-					"recommended.\nIf you still wish to "
-					"use RSA (RSAMD5) please specify "
-					"\"-a RSAMD5\"\n");
-			if (freeit != NULL)
-				free(freeit);
-			return (1);
-		} else {
-			r.base = algname;
-			r.length = strlen(algname);
-			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS)
-				fatal("unknown algorithm %s", algname);
-			if (alg == DST_ALG_DH)
-				options |= DST_TYPE_KEY;
+		r.base = algname;
+		r.length = strlen(algname);
+		ret = dns_secalg_fromtext(&alg, &r);
+		if (ret != ISC_R_SUCCESS) {
+			fatal("unknown algorithm %s", algname);
+		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
 		}
 
 		if (use_nsec3) {

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -105,7 +105,7 @@
 	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
-	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    <option>algorithm</option> must be one of RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>

bin/dnssec/dnssec-keygen.8

@@ -327,21 +327,21 @@ and
 files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
-To generate a 768\-bit DSA key for the domain
+To generate an ECDSAP256SHA256 key for the domain
 \fBexample\&.com\fR, the following command would be issued:
 .PP
-\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE example\&.com\fR
+\fBdnssec\-keygen \-a ECDSAP256SHA256 \-n ZONE example\&.com\fR
 .PP
 The command would print a string of the form:
 .PP
-\fBKexample\&.com\&.+003+26160\fR
+\fBKexample\&.com\&.+013+26160\fR
 .PP
 In this example,
 \fBdnssec\-keygen\fR
 creates the files
-Kexample\&.com\&.+003+26160\&.key
+Kexample\&.com\&.+013+26160\&.key
 and
-Kexample\&.com\&.+003+26160\&.private\&.
+Kexample\&.com\&.+013+26160\&.private\&.
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),

bin/dnssec/dnssec-keygen.c

@@ -79,14 +79,12 @@ usage(void) {
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "    -K <directory>: write keys into directory\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	fprintf(stderr, "        RSA | RSAMD5 | RSASHA1 | NSEC3RSASHA1"
-				" |\n");
+	fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
@@ -508,23 +506,14 @@ main(int argc, char **argv) {
 			fatal("no algorithm specified");
 		}
 
-		if (strcasecmp(algname, "RSA") == 0) {
-			fprintf(stderr, "The use of RSA (RSAMD5) is not "
-					"recommended.\nIf you still wish to "
-					"use RSA (RSAMD5) please specify "
-					"\"-a RSAMD5\"\n");
-			INSIST(freeit == NULL);
-			return (1);
-		} else {
-			r.base = algname;
-			r.length = strlen(algname);
-			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS) {
-				fatal("unknown algorithm %s", algname);
-			}
-			if (alg == DST_ALG_DH) {
-				options |= DST_TYPE_KEY;
-			}
+		r.base = algname;
+		r.length = strlen(algname);
+		ret = dns_secalg_fromtext(&alg, &r);
+		if (ret != ISC_R_SUCCESS) {
+			fatal("unknown algorithm %s", algname);
+		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
 		}
 
 		if (!dst_algorithm_supported(alg)) {
@@ -698,7 +687,6 @@ main(int argc, char **argv) {
 	}
 
 	switch (alg) {
-	case DNS_KEYALG_RSAMD5:
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
@@ -780,7 +768,6 @@ main(int argc, char **argv) {
 	}
 
 	switch(alg) {
-	case DNS_KEYALG_RSAMD5:
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:

bin/dnssec/dnssec-keygen.docbook

@@ -122,7 +122,7 @@
 	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
-	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    of <option>algorithm</option> must be one of RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
@@ -605,22 +605,22 @@
   <refsection><info><title>EXAMPLE</title></info>
 
     <para>
-      To generate a 768-bit DSA key for the domain
+      To generate an ECDSAP256SHA256 key for the domain
       <userinput>example.com</userinput>, the following command would be
       issued:
     </para>
-    <para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
+    <para><userinput>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</userinput>
     </para>
     <para>
       The command would print a string of the form:
     </para>
-    <para><userinput>Kexample.com.+003+26160</userinput>
+    <para><userinput>Kexample.com.+013+26160</userinput>
     </para>
     <para>
       In this example, <command>dnssec-keygen</command> creates
-      the files <filename>Kexample.com.+003+26160.key</filename>
+      the files <filename>Kexample.com.+013+26160.key</filename>
       and
-      <filename>Kexample.com.+003+26160.private</filename>.
+      <filename>Kexample.com.+013+26160.private</filename>.
     </para>
   </refsection>
 

bin/dnssec/dnssec-keygen.html

@@ -498,22 +498,22 @@
 <a name="id-1.11"></a><h2>EXAMPLE</h2>
 
     <p>
-      To generate a 768-bit DSA key for the domain
+      To generate an ECDSAP256SHA256 key for the domain
       <strong class="userinput"><code>example.com</code></strong>, the following command would be
       issued:
     </p>
-    <p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
+    <p><strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</code></strong>
     </p>
     <p>
       The command would print a string of the form:
     </p>
-    <p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
+    <p><strong class="userinput"><code>Kexample.com.+013+26160</code></strong>
     </p>
     <p>
       In this example, <span class="command"><strong>dnssec-keygen</strong></span> creates
-      the files <code class="filename">Kexample.com.+003+26160.key</code>
+      the files <code class="filename">Kexample.com.+013+26160.key</code>
       and
-      <code class="filename">Kexample.com.+003+26160.private</code>.
+      <code class="filename">Kexample.com.+013+26160.private</code>.
     </p>
   </div>
 

bin/dnssec/dnssec-revoke.c

@@ -239,7 +239,7 @@ main(int argc, char **argv) {
 		 * Remove old key file, if told to (and if
 		 * it isn't the same as the new file)
 		 */
-		if (removefile && dst_key_alg(key) != DST_ALG_RSAMD5) {
+		if (removefile) {
 			isc_buffer_init(&buf, oldname, sizeof(oldname));
 			dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
 			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);

bin/dnssec/dnssec-signzone.8

@@ -415,9 +415,9 @@ Specify which keys should be used to sign the zone\&. If no keys are specified,
 .PP
 The following command signs the
 \fBexample\&.com\fR
-zone with the DSA key generated by
+zone with the ECDSAP256SHA256 key generated by key generated by
 \fBdnssec\-keygen\fR
-(Kexample\&.com\&.+003+17247)\&. Because the
+(Kexample\&.com\&.+013+17247)\&. Because the
 \fB\-S\fR
 option is not being used, the zone\*(Aqs keys must be in the master file (db\&.example\&.com)\&. This invocation looks for
 dsset
@@ -428,7 +428,7 @@ files, in the current directory, so that DS records can be imported from them (\
 .\}
 .nf
 % dnssec\-signzone \-g \-o example\&.com db\&.example\&.com \e
-Kexample\&.com\&.+003+17247
+Kexample\&.com\&.+013+17247
 db\&.example\&.com\&.signed
 %
 .fi

bin/dnssec/dnssec-signzone.docbook

@@ -787,15 +787,16 @@
 
     <para>
       The following command signs the <userinput>example.com</userinput>
-      zone with the DSA key generated by <command>dnssec-keygen</command>
-      (Kexample.com.+003+17247).  Because the <command>-S</command> option
-      is not being used, the zone's keys must be in the master file
+      zone with the ECDSAP256SHA256 key generated by key generated by
+      <command>dnssec-keygen</command> (Kexample.com.+013+17247).
+      Because the <command>-S</command> option is not being used,
+      the zone's keys must be in the master file
       (<filename>db.example.com</filename>).  This invocation looks
       for <filename>dsset</filename> files, in the current directory,
       so that DS records can be imported from them (<command>-g</command>).
     </para>
 <programlisting>% dnssec-signzone -g -o example.com db.example.com \
-Kexample.com.+003+17247
+Kexample.com.+013+17247
 db.example.com.signed
 %</programlisting>
     <para>

bin/dnssec/dnssec-signzone.html

@@ -624,15 +624,16 @@
 
     <p>
       The following command signs the <strong class="userinput"><code>example.com</code></strong>
-      zone with the DSA key generated by <span class="command"><strong>dnssec-keygen</strong></span>
-      (Kexample.com.+003+17247).  Because the <span class="command"><strong>-S</strong></span> option
-      is not being used, the zone's keys must be in the master file
+      zone with the ECDSAP256SHA256 key generated by key generated by
+      <span class="command"><strong>dnssec-keygen</strong></span> (Kexample.com.+013+17247).
+      Because the <span class="command"><strong>-S</strong></span> option is not being used,
+      the zone's keys must be in the master file
       (<code class="filename">db.example.com</code>).  This invocation looks
       for <code class="filename">dsset</code> files, in the current directory,
       so that DS records can be imported from them (<span class="command"><strong>-g</strong></span>).
     </p>
 <pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
-Kexample.com.+003+17247
+Kexample.com.+013+17247
 db.example.com.signed
 %</pre>
     <p>

bin/named/config.c

@@ -154,10 +154,7 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n\
-	filter-aaaa-on-v4 no;\n\
-	filter-aaaa-on-v6 no;\n\
-	filter-aaaa { any; };\n"
+	fetches-per-zone 0;\n"
 #ifdef HAVE_GEOIP
 "	geoip-use-ecs yes;\n"
 #endif

bin/named/include/named/server.h

@@ -78,6 +78,7 @@ struct named_server {
 
 	isc_mutex_t		reload_event_lock;
 	isc_event_t *		reload_event;
+	bool			reload_in_progress;
 
 	bool		flushonshutdown;
 

bin/named/server.c

@@ -102,6 +102,7 @@
 #include <dst/result.h>
 
 #include <ns/client.h>
+#include <ns/hooks.h>
 #include <ns/listenlist.h>
 #include <ns/interfacemgr.h>
 
@@ -776,8 +777,7 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	keystruct.datalen = r.length;
 	keystruct.data = r.base;
 
-	if ((keystruct.algorithm == DST_ALG_RSASHA1 ||
-	     keystruct.algorithm == DST_ALG_RSAMD5) &&
+	if ((keystruct.algorithm == DST_ALG_RSASHA1) &&
 	    r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "%s key '%s' has a weak exponent",
@@ -2551,7 +2551,15 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		}
 
 	} else {
-		if (result != ISC_R_NOTFOUND && result != DNS_R_PARTIALMATCH) {
+		if (result == ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "catz: zone \"%s\" is overridden "
+				      "by explicitly configured zone",
+				      nameb);
+			goto cleanup;
+		} else if (result != ISC_R_NOTFOUND &&
+			   result != DNS_R_PARTIALMATCH) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "catz: error \"%s\" while trying to "
@@ -3638,6 +3646,35 @@ create_mapped_acl(void) {
 	return (result);
 }
 
+#ifdef HAVE_DLOPEN
+/*%
+ * A callback for the cfg_pluginlist_foreach() call in configure_view() below.
+ * If registering any plugin fails, registering subsequent ones is not
+ * attempted.
+ */
+static isc_result_t
+register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
+		    const char *plugin_path, const char *parameters,
+		    void *callback_data)
+{
+	dns_view_t *view = callback_data;
+	isc_result_t result;
+
+	result = ns_plugin_register(plugin_path, parameters, config,
+				    cfg_obj_file(obj), cfg_obj_line(obj),
+				    named_g_mctx, named_g_lctx,
+				    named_g_aclconfctx, view);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "%s: plugin configuration failed: %s",
+			      plugin_path, isc_result_totext(result));
+	}
+
+	return (result);
+}
+#endif
+
 /*
  * Configure 'view' according to 'vconfig', taking defaults from 'config'
  * where values are missing in 'vconfig'.
@@ -3666,7 +3703,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	const cfg_obj_t *dlvobj = NULL;
 	unsigned int dlzargc;
 	char **dlzargv;
-	const cfg_obj_t *dyndb_list;
+	const cfg_obj_t *dyndb_list, *plugin_list;
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj, *obj2;
 	const cfg_listelt_t *element;
@@ -5080,46 +5117,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					      dns_quotatype_zone, r);
 	}
 
-	obj = NULL;
-	result = named_config_get(maps, "filter-aaaa-on-v4", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj))
-			view->v4_aaaa = dns_aaaa_filter;
-		else
-			view->v4_aaaa = dns_aaaa_ok;
-	} else {
-		const char *v4_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
-			view->v4_aaaa = dns_aaaa_break_dnssec;
-		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "filter-aaaa-on-v6", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj))
-			view->v6_aaaa = dns_aaaa_filter;
-		else
-			view->v6_aaaa = dns_aaaa_ok;
-	} else {
-		const char *v6_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
-			view->v6_aaaa = dns_aaaa_break_dnssec;
-		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
-	}
-
-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "filter-aaaa", NULL, actx,
-				 named_g_mctx, &view->aaaa_acl));
-
 	obj = NULL;
 	result = named_config_get(maps, "prefetch", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -5261,10 +5258,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * Load DynDB modules.
 	 */
 	dyndb_list = NULL;
-	if (voptions != NULL)
+	if (voptions != NULL) {
 		(void)cfg_map_get(voptions, "dyndb", &dyndb_list);
-	else
+	} else {
 		(void)cfg_map_get(config, "dyndb", &dyndb_list);
+	}
 
 #ifdef HAVE_DLOPEN
 	for (element = cfg_list_first(dyndb_list);
@@ -5286,6 +5284,31 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	}
 #endif
 
+	/*
+	 * Load plugins.
+	 */
+	plugin_list = NULL;
+	if (voptions != NULL) {
+		(void)cfg_map_get(voptions, "plugin", &plugin_list);
+	} else {
+		(void)cfg_map_get(config, "plugin", &plugin_list);
+	}
+
+#ifdef HAVE_DLOPEN
+	if (plugin_list != NULL) {
+		INSIST(view->hooktable == NULL);
+		CHECK(ns_hooktable_create(view->mctx,
+				  (ns_hooktable_t **) &view->hooktable));
+		view->hooktable_free = ns_hooktable_free;
+
+		ns_plugins_create(view->mctx, (ns_plugins_t **)&view->plugins);
+		view->plugins_free = ns_plugins_free;
+
+		CHECK(cfg_pluginlist_foreach(config, plugin_list, named_g_lctx,
+					     register_one_plugin, view));
+	}
+#endif
+
 	/*
 	 * Setup automatic empty zones.  If recursion is off then
 	 * they are disabled by default.
@@ -8056,8 +8079,12 @@ load_configuration(const char *filename, named_server_t *server,
 
 	/*
 	 * Check the validity of the configuration.
+	 *
+	 * (Ignore plugin parameters for now; they will be
+	 * checked later when the modules are actually loaded and
+	 * registered.)
 	 */
-	CHECK(bind9_check_namedconf(config, named_g_lctx, named_g_mctx));
+	CHECK(bind9_check_namedconf(config, false, named_g_lctx, named_g_mctx));
 
 	/*
 	 * Fill in the maps array, used for resolving defaults.
@@ -9298,6 +9325,7 @@ view_loaded(void *arg) {
 			      "FIPS mode is %s",
 			      FIPS_mode() ? "enabled" : "disabled");
 #endif
+		server->reload_in_progress = false;
 
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
@@ -9502,6 +9530,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 			dns_view_detach(&view);
 	}
 
+	/*
+	 * Shut down all dyndb instances.
+	 */
 	dns_dyndb_cleanup(true);
 
 	while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
@@ -9630,6 +9661,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	CHECKFATAL(server->reload_event == NULL ?
 		   ISC_R_NOMEMORY : ISC_R_SUCCESS,
 		   "allocating reload event");
+	server->reload_in_progress = true;
 
 	/*
 	 * Setup the server task, which is responsible for coordinating
@@ -9940,6 +9972,7 @@ loadconfig(named_server_t *server) {
 static isc_result_t
 reload(named_server_t *server) {
 	isc_result_t result;
+	server->reload_in_progress = true;
 	CHECK(loadconfig(server));
 
 	result = load_zones(server, false, false);
@@ -10286,6 +10319,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_reconfigcommand(named_server_t *server) {
 	isc_result_t result;
+	server->reload_in_progress = true;
 
 	CHECK(loadconfig(server));
 
@@ -11431,6 +11465,10 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		     server->sctx->tcpquota.used, server->sctx->tcpquota.max);
 	CHECK(putstr(text, line));
 
+	if (server->reload_in_progress) {
+		CHECK(putstr(text, "reload/reconfig in progress"));
+	}
+
 	CHECK(putstr(text, "server is up and running"));
 	CHECK(putnull(text));
 
@@ -14880,7 +14918,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 
 			dns_rdata_toregion(&rdata, &r);
 			isc_region_consume(&r, 12);
-			keyid = dst_region_computeid(&r, kd.algorithm);
+			keyid = dst_region_computeid(&r);
 
 			snprintf(buf, sizeof(buf), "\n    keyid: %u", keyid);
 			CHECK(putstr(text, buf));

bin/named/unix/dlz_dlopen_driver.c

@@ -257,7 +257,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	/* Open the library */
 	dlopen_flags = RTLD_NOW|RTLD_GLOBAL;
 
-#ifdef RTLD_DEEPBIND
+#if defined(RTLD_DEEPBIND) && !__ADDRESS_SANITIZER__
 	/*
 	 * If RTLD_DEEPBIND is available then use it. This can avoid
 	 * issues with a module using a different version of a system

bin/plugins/Makefile.in

@@ -0,0 +1,72 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+srcdir =	@srcdir@
+VPATH =		@srcdir@
+top_srcdir =	@top_srcdir@
+
+@BIND9_MAKE_INCLUDES@
+
+CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+		${NS_INCLUDES} ${DNS_INCLUDES} \
+		${ISCCFG_INCLUDES} ${ISC_INCLUDES}
+
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+NSLIBS =	../../lib/ns/libns.@A@
+
+LIBS =
+
+SO_TARGETS =	lib/filter-aaaa.@SO@
+TARGETS =	@SO_TARGETS@
+
+SO_OBJS =	filter-aaaa.@O@
+SO_SRCS =	filter-aaaa.c
+
+CFLAGS =	@CFLAGS@ @SO_CFLAGS@
+SO_LDFLAGS =	@LDFLAGS@ @SO_LDFLAGS@
+
+MANPAGES =	filter-aaaa.8
+
+HTMLPAGES =	filter-aaaa.html
+
+MANOBJS =	${MANPAGES} ${HTMLPAGES}
+
+@BIND9_MAKE_RULES@
+
+lib/filter-aaaa.@SO@: filter-aaaa.@SO@
+	$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
+	${LIBTOOL_MODE_INSTALL} ${INSTALL} filter-aaaa.@SO@ `pwd`/lib
+
+filter-aaaa.@SO@: filter-aaaa.@O@
+	${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ \
+		filter-aaaa.@O@ ${LIBS}
+
+doc man:: ${MANOBJS}
+
+docclean manclean maintainer-clean::
+	rm -f ${MANOBJS}
+
+clean distclean::
+	rm -f filter-aaaa.so
+	rm -f ${TARGETS} ${OBJS}
+
+installdirs:
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+
+install:: filter-aaaa.@SO@ installdirs
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} filter-aaaa.@SO@ \
+		${DESTDIR}${libdir}
+	${INSTALL_DATA} ${srcdir}/filter-aaaa.8 ${DESTDIR}${mandir}/man8
+
+uninstall::
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/filter-aaaa.@SO@
+	rm -f ${DESTDIR}${mandir}/man8/filter-aaaa.8

bin/plugins/filter-aaaa.8

@@ -0,0 +1,116 @@
+.\" Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" 
+.\" This Source Code Form is subject to the terms of the Mozilla Public
+.\" License, v. 2.0. If a copy of the MPL was not distributed with this
+.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
+.\"
+.hy 0
+.ad l
+'\" t
+.\"     Title: filter-aaaa.so
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
+.\"      Date: 2018-08-13
+.\"    Manual: BIND9
+.\"    Source: ISC
+.\"  Language: English
+.\"
+.TH "FILTER\-AAAA\&.SO" "8" "2018\-08\-13" "ISC" "BIND9"
+.\" -----------------------------------------------------------------
+.\" * Define some portability stuff
+.\" -----------------------------------------------------------------
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.\" http://bugs.debian.org/507673
+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\" -----------------------------------------------------------------
+.\" * set default formatting
+.\" -----------------------------------------------------------------
+.\" disable hyphenation
+.nh
+.\" disable justification (adjust text to left margin only)
+.ad l
+.\" -----------------------------------------------------------------
+.\" * MAIN CONTENT STARTS HERE *
+.\" -----------------------------------------------------------------
+.SH "NAME"
+filter-aaaa.so \- filter AAAA in DNS responses when A is present
+.SH "SYNOPSIS"
+.HP \w'\fBplugin\ query\ "filter\-aaaa\&.so"\fR\ 'u
+\fBplugin query "filter\-aaaa\&.so"\fR [\fI{\ parameters\ }\fR];
+.SH "DESCRIPTION"
+.PP
+\fBfilter\-aaaa\&.so\fR
+is a query plugin module for
+\fBnamed\fR, enabling
+\fBnamed\fR
+to omit some IPv6 addresses when responding to clients\&.
+.PP
+Until BIND 9\&.12, this feature was implemented natively in
+\fBnamed\fR
+and enabled with the
+\fBfilter\-aaaa\fR
+ACL and the
+\fBfilter\-aaaa\-on\-v4\fR
+and
+\fBfilter\-aaaa\-on\-v6\fR
+options\&. These options are now deprecated in
+named\&.conf, but can be passed as parameters to the
+\fBfilter\-aaaa\&.so\fR
+plugin, for example:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+plugin query "/usr/local/lib/filter\-aaaa\&.so" {
+        filter\-aaaa\-on\-v4 yes;
+        filter\-aaaa\-on\-v6 yes;
+        filter\-aaaa { 192\&.0\&.2\&.1; 2001:db8:2::1; };
+};
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6 addresses from DNS clients which are not connected to the IPv6 Internet, when the name being looked up has an IPv4 address available\&. Use of this module is not recommended unless absolutely necessary\&.
+.PP
+Note: This mechanism can erroneously cause other servers not to give AAAA records to their clients\&. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it will be denied AAAA records even if its client is using IPv6\&.
+.SH "OPTIONS"
+.PP
+\fBfilter\-aaaa\fR
+.RS 4
+Specifies a list of client addresses for which AAAA filtering is to be applied\&. The default is
+\fBany\fR\&.
+.RE
+.PP
+\fBfilter\-aaaa\-on\-v4\fR
+.RS 4
+If set to
+\fByes\fR, the DNS client is at an IPv4 address, in
+\fBfilter\-aaaa\fR, and if the response does not include DNSSEC signatures, then all AAAA records are deleted from the response\&. This filtering applies to all responses and not only authoritative responses\&.
+.sp
+If set to
+\fBbreak\-dnssec\fR, then AAAA records are deleted even when DNSSEC is enabled\&. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions\&.
+.sp
+This mechanism can erroneously cause other servers not to give AAAA records to their clients\&. A recursing server with both IPv6 and IPv4 network connections that queries an authoritative server using this mechanism via IPv4 will be denied AAAA records even if its client is using IPv6\&.
+.RE
+.PP
+\fBfilter\-aaaa\-on\-v6\fR
+.RS 4
+Identical to
+\fBfilter\-aaaa\-on\-v4\fR, except it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients\&. To filter all responses, set both options to
+\fByes\fR\&.
+.RE
+.SH "SEE ALSO"
+.PP
+BIND 9 Administrator Reference Manual\&.
+.SH "AUTHOR"
+.PP
+\fBInternet Systems Consortium, Inc\&.\fR
+.SH "COPYRIGHT"
+.br
+Copyright \(co 2018 Internet Systems Consortium, Inc. ("ISC")
+.br

bin/plugins/filter-aaaa.c

@@ -0,0 +1,925 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/ht.h>
+#include <isc/lib.h>
+#include <isc/log.h>
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/result.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <isccfg/aclconf.h>
+#include <isccfg/cfg.h>
+#include <isccfg/grammar.h>
+
+#include <ns/client.h>
+#include <ns/hooks.h>
+#include <ns/log.h>
+#include <ns/query.h>
+#include <ns/types.h>
+
+#include <dns/acl.h>
+#include <dns/db.h>
+#include <dns/enumtype.h>
+#include <dns/log.h>
+#include <dns/message.h>
+#include <dns/rdataset.h>
+#include <dns/result.h>
+#include <dns/types.h>
+#include <dns/view.h>
+
+#define CHECK(op)						\
+	do {							\
+		result = (op);					\
+		if (result != ISC_R_SUCCESS) {			\
+			goto cleanup;				\
+		}						\
+	} while (0)
+
+/*
+ * Possible values for the settings of filter-aaaa-on-v4 and
+ * filter-aaaa-on-v6: "no" is NONE, "yes" is FILTER, "break-dnssec"
+ * is BREAK_DNSSEC.
+ */
+typedef enum {
+	NONE = 0,
+	FILTER = 1,
+	BREAK_DNSSEC = 2
+} filter_aaaa_t;
+
+/*
+ * Persistent data for use by this module. This will be associated
+ * with client object address in the hash table, and will remain
+ * accessible until the client object is detached.
+ */
+typedef struct filter_data {
+	filter_aaaa_t mode;
+	uint32_t flags;
+} filter_data_t;
+
+typedef struct filter_instance {
+	ns_plugin_t *module;
+	isc_mem_t *mctx;
+
+	/*
+	 * Memory pool for use with persistent data.
+	 */
+	isc_mempool_t *datapool;
+
+	/*
+	 * Hash table associating a client object with its persistent data.
+	 */
+	isc_ht_t *ht;
+
+	/*
+	 * Values configured when the module is loaded.
+	 */
+	filter_aaaa_t v4_aaaa;
+	filter_aaaa_t v6_aaaa;
+	dns_acl_t *aaaa_acl;
+} filter_instance_t;
+
+/*
+ * Per-client flags set by this module
+ */
+#define FILTER_AAAA_RECURSING	0x0001	/* Recursing for A */
+#define FILTER_AAAA_FILTERED	0x0002	/* AAAA was removed from answer */
+
+/*
+ * Client attribute tests.
+ */
+#define WANTDNSSEC(c)	(((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
+#define RECURSIONOK(c)	(((c)->query.attributes & \
+				  NS_QUERYATTR_RECURSIONOK) != 0)
+
+/*
+ * Forward declarations of functions referenced in install_hooks().
+ */
+static ns_hookresult_t
+filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp);
+
+/*%
+ * Register the functions to be called at each hook point in 'hooktable', using
+ * memory context 'mctx' for allocating copies of stack-allocated structures
+ * passed to ns_hook_add().  Make sure 'inst' will be passed as the 'cbdata'
+ * argument to every callback.
+ */
+static void
+install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
+	      filter_instance_t *inst)
+{
+	const ns_hook_t filter_init = {
+		.action = filter_qctx_initialize,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_respbegin = {
+		.action = filter_respond_begin,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_respanyfound = {
+		.action = filter_respond_any_found,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_prepresp = {
+		.action = filter_prep_response_begin,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_donesend = {
+		.action = filter_query_done_send,
+		.action_data = inst,
+	};
+
+	const ns_hook_t filter_destroy = {
+		.action = filter_qctx_destroy,
+		.action_data = inst,
+	};
+
+	ns_hook_add(hooktable, mctx, -
+		    NS_QUERY_QCTX_INITIALIZED, &filter_init);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_RESPOND_ANY_FOUND, &filter_respanyfound);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_PREP_RESPONSE_BEGIN, &filter_prepresp);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_DONE_SEND, &filter_donesend);
+	ns_hook_add(hooktable, mctx,
+		    NS_QUERY_QCTX_DESTROYED, &filter_destroy);
+}
+
+/**
+ ** Support for parsing of parameters and configuration of the module.
+ **/
+
+/*
+ * Support for parsing of parameters.
+ */
+static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };
+
+static isc_result_t
+parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+}
+
+static void
+doc_filter_aaaa(cfg_printer_t *pctx, const cfg_type_t *type) {
+	cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
+}
+
+static cfg_type_t cfg_type_filter_aaaa = {
+	"filter_aaaa", parse_filter_aaaa, cfg_print_ustring,
+	doc_filter_aaaa, &cfg_rep_string, filter_aaaa_enums,
+};
+
+static cfg_clausedef_t param_clauses[] = {
+	{ "filter-aaaa", &cfg_type_bracketed_aml, 0 },
+	{ "filter-aaaa-on-v4", &cfg_type_filter_aaaa, 0 },
+	{ "filter-aaaa-on-v6", &cfg_type_filter_aaaa, 0 },
+};
+
+static cfg_clausedef_t *param_clausesets[] = {
+	param_clauses,
+	NULL
+};
+
+static cfg_type_t cfg_type_parameters = {
+	"filter-aaaa-params", cfg_parse_mapbody, cfg_print_mapbody,
+	cfg_doc_mapbody, &cfg_rep_map, param_clausesets
+};
+
+static isc_result_t
+parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
+		     filter_aaaa_t *dstp)
+{
+	const cfg_obj_t *obj = NULL;
+	isc_result_t result;
+
+	result = cfg_map_get(param_obj, param_name, &obj);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_SUCCESS);
+	}
+
+	if (cfg_obj_isboolean(obj)) {
+		if (cfg_obj_asboolean(obj)) {
+			*dstp = FILTER;
+		} else {
+			*dstp = NONE;
+		}
+	} else if (strcasecmp(cfg_obj_asstring(obj), "break-dnssec") == 0) {
+		*dstp = BREAK_DNSSEC;
+	} else {
+		result = ISC_R_UNEXPECTED;
+	}
+
+	return (result);
+}
+
+static isc_result_t
+check_syntax(cfg_obj_t *fmap, const void *cfg,
+	     isc_mem_t *mctx, isc_log_t *lctx, void *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	const cfg_obj_t *aclobj = NULL;
+	dns_acl_t *acl = NULL;
+	filter_aaaa_t f4 = NONE, f6 = NONE;
+
+	cfg_map_get(fmap, "filter-aaaa", &aclobj);
+	if (aclobj == NULL) {
+		return (result);
+	}
+
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *) cfg,
+				 lctx, (cfg_aclconfctx_t *) actx,
+				 mctx, 0, &acl));
+
+	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
+	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));
+
+	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+			    "\"filter-aaaa\" is 'none;' but "
+			    "either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
+			    "is enabled");
+		result = ISC_R_FAILURE;
+	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
+			    "\"filter-aaaa\" is set but "
+			    "neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
+			    "is enabled");
+		result = ISC_R_FAILURE;
+	}
+
+ cleanup:
+	if (acl != NULL) {
+		dns_acl_detach(&acl);
+	}
+
+	return (result);
+}
+
+static isc_result_t
+parse_parameters(filter_instance_t *inst, const char *parameters,
+		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
+		 isc_mem_t *mctx, isc_log_t *lctx, void *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	cfg_parser_t *parser = NULL;
+	cfg_obj_t *param_obj = NULL;
+	const cfg_obj_t *obj = NULL;
+	isc_buffer_t b;
+
+	CHECK(cfg_parser_create(mctx, lctx, &parser));
+
+	isc_buffer_constinit(&b, parameters, strlen(parameters));
+	isc_buffer_add(&b, strlen(parameters));
+	CHECK(cfg_parse_buffer4(parser, &b, cfg_file, cfg_line,
+				&cfg_type_parameters, 0, &param_obj));
+
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+
+	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
+				   &inst->v4_aaaa));
+	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v6",
+				   &inst->v6_aaaa));
+
+	result = cfg_map_get(param_obj, "filter-aaaa", &obj);
+	if (result == ISC_R_SUCCESS) {
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *) cfg,
+					 lctx, (cfg_aclconfctx_t *) actx,
+					 mctx, 0, &inst->aaaa_acl));
+	} else {
+		CHECK(dns_acl_any(mctx, &inst->aaaa_acl));
+	}
+
+ cleanup:
+	if (param_obj != NULL) {
+		cfg_obj_destroy(parser, &param_obj);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
+	return (result);
+}
+
+/**
+ ** Mandatory plugin API functions:
+ **
+ ** - plugin_destroy
+ ** - plugin_register
+ ** - plugin_version
+ ** - plugin_check
+ **/
+
+/*
+ * Called by ns_plugin_register() to initialize the plugin and
+ * register hook functions into the view hook table.
+ */
+isc_result_t
+plugin_register(const char *parameters,
+		const void *cfg, const char *cfg_file, unsigned long cfg_line,
+		isc_mem_t *mctx, isc_log_t *lctx, void *actx,
+		ns_hooktable_t *hooktable, void **instp)
+{
+	filter_instance_t *inst = NULL;
+	isc_result_t result;
+
+
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
+		      "registering 'filter-aaaa' "
+		      "module from %s:%lu, %s parameters",
+		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
+
+	inst = isc_mem_get(mctx, sizeof(*inst));
+	memset(inst, 0, sizeof(*inst));
+	isc_mem_attach(mctx, &inst->mctx);
+
+	if (parameters != NULL) {
+		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
+				       cfg_line, mctx, lctx, actx));
+	}
+
+	CHECK(isc_mempool_create(mctx, sizeof(filter_data_t),
+				 &inst->datapool));
+	CHECK(isc_ht_init(&inst->ht, mctx, 16));
+
+	/*
+	 * Fill the mempool with 1K filter_aaaa state objects at
+	 * a time; ideally after a single allocation, the mempool will
+	 * have enough to handle all the simultaneous queries the system
+	 * requires and it won't be necessary to allocate more.
+	 *
+	 * We don't set any limit on the number of free state objects
+	 * so that they'll always be returned to the pool and not
+	 * freed until the pool is destroyed on shutdown.
+	 */
+	isc_mempool_setfillcount(inst->datapool, 1024);
+	isc_mempool_setfreemax(inst->datapool, UINT_MAX);
+
+	/*
+	 * Set hook points in the view's hooktable.
+	 */
+	install_hooks(hooktable, mctx, inst);
+
+	*instp = inst;
+
+ cleanup:
+	if (result != ISC_R_SUCCESS && inst != NULL) {
+		plugin_destroy((void **) &inst);
+	}
+
+	return (result);
+}
+
+isc_result_t
+plugin_check(const char *parameters,
+	     const void *cfg, const char *cfg_file, unsigned long cfg_line,
+	     isc_mem_t *mctx, isc_log_t *lctx, void *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	cfg_parser_t *parser = NULL;
+	cfg_obj_t *param_obj = NULL;
+	isc_buffer_t b;
+
+	CHECK(cfg_parser_create(mctx, lctx, &parser));
+
+	isc_buffer_constinit(&b, parameters, strlen(parameters));
+	isc_buffer_add(&b, strlen(parameters));
+	CHECK(cfg_parse_buffer4(parser, &b, cfg_file, cfg_line,
+				&cfg_type_parameters, 0, &param_obj));
+
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
+
+ cleanup:
+	if (param_obj != NULL) {
+		cfg_obj_destroy(parser, &param_obj);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
+	return (result);
+}
+
+/*
+ * Called by ns_plugins_free(); frees memory allocated by
+ * the module when it was registered.
+ */
+void
+plugin_destroy(void **instp) {
+	filter_instance_t *inst = (filter_instance_t *) *instp;
+
+	if (inst->ht != NULL) {
+		isc_ht_destroy(&inst->ht);
+	}
+	if (inst->datapool != NULL) {
+		isc_mempool_destroy(&inst->datapool);
+	}
+	if (inst->aaaa_acl != NULL) {
+		dns_acl_detach(&inst->aaaa_acl);
+	}
+
+	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
+	*instp = NULL;
+
+	return;
+}
+
+/*
+ * Returns plugin API version for compatibility checks.
+ */
+int
+plugin_version(void) {
+	return (NS_PLUGIN_VERSION);
+}
+
+/**
+ ** "filter-aaaa" feature implementation begins here.
+ **/
+
+/*%
+ * Structure describing the filtering to be applied by process_section().
+ */
+typedef struct section_filter {
+	query_ctx_t *		qctx;
+	filter_aaaa_t 		mode;
+	dns_section_t		section;
+	const dns_name_t *	name;
+	dns_rdatatype_t		type;
+	bool			only_if_a_exists;
+} section_filter_t;
+
+/*
+ * Check whether this is an IPv4 client.
+ */
+static bool
+is_v4_client(ns_client_t *client) {
+	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
+		return (true);
+	}
+	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
+	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
+	{
+		return (true);
+	}
+	return (false);
+}
+
+/*
+ * Check whether this is an IPv6 client.
+ */
+static bool
+is_v6_client(ns_client_t *client) {
+	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
+	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
+	{
+		return (true);
+	}
+	return (false);
+}
+
+static filter_data_t *
+client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
+	filter_data_t *client_state = NULL;
+	isc_result_t result;
+
+	result = isc_ht_find(inst->ht, (const unsigned char *)&qctx->client,
+			     sizeof(qctx->client), (void **)&client_state);
+
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
+}
+
+static void
+client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
+	filter_data_t *client_state;
+	isc_result_t result;
+
+	client_state = isc_mempool_get(inst->datapool);
+	if (client_state == NULL) {
+		return;
+	}
+
+	client_state->mode = NONE;
+	client_state->flags = 0;
+
+	result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
+			    sizeof(qctx->client), client_state);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
+static void
+client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
+	filter_data_t *client_state = client_state_get(qctx, inst);
+	isc_result_t result;
+
+	if (client_state == NULL) {
+		return;
+	}
+
+	result = isc_ht_delete(inst->ht, (const unsigned char *)&qctx->client,
+			       sizeof(qctx->client));
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	isc_mempool_put(inst->datapool, client_state);
+}
+
+/*%
+ * Mark 'rdataset' and 'sigrdataset' as rendered, gracefully handling NULL
+ * pointers and non-associated rdatasets.
+ */
+static void
+mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+	if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
+		rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+	}
+	if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
+		sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+	}
+}
+
+/*%
+ * Check whether an RRset of given 'type' is present at given 'name'.  If
+ * it is found and either it is not signed or the combination of query
+ * flags and configured processing 'mode' allows it, mark the RRset and its
+ * associated signatures as already rendered to prevent them from appearing
+ * in the response message stored in 'qctx'.  If 'only_if_a_exists' is
+ * true, an RRset of type A must also exist at 'name' in order for the
+ * above processing to happen.
+ */
+static bool
+process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
+	     dns_rdatatype_t type, bool only_if_a_exists)
+{
+	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
+	isc_result_t result;
+	bool modified = false;
+
+	if (only_if_a_exists) {
+		CHECK(dns_message_findtype(name, dns_rdatatype_a, 0, NULL));
+	}
+
+	dns_message_findtype(name, type, 0, &rdataset);
+	dns_message_findtype(name, dns_rdatatype_rrsig, type, &sigrdataset);
+
+	if (rdataset != NULL &&
+	    (sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
+	     mode == BREAK_DNSSEC))
+	{
+		/*
+		 * An RRset of given 'type' was found at 'name' and at least
+		 * one of the following is true:
+		 *
+		 *   - the RRset is not signed,
+		 *   - the client did not set the DO bit in its request,
+		 *   - configuration allows us to tamper with signed responses.
+		 *
+		 * This means it is okay to filter out this RRset and its
+		 * signatures, if any, from the response.
+		 */
+		mark_as_rendered(rdataset, sigrdataset);
+		modified = true;
+	}
+
+ cleanup:
+	return (modified);
+}
+
+/*%
+ * Apply the requested section filter, i.e. prevent (when possible, as
+ * determined by process_name()) RRsets of given 'type' from being rendered
+ * in the given 'section' of the response message stored in 'qctx'.  Clear
+ * the AD bit if the answer and/or authority section was modified.  If
+ * 'name' is NULL, all names in the given 'section' are processed;
+ * otherwise, only 'name' is.  'only_if_a_exists' is passed through to
+ * process_name().
+ */
+static void
+process_section(const section_filter_t *filter) {
+	query_ctx_t *qctx = filter->qctx;
+	filter_aaaa_t mode = filter->mode;
+	dns_section_t section = filter->section;
+	const dns_name_t *name = filter->name;
+	dns_rdatatype_t type = filter->type;
+	bool only_if_a_exists = filter->only_if_a_exists;
+
+	dns_message_t *message = qctx->client->message;
+	isc_result_t result;
+
+	for (result = dns_message_firstname(message, section);
+	     result == ISC_R_SUCCESS;
+	     result = dns_message_nextname(message, section))
+	{
+		dns_name_t *cur = NULL;
+		dns_message_currentname(message, section, &cur);
+		if (name != NULL && !dns_name_equal(name, cur)) {
+			/*
+			 * We only want to process 'name' and this is not it.
+			 */
+			continue;
+		}
+
+		if (!process_name(qctx, mode, cur, type, only_if_a_exists)) {
+			/*
+			 * Response was not modified, do not touch the AD bit.
+			 */
+			continue;
+		}
+
+		if (section == DNS_SECTION_ANSWER ||
+		    section == DNS_SECTION_AUTHORITY)
+		{
+			message->flags &= ~DNS_MESSAGEFLAG_AD;
+		}
+	}
+}
+
+/*
+ * Initialize filter state, fetching it from a memory pool and storing it
+ * in a hash table keyed according to the client object; this enables us to
+ * retrieve persistent data related to a client query for as long as the
+ * object persists.
+ */
+static ns_hookresult_t
+filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state;
+
+	*resp = ISC_R_UNSET;
+
+	client_state = client_state_get(qctx, inst);
+	if (client_state == NULL) {
+		client_state_create(qctx, inst);
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * Determine whether this client should have AAAA filtered or not, based on
+ * the client address family and the settings of filter-aaaa-on-v4 and
+ * filter-aaaa-on-v6.
+ */
+static ns_hookresult_t
+filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+	isc_result_t result;
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state == NULL) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
+		result = ns_client_checkaclsilent(qctx->client, NULL,
+						  inst->aaaa_acl, true);
+		if (result == ISC_R_SUCCESS &&
+		    inst->v4_aaaa != NONE &&
+		    is_v4_client(qctx->client))
+		{
+			client_state->mode = inst->v4_aaaa;
+		} else if (result == ISC_R_SUCCESS &&
+			   inst->v6_aaaa != NONE &&
+			   is_v6_client(qctx->client))
+		{
+			client_state->mode = inst->v6_aaaa;
+		}
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * Hide AAAA rrsets if there is a matching A. Trigger recursion if
+ * necessary to find out whether an A exists.
+ *
+ * (This version is for processing answers to explicit AAAA queries; ANY
+ * queries are handled in filter_respond_any_found().)
+ */
+static ns_hookresult_t
+filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+	isc_result_t result = ISC_R_UNSET;
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state == NULL) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	if (client_state->mode != BREAK_DNSSEC &&
+	    (client_state->mode != FILTER ||
+	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
+	      dns_rdataset_isassociated(qctx->sigrdataset))))
+	{
+		return (NS_HOOK_CONTINUE);
+	}
+
+	if (qctx->qtype == dns_rdatatype_aaaa) {
+		dns_rdataset_t *trdataset;
+		trdataset = ns_client_newrdataset(qctx->client);
+		result = dns_db_findrdataset(qctx->db, qctx->node,
+					     qctx->version,
+					     dns_rdatatype_a, 0,
+					     qctx->client->now,
+					     trdataset, NULL);
+		if (dns_rdataset_isassociated(trdataset)) {
+			dns_rdataset_disassociate(trdataset);
+		}
+		ns_client_putrdataset(qctx->client, &trdataset);
+
+		/*
+		 * We found an AAAA. If we also found an A, then the AAAA
+		 * must not be rendered.
+		 *
+		 * If the A is not in our cache, then any result other than
+		 * DNS_R_DELEGATION or ISC_R_NOTFOUND means there is no A,
+		 * and so AAAAs are okay.
+		 *
+		 * We assume there is no A if we can't recurse for this
+		 * client. That might be the wrong answer, but what else
+		 * can we do?  Besides, the fact that we have the AAAA and
+		 * are using this mechanism in the first place suggests
+		 * that we care more about As than AAAAs, and would have
+		 * cached an A if it existed.
+		 */
+		if (result == ISC_R_SUCCESS) {
+			mark_as_rendered(qctx->rdataset, qctx->sigrdataset);
+			qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
+			client_state->flags |= FILTER_AAAA_FILTERED;
+		} else if (!qctx->authoritative &&
+			   RECURSIONOK(qctx->client) &&
+			   (result == DNS_R_DELEGATION ||
+			    result == ISC_R_NOTFOUND))
+		{
+			/*
+			 * This is an ugly kludge to recurse
+			 * for the A and discard the result.
+			 *
+			 * Continue to add the AAAA now.
+			 * We'll make a note to not render it
+			 * if the recursion for the A succeeds.
+			 */
+			result = ns_query_recurse(qctx->client,
+						  dns_rdatatype_a,
+						  qctx->client->query.qname,
+						  NULL, NULL, qctx->resuming);
+			if (result == ISC_R_SUCCESS) {
+				client_state->flags |= FILTER_AAAA_RECURSING;
+				qctx->client->query.attributes |=
+					NS_QUERYATTR_RECURSING;
+			}
+		}
+	} else if (qctx->qtype == dns_rdatatype_a &&
+		   (client_state->flags & FILTER_AAAA_RECURSING) != 0)
+	{
+		const section_filter_t filter_answer = {
+			.qctx = qctx,
+			.mode = client_state->mode,
+			.section = DNS_SECTION_ANSWER,
+			.name = qctx->fname,
+			.type = dns_rdatatype_aaaa,
+		};
+		process_section(&filter_answer);
+
+		client_state->flags &= ~FILTER_AAAA_RECURSING;
+
+		result = ns_query_done(qctx);
+
+		*resp = result;
+
+		return (NS_HOOK_RETURN);
+	}
+
+	*resp = result;
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * When answering an ANY query, remove AAAA if A is present.
+ */
+static ns_hookresult_t
+filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state != NULL && client_state->mode != NONE) {
+		/*
+		 * If we are authoritative, require an A record to be
+		 * present before filtering out AAAA records; otherwise,
+		 * just assume an A record exists even if it was not in the
+		 * cache (and therefore is not in the response message),
+		 * thus proceeding with filtering out AAAA records.
+		 */
+		const section_filter_t filter_answer = {
+			.qctx = qctx,
+			.mode = client_state->mode,
+			.section = DNS_SECTION_ANSWER,
+			.name = qctx->tname,
+			.type = dns_rdatatype_aaaa,
+			.only_if_a_exists = qctx->authoritative,
+		};
+		process_section(&filter_answer);
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * Hide AAAA rrsets in the additional section if there is a matching A, and
+ * hide NS in the authority section if AAAA was filtered in the answer
+ * section.
+ */
+static ns_hookresult_t
+filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+	filter_data_t *client_state = client_state_get(qctx, inst);
+
+	*resp = ISC_R_UNSET;
+
+	if (client_state != NULL && client_state->mode != NONE) {
+		const section_filter_t filter_additional = {
+			.qctx = qctx,
+			.mode = client_state->mode,
+			.section = DNS_SECTION_ADDITIONAL,
+			.type = dns_rdatatype_aaaa,
+			.only_if_a_exists = true,
+		};
+		process_section(&filter_additional);
+
+		if ((client_state->flags & FILTER_AAAA_FILTERED) != 0) {
+			const section_filter_t filter_authority = {
+				.qctx = qctx,
+				.mode = client_state->mode,
+				.section = DNS_SECTION_AUTHORITY,
+				.type = dns_rdatatype_ns,
+			};
+			process_section(&filter_authority);
+		}
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+/*
+ * If the client is being detached, then we can delete our persistent data
+ * from hash table and return it to the memory pool.
+ */
+static ns_hookresult_t
+filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *) arg;
+	filter_instance_t *inst = (filter_instance_t *) cbdata;
+
+	*resp = ISC_R_UNSET;
+
+	if (!qctx->detach_client) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	client_state_destroy(qctx, inst);
+
+	return (NS_HOOK_CONTINUE);
+}

bin/plugins/filter-aaaa.docbook

@@ -0,0 +1,146 @@
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+
+<!-- Converted by db4-upgrade version 1.0 -->
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.filter-aaaa">
+  <info>
+    <date>2018-08-13</date>
+  </info>
+  <refentryinfo>
+    <corpname>ISC</corpname>
+    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
+  </refentryinfo>
+  <refmeta>
+    <refentrytitle><application>filter-aaaa.so</application></refentrytitle>
+    <manvolnum>8</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname><application>filter-aaaa.so</application></refname>
+    <refpurpose>filter AAAA in DNS responses when A is present</refpurpose>
+  </refnamediv>
+
+  <docinfo>
+    <copyright>
+      <year>2018</year>
+      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
+    </copyright>
+  </docinfo>
+
+  <refsynopsisdiv>
+    <cmdsynopsis sepchar=" ">
+      <command>plugin query "filter-aaaa.so"</command>
+      <arg choice="opt" rep="norepeat"><replaceable class="parameter">{ parameters }</replaceable></arg>;
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsection><info><title>DESCRIPTION</title></info>
+    <para>
+      <command>filter-aaaa.so</command> is a query plugin module for
+      <command>named</command>, enabling <command>named</command>
+      to omit some IPv6 addresses when responding to clients.
+    </para>
+    <para>
+      Until BIND 9.12, this feature was implemented natively in
+      <command>named</command> and enabled with the
+      <command>filter-aaaa</command> ACL and the
+      <command>filter-aaaa-on-v4</command> and
+      <command>filter-aaaa-on-v6</command> options. These options are
+      now deprecated in <filename>named.conf</filename>, but can be
+      passed as parameters to the <command>filter-aaaa.so</command>
+      plugin, for example:
+    </para>
+    <programlisting>
+plugin query "/usr/local/lib/filter-aaaa.so" {
+        filter-aaaa-on-v4 yes;
+        filter-aaaa-on-v6 yes;
+        filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+};
+</programlisting>
+    <para>
+      This module is intended to aid transition from IPv4 to IPv6 by
+      withholding IPv6 addresses from DNS clients which are not connected
+      to the IPv6 Internet, when the name being looked up has an IPv4
+      address available.  Use of this module is not recommended unless
+      absolutely necessary.
+    </para>
+    <para>
+      Note: This mechanism can erroneously cause other servers not to
+      give AAAA records to their clients.  If a recursing server with
+      both IPv6 and IPv4 network connections queries an authoritative
+      server using this mechanism via IPv4, it will be denied AAAA
+      records even if its client is using IPv6.
+    </para>
+  </refsection>
+
+  <refsection><info><title>OPTIONS</title></info>
+    <variablelist>
+      <varlistentry>
+	<term><command>filter-aaaa</command></term>
+	<listitem>
+	  <para>
+	    Specifies a list of client addresses for which AAAA
+	    filtering is to be applied.  The default is
+	    <userinput>any</userinput>.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term><command>filter-aaaa-on-v4</command></term>
+	<listitem>
+	  <para>
+	    If set to <userinput>yes</userinput>, the DNS client is
+	    at an IPv4 address, in <command>filter-aaaa</command>,
+	    and if the response does not include DNSSEC signatures,
+	    then all AAAA records are deleted from the response.
+	    This filtering applies to all responses and not only
+	    authoritative responses.
+	  </para>
+	  <para>
+	    If set to <userinput>break-dnssec</userinput>,
+	    then AAAA records are deleted even when DNSSEC is
+	    enabled.  As suggested by the name, this causes the
+	    response to fail to verify, because the DNSSEC protocol is
+	    designed to detect deletions.
+	  </para>
+	  <para>
+	    This mechanism can erroneously cause other servers not to
+	    give AAAA records to their clients.  A recursing server with
+	    both IPv6 and IPv4 network connections that queries an
+	    authoritative server using this mechanism via IPv4 will be
+	    denied AAAA records even if its client is using IPv6.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term><command>filter-aaaa-on-v6</command></term>
+	<listitem>
+	  <para>
+	    Identical to <command>filter-aaaa-on-v4</command>,
+	    except it filters AAAA responses to queries from IPv6
+	    clients instead of IPv4 clients.  To filter all
+	    responses, set both options to <userinput>yes</userinput>.
+	  </para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsection>
+
+  <refsection><info><title>SEE ALSO</title></info>
+    <para>
+      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
+    </para>
+  </refsection>
+
+</refentry>

bin/plugins/filter-aaaa.html

@@ -0,0 +1,135 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<!--
+ - Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
+ - 
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<html lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>filter-aaaa.so</title>
+<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+</head>
+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
+<a name="man.filter-aaaa"></a><div class="titlepage"></div>
+  
+  
+  
+
+  <div class="refnamediv">
+<h2>Name</h2>
+<p>
+    <span class="application">filter-aaaa.so</span>
+     &#8212; filter AAAA in DNS responses when A is present
+  </p>
+</div>
+
+  
+
+  <div class="refsynopsisdiv">
+<h2>Synopsis</h2>
+    <div class="cmdsynopsis"><p>
+      <code class="command">plugin query "filter-aaaa.so"</code> 
+       [<em class="replaceable"><code>{ parameters }</code></em>];
+    </p></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.7"></a><h2>DESCRIPTION</h2>
+    <p>
+      <span class="command"><strong>filter-aaaa.so</strong></span> is a query plugin module for
+      <span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
+      to omit some IPv6 addresses when responding to clients.
+    </p>
+    <p>
+      Until BIND 9.12, this feature was implemented natively in
+      <span class="command"><strong>named</strong></span> and enabled with the
+      <span class="command"><strong>filter-aaaa</strong></span> ACL and the
+      <span class="command"><strong>filter-aaaa-on-v4</strong></span> and
+      <span class="command"><strong>filter-aaaa-on-v6</strong></span> options. These options are
+      now deprecated in <code class="filename">named.conf</code>, but can be
+      passed as parameters to the <span class="command"><strong>filter-aaaa.so</strong></span>
+      plugin, for example:
+    </p>
+    <pre class="programlisting">
+plugin query "/usr/local/lib/filter-aaaa.so" {
+        filter-aaaa-on-v4 yes;
+        filter-aaaa-on-v6 yes;
+        filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+};
+</pre>
+    <p>
+      This module is intended to aid transition from IPv4 to IPv6 by
+      withholding IPv6 addresses from DNS clients which are not connected
+      to the IPv6 Internet, when the name being looked up has an IPv4
+      address available.  Use of this module is not recommended unless
+      absolutely necessary.
+    </p>
+    <p>
+      Note: This mechanism can erroneously cause other servers not to
+      give AAAA records to their clients.  If a recursing server with
+      both IPv6 and IPv4 network connections queries an authoritative
+      server using this mechanism via IPv4, it will be denied AAAA
+      records even if its client is using IPv6.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.8"></a><h2>OPTIONS</h2>
+    <div class="variablelist"><dl class="variablelist">
+<dt><span class="term"><span class="command"><strong>filter-aaaa</strong></span></span></dt>
+<dd>
+	  <p>
+	    Specifies a list of client addresses for which AAAA
+	    filtering is to be applied.  The default is
+	    <strong class="userinput"><code>any</code></strong>.
+	  </p>
+	</dd>
+<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v4</strong></span></span></dt>
+<dd>
+	  <p>
+	    If set to <strong class="userinput"><code>yes</code></strong>, the DNS client is
+	    at an IPv4 address, in <span class="command"><strong>filter-aaaa</strong></span>,
+	    and if the response does not include DNSSEC signatures,
+	    then all AAAA records are deleted from the response.
+	    This filtering applies to all responses and not only
+	    authoritative responses.
+	  </p>
+	  <p>
+	    If set to <strong class="userinput"><code>break-dnssec</code></strong>,
+	    then AAAA records are deleted even when DNSSEC is
+	    enabled.  As suggested by the name, this causes the
+	    response to fail to verify, because the DNSSEC protocol is
+	    designed to detect deletions.
+	  </p>
+	  <p>
+	    This mechanism can erroneously cause other servers not to
+	    give AAAA records to their clients.  A recursing server with
+	    both IPv6 and IPv4 network connections that queries an
+	    authoritative server using this mechanism via IPv4 will be
+	    denied AAAA records even if its client is using IPv6.
+	  </p>
+	</dd>
+<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v6</strong></span></span></dt>
+<dd>
+	  <p>
+	    Identical to <span class="command"><strong>filter-aaaa-on-v4</strong></span>,
+	    except it filters AAAA responses to queries from IPv6
+	    clients instead of IPv4 clients.  To filter all
+	    responses, set both options to <strong class="userinput"><code>yes</code></strong>.
+	  </p>
+	</dd>
+</dl></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.9"></a><h2>SEE ALSO</h2>
+    <p>
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
+    </p>
+  </div>
+
+</div></body>
+</html>

bin/python/isc/dnskey.py.in

@@ -452,6 +452,10 @@ class dnskey:
         if timespan is None:
             timespan = self.ttl
 
+        if timespan is None:
+            output("WARNING: Key %s using default TTL." % repr(self))
+            timespan = (60*60*24)
+
         now = time.time()
         d = self.delete()
         i = self.inactive()

bin/python/isc/policy.py.in

@@ -71,7 +71,7 @@ class PolicyLex:
         return t
 
     def t_ALGNAME(self, t):
-        r'(?i)\b(RSAMD5|DH|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
+        r'(?i)\b(DH|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
         t.value = t.value.upper()
         return t
 
@@ -132,8 +132,7 @@ class Policy:
     keyttl = None
     coverage = None
     directory = None
-    valid_key_sz_per_algo = {'RSAMD5': [1024, 4096],
-                             'RSASHA1': [1024, 4096],
+    valid_key_sz_per_algo = {'RSASHA1': [1024, 4096],
                              'NSEC3RSASHA1': [512, 4096],
                              'RSASHA256': [1024, 4096],
                              'RSASHA512': [1024, 4096],
@@ -322,10 +321,6 @@ class dnssec_policy:
         # set default algorithm policies
 
         # these can use default settings
-        self.alg_policy['RSAMD5'] = copy(p)
-        self.alg_policy['RSAMD5'].algorithm = "RSAMD5"
-        self.alg_policy['RSAMD5'].name = "RSAMD5"
-
         self.alg_policy['RSASHA1'] = copy(p)
         self.alg_policy['RSASHA1'].algorithm = "RSASHA1"
         self.alg_policy['RSASHA1'].name = "RSASHA1"

bin/tests/optional/Makefile.in

@@ -47,7 +47,6 @@ XTARGETS =	adb_test@EXEEXT@ \
 		backtrace_test_nosymtbl@EXEEXT@ \
 		byname_test@EXEEXT@ \
 		db_test@EXEEXT@ \
-		dst_test@EXEEXT@ \
 		gsstest@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
@@ -76,7 +75,6 @@ XSRCS =		adb_test.c \
 		backtrace_test.c \
 		byname_test.c \
 		db_test.c \
-		dst_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
@@ -237,10 +235,6 @@ sig0_test@EXEEXT@: sig0_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ sig0_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}
 
-dst_test@EXEEXT@: dst_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
-		-o $@ dst_test.@O@ ${DNSLIBS} ${ISCLIBS} ${LIBS}
-
 gsstest@EXEEXT@: gsstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ gsstest.@O@ ${DNSLIBS} ${ISCLIBS} ${LIBS}

bin/tests/optional/dst_test.c

@@ -1,280 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <config.h>
-
-#include <stdbool.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#include <isc/buffer.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/string.h>		/* Required for HP/UX (and others?) */
-
-#include <dns/fixedname.h>
-#include <dns/log.h>
-#include <dns/name.h>
-#include <dns/result.h>
-
-#include <dst/dst.h>
-#include <dst/result.h>
-
-char *current;
-const char *tmp = "/tmp";
-
-static void
-use(dst_key_t *key, isc_mem_t *mctx) {
-	isc_result_t ret;
-	const char *data = "This is some data";
-	unsigned char sig[512];
-	isc_buffer_t databuf, sigbuf;
-	isc_region_t datareg, sigreg;
-	dst_context_t *ctx = NULL;
-
-	isc_buffer_init(&sigbuf, sig, sizeof(sig));
-	/*
-	 * Advance 1 byte for fun.
-	 */
-	isc_buffer_add(&sigbuf, 1);
-
-	isc_buffer_constinit(&databuf, data, strlen(data));
-	isc_buffer_add(&databuf, strlen(data));
-	isc_buffer_usedregion(&databuf, &datareg);
-
-	ret = dst_context_create(key, mctx,
-				 DNS_LOGCATEGORY_GENERAL, true, 0, &ctx);
-	if (ret != ISC_R_SUCCESS) {
-		printf("contextcreate(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		return;
-	}
-	ret = dst_context_adddata(ctx, &datareg);
-	if (ret != ISC_R_SUCCESS) {
-		printf("adddata(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		dst_context_destroy(&ctx);
-		return;
-	}
-	ret = dst_context_sign(ctx, &sigbuf);
-	printf("sign(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	dst_context_destroy(&ctx);
-
-	isc_buffer_forward(&sigbuf, 1);
-	isc_buffer_remainingregion(&sigbuf, &sigreg);
-	ret = dst_context_create(key, mctx,
-				 DNS_LOGCATEGORY_GENERAL, false, 0, &ctx);
-	if (ret != ISC_R_SUCCESS) {
-		printf("contextcreate(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		return;
-	}
-	ret = dst_context_adddata(ctx, &datareg);
-	if (ret != ISC_R_SUCCESS) {
-		printf("adddata(%u) returned: %s\n", dst_key_alg(key),
-		       isc_result_totext(ret));
-		dst_context_destroy(&ctx);
-		return;
-	}
-	ret = dst_context_verify(ctx, &sigreg);
-	printf("verify(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	dst_context_destroy(&ctx);
-}
-
-static void
-dns(dst_key_t *key, isc_mem_t *mctx) {
-	unsigned char buffer1[2048];
-	unsigned char buffer2[2048];
-	isc_buffer_t buf1, buf2;
-	isc_region_t r1, r2;
-	dst_key_t *newkey = NULL;
-	isc_result_t ret;
-	bool match;
-
-	isc_buffer_init(&buf1, buffer1, sizeof(buffer1));
-	ret = dst_key_todns(key, &buf1);
-	printf("todns(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-	ret = dst_key_fromdns(dst_key_name(key), dns_rdataclass_in,
-			      &buf1, mctx, &newkey);
-	printf("fromdns(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-	isc_buffer_init(&buf2, buffer2, sizeof(buffer2));
-	ret = dst_key_todns(newkey, &buf2);
-	printf("todns2(%u) returned: %s\n", dst_key_alg(key),
-	       isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-	isc_buffer_usedregion(&buf1, &r1);
-	isc_buffer_usedregion(&buf2, &r2);
-	match = (r1.length == r2.length &&
-		 memcmp(r1.base, r2.base, r1.length) == 0);
-	printf("compare(%u): %s\n", dst_key_alg(key),
-	       match ? "true" : "false");
-	dst_key_free(&newkey);
-}
-
-static void
-io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx) {
-	dst_key_t *key = NULL;
-	isc_result_t ret;
-
-	ret = dst_key_fromfile(name, id, alg, type, current, mctx, &key);
-	printf("read(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	ret = dst_key_tofile(key, type, tmp);
-	printf("write(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	use(key, mctx);
-	dns(key, mctx);
-	dst_key_free(&key);
-}
-
-static void
-dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx) {
-	dst_key_t *key1 = NULL, *key2 = NULL;
-	isc_result_t ret;
-	isc_buffer_t b1, b2;
-	isc_region_t r1, r2;
-	unsigned char array1[1024], array2[1024];
-	int alg = DST_ALG_DH;
-	int type = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE|DST_TYPE_KEY;
-
-	ret = dst_key_fromfile(name1, id1, alg, type, current, mctx, &key1);
-	printf("read(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	ret = dst_key_fromfile(name2, id2, alg, type, current, mctx, &key2);
-	printf("read(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	ret = dst_key_tofile(key1, type, tmp);
-	printf("write(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-	ret = dst_key_tofile(key2, type, tmp);
-	printf("write(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	isc_buffer_init(&b1, array1, sizeof(array1));
-	ret = dst_key_computesecret(key1, key2, &b1);
-	printf("computesecret() returned: %s\n", isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	isc_buffer_init(&b2, array2, sizeof(array2));
-	ret = dst_key_computesecret(key2, key1, &b2);
-	printf("computesecret() returned: %s\n", isc_result_totext(ret));
-	if (ret != 0)
-		return;
-
-	isc_buffer_usedregion(&b1, &r1);
-	isc_buffer_usedregion(&b2, &r2);
-
-	if (r1.length != r2.length || memcmp(r1.base, r2.base, r1.length) != 0)
-	{
-		int i;
-		printf("secrets don't match\n");
-		printf("secret 1: %u bytes\n", r1.length);
-		for (i = 0; i < (int) r1.length; i++)
-			printf("%02x ", r1.base[i]);
-		printf("\n");
-		printf("secret 2: %u bytes\n", r2.length);
-		for (i = 0; i < (int) r2.length; i++)
-			printf("%02x ", r2.base[i]);
-		printf("\n");
-	}
-	dst_key_free(&key1);
-	dst_key_free(&key2);
-}
-
-static void
-generate(int alg, isc_mem_t *mctx) {
-	isc_result_t ret;
-	dst_key_t *key = NULL;
-
-	ret = dst_key_generate(dns_rootname, alg, 512, 0, 0, 0,
-			       dns_rdataclass_in, mctx, &key, NULL);
-	printf("generate(%d) returned: %s\n", alg, isc_result_totext(ret));
-	if (ret != ISC_R_SUCCESS)
-		return;
-
-	if (alg != DST_ALG_DH)
-		use(key, mctx);
-
-	dst_key_free(&key);
-}
-
-int
-main(void) {
-	isc_mem_t *mctx = NULL;
-	isc_buffer_t b;
-	dns_fixedname_t fname;
-	dns_name_t *name;
-	isc_result_t result;
-
-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-
-	current = isc_mem_get(mctx, 256);
-	if (current == NULL)
-		return (1);
-	if (getcwd(current, 256) == NULL) {
-		perror("getcwd");
-		return (1);
-	}
-
-	dns_result_register();
-
-	dst_lib_init(mctx, NULL);
-
-	name = dns_fixedname_initname(&fname);
-	isc_buffer_constinit(&b, "test.", 5);
-	isc_buffer_add(&b, 5);
-	result = dns_name_fromtext(name, &b, NULL, 0, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-	io(name, 54622, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC,
-	   mctx);
-
-	io(name, 2, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
-
-	isc_buffer_constinit(&b, "dh.", 3);
-	isc_buffer_add(&b, 3);
-	result = dns_name_fromtext(name, &b, NULL, 0, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-	dh(name, 18602, name, 48957, mctx);
-
-	generate(DST_ALG_RSAMD5, mctx);
-	generate(DST_ALG_DH, mctx);
-	generate(DST_ALG_HMACMD5, mctx);
-
-	dst_lib_destroy();
-
-	isc_mem_put(mctx, current, 256);
-/*	isc_mem_stats(mctx, stdout);*/
-	isc_mem_destroy(&mctx);
-
-	return (0);
-}

bin/tests/system/acl/tests.sh

@@ -33,7 +33,7 @@ $DIG $DIGOPTS tsigzone. \
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 copy_setports ns2/named2.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5
 
 # prefix 10/8 should fail
@@ -56,7 +56,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1;
 echo_i "testing nested ACL processing"
 # all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
 copy_setports ns2/named3.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5
 
 # should succeed
@@ -102,7 +102,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1;
 
 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
 copy_setports ns2/named4.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5
 
 # should succeed
@@ -137,7 +137,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1;
 
 echo_i "testing allow-query-on ACL processing"
 copy_setports ns2/named5.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
+rndc_reload ns2 10.53.0.2
 sleep 5
 t=`expr $t + 1`
 $DIG -p ${PORT} +tcp soa example. \
@@ -161,7 +161,7 @@ grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 status=`expr $status + $ret`
 
 echo_i "calling rndc reconfig"
-$RNDCCMD 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndc_reconfig ns3 10.53.0.3
 
 sleep 1
 
@@ -190,7 +190,7 @@ grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 status=`expr $status + $ret`
 
 echo_i "calling rndc reconfig"
-$RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i
+rndc_reconfig ns4 10.53.0.4
 
 sleep 1
 

bin/tests/system/additional/tests.sh

@@ -218,8 +218,7 @@ dotests
 
 echo_i "reconfiguring server: minimal-responses no"
 copy_setports ns1/named2.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1
 
 echo_i "testing with 'minimal-responses no;'"
 minimal=no
@@ -236,8 +235,7 @@ fi
 
 echo_i "reconfiguring server: minimal-any yes"
 copy_setports ns1/named3.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1
 
 n=`expr $n + 1`
 echo_i "testing with 'minimal-any yes;' over UDP ($n)"
@@ -272,8 +270,7 @@ dotests
 
 echo_i "reconfiguring server: minimal-responses no-auth-recursive"
 copy_setports ns1/named4.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1
 
 echo_i "testing with 'minimal-responses no-auth-recursive;'"
 minimal=no-auth-recursive
@@ -303,8 +300,7 @@ fi
 
 echo_i "reconfiguring server: minimal-responses no"
 copy_setports ns1/named2.conf.in ns1/named.conf
-$RNDCCMD 10.53.0.1 reconfig 2>&1 | sed 's/^/ns1 /' | cat_i
-sleep 2
+rndc_reconfig ns1 10.53.0.1
 
 n=`expr $n + 1`
 echo_i "testing NS handling in ANY responses (authoritative) ($n)"

bin/tests/system/addzone/tests.sh

@@ -467,10 +467,9 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "reconfiguring server with multiple views"
-rm -f ns2/named.conf 
+rm -f ns2/named.conf
 copy_setports ns2/named2.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig 2>&1 | sed 's/^/I:ns2 /'
-sleep 5
+rndc_reconfig ns2 10.53.0.2
 
 echo_i "adding new zone to external view ($n)"
 # NOTE: The internal view has "recursion yes" set, and so queries for
@@ -591,8 +590,7 @@ status=`expr $status + $ret`
 echo_i "reconfiguring server with multiple views and new-zones-directory"
 rm -f ns2/named.conf
 copy_setports ns2/named3.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig 2>&1 | sed 's/^/I:ns2 /'
-sleep 5
+rndc_reconfig ns2 10.53.0.2
 
 echo_i "checking new zone is still loaded after dir change ($n)"
 ret=0
@@ -659,8 +657,7 @@ status=`expr $status + $ret`
 
 echo_i "ensure the configuration context is cleaned up correctly ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 reconfig > /dev/null 2>&1 || ret=1
-sleep 5
+rndc_reconfig ns2 10.53.0.2
 $RNDCCMD 10.53.0.2 status > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -670,8 +667,7 @@ echo_i "check delzone after reconfig failure ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 addzone 'inlineslave.example. IN { type slave; file "inlineslave.db"; masterfile-format text; masters { testmaster; }; };' > /dev/null 2>&1 || ret=1
 copy_setports ns3/named2.conf.in ns3/named.conf
-$RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1 && ret=1
-sleep 5
+rndc_reconfgi ns3 10.53.0.3
 $RNDCCMD 10.53.0.3 delzone inlineslave.example > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -695,8 +691,8 @@ echo_i "check that named restarts with multiple added zones ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 addzone "test4.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone "test5.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
-$PERL $SYSTEMTESTTOP/stop.pl . ns3
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns3 || ret=1
+$PERL $SYSTEMTESTTOP/stop.pl addzone ns3
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} addzone ns3 || ret=1
 $DIG $DIGOPTS @10.53.0.3 version.bind txt ch > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 n=`expr $n + 1`

bin/tests/system/allow-query/tests.sh

@@ -55,14 +55,6 @@ SYSTEMTESTTOP=..
 
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
 
-rndc_reload() {
-    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/'$1' /'`"
-    for try in 0 1 2 3 4 5 6 7 8 9; do
-        nextpart $1/named.run | grep "reloading configuration succeeded" > /dev/null && break
-        sleep 1
-    done
-}
-
 status=0
 n=0
 

bin/tests/system/autosign/clean.sh

@@ -12,18 +12,19 @@
 rm -f */K* */dsset-* */*.signed */tmp* */*.jnl */*.bk
 rm -f */core
 rm -f */example.bk
+rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
-rm -f */named.conf
 rm -f */trusted.conf */private.conf
 rm -f activate-now-publish-1day.key
-rm -f active.key inact.key del.key unpub.key standby.key rev.key
+rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
 rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
 rm -f dig.out.*
 rm -f digcomp.out.test*
 rm -f digcomp.out.test*
 rm -f missingzsk.key inactivezsk.key
 rm -f nopriv.key vanishing.key del1.key del2.key
+rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
 rm -f ns*/named.lock
 rm -f ns1/root.db
@@ -32,6 +33,8 @@ rm -f ns2/private.secure.example.db ns2/bar.db
 rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
 rm -f ns3/*.nzf
 rm -f ns3/autonsec3.example.db
+rm -f ns3/delzsk.example.db
+rm -f ns3/dname-at-apex-nsec3.example.db
 rm -f ns3/inacksk2.example.db
 rm -f ns3/inacksk3.example.db
 rm -f ns3/inaczsk2.example.db
@@ -63,4 +66,3 @@ rm -f nsupdate.out
 rm -f settime.out.*
 rm -f signing.out.*
 rm -f sync.key
-rm -f ns*/managed-keys.bind*

bin/tests/system/autosign/ns2/example.db.in

@@ -82,3 +82,5 @@ ns.nsec3-to-nsec	A	10.53.0.3
 
 oldsigs			NS	ns.oldsigs
 ns.oldsigs		A	10.53.0.3
+
+dname-at-apex-nsec3	NS	ns3

bin/tests/system/autosign/ns2/keygen.sh

@@ -15,7 +15,8 @@ SYSTEMTESTTOP=../..
 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )
 
-for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync
+for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync \
+    dname-at-apex-nsec3
 do
 	cp ../ns3/dsset-$subdomain.example$TP .
 done

bin/tests/system/autosign/ns3/delzsk.example.db.in

@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000010101 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+sub			NS	ns.sub
+			DS	12345 8 1 0000000000000000000000000000000000000000
+ns.sub			A	10.53.0.3

bin/tests/system/autosign/ns3/dname-at-apex-nsec3.example.db.in

@@ -0,0 +1,5 @@
+$TTL	600
+@	SOA	ns3.example. . 1 1200 1200 1814400 3600
+@	NS	ns3.example.
+@	DNAME	example.
+@	NSEC3PARAM 1 0 0 -

bin/tests/system/autosign/ns3/keygen.sh

@@ -314,3 +314,23 @@ ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -a NSEC3RSASHA1 -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
+
+#
+# A zone that starts with an active KSK + ZSK and an inactive ZSK, with the
+# latter getting deleted during the test.
+#
+setup delzsk.example
+cp $infile $zonefile
+ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+$KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+zsk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -I now-1w $zone 2>kg.out` || dumpit kg.out
+echo $zsk > ../delzsk.key
+
+#
+#  Check that NSEC3 are correctly signed and returned from below a DNAME
+#
+setup dname-at-apex-nsec3.example
+cp $infile $zonefile
+ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
+$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}$TP

bin/tests/system/autosign/ns3/named.conf.in

@@ -282,4 +282,18 @@ zone "inaczsk3.example" {
 	auto-dnssec maintain;
 };
 
+zone "delzsk.example." {
+	type master;
+	file "delzsk.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
+zone "dname-at-apex-nsec3.example" {
+	type master;
+	file "dname-at-apex-nsec3.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
 include "trusted.conf";

bin/tests/system/autosign/ns3/secure.example.db.in

@@ -31,3 +31,5 @@ ns.private		A	10.53.0.2
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.2
 
+dname-and-txt		DNAME	@
+			TXT	"DNAME and TXT"

bin/tests/system/autosign/tests.sh

@@ -1227,7 +1227,7 @@ rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
 [ "$rekey_calls" -eq 0 ] || ret=1
 # ...then we add auto-dnssec and reconfigure
 $RNDCCMD 10.53.0.3 modzone reconf.example '{ type master; file "reconf.example.db"; allow-update { any; }; auto-dnssec maintain; };' 2>&1 | sed 's/^/ns3 /' | cat_i
-$RNDCCMD 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndc_reconfig ns3 10.53.0.3
 for i in 0 1 2 3 4 5 6 7 8 9; do
     lret=0
     rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
@@ -1395,5 +1395,77 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "checking for out-of-zone NSEC3 records after ZSK removal ($n)"
+ret=0
+# Switch the zone over to NSEC3 and wait until the transition is complete.
+$RNDCCMD 10.53.0.3 signing -nsec3param 1 1 10 12345678 delzsk.example. > signing.out.1.test$n 2>&1 || ret=1
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	_ret=1
+	$DIG $DIGOPTS delzsk.example NSEC3PARAM @10.53.0.3 > dig.out.ns3.1.test$n 2>&1 || ret=1
+	grep "NSEC3PARAM.*12345678" dig.out.ns3.1.test$n > /dev/null 2>&1
+	if [ $? -eq 0 ]; then
+		_ret=0
+		break
+	fi
+	sleep 1
+done
+if [ $_ret -ne 0 ]; then
+	echo_i "timed out waiting for NSEC3 chain creation"
+	ret=1
+fi
+# Mark the inactive ZSK as pending removal.
+file="ns3/`cat delzsk.key`.key"
+$SETTIME -D now-1h $file > settime.out.test$n 2>&1 || ret=1
+# Trigger removal of the inactive ZSK and wait until its completion.
+$RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	_ret=1
+	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
+	grep "Signing " signing.out.2.test$n > /dev/null 2>&1
+	if [ $? -ne 0 ]; then
+		if [ `cat signing.out.2.test$n | wc -l` -eq 2 ]; then
+			_ret=0
+			break
+		fi
+	fi
+	sleep 1
+done
+if [ $_ret -ne 0 ]; then
+	echo_i "timed out waiting for key removal"
+	ret=1
+fi
+# Check whether key removal caused NSEC3 records to be erroneously created for
+# glue records due to a secure delegation already being signed by the active key
+# (i.e. a key other than the one being removed but using the same algorithm).
+#
+# For reference:
+#
+#     $ nsec3hash 12345678 1 10 ns.sub.delzsk.example.
+#     589R358VSPJUFVAJU949JPVF74D9PTGH (salt=12345678, hash=1, iterations=10)
+#
+$DIG $DIGOPTS delzsk.example AXFR @10.53.0.3 > dig.out.ns3.3.test$n || ret=1
+grep "589R358VSPJUFVAJU949JPVF74D9PTGH" dig.out.ns3.3.test$n > /dev/null 2>&1 && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "check that DNAME at apex with NSEC3 is correctly signed (auto-dnssec maintain) ($n)"
+ret=0
+$DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "RRSIG NSEC3 7 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking that DNAME is not treated as a delegation when signing ($n)"
+ret=0
+$DIG $DIGOPTS dname-and-txt.secure.example. DNAME @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
+grep "dname-and-txt.secure.example.*RRSIG.*DNAME" dig.out.ns3.1.test$n > /dev/null 2>&1 || ret=1
+$DIG $DIGOPTS dname-and-txt.secure.example. TXT @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+grep "dname-and-txt.secure.example.*RRSIG.*TXT" dig.out.ns3.2.test$n > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/builtin/tests.sh

@@ -148,7 +148,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
 n=`expr $n + 1`
 echo_i "Checking that reloading empty zones is silent ($n)"
-$RNDCCMD 10.53.0.1 reload > /dev/null
+rndc_reload ns1 10.53.0.1
 ret=0
 grep "automatic empty zone" ns1/named.run > /dev/null || ret=1
 grep "received control channel command 'reload'" ns1/named.run > /dev/null || ret=1

bin/tests/system/checkconf/bad-stub-masters-dialup.conf

@@ -0,0 +1,23 @@
+controls { /* empty */ };
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	heartbeat-interval 2;
+	recursion no;
+};
+zone "." {
+	type hint;
+	file "hint";
+};
+zone "example." {
+	type stub;
+	dialup notify;
+	notify no;
+	file "example.bk";
+	// masters { 10.53.0.1; };
+};

bin/tests/system/conf.sh.common

@@ -0,0 +1,305 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+if test -n "$PERL"
+then
+	if $PERL -e "use IO::Socket::INET6;" 2> /dev/null
+	then
+		TESTSOCK6="$PERL $TOP/bin/tests/system/testsock6.pl"
+	else
+		TESTSOCK6=false
+	fi
+else
+	TESTSOCK6=false
+fi
+
+TESTSOCK6="$TESTSOCK6"
+
+. ${TOP}/version
+
+#
+# Set up color-coded test output
+#
+if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
+    COLOR_END=`tput setaf 4`    # blue
+    COLOR_FAIL=`tput setaf 1`   # red
+    COLOR_INFO=`tput bold`      # bold
+    COLOR_NONE=`tput sgr0`
+    COLOR_PASS=`tput setaf 2`   # green
+    COLOR_START=`tput setaf 4`  # blue
+    COLOR_WARN=`tput setaf 3`   # yellow
+else
+    # set to empty strings so printf succeeds
+    COLOR_END=''
+    COLOR_FAIL=''
+    COLOR_INFO=''
+    COLOR_NONE=''
+    COLOR_PASS=''
+    COLOR_START=''
+    COLOR_WARN=''
+fi
+
+if type printf > /dev/null 2>&1
+then
+	echofail () {
+		printf "${COLOR_FAIL}%s${COLOR_NONE}\n" "$*"
+	}
+	echowarn () {
+		printf "${COLOR_WARN}%s${COLOR_NONE}\n" "$*"
+	}
+	echopass () {
+		printf "${COLOR_PASS}%s${COLOR_NONE}\n" "$*"
+	}
+	echoinfo () {
+		printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
+	}
+	echostart () {
+		printf "${COLOR_START}%s${COLOR_NONE}\n" "$*"
+	}
+	echoend () {
+		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
+	}
+else
+	echofail () {
+		echo "$*"
+	}
+	echowarn () {
+		echo "$*"
+	}
+	echopass () {
+		echo "$*"
+	}
+	echoinfo () {
+		echo "$*"
+	}
+	echostart () {
+		echo "$*"
+	}
+	echoend () {
+		echo "$*"
+	}
+fi
+
+SYSTESTDIR="`basename $PWD`"
+
+echo_i() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
+    done
+}
+
+echo_ic() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
+    done
+}
+
+cat_i() {
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
+    done
+}
+
+echo_d() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+cat_d() {
+    while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+digcomp() {
+    output=`$PERL $SYSTEMTESTTOP/digcomp.pl "$@"`
+    result=$?
+    [ -n "$output" ] &&  { echo "digcomp failed:"; echo "$output"; } | cat_i
+    return $result
+}
+
+#
+# Useful functions in test scripts
+#
+
+# keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
+# converts keyfile data into a configuration section using the supplied
+# parameters
+keyfile_to_keys_section() {
+    section_name=$1
+    key_prefix=$2
+    shift
+    shift
+    echo "$section_name {"
+    for keyname in $*; do
+        awk '!/^; /{
+            printf "\t\""$1"\" "
+            printf "'"$key_prefix"'"
+            printf $4 " " $5 " " $6 " \""
+            for (i=7; i<=NF; i++) printf $i
+            printf "\";\n"
+        }' $keyname.key
+    done
+    echo "};"
+}
+
+# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
+# provided to a "trusted-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_trusted_keys() {
+    keyfile_to_keys_section "trusted-keys" "" $*
+}
+
+# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
+# provided to a "managed-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_managed_keys() {
+    keyfile_to_keys_section "managed-keys" "initial-key " $*
+}
+
+# nextpart*() - functions for reading files incrementally
+#
+# These functions aim to facilitate looking for (or waiting for)
+# messages which may be logged more than once throughout the lifetime of
+# a given named instance by outputting just the part of the file which
+# has been appended since the last time we read it.
+#
+# Calling some of these functions causes temporary *.prev files to be
+# created that need to be cleaned up manually (usually by a given system
+# test's clean.sh script).
+#
+# Note that unlike other nextpart*() functions, nextpartread() is not
+# meant to be directly used in system tests; its sole purpose is to
+# reduce code duplication below.
+#
+# A quick usage example:
+#
+#     $ echo line1 > named.log
+#     $ echo line2 >> named.log
+#     $ nextpart named.log
+#     line1
+#     line2
+#     $ echo line3 >> named.log
+#     $ nextpart named.log
+#     line3
+#     $ nextpart named.log
+#     $ echo line4 >> named.log
+#     $ nextpartpeek named.log
+#     line4
+#     $ nextpartpeek named.log
+#     line4
+#     $ nextpartreset named.log
+#     $ nextpartpeek named.log
+#     line1
+#     line2
+#     line3
+#     line4
+#     $ nextpart named.log
+#     line1
+#     line2
+#     line3
+#     line4
+#     $ nextpart named.log
+#     $
+
+# nextpartreset: reset the marker used by nextpart() and nextpartpeek()
+# so that it points to the start of the given file
+nextpartreset() {
+    echo "0" > $1.prev
+}
+
+# nextpartread: read everything that's been appended to a file since the
+# last time nextpart() was called and print it to stdout, print the
+# total number of lines read from that file so far to stderr
+nextpartread() {
+    [ -f $1.prev ] || nextpartreset $1
+    prev=`cat $1.prev`
+    awk "NR > $prev "'{ print }
+         END          { print NR > "/dev/stderr" }' $1
+}
+
+# nextpart: read everything that's been appended to a file since the
+# last time nextpart() was called
+nextpart() {
+	nextpartread $1 2> $1.prev.tmp
+	mv $1.prev.tmp $1.prev
+}
+
+# nextpartpeek: read everything that's been appended to a file since the
+# last time nextpart() was called
+nextpartpeek() {
+	nextpartread $1 2> /dev/null
+}
+
+rndc_reload() {
+    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'$1' /'`"
+    # reloading single zone is synchronous, if we're reloading whole server
+    # we need to wait for reload to finish
+    if [ -z "$3" ]; then
+	for __try in 0 1 2 3 4 5 6 7 8 9; do
+	    $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break; 
+	    sleep 1
+	done
+    fi
+}
+
+rndc_reconfig() {
+    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reconfig 2>&1 | sed 's/^/'$1' /'`"
+    for __try in 0 1 2 3 4 5 6 7 8 9; do
+        $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break; 
+	sleep 1
+    done
+}
+
+#
+# Export command paths
+#
+export ARPANAME
+export BIGKEY
+export CDS
+export CHECKZONE
+export DESCRIPTION
+export DIG
+export FEATURETEST
+export FSTRM_CAPTURE
+export GENCHECK
+export JOURNALPRINT
+export KEYCREATE
+export KEYDELETE
+export KEYFRLAB
+export KEYGEN
+export KEYSETTOOL
+export KEYSIGNER
+export KRB5_CONFIG
+export MAKEJOURNAL
+export MDIG
+export NAMED
+export NSEC3HASH
+export NSLOOKUP
+export NSUPDATE
+export NZD2NZF
+export PERL
+export PIPEQUERIES
+export PK11DEL
+export PK11GEN
+export PK11LIST
+export PSSUSPEND
+export PYTHON
+export RESOLVE
+export RNDC
+export RRCHECKER
+export SAMPLEUPDATE
+export SIGNER
+export SUBDIRS
+export TESTSOCK6
+export TSIGKEYGEN
+export WIRETEST

bin/tests/system/conf.sh.in

@@ -22,6 +22,11 @@ DEFAULT_ALGORITHM=ECDSAP256SHA256
 DEFAULT_ALGORITHM_NUMBER=13
 DEFAULT_BITS=256
 
+# must be different from DEFAULT_ALGORITHM
+ALTERNATIVE_ALGORITHM=RSASHA256
+ALTERNATIVE_ALGORITHM_NUMBER=8
+ALTERNATIVE_BITS=1280
+
 ARPANAME=$TOP/bin/tools/arpaname
 CDS=$TOP/bin/dnssec/dnssec-cds
 CHECKCONF=$TOP/bin/check/named-checkconf
@@ -128,20 +133,6 @@ XMLLINT=@XMLLINT@
 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@
 
-if test -n "$PERL"
-then
-	if $PERL -e "use IO::Socket::INET6;" 2> /dev/null
-	then
-		TESTSOCK6="$PERL $TOP/bin/tests/system/testsock6.pl"
-	else
-		TESTSOCK6=false
-	fi
-else
-	TESTSOCK6=false
-fi
-
-TESTSOCK6="$TESTSOCK6"
-
 # Windows process management leave empty
 PSSUSPEND=
 
@@ -155,225 +146,8 @@ HAVEJSONSTATS=@JSONSTATS@
 ZLIB=@ZLIB@
 NZD=@NZD_TOOLS@
 
-. ${TOP}/version
-
-#
-# Set up color-coded test output
-#
-if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
-    COLOR_END=`tput setaf 4`    # blue
-    COLOR_FAIL=`tput setaf 1`   # red
-    COLOR_INFO=`tput bold`      # bold
-    COLOR_NONE=`tput sgr0`
-    COLOR_PASS=`tput setaf 2`   # green
-    COLOR_START=`tput setaf 4`  # blue
-    COLOR_WARN=`tput setaf 3`   # yellow
-else
-    # set to empty strings so printf succeeds
-    COLOR_END=''
-    COLOR_FAIL=''
-    COLOR_INFO=''
-    COLOR_NONE=''
-    COLOR_PASS=''
-    COLOR_START=''
-    COLOR_WARN=''
-fi
-
-if type printf > /dev/null 2>&1
-then
-	echofail () {
-		printf "${COLOR_FAIL}%s${COLOR_NONE}\n" "$*"
-	}
-	echowarn () {
-		printf "${COLOR_WARN}%s${COLOR_NONE}\n" "$*"
-	}
-	echopass () {
-		printf "${COLOR_PASS}%s${COLOR_NONE}\n" "$*"
-	}
-	echoinfo () {
-		printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
-	}
-	echostart () {
-		printf "${COLOR_START}%s${COLOR_NONE}\n" "$*"
-	}
-	echoend () {
-		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
-	}
-else
-	echofail () {
-		echo "$*"
-	}
-	echowarn () {
-		echo "$*"
-	}
-	echopass () {
-		echo "$*"
-	}
-	echoinfo () {
-		echo "$*"
-	}
-	echostart () {
-		echo "$*"
-	}
-	echoend () {
-		echo "$*"
-	}
-fi
-
-SYSTESTDIR="`basename $PWD`"
-
-echo_i() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:$__LINE"
-    done
-}
-
-echo_ic() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $__LINE"
-    done
-}
-
-cat_i() {
-    while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:$__LINE"
-    done
-}
-
-echo_d() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "D:$SYSTESTDIR:$__LINE"
-    done
-}
-
-cat_d() {
-    while read __LINE ; do
-       echoinfo "D:$SYSTESTDIR:$__LINE"
-    done
-}
-
-
-digcomp() {
-    output=`$PERL $SYSTEMTESTTOP/digcomp.pl "$@"`
-    result=$?
-    [ -n "$output" ] &&  { echo "digcomp failed:"; echo "$output"; } | cat_i
-    return $result
-}
-
-#
-# Useful functions in test scripts
-#
-
-# keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
-# converts keyfile data into a configuration section using the supplied
-# parameters
-keyfile_to_keys_section() {
-    section_name=$1
-    key_prefix=$2
-    shift
-    shift
-    echo "$section_name {"
-    for keyname in $*; do
-        awk '!/^; /{
-            printf "\t\""$1"\" "
-            printf "'"$key_prefix"'"
-            printf $4 " " $5 " " $6 " \""
-            for (i=7; i<=NF; i++) printf $i
-            printf "\";\n"
-        }' $keyname.key
-    done
-    echo "};"
-}
-
-# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
-# provided to a "trusted-keys" section suitable for including in a
-# resolver's configuration file
-keyfile_to_trusted_keys() {
-    keyfile_to_keys_section "trusted-keys" "" $*
-}
-
-# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
-# provided to a "managed-keys" section suitable for including in a
-# resolver's configuration file
-keyfile_to_managed_keys() {
-    keyfile_to_keys_section "managed-keys" "initial-key " $*
-}
-
-# nextpart*() - functions for reading files incrementally
-#
-# These functions aim to facilitate looking for (or waiting for)
-# messages which may be logged more than once throughout the lifetime of
-# a given named instance by outputting just the part of the file which
-# has been appended since the last time we read it.
-#
-# Calling some of these functions causes temporary *.prev files to be
-# created that need to be cleaned up manually (usually by a given system
-# test's clean.sh script).
-#
-# Note that unlike other nextpart*() functions, nextpartread() is not
-# meant to be directly used in system tests; its sole purpose is to
-# reduce code duplication below.
-#
-# A quick usage example:
-#
-#     $ echo line1 > named.log
-#     $ echo line2 >> named.log
-#     $ nextpart named.log
-#     line1
-#     line2
-#     $ echo line3 >> named.log
-#     $ nextpart named.log
-#     line3
-#     $ nextpart named.log
-#     $ echo line4 >> named.log
-#     $ nextpartpeek named.log
-#     line4
-#     $ nextpartpeek named.log
-#     line4
-#     $ nextpartreset named.log
-#     $ nextpartpeek named.log
-#     line1
-#     line2
-#     line3
-#     line4
-#     $ nextpart named.log
-#     line1
-#     line2
-#     line3
-#     line4
-#     $ nextpart named.log
-#     $
-
-# nextpartreset: reset the marker used by nextpart() and nextpartpeek()
-# so that it points to the start of the given file
-nextpartreset() {
-    echo "0" > $1.prev
-}
-
-# nextpartread: read everything that's been appended to a file since the
-# last time nextpart() was called and print it to stdout, print the
-# total number of lines read from that file so far to stderr
-nextpartread() {
-    [ -f $1.prev ] || nextpartreset $1
-    prev=`cat $1.prev`
-    awk "NR > $prev "'{ print }
-         END          { print NR > "/dev/stderr" }' $1
-}
-
-# nextpart: read everything that's been appended to a file since the
-# last time nextpart() was called
-nextpart() {
-	nextpartread $1 2> $1.prev.tmp
-	mv $1.prev.tmp $1.prev
-}
-
-# nextpartpeek: read everything that's been appended to a file since the
-# last time nextpart() was called
-nextpartpeek() {
-	nextpartread $1 2> /dev/null
-}
-
 # copy_setports - Copy Configuration File and Replace Ports
+# Unfortunately it has to be different on Windows.
 #
 # Convenience function to copy a configuration file, replacing the tokens
 # QUERYPORT, CONTROLPORT and EXTRAPORT[1-8] with the values of the equivalent
@@ -397,49 +171,11 @@ copy_setports() {
 	-e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
 	-e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
 	-e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
+	-e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
+	-e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
+	-e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
 	$1 > $2
 }
 
-#
-# Export command paths
-#
-export ARPANAME
-export BIGKEY
-export CDS
-export CHECKZONE
-export DESCRIPTION
-export DIG
-export FEATURETEST
-export FSTRM_CAPTURE
-export GENCHECK
-export JOURNALPRINT
-export KEYCREATE
-export KEYDELETE
-export KEYFRLAB
-export KEYGEN
-export KEYSETTOOL
-export KEYSIGNER
-export KRB5_CONFIG
-export MAKEJOURNAL
-export MDIG
-export NAMED
-export NSEC3HASH
-export NSLOOKUP
-export NSUPDATE
-export NZD2NZF
-export PERL
-export PIPEQUERIES
-export PK11DEL
-export PK11GEN
-export PK11LIST
-export PSSUSPEND
-export PYTHON
-export RESOLVE
-export RNDC
-export RRCHECKER
-export SAMPLEUPDATE
-export SIGNER
-export SUBDIRS
-export TESTSOCK6
-export TSIGKEYGEN
-export WIRETEST
+# The rest is shared between Windows and Unices
+. $TOP/bin/tests/system/conf.sh.common

bin/tests/system/conf.sh.win32

@@ -31,7 +31,13 @@ DEFAULT_ALGORITHM=ECDSAP256SHA256
 DEFAULT_ALGORITHM_NUMBER=13
 DEFAULT_BITS=256
 
+# must be different from DEFAULT_ALGORITHM
+ALTERNATIVE_ALGORITHM=RSASHA256
+ALTERNATIVE_ALGORITHM_NUMBER=8
+ALTERNATIVE_BITS=1280
+
 ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
+CDS=
 CHECKCONF=$TOP/Build/$VSCONF/named-checkconf@EXEEXT@
 CHECKDS="$PYTHON `cygpath -w $TOP/bin/python/dnssec-checkds.py`"
 CHECKZONE=$TOP/Build/$VSCONF/named-checkzone@EXEEXT@
@@ -50,6 +56,7 @@ KEYGEN=$TOP/Build/$VSCONF/dnssec-keygen@EXEEXT@
 KEYMGR="$PYTHON `cygpath -w $TOP/bin/python/dnssec-keymgr.py`"
 MDIG=$TOP/Build/$VSCONF/mdig@EXEEXT@
 NAMED=$TOP/Build/$VSCONF/named@EXEEXT@
+NSEC3HASH=
 NSLOOKUP=$TOP/Build/$VSCONF/nslookup@EXEEXT@
 NSUPDATE=$TOP/Build/$VSCONF/nsupdate@EXEEXT@
 NZD2NZF=$TOP/Build/$VSCONF/named-nzd2nzf@EXEEXT@
@@ -68,6 +75,7 @@ TSIGKEYGEN=$TOP/Build/$VSCONF/tsig-keygen@EXEEXT@
 VERIFY=$TOP/Build/$VSCONF/dnssec-verify@EXEEXT@
 
 # to port WIRETEST=$TOP/Build/$VSCONF/wire_test@EXEEXT@
+WIRETEST=
 
 BIGKEY=$TOP/Build/$VSCONF/bigkey@EXEEXT@
 GENCHECK=$TOP/Build/$VSCONF/gencheck@EXEEXT@
@@ -128,25 +136,12 @@ CURL=/usr/bin/curl
 XMLLINT=/usr/bin/xmllint
 PERL=/usr/bin/perl
 
-if test -n "$PERL"
-then
-	if $PERL -e "use IO::Socket::INET6;" 2> /dev/null
-	then
-		TESTSOCK6="$PERL $TOP/bin/tests/system/testsock6.pl"
-	else
-		TESTSOCK6=false
-	fi
-else
-	TESTSOCK6=false
-fi
-
-TESTSOCK6="$TESTSOCK6"
-
 #
 # PsSuspend is part of PSTools and can be downloaded from
 # https://download.sysinternals.com/files/PSTools.zip
 #
 PSSUSPEND=@PSSUSPEND@
+
 PYTHON=@PYTHON@
 
 #
@@ -157,190 +152,8 @@ HAVEJSONSTATS=@JSONSTATS@
 ZLIB=@ZLIB@
 NZD=@NZD_TOOLS@
 
-. ${TOP}/version
-
-#
-# Set up color-coded test output
-#
-if test -t 1 && type tput > /dev/null; then
-    COLOR_END=`tput setaf 4`    # blue
-    COLOR_FAIL=`tput setaf 1`   # red
-    COLOR_INFO=`tput bold`      # bold
-    COLOR_NONE=`tput sgr0`
-    COLOR_PASS=`tput setaf 2`   # green
-    COLOR_START=`tput setaf 4`  # blue
-    COLOR_WARN=`tput setaf 3`   # yellow
-else
-    # set to empty strings so printf succeeds
-    COLOR_END=''
-    COLOR_FAIL=''
-    COLOR_INFO=''
-    COLOR_NONE=''
-    COLOR_PASS=''
-    COLOR_START=''
-    COLOR_WARN=''
-fi
-
-echofail () {
-        printf "${COLOR_FAIL}%s${COLOR_NONE}\n" "$*"
-}
-echowarn () {
-        printf "${COLOR_WARN}%s${COLOR_NONE}\n" "$*"
-}
-echopass () {
-        printf "${COLOR_PASS}%s${COLOR_NONE}\n" "$*"
-}
-echoinfo () {
-        printf "${COLOR_INFO}%s${COLOR_NONE}\n" "$*"
-}
-echostart () {
-        printf "${COLOR_START}%s${COLOR_NONE}\n" "$*"
-}
-echoend () {
-        printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
-}
-
-SYSTESTDIR="`basename $PWD`"
-
-echo_i() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:$__LINE"
-    done
-}
-
-echo_ic() {
-    echo "$@" | while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $__LINE"
-    done
-}
-
-cat_i() {
-    while read __LINE ; do
-       echoinfo "I:$SYSTESTDIR:$__LINE"
-    done
-}
-
-digcomp() {
-    output=`$PERL $SYSTEMTESTTOP/digcomp.pl "$@"`
-    result=$?
-    [ -n "$output" ] &&  { echo "digcomp failed:"; echo "$output"; } | cat_i
-    return $result
-}
-
-#
-# Useful functions in test scripts
-#
-
-# keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
-# converts keyfile data into a configuration section using the supplied
-# parameters
-keyfile_to_keys_section() {
-    section_name=$1
-    key_prefix=$2
-    shift
-    shift
-    echo "$section_name {"
-    for keyname in $*; do
-        awk '!/^; /{
-            printf "\t\""$1"\" "
-            printf "'"$key_prefix"'"
-            printf $4 " " $5 " " $6 " \""
-            for (i=7; i<=NF; i++) printf $i
-            printf "\";\n"
-        }' $keyname.key
-    done
-    echo "};"
-}
-
-# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
-# provided to a "trusted-keys" section suitable for including in a
-# resolver's configuration file
-keyfile_to_trusted_keys() {
-    keyfile_to_keys_section "trusted-keys" "" $*
-}
-
-# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
-# provided to a "managed-keys" section suitable for including in a
-# resolver's configuration file
-keyfile_to_managed_keys() {
-    keyfile_to_keys_section "managed-keys" "initial-key " $*
-}
-
-# nextpart*() - functions for reading files incrementally
-#
-# These functions aim to facilitate looking for (or waiting for)
-# messages which may be logged more than once throughout the lifetime of
-# a given named instance by outputting just the part of the file which
-# has been appended since the last time we read it.
-#
-# Calling some of these functions causes temporary *.prev files to be
-# created that need to be cleaned up manually (usually by a given system
-# test's clean.sh script).
-#
-# Note that unlike other nextpart*() functions, nextpartread() is not
-# meant to be directly used in system tests; its sole purpose is to
-# reduce code duplication below.
-#
-# A quick usage example:
-#
-#     $ echo line1 > named.log
-#     $ echo line2 >> named.log
-#     $ nextpart named.log
-#     line1
-#     line2
-#     $ echo line3 >> named.log
-#     $ nextpart named.log
-#     line3
-#     $ nextpart named.log
-#     $ echo line4 >> named.log
-#     $ nextpartpeek named.log
-#     line4
-#     $ nextpartpeek named.log
-#     line4
-#     $ nextpartreset named.log
-#     $ nextpartpeek named.log
-#     line1
-#     line2
-#     line3
-#     line4
-#     $ nextpart named.log
-#     line1
-#     line2
-#     line3
-#     line4
-#     $ nextpart named.log
-#     $
-
-# nextpartreset: reset the marker used by nextpart() and nextpartpeek()
-# so that it points to the start of the given file
-nextpartreset() {
-    echo "0" > $1.prev
-}
-
-# nextpartread: read everything that's been appended to a file since the
-# last time 'nextpart' was called and print it to stdout, print the
-# total number of lines read from that file so far to stderr
-nextpartread() {
-    [ -f $1.prev ] || nextpartreset $1
-    prev=`cat $1.prev`
-    awk "NR > $prev "'{ print }
-         END          { print NR > "/dev/stderr" }' $1
-}
-
-# nextpart: read everything that's been appended to a file since the
-# last time 'nextpart' was called
-nextpart() {
-	nextpartread $1 2> $1.prev.tmp
-	mv $1.prev.tmp $1.prev
-}
-
-# nextpartpeek: read everything that's been appended to a file since the
-# last time 'nextpart' was called
-nextpartpeek() {
-	nextpartread $1 2> /dev/null
-}
-
 # copy_setports - Copy Configuration File and Replace Ports
+# Unfortunately it has to be different on Windows.
 #
 # Convenience function to copy a configuration file, replacing the tokens
 # QUERYPORT, CONTROLPORT and EXTRAPORT[1-8] with the values of the equivalent
@@ -367,48 +180,14 @@ copy_setports() {
         -e "s/${atsign}EXTRAPORT7${atsign}/${EXTRAPORT7}/g" \
         -e "s/${atsign}EXTRAPORT8${atsign}/${EXTRAPORT8}/g" \
         -e "s/${atsign}CONTROLPORT${atsign}/${CONTROLPORT}/g" \
-	-e "s/${atsign}DEFAULT_ALGORITM${atsign}/${DEFAULT_ALGORITHM}/g" \
+	-e "s/${atsign}DEFAULT_ALGORITHM${atsign}/${DEFAULT_ALGORITHM}/g" \
 	-e "s/${atsign}DEFAULT_ALGORITHM_NUMBER${atsign}/${DEFAULT_ALGORITHM_NUMBER}/g" \
 	-e "s/${atsign}DEFAULT_BITS${atsign}/${DEFAULT_BITS}/g" \
+	-e "s/${atsign}ALTERNATIVE_ALGORITHM${atsign}/${ALTERNATIVE_ALGORITHM}/g" \
+	-e "s/${atsign}ALTERNATIVE_ALGORITHM_NUMBER${atsign}/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
+	-e "s/${atsign}ALTERNATIVE_BITS${atsign}/${ALTERNATIVE_BITS}/g" \
 	$1 > $2
 }
 
-#
-# Export command paths
-#
-export ARPANAME
-export BIGKEY
-export CHECKZONE
-export DESCRIPTION
-export DIG
-export FEATURETEST
-export FSTRM_CAPTURE
-export GENCHECK
-export JOURNALPRINT
-export KEYCREATE
-export KEYDELETE
-export KEYFRLAB
-export KEYGEN
-export KEYSETTOOL
-export KEYSIGNER
-export KRB5_CONFIG
-export MAKEJOURNAL
-export MDIG
-export NAMED
-export NSLOOKUP
-export NSUPDATE
-export NZD2NZF
-export PERL
-export PIPEQUERIES
-export PK11DEL
-export PK11GEN
-export PK11LIST
-export PSSUSPEND
-export PYTHON
-export RESOLVE
-export RNDC
-export RRCHECKER
-export SAMPLEUPDATE
-export SIGNER
-export SUBDIRS
-export TESTSOCK6
+# The rest is shared between Windows and Unices
+. $TOP/bin/tests/system/conf.sh.common

bin/tests/system/coverage/12-ksk-deletion/expect

@@ -0,0 +1,6 @@
+args=
+warn=4
+error=1
+ok=1
+retcode=1
+match=0

bin/tests/system/coverage/setup.sh

@@ -127,3 +127,8 @@ $SETTIME -K $dir -I +18mo -D +2y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
 $SETTIME -K $dir -I +16mo $zsk1 > /dev/null 2>&1
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+
+# Test 12: Too early KSK deletion
+dir=12-ksk-deletion
+ksk1=`$KEYGEN -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com`
+ksk2=`$KEYGEN -K $dir -S $ksk1.key example.com`

bin/tests/system/coverage/tests.sh

@@ -70,6 +70,12 @@ for dir in [0-9][0-9]-*; do
             ret=1
         fi
 
+        found=`grep Traceback coverage.$n | wc -l`
+        if [ $found -ne 0 ]; then
+            echo "python exception detected"
+            ret=1
+        fi
+
         n=`expr $n + 1`
         if [ $ret != 0 ]; then echo_i "failed"; fi
         status=`expr $status + $ret`

bin/tests/system/digdelv/clean.sh

@@ -9,14 +9,17 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.conf
-rm -f delv.out.test*
-rm -f dig.out.*test*
-rm -f dig.out.mm.*
-rm -f dig.out.mn.*
-rm -f dig.out.nm.*
-rm -f dig.out.nn.*
-rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*
+set -e
+
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./*/named.conf
+rm -f ./delv.out.test*
+rm -f ./dig.out.*test*
+rm -f ./dig.out.mm.*
+rm -f ./dig.out.mn.*
+rm -f ./dig.out.nm.*
+rm -f ./dig.out.nn.*
+rm -f ./ns*/named.lock
+rm -f ./ns*/managed-keys.bind*
+rm -f ./ns2/example.db ./ns2/K* ./ns2/keyid ./ns2/keydata

bin/tests/system/digdelv/ns2/example.db.in

@@ -35,16 +35,6 @@ foo			TXT	"testing"
 foo			A	10.0.1.0
 foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890
 
-;;
-;; we are not testing DNSSEC behavior, so we don't care about the semantics
-;; of the following records.
-dnskey                  300     DNSKEY  256 3 1 (
-                                        AQPTpWyReB/e9Ii6mVGnakS8hX2zkh/iUYAg
-                                        +Ge4noWROpTWOIBvm76zeJPWs4Zfqa1IsswD
-                                        Ix5Mqeg0zwclz59uecKsKyx5w9IhtZ8plc4R
-                                        b9VIE5x7KNHAYTvTO5d4S8M=
-                                        )
-
 ; TTL of 3 weeks
 weeks		1814400	A	10.53.0.2
 ; TTL of 3 days

bin/tests/system/digdelv/ns2/sign.sh

@@ -0,0 +1,24 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
+
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "dnskey.example.")
+
+cp example.db.in example.db
+
+cat "$keyname.key" >> example.db
+
+echo "$keyname" | sed -e 's/.*[+]//' -e 's/^0*//' > keyid
+< "$keyname.key" grep -Ev '^;' | cut -f 7- -d ' ' > keydata

bin/tests/system/digdelv/prereq.sh

@@ -9,8 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 if $PERL -e 'use Net::DNS;' 2>/dev/null
 then

bin/tests/system/digdelv/setup.sh

@@ -9,10 +9,14 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
+
+cd ns2 && $SHELL sign.sh

bin/tests/system/dlzexternal/tests.sh

@@ -93,7 +93,7 @@ addr=`eval echo "$out" | cut -f1 -d'#'`
 status=`expr $status + $ret`
 
 newtest "testing DLZ driver is cleaned up on reload"
-$RNDCCMD 10.53.0.1 reload 2>&1 | sed 's/^/ns1 /' | cat_i
+rndc_reload ns1 10.53.0.1
 for i in 0 1 2 3 4 5 6 7 8 9; do
     ret=0
     grep 'dlz_example: shutting down zone example.nil' ns1/named.run > /dev/null 2>&1 || ret=1

bin/tests/system/dnssec/clean.sh

@@ -9,92 +9,96 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed
-rm -f */example.bk
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.conf
-rm -f */named.secroots
-rm -f */tmp* */*.jnl */*.bk */*.jbk
-rm -f */trusted.conf */managed.conf */revoked.conf
-rm -f Kexample.*
-rm -f canonical?.*
-rm -f delv.out*
-rm -f delve.out*
-rm -f dig.out.*
-rm -f dsfromkey.out.*
-rm -f keygen.err
-rm -f named.secroots.test*
-rm -f nosign.before
-rm -f ns*/*.nta
-rm -f ns*/named.lock
-rm -f ns1/managed.key.id
-rm -f ns1/root.db ns2/example.db ns3/secure.example.db
-rm -f ns2/algroll.db
-rm -f ns2/badparam.db ns2/badparam.db.bad
-rm -f ns2/cdnskey-kskonly.secure.db
-rm -f ns2/cdnskey-update.secure.db
-rm -f ns2/cdnskey-x.secure.db
-rm -f ns2/cdnskey.secure.db
-rm -f ns2/cds-auto.secure.db ns2/cds-auto.secure.db.jnl
-rm -f ns2/cds-kskonly.secure.db
-rm -f ns2/cds-update.secure.db ns2/cds-update.secure.db.jnl
-rm -f ns2/cds.secure.db ns2/cds-x.secure.db
-rm -f ns2/dlv.db
-rm -f ns2/in-addr.arpa.db
-rm -f ns2/nsec3chain-test.db
-rm -f ns2/private.secure.example.db
-rm -f ns2/single-nsec3.db
-rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
-rm -f ns3/badds.example.db
-rm -f ns3/dnskey-nsec3-unknown.example.db
-rm -f ns3/dnskey-nsec3-unknown.example.db.tmp
-rm -f ns3/dnskey-unknown.example.db
-rm -f ns3/dnskey-unknown.example.db.tmp
-rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
-rm -f ns3/expired.example.db ns3/update-nsec3.example.db
-rm -f ns3/expiring.example.db ns3/nosign.example.db
-rm -f ns3/future.example.db ns3/trusted-future.key
-rm -f ns3/inline.example.db.signed
-rm -f ns3/kskonly.example.db
-rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
-rm -f ns3/managed-future.example.db
-rm -f ns3/multiple.example.db ns3/nsec3-unknown.example.db ns3/nsec3.example.db
-rm -f ns3/nsec3.nsec3.example.db
-rm -f ns3/nsec3.optout.example.db
-rm -f ns3/optout-unknown.example.db ns3/optout.example.db
-rm -f ns3/optout.nsec3.example.db
-rm -f ns3/optout.optout.example.db
-rm -f ns3/publish-inactive.example.db
-rm -f ns3/revkey.example.db
-rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
-rm -f ns3/secure.below-cname.example.db
-rm -f ns3/secure.nsec3.example.db
-rm -f ns3/secure.optout.example.db
-rm -f ns3/siginterval.conf
-rm -f ns3/siginterval.example.db
-rm -f ns3/split-dnssec.example.db
-rm -f ns3/split-smart.example.db
-rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed
-rm -f ns3/ttlpatch.example.db.patched
-rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
-rm -f ns4/managed-keys.bind*
-rm -f ns4/named_dump.db
-rm -f ns6/optout-tld.db
-rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
-rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit
-rm -f nsupdate.out*
-rm -f rndc.out.*
-rm -f signer/*.db
-rm -f signer/*.signed.post*
-rm -f signer/*.signed.pre*
-rm -f signer/example.db.after signer/example.db.before
-rm -f signer/example.db.changed
-rm -f signer/nsec3param.out
-rm -f signer/signer.out.*
-rm -f signer/general/signed.zone
-rm -f signer/general/signer.out.*
-rm -f signer/general/dsset*
-rm -f signing.out*
-rm -f python.out.*
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*
+set -e
+
+rm -f ./*/K* ./*/keyset-* ./*/dsset-* ./*/dlvset-* ./*/signedkey-* ./*/*.signed
+rm -f ./*/example.bk
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./*/named.secroots
+rm -f ./*/tmp* ./*/*.jnl ./*/*.bk ./*/*.jbk
+rm -f ./*/trusted.conf ./*/managed.conf ./*/revoked.conf
+rm -f ./Kexample.*
+rm -f ./canonical?.*
+rm -f ./delv.out*
+rm -f ./delve.out*
+rm -f ./dig.out.*
+rm -f ./dsfromkey.out.*
+rm -f ./keygen.err
+rm -f ./named.secroots.test*
+rm -f ./nosign.before
+rm -f ./ns*/*.nta
+rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
+rm -f ./ns*/named.lock
+rm -f ./ns1/managed.key.id
+rm -f ./ns1/root.db ./ns2/example.db ./ns3/secure.example.db
+rm -f ./ns2/algroll.db
+rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
+rm -f ./ns2/cdnskey-kskonly.secure.db
+rm -f ./ns2/cdnskey-update.secure.db
+rm -f ./ns2/cdnskey-x.secure.db
+rm -f ./ns2/cdnskey.secure.db
+rm -f ./ns2/cds-auto.secure.db ./ns2/cds-auto.secure.db.jnl
+rm -f ./ns2/cds-kskonly.secure.db
+rm -f ./ns2/cds-update.secure.db ./ns2/cds-update.secure.db.jnl
+rm -f ./ns2/cds.secure.db ./ns2/cds-x.secure.db
+rm -f ./ns2/dlv.db
+rm -f ./ns2/in-addr.arpa.db
+rm -f ./ns2/nsec3chain-test.db
+rm -f ./ns2/private.secure.example.db
+rm -f ./ns2/single-nsec3.db
+rm -f ./ns3/auto-nsec.example.db ./ns3/auto-nsec3.example.db
+rm -f ./ns3/badds.example.db
+rm -f ./ns3/dname-at-apex-nsec3.example.db
+rm -f ./ns3/dnskey-nsec3-unknown.example.db
+rm -f ./ns3/dnskey-nsec3-unknown.example.db.tmp
+rm -f ./ns3/dnskey-unknown.example.db
+rm -f ./ns3/dnskey-unknown.example.db.tmp
+rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
+rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
+rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
+rm -f ./ns3/future.example.db ./ns3/trusted-future.key
+rm -f ./ns3/inline.example.db.signed
+rm -f ./ns3/kskonly.example.db
+rm -f ./ns3/lower.example.db ./ns3/upper.example.db ./ns3/upper.example.db.lower
+rm -f ./ns3/managed-future.example.db
+rm -f ./ns3/multiple.example.db ./ns3/nsec3-unknown.example.db ./ns3/nsec3.example.db
+rm -f ./ns3/nsec3.nsec3.example.db
+rm -f ./ns3/nsec3.optout.example.db
+rm -f ./ns3/occluded.example.db
+rm -f ./ns3/optout-unknown.example.db ./ns3/optout.example.db
+rm -f ./ns3/optout.nsec3.example.db
+rm -f ./ns3/optout.optout.example.db
+rm -f ./ns3/publish-inactive.example.db
+rm -f ./ns3/revkey.example.db
+rm -f ./ns3/rsasha256.example.db ./ns3/rsasha512.example.db
+rm -f ./ns3/secure.below-cname.example.db
+rm -f ./ns3/secure.nsec3.example.db
+rm -f ./ns3/secure.optout.example.db
+rm -f ./ns3/siginterval.conf
+rm -f ./ns3/siginterval.example.db
+rm -f ./ns3/split-dnssec.example.db
+rm -f ./ns3/split-smart.example.db
+rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
+rm -f ./ns3/ttlpatch.example.db.patched
+rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
+rm -f ./ns4/managed-keys.bind*
+rm -f ./ns4/named_dump.db
+rm -f ./ns6/optout-tld.db
+rm -f ./ns7/multiple.example.bk ./ns7/nsec3.example.bk ./ns7/optout.example.bk
+rm -f ./ns7/split-rrsig.db ./ns7/split-rrsig.db.unsplit
+rm -f ./nsupdate.out*
+rm -f ./python.out.*
+rm -f ./rndc.out.*
+rm -f ./signer/*.db
+rm -f ./signer/*.signed.post*
+rm -f ./signer/*.signed.pre*
+rm -f ./signer/example.db.after ./signer/example.db.before
+rm -f ./signer/example.db.changed
+rm -f ./signer/general/dsset*
+rm -f ./signer/general/signed.zone
+rm -f ./signer/general/signer.out.*
+rm -f ./signer/nsec3param.out
+rm -f ./signer/signer.out.*
+rm -f ./signing.out*

bin/tests/system/dnssec/ns1/sign.sh

@@ -9,8 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 zone=.
 infile=root.db.in
@@ -20,21 +22,21 @@ zonefile=root.db
 (cd ../ns6 && $SHELL sign.sh )
 (cd ../ns7 && $SHELL sign.sh )
 
-cp ../ns2/dsset-example$TP .
-cp ../ns2/dsset-dlv$TP .
-cp ../ns2/dsset-in-addr.arpa$TP .
+cp "../ns2/dsset-example$TP" .
+cp "../ns2/dsset-dlv$TP" .
+cp "../ns2/dsset-in-addr.arpa$TP" .
 
-grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
-cp ../ns6/dsset-optout-tld$TP .
+grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll$TP" > "dsset-algroll$TP"
+cp "../ns6/dsset-optout-tld$TP" .
 
-keyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key > $zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 # Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $keyname > trusted.conf
+keyfile_to_trusted_keys "$keyname" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
@@ -42,12 +44,11 @@ cp trusted.conf ../ns6/trusted.conf
 cp trusted.conf ../ns7/trusted.conf
 
 # ...or with a managed key.
-keyfile_to_managed_keys $keyname > managed.conf
+keyfile_to_managed_keys "$keyname" > managed.conf
 cp managed.conf ../ns4/managed.conf
 
 #
 #  Save keyid for managed key id test.
 #
-keyid=`expr $keyname : 'K.+001+\(.*\)'`
-keyid=`expr $keyid + 0`
-echo "$keyid" > managed.key.id
+
+echo "$keyname" | sed -e 's/.*[+]//' -e 's/^0*//' > managed.key.id

bin/tests/system/dnssec/ns2/example.db.in

@@ -158,3 +158,5 @@ ns.managed-future	A	10.53.0.3
 
 revkey			NS	ns.revkey
 ns.revkey		A	10.53.0.3
+
+dname-at-apex-nsec3	NS	ns3

bin/tests/system/dnssec/ns2/sign.sh

@@ -9,8 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 zone=example.
 infile=example.db.in
@@ -24,23 +26,26 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
 	nsec3-unknown optout-unknown multiple rsasha256 rsasha512 \
 	kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
 	ttlpatch split-dnssec split-smart expired expiring upper lower \
-	dnskey-unknown dnskey-nsec3-unknown managed-future revkey
+	dnskey-unknown dnskey-nsec3-unknown managed-future revkey \
+	dname-at-apex-nsec3 occluded
 do
-	cp ../ns3/dsset-$subdomain.example$TP .
+	cp "../ns3/dsset-$subdomain.example$TP" .
 done
 
-keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone "$zone")
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-$SIGNER -P -g -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+"$SIGNER" -P -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 #
 # lower/uppercase the signature bits with the exception of the last characters
 # changing the last 4 characters will lead to a bad base64 encoding.
 #
-$CHECKZONE -D -q -i local $zone $zonefile.signed |
+
+zonefiletmp=$(mktemp "$zonefile.XXXXXX") || exit 1
+"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" |
 awk '
 tolower($1) == "bad-cname.example." && $4 == "RRSIG" && $5 == "CNAME" {
 	for (i = 1; i <= NF; i++ ) {
@@ -80,7 +85,7 @@ tolower($1) == "bad-dname.example." && $4 == "RRSIG" && $5 == "DNAME" {
 	next;
 }
 
-{ print; }' > $zonefile.signed++ && mv $zonefile.signed++ $zonefile.signed
+{ print; }' > "$zonefiletmp" && mv "$zonefiletmp" "$zonefile.signed"
 
 #
 # signed in-addr.arpa w/ a delegation for 10.in-addr.arpa which is unsigned.
@@ -89,11 +94,11 @@ zone=in-addr.arpa.
 infile=in-addr.arpa.db.in
 zonefile=in-addr.arpa.db
 
-keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
-$SIGNER -P -g -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
+"$SIGNER" -P -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 # Sign the privately secure file
 
@@ -101,25 +106,24 @@ privzone=private.secure.example.
 privinfile=private.secure.example.db.in
 privzonefile=private.secure.example.db
 
-privkeyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $privzone`
+privkeyname=$("$KEYGEN" -q -a "${DEFAULT_ALGORITHM}" -b "${DEFAULT_BITS}" -n zone "$privzone")
 
-cat $privinfile $privkeyname.key >$privzonefile
+cat "$privinfile" "$privkeyname.key" > "$privzonefile"
 
-$SIGNER -P -g -o $privzone -l dlv $privzonefile > /dev/null
+"$SIGNER" -P -g -o "$privzone" -l dlv "$privzonefile" > /dev/null 2>&1
 
 # Sign the DLV secure zone.
 
-
 dlvzone=dlv.
 dlvinfile=dlv.db.in
 dlvzonefile=dlv.db
-dlvsetfile=dlvset-`echo $privzone |sed -e "s/\.$//g"`$TP
+dlvsetfile="dlvset-$(echo "$privzone" |sed -e "s/\\.$//g")$TP"
 
-dlvkeyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $dlvzone`
+dlvkeyname=$("$KEYGEN" -q -a "${DEFAULT_ALGORITHM}" -b "${DEFAULT_BITS}" -n zone "$dlvzone")
 
-cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
+cat "$dlvinfile" "$dlvkeyname.key" "$dlvsetfile" > "$dlvzonefile"
 
-$SIGNER -P -g -o $dlvzone $dlvzonefile > /dev/null
+"$SIGNER" -P -g -o "$dlvzone" "$dlvzonefile" > /dev/null 2>&1
 
 # Sign the badparam secure file
 
@@ -127,14 +131,14 @@ zone=badparam.
 infile=badparam.db.in
 zonefile=badparam.db
 
-keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-$SIGNER -P -3 - -H 1 -g -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+"$SIGNER" -P -3 - -H 1 -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
-sed 's/IN NSEC3 1 0 1 /IN NSEC3 1 0 10 /' $zonefile.signed > $zonefile.bad
+sed -e 's/IN NSEC3 1 0 1 /IN NSEC3 1 0 10 /' "$zonefile.signed" > "$zonefile.bad"
 
 # Sign the single-nsec3 secure zone with optout
 
@@ -142,12 +146,12 @@ zone=single-nsec3.
 infile=single-nsec3.db.in
 zonefile=single-nsec3.db
 
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-$SIGNER -P -3 - -A -H 1 -g -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+"$SIGNER" -P -3 - -A -H 1 -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 #
 # algroll has just has the old DNSKEY records removed and is waiting
@@ -158,14 +162,14 @@ zone=algroll.
 infile=algroll.db.in
 zonefile=algroll.db
 
-keyold1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-keyold2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keynew1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -fk $zone`
-keynew2=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+keyold1=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone -f KSK "$zone")
+keyold2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zone "$zone")
+keynew1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+keynew2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keynew1.key $keynew2.key >$zonefile
+cat "$infile" "$keynew1.key" "$keynew2.key" > "$zonefile"
 
-$SIGNER -P -o $zone -k $keyold1 -k $keynew1 $zonefile $keyold1 $keyold2 $keynew1 $keynew2 > /dev/null
+"$SIGNER" -P -o "$zone" -k "$keyold1" -k "$keynew1" "$zonefile" "$keyold1" "$keyold2" "$keynew1" "$keynew2" > /dev/null 2>&1
 
 #
 # Make a zone big enough that it takes several seconds to generate a new
@@ -173,103 +177,104 @@ $SIGNER -P -o $zone -k $keyold1 -k $keynew1 $zonefile $keyold1 $keyold2 $keynew1
 #
 zone=nsec3chain-test
 zonefile=nsec3chain-test.db
-cat > $zonefile << 'EOF'
-$TTL 10
+cat > "$zonefile" << EOF
+\$TTL 10
 @	10	SOA	ns2 hostmaster 0 3600 1200 864000 1200
 @	10	NS	ns2
 @	10	NS	ns3
 ns2	10	A	10.53.0.2
 ns3	10	A	10.53.0.3
 EOF
-awk 'END { for (i = 0; i < 300; i++)
-	print "host" i, 10, "NS", "ns.elsewhere"; }' < /dev/null >> $zonefile
-key1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-cat $key1.key $key2.key >> $zonefile
-$SIGNER -P -3 - -A -H 1 -g -o $zone -k $key1 $zonefile $key2 > /dev/null
+for i in $(seq 300); do
+    echo "host$i 10 IN NS ns.elsewhere"
+done >> "$zonefile"
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$key1.key" "$key2.key" >> "$zonefile"
+"$SIGNER" -P -3 - -A -H 1 -g -o "$zone" -k "$key1" "$zonefile" "$key2" > /dev/null 2>&1
 
 zone=cds.secure
 infile=cds.secure.db.in
 zonefile=cds.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-$DSFROMKEY -C $key1.key > $key1.cds
-cat $infile $key1.key $key2.key $key1.cds >$zonefile
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+"$DSFROMKEY" -C "$key1.key" > "$key1.cds"
+cat "$infile" "$key1.key" "$key2.key" "$key1.cds" >$zonefile
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-x.secure
 infile=cds.secure.db.in
 zonefile=cds-x.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key3=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-$DSFROMKEY -C $key2.key > $key2.cds
-cat $infile $key1.key $key3.key $key2.cds >$zonefile
-$SIGNER -P -g -x -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+"$DSFROMKEY" -C "$key2.key" > "$key2.cds"
+cat "$infile" "$key1.key" "$key3.key" "$key2.cds" > "$zonefile"
+"$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-update.secure
 infile=cds-update.secure.db.in
 zonefile=cds-update.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $key1.key $key2.key > $zonefile
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-kskonly.secure
 infile=cds-kskonly.secure.db.in
 zonefile=cds-kskonly.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $key1.key $key2.key > $zonefile
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-auto.secure
 infile=cds-auto.secure.db.in
 zonefile=cds-auto.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-$DSFROMKEY -C $key1.key > $key1.cds
-cat $infile $key1.cds > $zonefile.signed
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+"$DSFROMKEY" -C "$key1.key" > "$key1.cds"
+cat "$infile" "$key1.cds" > "$zonefile.signed"
 
 zone=cdnskey.secure
 infile=cdnskey.secure.db.in
 zonefile=cdnskey.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-sed 's/DNSKEY/CDNSKEY/' $key1.key > $key1.cds
-cat $infile $key1.key $key2.key $key1.cds >$zonefile
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
+cat "$infile" "$key1.key" "$key2.key" "$key1.cds" > "$zonefile"
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-x.secure
 infile=cdnskey.secure.db.in
 zonefile=cdnskey-x.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key3=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-sed 's/DNSKEY/CDNSKEY/' $key1.key > $key1.cds
-cat $infile $key2.key $key3.key $key1.cds >$zonefile
-$SIGNER -P -g -x -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
+cat "$infile" "$key2.key" "$key3.key" "$key1.cds" > "$zonefile"
+"$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-update.secure
 infile=cdnskey-update.secure.db.in
 zonefile=cdnskey-update.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $key1.key $key2.key > $zonefile
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-kskonly.secure
 infile=cdnskey-kskonly.secure.db.in
 zonefile=cdnskey-kskonly.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $key1.key $key2.key > $zonefile
-$SIGNER -P -g -o $zone $zonefile > /dev/null
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
+"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-auto.secure
 infile=cdnskey-auto.secure.db.in
 zonefile=cdnskey-auto.secure.db
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -fk $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-sed 's/DNSKEY/CDNSKEY/' $key1.key > $key1.cds
-cat $infile $key1.cds > $zonefile.signed
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
+cat "$infile" "$key1.cds" > "$zonefile.signed"

bin/tests/system/dnssec/ns3/dname-at-apex-nsec3.example.db.in

@@ -0,0 +1,4 @@
+$TTL	600
+@	SOA	ns3.example. . 1 1200 1200 1814400 3600
+@	NS	ns3.example.
+@	DNAME	example.

bin/tests/system/dnssec/ns3/named.conf.in

@@ -294,6 +294,16 @@ zone "revkey.example" {
 	file "revkey.example.db.signed";
 };
 
+zone "dname-at-apex-nsec3.example" {
+	type master;
+	file "dname-at-apex-nsec3.example.db.signed";
+};
+
+zone "occluded.example" {
+	type master;
+	file "occluded.example.db.signed";
+};
+
 include "siginterval.conf";
 
 include "trusted.conf";

bin/tests/system/dnssec/ns3/occluded.example.db.in

@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a.b			A	10.0.0.1
+delegation		NS	ns
+			A	10.53.0.3
+			AAAA	2002::

bin/tests/system/dnssec/ns3/sign.sh

@@ -9,58 +9,61 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 zone=secure.example.
 infile=secure.example.db.in
 zonefile=secure.example.db
 
-cnameandkey=`$KEYGEN -T KEY -q -a RSASHA1 -b 1024 -n host cnameandkey.$zone`
-dnameandkey=`$KEYGEN -T KEY -q -a RSASHA1 -b 1024 -n host dnameandkey.$zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "cnameandkey.$zone")
+dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "dnameandkey.$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $cnameandkey.key $dnameandkey.key $keyname.key >$zonefile
+cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=bogus.example.
 infile=bogus.example.db.in
 zonefile=bogus.example.db
 
-keyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=dynamic.example.
 infile=dynamic.example.db.in
 zonefile=dynamic.example.db
 
-keyname1=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone -f KSK $zone`
+keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=keyless.example.
 infile=generic.example.db.in
 zonefile=keyless.example.db
 
-keyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 # Change the signer field of the a.b.keyless.example SIG A
 # to point to a provably nonexistent KEY record.
-mv $zonefile.signed $zonefile.tmp
-<$zonefile.tmp $PERL -p -e 's/ keyless.example/ b.keyless.example/
-    if /^a.b.keyless.example/../NXT/;' >$zonefile.signed
-rm -f $zonefile.tmp
+zonefiletmp=$(mktemp "$zonefile.XXXXXX") || exit 1
+mv "$zonefile.signed" "$zonefiletmp"
+<"$zonefiletmp" "$PERL" -p -e 's/ keyless.example/ b.keyless.example/
+    if /^a.b.keyless.example/../NXT/;' > "$zonefile.signed"
+rm -f "$zonefiletmp"
 
 #
 #  NSEC3/NSEC test zone
@@ -69,11 +72,11 @@ zone=secure.nsec3.example.
 infile=secure.nsec3.example.db.in
 zonefile=secure.nsec3.example.db
 
-keyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 #  NSEC3/NSEC3 test zone
@@ -82,11 +85,11 @@ zone=nsec3.nsec3.example.
 infile=nsec3.nsec3.example.db.in
 zonefile=nsec3.nsec3.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 #  OPTOUT/NSEC3 test zone
@@ -95,11 +98,11 @@ zone=optout.nsec3.example.
 infile=optout.nsec3.example.db.in
 zonefile=optout.nsec3.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -A -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -A -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A nsec3 zone (non-optout).
@@ -108,11 +111,11 @@ zone=nsec3.example.
 infile=nsec3.example.db.in
 zonefile=nsec3.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -g -3 - -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -g -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 #  OPTOUT/NSEC test zone
@@ -121,11 +124,11 @@ zone=secure.optout.example.
 infile=secure.optout.example.db.in
 zonefile=secure.optout.example.db
 
-keyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 #  OPTOUT/NSEC3 test zone
@@ -134,11 +137,11 @@ zone=nsec3.optout.example.
 infile=nsec3.optout.example.db.in
 zonefile=nsec3.optout.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 #  OPTOUT/OPTOUT test zone
@@ -147,11 +150,11 @@ zone=optout.optout.example.
 infile=optout.optout.example.db.in
 zonefile=optout.optout.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -A -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -A -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A optout nsec3 zone.
@@ -160,11 +163,11 @@ zone=optout.example.
 infile=optout.example.db.in
 zonefile=optout.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -g -3 - -A -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -g -3 - -A -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A nsec3 zone (non-optout) with unknown nsec3 hash algorithm (-U).
@@ -173,11 +176,11 @@ zone=nsec3-unknown.example.
 infile=nsec3-unknown.example.db.in
 zonefile=nsec3-unknown.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -U -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -U -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A optout nsec3 zone with a unknown nsec3 hash algorithm (-U).
@@ -186,11 +189,11 @@ zone=optout-unknown.example.
 infile=optout-unknown.example.db.in
 zonefile=optout-unknown.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -U -A -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -U -A -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A zone with a unknown DNSKEY algorithm.
@@ -200,16 +203,16 @@ zone=dnskey-unknown.example.
 infile=dnskey-unknown.example.db.in
 zonefile=dnskey-unknown.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -o $zone -O full -f ${zonefile}.tmp $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null 2>&1
 
 awk '$4 == "DNSKEY" { $7 = 100; print } $4 == "RRSIG" { $6 = 100; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE=dsset-`echo ${zone} |sed -e "s/\.$//g"`$TP
-$DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
+DSFILE="dsset-$(echo ${zone} |sed -e "s/\\.$//g")$TP"
+$DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
 # A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
@@ -219,16 +222,16 @@ zone=dnskey-nsec3-unknown.example.
 infile=dnskey-nsec3-unknown.example.db.in
 zonefile=dnskey-nsec3-unknown.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -o $zone -U -O full -f ${zonefile}.tmp $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -o "$zone" -U -O full -f ${zonefile}.tmp "$zonefile" > /dev/null 2>&1
 
 awk '$4 == "DNSKEY" { $7 = 100; print } $4 == "RRSIG" { $6 = 100; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE=dsset-`echo ${zone} |sed -e "s/\.$//g"`$TP
-$DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
+DSFILE="dsset-$(echo ${zone} |sed -e "s/\\.$//g")$TP"
+$DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
 # A multiple parameter nsec3 zone.
@@ -237,21 +240,21 @@ zone=multiple.example.
 infile=multiple.example.db.in
 zonefile=multiple.example.db
 
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
-mv $zonefile.signed $zonefile
-$SIGNER -P -u3 - -o $zone $zonefile > /dev/null 2>&1
-mv $zonefile.signed $zonefile
-$SIGNER -P -u3 AAAA -o $zone $zonefile > /dev/null 2>&1
-mv $zonefile.signed $zonefile
-$SIGNER -P -u3 BBBB -o $zone $zonefile > /dev/null 2>&1
-mv $zonefile.signed $zonefile
-$SIGNER -P -u3 CCCC -o $zone $zonefile > /dev/null 2>&1
-mv $zonefile.signed $zonefile
-$SIGNER -P -u3 DDDD -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
+mv "$zonefile".signed "$zonefile"
+"$SIGNER" -P -u3 - -o "$zone" "$zonefile" > /dev/null 2>&1
+mv "$zonefile".signed "$zonefile"
+"$SIGNER" -P -u3 AAAA -o "$zone" "$zonefile" > /dev/null 2>&1
+mv "$zonefile".signed "$zonefile"
+"$SIGNER" -P -u3 BBBB -o "$zone" "$zonefile" > /dev/null 2>&1
+mv "$zonefile".signed "$zonefile"
+"$SIGNER" -P -u3 CCCC -o "$zone" "$zonefile" > /dev/null 2>&1
+mv "$zonefile".signed "$zonefile"
+"$SIGNER" -P -u3 DDDD -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A RSASHA256 zone.
@@ -260,11 +263,11 @@ zone=rsasha256.example.
 infile=rsasha256.example.db.in
 zonefile=rsasha256.example.db
 
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a RSASHA256 -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A RSASHA512 zone.
@@ -273,11 +276,11 @@ zone=rsasha512.example.
 infile=rsasha512.example.db.in
 zonefile=rsasha512.example.db
 
-keyname=`$KEYGEN -q -a RSASHA512 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a RSASHA512 -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A zone with the DNSKEY set only signed by the KSK
@@ -286,10 +289,10 @@ zone=kskonly.example.
 infile=kskonly.example.db.in
 zonefile=kskonly.example.db
 
-kskname=`$KEYGEN -q -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -x -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A zone with the expired signatures
@@ -298,11 +301,11 @@ zone=expired.example.
 infile=expired.example.db.in
 zonefile=expired.example.db
 
-kskname=`$KEYGEN -q -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -o $zone -s -1d -e +1h $zonefile > /dev/null 2>&1
-rm -f $kskname.* $zskname.*
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -P -o "$zone" -s -1d -e +1h "$zonefile" > /dev/null 2>&1
+rm -f "$kskname.*" "$zskname.*"
 
 #
 # A NSEC3 signed zone that will have a DNSKEY added to it via UPDATE.
@@ -311,10 +314,10 @@ zone=update-nsec3.example.
 infile=update-nsec3.example.db.in
 zonefile=update-nsec3.example.db
 
-kskname=`$KEYGEN -q -3 -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -3 -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -3 - -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A NSEC signed zone that will have auto-dnssec enabled and
@@ -324,12 +327,12 @@ zone=auto-nsec.example.
 infile=auto-nsec.example.db.in
 zonefile=auto-nsec.example.db
 
-kskname=`$KEYGEN -q -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-kskname=`$KEYGEN -q -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A NSEC3 signed zone that will have auto-dnssec enabled and
@@ -339,12 +342,12 @@ zone=auto-nsec3.example.
 infile=auto-nsec3.example.db.in
 zonefile=auto-nsec3.example.db
 
-kskname=`$KEYGEN -q -3 -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -3 -a RSASHA1 $zone`
-kskname=`$KEYGEN -q -3 -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -3 -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -3 - -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # Secure below cname test zone.
@@ -352,9 +355,9 @@ $SIGNER -P -3 - -o $zone $zonefile > /dev/null 2>&1
 zone=secure.below-cname.example.
 infile=secure.below-cname.example.db.in
 zonefile=secure.below-cname.example.db
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $keyname.key >$zonefile
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$keyname.key" > "$zonefile"
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # Patched TTL test zone.
@@ -365,11 +368,11 @@ zonefile=ttlpatch.example.db
 signedfile=ttlpatch.example.db.signed
 patchedfile=ttlpatch.example.db.patched
 
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $keyname.key >$zonefile
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -f $signedfile -o $zone $zonefile > /dev/null 2>&1
-$CHECKZONE -D -s full $zone $signedfile 2> /dev/null | \
+"$SIGNER" -P -f $signedfile -o "$zone" "$zonefile" > /dev/null 2>&1
+$CHECKZONE -D -s full "$zone" $signedfile 2> /dev/null | \
     awk '{$2 = "3600"; print}' > $patchedfile
 
 #
@@ -380,11 +383,11 @@ infile=split-dnssec.example.db.in
 zonefile=split-dnssec.example.db
 signedfile=split-dnssec.example.db.signed
 
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cat $infile $keyname.key >$zonefile
-echo '$INCLUDE "'"$signedfile"'"' >> $zonefile
-: > $signedfile
-$SIGNER -P -D -o $zone $zonefile > /dev/null 2>&1
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$keyname.key" > "$zonefile"
+echo "\$INCLUDE \"$signedfile\"" >> "$zonefile"
+: > "$signedfile"
+"$SIGNER" -P -D -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # Seperate DNSSEC records smart signing.
@@ -394,25 +397,26 @@ infile=split-smart.example.db.in
 zonefile=split-smart.example.db
 signedfile=split-smart.example.db.signed
 
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-cp $infile $zonefile
-echo '$INCLUDE "'"$signedfile"'"' >> $zonefile
-: > $signedfile
-$SIGNER -P -S -D -o $zone $zonefile > /dev/null 2>&1
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cp "$infile" "$zonefile"
+# shellcheck disable=SC2016
+echo "\$INCLUDE \"$signedfile\"" >> "$zonefile"
+: > "$signedfile"
+"$SIGNER" -P -S -D -o "$zone" "$zonefile" > /dev/null 2>&1
 
-# 
+#
 # Zone with signatures about to expire, but no private key to replace them
 #
 zone="expiring.example."
 infile="expiring.example.db.in"
 zonefile="expiring.example.db"
 signedfile="expiring.example.db.signed"
-kskname=`$KEYGEN -q -a RSASHA1 $zone`
-zskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-cp $infile $zonefile
-$SIGNER -S -e now+1mi -o $zone $zonefile > /dev/null 2>&1
-mv -f ${zskname}.private ${zskname}.private.moved
-mv -f ${kskname}.private ${kskname}.private.moved
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+cp "$infile" "$zonefile"
+"$SIGNER" -S -e now+1mi -o "$zone" "$zonefile" > /dev/null 2>&1
+mv -f "${zskname}.private" "${zskname}.private.moved"
+mv -f "${kskname}.private" "${kskname}.private.moved"
 
 #
 # A zone where the signer's name has been forced to uppercase.
@@ -422,10 +426,10 @@ infile="upper.example.db.in"
 zonefile="upper.example.db"
 lower="upper.example.db.lower"
 signedfile="upper.example.db.signed"
-kskname=`$KEYGEN -q -a RSASHA1 $zone`
-zskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-cp $infile $zonefile
-$SIGNER -P -S -o $zone -f $lower $zonefile > /dev/null 2>/dev/null
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+cp "$infile" "$zonefile"
+"$SIGNER" -P -S -o "$zone" -f $lower "$zonefile" > /dev/null 2>&1
 $CHECKZONE -D upper.example $lower 2>/dev/null | \
 	sed '/RRSIG/s/ upper.example. / UPPER.EXAMPLE. /' > $signedfile
 
@@ -437,10 +441,10 @@ zone="LOWER.EXAMPLE."
 infile="lower.example.db.in"
 zonefile="lower.example.db"
 signedfile="lower.example.db.signed"
-kskname=`$KEYGEN -q -a RSASHA1 $zone`
-zskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-cp $infile $zonefile
-$SIGNER -P -S -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+cp "$infile" "$zonefile"
+"$SIGNER" -P -S -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # Zone with signatures about to expire, and dynamic, but configured
@@ -450,10 +454,10 @@ zone="nosign.example."
 infile="nosign.example.db.in"
 zonefile="nosign.example.db"
 signedfile="nosign.example.db.signed"
-kskname=`$KEYGEN -q -a RSASHA1 $zone`
-zskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-cp $infile $zonefile
-$SIGNER -S -e now+1mi -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+cp "$infile" "$zonefile"
+"$SIGNER" -S -e "now+1mi" -o "$zone" "$zonefile" > /dev/null 2>&1
 # preserve a normalized copy of the NS RRSIG for comparison later
 $CHECKZONE -D nosign.example nosign.example.db.signed 2>/dev/null | \
         awk '$4 == "RRSIG" && $5 == "NS" {$2 = ""; print}' | \
@@ -463,8 +467,8 @@ $CHECKZONE -D nosign.example nosign.example.db.signed 2>/dev/null | \
 # An inline signing zone
 #
 zone=inline.example.
-kskname=`$KEYGEN -q -3 -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -3 -a RSASHA1 $zone`
+kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
 
 #
 # publish a new key while deactivating another key at the same time.
@@ -472,13 +476,13 @@ zskname=`$KEYGEN -q -3 -a RSASHA1 $zone`
 zone=publish-inactive.example
 infile=publish-inactive.example.db.in
 zonefile=publish-inactive.example.db
-now=`date -u +%Y%m%d%H%M%S`
-kskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-kskname=`$KEYGEN -P $now+90s -A $now+3600s -q -a RSASHA1 -f KSK $zone`
-kskname=`$KEYGEN -I $now+90s -q -a RSASHA1 -f KSK $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-cp $infile $zonefile
-$SIGNER -S -o $zone $zonefile > /dev/null 2>&1
+now=$(date -u +%Y%m%d%H%M%S)
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+kskname=$("$KEYGEN" -P "$now+90s" -A "$now+3600s" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+kskname=$("$KEYGEN" -I "$now+90s" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cp "$infile" "$zonefile"
+"$SIGNER" -S -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A zone which will change its sig-validity-interval
@@ -486,9 +490,9 @@ $SIGNER -S -o $zone $zonefile > /dev/null 2>&1
 zone=siginterval.example
 infile=siginterval.example.db.in
 zonefile=siginterval.example.db
-kskname=`$KEYGEN -q -3 -a RSASHA1 -fk $zone`
-zskname=`$KEYGEN -q -3 -a RSASHA1 $zone`
-cp $infile $zonefile
+kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
+zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cp "$infile" "$zonefile"
 
 #
 # A zone with a bad DS in the parent
@@ -498,11 +502,11 @@ zone=badds.example.
 infile=bogus.example.db.in
 zonefile=badds.example.db
 
-keyname=`$KEYGEN -q -a RSAMD5 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 sed -e 's/bogus/badds/g' < dsset-bogus.example$TP > dsset-badds.example$TP
 
 #
@@ -511,11 +515,11 @@ sed -e 's/bogus/badds/g' < dsset-bogus.example$TP > dsset-badds.example$TP
 zone=future.example
 infile=future.example.db.in
 zonefile=future.example.db
-kskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -s +3600 -o $zone $zonefile > /dev/null 2>&1
-cp -f $kskname.key trusted-future.key
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -P -s +3600 -o "$zone" "$zonefile" > /dev/null 2>&1
+cp -f "$kskname.key" trusted-future.key
 
 #
 # A zone with future signatures.
@@ -523,10 +527,10 @@ cp -f $kskname.key trusted-future.key
 zone=managed-future.example
 infile=managed-future.example.db.in
 zonefile=managed-future.example.db
-kskname=`$KEYGEN -q -a RSASHA1 -f KSK $zone`
-zskname=`$KEYGEN -q -a RSASHA1 $zone`
-cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -s +3600 -o $zone $zonefile > /dev/null 2>&1
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
+"$SIGNER" -P -s +3600 -o "$zone" "$zonefile" > /dev/null 2>&1
 
 #
 # A zone with a revoked key
@@ -535,11 +539,37 @@ zone=revkey.example.
 infile=generic.example.db.in
 zonefile=revkey.example.db
 
-ksk1=`$KEYGEN -q -a RSASHA1 -3fk $zone`
-ksk1=`$REVOKE $ksk1`
-ksk2=`$KEYGEN -q -a RSASHA1 -3fk $zone`
-zsk1=`$KEYGEN -q -a RSASHA1 -3 $zone`
+ksk1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -3fk "$zone")
+ksk1=$("$REVOKE" "$ksk1")
+ksk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -3fk "$zone")
+zsk1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -3 "$zone")
 
-cat $infile ${ksk1}.key ${ksk2}.key ${zsk1}.key >$zonefile
+cat "$infile" "${ksk1}.key" "${ksk2}.key" "${zsk1}.key" > "$zonefile"
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1
 
-$SIGNER -P -o $zone $zonefile > /dev/null 2>&1
+#
+# Check that NSEC3 are correctly signed and returned from below a DNAME
+#
+zone=dname-at-apex-nsec3.example
+infile=dname-at-apex-nsec3.example.db.in
+zonefile=dname-at-apex-nsec3.example.db
+
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -3fk "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -3 "$zone")
+cat "$infile" "${kskname}.key" "${zskname}.key" >"$zonefile"
+"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
+
+#
+# A NSEC zone with occuded data at the delegation
+#
+zone=occluded.example
+infile=occluded.example.db.in
+zonefile=occluded.example.db
+kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "$zone")
+zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" "$zone")
+keyname=$("$KEYGEN" -q -a RSASHA1 -n ENTITY -T KEY "delegation.$zone")
+dnskeyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "delegation.$zone")
+$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
+cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
+    "${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
+"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1

bin/tests/system/dnssec/ns5/sign.sh

@@ -9,21 +9,27 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 zone=.
 infile=../ns1/root.db.in
 zonefile=root.db.signed
 
-keyname=`$KEYGEN -a RSASHA1 -qfk $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
 
 # copy the KSK out first, then revoke it
-keyfile_to_managed_keys $keyname > revoked.conf
+keyfile_to_managed_keys "$keyname" > revoked.conf
 
-$SETTIME -R now ${keyname}.key > /dev/null
+"$SETTIME" -R now "${keyname}.key" > /dev/null
 
 # create a current set of keys, and sign the root zone
-$KEYGEN -a RSASHA1 -q $zone > /dev/null
-$KEYGEN -a RSASHA1 -qfk $zone > /dev/null
-$SIGNER -S -o $zone -f $zonefile $infile > /dev/null 2>&1
+"$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" $zone > /dev/null
+"$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK $zone > /dev/null
+"$SIGNER" -S -o "$zone" -f "$zonefile" "$infile" > /dev/null 2>&1
+
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")
+
+keyfile_to_trusted_keys "$keyname" > trusted.conf

bin/tests/system/dnssec/ns5/trusted.conf.bad

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trusted-keys {
-    "." 256 3 1 "AQO6Cl+slAf+iuieDim9L3kujFHQD7s/IOj03ClMOpKYcTXtK4mRpuULVfvWxDi9Ew/gj0xLnnX7z9OJHIxLI+DSrAHd8Dm0XfBEAtVtJSn70GaPZgnLMw1rk5ap2DsEoWk=";
-};

bin/tests/system/dnssec/ns6/named.conf.in

@@ -21,7 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	disable-algorithms . { @DEFAULT_ALGORITHM@; };
+	disable-algorithms . { @ALTERNATIVE_ALGORITHM@; };
 	dnssec-enable yes;
 	dnssec-validation yes;
 	dnssec-lookaside . trust-anchor dlv;

bin/tests/system/dnssec/ns6/sign.sh

@@ -9,15 +9,17 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 zone=optout-tld
 infile=optout-tld.db.in
 zonefile=optout-tld.db
 
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $keyname.key >$zonefile
+cat "$infile" "$keyname.key" > "$zonefile"
 
-$SIGNER -P -3 - -A -o $zone $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -A -o "$zone" "$zonefile" > /dev/null 2>&1

bin/tests/system/dnssec/ns7/sign.sh

@@ -9,20 +9,22 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+set -e
 
 zone=split-rrsig
 infile=split-rrsig.db.in
 zonefile=split-rrsig.db
 
-k1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-k2=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
+k1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+k2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat $infile $k1.key $k2.key >$zonefile
+cat "$infile" "$k1.key" "$k2.key" > "$zonefile"
 
-$SIGNER -P -3 - -A -o $zone -O full -f $zonefile.unsplit -e now-3600 -s now-7200 $zonefile > /dev/null 2>&1
+"$SIGNER" -P -3 - -A -o "$zone" -O full -f "$zonefile.unsplit" -e now-3600 -s now-7200 "$zonefile" > /dev/null 2>&1
 awk 'BEGIN { r = ""; }
      $4 == "RRSIG" && $5 == "SOA" && r == "" { r = $0; next; }
      { print }
-     END { print r }' $zonefile.unsplit > $zonefile.signed
+     END { print r }' "$zonefile.unsplit" > "$zonefile.signed"

bin/tests/system/dnssec/prereq.sh

@@ -9,12 +9,15 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
 
-if $PERL -e 'use Net::DNS;' 2>/dev/null
+set -e
+
+if "$PERL" -e 'use Net::DNS;' 2>/dev/null
 then
-    if $PERL -e 'use Net::DNS; die if ($Net::DNS::VERSION >= 0.69 && $Net::DNS::VERSION <= 0.70);' 2>/dev/null
+    # shellcheck disable=SC2016
+    if "$PERL" -e 'use Net::DNS; die if ($Net::DNS::VERSION >= 0.69 && $Net::DNS::VERSION <= 0.70);' 2>/dev/null
     then
         :
     else

bin/tests/system/dnssec/setup.sh

@@ -9,10 +9,12 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
 
-$SHELL clean.sh 
+set -e
+
+$SHELL clean.sh
 
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -24,16 +26,22 @@ copy_setports ns5/named1.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named.conf.in ns7/named.conf
 
-cd ns1
-$SHELL sign.sh
+(
+    cd ns1
+    $SHELL sign.sh
+    {
+	echo "a.bogus.example.	A	10.0.0.22"
+	echo "b.bogus.example.	A	10.0.0.23"
+	echo "c.bogus.example.	A	10.0.0.23"
+    } >>../ns3/bogus.example.db.signed
+)
 
-echo "a.bogus.example.	A	10.0.0.22" >>../ns3/bogus.example.db.signed
-echo "b.bogus.example.	A	10.0.0.23" >>../ns3/bogus.example.db.signed
-echo "c.bogus.example.	A	10.0.0.23" >>../ns3/bogus.example.db.signed
+(
+    cd ns3
+    cp -f siginterval1.conf siginterval.conf
+)
 
-cd ../ns3
-cp -f siginterval1.conf siginterval.conf
-
-cd ../ns5
-cp -f trusted.conf.bad trusted.conf
-$SHELL sign.sh
+(
+    cd ns5
+    $SHELL sign.sh
+)

bin/tests/system/dyndb/driver/driver.c

@@ -91,21 +91,38 @@ dyndb_init(isc_mem_t *mctx, const char *name, const char *parameters,
 	}
 
 	result = isc_commandline_strtoargv(mctx, s, &argc, &argv, 0);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "dyndb_init: isc_commandline_strtoargv -> %s\n",
+			  isc_result_totext(result));
 		goto cleanup;
+	}
 
 	log_write(ISC_LOG_DEBUG(9),
 		  "loading params for dyndb '%s' from %s:%lu",
 		  name, file, line);
 
 	/* Finally, create the instance. */
-	CHECK(new_sample_instance(mctx, name, argc, argv, dctx, &sample_inst));
+	result = new_sample_instance(mctx, name, argc, argv, dctx,
+				     &sample_inst);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "dyndb_init: new_sample_instance -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 	/*
 	 * This is an example so we create and load zones
 	 * right now.  This step can be arbitrarily postponed.
 	 */
-	CHECK(load_sample_instance_zones(sample_inst));
+	result = load_sample_instance_zones(sample_inst);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "dyndb_init: load_sample_instance_zones -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 	*instp = sample_inst;
 

bin/tests/system/dyndb/driver/instance.c

@@ -57,8 +57,20 @@ parse_params(isc_mem_t *mctx, int argc, char **argv,
 		result = ISC_R_FAILURE;
 		goto cleanup;
 	}
-	CHECK(dns_name_fromstring2(z1, argv[0], dns_rootname, 0, mctx));
-	CHECK(dns_name_fromstring2(z2, argv[1], dns_rootname, 0, mctx));
+	result = dns_name_fromstring2(z1, argv[0], dns_rootname, 0, mctx);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "parse_params: dns_name_fromstring2 -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
+	result = dns_name_fromstring2(z2, argv[1], dns_rootname, 0, mctx);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "parse_params: dns_name_fromstring2 -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
 
 	result = ISC_R_SUCCESS;
 
@@ -93,15 +105,27 @@ new_sample_instance(isc_mem_t *mctx, const char *db_name,
 	inst->zone1_name = dns_fixedname_initname(&inst->zone1_fn);
 	inst->zone2_name = dns_fixedname_initname(&inst->zone2_fn);
 
-	CHECK(parse_params(mctx, argc, argv,
-			   inst->zone1_name, inst->zone2_name));
+	result = parse_params(mctx, argc, argv,
+			      inst->zone1_name, inst->zone2_name);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "new_sample_instance: parse_params -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
 
 	dns_view_attach(dctx->view, &inst->view);
 	dns_zonemgr_attach(dctx->zmgr, &inst->zmgr);
 	isc_task_attach(dctx->task, &inst->task);
 
 	/* Register new DNS DB implementation. */
-	CHECK(dns_db_register(db_name, create_db, inst, mctx, &inst->db_imp));
+	result = dns_db_register(db_name, create_db, inst, mctx, &inst->db_imp);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "new_sample_instance: dns_db_register -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
 
 	*sample_instp = inst;
 	result = ISC_R_SUCCESS;
@@ -120,11 +144,35 @@ isc_result_t
 load_sample_instance_zones(sample_instance_t *inst) {
 	isc_result_t result;
 
-	CHECK(create_zone(inst, inst->zone1_name, &inst->zone1));
-	CHECK(activate_zone(inst, inst->zone1));
+	result = create_zone(inst, inst->zone1_name, &inst->zone1);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "load_sample_instance_zones: create_zone -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
+	result = activate_zone(inst, inst->zone1);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "load_sample_instance_zones: activate_zone -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
 
-	CHECK(create_zone(inst, inst->zone2_name, &inst->zone2));
-	CHECK(activate_zone(inst, inst->zone2));
+	result = create_zone(inst, inst->zone2_name, &inst->zone2);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "load_sample_instance_zones: create_zone -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
+	result = activate_zone(inst, inst->zone2);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			 "load_sample_instance_zones: activate_zone -> %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
 
 cleanup:
 	return (result);

bin/tests/system/dyndb/driver/syncptr.c

@@ -57,9 +57,30 @@ syncptr_write(isc_task_t *task, isc_event_t *event) {
 
 	UNUSED(task);
 
-	CHECK(dns_zone_getdb(pevent->zone, &db));
-	CHECK(dns_db_newversion(db, &version));
-	CHECK(dns_diff_apply(&pevent->diff, db, version));
+	log_write(ISC_LOG_INFO, "ENTER: syncptr_write");
+
+	result = dns_zone_getdb(pevent->zone, &db);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr_write: dns_zone_getdb -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
+
+	result = dns_db_newversion(db, &version);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr_write: dns_db_newversion -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
+	result = dns_diff_apply(&pevent->diff, db, version);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr_write: dns_diff_apply -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 cleanup:
 	if (db != NULL) {
@@ -119,18 +140,30 @@ syncptr_find_zone(sample_instance_t *inst, dns_rdata_t *rdata,
 	 * @example
 	 * 192.168.0.1 -> 1.0.168.192.in-addr.arpa
 	 */
-	CHECK(dns_byaddr_createptrname(&isc_ip, 0, name));
+	result = dns_byaddr_createptrname(&isc_ip, 0, name);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr_find_zone: dns_byaddr_createptrname -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 	/* Find a zone containing owner name of the PTR record. */
 	result = dns_zt_find(inst->view->zonetable, name, 0, NULL, zone);
 	if (result == DNS_R_PARTIALMATCH)
 		result = ISC_R_SUCCESS;
-	else if (result != ISC_R_SUCCESS)
+	else if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr_find_zone: dns_zt_find -> %s\n",
+			  isc_result_totext(result));
 		goto cleanup;
+	}
 
 	/* Make sure that the zone is managed by this driver. */
 	if (*zone != inst->zone1 && *zone != inst->zone2) {
 		dns_zone_detach(zone);
+		log_write(ISC_LOG_INFO,
+			  "syncptr_find_zone: zone not managed");
 		result = ISC_R_NOTFOUND;
 	}
 
@@ -202,17 +235,37 @@ syncptr(sample_instance_t *inst, dns_name_t *name,
 	/* Reverse zone is managed by this driver, prepare PTR record */
 	pevent->zone = NULL;
 	dns_zone_attach(ptr_zone, &pevent->zone);
-	CHECK(dns_name_copy(name, dns_fixedname_name(&pevent->ptr_target_name),
-			    NULL));
+	result = dns_name_copy(name,
+			       dns_fixedname_name(&pevent->ptr_target_name),
+			       NULL);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr: dns_name_copy -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 	dns_name_clone(dns_fixedname_name(&pevent->ptr_target_name),
 		       &ptr_struct.ptr);
 	dns_diff_init(inst->mctx, &pevent->diff);
-	CHECK(dns_rdata_fromstruct(&ptr_rdata, dns_rdataclass_in,
-				   dns_rdatatype_ptr, &ptr_struct, &pevent->b));
+	result = dns_rdata_fromstruct(&ptr_rdata, dns_rdataclass_in,
+				      dns_rdatatype_ptr, &ptr_struct,
+				      &pevent->b);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr: dns_rdata_fromstruct -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 	/* Create diff */
-	CHECK(dns_difftuple_create(mctx, op, dns_fixedname_name(&ptr_name),
-				   ttl, &ptr_rdata, &tp));
+	result = dns_difftuple_create(mctx, op, dns_fixedname_name(&ptr_name),
+				      ttl, &ptr_rdata, &tp);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "syncptr: dns_difftuple_create -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 	dns_diff_append(&pevent->diff, &tp);
 
 	/*

bin/tests/system/dyndb/driver/zone.c

@@ -43,15 +43,45 @@ create_zone(sample_instance_t * const inst, dns_name_t * const name,
 
 	zone_argv[0] = inst->db_name;
 
-	CHECK(dns_zone_create(&raw, inst->mctx));
-	CHECK(dns_zone_setorigin(raw, name));
+	result = dns_zone_create(&raw, inst->mctx);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "create_zone: dns_zone_create -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
+	result = dns_zone_setorigin(raw, name);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "create_zone: dns_zone_setorigin -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 	dns_zone_setclass(raw, dns_rdataclass_in);
 	dns_zone_settype(raw, dns_zone_master);
-	CHECK(dns_zone_setdbtype(raw, 1, zone_argv));
-	CHECK(dns_zonemgr_managezone(inst->zmgr, raw));
+	result = dns_zone_setdbtype(raw, 1, zone_argv);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "create_zone: dns_zone_setdbtype -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
+	result = dns_zonemgr_managezone(inst->zmgr, raw);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "create_zone: dns_zonemgr_managezone -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 	/* This is completely insecure - use some sensible values instead! */
-	CHECK(dns_acl_any(inst->mctx, &acl_any));
+	result = dns_acl_any(inst->mctx, &acl_any);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "create_zone: dns_acl_any -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 	dns_zone_setupdateacl(raw, acl_any);
 	dns_zone_setqueryacl(raw, acl_any);
 	dns_zone_setxfracl(raw, acl_any);
@@ -129,7 +159,13 @@ publish_zone(sample_instance_t *inst, dns_zone_t *zone) {
 	}
 
 	dns_zone_setview(zone, inst->view);
-	CHECK(dns_view_addzone(inst->view, zone));
+	result = dns_view_addzone(inst->view, zone);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "publish_zone: dns_view_addzone -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 cleanup:
 	if (zone_in_view != NULL)
@@ -157,7 +193,13 @@ load_zone(dns_zone_t *zone) {
 		goto cleanup;
 	zone_dynamic = (result == DNS_R_DYNAMIC);
 
-	CHECK(dns_zone_getserial(zone, &serial));
+	result = dns_zone_getserial(zone, &serial);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "load_zone: dns_zone_getserial -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 	dns_zone_log(zone, ISC_LOG_INFO, "loaded serial %u", serial);
 
 	if (zone_dynamic)
@@ -187,7 +229,13 @@ activate_zone(sample_instance_t *inst, dns_zone_t *raw) {
 		goto cleanup;
 	}
 
-	CHECK(load_zone(raw));
+	result = load_zone(raw);
+	if (result != ISC_R_SUCCESS) {
+		log_write(ISC_LOG_ERROR,
+			  "activate_zone: load_zone -> %s\n",
+			  isc_result_totext(result));
+		goto cleanup;
+	}
 
 cleanup:
 	return (result);

bin/tests/system/dyndb/tests.sh

@@ -39,7 +39,7 @@ EOF
     newtest "adding $host $type $ip"
     $NSUPDATE ns1/update.txt > /dev/null 2>&1 || {
 	[ "$should_fail" ] || \
-             echo_i "update failed for $host $type $ip"
+	     echo_i "update failed for $host $type $ip"
 	return 1
     }
 
@@ -48,16 +48,21 @@ EOF
     lines=`echo "$out" | grep "$ip" | wc -l`
     [ $lines -eq 1 ] || {
 	[ "$should_fail" ] || \
-            echo_i "dig output incorrect for $host $type $cmd: $out"
+	    echo_i "dig output incorrect for $host $type $cmd: $out"
 	return 1
     }
 
-    out=`$DIG $DIGOPTS +noall +answer -x $ip`
-    echo $out > added.ptr.out.$n
-    lines=`echo "$out" | grep "$host" | wc -l`
+    for i in 1 2 3 4 5 6 7 8 9 10
+    do
+	out=`$DIG $DIGOPTS +noall +answer -x $ip`
+	echo $out > added.ptr.out.$n
+	lines=`echo "$out" | grep "$host" | wc -l`
+	[ $lines -eq 1 ] && break;
+	$PERL -e 'select(undef, undef, undef, 0.1);'
+    done
     [ $lines -eq 1 ] || {
 	[ "$should_fail" ] || \
-            echo_i "dig reverse output incorrect for $host $type $cmd: $out"
+	    echo_i "dig reverse output incorrect for $host $type $cmd: $out"
 	return 1
     }
 
@@ -79,7 +84,7 @@ EOF
     newtest "deleting $host $type (was $ip)"
     $NSUPDATE ns1/update.txt > /dev/null 2>&1 || {
 	[ "$should_fail" ] || \
-             echo_i "update failed deleting $host $type"
+	     echo_i "update failed deleting $host $type"
 	return 1
     }
 
@@ -88,16 +93,21 @@ EOF
     lines=`echo "$out" | grep "$ip" | wc -l`
     [ $lines -eq 0 ] || {
 	[ "$should_fail" ] || \
-            echo_i "dig output incorrect for $host $type $cmd: $out"
+	    echo_i "dig output incorrect for $host $type $cmd: $out"
 	return 1
     }
 
-    out=`$DIG $DIGOPTS +noall +answer -x $ip`
-    echo $out > deleted.ptr.out.$n
-    lines=`echo "$out" | grep "$host" | wc -l`
+    for i in 1 2 3 4 5 6 7 8 9 10
+    do
+	out=`$DIG $DIGOPTS +noall +answer -x $ip`
+	echo $out > deleted.ptr.out.$n
+	lines=`echo "$out" | grep "$host" | wc -l`
+	[ $lines -eq 0 ] && break
+	$PERL -e 'select(undef, undef, undef, 0.1);'
+    done
     [ $lines -eq 0 ] || {
 	[ "$should_fail" ] || \
-            echo_i "dig reverse output incorrect for $host $type $cmd: $out"
+	    echo_i "dig reverse output incorrect for $host $type $cmd: $out"
 	return 1
     }
 
@@ -135,7 +145,7 @@ grep "loading params for dyndb 'sample2' from .*named.conf:" ns1/named.run > /de
 status=`expr $status + $ret`
 
 echo_i "checking dyndb still works after reload"
-$RNDCCMD 10.53.0.1 reload 2>&1 | sed 's/^/ns1 /' | cat_i
+rndc_reload ns1 10.53.0.1
 
 test_add test5.ipv4.example.nil. A "10.53.0.10" || ret=1
 status=`expr $status + $ret`

bin/tests/system/emptyzones/tests.sh

@@ -21,8 +21,7 @@ n=0
 n=`expr $n + 1`
 echo_i "check that switching to automatic empty zones works ($n)"
 ret=0
-$RNDCCMD 10.53.0.1 reload > /dev/null || ret=1
-sleep 5
+rndc_reload ns1 10.53.0.1
 
 copy_setports ns1/named2.conf.in ns1/named.conf
 $RNDCCMD 10.53.0.1 reload > /dev/null || ret=1

bin/tests/system/fetchlimit/tests.sh

@@ -116,7 +116,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 copy_setports ns3/named2.conf.in ns3/named.conf
-$RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndc_reconfig ns3 10.53.0.3
 
 echo_i "checking lame server clients are dropped at the per-domain limit"
 ret=0
@@ -155,7 +155,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 copy_setports ns3/named3.conf.in ns3/named.conf
-$RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndc_reconfig ns3 10.53.0.3
 
 echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
@@ -166,7 +166,7 @@ touch ans4/norespond
 for try in 1 2 3 4 5; do
     burst b $try 400
     $DIG @10.53.0.3 -p ${PORT}  a ${try}.example > dig.out.ns3.$try
-    stat 370 || exceeded=`expr $exceeded + 1`
+    stat 380 || exceeded=`expr $exceeded + 1`
     grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
             success=`expr $success + 1`
     grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
@@ -177,7 +177,7 @@ echo_i "$success successful valid queries (expected 5)"
 [ "$success" -eq 5 ] || { echo_i "failed"; ret=1; }
 echo_i "$fail SERVFAIL responses (expected 0)"
 [ "$fail" -eq 0 ] || { echo_i "failed"; ret=1; }
-echo_i "clients count exceeded 370 on $exceeded trials (expected 0)"
+echo_i "clients count exceeded 380 on $exceeded trials (expected 0)"
 [ "$exceeded" -eq 0 ] || { echo_i "failed"; ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/filter-aaaa/clean.sh

@@ -26,3 +26,6 @@ rm -f ns4/dsset-*
 rm -f dig.out.*
 rm -f ns*/named.lock
 rm -f ns*/managed-keys.bind*
+
+rm -f ns*/trusted.conf
+rm -f ns*/keygen.out

bin/tests/system/filter-aaaa/conf/bad1.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-options {
+plugin query "../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa-on-v4 yes;
 	filter-aaaa { none; };
 };

bin/tests/system/filter-aaaa/conf/bad2.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-options {
+plugin query "../../../plugins/lib/filter-aaaa.so" {
 	/*
 	 * While this matches the defaults, it is not a good configuration
 	 * to have in named.conf as the two options contradict each other

bin/tests/system/filter-aaaa/conf/bad3.conf

@@ -9,10 +9,9 @@
  * information regarding copyright ownership.
  */
 
-options {
-	filter-aaaa-on-v4 no;
-};
-
 view myview {
-	filter-aaaa { any; };
+	plugin query "../../../plugins/lib/filter-aaaa.so" {
+		filter-aaaa-on-v4 no;
+		filter-aaaa { any; };
+	};
 };

bin/tests/system/filter-aaaa/conf/bad4.conf

@@ -9,10 +9,9 @@
  * information regarding copyright ownership.
  */
 
-options {
-	filter-aaaa { any; };
-};
-
 view myview {
-	filter-aaaa-on-v4 no;
+	plugin query "../../../plugins/lib/filter-aaaa.so" {
+		filter-aaaa-on-v4 yes;
+		filter-aaaa { none; };
+	};
 };

bin/tests/system/filter-aaaa/conf/bad5.conf

@@ -9,10 +9,11 @@
  * information regarding copyright ownership.
  */
 
-options {
-	filter-aaaa { none; };
+plugin query "../../../plugins/lib/filter-aaaa.so" {
+	filter-aaaa-on-v4 yes;
+	filter-aaaa { 1.0.0.0/8; };
 };
 
 view myview {
-	filter-aaaa-on-v4 yes;
+	match-clients { any; };
 };

bin/tests/system/filter-aaaa/conf/bad6.conf

@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	filter-aaaa-on-v4 yes;
-};
-
-view myview {
-	filter-aaaa { none; };
-};

bin/tests/system/filter-aaaa/conf/good1.conf

@@ -9,6 +9,6 @@
  * information regarding copyright ownership.
  */
 
-options {
+plugin query "../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa-on-v4 yes;
 };

bin/tests/system/filter-aaaa/conf/good2.conf

@@ -9,6 +9,6 @@
  * information regarding copyright ownership.
  */
 
-options {
+plugin query "../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa-on-v4 break-dnssec;
 };

bin/tests/system/filter-aaaa/conf/good3.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-options {
+plugin query "../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa-on-v4 break-dnssec;
 	filter-aaaa { 1.0.0.0/8; };
 };

bin/tests/system/filter-aaaa/conf/good4.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-options {
+plugin query "../../../plugins/lib/filter-aaaa.so" {
 	filter-aaaa-on-v4 yes;
 	filter-aaaa { 1.0.0.0/8; };
 };

bin/tests/system/filter-aaaa/conf/good5.conf

@@ -9,10 +9,9 @@
  * information regarding copyright ownership.
  */
 
-options {
-	filter-aaaa-on-v4 yes;
-};
-
 view myview {
-	filter-aaaa { 1.0.0.0/8; };
+	plugin query "../../../plugins/lib/filter-aaaa.so" {
+		filter-aaaa-on-v4 yes;
+		filter-aaaa { 1.0.0.0/8; };
+	};
 };

bin/tests/system/filter-aaaa/conf/good6.conf

@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	filter-aaaa { 1.0.0.0/8; };
-};
-
-view myview {
-	filter-aaaa-on-v4 yes;
-};