From 35b53607724ec4b5d4060385218c39ccd0d78a4d Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Thu, 2 Aug 2018 23:46:45 +0200

Subject: [PATCH 2/2] Squashed commit of the following:

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 20:35:13 2018 +0100

    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.

commit ab303db70082db76ecf36493d0b82ef3e8750cad

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 18:11:10 2018 +0100

    Changed root key to be RSASHA256

    Change bad trusted key to be the same algorithm.

commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 16:56:17 2018 +0100

    Change used key to not use hmac-md5

    Fix upforwd test, do not use hmac-md5

commit aec891571626f053acfb4d0a247240cbc21a84e9

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 15:54:11 2018 +0100

    Increase bitsize of DSA key to pass FIPS 140-2 mode.

commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 15:41:08 2018 +0100

    Fix tsig and rndc tests for disabled md5

    Use hmac-sha256 instead of hmac-md5.

commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 13:21:00 2018 +0100

    Add md5 availability detection to featuretest

commit f389a918803e2853e4b55fed62765dc4a492e34f

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 10:44:23 2018 +0100

    Change tests to not use hmac-md5 algorithms if not required

    Use hmac-sha256 instead of default hmac-md5 for allow-query

---

 bin/tests/system/acl/ns2/named1.conf.in          |  4 +-

 bin/tests/system/acl/ns2/named2.conf.in          |  4 +-

 bin/tests/system/acl/ns2/named3.conf.in          |  6 +--

 bin/tests/system/acl/ns2/named4.conf.in          |  4 +-

 bin/tests/system/acl/ns2/named5.conf.in          |  4 +-

 bin/tests/system/acl/tests.sh                    | 32 +++++------

 bin/tests/system/allow-query/ns2/named10.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named11.conf.in |  4 +-

 bin/tests/system/allow-query/ns2/named12.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named30.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named31.conf.in |  4 +-

 bin/tests/system/allow-query/ns2/named32.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named40.conf.in |  4 +-

 bin/tests/system/allow-query/tests.sh            | 18 +++----

 bin/tests/system/catz/ns1/named.conf.in          |  2 +-

 bin/tests/system/catz/ns2/named.conf.in          |  2 +-

 bin/tests/system/checkconf/bad-tsig.conf         |  2 +-

 bin/tests/system/checkconf/good.conf             |  2 +-

 bin/tests/system/digdelv/ns2/example.db          | 15 +++---

 bin/tests/system/digdelv/tests.sh                | 28 +++++-----

 bin/tests/system/dlv/ns1/sign.sh                 |  4 +-

 bin/tests/system/dlv/ns2/sign.sh                 |  4 +-

 bin/tests/system/dlv/ns3/sign.sh                 | 69 ++++++++++++------------

 bin/tests/system/dlv/ns6/sign.sh                 | 66 ++++++++++++-----------

 bin/tests/system/dnssec/ns1/sign.sh              |  4 +-

 bin/tests/system/dnssec/ns2/sign.sh              | 12 ++---

 bin/tests/system/dnssec/ns3/sign.sh              | 20 +++----

 bin/tests/system/dnssec/ns5/trusted.conf.bad     |  2 +-

 bin/tests/system/dnssec/tests.sh                 |  8 +--

 bin/tests/system/feature-test.c                  | 14 +++++

 bin/tests/system/filter-aaaa/ns1/sign.sh         |  4 +-

 bin/tests/system/filter-aaaa/ns4/sign.sh         |  4 +-

 bin/tests/system/notify/ns5/named.conf.in        |  6 +--

 bin/tests/system/notify/tests.sh                 |  6 +--

 bin/tests/system/nsupdate/ns1/named.conf.in      |  2 +-

 bin/tests/system/nsupdate/ns2/named.conf.in      |  2 +-

 bin/tests/system/nsupdate/setup.sh               |  7 ++-

 bin/tests/system/nsupdate/tests.sh               | 11 +++-

 bin/tests/system/rndc/setup.sh                   |  2 +-

 bin/tests/system/rndc/tests.sh                   | 23 ++++----

 bin/tests/system/tsig/clean.sh                   |  1 +

 bin/tests/system/tsig/ns1/named.conf.in          | 10 +---

 bin/tests/system/tsig/ns1/rndc5.conf.in          | 11 ++++

 bin/tests/system/tsig/setup.sh                   |  4 ++

 bin/tests/system/tsig/tests.sh                   | 67 ++++++++++++++---------

 bin/tests/system/tsiggss/setup.sh                |  2 +-

 bin/tests/system/upforwd/ns1/named.conf.in       |  2 +-

 bin/tests/system/upforwd/tests.sh                |  2 +-

 48 files changed, 287 insertions(+), 225 deletions(-)

 create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in

diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in

index 0ea6502708..026db3f134 100644

--- a/bin/tests/system/acl/ns2/named1.conf.in

+++ b/bin/tests/system/acl/ns2/named1.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in

index b877880554..d8f50be255 100644

--- a/bin/tests/system/acl/ns2/named2.conf.in

+++ b/bin/tests/system/acl/ns2/named2.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in

index 0a950622a2..aa54088138 100644

--- a/bin/tests/system/acl/ns2/named3.conf.in

+++ b/bin/tests/system/acl/ns2/named3.conf.in

@@ -33,17 +33,17 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key three {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in

index 7cdcb6e341..606a3452d8 100644

--- a/bin/tests/system/acl/ns2/named4.conf.in

+++ b/bin/tests/system/acl/ns2/named4.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in

index 4b4e05027a..0e679a821d 100644

--- a/bin/tests/system/acl/ns2/named5.conf.in

+++ b/bin/tests/system/acl/ns2/named5.conf.in

@@ -34,12 +34,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh

index 09f31f2bb9..f88f0d4430 100644

--- a/bin/tests/system/acl/tests.sh

+++ b/bin/tests/system/acl/tests.sh

@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"

 # key "one" should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # any other key should be fine

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 copy_setports ns2/named2.conf.in ns2/named.conf

@@ -39,18 +39,18 @@ sleep 5

 # prefix 10/8 should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # any other address should work, as long as it sends key "one"

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 echo_i "testing nested ACL processing"

@@ -62,31 +62,31 @@ sleep 5

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # but only one or the other should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 t=`expr $t + 1`

@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1

 # and other values? right out

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two

@@ -108,31 +108,31 @@ sleep 5

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 echo_i "testing allow-query-on ACL processing"

diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in

index 1569913b37..e9c5c2d574 100644

--- a/bin/tests/system/allow-query/ns2/named10.conf.in

+++ b/bin/tests/system/allow-query/ns2/named10.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in

index 18ac91c6e7..2b1c8739d8 100644

--- a/bin/tests/system/allow-query/ns2/named11.conf.in

+++ b/bin/tests/system/allow-query/ns2/named11.conf.in

@@ -12,12 +12,12 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in

index b8248444dd..dd48945bf8 100644

--- a/bin/tests/system/allow-query/ns2/named12.conf.in

+++ b/bin/tests/system/allow-query/ns2/named12.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in

index aeb1540e95..bfce58bddd 100644

--- a/bin/tests/system/allow-query/ns2/named30.conf.in

+++ b/bin/tests/system/allow-query/ns2/named30.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in

index d4b743281a..e0f52526ba 100644

--- a/bin/tests/system/allow-query/ns2/named31.conf.in

+++ b/bin/tests/system/allow-query/ns2/named31.conf.in

@@ -12,12 +12,12 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in

index c0259387e7..87afb3fa3a 100644

--- a/bin/tests/system/allow-query/ns2/named32.conf.in

+++ b/bin/tests/system/allow-query/ns2/named32.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in

index d83b376cfd..d726b9480b 100644

--- a/bin/tests/system/allow-query/ns2/named40.conf.in

+++ b/bin/tests/system/allow-query/ns2/named40.conf.in

@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };

 acl badaccept { 10.53.0.1; };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh

index fb6059d5b8..f9601564a2 100644

--- a/bin/tests/system/allow-query/tests.sh

+++ b/bin/tests/system/allow-query/tests.sh

@@ -190,7 +190,7 @@ rndc_reload

 echo_i "test $n: key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -203,7 +203,7 @@ rndc_reload

 echo_i "test $n: key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -216,7 +216,7 @@ rndc_reload

 echo_i "test $n: key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -349,7 +349,7 @@ rndc_reload

 echo_i "test $n: views key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -362,7 +362,7 @@ rndc_reload

 echo_i "test $n: views key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -375,7 +375,7 @@ rndc_reload

 echo_i "test $n: views key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -508,7 +508,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -518,7 +518,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -528,7 +528,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in

index 74b7d371b7..c35376640d 100644

--- a/bin/tests/system/catz/ns1/named.conf.in

+++ b/bin/tests/system/catz/ns1/named.conf.in

@@ -61,5 +61,5 @@ zone "catalog4.example" {

 key tsig_key. {

 	secret "LSAnCU+Z";

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 };

diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in

index ee83efbee4..35ced08842 100644

--- a/bin/tests/system/catz/ns2/named.conf.in

+++ b/bin/tests/system/catz/ns2/named.conf.in

@@ -70,5 +70,5 @@ zone "catalog4.example" {

 key tsig_key. {

 	secret "LSAnCU+Z";

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 };

diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf

index 21be03e9d2..e57c30875c 100644

--- a/bin/tests/system/checkconf/bad-tsig.conf

+++ b/bin/tests/system/checkconf/bad-tsig.conf

@@ -11,7 +11,7 @@

 /* Bad secret */

 key "badtsig" {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "jEdD+BPKg==";

 };

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf

index 9ab35b38a5..486551ae64 100644

--- a/bin/tests/system/checkconf/good.conf

+++ b/bin/tests/system/checkconf/good.conf

@@ -153,6 +153,6 @@ dyndb "name" "library.so" {

 	system;

 };

 key "mykey" {

-	algorithm "hmac-md5";

+	algorithm "hmac-sha256";

 	secret "qwertyuiopasdfgh";

 };

diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db

index f4e30f51e5..9f53e31c97 100644

--- a/bin/tests/system/digdelv/ns2/example.db

+++ b/bin/tests/system/digdelv/ns2/example.db

@@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890

 ;;

 ;; we are not testing DNSSEC behavior, so we don't care about the semantics

 ;; of the following records.

-dnskey                  300     DNSKEY  256 3 1 (

-                                        AQPTpWyReB/e9Ii6mVGnakS8hX2zkh/iUYAg

-                                        +Ge4noWROpTWOIBvm76zeJPWs4Zfqa1IsswD

-                                        Ix5Mqeg0zwclz59uecKsKyx5w9IhtZ8plc4R

-                                        b9VIE5x7KNHAYTvTO5d4S8M=

-                                        )

+dnskey                  300     DNSKEY 256 3 8 (

+                    AwEAAaWmCoDpj2K59zcpqnmnQM7IC/XbjS6jIP7uTBR4X7p1bdQJzAeo

+                    EnMhnpnxPp0j+20eZm4847DB2U+HuHy79Mvqd3aozTmfBJvzjKs9qyba

+                    zY/ZHn6BDYxNJiFfjSS/VJ1KuQPDbpCzhm2hbvT5s9nSOaG0WyRk+d+R

+                    qEca11E7ZKkmmNiGlyzMAgfmTTBwgxWBAAhvd9nU1GqD6eQ6Z63hpTc/

+                    KDIHnFTo7pOcZ4z5urIKUMCMcFytedETlEoR5CIWGPdQq2eIEEMfn5ld

+                    QqdEZRHVErD9og8aluJ2s767HZb8LzjCfYgBFoT9/n48T75oZLEKtSkG

+                    /idCeeQlaLU=

+                    )

 ; TTL of 3 weeks

 weeks		1814400	A	10.53.0.2

diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh

index 1b25c4ddfc..5dbf20a3e1 100644

--- a/bin/tests/system/digdelv/tests.sh

+++ b/bin/tests/system/digdelv/tests.sh

@@ -62,7 +62,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -70,7 +70,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -78,7 +78,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +rrcomments works for DNSKEY($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -86,7 +86,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -94,7 +94,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +nosplit works($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=$" < dig.out.test$n > /dev/null || ret=1

+  grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -102,7 +102,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +rrcomments works($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1

+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -118,7 +118,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +rrcomments works($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1

+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -543,7 +543,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -551,7 +551,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -559,7 +559,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +rrcomments works for DNSKEY($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -567,7 +567,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -575,7 +575,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +short +rrcomments works ($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < delv.out.test$n > /dev/null || ret=1

+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < delv.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -583,7 +583,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +short +nosplit works ($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1