199a5d
From 3f04cf343dbeb8819197702ce1be737e26e0638a Mon Sep 17 00:00:00 2001
199a5d
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
199a5d
Date: Thu, 2 Aug 2018 23:46:45 +0200
199a5d
Subject: [PATCH] FIPS tests changes
199a5d
MIME-Version: 1.0
199a5d
Content-Type: text/plain; charset=UTF-8
199a5d
Content-Transfer-Encoding: 8bit
199a5d
199a5d
Squashed commit of the following:
199a5d
199a5d
commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 20:35:13 2018 +0100
199a5d
199a5d
    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.
199a5d
199a5d
commit ab303db70082db76ecf36493d0b82ef3e8750cad
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 18:11:10 2018 +0100
199a5d
199a5d
    Changed root key to be RSASHA256
199a5d
199a5d
    Change bad trusted key to be the same algorithm.
199a5d
199a5d
commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 16:56:17 2018 +0100
199a5d
199a5d
    Change used key to not use hmac-md5
199a5d
199a5d
    Fix upforwd test, do not use hmac-md5
199a5d
199a5d
commit aec891571626f053acfb4d0a247240cbc21a84e9
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 15:54:11 2018 +0100
199a5d
199a5d
    Increase bitsize of DSA key to pass FIPS 140-2 mode.
199a5d
199a5d
commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 15:41:08 2018 +0100
199a5d
199a5d
    Fix tsig and rndc tests for disabled md5
199a5d
199a5d
    Use hmac-sha256 instead of hmac-md5.
199a5d
199a5d
commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 13:21:00 2018 +0100
199a5d
199a5d
    Add md5 availability detection to featuretest
199a5d
199a5d
commit f389a918803e2853e4b55fed62765dc4a492e34f
199a5d
Author: Petr Menšík <pemensik@redhat.com>
199a5d
Date:   Wed Mar 7 10:44:23 2018 +0100
199a5d
199a5d
    Change tests to not use hmac-md5 algorithms if not required
199a5d
199a5d
    Use hmac-sha256 instead of default hmac-md5 for allow-query
199a5d
---
199a5d
 bin/tests/system/acl/ns2/named1.conf.in       |  4 +-
199a5d
 bin/tests/system/acl/ns2/named2.conf.in       |  4 +-
199a5d
 bin/tests/system/acl/ns2/named3.conf.in       |  6 +-
199a5d
 bin/tests/system/acl/ns2/named4.conf.in       |  4 +-
199a5d
 bin/tests/system/acl/ns2/named5.conf.in       |  4 +-
199a5d
 bin/tests/system/acl/tests.sh                 | 32 ++++-----
199a5d
 .../system/allow-query/ns2/named10.conf.in    |  2 +-
199a5d
 .../system/allow-query/ns2/named11.conf.in    |  4 +-
199a5d
 .../system/allow-query/ns2/named12.conf.in    |  2 +-
199a5d
 .../system/allow-query/ns2/named30.conf.in    |  2 +-
199a5d
 .../system/allow-query/ns2/named31.conf.in    |  4 +-
199a5d
 .../system/allow-query/ns2/named32.conf.in    |  2 +-
199a5d
 .../system/allow-query/ns2/named40.conf.in    |  4 +-
199a5d
 bin/tests/system/allow-query/tests.sh         | 18 ++---
199a5d
 bin/tests/system/catz/ns1/named.conf.in       |  2 +-
199a5d
 bin/tests/system/catz/ns2/named.conf.in       |  2 +-
199a5d
 bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
199a5d
 bin/tests/system/checkconf/good.conf          |  2 +-
199a5d
 bin/tests/system/feature-test.c               | 14 ++++
199a5d
 bin/tests/system/notify/ns5/named.conf.in     |  6 +-
199a5d
 bin/tests/system/notify/tests.sh              |  6 +-
199a5d
 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
199a5d
 bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
199a5d
 bin/tests/system/nsupdate/setup.sh            |  6 +-
199a5d
 bin/tests/system/nsupdate/tests.sh            | 15 +++--
199a5d
 bin/tests/system/rndc/setup.sh                |  2 +-
199a5d
 bin/tests/system/rndc/tests.sh                | 23 ++++---
199a5d
 bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
199a5d
 bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
199a5d
 bin/tests/system/tsig/setup.sh                |  5 ++
199a5d
 bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
199a5d
 bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
199a5d
 bin/tests/system/upforwd/tests.sh             |  2 +-
199a5d
 33 files changed, 162 insertions(+), 108 deletions(-)
199a5d
 create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
199a5d
199a5d
diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
199a5d
index 60f22e1..249f672 100644
199a5d
--- a/bin/tests/system/acl/ns2/named1.conf.in
199a5d
+++ b/bin/tests/system/acl/ns2/named1.conf.in
199a5d
@@ -33,12 +33,12 @@ options {
199a5d
 };
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
199a5d
index ada97bc..f82d858 100644
199a5d
--- a/bin/tests/system/acl/ns2/named2.conf.in
199a5d
+++ b/bin/tests/system/acl/ns2/named2.conf.in
199a5d
@@ -33,12 +33,12 @@ options {
199a5d
 };
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
199a5d
index 97684e4..de6a2e9 100644
199a5d
--- a/bin/tests/system/acl/ns2/named3.conf.in
199a5d
+++ b/bin/tests/system/acl/ns2/named3.conf.in
199a5d
@@ -33,17 +33,17 @@ options {
199a5d
 };
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key three {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
199a5d
index 462b3fa..994b35c 100644
199a5d
--- a/bin/tests/system/acl/ns2/named4.conf.in
199a5d
+++ b/bin/tests/system/acl/ns2/named4.conf.in
199a5d
@@ -33,12 +33,12 @@ options {
199a5d
 };
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
199a5d
index 728da58..8f00d09 100644
199a5d
--- a/bin/tests/system/acl/ns2/named5.conf.in
199a5d
+++ b/bin/tests/system/acl/ns2/named5.conf.in
199a5d
@@ -35,12 +35,12 @@ options {
199a5d
 };
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
199a5d
index be59d64..13d5bdc 100644
199a5d
--- a/bin/tests/system/acl/tests.sh
199a5d
+++ b/bin/tests/system/acl/tests.sh
199a5d
@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
199a5d
 # key "one" should fail
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 
199a5d
 # any other key should be fine
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 copy_setports ns2/named2.conf.in ns2/named.conf
199a5d
@@ -39,18 +39,18 @@ sleep 5
199a5d
 # prefix 10/8 should fail
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # any other address should work, as long as it sends key "one"
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 echo_i "testing nested ACL processing"
199a5d
@@ -62,31 +62,31 @@ sleep 5
199a5d
 # should succeed
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should succeed
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should succeed
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should succeed
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # but only one or the other should fail
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 t=`expr $t + 1`
199a5d
@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
199a5d
 # and other values? right out
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
199a5d
@@ -108,31 +108,31 @@ sleep 5
199a5d
 # should succeed
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should succeed
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should fail
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should fail
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 # should fail
199a5d
 t=`expr $t + 1`
199a5d
 $DIG $DIGOPTS tsigzone. \
199a5d
-	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
199a5d
+	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
199a5d
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
199a5d
 
199a5d
 echo_i "testing allow-query-on ACL processing"
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
199a5d
index 7d43e36..f7b25f9 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
199a5d
@@ -10,7 +10,7 @@
199a5d
  */
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
199a5d
index 2952518..121557e 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
199a5d
@@ -10,12 +10,12 @@
199a5d
  */
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234efgh8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
199a5d
index 0c01071..ceabbb5 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
199a5d
@@ -10,7 +10,7 @@
199a5d
  */
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
199a5d
index 4c17292..9cd9d1f 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
199a5d
@@ -10,7 +10,7 @@
199a5d
  */
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
199a5d
index a2690a4..f488730 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
199a5d
@@ -10,12 +10,12 @@
199a5d
  */
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234efgh8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
199a5d
index a0708c8..51fa457 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
199a5d
@@ -10,7 +10,7 @@
199a5d
  */
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
199a5d
index 687768e..d24d6d2 100644
199a5d
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
199a5d
+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
199a5d
@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
199a5d
 acl badaccept { 10.53.0.1; };
199a5d
 
199a5d
 key one {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
 key two {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "1234efgh8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
199a5d
index fe40635..543c663 100644
199a5d
--- a/bin/tests/system/allow-query/tests.sh
199a5d
+++ b/bin/tests/system/allow-query/tests.sh
199a5d
@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
199a5d
 
199a5d
 echo_i "test $n: key allowed - query allowed"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2
199a5d
 
199a5d
 echo_i "test $n: key not allowed - query refused"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2
199a5d
 
199a5d
 echo_i "test $n: key disallowed - query refused"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2
199a5d
 
199a5d
 echo_i "test $n: views key allowed - query allowed"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2
199a5d
 
199a5d
 echo_i "test $n: views key not allowed - query refused"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
199a5d
 
199a5d
 echo_i "test $n: views key disallowed - query refused"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -500,7 +500,7 @@ status=`expr $status + $ret`
199a5d
 n=`expr $n + 1`
199a5d
 echo_i "test $n: zone key allowed - query allowed"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -510,7 +510,7 @@ status=`expr $status + $ret`
199a5d
 n=`expr $n + 1`
199a5d
 echo_i "test $n: zone key not allowed - query refused"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
@@ -520,7 +520,7 @@ status=`expr $status + $ret`
199a5d
 n=`expr $n + 1`
199a5d
 echo_i "test $n: zone key disallowed - query refused"
199a5d
 ret=0
199a5d
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
199a5d
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
199a5d
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
199a5d
 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
199a5d
 if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
199a5d
index 1218669..e62715e 100644
199a5d
--- a/bin/tests/system/catz/ns1/named.conf.in
199a5d
+++ b/bin/tests/system/catz/ns1/named.conf.in
199a5d
@@ -61,5 +61,5 @@ zone "catalog4.example" {
199a5d
 
199a5d
 key tsig_key. {
199a5d
 	secret "LSAnCU+Z";
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 };
199a5d
diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
199a5d
index 30333e6..4005152 100644
199a5d
--- a/bin/tests/system/catz/ns2/named.conf.in
199a5d
+++ b/bin/tests/system/catz/ns2/named.conf.in
199a5d
@@ -70,5 +70,5 @@ zone "catalog4.example" {
199a5d
 
199a5d
 key tsig_key. {
199a5d
 	secret "LSAnCU+Z";
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 };
199a5d
diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
199a5d
index 21be03e..e57c308 100644
199a5d
--- a/bin/tests/system/checkconf/bad-tsig.conf
199a5d
+++ b/bin/tests/system/checkconf/bad-tsig.conf
199a5d
@@ -11,7 +11,7 @@
199a5d
 
199a5d
 /* Bad secret */
199a5d
 key "badtsig" {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha256;
199a5d
 	secret "jEdD+BPKg==";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
199a5d
index e09b9e8..2e824b3 100644
199a5d
--- a/bin/tests/system/checkconf/good.conf
199a5d
+++ b/bin/tests/system/checkconf/good.conf
199a5d
@@ -210,6 +210,6 @@ dyndb "name" "library.so" {
199a5d
 	system;
199a5d
 };
199a5d
 key "mykey" {
199a5d
-	algorithm "hmac-md5";
199a5d
+	algorithm "hmac-sha256";
199a5d
 	secret "qwertyuiopasdfgh";
199a5d
 };
199a5d
diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
199a5d
index 877504f..577660a 100644
199a5d
--- a/bin/tests/system/feature-test.c
199a5d
+++ b/bin/tests/system/feature-test.c
199a5d
@@ -14,6 +14,7 @@
199a5d
 #include <string.h>
199a5d
 #include <unistd.h>
199a5d
 
199a5d
+#include <isc/md.h>
199a5d
 #include <isc/net.h>
199a5d
 #include <isc/print.h>
199a5d
 #include <isc/util.h>
199a5d
@@ -186,6 +187,19 @@ main(int argc, char **argv) {
199a5d
 #endif /* ifdef DLZ_FILESYSTEM */
199a5d
 	}
199a5d
 
199a5d
+	if (strcmp(argv[1], "--md5") == 0) {
199a5d
+		unsigned char digest[ISC_MAX_MD_SIZE];
199a5d
+		const unsigned char test[] = "test";
199a5d
+		unsigned int size = sizeof(digest);
199a5d
+
199a5d
+		if (isc_md(ISC_MD_MD5, test, sizeof(test),
199a5d
+		           digest, &size) == ISC_R_SUCCESS) {
199a5d
+			return (0);
199a5d
+		} else {
199a5d
+			return (1);
199a5d
+		}
199a5d
+	}
199a5d
+
199a5d
 	if (strcmp(argv[1], "--with-idn") == 0) {
199a5d
 #ifdef HAVE_LIBIDN2
199a5d
 		return (0);
199a5d
diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
199a5d
index 1ee8df4..2b75d9a 100644
199a5d
--- a/bin/tests/system/notify/ns5/named.conf.in
199a5d
+++ b/bin/tests/system/notify/ns5/named.conf.in
199a5d
@@ -10,17 +10,17 @@
199a5d
  */
199a5d
 
199a5d
 key "a" {
199a5d
-	algorithm "hmac-md5";
199a5d
+	algorithm "hmac-sha256";
199a5d
 	secret "aaaaaaaaaaaaaaaaaaaa";
199a5d
 };
199a5d
 
199a5d
 key "b" {
199a5d
-	algorithm "hmac-md5";
199a5d
+	algorithm "hmac-sha256";
199a5d
 	secret "bbbbbbbbbbbbbbbbbbbb";
199a5d
 };
199a5d
 
199a5d
 key "c" {
199a5d
-	algorithm "hmac-md5";
199a5d
+	algorithm "hmac-sha256";
199a5d
 	secret "cccccccccccccccccccc";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
199a5d
index 3d7e0b7..ec4d9a7 100644
199a5d
--- a/bin/tests/system/notify/tests.sh
199a5d
+++ b/bin/tests/system/notify/tests.sh
199a5d
@@ -212,16 +212,16 @@ ret=0
199a5d
 $NSUPDATE << EOF
199a5d
 server 10.53.0.5 ${PORT}
199a5d
 zone x21
199a5d
-key a aaaaaaaaaaaaaaaaaaaa
199a5d
+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa
199a5d
 update add added.x21 0 in txt "test string"
199a5d
 send
199a5d
 EOF
199a5d
 
199a5d
 for i in 1 2 3 4 5 6 7 8 9
199a5d
 do
199a5d
-	$DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
199a5d
+	$DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
199a5d
 		txt > dig.out.b.ns5.test$n || ret=1
199a5d
-	$DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
199a5d
+	$DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
199a5d
 		txt > dig.out.c.ns5.test$n || ret=1
199a5d
 	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
199a5d
 	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
199a5d
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
199a5d
index b51e700..436c97d 100644
199a5d
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
199a5d
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
199a5d
@@ -37,7 +37,7 @@ controls {
199a5d
 };
199a5d
 
199a5d
 key altkey {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha512;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
199a5d
index da6b3b4..c547e47 100644
199a5d
--- a/bin/tests/system/nsupdate/ns2/named.conf.in
199a5d
+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
199a5d
@@ -32,7 +32,7 @@ controls {
199a5d
 };
199a5d
 
199a5d
 key altkey {
199a5d
-	algorithm hmac-md5;
199a5d
+	algorithm hmac-sha512;
199a5d
 	secret "1234abcd8765";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
199a5d
index c055da3..4e1242b 100644
199a5d
--- a/bin/tests/system/nsupdate/setup.sh
199a5d
+++ b/bin/tests/system/nsupdate/setup.sh
199a5d
@@ -56,7 +56,11 @@ EOF
199a5d
 
199a5d
 $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
199a5d
 
199a5d
-$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
199a5d
+if $FEATURETEST --md5; then
199a5d
+	$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
199a5d
+else
199a5d
+	echo -n > ns1/md5.key
199a5d
+fi
199a5d
 $DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
199a5d
 $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
199a5d
 $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
199a5d
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
199a5d
index b35d797..41c128e 100755
199a5d
--- a/bin/tests/system/nsupdate/tests.sh
199a5d
+++ b/bin/tests/system/nsupdate/tests.sh
199a5d
@@ -797,7 +797,14 @@ fi
199a5d
 n=`expr $n + 1`
199a5d
 ret=0
199a5d
 echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
199a5d
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
199a5d
+if $FEATURETEST --md5
199a5d
+then
199a5d
+	ALGS="md5 sha1 sha224 sha256 sha384 sha512"
199a5d
+else
199a5d
+	ALGS="sha1 sha224 sha256 sha384 sha512"
199a5d
+	echo_i "skipping disabled md5 algorithm"
199a5d
+fi
199a5d
+for alg in $ALGS; do
199a5d
     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
199a5d
 server 10.53.0.1 ${PORT}
199a5d
 update add ${alg}.keytests.nil. 600 A 10.10.10.3
199a5d
@@ -805,7 +812,7 @@ send
199a5d
 END
199a5d
 done
199a5d
 sleep 2
199a5d
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
199a5d
+for alg in $ALGS; do
199a5d
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
199a5d
 done
199a5d
 if [ $ret -ne 0 ]; then
199a5d
@@ -816,7 +823,7 @@ fi
199a5d
 n=`expr $n + 1`
199a5d
 ret=0
199a5d
 echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
199a5d
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
199a5d
+for alg in $ALGS; do
199a5d
     secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
199a5d
     $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
199a5d
 server 10.53.0.1 ${PORT}
199a5d
@@ -825,7 +832,7 @@ send
199a5d
 END
199a5d
 done
199a5d
 sleep 2
199a5d
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
199a5d
+for alg in $ALGS; do
199a5d
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
199a5d
 done
199a5d
 if [ $ret -ne 0 ]; then
199a5d
diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
199a5d
index b59e7a7..04d5f5a 100644
199a5d
--- a/bin/tests/system/rndc/setup.sh
199a5d
+++ b/bin/tests/system/rndc/setup.sh
199a5d
@@ -33,7 +33,7 @@ make_key () {
199a5d
             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
199a5d
 }
199a5d
 
199a5d
-make_key 1 ${EXTRAPORT1} hmac-md5
199a5d
+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
199a5d
 make_key 2 ${EXTRAPORT2} hmac-sha1
199a5d
 make_key 3 ${EXTRAPORT3} hmac-sha224
199a5d
 make_key 4 ${EXTRAPORT4} hmac-sha256
199a5d
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
199a5d
index 9fd84ed..d0b188f 100644
199a5d
--- a/bin/tests/system/rndc/tests.sh
199a5d
+++ b/bin/tests/system/rndc/tests.sh
199a5d
@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
 status=`expr $status + $ret`
199a5d
 
199a5d
 n=`expr $n + 1`
199a5d
-echo_i "testing rndc with hmac-md5 ($n)"
199a5d
-ret=0
199a5d
-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
199a5d
-for i in 2 3 4 5 6
199a5d
-do
199a5d
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
199a5d
-done
199a5d
-if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
-status=`expr $status + $ret`
199a5d
+if $FEATURETEST --md5
199a5d
+then
199a5d
+	echo_i "testing rndc with hmac-md5 ($n)"
199a5d
+	ret=0
199a5d
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
199a5d
+	for i in 2 3 4 5 6
199a5d
+	do
199a5d
+		$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
199a5d
+	done
199a5d
+	if [ $ret != 0 ]; then echo_i "failed"; fi
199a5d
+	status=`expr $status + $ret`
199a5d
+else
199a5d
+	echo_i "skipping rndc with hmac-md5 ($n)"
199a5d
+fi
199a5d
 
199a5d
 n=`expr $n + 1`
199a5d
 echo_i "testing rndc with hmac-sha1 ($n)"
199a5d
diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
199a5d
index 3470c4f..cf539cd 100644
199a5d
--- a/bin/tests/system/tsig/ns1/named.conf.in
199a5d
+++ b/bin/tests/system/tsig/ns1/named.conf.in
199a5d
@@ -21,10 +21,7 @@ options {
199a5d
 	notify no;
199a5d
 };
199a5d
 
199a5d
-key "md5" {
199a5d
-	secret "97rnFx24Tfna4mHPfgnerA==";
199a5d
-	algorithm hmac-md5;
199a5d
-};
199a5d
+# md5 key appended by setup.sh at the end
199a5d
 
199a5d
 key "sha1" {
199a5d
 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
199a5d
@@ -51,10 +48,7 @@ key "sha512" {
199a5d
 	algorithm hmac-sha512;
199a5d
 };
199a5d
 
199a5d
-key "md5-trunc" {
199a5d
-	secret "97rnFx24Tfna4mHPfgnerA==";
199a5d
-	algorithm hmac-md5-80;
199a5d
-};
199a5d
+# md5-trunc key appended by setup.sh at the end
199a5d
 
199a5d
 key "sha1-trunc" {
199a5d
 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
199a5d
diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
199a5d
new file mode 100644
199a5d
index 0000000..0682194
199a5d
--- /dev/null
199a5d
+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
199a5d
@@ -0,0 +1,10 @@
199a5d
+# Conditionally included when support for MD5 is available
199a5d
+key "md5" {
199a5d
+	secret "97rnFx24Tfna4mHPfgnerA==";
199a5d
+	algorithm hmac-md5;
199a5d
+};
199a5d
+
199a5d
+key "md5-trunc" {
199a5d
+	secret "97rnFx24Tfna4mHPfgnerA==";
199a5d
+	algorithm hmac-md5-80;
199a5d
+};
199a5d
diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
199a5d
index e3b4a45..ae21d04 100644
199a5d
--- a/bin/tests/system/tsig/setup.sh
199a5d
+++ b/bin/tests/system/tsig/setup.sh
199a5d
@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
199a5d
 $SHELL clean.sh
199a5d
 
199a5d
 copy_setports ns1/named.conf.in ns1/named.conf
199a5d
+
199a5d
+if $FEATURETEST --md5
199a5d
+then
199a5d
+	cat ns1/rndc5.conf.in >> ns1/named.conf
199a5d
+fi
199a5d
diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
199a5d
index 38d842a..668aa6f 100644
199a5d
--- a/bin/tests/system/tsig/tests.sh
199a5d
+++ b/bin/tests/system/tsig/tests.sh
199a5d
@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
199a5d
 
199a5d
 status=0
199a5d
 
199a5d
-echo_i "fetching using hmac-md5 (old form)"
199a5d
-ret=0
199a5d
-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
199a5d
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
199a5d
-if [ $ret -eq 1 ] ; then
199a5d
-	echo_i "failed"; status=1
199a5d
-fi
199a5d
+if $FEATURETEST --md5
199a5d
+then
199a5d
+	echo_i "fetching using hmac-md5 (old form)"
199a5d
+	ret=0
199a5d
+	$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
199a5d
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
199a5d
+	if [ $ret -eq 1 ] ; then
199a5d
+		echo_i "failed"; status=1
199a5d
+	fi
199a5d
 
199a5d
-echo_i "fetching using hmac-md5 (new form)"
199a5d
-ret=0
199a5d
-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
199a5d
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
199a5d
-if [ $ret -eq 1 ] ; then
199a5d
-	echo_i "failed"; status=1
199a5d
+	echo_i "fetching using hmac-md5 (new form)"
199a5d
+	ret=0
199a5d
+	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
199a5d
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
199a5d
+	if [ $ret -eq 1 ] ; then
199a5d
+		echo_i "failed"; status=1
199a5d
+	fi
199a5d
+else
199a5d
+	echo_i "skipping using hmac-md5"
199a5d
 fi
199a5d
 
199a5d
 echo_i "fetching using hmac-sha1"
199a5d
@@ -87,12 +92,17 @@ fi
199a5d
 #	Truncated TSIG
199a5d
 #
199a5d
 #
199a5d
-echo_i "fetching using hmac-md5 (trunc)"
199a5d
-ret=0
199a5d
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
199a5d
-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
199a5d
-if [ $ret -eq 1 ] ; then
199a5d
-	echo_i "failed"; status=1
199a5d
+if $FEATURETEST --md5
199a5d
+then
199a5d
+	echo_i "fetching using hmac-md5 (trunc)"
199a5d
+	ret=0
199a5d
+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
199a5d
+	grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
199a5d
+	if [ $ret -eq 1 ] ; then
199a5d
+		echo_i "failed"; status=1
199a5d
+	fi
199a5d
+else
199a5d
+	echo_i "skipping using hmac-md5 (trunc)"
199a5d
 fi
199a5d
 
199a5d
 echo_i "fetching using hmac-sha1 (trunc)"
199a5d
@@ -141,12 +151,17 @@ fi
199a5d
 #	Check for bad truncation.
199a5d
 #
199a5d
 #
199a5d
-echo_i "fetching using hmac-md5-80 (BADTRUNC)"
199a5d
-ret=0
199a5d
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
199a5d
-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
199a5d
-if [ $ret -eq 1 ] ; then
199a5d
-	echo_i "failed"; status=1
199a5d
+if $FEATURETEST --md5
199a5d
+then
199a5d
+	echo_i "fetching using hmac-md5-80 (BADTRUNC)" 
199a5d
+	ret=0
199a5d
+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
199a5d
+	grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
199a5d
+	if [ $ret -eq 1 ] ; then
199a5d
+		echo_i "failed"; status=1
199a5d
+	fi
199a5d
+else
199a5d
+	echo_i "skipping using hmac-md5-80 (BADTRUNC)" 
199a5d
 fi
199a5d
 
199a5d
 echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
199a5d
diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
199a5d
index 3873c7c..b359a5a 100644
199a5d
--- a/bin/tests/system/upforwd/ns1/named.conf.in
199a5d
+++ b/bin/tests/system/upforwd/ns1/named.conf.in
199a5d
@@ -10,7 +10,7 @@
199a5d
  */
199a5d
 
199a5d
 key "update.example." {
199a5d
-	algorithm "hmac-md5";
199a5d
+	algorithm "hmac-sha256";
199a5d
 	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
199a5d
 };
199a5d
 
199a5d
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
199a5d
index a50c896..8062d68 100644
199a5d
--- a/bin/tests/system/upforwd/tests.sh
199a5d
+++ b/bin/tests/system/upforwd/tests.sh
199a5d
@@ -79,7 +79,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
199a5d
 
199a5d
 echo_i "updating zone (signed) ($n)"
199a5d
 ret=0
199a5d
-$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <
199a5d
+$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <
199a5d
 server 10.53.0.3 ${PORT}
199a5d
 update add updated.example. 600 A 10.10.10.1
199a5d
 update add updated.example. 600 TXT Foo
199a5d
-- 
199a5d
2.26.2
199a5d