From 303aae42064a4f6245f9c519953a5e6dd67510c0 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Thu, 2 Aug 2018 23:46:45 +0200

Subject: [PATCH] FIPS tests changes

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Squashed commit of the following:

commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 20:35:13 2018 +0100

    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.

commit ab303db70082db76ecf36493d0b82ef3e8750cad

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 18:11:10 2018 +0100

    Changed root key to be RSASHA256

    Change bad trusted key to be the same algorithm.

commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 16:56:17 2018 +0100

    Change used key to not use hmac-md5

    Fix upforwd test, do not use hmac-md5

commit aec891571626f053acfb4d0a247240cbc21a84e9

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 15:54:11 2018 +0100

    Increase bitsize of DSA key to pass FIPS 140-2 mode.

commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 15:41:08 2018 +0100

    Fix tsig and rndc tests for disabled md5

    Use hmac-sha256 instead of hmac-md5.

commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 13:21:00 2018 +0100

    Add md5 availability detection to featuretest

commit f389a918803e2853e4b55fed62765dc4a492e34f

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 10:44:23 2018 +0100

    Change tests to not use hmac-md5 algorithms if not required

    Use hmac-sha256 instead of default hmac-md5 for allow-query

---

 bin/tests/system/acl/ns2/named1.conf.in       |  4 +-

 bin/tests/system/acl/ns2/named2.conf.in       |  4 +-

 bin/tests/system/acl/ns2/named3.conf.in       |  6 +-

 bin/tests/system/acl/ns2/named4.conf.in       |  4 +-

 bin/tests/system/acl/ns2/named5.conf.in       |  4 +-

 bin/tests/system/acl/tests.sh                 | 32 ++++-----

 .../system/allow-query/ns2/named10.conf.in    |  2 +-

 .../system/allow-query/ns2/named11.conf.in    |  4 +-

 .../system/allow-query/ns2/named12.conf.in    |  2 +-

 .../system/allow-query/ns2/named30.conf.in    |  2 +-

 .../system/allow-query/ns2/named31.conf.in    |  4 +-

 .../system/allow-query/ns2/named32.conf.in    |  2 +-

 .../system/allow-query/ns2/named40.conf.in    |  4 +-

 bin/tests/system/allow-query/tests.sh         | 18 ++---

 bin/tests/system/catz/ns1/named.conf.in       |  2 +-

 bin/tests/system/catz/ns2/named.conf.in       |  2 +-

 bin/tests/system/checkconf/bad-tsig.conf      |  2 +-

 bin/tests/system/checkconf/good.conf          |  2 +-

 bin/tests/system/feature-test.c               | 14 ++++

 bin/tests/system/notify/ns5/named.conf.in     |  6 +-

 bin/tests/system/notify/tests.sh              |  6 +-

 bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-

 bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-

 bin/tests/system/nsupdate/setup.sh            |  6 +-

 bin/tests/system/nsupdate/tests.sh            | 11 ++-

 bin/tests/system/rndc/setup.sh                |  2 +-

 bin/tests/system/rndc/tests.sh                | 23 ++++---

 bin/tests/system/tsig/ns1/named.conf.in       | 10 +--

 bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++

 bin/tests/system/tsig/setup.sh                |  5 ++

 bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------

 bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-

 bin/tests/system/upforwd/tests.sh             |  2 +-

 33 files changed, 161 insertions(+), 107 deletions(-)

 create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in

diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in

index 0ea6502..026db3f 100644

--- a/bin/tests/system/acl/ns2/named1.conf.in

+++ b/bin/tests/system/acl/ns2/named1.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in

index b877880..d8f50be 100644

--- a/bin/tests/system/acl/ns2/named2.conf.in

+++ b/bin/tests/system/acl/ns2/named2.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in

index 0a95062..aa54088 100644

--- a/bin/tests/system/acl/ns2/named3.conf.in

+++ b/bin/tests/system/acl/ns2/named3.conf.in

@@ -33,17 +33,17 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key three {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in

index 7cdcb6e..606a345 100644

--- a/bin/tests/system/acl/ns2/named4.conf.in

+++ b/bin/tests/system/acl/ns2/named4.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in

index 4b4e050..0e679a8 100644

--- a/bin/tests/system/acl/ns2/named5.conf.in

+++ b/bin/tests/system/acl/ns2/named5.conf.in

@@ -34,12 +34,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh

index fe49a86..d7819f1 100644

--- a/bin/tests/system/acl/tests.sh

+++ b/bin/tests/system/acl/tests.sh

@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"

 # key "one" should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # any other key should be fine

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 copy_setports ns2/named2.conf.in ns2/named.conf

@@ -39,18 +39,18 @@ sleep 5

 # prefix 10/8 should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # any other address should work, as long as it sends key "one"

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 echo_i "testing nested ACL processing"

@@ -62,31 +62,31 @@ sleep 5

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # but only one or the other should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 t=`expr $t + 1`

@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1

 # and other values? right out

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two

@@ -108,31 +108,31 @@ sleep 5

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 echo_i "testing allow-query-on ACL processing"

diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in

index c5f38c9..00db0da 100644

--- a/bin/tests/system/allow-query/ns2/named10.conf.in

+++ b/bin/tests/system/allow-query/ns2/named10.conf.in

@@ -10,7 +10,7 @@

  */

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in

index 56e5cc4..2c32b71 100644

--- a/bin/tests/system/allow-query/ns2/named11.conf.in

+++ b/bin/tests/system/allow-query/ns2/named11.conf.in

@@ -10,12 +10,12 @@

  */

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in

index 8381950..21a6366 100644

--- a/bin/tests/system/allow-query/ns2/named12.conf.in

+++ b/bin/tests/system/allow-query/ns2/named12.conf.in

@@ -10,7 +10,7 @@

  */

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in

index 0e5ff55..a90ed6a 100644

--- a/bin/tests/system/allow-query/ns2/named30.conf.in

+++ b/bin/tests/system/allow-query/ns2/named30.conf.in

@@ -10,7 +10,7 @@

  */

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in

index faadb3f..b99f337 100644

--- a/bin/tests/system/allow-query/ns2/named31.conf.in

+++ b/bin/tests/system/allow-query/ns2/named31.conf.in

@@ -10,12 +10,12 @@

  */

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in

index 9e78dd0..ea7a413 100644

--- a/bin/tests/system/allow-query/ns2/named32.conf.in

+++ b/bin/tests/system/allow-query/ns2/named32.conf.in

@@ -10,7 +10,7 @@

  */

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in

index f4bc399..e01f312 100644

--- a/bin/tests/system/allow-query/ns2/named40.conf.in

+++ b/bin/tests/system/allow-query/ns2/named40.conf.in

@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };

 acl badaccept { 10.53.0.1; };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh

index 479910c..53b9e5c 100644

--- a/bin/tests/system/allow-query/tests.sh

+++ b/bin/tests/system/allow-query/tests.sh

@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2

 echo_i "test $n: key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2

 echo_i "test $n: key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2

 echo_i "test $n: key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2

 echo_i "test $n: views key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2

 echo_i "test $n: views key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2

 echo_i "test $n: views key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -500,7 +500,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -510,7 +510,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -520,7 +520,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in

index 74b7d37..c353766 100644

--- a/bin/tests/system/catz/ns1/named.conf.in

+++ b/bin/tests/system/catz/ns1/named.conf.in

@@ -61,5 +61,5 @@ zone "catalog4.example" {

 key tsig_key. {

 	secret "LSAnCU+Z";

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 };

diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in

index ee83efb..35ced08 100644

--- a/bin/tests/system/catz/ns2/named.conf.in

+++ b/bin/tests/system/catz/ns2/named.conf.in

@@ -70,5 +70,5 @@ zone "catalog4.example" {

 key tsig_key. {

 	secret "LSAnCU+Z";

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 };

diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf

index 21be03e..e57c308 100644

--- a/bin/tests/system/checkconf/bad-tsig.conf

+++ b/bin/tests/system/checkconf/bad-tsig.conf

@@ -11,7 +11,7 @@

 /* Bad secret */

 key "badtsig" {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "jEdD+BPKg==";

 };

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf

index 2eb2850..9e6913d 100644

--- a/bin/tests/system/checkconf/good.conf

+++ b/bin/tests/system/checkconf/good.conf

@@ -197,6 +197,6 @@ dyndb "name" "library.so" {

 	system;

 };

 key "mykey" {

-	algorithm "hmac-md5";

+	algorithm "hmac-sha256";

 	secret "qwertyuiopasdfgh";

 };

diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c

index 204d612..684fab6 100644

--- a/bin/tests/system/feature-test.c

+++ b/bin/tests/system/feature-test.c

@@ -14,6 +14,7 @@

 #include <string.h>

 #include <unistd.h>

+#include <isc/md.h>

 #include <isc/net.h>

 #include <isc/print.h>

 #include <isc/util.h>

@@ -158,6 +159,19 @@ main(int argc, char **argv) {

 #endif /* ifdef DLZ_FILESYSTEM */

 	}

+	if (strcmp(argv[1], "--md5") == 0) {

+		unsigned char digest[ISC_MAX_MD_SIZE];

+		const unsigned char test[] = "test";

+		unsigned int size = sizeof(digest);

+

+		if (isc_md(ISC_MD_MD5, test, sizeof(test),

+		           digest, &size) == ISC_R_SUCCESS) {

+			return (0);

+		} else {

+			return (1);

+		}

+	}

+

 	if (strcmp(argv[1], "--ipv6only=no") == 0) {

 #ifdef WIN32

 		return (0);

diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in

index 2976bfc..256d846 100644

--- a/bin/tests/system/notify/ns5/named.conf.in

+++ b/bin/tests/system/notify/ns5/named.conf.in

@@ -10,17 +10,17 @@

  */

 key "a" {

-	algorithm "hmac-md5";

+	algorithm "hmac-sha256";

 	secret "aaaaaaaaaaaaaaaaaaaa";

 };

 key "b" {

-	algorithm "hmac-md5";

+	algorithm "hmac-sha256";

 	secret "bbbbbbbbbbbbbbbbbbbb";

 };

 key "c" {

-	algorithm "hmac-md5";

+	algorithm "hmac-sha256";

 	secret "cccccccccccccccccccc";

 };

diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh

index d54ab0d..ba38177 100644

--- a/bin/tests/system/notify/tests.sh

+++ b/bin/tests/system/notify/tests.sh

@@ -212,16 +212,16 @@ ret=0

 $NSUPDATE << EOF

 server 10.53.0.5 ${PORT}

 zone x21

-key a aaaaaaaaaaaaaaaaaaaa

+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa

 update add added.x21 0 in txt "test string"

 send

 EOF

 for i in 1 2 3 4 5 6 7 8 9

 do

-	$DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \

+	$DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \

 		txt > dig.out.b.ns5.test$n || ret=1

-	$DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \

+	$DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \

 		txt > dig.out.c.ns5.test$n || ret=1

 	grep "test string" dig.out.b.ns5.test$n > /dev/null &&

 	grep "test string" dig.out.c.ns5.test$n > /dev/null &&

diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in

index e7b6adb..4ad5cc1 100644

--- a/bin/tests/system/nsupdate/ns1/named.conf.in

+++ b/bin/tests/system/nsupdate/ns1/named.conf.in

@@ -33,7 +33,7 @@ controls {

 };

 key altkey {

-	algorithm hmac-md5;

+	algorithm hmac-sha512;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in

index b703843..8bfe2b0 100644

--- a/bin/tests/system/nsupdate/ns2/named.conf.in

+++ b/bin/tests/system/nsupdate/ns2/named.conf.in

@@ -32,7 +32,7 @@ controls {

 };

 key altkey {

-	algorithm hmac-md5;

+	algorithm hmac-sha512;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh

index 5d70114..6c4b55a 100644

--- a/bin/tests/system/nsupdate/setup.sh

+++ b/bin/tests/system/nsupdate/setup.sh

@@ -56,7 +56,11 @@ EOF

 $DDNSCONFGEN -q -z example.nil > ns1/ddns.key

-$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key

+if $FEATURETEST --md5; then

+	$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key

+else

+	echo -n > ns1/md5.key

+fi

 $DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key

 $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key

 $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh

index 72a282a..5d42e04 100755

--- a/bin/tests/system/nsupdate/tests.sh

+++ b/bin/tests/system/nsupdate/tests.sh

@@ -715,7 +715,14 @@ fi

 n=`expr $n + 1`

 ret=0

 echo_i "check TSIG key algorithms ($n)"

-for alg in md5 sha1 sha224 sha256 sha384 sha512; do

+if $FEATURETEST --md5

+then

+	ALGS="md5 sha1 sha224 sha256 sha384 sha512"

+else

+	ALGS="sha1 sha224 sha256 sha384 sha512"

+	echo_i "skipping disabled md5 algorithm"

+fi

+for alg in $ALGS; do

     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1

 server 10.53.0.1 ${PORT}

 update add ${alg}.keytests.nil. 600 A 10.10.10.3

@@ -723,7 +730,7 @@ send

 END

 done

 sleep 2

-for alg in md5 sha1 sha224 sha256 sha384 sha512; do

+for alg in $ALGS; do

     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1

 done

 if [ $ret -ne 0 ]; then

diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh

index 6b539d1..4d7eaa2 100644