From 07876a60a9c2537f536901b214349d67f6b25666 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Thu, 2 Aug 2018 23:46:45 +0200

Subject: [PATCH] FIPS tests changes

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Squashed commit of the following:

commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 20:35:13 2018 +0100

    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.

commit ab303db70082db76ecf36493d0b82ef3e8750cad

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 18:11:10 2018 +0100

    Changed root key to be RSASHA256

    Change bad trusted key to be the same algorithm.

commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 16:56:17 2018 +0100

    Change used key to not use hmac-md5

    Fix upforwd test, do not use hmac-md5

commit aec891571626f053acfb4d0a247240cbc21a84e9

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 15:54:11 2018 +0100

    Increase bitsize of DSA key to pass FIPS 140-2 mode.

commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 15:41:08 2018 +0100

    Fix tsig and rndc tests for disabled md5

    Use hmac-sha256 instead of hmac-md5.

commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 13:21:00 2018 +0100

    Add md5 availability detection to featuretest

commit f389a918803e2853e4b55fed62765dc4a492e34f

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Mar 7 10:44:23 2018 +0100

    Change tests to not use hmac-md5 algorithms if not required

    Use hmac-sha256 instead of default hmac-md5 for allow-query

---

 bin/tests/system/acl/ns2/named1.conf.in          |  4 +-

 bin/tests/system/acl/ns2/named2.conf.in          |  4 +-

 bin/tests/system/acl/ns2/named3.conf.in          |  6 +--

 bin/tests/system/acl/ns2/named4.conf.in          |  4 +-

 bin/tests/system/acl/ns2/named5.conf.in          |  4 +-

 bin/tests/system/acl/tests.sh                    | 32 +++++------

 bin/tests/system/allow-query/ns2/named10.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named11.conf.in |  4 +-

 bin/tests/system/allow-query/ns2/named12.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named30.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named31.conf.in |  4 +-

 bin/tests/system/allow-query/ns2/named32.conf.in |  2 +-

 bin/tests/system/allow-query/ns2/named40.conf.in |  4 +-

 bin/tests/system/allow-query/tests.sh            | 18 +++----

 bin/tests/system/catz/ns1/named.conf.in          |  2 +-

 bin/tests/system/catz/ns2/named.conf.in          |  2 +-

 bin/tests/system/checkconf/bad-tsig.conf         |  2 +-

 bin/tests/system/checkconf/good.conf             |  2 +-

 bin/tests/system/digdelv/ns2/example.db          | 15 +++---

 bin/tests/system/digdelv/tests.sh                | 28 +++++-----

 bin/tests/system/dlv/ns1/sign.sh                 |  4 +-

 bin/tests/system/dlv/ns2/sign.sh                 |  4 +-

 bin/tests/system/dlv/ns3/sign.sh                 | 69 ++++++++++++------------

 bin/tests/system/dlv/ns6/sign.sh                 | 66 ++++++++++++-----------

 bin/tests/system/dnssec/ns1/sign.sh              |  4 +-

 bin/tests/system/dnssec/ns2/sign.sh              | 12 ++---

 bin/tests/system/dnssec/ns3/sign.sh              | 20 +++----

 bin/tests/system/dnssec/ns5/trusted.conf.bad     |  2 +-

 bin/tests/system/dnssec/tests.sh                 |  8 +--

 bin/tests/system/feature-test.c                  | 14 +++++

 bin/tests/system/filter-aaaa/ns1/sign.sh         |  4 +-

 bin/tests/system/filter-aaaa/ns4/sign.sh         |  4 +-

 bin/tests/system/notify/ns5/named.conf.in        |  6 +--

 bin/tests/system/notify/tests.sh                 |  6 +--

 bin/tests/system/nsupdate/ns1/named.conf.in      |  2 +-

 bin/tests/system/nsupdate/ns2/named.conf.in      |  2 +-

 bin/tests/system/nsupdate/setup.sh               |  7 ++-

 bin/tests/system/nsupdate/tests.sh               | 11 +++-

 bin/tests/system/rndc/setup.sh                   |  2 +-

 bin/tests/system/rndc/tests.sh                   | 23 ++++----

 bin/tests/system/tsig/clean.sh                   |  1 +

 bin/tests/system/tsig/ns1/named.conf.in          | 10 +---

 bin/tests/system/tsig/ns1/rndc5.conf.in          | 11 ++++

 bin/tests/system/tsig/setup.sh                   |  4 ++

 bin/tests/system/tsig/tests.sh                   | 67 ++++++++++++++---------

 bin/tests/system/tsiggss/setup.sh                |  2 +-

 bin/tests/system/upforwd/ns1/named.conf.in       |  2 +-

 bin/tests/system/upforwd/tests.sh                |  2 +-

 48 files changed, 287 insertions(+), 225 deletions(-)

 create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in

diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in

index 0ea6502..026db3f 100644

--- a/bin/tests/system/acl/ns2/named1.conf.in

+++ b/bin/tests/system/acl/ns2/named1.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in

index b877880..d8f50be 100644

--- a/bin/tests/system/acl/ns2/named2.conf.in

+++ b/bin/tests/system/acl/ns2/named2.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in

index 0a95062..aa54088 100644

--- a/bin/tests/system/acl/ns2/named3.conf.in

+++ b/bin/tests/system/acl/ns2/named3.conf.in

@@ -33,17 +33,17 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key three {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in

index 7cdcb6e..606a345 100644

--- a/bin/tests/system/acl/ns2/named4.conf.in

+++ b/bin/tests/system/acl/ns2/named4.conf.in

@@ -33,12 +33,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in

index 4b4e050..0e679a8 100644

--- a/bin/tests/system/acl/ns2/named5.conf.in

+++ b/bin/tests/system/acl/ns2/named5.conf.in

@@ -34,12 +34,12 @@ options {

 };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh

index 09f31f2..f88f0d4 100644

--- a/bin/tests/system/acl/tests.sh

+++ b/bin/tests/system/acl/tests.sh

@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"

 # key "one" should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # any other key should be fine

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 copy_setports ns2/named2.conf.in ns2/named.conf

@@ -39,18 +39,18 @@ sleep 5

 # prefix 10/8 should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # any other address should work, as long as it sends key "one"

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 echo_i "testing nested ACL processing"

@@ -62,31 +62,31 @@ sleep 5

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # but only one or the other should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 t=`expr $t + 1`

@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1

 # and other values? right out

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two

@@ -108,31 +108,31 @@ sleep 5

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should succeed

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 # should fail

 t=`expr $t + 1`

 $DIG $DIGOPTS tsigzone. \

-	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}

+	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}

 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }

 echo_i "testing allow-query-on ACL processing"

diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in

index 1569913..e9c5c2d 100644

--- a/bin/tests/system/allow-query/ns2/named10.conf.in

+++ b/bin/tests/system/allow-query/ns2/named10.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in

index 18ac91c..2b1c873 100644

--- a/bin/tests/system/allow-query/ns2/named11.conf.in

+++ b/bin/tests/system/allow-query/ns2/named11.conf.in

@@ -12,12 +12,12 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in

index b824844..dd48945 100644

--- a/bin/tests/system/allow-query/ns2/named12.conf.in

+++ b/bin/tests/system/allow-query/ns2/named12.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in

index aeb1540..bfce58b 100644

--- a/bin/tests/system/allow-query/ns2/named30.conf.in

+++ b/bin/tests/system/allow-query/ns2/named30.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in

index d4b7432..e0f5252 100644

--- a/bin/tests/system/allow-query/ns2/named31.conf.in

+++ b/bin/tests/system/allow-query/ns2/named31.conf.in

@@ -12,12 +12,12 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in

index c025938..87afb3f 100644

--- a/bin/tests/system/allow-query/ns2/named32.conf.in

+++ b/bin/tests/system/allow-query/ns2/named32.conf.in

@@ -12,7 +12,7 @@

 controls { /* empty */ };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in

index d83b376..d726b94 100644

--- a/bin/tests/system/allow-query/ns2/named40.conf.in

+++ b/bin/tests/system/allow-query/ns2/named40.conf.in

@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };

 acl badaccept { 10.53.0.1; };

 key one {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234abcd8765";

 };

 key two {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "1234efgh8765";

 };

diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh

index fb6059d..f960156 100644

--- a/bin/tests/system/allow-query/tests.sh

+++ b/bin/tests/system/allow-query/tests.sh

@@ -190,7 +190,7 @@ rndc_reload

 echo_i "test $n: key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -203,7 +203,7 @@ rndc_reload

 echo_i "test $n: key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -216,7 +216,7 @@ rndc_reload

 echo_i "test $n: key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -349,7 +349,7 @@ rndc_reload

 echo_i "test $n: views key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -362,7 +362,7 @@ rndc_reload

 echo_i "test $n: views key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -375,7 +375,7 @@ rndc_reload

 echo_i "test $n: views key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -508,7 +508,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key allowed - query allowed"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -518,7 +518,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key not allowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

@@ -528,7 +528,7 @@ status=`expr $status + $ret`

 n=`expr $n + 1`

 echo_i "test $n: zone key disallowed - query refused"

 ret=0

-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1

+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1

 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1

 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in

index 74b7d37..c353766 100644

--- a/bin/tests/system/catz/ns1/named.conf.in

+++ b/bin/tests/system/catz/ns1/named.conf.in

@@ -61,5 +61,5 @@ zone "catalog4.example" {

 key tsig_key. {

 	secret "LSAnCU+Z";

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 };

diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in

index ee83efb..35ced08 100644

--- a/bin/tests/system/catz/ns2/named.conf.in

+++ b/bin/tests/system/catz/ns2/named.conf.in

@@ -70,5 +70,5 @@ zone "catalog4.example" {

 key tsig_key. {

 	secret "LSAnCU+Z";

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 };

diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf

index 21be03e..e57c308 100644

--- a/bin/tests/system/checkconf/bad-tsig.conf

+++ b/bin/tests/system/checkconf/bad-tsig.conf

@@ -11,7 +11,7 @@

 /* Bad secret */

 key "badtsig" {

-	algorithm hmac-md5;

+	algorithm hmac-sha256;

 	secret "jEdD+BPKg==";

 };

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf

index 9ab35b3..486551a 100644

--- a/bin/tests/system/checkconf/good.conf

+++ b/bin/tests/system/checkconf/good.conf

@@ -153,6 +153,6 @@ dyndb "name" "library.so" {

 	system;

 };

 key "mykey" {

-	algorithm "hmac-md5";

+	algorithm "hmac-sha256";

 	secret "qwertyuiopasdfgh";

 };

diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db

index f4e30f5..9f53e31 100644

--- a/bin/tests/system/digdelv/ns2/example.db

+++ b/bin/tests/system/digdelv/ns2/example.db

@@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890

 ;;

 ;; we are not testing DNSSEC behavior, so we don't care about the semantics

 ;; of the following records.

-dnskey                  300     DNSKEY  256 3 1 (

-                                        AQPTpWyReB/e9Ii6mVGnakS8hX2zkh/iUYAg

-                                        +Ge4noWROpTWOIBvm76zeJPWs4Zfqa1IsswD

-                                        Ix5Mqeg0zwclz59uecKsKyx5w9IhtZ8plc4R

-                                        b9VIE5x7KNHAYTvTO5d4S8M=

-                                        )

+dnskey                  300     DNSKEY 256 3 8 (

+                    AwEAAaWmCoDpj2K59zcpqnmnQM7IC/XbjS6jIP7uTBR4X7p1bdQJzAeo

+                    EnMhnpnxPp0j+20eZm4847DB2U+HuHy79Mvqd3aozTmfBJvzjKs9qyba

+                    zY/ZHn6BDYxNJiFfjSS/VJ1KuQPDbpCzhm2hbvT5s9nSOaG0WyRk+d+R

+                    qEca11E7ZKkmmNiGlyzMAgfmTTBwgxWBAAhvd9nU1GqD6eQ6Z63hpTc/

+                    KDIHnFTo7pOcZ4z5urIKUMCMcFytedETlEoR5CIWGPdQq2eIEEMfn5ld

+                    QqdEZRHVErD9og8aluJ2s767HZb8LzjCfYgBFoT9/n48T75oZLEKtSkG

+                    /idCeeQlaLU=

+                    )

 ; TTL of 3 weeks

 weeks		1814400	A	10.53.0.2

diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh

index 95bd074..b566ecb 100644

--- a/bin/tests/system/digdelv/tests.sh

+++ b/bin/tests/system/digdelv/tests.sh

@@ -61,7 +61,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -69,7 +69,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -77,7 +77,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +rrcomments works for DNSKEY($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -85,7 +85,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -93,7 +93,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +nosplit works($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=$" < dig.out.test$n > /dev/null || ret=1

+  grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -101,7 +101,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +rrcomments works($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1

+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -117,7 +117,7 @@ if [ -x ${DIG} ] ; then

   echo_i "checking dig +short +rrcomments works($n)"

   ret=0

   $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1

-  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1

+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -555,7 +555,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -563,7 +563,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -571,7 +571,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +rrcomments works for DNSKEY($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -579,7 +579,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1

+  grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -587,7 +587,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +short +rrcomments works ($n)"

   ret=0

   $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1

-  grep "S8M=  ; ZSK; alg = RSAMD5 ; key id = 30795$" < delv.out.test$n > /dev/null || ret=1

+  grep "aLU=  ; ZSK; alg = RSASHA256 ; key id = 36895$" < delv.out.test$n > /dev/null || ret=1

   if [ $ret != 0 ]; then echo_i "failed"; fi

   status=`expr $status + $ret`

@@ -595,7 +595,7 @@ if [ -x ${DELV} ] ; then

   echo_i "checking delv +short +nosplit works ($n)"