nsec3: use fips configuration if rsasha1 is not supported

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 81e4af62f6854ff670e48ff792cb27e0611a50a7..6baf65bff0bf025a84d292f323799a6275f20c85 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -518,7 +518,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
 ret=0
-if $FEATURETEST --have-fips-mode; then
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
     conf=kasp-bad-nsec3-iter-fips.conf
     expect=2
 else
@@ -536,8 +536,8 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-alg.conf > checkconf.out$n 2>&1 && ret=1
-if $FEATURETEST --have-fips-mode; then
-    grep "dnssec-policy: algorithm rsasha1 not supported in FIPS mode" < checkconf.out$n > /dev/null || ret=1
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
+    grep "dnssec-policy: algorithm rsasha1 not supported" < checkconf.out$n > /dev/null || ret=1
 else
     grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
 fi

diff --git a/bin/tests/system/nsec3/setup.sh b/bin/tests/system/nsec3/setup.sh
index 9124385d52418b2b710d5d847baf74261ce1c64d..9e60297c2071a29c8174f8ef38d9e408ec844b1d 100644 (file)
--- a/bin/tests/system/nsec3/setup.sh
+++ b/bin/tests/system/nsec3/setup.sh
@@ -24,7 +24,7 @@ copy_setports ns2/named.conf.in ns2/named.conf
        $SHELL setup.sh
 )
 
-if $FEATURETEST --have-fips-mode
+if ! ($SHELL ../testcrypto.sh -q RSASHA1)
 then
     copy_setports ns3/named-fips.conf.in ns3/named.conf
 else

diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh
index 70e15d9af76a9b26c7e676acab7841eaf8186665..93a99e0b22da61f860c9d7e674cc54d9395ff181 100644 (file)
--- a/bin/tests/system/nsec3/tests.sh
+++ b/bin/tests/system/nsec3/tests.sh
@@ -391,7 +391,7 @@ check_nsec
 # Reconfig named.
 ret=0
 echo_i "reconfig dnssec-policy to trigger nsec3 rollovers"
-if $FEATURETEST --have-fips-mode
+if ! ($SHELL ../testcrypto.sh -q RSASHA1)
 then
     copy_setports ns3/named2-fips.conf.in ns3/named.conf
 else