Merging upstream version 1:9.16.48.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

4 files changed, 635 insertions, 616 deletions

diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh
index 1a3127c..74a2126 100644
--- a/bin/tests/system/rpz/clean.sh
+++ b/bin/tests/system/rpz/clean.sh
@@ -16,16 +16,19 @@
 USAGE="$0: [-Px]"
 DEBUG=
 while getopts "Px" c; do
-    case $c in
-	x) set -x ;;
-	P) PARTIAL=set ;;
-	*) echo "$USAGE" 1>&2; exit 1;;
-    esac
+  case $c in
+    x) set -x ;;
+    P) PARTIAL=set ;;
+    *)
+      echo "$USAGE" 1>&2
+      exit 1
+      ;;
+  esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $(expr $OPTIND - 1 || true)
 if test "$#" -ne 0; then
-    echo "$USAGE" 1>&2
-    exit 1
+  echo "$USAGE" 1>&2
+  exit 1
 fi
 
 # this might be called from setup.sh to partially clean up the files
@@ -42,16 +45,16 @@ rm -f */policy2.db
 rm -f */*.jnl
 
 if [ ${PARTIAL:-unset} = unset ]; then
-    rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
-    rm -f ns5/requests ns5/*.perf
-    rm -f */named.memstats */*.run */*.run.prev */named.stats */session.key
-    rm -f */*.log */*core */*.pid
-    rm -f ns*/named.lock
-    rm -f ns*/named.conf
-    rm -f ns*/*switch
-    rm -f dnsrps*.conf
-    rm -f dnsrpzd.conf
-    rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid
-    rm -f ns*/managed-keys.bind*
-    rm -f tmp
+  rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
+  rm -f ns5/requests ns5/*.perf
+  rm -f */named.memstats */*.run */*.run.prev */named.stats */session.key
+  rm -f */*.log */*core */*.pid
+  rm -f ns*/named.lock
+  rm -f ns*/named.conf
+  rm -f ns*/*switch
+  rm -f dnsrps*.conf
+  rm -f dnsrpzd.conf
+  rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid
+  rm -f ns*/managed-keys.bind*
+  rm -f tmp
 fi
diff --git a/bin/tests/system/rpz/qperf.sh b/bin/tests/system/rpz/qperf.sh
index dc79de9..1ec64fe 100644
--- a/bin/tests/system/rpz/qperf.sh
+++ b/bin/tests/system/rpz/qperf.sh
@@ -11,12 +11,12 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-for QDIR in `echo "$PATH" | tr : ' '` ../../../../contrib/queryperf; do
-    QPERF=$QDIR/queryperf
-    if test -f "$QPERF" -a -x "$QPERF"; then
-	echo $QPERF
-	exit 0
-    fi
+for QDIR in $(echo "$PATH" | tr : ' ') ../../../../contrib/queryperf; do
+  QPERF=$QDIR/queryperf
+  if test -f "$QPERF" -a -x "$QPERF"; then
+    echo $QPERF
+    exit 0
+  fi
 done
 
 exit 0
diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
index 10ab738..306a19a 100644
--- a/bin/tests/system/rpz/setup.sh
+++ b/bin/tests/system/rpz/setup.sh
@@ -23,26 +23,32 @@ QPERF=$($SHELL qperf.sh)
 USAGE="$0: [-DNx]"
 DEBUG=
 while getopts "DNx" c; do
-    case $c in
-	x) set -x; DEBUG=-x ;;
-        D) TEST_DNSRPS="-D" ;;
-	N) PARTIAL=-P ;;
-	*) echo "$USAGE" 1>&2; exit 1 ;;
-    esac
+  case $c in
+    x)
+      set -x
+      DEBUG=-x
+      ;;
+    D) TEST_DNSRPS="-D" ;;
+    N) PARTIAL=-P ;;
+    *)
+      echo "$USAGE" 1>&2
+      exit 1
+      ;;
+  esac
 done
 shift $((OPTIND - 1))
 if test "$#" -ne 0; then
-    echo "$USAGE" 1>&2
-    exit 1
+  echo "$USAGE" 1>&2
+  exit 1
 fi
 
 if [ ${NOCLEAN:-unset} = unset ]; then
-    $SHELL clean.sh $PARTIAL $DEBUG
+  $SHELL clean.sh $PARTIAL $DEBUG
 fi
 
 for dir in ns*; do
-    touch $dir/named.run
-    nextpart $dir/named.run > /dev/null
+  touch $dir/named.run
+  nextpart $dir/named.run >/dev/null
 done
 
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -71,7 +77,7 @@ test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS=
 #	    drop,tcp-only} are used to check policy overrides in named.conf.
 #   NO-OP is an obsolete synonym for PASSHTRU
 for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wildcname -garden -drop -tcp-only; do
-    sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
+  sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
 done
 #  bl zones are dynamically updated.  Add one zone that is updated manually.
 cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
@@ -87,13 +93,13 @@ cp ns5/expire.conf.in ns5/expire.conf
 # $2=domain name
 # $3=input zone file
 # $4=output file
-signzone () {
-    KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2)
-    cat $1/$3 $1/$KEYNAME.key > $1/tmp
-    $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
-    sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
-    DSFILENAME=dsset-${2}${TP}
-    rm $DSFILENAME $1/tmp
+signzone() {
+  KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2)
+  cat $1/$3 $1/$KEYNAME.key >$1/tmp
+  $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
+  sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
+  DSFILENAME=dsset-${2}${TP}
+  rm $DSFILENAME $1/tmp
 }
 signzone ns2 tld2s base-tld2s.db tld2s.db
 
@@ -141,20 +147,20 @@ ns1.x.rpz-nsdname	CNAME	.
 EOF
 
 if test -n "$QPERF"; then
-    # Do not build the full zones if we will not use them.
-    $PERL -e 'for ($val = 1; $val <= 65535; ++$val) {
+  # Do not build the full zones if we will not use them.
+  $PERL -e 'for ($val = 1; $val <= 65535; ++$val) {
 	printf("host-%05d\tA    192.168.%d.%d\n", $val, $val/256, $val%256);
 	}' >>ns5/example.db
 
-    echo >>ns5/bl.db
-    echo "; rewrite some names" >>ns5/bl.db
-    $PERL -e 'for ($val = 2; $val <= 65535; $val += 69) {
+  echo >>ns5/bl.db
+  echo "; rewrite some names" >>ns5/bl.db
+  $PERL -e 'for ($val = 2; $val <= 65535; $val += 69) {
 	printf("host-%05d.example.tld5\tCNAME\t.\n", $val);
 	}' >>ns5/bl.db
 
-    echo >>ns5/bl.db
-    echo "; rewrite with some not entirely trivial patricia trees" >>ns5/bl.db
-    $PERL -e 'for ($val = 3; $val <= 65535; $val += 69) {
+  echo >>ns5/bl.db
+  echo "; rewrite with some not entirely trivial patricia trees" >>ns5/bl.db
+  $PERL -e 'for ($val = 3; $val <= 65535; $val += 69) {
 	printf("32.%d.%d.168.192.rpz-ip  \tCNAME\t.\n",
 		$val%256, $val/256);
 	}' >>ns5/bl.db
@@ -173,8 +179,8 @@ cp ns6/bl.tld2s.db.in ns6/bl.tld2s.db
 
 # Run dnsrpzd to get the license and prime the static policy zones
 if test -n "$TEST_DNSRPS"; then
-   DNSRPZD="$(../rpz/dnsrps -p)"
-   cd ns3
-   "$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \
-             -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
+  DNSRPZD="$(../rpz/dnsrps -p)"
+  cd ns3
+  "$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \
+    -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
 fi
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 738df3c..381c025 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -20,16 +20,16 @@ SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
 ns=10.53.0
-ns1=$ns.1		# root, defining the others
-ns2=$ns.2		# authoritative server whose records are rewritten
-ns3=$ns.3		# main rewriting resolver
-ns4=$ns.4		# another authoritative server that is rewritten
-ns5=$ns.5		# another rewriting resolver
-ns6=$ns.6		# a forwarding server
-ns7=$ns.7		# another rewriting resolver
-ns8=$ns.8		# another rewriting resolver
-ns9=$ns.9		# another rewriting resolver
-ns10=$ns.10		# authoritative server
+ns1=$ns.1   # root, defining the others
+ns2=$ns.2   # authoritative server whose records are rewritten
+ns3=$ns.3   # main rewriting resolver
+ns4=$ns.4   # another authoritative server that is rewritten
+ns5=$ns.5   # another rewriting resolver
+ns6=$ns.6   # a forwarding server
+ns7=$ns.7   # another rewriting resolver
+ns8=$ns.8   # another rewriting resolver
+ns9=$ns.9   # another rewriting resolver
+ns10=$ns.10 # authoritative server
 
 HAVE_CORE=
 
@@ -42,118 +42,128 @@ ARGS=
 
 USAGE="$0: [-xS]"
 while getopts "xS:" c; do
-    case $c in
-	x) set -x; DEBUG=-x; ARGS="$ARGS -x";;
-	S) SAVE_RESULTS=-S; ARGS="$ARGS -S";;
-	*) echo "$USAGE" 1>&2; exit 1;;
-    esac
+  case $c in
+    x)
+      set -x
+      DEBUG=-x
+      ARGS="$ARGS -x"
+      ;;
+    S)
+      SAVE_RESULTS=-S
+      ARGS="$ARGS -S"
+      ;;
+    *)
+      echo "$USAGE" 1>&2
+      exit 1
+      ;;
+  esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $(expr $OPTIND - 1 || true)
 if test "$#" -ne 0; then
-    echo "$USAGE" 1>&2
-    exit 1
+  echo "$USAGE" 1>&2
+  exit 1
 fi
 # really quit on control-C
 trap 'exit 1' 1 2 15
 
 TS='%H:%M:%S '
 TS=
-comment () {
-    if test -n "$TS"; then
-	date "+${TS}$*" | cat_i
-    fi
+comment() {
+  if test -n "$TS"; then
+    date "+${TS}$*" | cat_i
+  fi
 }
 
 DNSRPSCMD=./dnsrps
 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 
 if test -x "$DNSRPSCMD"; then
-    # speed up the many delays for dnsrpzd by waiting only 0.1 seconds
-    WAIT_CMD="$DNSRPSCMD -w 0.1"
-    TEN_SECS=100
+  # speed up the many delays for dnsrpzd by waiting only 0.1 seconds
+  WAIT_CMD="$DNSRPSCMD -w 0.1"
+  TEN_SECS=100
 else
-    WAIT_CMD="sleep 1"
-    TEN_SECS=10
+  WAIT_CMD="sleep 1"
+  TEN_SECS=10
 fi
 
-digcmd () {
-    if test "$1" = TCP; then
-	shift
-    fi
-    # Default to +noauth and @$ns3
-    # Also default to -bX where X is the @value so that OS X will choose
-    #	    the right IP source address.
-    digcmd_args=`echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" |	\
-	    sed -e "/@/!s/.*/& @$ns3/"					\
-		-e '/-b/!s/@\([^ ]*\)/@\1 -b\1/'			\
-		-e '/+n?o?auth/!s/.*/+noauth &/'`
-    #echo_i "dig $digcmd_args 1>&2
-    $DIG $digcmd_args
+digcmd() {
+  if test "$1" = TCP; then
+    shift
+  fi
+  # Default to +noauth and @$ns3
+  # Also default to -bX where X is the @value so that OS X will choose
+  #	    the right IP source address.
+  digcmd_args=$(echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" \
+    | sed -e "/@/!s/.*/& @$ns3/" \
+      -e '/-b/!s/@\([^ ]*\)/@\1 -b\1/' \
+      -e '/+n?o?auth/!s/.*/+noauth &/')
+  #echo_i "dig $digcmd_args 1>&2
+  $DIG $digcmd_args
 }
 
 # set DIGNM=file name for dig output
 GROUP_NM=
 TEST_NUM=0
-make_dignm () {
-    TEST_NUM=`expr $TEST_NUM : '\([0-9]*\).*'`	    # trim '+' characters
-    TEST_NUM=`expr $TEST_NUM + 1`
+make_dignm() {
+  TEST_NUM=$(expr $TEST_NUM : '\([0-9]*\).*') # trim '+' characters
+  TEST_NUM=$(expr $TEST_NUM + 1)
+  DIGNM=dig.out$GROUP_NM-$TEST_NUM
+  while test -f $DIGNM; do
+    TEST_NUM="$TEST_NUM+"
     DIGNM=dig.out$GROUP_NM-$TEST_NUM
-    while test -f $DIGNM; do
-	TEST_NUM="$TEST_NUM+"
-	DIGNM=dig.out$GROUP_NM-$TEST_NUM
-    done
+  done
 }
 
-setret () {
-    ret=1
-    status=`expr $status + 1`
-    echo_i "$*"
+setret() {
+  ret=1
+  status=$(expr $status + 1)
+  echo_i "$*"
 }
 
 # set $SN to the SOA serial number of a zone
 # $1=domain
 # $2=DNS server and client IP address
 get_sn() {
-    SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
-    SN=`expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*'`
-    test "$SN" != "" && return
-    echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
-    exit 1
+  SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2")
+  SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*')
+  test "$SN" != "" && return
+  echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
+  exit 1
 }
 
-get_sn_fast () {
-    RSN=`$DNSRPSCMD -n "$1"`
-    #echo "dnsrps serial for $1 is $RSN"
-    if test -z "$RSN"; then
-	echo_i "dnsrps failed to get SOA serial number for $1"
-	exit 1
-    fi
+get_sn_fast() {
+  RSN=$($DNSRPSCMD -n "$1")
+  #echo "dnsrps serial for $1 is $RSN"
+  if test -z "$RSN"; then
+    echo_i "dnsrps failed to get SOA serial number for $1"
+    exit 1
+  fi
 }
 
 # check that dnsrpzd has loaded its zones
 # $1=domain
 # $2=DNS server IP address
-FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
+FZONES=$(sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf)
 dnsrps_loaded() {
-    test "$mode" = dnsrps || return
-    n=0
-    for V in $FZONES; do
-	eval "$V"
-	get_sn $Z $M
-	while true; do
-	    get_sn_fast "$Z"
-	    if test "$SN" -eq "0$RSN"; then
-		#echo "$Z @$M serial=$SN"
-		break
-	    fi
-	    n=`expr $n + 1`
-	    if test "$n" -gt $TEN_SECS; then
-		echo_i "dnsrps serial for $Z is $RSN instead of $SN"
-		exit 1
-	    fi
-	    $WAIT_CMD
-	done
+  test "$mode" = dnsrps || return
+  n=0
+  for V in $FZONES; do
+    eval "$V"
+    get_sn $Z $M
+    while true; do
+      get_sn_fast "$Z"
+      if test "$SN" -eq "0$RSN"; then
+        #echo "$Z @$M serial=$SN"
+        break
+      fi
+      n=$(expr $n + 1)
+      if test "$n" -gt $TEN_SECS; then
+        echo_i "dnsrps serial for $Z is $RSN instead of $SN"
+        exit 1
+      fi
+      $WAIT_CMD
     done
+  done
 }
 
 # check the serial number in an SOA to ensure that a policy zone has
@@ -162,215 +172,215 @@ dnsrps_loaded() {
 # $2=domain
 # $3=DNS server
 ck_soa() {
-    n=0
-    while true; do
-	if test "$mode" = dnsrps; then
-	    get_sn_fast "$2"
-	    test "$RSN" -eq "$1" && return
-	else
-	    get_sn "$2" "$3"
-	    test "$SN" -eq "$1" && return
-	fi
-	n=`expr $n + 1`
-	if test "$n" -gt $TEN_SECS; then
-	    echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3"
-	    return
-	fi
-	$WAIT_CMD
-    done
+  n=0
+  while true; do
+    if test "$mode" = dnsrps; then
+      get_sn_fast "$2"
+      test "$RSN" -eq "$1" && return
+    else
+      get_sn "$2" "$3"
+      test "$SN" -eq "$1" && return
+    fi
+    n=$(expr $n + 1)
+    if test "$n" -gt $TEN_SECS; then
+      echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3"
+      return
+    fi
+    $WAIT_CMD
+  done
 }
 
 # (re)load the response policy zones with the rules in the file $TEST_FILE
-load_db () {
-    if test -n "$TEST_FILE"; then
-        copy_setports $TEST_FILE tmp
-	if $NSUPDATE -v tmp; then :
-	    $RNDCCMD $ns3 sync
-	else
-	    echo_i "failed to update policy zone with $TEST_FILE"
-	    $RNDCCMD $ns3 sync
-	    exit 1
-	fi
-        rm -f tmp
+load_db() {
+  if test -n "$TEST_FILE"; then
+    copy_setports $TEST_FILE tmp
+    if $NSUPDATE -v tmp; then
+      :
+      $RNDCCMD $ns3 sync
+    else
+      echo_i "failed to update policy zone with $TEST_FILE"
+      $RNDCCMD $ns3 sync
+      exit 1
     fi
+    rm -f tmp
+  fi
 }
 
 # restart name server
 # $1 ns number
 # $2 rebuild bl rpz zones if "rebuild-bl-rpz"
-restart () {
-    # try to ensure that the server really has stopped
-    # and won't mess with ns$1/name.pid
-    if test -z "$HAVE_CORE" -a -f ns$1/named.pid; then
-	$RNDCCMD $ns$1 halt >/dev/null 2>&1
-	if test -f ns$1/named.pid; then
-	    sleep 1
-	    PID=`cat ns$1/named.pid 2>/dev/null`
-	    if test -n "$PID"; then
-		echo_i "killing ns$1 server $PID"
-		$KILL -9 $PID
-	    fi
-	fi
+restart() {
+  # try to ensure that the server really has stopped
+  # and won't mess with ns$1/name.pid
+  if test -z "$HAVE_CORE" -a -f ns$1/named.pid; then
+    $RNDCCMD $ns$1 halt >/dev/null 2>&1
+    if test -f ns$1/named.pid; then
+      sleep 1
+      PID=$(cat ns$1/named.pid 2>/dev/null)
+      if test -n "$PID"; then
+        echo_i "killing ns$1 server $PID"
+        $KILL -9 $PID
+      fi
     fi
-    rm -f ns$1/*.jnl
-    if [ "$2" = "rebuild-bl-rpz" ]; then
-        if test -f ns$1/base.db; then
-	    for NM in ns$1/bl*.db; do
-	        cp -f ns$1/base.db $NM
-            done
-        fi
+  fi
+  rm -f ns$1/*.jnl
+  if [ "$2" = "rebuild-bl-rpz" ]; then
+    if test -f ns$1/base.db; then
+      for NM in ns$1/bl*.db; do
+        cp -f ns$1/base.db $NM
+      done
     fi
-    start_server --noclean --restart --port ${PORT} ns$1
-    load_db
-    dnsrps_loaded
-    sleep 1
+  fi
+  start_server --noclean --restart --port ${PORT} ns$1
+  load_db
+  dnsrps_loaded
+  sleep 1
 }
 
 # $1=server and irrelevant args
 # $2=error message
-ckalive () {
-    CKALIVE_NS=`expr "$1" : '.*@ns\([1-9]\).*'`
-    if test -z "$CKALIVE_NS"; then
-	CKALIVE_NS=3
-    fi
-    eval CKALIVE_IP=\$ns$CKALIVE_NS
-    $RNDCCMD $CKALIVE_IP status >/dev/null 2>&1 && return 0
-    HAVE_CORE=yes
-    setret "$2"
-    # restart the server to avoid stalling waiting for it to stop
-    restart $CKALIVE_NS "rebuild-bl-rpz"
-    return 1
+ckalive() {
+  CKALIVE_NS=$(expr "$1" : '.*@ns\([1-9]\).*')
+  if test -z "$CKALIVE_NS"; then
+    CKALIVE_NS=3
+  fi
+  eval CKALIVE_IP=\$ns$CKALIVE_NS
+  $RNDCCMD $CKALIVE_IP status >/dev/null 2>&1 && return 0
+  HAVE_CORE=yes
+  setret "$2"
+  # restart the server to avoid stalling waiting for it to stop
+  restart $CKALIVE_NS "rebuild-bl-rpz"
+  return 1
 }
 
-resetstats () {
-        NSDIR=$1
-        eval "${NSDIR}_CNT=''"
+resetstats() {
+  NSDIR=$1
+  eval "${NSDIR}_CNT=''"
 }
 
-ckstats () {
-    HOST=$1
-    LABEL="$2"
-    NSDIR="$3"
-    EXPECTED="$4"
-    $RNDCCMD $HOST stats
-    NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
-		    $NSDIR/named.stats | tail -1`
-    eval "OLD_CNT=0\$${NSDIR}_CNT"
-    GOT=`expr $NEW_CNT - $OLD_CNT`
-    if test "$GOT" -ne "$EXPECTED"; then
-	setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED"
-    fi
-    eval "${NSDIR}_CNT=$NEW_CNT"
+ckstats() {
+  HOST=$1
+  LABEL="$2"
+  NSDIR="$3"
+  EXPECTED="$4"
+  $RNDCCMD $HOST stats
+  NEW_CNT=0$(sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p' \
+    $NSDIR/named.stats | tail -1)
+  eval "OLD_CNT=0\$${NSDIR}_CNT"
+  GOT=$(expr $NEW_CNT - $OLD_CNT)
+  if test "$GOT" -ne "$EXPECTED"; then
+    setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED"
+  fi
+  eval "${NSDIR}_CNT=$NEW_CNT"
 }
 
-ckstatsrange () {
-    HOST=$1
-    LABEL="$2"
-    NSDIR="$3"
-    MIN="$4"
-    MAX="$5"
-    $RNDCCMD $HOST stats
-    NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
-		    $NSDIR/named.stats | tail -1`
-    eval "OLD_CNT=0\$${NSDIR}_CNT"
-    GOT=`expr $NEW_CNT - $OLD_CNT`
-    if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then
-	setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}"
-    fi
-    eval "${NSDIR}_CNT=$NEW_CNT"
+ckstatsrange() {
+  HOST=$1
+  LABEL="$2"
+  NSDIR="$3"
+  MIN="$4"
+  MAX="$5"
+  $RNDCCMD $HOST stats
+  NEW_CNT=0$(sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p' \
+    $NSDIR/named.stats | tail -1)
+  eval "OLD_CNT=0\$${NSDIR}_CNT"
+  GOT=$(expr $NEW_CNT - $OLD_CNT)
+  if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then
+    setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}"
+  fi
+  eval "${NSDIR}_CNT=$NEW_CNT"
 }
 
 # $1=message
 # $2=optional test file name
-start_group () {
-    ret=0
-    t=`expr $t + 1`
-    test -n "$1" && date "+${TS}checking $1 (${t})" | cat_i
-    TEST_FILE=$2
-    if test -n "$TEST_FILE"; then
-	GROUP_NM="-$TEST_FILE"
-	load_db
-    else
-	GROUP_NM=
-    fi
-    dnsrps_loaded
-    TEST_NUM=0
+start_group() {
+  ret=0
+  t=$(expr $t + 1)
+  test -n "$1" && date "+${TS}checking $1 (${t})" | cat_i
+  TEST_FILE=$2
+  if test -n "$TEST_FILE"; then
+    GROUP_NM="-$TEST_FILE"
+    load_db
+  else
+    GROUP_NM=
+  fi
+  dnsrps_loaded
+  TEST_NUM=0
 }
 
-end_group () {
-    if test -n "$TEST_FILE"; then
-	# remove the previous set of test rules
-        copy_setports $TEST_FILE tmp
-	sed -e 's/[	 ]add[	 ]/ delete /' tmp | $NSUPDATE
-        rm -f tmp
-	TEST_FILE=
-    fi
-    ckalive $ns3 "failed; ns3 server crashed and restarted"
-    dnsrps_loaded
-    GROUP_NM=
+end_group() {
+  if test -n "$TEST_FILE"; then
+    # remove the previous set of test rules
+    copy_setports $TEST_FILE tmp
+    sed -e 's/[	 ]add[	 ]/ delete /' tmp | $NSUPDATE
+    rm -f tmp
+    TEST_FILE=
+  fi
+  ckalive $ns3 "failed; ns3 server crashed and restarted"
+  dnsrps_loaded
+  GROUP_NM=
 }
 
-clean_result () {
-    if test -z "$SAVE_RESULTS"; then
-	rm -f $*
-    fi
+clean_result() {
+  if test -z "$SAVE_RESULTS"; then
+    rm -f $*
+  fi
 }
 
 # $1=dig args
 # $2=other dig output file
-ckresult () {
-    #ckalive "$1" "server crashed by 'dig $1'" || return 1
-    expr "$1" : 'TCP ' > /dev/null && tcp=1 || tcp=0
-    digarg=${1#TCP }
-
-    if grep "flags:.* aa .*ad;" $DIGNM; then
-	setret "'dig $digarg' AA and AD set;"
-    elif grep "flags:.* aa .*ad;" $DIGNM; then
-	setret "'dig $digarg' AD set;"
-    fi
+ckresult() {
+  #ckalive "$1" "server crashed by 'dig $1'" || return 1
+  expr "$1" : 'TCP ' >/dev/null && tcp=1 || tcp=0
+  digarg=${1#TCP }
+
+  if grep "flags:.* aa .*ad;" $DIGNM; then
+    setret "'dig $digarg' AA and AD set;"
+  elif grep "flags:.* aa .*ad;" $DIGNM; then
+    setret "'dig $digarg' AD set;"
+  fi
 
-    if $PERL $SYSTEMTESTTOP/digcomp.pl $DIGNM $2 >/dev/null; then
-	grep -q 'Truncated, retrying in TCP' $DIGNM && trunc=1 || trunc=0
-	if [ "$tcp" -ne "$trunc" ]; then
-	    setret "'dig $digarg' wrong; no or unexpected truncation in $DIGNM"
-	    return 1
-	fi
-	clean_result ${DIGNM}*
-	return 0
+  if $PERL $SYSTEMTESTTOP/digcomp.pl $DIGNM $2 >/dev/null; then
+    grep -q 'Truncated, retrying in TCP' $DIGNM && trunc=1 || trunc=0
+    if [ "$tcp" -ne "$trunc" ]; then
+      setret "'dig $digarg' wrong; no or unexpected truncation in $DIGNM"
+      return 1
     fi
-    setret "'dig $digarg' wrong; diff $DIGNM $2"
-    return 1
+    clean_result ${DIGNM}*
+    return 0
+  fi
+  setret "'dig $digarg' wrong; diff $DIGNM $2"
+  return 1
 }
 
 # check only that the server does not crash
 # $1=target domain
 # $2=optional query type
-nocrash () {
-    digcmd $* >/dev/null
-    ckalive "$*" "server crashed by 'dig $*'"
+nocrash() {
+  digcmd $* >/dev/null
+  ckalive "$*" "server crashed by 'dig $*'"
 }
 
-
 # check rewrite to NXDOMAIN
 # $1=target domain
 # $2=optional query type
-nxdomain () {
-    make_dignm
-    digcmd $*								\
-	| sed -e 's/^[a-z].*	IN	CNAME	/;xxx &/'		\
-		-e 's/^[a-z].*	IN	RRSIG	/;xxx &/'		\
-	    >$DIGNM
-    ckresult "$*" proto.nxdomain
+nxdomain() {
+  make_dignm
+  digcmd $* \
+    | sed -e 's/^[a-z].*	IN	CNAME	/;xxx &/' \
+      -e 's/^[a-z].*	IN	RRSIG	/;xxx &/' \
+      >$DIGNM
+  ckresult "$*" proto.nxdomain
 }
 
 # check rewrite to NODATA
 # $1=target domain
 # $2=optional query type
-nodata () {
-    make_dignm
-    digcmd $*								\
-	| sed -e 's/^[a-z].*	IN	CNAME	/;xxx &/' >$DIGNM
-    ckresult "$*" proto.nodata
+nodata() {
+  make_dignm
+  digcmd $* \
+    | sed -e 's/^[a-z].*	IN	CNAME	/;xxx &/' >$DIGNM
+  ckresult "$*" proto.nodata
 }
 
 # check rewrite to an address
@@ -378,22 +388,22 @@ nodata () {
 # $1=IPv4 address
 # $2=digcmd args
 # $3=optional TTL
-addr () {
-    ADDR=$1
-    make_dignm
-    digcmd $2 >$DIGNM
-    #ckalive "$2" "server crashed by 'dig $2'" || return 1
-    ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'`
-    ADDR_TTL=`tr -d '\r' < $DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p"`
-    if test -z "$ADDR_TTL"; then
-	setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
-	return 1
-    fi
-    if test -n "$3" && test "$ADDR_TTL" -ne "$3"; then
-	setret "'dig $2' wrong; TTL=$ADDR_TTL instead of $3 in $DIGNM"
-	return 1
-    fi
-    clean_result ${DIGNM}*
+addr() {
+  ADDR=$1
+  make_dignm
+  digcmd $2 >$DIGNM
+  #ckalive "$2" "server crashed by 'dig $2'" || return 1
+  ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g')
+  ADDR_TTL=$(tr -d '\r' <$DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}$/\1/p")
+  if test -z "$ADDR_TTL"; then
+    setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
+    return 1
+  fi
+  if test -n "$3" && test "$ADDR_TTL" -ne "$3"; then
+    setret "'dig $2' wrong; TTL=$ADDR_TTL instead of $3 in $DIGNM"
+    return 1
+  fi
+  clean_result ${DIGNM}*
 }
 
 # Check that a response is not rewritten
@@ -401,43 +411,43 @@ addr () {
 #   spurious differences for `dig +norecurse`
 # $1=optional "TCP"
 # remaining args for dig
-nochange () {
-    make_dignm
-    digcmd $* >$DIGNM
-    digcmd $* @$ns1 >${DIGNM}_OK
-    ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
+nochange() {
+  make_dignm
+  digcmd $* >$DIGNM
+  digcmd $* @$ns1 >${DIGNM}_OK
+  ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
 }
 
-nochange_ns10 () {
-    make_dignm
-    digcmd $* >$DIGNM
-    digcmd $* @$ns10 >${DIGNM}_OK
-    ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
+nochange_ns10() {
+  make_dignm
+  digcmd $* >$DIGNM
+  digcmd $* @$ns10 >${DIGNM}_OK
+  ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
 }
 
 # check against a 'here document'
-here () {
-    make_dignm
-    sed -e 's/^[	 ]*//' >${DIGNM}_OK
-    digcmd $* >$DIGNM
-    ckresult "$*" ${DIGNM}_OK
+here() {
+  make_dignm
+  sed -e 's/^[	 ]*//' >${DIGNM}_OK
+  digcmd $* >$DIGNM
+  ckresult "$*" ${DIGNM}_OK
 }
 
 # check dropped response
 DROPPED='^;; connection timed out; no servers could be reached'
-drop () {
-    make_dignm
-    digcmd $* >$DIGNM
-    if grep "$DROPPED" $DIGNM >/dev/null; then
-	clean_result ${DIGNM}*
-	return 0
-    fi
-    setret "'dig $1' wrong; response in $DIGNM"
-    return 1
+drop() {
+  make_dignm
+  digcmd $* >$DIGNM
+  if grep "$DROPPED" $DIGNM >/dev/null; then
+    clean_result ${DIGNM}*
+    return 0
+  fi
+  setret "'dig $1' wrong; response in $DIGNM"
+  return 1
 }
 
 nsd() {
-  $NSUPDATE -p ${PORT} << EOF
+  $NSUPDATE -p ${PORT} <<EOF
   server $1
   ttl 300
   update $2 $3 IN CNAME .
@@ -468,39 +478,39 @@ make_proto_nodata() {
 for mode in native dnsrps; do
   status=0
   case ${mode} in
-  native)
-    if [ -e dnsrps-only ] ; then
-      echo_i "'dnsrps-only' found: skipping native RPZ sub-test"
-      continue
-    else
-      echo_i "running native RPZ sub-test"
-    fi
-    ;;
-  dnsrps)
-    if [ -e dnsrps-off ] ; then
-      echo_i "'dnsrps-off' found: skipping DNSRPS sub-test"
-      continue
-    fi
-    echo_i "attempting to configure servers with DNSRPS..."
-    stop_server --use-rndc --port ${CONTROLPORT}
-    $SHELL ./setup.sh -N -D $DEBUG
-    for server in ns*; do
-      resetstats $server
-    done
-    sed -n 's/^## //p' dnsrps.conf | cat_i
-    if grep '^#fail' dnsrps.conf >/dev/null; then
-      echo_i "exit status: 1"
-      exit 1
-    fi
-    if grep '^#skip' dnsrps.conf > /dev/null; then
-      echo_i "DNSRPS sub-test skipped"
-      continue
-    else
-      echo_i "running DNSRPS sub-test"
-      start_server --noclean --restart --port ${PORT}
-      sleep 3
-    fi
-    ;;
+    native)
+      if [ -e dnsrps-only ]; then
+        echo_i "'dnsrps-only' found: skipping native RPZ sub-test"
+        continue
+      else
+        echo_i "running native RPZ sub-test"
+      fi
+      ;;
+    dnsrps)
+      if [ -e dnsrps-off ]; then
+        echo_i "'dnsrps-off' found: skipping DNSRPS sub-test"
+        continue
+      fi
+      echo_i "attempting to configure servers with DNSRPS..."
+      stop_server --use-rndc --port ${CONTROLPORT}
+      $SHELL ./setup.sh -N -D $DEBUG
+      for server in ns*; do
+        resetstats $server
+      done
+      sed -n 's/^## //p' dnsrps.conf | cat_i
+      if grep '^#fail' dnsrps.conf >/dev/null; then
+        echo_i "exit status: 1"
+        exit 1
+      fi
+      if grep '^#skip' dnsrps.conf >/dev/null; then
+        echo_i "DNSRPS sub-test skipped"
+        continue
+      else
+        echo_i "running DNSRPS sub-test"
+        start_server --noclean --restart --port ${PORT}
+        sleep 3
+      fi
+      ;;
   esac
 
   # make prototype files to check against rewritten results
@@ -508,104 +518,104 @@ for mode in native dnsrps; do
   retry_quiet 10 make_proto_nodata
 
   start_group "QNAME rewrites" test1
-  nochange .					# 1 do not crash or rewrite root
-  nxdomain a0-1.tld2				# 2
-  nodata a3-1.tld2				# 3
-  nodata a3-2.tld2				# 4 nodata at DNAME itself
-  nochange sub.a3-2.tld2			# 5 miss where DNAME might work
-  nxdomain a4-2.tld2				# 6 rewrite based on CNAME target
-  nxdomain a4-2-cname.tld2			# 7
-  nodata a4-3-cname.tld2			# 8
-  addr 12.12.12.12  a4-1.sub1.tld2		# 9 A replacement
-  addr 12.12.12.12  a4-1.sub2.tld2		# 10 A replacement with wildcard
-  addr 12.12.12.12  nxc1.sub1.tld2		# 11 replace NXDOMAIN with CNAME
-  addr 12.12.12.12  nxc2.sub1.tld2		# 12 replace NXDOMAIN with CNAME chain
-  addr 127.4.4.1    a4-4.tld2			# 13 prefer 1st conflicting QNAME zone
-  nochange a6-1.tld2				# 14
-  addr 127.6.2.1    a6-2.tld2			# 15
-  addr 56.56.56.56  a3-6.tld2			# 16 wildcard CNAME
-  addr 57.57.57.57  a3-7.sub1.tld2		# 17 wildcard CNAME
-  addr 127.0.0.16   a4-5-cname3.tld2		# 18 CNAME chain
-  addr 127.0.0.17   a4-6-cname3.tld2		# 19 stop short in CNAME chain
-  nochange a5-2.tld2 +norecurse			# 20 check that RD=1 is required
-  nochange a5-3.tld2 +norecurse			# 21
-  nochange a5-4.tld2 +norecurse			# 22
-  nochange sub.a5-4.tld2 +norecurse		# 23
-  nxdomain c1.crash2.tld3			# 24 assert in rbtdb.c
-  nxdomain a0-1.tld2  +dnssec			# 25 simple DO=1 without signatures
-  nxdomain a0-1.tld2s +nodnssec			# 26 simple DO=0 with signatures
-  nochange a0-1.tld2s +dnssec			# 27 simple DO=1 with signatures
-  nxdomain a0-1s-cname.tld2s +dnssec		# 28 DNSSEC too early in CNAME chain
-  nochange a0-1-scname.tld2  +dnssec		# 29 DNSSEC on target in CNAME chain
-  nochange a0-1.tld2s srv +auth +dnssec		# 30 no write for DNSSEC and no record
-  nxdomain a0-1.tld2s srv +nodnssec		# 31
-  drop a3-8.tld2 any				# 32 drop
-  nochange TCP a3-9.tld2			# 33 tcp-only
-  here x.servfail <<'EOF'			# 34 qname-wait-recurse yes
+  nochange .                            # 1 do not crash or rewrite root
+  nxdomain a0-1.tld2                    # 2
+  nodata a3-1.tld2                      # 3
+  nodata a3-2.tld2                      # 4 nodata at DNAME itself
+  nochange sub.a3-2.tld2                # 5 miss where DNAME might work
+  nxdomain a4-2.tld2                    # 6 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2              # 7
+  nodata a4-3-cname.tld2                # 8
+  addr 12.12.12.12 a4-1.sub1.tld2       # 9 A replacement
+  addr 12.12.12.12 a4-1.sub2.tld2       # 10 A replacement with wildcard
+  addr 12.12.12.12 nxc1.sub1.tld2       # 11 replace NXDOMAIN with CNAME
+  addr 12.12.12.12 nxc2.sub1.tld2       # 12 replace NXDOMAIN with CNAME chain
+  addr 127.4.4.1 a4-4.tld2              # 13 prefer 1st conflicting QNAME zone
+  nochange a6-1.tld2                    # 14
+  addr 127.6.2.1 a6-2.tld2              # 15
+  addr 56.56.56.56 a3-6.tld2            # 16 wildcard CNAME
+  addr 57.57.57.57 a3-7.sub1.tld2       # 17 wildcard CNAME
+  addr 127.0.0.16 a4-5-cname3.tld2      # 18 CNAME chain
+  addr 127.0.0.17 a4-6-cname3.tld2      # 19 stop short in CNAME chain
+  nochange a5-2.tld2 +norecurse         # 20 check that RD=1 is required
+  nochange a5-3.tld2 +norecurse         # 21
+  nochange a5-4.tld2 +norecurse         # 22
+  nochange sub.a5-4.tld2 +norecurse     # 23
+  nxdomain c1.crash2.tld3               # 24 assert in rbtdb.c
+  nxdomain a0-1.tld2 +dnssec            # 25 simple DO=1 without signatures
+  nxdomain a0-1.tld2s +nodnssec         # 26 simple DO=0 with signatures
+  nochange a0-1.tld2s +dnssec           # 27 simple DO=1 with signatures
+  nxdomain a0-1s-cname.tld2s +dnssec    # 28 DNSSEC too early in CNAME chain
+  nochange a0-1-scname.tld2 +dnssec     # 29 DNSSEC on target in CNAME chain
+  nochange a0-1.tld2s srv +auth +dnssec # 30 no write for DNSSEC and no record
+  nxdomain a0-1.tld2s srv +nodnssec     # 31
+  drop a3-8.tld2 any                    # 32 drop
+  nochange TCP a3-9.tld2                # 33 tcp-only
+  here x.servfail <<'EOF'               # 34 qname-wait-recurse yes
     ;; status: SERVFAIL, x
 EOF
-  addr 35.35.35.35 "x.servfail @$ns5"		# 35 qname-wait-recurse no
+  addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no
   end_group
   ckstats $ns3 test1 ns3 22
   ckstats $ns5 test1 ns5 1
   ckstats $ns6 test1 ns6 0
 
   start_group "NXDOMAIN/NODATA action on QNAME trigger" test1
-  nxdomain a0-1.tld2 @$ns6			# 1
-  nodata a3-1.tld2 @$ns6			# 2
-  nodata a3-2.tld2 @$ns6			# 3 nodata at DNAME itself
-  nxdomain a4-2.tld2 @$ns6			# 4 rewrite based on CNAME target
-  nxdomain a4-2-cname.tld2 @$ns6		# 5
-  nodata a4-3-cname.tld2 @$ns6			# 6
-  addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"	# 7 A replacement
-  addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"	# 8 A replacement with wildcard
-  addr 127.4.4.1    "a4-4.tld2 @$ns6"		# 9 prefer 1st conflicting QNAME zone
-  addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"	# 10 replace NXDOMAIN w/ CNAME
-  addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"	# 11 replace NXDOMAIN w/ CNAME chain
-  addr 127.6.2.1    "a6-2.tld2 @$ns6"		# 12
-  addr 56.56.56.56  "a3-6.tld2 @$ns6"		# 13 wildcard CNAME
-  addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"	# 14 wildcard CNAME
-  addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6"	# 15 CNAME chain
-  addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6"	# 16 stop short in CNAME chain
-  nxdomain c1.crash2.tld3 @$ns6			# 17 assert in rbtdb.c
-  nxdomain a0-1.tld2 +dnssec @$ns6		# 18 simple DO=1 without sigs
-  nxdomain a0-1s-cname.tld2s  +dnssec @$ns6	# 19
-  drop a3-8.tld2 any @$ns6			# 20 drop
+  nxdomain a0-1.tld2 @$ns6                 # 1
+  nodata a3-1.tld2 @$ns6                   # 2
+  nodata a3-2.tld2 @$ns6                   # 3 nodata at DNAME itself
+  nxdomain a4-2.tld2 @$ns6                 # 4 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2 @$ns6           # 5
+  nodata a4-3-cname.tld2 @$ns6             # 6
+  addr 12.12.12.12 "a4-1.sub1.tld2 @$ns6"  # 7 A replacement
+  addr 12.12.12.12 "a4-1.sub2.tld2 @$ns6"  # 8 A replacement with wildcard
+  addr 127.4.4.1 "a4-4.tld2 @$ns6"         # 9 prefer 1st conflicting QNAME zone
+  addr 12.12.12.12 "nxc1.sub1.tld2 @$ns6"  # 10 replace NXDOMAIN w/ CNAME
+  addr 12.12.12.12 "nxc2.sub1.tld2 @$ns6"  # 11 replace NXDOMAIN w/ CNAME chain
+  addr 127.6.2.1 "a6-2.tld2 @$ns6"         # 12
+  addr 56.56.56.56 "a3-6.tld2 @$ns6"       # 13 wildcard CNAME
+  addr 57.57.57.57 "a3-7.sub1.tld2 @$ns6"  # 14 wildcard CNAME
+  addr 127.0.0.16 "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain
+  addr 127.0.0.17 "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain
+  nxdomain c1.crash2.tld3 @$ns6            # 17 assert in rbtdb.c
+  nxdomain a0-1.tld2 +dnssec @$ns6         # 18 simple DO=1 without sigs
+  nxdomain a0-1s-cname.tld2s +dnssec @$ns6 # 19
+  drop a3-8.tld2 any @$ns6                 # 20 drop
   end_group
   ckstatsrange $ns3 test1 ns3 22 30
   ckstats $ns5 test1 ns5 0
   ckstats $ns6 test1 ns6 0
 
   start_group "IP rewrites" test2
-  nodata a3-1.tld2				# 1 NODATA
-  nochange a3-2.tld2				# 2 no policy record so no change
-  nochange a4-1.tld2				# 3 obsolete PASSTHRU record style
-  nxdomain a4-2.tld2				# 4
-  nochange a4-2.tld2 -taaaa			# 5 no A => no policy rewrite
-  nochange a4-2.tld2 -ttxt			# 6 no A => no policy rewrite
-  nxdomain a4-2.tld2 -tany			# 7 no A => no policy rewrite
-  nodata a4-3.tld2				# 8
-  nxdomain a3-1.tld2 -taaaa			# 9 IPv6 policy
-  nochange a4-1-aaaa.tld2 -taaaa		# 10
-  addr 127.0.0.1 a5-1-2.tld2			# 11 prefer smallest policy address
-  addr 127.0.0.1 a5-3.tld2			# 12 prefer first conflicting IP zone
-  nochange a5-4.tld2 +norecurse			# 13 check that RD=1 is required for #14
-  addr 14.14.14.14 a5-4.tld2			# 14 prefer QNAME to IP
-  nochange a4-4.tld2				# 15 PASSTHRU
-  nxdomain c2.crash2.tld3			# 16 assert in rbtdb.c
-  addr 127.0.0.17 "a4-4.tld2 -b $ns1"		# 17 client-IP address trigger
-  nxdomain a7-1.tld2				# 18 secondary policy zone (RT34450)
+  nodata a3-1.tld2                    # 1 NODATA
+  nochange a3-2.tld2                  # 2 no policy record so no change
+  nochange a4-1.tld2                  # 3 obsolete PASSTHRU record style
+  nxdomain a4-2.tld2                  # 4
+  nochange a4-2.tld2 -taaaa           # 5 no A => no policy rewrite
+  nochange a4-2.tld2 -ttxt            # 6 no A => no policy rewrite
+  nxdomain a4-2.tld2 -tany            # 7 no A => no policy rewrite
+  nodata a4-3.tld2                    # 8
+  nxdomain a3-1.tld2 -taaaa           # 9 IPv6 policy
+  nochange a4-1-aaaa.tld2 -taaaa      # 10
+  addr 127.0.0.1 a5-1-2.tld2          # 11 prefer smallest policy address
+  addr 127.0.0.1 a5-3.tld2            # 12 prefer first conflicting IP zone
+  nochange a5-4.tld2 +norecurse       # 13 check that RD=1 is required for #14
+  addr 14.14.14.14 a5-4.tld2          # 14 prefer QNAME to IP
+  nochange a4-4.tld2                  # 15 PASSTHRU
+  nxdomain c2.crash2.tld3             # 16 assert in rbtdb.c
+  addr 127.0.0.17 "a4-4.tld2 -b $ns1" # 17 client-IP address trigger
+  nxdomain a7-1.tld2                  # 18 secondary policy zone (RT34450)
   # updating an response zone policy
   cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
   rndc_reload ns2 $ns2 bl.tld2
   ck_soa 2 bl.tld2 $ns3
-  nochange a7-1.tld2				# 19 PASSTHRU
+  nochange a7-1.tld2 # 19 PASSTHRU
   # ensure that a clock tick has occurred so that named will do the reload
   sleep 1
   cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
   rndc_reload ns2 $ns2 bl.tld2
   ck_soa 3 bl.tld2 $ns3
-  nxdomain a7-1.tld2				# 20 secondary policy zone (RT34450)
+  nxdomain a7-1.tld2 # 20 secondary policy zone (RT34450)
   end_group
   ckstats $ns3 test2 ns3 12
 
@@ -627,29 +637,29 @@ EOF
 
   # these tests assume "min-ns-dots 0"
   start_group "NSDNAME rewrites" test3
-  nextpart ns3/named.run > /dev/null
-  nochange a3-1.tld2				# 1
-  nochange a3-1.tld2 +dnssec			# 2 this once caused problems
-  nxdomain a3-1.sub1.tld2			# 3 NXDOMAIN *.sub1.tld2 by NSDNAME
-  nxdomain a3-1.subsub.sub1.tld2		# 4
-  nxdomain a3-1.subsub.sub1.tld2 -tany		# 5
-  addr 12.12.12.12 a4-2.subsub.sub2.tld2	# 6 walled garden for *.sub2.tld2
-  nochange a3-2.tld2.				# 7 exempt rewrite by name
-  nochange a0-1.tld2.				# 8 exempt rewrite by address block
-  addr 12.12.12.12 a4-1.tld2			# 9 prefer QNAME policy to NSDNAME
-  addr 127.0.0.1 a3-1.sub3.tld2			# 10 prefer policy for largest NSDNAME
-  addr 127.0.0.2 a3-1.subsub.sub3.tld2		# 11
-  nxdomain xxx.crash1.tld2			# 12 dns_db_detachnode() crash
-
-  nxdomain a3-1.stub				# 13
-  nxdomain a3-1.static-stub			# 14
-  nochange_ns10 a3-1.stub-nomatch		# 15
-  nochange_ns10 a3-1.static-stub-nomatch	# 16
+  nextpart ns3/named.run >/dev/null
+  nochange a3-1.tld2                     # 1
+  nochange a3-1.tld2 +dnssec             # 2 this once caused problems
+  nxdomain a3-1.sub1.tld2                # 3 NXDOMAIN *.sub1.tld2 by NSDNAME
+  nxdomain a3-1.subsub.sub1.tld2         # 4
+  nxdomain a3-1.subsub.sub1.tld2 -tany   # 5
+  addr 12.12.12.12 a4-2.subsub.sub2.tld2 # 6 walled garden for *.sub2.tld2
+  nochange a3-2.tld2.                    # 7 exempt rewrite by name
+  nochange a0-1.tld2.                    # 8 exempt rewrite by address block
+  addr 12.12.12.12 a4-1.tld2             # 9 prefer QNAME policy to NSDNAME
+  addr 127.0.0.1 a3-1.sub3.tld2          # 10 prefer policy for largest NSDNAME
+  addr 127.0.0.2 a3-1.subsub.sub3.tld2   # 11
+  nxdomain xxx.crash1.tld2               # 12 dns_db_detachnode() crash
+
+  nxdomain a3-1.stub                     # 13
+  nxdomain a3-1.static-stub              # 14
+  nochange_ns10 a3-1.stub-nomatch        # 15
+  nochange_ns10 a3-1.static-stub-nomatch # 16
   if [ "$mode" = dnsrps ]; then
-    addr 12.12.12.12 as-ns.tld5.		# 17 qname-as-ns
+    addr 12.12.12.12 as-ns.tld5. # 17 qname-as-ns
   fi
-  nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
-  setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
+  nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" \
+    && setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
   end_group
   if [ "$mode" = dnsrps ]; then
     ckstats $ns3 test3 ns3 10
@@ -659,26 +669,26 @@ EOF
 
   # these tests assume "min-ns-dots 0"
   start_group "NSIP rewrites" test4
-  nextpart ns3/named.run > /dev/null
-  nxdomain a3-1.tld2				# 1 NXDOMAIN for all of tld2
-  nochange a3-2.tld2.				# 2 exempt rewrite by name
-  nochange a0-1.tld2.				# 3 exempt rewrite by address block
-  nochange a3-1.tld4				# 4 different NS IP address
-  nxdomain a4-1.stub				# 5
-  nxdomain a4-1.static-stub			# 6
-  nochange_ns10 a4-1.stub-nomatch		# 7
-  nochange_ns10 a4-1.static-stub-nomatch	# 8
+  nextpart ns3/named.run >/dev/null
+  nxdomain a3-1.tld2                     # 1 NXDOMAIN for all of tld2
+  nochange a3-2.tld2.                    # 2 exempt rewrite by name
+  nochange a0-1.tld2.                    # 3 exempt rewrite by address block
+  nochange a3-1.tld4                     # 4 different NS IP address
+  nxdomain a4-1.stub                     # 5
+  nxdomain a4-1.static-stub              # 6
+  nochange_ns10 a4-1.stub-nomatch        # 7
+  nochange_ns10 a4-1.static-stub-nomatch # 8
   if [ "$mode" = dnsrps ]; then
-      addr 12.12.12.12 as-ns.tld5.		# 9 ip-as-ns
+    addr 12.12.12.12 as-ns.tld5. # 9 ip-as-ns
   fi
-  nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
-  setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
+  nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" \
+    && setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
   end_group
 
   start_group "walled garden NSIP rewrites" test4a
-  addr 41.41.41.41 a3-1.tld2			# 1 walled garden for all of tld2
-  addr 2041::41   'a3-1.tld2 AAAA'		# 2 walled garden for all of tld2
-  here a3-1.tld2 TXT <<'EOF'			# 3 text message for all of tld2
+  addr 41.41.41.41 a3-1.tld2     # 1 walled garden for all of tld2
+  addr 2041::41 'a3-1.tld2 AAAA' # 2 walled garden for all of tld2
+  here a3-1.tld2 TXT <<'EOF'     # 3 text message for all of tld2
     ;; status: NOERROR, x
     a3-1.tld2.	    x	IN	TXT   "NSIP walled garden"
 EOF
@@ -692,29 +702,29 @@ EOF
   # policies in ./test5 overridden by response-policy{} in ns3/named.conf
   # and in ns5/named.conf
   start_group "policy overrides" test5
-  addr 127.0.0.1 a3-1.tld2			# 1 bl-given
-  nochange a3-2.tld2				# 2 bl-passthru
-  nochange a3-3.tld2				# 3 bl-no-op (obsolete for passthru)
-  nochange a3-4.tld2				# 4 bl-disabled
-  nodata a3-5.tld2				# 5 bl-nodata zone recursive-only no
-  nodata a3-5.tld2 +norecurse			# 6 bl-nodata zone recursive-only no
-  nodata a3-5.tld2				# 7 bl-nodata not needed
-  nxdomain a3-5.tld2 +norecurse @$ns5		# 8 bl-nodata global recursive-only no
-  nxdomain a3-5.tld2s @$ns5			# 9 bl-nodata global break-dnssec
-  nxdomain a3-5.tld2s +dnssec @$ns5		# 10 bl-nodata global break-dnssec
-  nxdomain a3-6.tld2				# 11 bl-nxdomain
-  here a3-7.tld2 -tany <<'EOF'			# 12
+  addr 127.0.0.1 a3-1.tld2            # 1 bl-given
+  nochange a3-2.tld2                  # 2 bl-passthru
+  nochange a3-3.tld2                  # 3 bl-no-op (obsolete for passthru)
+  nochange a3-4.tld2                  # 4 bl-disabled
+  nodata a3-5.tld2                    # 5 bl-nodata zone recursive-only no
+  nodata a3-5.tld2 +norecurse         # 6 bl-nodata zone recursive-only no
+  nodata a3-5.tld2                    # 7 bl-nodata not needed
+  nxdomain a3-5.tld2 +norecurse @$ns5 # 8 bl-nodata global recursive-only no
+  nxdomain a3-5.tld2s @$ns5           # 9 bl-nodata global break-dnssec
+  nxdomain a3-5.tld2s +dnssec @$ns5   # 10 bl-nodata global break-dnssec
+  nxdomain a3-6.tld2                  # 11 bl-nxdomain
+  here a3-7.tld2 -tany <<'EOF'        # 12
     ;; status: NOERROR, x
     a3-7.tld2.	    x	IN	CNAME   txt-only.tld2.
     txt-only.tld2.  x	IN	TXT     "txt-only-tld2"
 EOF
-  addr 58.58.58.58 a3-8.tld2			# 13 bl_wildcname
-  addr 59.59.59.59 a3-9.sub9.tld2		# 14 bl_wildcname
-  addr 12.12.12.12 a3-15.tld2			# 15 bl-garden via CNAME to a12.tld2
-  addr 127.0.0.16 a3-16.tld2 100		# 16 bl	max-policy-ttl 100
-  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl max-policy-ttl 90
-  drop a3-18.tld2 any				# 18 bl-drop
-  nxdomain TCP a3-19.tld2			# 19 bl-tcp-only
+  addr 58.58.58.58 a3-8.tld2             # 13 bl_wildcname
+  addr 59.59.59.59 a3-9.sub9.tld2        # 14 bl_wildcname
+  addr 12.12.12.12 a3-15.tld2            # 15 bl-garden via CNAME to a12.tld2
+  addr 127.0.0.16 a3-16.tld2 100         # 16 bl	max-policy-ttl 100
+  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90 # 17 ns5 bl max-policy-ttl 90
+  drop a3-18.tld2 any                    # 18 bl-drop
+  nxdomain TCP a3-19.tld2                # 19 bl-tcp-only
   end_group
   ckstats $ns3 test5 ns3 12
   ckstats $ns5 test5 ns5 4
@@ -737,48 +747,48 @@ EOF
   ckstats $ns3 bugs ns3 8
 
   # superficial test for major performance bugs
-  QPERF=`sh qperf.sh`
+  QPERF=$(sh qperf.sh)
   if test -n "$QPERF"; then
-    perf () {
-	date "+${TS}checking performance $1" | cat_i
-	# Dry run to prime everything
-	comment "before dry run $1"
-	$RNDCCMD $ns5 notrace
-	$QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >/dev/null
-	comment "before real test $1"
-	PFILE="ns5/$2.perf"
-	$QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE
-	comment "after test $1"
-	X=`sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
-		| tr '\n' ' '`
-	if test "$X" != "$3"; then
-	    setret "wrong results '$X' in $PFILE"
-	fi
-	ckalive $ns5 "failed; server #5 crashed"
+    perf() {
+      date "+${TS}checking performance $1" | cat_i
+      # Dry run to prime everything
+      comment "before dry run $1"
+      $RNDCCMD $ns5 notrace
+      $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >/dev/null
+      comment "before real test $1"
+      PFILE="ns5/$2.perf"
+      $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE
+      comment "after test $1"
+      X=$(sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
+        | tr '\n' ' ')
+      if test "$X" != "$3"; then
+        setret "wrong results '$X' in $PFILE"
+      fi
+      ckalive $ns5 "failed; server #5 crashed"
     }
-    trim () {
-	sed -n -e 's/.*Queries per second: *\([0-9]*\).*/\1/p' ns5/$1.perf
+    trim() {
+      sed -n -e 's/.*Queries per second: *\([0-9]*\).*/\1/p' ns5/$1.perf
     }
 
     # get qps with rpz
     perf 'with RPZ' rpz 'NOERROR:2900 NXDOMAIN:100 '
-    RPZ=`trim rpz`
+    RPZ=$(trim rpz)
     # turn off rpz and measure qps again
     echo "# RPZ off" >ns5/rpz-switch
-    RNDCCMD_OUT=`$RNDCCMD $ns5 reload`
+    RNDCCMD_OUT=$($RNDCCMD $ns5 reload)
     perf 'without RPZ' norpz 'NOERROR:3000 '
-    NORPZ=`trim norpz`
+    NORPZ=$(trim norpz)
 
-    PERCENT=`expr \( "$RPZ" \* 100 + \( $NORPZ / 2 \) \) / $NORPZ`
+    PERCENT=$(expr \( "$RPZ" \* 100 + \( $NORPZ / 2 \) \) / $NORPZ)
     echo_i "$RPZ qps with RPZ is $PERCENT% of $NORPZ qps without RPZ"
 
     MIN_PERCENT=30
     if test "$PERCENT" -lt $MIN_PERCENT; then
-	echo_i "$RPZ qps with rpz or $PERCENT% is below $MIN_PERCENT% of $NORPZ qps"
+      echo_i "$RPZ qps with rpz or $PERCENT% is below $MIN_PERCENT% of $NORPZ qps"
     fi
 
     if test "$PERCENT" -ge 100; then
-	echo_i "$RPZ qps with RPZ or $PERCENT% of $NORPZ qps without RPZ is too high"
+      echo_i "$RPZ qps with RPZ or $PERCENT% of $NORPZ qps without RPZ is too high"
     fi
 
     ckstats $ns5 performance ns5 200
@@ -789,22 +799,22 @@ EOF
 
   if [ "$mode" = dnsrps ]; then
     echo_i "checking that dnsrpzd is automatically restarted"
-    OLD_PID=`cat dnsrpzd.pid`
+    OLD_PID=$(cat dnsrpzd.pid)
     $KILL "$OLD_PID"
     n=0
     while true; do
-	NEW_PID=`cat dnsrpzd.pid 2>/dev/null`
-	if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then
-	    #echo "OLD_PID=$OLD_PID  NEW_PID=$NEW_PID"
-	    break;
-	fi
-	$DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null
-	n=`expr $n + 1`
-	if test "$n" -gt $TEN_SECS; then
-	    setret "dnsrpzd did not restart"
-	    break
-	fi
-	$WAIT_CMD
+      NEW_PID=$(cat dnsrpzd.pid 2>/dev/null)
+      if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then
+        #echo "OLD_PID=$OLD_PID  NEW_PID=$NEW_PID"
+        break
+      fi
+      $DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null
+      n=$(expr $n + 1)
+      if test "$n" -gt $TEN_SECS; then
+        setret "dnsrpzd did not restart"
+        break
+      fi
+      $WAIT_CMD
     done
   fi
 
@@ -814,30 +824,30 @@ EOF
 
   # reconfigure the ns5 primary server without the fast-expire zone, so
   # it can't be refreshed on ns3, and will expire in 5 seconds.
-  cat /dev/null > ns5/expire.conf
+  cat /dev/null >ns5/expire.conf
   rndc_reconfig ns5 10.53.0.5
 
   # restart the main test RPZ server to see if that creates a core file
   if test -z "$HAVE_CORE"; then
     stop_server --use-rndc --port ${CONTROLPORT} ns3
     restart 3 "rebuild-bl-rpz"
-    HAVE_CORE=`find ns* -name '*core*' -print`
+    HAVE_CORE=$(find ns* -name '*core*' -print)
     test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
   fi
 
   # look for complaints from lib/dns/rpz.c and bin/name/query.c
   for runfile in ns*/named.run; do
-    EMSGS=`nextpart $runfile | grep -E -l 'invalid rpz|rpz.*failed'`
+    EMSGS=$(nextpart $runfile | grep -E -l 'invalid rpz|rpz.*failed')
     if test -n "$EMSGS"; then
       setret "error messages in $runfile starting with:"
-      grep -E 'invalid rpz|rpz.*failed' ns*/named.run | \
-              sed -e '10,$d' -e 's/^//' | cat_i
+      grep -E 'invalid rpz|rpz.*failed' ns*/named.run \
+        | sed -e '10,$d' -e 's/^//' | cat_i
     fi
   done
 
   if [ native = "$mode" ]; then
     # restart the main test RPZ server with a bad zone.
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking that ns3 with broken rpz does not crash (${t})"
     stop_server --use-rndc --port ${CONTROLPORT} ns3
     cp ns3/broken.db.in ns3/bl.db
@@ -846,54 +856,54 @@ EOF
     stop_server --use-rndc --port ${CONTROLPORT} ns3
     restart 3 "rebuild-bl-rpz"
 
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking if rpz survives a certain class of failed reconfiguration attempts (${t})"
-    sed -e "s/^#BAD//" < ns3/named.conf.in > ns3/named.conf.tmp
+    sed -e "s/^#BAD//" <ns3/named.conf.in >ns3/named.conf.tmp
     copy_setports ns3/named.conf.tmp ns3/named.conf
     rm ns3/named.conf.tmp
-    $RNDCCMD $ns3 reconfig > /dev/null 2>&1 && setret "failed"
+    $RNDCCMD $ns3 reconfig >/dev/null 2>&1 && setret "failed"
     sleep 1
     copy_setports ns3/named.conf.in ns3/named.conf
     $RNDCCMD $ns3 reconfig || setret "failed"
 
     # reload a RPZ zone that is now deliberately broken.
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking rpz failed update will keep previous rpz rules (${t})"
-    $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before
-    grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed"
+    $DIG -p ${PORT} @$ns3 walled.tld2 >dig.out.$t.before
+    grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before >/dev/null || setret "failed"
     cp ns3/broken.db.in ns3/manual-update-rpz.db
     rndc_reload ns3 $ns3 manual-update-rpz
     sleep 1
     # ensure previous RPZ rules still apply.
-    $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after
-    grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed"
+    $DIG -p ${PORT} @$ns3 walled.tld2 >dig.out.$t.after
+    grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after >/dev/null || setret "failed"
 
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking reload of a mixed-case RPZ zone (${t})"
     # First, a sanity check: the A6-2.TLD2.mixed-case-rpz RPZ record should
     # cause a6-2.tld2 NOERROR answers to be rewritten to NXDOMAIN answers.
-    $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t.before
+    $DIG -p ${PORT} @$ns3 a6-2.tld2. A >dig.out.$t.before
     grep "status: NXDOMAIN" dig.out.$t.before >/dev/null || setret "failed"
     # Add a sibling name (a6-1.tld2.mixed-case-rpz, with "tld2" in lowercase
     # rather than uppercase) before A6-2.TLD.mixed-case-rpz.
-    nextpart ns3/named.run > /dev/null
+    nextpart ns3/named.run >/dev/null
     cp ns3/mixed-case-rpz-2.db.in ns3/mixed-case-rpz.db
     rndc_reload ns3 $ns3 mixed-case-rpz
     wait_for_log 20 "rpz: mixed-case-rpz: reload done" ns3/named.run
     # a6-2.tld2 NOERROR answers should still be rewritten to NXDOMAIN answers.
     # (The bug we try to trigger here caused a6-2.tld2.mixed-case-rpz to be
     # erroneously removed from the summary RPZ database after reload.)
-    $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t.after
+    $DIG -p ${PORT} @$ns3 a6-2.tld2. A >dig.out.$t.after
     grep "status: NXDOMAIN" dig.out.$t.after >/dev/null || setret "failed"
   fi
 
-  t=`expr $t + 1`
+  t=$(expr $t + 1)
   echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
-  $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t
-  ttl=`awk '/a3-2 tld2 text/ {print $2}' dig.out.$t`
+  $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 >dig.out.$t
+  ttl=$(awk '/a3-2 tld2 text/ {print $2}' dig.out.$t)
   if test ${ttl:=0} -eq 0; then setret "failed"; fi
 
-  t=`expr $t + 1`
+  t=$(expr $t + 1)
   echo_i "checking rpz updates/transfers with parent nodes added after children (${t})"
   # regression test for RT #36272: the success condition
   # is the secondary server not crashing.
@@ -906,107 +916,107 @@ EOF
     nsd $ns5 delete '*.example.com.policy1.' example.com.policy1.
   done
 
-  t=`expr $t + 1`
+  t=$(expr $t + 1)
   echo_i "checking that going from an empty policy zone works (${t})"
   nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2.
   sleep 1
   rndc_reload ns7 $ns7 policy2
-  $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
-  grep NXDOMAIN dig.out.${t} > /dev/null || setret "failed"
+  $DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t}
+  grep NXDOMAIN dig.out.${t} >/dev/null || setret "failed"
 
-  t=`expr $t + 1`
+  t=$(expr $t + 1)
   echo_i "checking that "add-soa no" at rpz zone level works (${t})"
-  $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
-  grep SOA dig.out.${t} > /dev/null && setret "failed"
+  $DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t}
+  grep SOA dig.out.${t} >/dev/null && setret "failed"
 
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking that "add-soa yes" at response-policy level works (${t})"
-    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
-    grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
+    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t}
+    grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed"
   fi
 
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "reconfiguring server with 'add-soa no' (${t})"
     cp ns3/named.conf ns3/named.conf.tmp
-    sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf
+    sed -e "s/add-soa yes/add-soa no/g" <ns3/named.conf.tmp >ns3/named.conf
     rndc_reconfig ns3 $ns3
     echo_i "checking that 'add-soa no' at response-policy level works (${t})"
-    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
-    grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed"
+    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t}
+    grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null && setret "failed"
   fi
 
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking that 'add-soa unset' works (${t})"
-    $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 > dig.out.${t}
-    grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
+    $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 >dig.out.${t}
+    grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed"
   fi
 
   # dnsrps does not allow NS RRs in policy zones, so this check
   # with dnsrps results in no rewriting.
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking rpz with delegation fails correctly (${t})"
-    $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t
-    grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
+    $DIG -p ${PORT} @$ns3 ns example.com >dig.out.$t
+    grep "status: SERVFAIL" dig.out.$t >/dev/null || setret "failed"
 
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking policies from expired zone are no longer in effect ($t)"
-    $DIG -p ${PORT} @$ns3 a expired > dig.out.$t
-    grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed"
-    grep "fast-expire/IN: response-policy zone expired" ns3/named.run > /dev/null || setret "failed"
+    $DIG -p ${PORT} @$ns3 a expired >dig.out.$t
+    grep "expired.*10.0.0.10" dig.out.$t >/dev/null && setret "failed"
+    grep "fast-expire/IN: response-policy zone expired" ns3/named.run >/dev/null || setret "failed"
   fi
 
   # RPZ 'CNAME *.' (NODATA) trumps DNS64.  Test against various DNS64 scenarios.
-  for label in a-only no-a-no-aaaa a-plus-aaaa
-  do
-    for type in AAAA A
-    do
-      t=`expr $t + 1`
+  for label in a-only no-a-no-aaaa a-plus-aaaa; do
+    for type in AAAA A; do
+      t=$(expr $t + 1)
       case $label in
-      a-only)
-	echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})"
-	;;
-      no-a-no-aaaa)
-	echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})"
-	;;
-      a-plus-aaaa)
-	echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})"
-	;;
+        a-only)
+          echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})"
+          ;;
+        no-a-no-aaaa)
+          echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})"
+          ;;
+        a-plus-aaaa)
+          echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})"
+          ;;
       esac
       ret=0
-      $DIG ${label}.example -p ${PORT} $type @10.53.0.9 > dig.out.${t}
-      grep "status: NOERROR" dig.out.$t > /dev/null || ret=1
-      grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t > /dev/null || ret=1
-      grep "^rpz"  dig.out.$t > /dev/null || ret=1
+      $DIG ${label}.example -p ${PORT} $type @10.53.0.9 >dig.out.${t}
+      grep "status: NOERROR" dig.out.$t >/dev/null || ret=1
+      grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t >/dev/null || ret=1
+      grep "^rpz" dig.out.$t >/dev/null || ret=1
       [ $ret -eq 0 ] || echo_i "failed"
-      status=`expr $status + $ret`
+      status=$(expr $status + $ret)
     done
   done
 
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
+    t=$(expr $t + 1)
     echo_i "checking that rewriting CD=1 queries handles pending data correctly (${t})"
     $RNDCCMD $ns3 flush
     $RNDCCMD $ns6 flush
-    $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd > dig.out.${t}
-    grep -w "1.1.1.1" dig.out.${t} > /dev/null || setret "failed"
+    $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd >dig.out.${t}
+    grep -w "1.1.1.1" dig.out.${t} >/dev/null || setret "failed"
   fi
 
   [ $status -ne 0 ] && pf=fail || pf=pass
   case $mode in
-  native)
-    native=$status
-    echo_i "status (native RPZ sub-test): $status ($pf)";;
-
-  dnsrps)
-    dnsrps=$status
-    echo_i "status (DNSRPS sub-test): $status ($pf)";;
-  *) echo_i "invalid test mode";;
+    native)
+      native=$status
+      echo_i "status (native RPZ sub-test): $status ($pf)"
+      ;;
+
+    dnsrps)
+      dnsrps=$status
+      echo_i "status (DNSRPS sub-test): $status ($pf)"
+      ;;
+    *) echo_i "invalid test mode" ;;
   esac
 done
-status=`expr ${native:-0} + ${dnsrps:-0}`
+status=$(expr ${native:-0} + ${dnsrps:-0})
 
 [ $status -eq 0 ] || exit 1