vendor/unbound/1.25.0

16 files changed, 176 insertions, 38 deletions

diff --git a/testcode/asynclook.c b/testcode/asynclook.c
index fffd14ed598a..74fb9d13e694 100644
--- a/testcode/asynclook.c
+++ b/testcode/asynclook.c
@@ -488,12 +488,20 @@ int main(int argc, char** argv)
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #endif /* HAVE_SSL */
 
diff --git a/testcode/checklocks.h b/testcode/checklocks.h
index 7ebc2f98407e..d2c0a533604b 100644
--- a/testcode/checklocks.h
+++ b/testcode/checklocks.h
@@ -360,6 +360,7 @@ typedef pthread_key_t ub_thread_key_type;
 #define ub_thread_key_create(key, f) LOCKRET(pthread_key_create(key, f))
 #define ub_thread_key_set(key, v) LOCKRET(pthread_setspecific(key, v))
 #define ub_thread_key_get(key) pthread_getspecific(key)
+#define ub_thread_setname(thread, name) /* nop */
 
 #endif /* USE_THREAD_DEBUG */
 #endif /* TESTCODE_CHECK_LOCKS_H */
diff --git a/testcode/dohclient.c b/testcode/dohclient.c
index 5eb523b2e0ac..8d8adaf5df34 100644
--- a/testcode/dohclient.c
+++ b/testcode/dohclient.c
@@ -642,12 +642,20 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 	}
 	run(h2_session, port, no_tls, argc, argv);
diff --git a/testcode/doqclient.c b/testcode/doqclient.c
index 238a9380306d..8a34ca31b122 100644
--- a/testcode/doqclient.c
+++ b/testcode/doqclient.c
@@ -2255,7 +2255,7 @@ create_doq_client_data(const char* svr, int port, struct ub_event_base* base,
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0)
-		fatal_exit("ngtcp2_crypto_oss_init failed");
+		fatal_exit("ngtcp2_crypto_ossl_init failed");
 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_INIT)
 	if(ngtcp2_crypto_quictls_init() != 0)
 		fatal_exit("ngtcp2_crypto_quictls_init failed");
diff --git a/testcode/mini_tdir.sh b/testcode/mini_tdir.sh
index d1f7bfce94a8..caef1e3a372e 100755
--- a/testcode/mini_tdir.sh
+++ b/testcode/mini_tdir.sh
@@ -141,6 +141,13 @@ if test -f $done; then
 	exit 0
 fi
 
+# always clear the skip mark file in case something changed in the environment
+# in between runs
+if test -f $skip; then
+	echo "minitdir $skip exists; removing."
+	rm $skip
+fi
+
 # Copy
 if test $quiet = 0; then
 	echo "minitdir copy $1 to $dir"
diff --git a/testcode/petal.c b/testcode/petal.c
index 627c77d57529..ec99a092d9bd 100644
--- a/testcode/petal.c
+++ b/testcode/petal.c
@@ -160,11 +160,26 @@ read_ssl_line(SSL* ssl, char* buf, size_t len)
 			return 0;
 		}
 		if((r = SSL_read(ssl, buf+n, 1)) <= 0) {
-			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
+			int e = SSL_get_error(ssl, r);
+			if(e == SSL_ERROR_ZERO_RETURN) {
 				/* EOF */
 				break;
+			} else if(e == SSL_ERROR_WANT_READ) {
+				continue;
+			} else if(e == SSL_ERROR_WANT_WRITE) {
+				continue;
+			} else if(e == SSL_ERROR_SYSCALL) {
+				if(verb) printf("could not SSL_read %s\n",
+					strerror(errno));
+			} else if(e == SSL_ERROR_SSL) {
+				int er = ERR_peek_error();
+				if(er)
+					printf("could not SSL_read: %s\n",
+						ERR_reason_error_string(er));
+			} else {
+				if(verb) printf("could not SSL_read "
+						"(SSL_get_error %d)\n", e);
 			}
-			if(verb) printf("could not SSL_read\n");
 			return 0;
 		}
 		if(endnl && buf[n] == '\n') {
@@ -222,7 +237,8 @@ read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
 		if(verb>=2) printf("read: %s\n", buf);
 		if(buf[0] == 0) {
 			int e = ERR_peek_error();
-			printf("error string: %s\n", ERR_reason_error_string(e));
+			if(e)
+				printf("error string: %s\n", ERR_reason_error_string(e));
 			return 1;
 		}
 		if(!process_one_header(buf, file, flen, host, hlen, vs))
@@ -246,7 +262,8 @@ setup_ctx(char* key, char* cert)
 #endif
 	if(!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
 		int e = ERR_peek_error();
-		printf("error string: %s\n", ERR_reason_error_string(e));
+		if(e)
+			printf("error string: %s\n", ERR_reason_error_string(e));
 		print_exit("cannot read cert");
 	}
 	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
@@ -673,12 +690,20 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 
 	do_service(addr, port, key, cert);
diff --git a/testcode/pktview.c b/testcode/pktview.c
index 12e0d8edbb68..4cada926b5e6 100644
--- a/testcode/pktview.c
+++ b/testcode/pktview.c
@@ -59,12 +59,16 @@ static void usage(char* argv[])
 /** read hex input */
 static void read_input(sldns_buffer* pkt, FILE* in)
 {
-	char buf[102400];
+	/* Buffer for 64Kib packet, in hex, with spaces and comments. */
+	char buf[1024000];
 	char* np = buf;
 	while(fgets(np, (int)sizeof(buf) - (np-buf), in)) {
 		if(buf[0] == ';') /* comment */
 			continue;
 		np = &np[strlen(np)];
+		if((size_t)(np-buf) >= sizeof(buf)-1)
+			fatal_exit("input too large (%lu bytes)",
+				(unsigned long)sizeof(buf));
 	}
 	hex_to_buf(pkt, buf);
 }
@@ -188,10 +192,16 @@ static void analyze(sldns_buffer* pkt)
 /** main program for pktview */
 int main(int argc, char* argv[]) 
 {
-	sldns_buffer* pkt = sldns_buffer_new(65553);
+	sldns_buffer* pkt;
+
+	log_init(NULL, 0, NULL);
+	log_ident_set("pktview");
+
 	if(argc != 1) {
 		usage(argv);
 	}
+
+	pkt = sldns_buffer_new(65553);
 	if(!pkt) fatal_exit("out of memory");
 
 	read_input(pkt, stdin);
diff --git a/testcode/replay.h b/testcode/replay.h
index 809e8ee39778..42a56a1c466e 100644
--- a/testcode/replay.h
+++ b/testcode/replay.h
@@ -142,6 +142,10 @@
 #include "util/netevent.h"
 #include "testcode/testpkts.h"
 #include "util/rbtree.h"
+#ifdef __QNX__
+/* For struct timeval */
+#include <sys/time.h>
+#endif /* __QNX__ */
 struct replay_answer;
 struct replay_moment;
 struct replay_range;
diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index 60122c4ddfd1..ce9e4cbe3f00 100644
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -652,12 +652,20 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 	}
 	send_em(svr, pp2_client, udp, usessl, noanswer, onarrival, delay, argc, argv);
diff --git a/testcode/testpkts.c b/testcode/testpkts.c
index 612461063481..93f2add94fa4 100644
--- a/testcode/testpkts.c
+++ b/testcode/testpkts.c
@@ -135,6 +135,8 @@ static void matchline(char* line, struct entry* e)
 			e->match_ttl = 1;
 		} else if(str_keyword(&parse, "DO")) {
 			e->match_do = 1;
+		} else if(str_keyword(&parse, "CO")) {
+			e->match_co = 1;
 		} else if(str_keyword(&parse, "noedns")) {
 			e->match_noedns = 1;
 		} else if(str_keyword(&parse, "ednsdata")) {
@@ -178,7 +180,7 @@ static void matchline(char* line, struct entry* e)
 
 /** parse REPLY line */
 static void replyline(char* line, uint8_t* reply, size_t reply_len,
-	int* do_flag)
+	int* do_flag, int* co_flag)
 {
 	char* parse = line;
 	if(reply_len < LDNS_HEADER_SIZE) error("packet too short for header");
@@ -236,6 +238,8 @@ static void replyline(char* line, uint8_t* reply, size_t reply_len,
 			LDNS_AD_SET(reply);
 		} else if(str_keyword(&parse, "DO")) {
 			*do_flag = 1;
+		} else if(str_keyword(&parse, "CO")) {
+			*co_flag = 1;
 		} else {
 			error("could not parse REPLY: '%s'", parse);
 		}
@@ -289,6 +293,7 @@ static struct entry* new_entry(void)
 	e->match_all_noedns = 0;
 	e->match_ttl = 0;
 	e->match_do = 0;
+	e->match_co = 0;
 	e->match_noedns = 0;
 	e->match_serial = 0;
 	e->ixfr_soa_serial = 0;
@@ -521,15 +526,17 @@ static void add_rr(char* rrstr, uint8_t* pktbuf, size_t pktsize,
 
 /* add EDNS 4096 opt record */
 static void
-add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, uint8_t *ednsdata,
-	uint16_t ednslen, size_t* pktlen)
+add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, int co_flag,
+	uint8_t *ednsdata, uint16_t ednslen, size_t* pktlen)
 {
 	uint8_t edns[] = {0x00, /* root label */
 		0x00, LDNS_RR_TYPE_OPT, /* type */
 		0x04, 0xD0, /* class is UDPSIZE 1232 */
 		0x00, /* TTL[0] is ext rcode */
 		0x00, /* TTL[1] is edns version */
-		(uint8_t)(do_flag?0x80:0x00), 0x00, /* TTL[2-3] is edns flags, DO */
+		(uint8_t)(do_flag?0x80:0x00)
+		| (uint8_t)(co_flag?0x40:0x00)
+		, 0x00, /* TTL[2-3] is edns flags, DO */
 		(uint8_t)((ednslen >> 8) & 0xff),
 		(uint8_t)(ednslen  & 0xff), /* rdatalength */
 	};
@@ -561,6 +568,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 	uint8_t pktbuf[MAX_PACKETLEN];
 	size_t pktlen = LDNS_HEADER_SIZE;
 	int do_flag = 0; /* DO flag in EDNS */
+	int co_flag = 0; /* CO flag in EDNS */
 	memset(pktbuf, 0, pktlen); /* ID = 0, FLAGS="", and rr counts 0 */
 
 	while(fgets(line, (int)sizeof(line), in) != NULL) {
@@ -598,7 +606,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 		if(str_keyword(&parse, "MATCH")) {
 			matchline(parse, current);
 		} else if(str_keyword(&parse, "REPLY")) {
-			replyline(parse, pktbuf, pktlen, &do_flag);
+			replyline(parse, pktbuf, pktlen, &do_flag, &co_flag);
 		} else if(str_keyword(&parse, "ADJUST")) {
 			adjustline(parse, current, cur_reply);
 		} else if(str_keyword(&parse, "EXTRA_PACKET")) {
@@ -654,15 +662,16 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 			if(hex_ednsdata_buffer)
 				sldns_buffer_free(hex_ednsdata_buffer);
 			if(pktlen != 0) {
-				if(do_flag || cur_reply->raw_ednsdata) {
+				if(do_flag || co_flag
+					|| cur_reply->raw_ednsdata) {
 					if(cur_reply->raw_ednsdata &&
 						sldns_buffer_limit(cur_reply->raw_ednsdata))
-						add_edns(pktbuf, sizeof(pktbuf), do_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
 							sldns_buffer_begin(cur_reply->raw_ednsdata),
 							(uint16_t)sldns_buffer_limit(cur_reply->raw_ednsdata),
 							&pktlen);
 					else
-						add_edns(pktbuf, sizeof(pktbuf), do_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
 							NULL, 0, &pktlen);
 				}
 				cur_reply->reply_pkt = memdup(pktbuf, pktlen);
@@ -909,6 +918,22 @@ get_do_flag(uint8_t* pkt, size_t len)
 	return (int)(edns_bits&LDNS_EDNS_MASK_DO_BIT);
 }
 
+/** return true if the CO flag is set */
+static int
+get_co_flag(uint8_t* pkt, size_t len)
+{
+	uint16_t edns_bits;
+	uint8_t* walk = pkt;
+	size_t walk_len = len;
+	if(!pkt_find_edns_opt(&walk, &walk_len)) {
+		return 0;
+	}
+	if(walk_len < 6)
+		return 0; /* malformed */
+	edns_bits = sldns_read_uint16(walk+4);
+	return (int)(edns_bits&LDNS_EDNS_MASK_CO_BIT);
+}
+
 /** Snips the specified EDNS option out of the OPT record and puts it in the
  *  provided buffer. The buffer should be able to hold any opt data ie 65535.
  *  Returns the length of the option written,
@@ -1654,6 +1679,10 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "no DO bit set\n");
 			continue;
 		}
+		if(p->match_co && !get_co_flag(query_pkt, len)) {
+			verbose(3, "no CO bit set\n");
+			continue;
+		}
 		if(p->match_noedns && get_has_edns(query_pkt, len)) {
 			verbose(3, "bad; EDNS OPT present\n");
 			continue;
@@ -1745,11 +1774,14 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 		memmove(res+LDNS_HEADER_SIZE+dlen+4,
 			orig+LDNS_HEADER_SIZE+olen+4,
 			reslen-(LDNS_HEADER_SIZE+dlen+4));
+	} else if(origlen == 0) {
+		res = NULL;
+		reslen = 0;
 	} else {
 		res = memdup(orig, origlen);
 		reslen = origlen;
 	}
-	if(!res) {
+	if(!res && reslen > 0) {
 		verbose(1, "out of memory; send without adjust\n");
 		return;
 	}
diff --git a/testcode/testpkts.h b/testcode/testpkts.h
index c6a3725f368e..e36802dbc8ac 100644
--- a/testcode/testpkts.h
+++ b/testcode/testpkts.h
@@ -218,6 +218,8 @@ struct entry {
 	uint8_t match_ttl;
 	/** match DO bit */
 	uint8_t match_do;
+	/** match CO bit */
+	uint8_t match_co;
 	/** match absence of EDNS OPT record in query */
 	uint8_t match_noedns;
 	/** match edns data field given in hex */
diff --git a/testcode/unitldns.c b/testcode/unitldns.c
index f8409fec71b1..07d001a792e1 100644
--- a/testcode/unitldns.c
+++ b/testcode/unitldns.c
@@ -207,7 +207,11 @@ rr_test_file(const char* input, const char* check)
 #define xstr(s) str(s)
 #define str(s) #s
 
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 
 /** read rrs to and from string, to and from wireformat */
 static void
diff --git a/testcode/unitmain.c b/testcode/unitmain.c
index 07c016d7ba74..79ce45f39559 100644
--- a/testcode/unitmain.c
+++ b/testcode/unitmain.c
@@ -283,7 +283,7 @@ net_test(void)
 		unit_assert(strcmp(astr, "1.2.3.0") == 0);
 		unit_assert(ntohs(((struct sockaddr_in*)&a)->sin_port)==53);
 
-		res = netblockstrtoaddr("2001:DB8:33:44::/64", 53,
+		res = netblockstrtoaddr("2001:db8:33:44::/64", 53,
 			&a, &alen, &net);
 		unit_assert(res!=0 && net == 64);
 		addr_to_str(&a, alen, astr, sizeof(astr));
diff --git a/testcode/unitmsgparse.c b/testcode/unitmsgparse.c
index a87314019d1f..d65b7dd02de3 100644
--- a/testcode/unitmsgparse.c
+++ b/testcode/unitmsgparse.c
@@ -498,7 +498,11 @@ testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc,
 #define xstr(s) str(s)
 #define str(s) #s
 
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 
 void msgparse_test(void)
 {
diff --git a/testcode/unitverify.c b/testcode/unitverify.c
index 12d5205b07da..fcf2e2ffe3d1 100644
--- a/testcode/unitverify.c
+++ b/testcode/unitverify.c
@@ -513,8 +513,11 @@ nsec3_hash_test(const char* fname)
 #define xstr(s) str(s)
 #define str(s) #s
 
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 #if defined(HAVE_SSL) && defined(USE_SHA1)
 /* Detect if openssl is configured to disable RSASHA1 signatures,
  * with the rh-allow-sha1-signatures disabled. */
@@ -631,6 +634,7 @@ rh_allow_sha1_signatures_disabled(void)
 void 
 verify_test(void)
 {
+	int do_sha1 = 1;
 	unit_show_feature("signature verify");
 
 #if defined(HAVE_SSL) && defined(USE_SHA1)
@@ -643,27 +647,40 @@ verify_test(void)
 #else
 		_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
 #endif
+		do_sha1 = 1;
 	}
+#ifdef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
+	if (EVP_default_properties_is_fips_enabled(NULL))
+		do_sha1 = 0;
 #endif
+#endif /* HAVE_SSL and USE_SHA1 */
 
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	}
 #endif
 #if defined(USE_DSA) && defined(USE_SHA1)
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	}
 #endif /* USE_DSA */
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	}
 #endif
 #if (defined(HAVE_EVP_SHA256) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256", "20070829144150");
 #  ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	}
 #  endif
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256_draft", "20090101000000");
 #endif
@@ -672,8 +689,10 @@ verify_test(void)
 	verifytest_file(SRCDIRSTR "/testdata/test_signatures.9", "20171215000000");
 #endif
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	}
 #endif
 #ifdef USE_GOST
 	if(sldns_key_EVP_load_gost_id())
@@ -699,7 +718,9 @@ verify_test(void)
 	}
 #endif
 #ifdef USE_SHA1
-	dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	if(do_sha1) {
+		dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	}
 #endif
 	nsectest();
 	nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");
diff --git a/testcode/unitzonemd.c b/testcode/unitzonemd.c
index 0420b0361590..c98dcf3959c9 100644
--- a/testcode/unitzonemd.c
+++ b/testcode/unitzonemd.c
@@ -50,7 +50,11 @@
 
 #define xstr(s) str(s)
 #define str(s) #s
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 
 /** Add zone from file for testing */
 struct auth_zone* authtest_addzone(struct auth_zones* az, const char* name,