Use jinja2 templates in nsupdate test

- Merge ns1/tls.options.in into ns1/named.conf.j2 and render it
  conditionally. Also conditionally include the additional
  ns1/tls.conf.j2 which is always rendered.
- Use multiple templates for ns7 and replace the copy_setports.
- Use jinja2 template for verylarge.in as well.

(cherry picked from commit 54c95d6966)

REUSE.toml

@@ -91,7 +91,7 @@ path = [
 	"bin/tests/system/nsupdate/CA/index.txt.attr",
 	"bin/tests/system/nsupdate/CA/serial",
 	"bin/tests/system/nsupdate/commandlist",
-	"bin/tests/system/nsupdate/verylarge.in",
+	"bin/tests/system/nsupdate/verylarge.j2",
 	"bin/tests/system/org.isc.bind.system.plist",
 	"bin/tests/system/pipelined/input",
 	"bin/tests/system/pipelined/inputb",

bin/tests/system/nsupdate/ns1/named.conf.j2

@@ -11,7 +11,9 @@
  * information regarding copyright ownership.
  */
 
+{% if FEATURE_FIPS_DH == "1" %}
 include "tls.conf";
+{% endif %}
 
 options {
 	query-source address 10.53.0.1;
@@ -27,7 +29,15 @@ options {
 	minimal-responses no;
 	update-quota 1;
 	dnssec-validation no;
-	include "tls.options";
+
+{% if FEATURE_FIPS_DH == "1" %}
+	tls-port @TLSPORT@;
+	listen-on tls ephemeral { 10.53.0.1; };
+	listen-on port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.1; };
+	listen-on port @EXTRAPORT2@ tls tls-forward-secrecy-mutual-tls { 10.53.0.1; };
+	listen-on port @EXTRAPORT3@ tls tls-expired { 10.53.0.1; };
+{% endif %}
+
 };
 
 acl named-acl {

bin/tests/system/nsupdate/ns1/tls.options.in

@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls-port @TLSPORT@;
-listen-on tls ephemeral { 10.53.0.1; };
-listen-on port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.1; };
-listen-on port @EXTRAPORT2@ tls tls-forward-secrecy-mutual-tls { 10.53.0.1; };
-listen-on port @EXTRAPORT3@ tls tls-expired { 10.53.0.1; };

bin/tests/system/nsupdate/ns10/named.conf.j2

@@ -26,7 +26,13 @@ options {
 	notify yes;
 	minimal-responses no;
 	dnssec-validation no;
-	@TKEY_CONFIGURATION@
+
+{% if FEATURE_GSSAPI == "1" %}
+{% raw %}
+	tkey-gssapi-credential "DNS/ns10.example.com@EXAMPLE.COM";
+{% endraw %}
+{% endif %}
+
 };
 
 key rndc_key {

bin/tests/system/nsupdate/ns9/named.conf.j2

@@ -24,7 +24,13 @@ options {
 	notify yes;
 	minimal-responses no;
 	dnssec-validation no;
-	@TKEY_CONFIGURATION@
+
+{% if FEATURE_GSSAPI == "1" %}
+{% raw %}
+	tkey-gssapi-credential "DNS/ns9.example.com@EXAMPLE.COM";
+{% endraw %}
+{% endif %}
+
 };
 
 key rndc_key {

bin/tests/system/nsupdate/setup.sh

@@ -13,40 +13,6 @@
 
 . ../conf.sh
 
-if $FEATURETEST --have-fips-dh; then
-  copy_setports ns1/tls.conf.in ns1/tls.conf
-  copy_setports ns1/tls.options.in ns1/tls.options
-else
-  : >ns1/tls.conf
-  : >ns1/tls.options
-fi
-copy_setports ns1/named.conf.in ns1/named.conf
-copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
-copy_setports ns5/named.conf.in ns5/named.conf
-copy_setports ns6/named.conf.in ns6/named.conf
-copy_setports ns7/named1.conf.in ns7/named.conf
-copy_setports ns8/named.conf.in ns8/named.conf
-
-# If "tkey-gssapi-credential" is set in the configuration and GSSAPI support is
-# not available, named will refuse to start.  As the test system framework does
-# not support starting named instances conditionally, ensure that
-# "tkey-gssapi-credential" is only present in named.conf if GSSAPI support is
-# available.
-copy_setports ns9/named.conf.in ns9/named.conf.in.tkey
-copy_setports ns10/named.conf.in ns10/named.conf.in.tkey
-if $FEATURETEST --gssapi; then
-  sed 's|@TKEY_CONFIGURATION@|tkey-gssapi-credential "DNS/ns9.example.com@EXAMPLE.COM";|' ns9/named.conf.in.tkey >ns9/named.conf
-  sed 's|@TKEY_CONFIGURATION@|tkey-gssapi-credential "DNS/ns10.example.com@EXAMPLE.COM";|' ns10/named.conf.in.tkey >ns10/named.conf
-else
-  sed 's|@TKEY_CONFIGURATION@||' ns9/named.conf.in.tkey >ns9/named.conf
-  sed 's|@TKEY_CONFIGURATION@||' ns10/named.conf.in.tkey >ns10/named.conf
-fi
-rm -f ns9/named.conf.in.tkey
-rm -f ns10/named.conf.in.tkey
-
-copy_setports verylarge.in verylarge
-
 cp -f ns1/example1.db ns1/example.db
 sed 's/example.nil/other.nil/g' ns1/example1.db >ns1/other.db
 sed 's/example.nil/unixtime.nil/g' ns1/example1.db >ns1/unixtime.db

bin/tests/system/nsupdate/tests.sh

@@ -2179,7 +2179,7 @@ EOF
     status=1
   }
 
-  copy_setports ns7/named2.conf.in ns7/named.conf
+  cp ns7/named2.conf ns7/named.conf
   rndc_reload ns7 10.53.0.7
 
   n=$((n + 1))