backends: support result security

diff --git a/TODO b/TODO
index 1e98b61f2c5b6dbcc115034739c3ef4f63103ef7..2ad903b77604f46b57cdda041980a0b18f590b45 100644 (file)
--- a/TODO
+++ b/TODO
@@ -2,9 +2,6 @@
 
 ## Core library
 
- * Add DNSSEC validation information
-    - what about non-DNS protocols?
-    - what about any, localhost or numeric addresses
  * Improve path ordering
     - use rules from http://tools.ietf.org/html/rfc6724
     - use /etc/gai.conf

diff --git a/backends/any.c b/backends/any.c
index 3253aa3023a56efa796eaf7e40a4b978a8d97fc4..cf595d209ee300a9e15bd4457c23945a31946445 100644 (file)
--- a/backends/any.c
+++ b/backends/any.c
@@ -56,8 +56,10 @@ setup_forward(netresolve_query_t query, char **settings)
 
        netresolve_backend_add_path(query, AF_INET, &inaddr_any, 0, 0, 0, 0, 0, 0, 0);
        netresolve_backend_add_path(query, AF_INET6, &in6addr_any, 0, 0, 0, 0, 0, 0, 0);
+       netresolve_backend_set_secure(query);
        netresolve_backend_finished(query);
 }
+
 void
 setup_reverse(netresolve_query_t query, char **settings)
 {
@@ -76,5 +78,6 @@ setup_reverse(netresolve_query_t query, char **settings)
        }
 
        netresolve_backend_add_name_info(query, "", NULL);
+       netresolve_backend_set_secure(query);
        netresolve_backend_finished(query);
 }

diff --git a/backends/hosts.c b/backends/hosts.c
index 156914a609cd03cd2a89ed907bffc4e66415f904..e585b372db3d65109ad3abdec77210d1d1ff700a 100644 (file)
--- a/backends/hosts.c
+++ b/backends/hosts.c
@@ -165,9 +165,10 @@ setup_forward(netresolve_query_t query, char **settings)
                count++;
        }
 
-       if (count)
+       if (count) {
+               netresolve_backend_set_secure(query);
                netresolve_backend_finished(query);
-       else
+       } else
                netresolve_backend_failed(query);
 
        free(list.items);
@@ -194,9 +195,10 @@ setup_reverse(netresolve_query_t query, char **settings)
                netresolve_backend_add_name_info(query, item->name, NULL);
        }
 
-       if (count)
+       if (count) {
+               netresolve_backend_set_secure(query);
                netresolve_backend_finished(query);
-       else
+       } else
                netresolve_backend_failed(query);
 
        free(list.items);

diff --git a/backends/loopback.c b/backends/loopback.c
index 5d1fecedcb534eb8f9d958b7b6a25f67197c7dd4..f25f0b5bd68a5f44f011f420e1195351c3f543b0 100644 (file)
--- a/backends/loopback.c
+++ b/backends/loopback.c
@@ -70,6 +70,7 @@ setup_forward(netresolve_query_t query, char **settings)
        if (ipv6)
                netresolve_backend_add_path(query, AF_INET6, &in6addr_loopback, 0, 0, 0, 0, 0, 0, 0);
 
+       netresolve_backend_set_secure(query);
        netresolve_backend_finished(query);
 }
 
@@ -85,5 +86,6 @@ setup_reverse(netresolve_query_t query, char **settings)
        }
 
        netresolve_backend_add_name_info(query, "localhost", NULL);
+       netresolve_backend_set_secure(query);
        netresolve_backend_finished(query);
 }

diff --git a/backends/numerichost.c b/backends/numerichost.c
index 3c1d6372fe8032d89cca922c3b3c51af3c9db940..f685f484d66feab0da92e124c5d304701db9cb00 100644 (file)
--- a/backends/numerichost.c
+++ b/backends/numerichost.c
@@ -36,7 +36,11 @@ setup_forward(netresolve_query_t query, char **settings)
                return;
        }
 
-       if (ifindex != -1)
+       if (ifindex >= 0) {
                netresolve_backend_add_path(query, family, &address, ifindex, 0, 0, 0, 0, 0, 0);
-       netresolve_backend_finished(query);
+               netresolve_backend_set_canonical_name(query, node);
+               netresolve_backend_set_secure(query);
+               netresolve_backend_finished(query);
+       } else
+               netresolve_backend_failed(query);
 }

diff --git a/backends/unix.c b/backends/unix.c
index 31b8ac65a5e10cd952c933ff719209e2e800fc0b..59829093183400262816cef7d1dc5616df5c952b 100644 (file)
--- a/backends/unix.c
+++ b/backends/unix.c
@@ -39,5 +39,6 @@ setup_forward(netresolve_query_t query, char **settings)
        }
 
        netresolve_backend_add_path(query, AF_UNIX, node, 0, socktype, 0, 0, 0, 0, 0);
+       netresolve_backend_set_secure(query);
        netresolve_backend_finished(query);
 }

diff --git a/include/netresolve-backend.h b/include/netresolve-backend.h
index 92717e390438df34b76ae1551c02f8cd129e41bd..9266111384feb57b75643de1391098e224cb3ea2 100644 (file)
--- a/include/netresolve-backend.h
+++ b/include/netresolve-backend.h
@@ -74,6 +74,7 @@ void netresolve_backend_add_path(netresolve_query_t query,
 void netresolve_backend_add_name_info(netresolve_query_t query, const char *nodename, const char *servname);
 void netresolve_backend_set_canonical_name(netresolve_query_t query, const char *canonical_name);
 void netresolve_backend_set_dns_answer(netresolve_query_t query, const void *answer, size_t length);
+void netresolve_backend_set_secure(netresolve_query_t query);
 
 /* Convenience output */
 void netresolve_backend_apply_addrinfo(netresolve_query_t query,

diff --git a/include/netresolve-private.h b/include/netresolve-private.h
index b123348d6b68af6d94edd06b218da92cb22dc3dc..cf70d987c9bb769342543ef8226fb45358b1a361 100644 (file)
--- a/include/netresolve-private.h
+++ b/include/netresolve-private.h
@@ -65,6 +65,11 @@ enum netresolve_request_type {
        _NETRSOLVE_REQUEST_TYPES
 };
 
+enum netresolve_security {
+       NETRESOLVE_SECURITY_INSECURE,
+       NETRESOLVE_SECURITY_SECURE
+};
+
 struct netresolve_backend {
        bool mandatory;
        char **settings;
@@ -176,6 +181,7 @@ struct netresolve_query {
                        void *answer;
                        size_t length;
                } dns;
+               enum netresolve_security security;
        } response;
 
        struct netresolve_service_list *services;

diff --git a/include/netresolve.h b/include/netresolve.h
index cad04b9d2e04924dc8aa7eea78ed23592ba49c93..d77c51d3031552fbbcf35cad754dfa7acc243889 100644 (file)
--- a/include/netresolve.h
+++ b/include/netresolve.h
@@ -76,6 +76,7 @@ void *netresolve_query_get_user_data(netresolve_query_t query);
 size_t netresolve_query_get_count(const netresolve_query_t query);
 const char *netresolve_query_get_node_name(const netresolve_query_t query);
 const char *netresolve_query_get_service_name(const netresolve_query_t query);
+bool netresolve_query_get_secure(const netresolve_query_t query);
 
 /* Query result getters (forward queries) */
 void netresolve_query_get_node_info(const netresolve_query_t query, size_t idx,

diff --git a/lib/backend.c b/lib/backend.c
index 007bf883164c971416c2dc647d85d6c560dc4cb1..d64570ae7c0e5878c193389838587e1106c7bca2 100644 (file)
--- a/lib/backend.c
+++ b/lib/backend.c
@@ -258,6 +258,11 @@ netresolve_backend_add_name_info(netresolve_query_t query, const char *nodename,
                                service_callback, query);
        }
 }
+void
+netresolve_backend_set_secure(netresolve_query_t query)
+{
+       query->response.security = NETRESOLVE_SECURITY_SECURE;
+}
 
 void
 netresolve_backend_set_dns_answer(netresolve_query_t query, const void *answer, size_t length)

diff --git a/lib/query.c b/lib/query.c
index ef1ec93009dc80ce2ed79a74760862b56423072e..199d9ff612f95496024a45d59814ef9e5f707c8e 100644 (file)
--- a/lib/query.c
+++ b/lib/query.c
@@ -437,3 +437,9 @@ netresolve_query_get_dns_answer(const netresolve_query_t query, size_t *size)
 
        return &query->response.dns.answer;
 }
+
+bool
+netresolve_query_get_secure(const netresolve_query_t query)
+{
+       return query->response.security == NETRESOLVE_SECURITY_SECURE;
+}

diff --git a/lib/string.c b/lib/string.c
index 50a0913aaa94b64e0fba97074e65ec3564a75d85..a6ee60fd6325f742029161bbc83c23aa6f193a40 100644 (file)
--- a/lib/string.c
+++ b/lib/string.c
@@ -197,6 +197,7 @@ netresolve_get_response_string(netresolve_query_t query)
        size_t i;
        size_t length;
        const char *answer = netresolve_query_get_dns_answer(query, &length);
+       bool secure = netresolve_query_get_secure(query);
 
        bprintf(&start, end, "response %s %s\n", PACKAGE_NAME, VERSION);
        if (length) {
@@ -213,6 +214,8 @@ netresolve_get_response_string(netresolve_query_t query)
                add_path(&start, end, query, i);
                bprintf(&start, end, "\n");
        }
+       if (secure)
+               bprintf(&start, end, "secure\n");
        bprintf(&start, end, "\n");
 
        return query->buffer;

diff --git a/tests/data/any b/tests/data/any
index 5a30419aa0b6e5fdbc5653d2072c17e1e287e5b4..c597d7cfba00ca99ff3387eae452d1ae6952e7f1 100644 (file)
--- a/tests/data/any
+++ b/tests/data/any
@@ -2,4 +2,5 @@ response netresolve 0.0.1
 name localhost
 ip :: any any 0 0 0 0
 ip 0.0.0.0 any any 0 0 0 0
+secure
 

diff --git a/tests/data/dns/dns-reverse b/tests/data/dns/dns-reverse
index 2e0a4207e373cdb4a16279ae8abf9b5dba31c025..8c313c7eb33e63dd7951ae1d24ed019949b06b57 100644 (file)
--- a/tests/data/dns/dns-reverse
+++ b/tests/data/dns/dns-reverse
@@ -1,4 +1,3 @@
 response netresolve 0.0.1
-name info.nix.cz.
-service 0
+name info.nix.cz
 

diff --git a/tests/data/empty b/tests/data/empty
index 69a7a1f26ceb45d532d787ff98a7a57cf025a4b2..5dfd802f625147fc5836e0a476f2943a36c9532d 100644 (file)
--- a/tests/data/empty
+++ b/tests/data/empty
@@ -1,3 +1,4 @@
 response netresolve 0.0.1
 name localhost
+secure
 

diff --git a/tests/data/localhost b/tests/data/localhost
index 4487d4c1af021bf3507d7ed1f133d95d1892928c..0f3cc21e688cce28d442a519b51630da1887a3e7 100644 (file)
--- a/tests/data/localhost
+++ b/tests/data/localhost
@@ -2,4 +2,5 @@ response netresolve 0.0.1
 name localhost
 ip ::1 any any 0 0 0 0
 ip 127.0.0.1 any any 0 0 0 0
+secure
 

diff --git a/tests/data/localhost-http b/tests/data/localhost-http
index 80b05b0f18132f2396a2b3e4a936cfcecb3c45e8..7ce3b10b95fd303bacfa2c1fb7d5c0b603da88fe 100644 (file)
--- a/tests/data/localhost-http
+++ b/tests/data/localhost-http
@@ -4,4 +4,5 @@ ip ::1 stream tcp 80 0 0 0
 ip ::1 dgram udp 80 0 0 0
 ip 127.0.0.1 stream tcp 80 0 0 0
 ip 127.0.0.1 dgram udp 80 0 0 0
+secure
 

diff --git a/tests/data/localhost4 b/tests/data/localhost4
index 38a78a6ea42f78d184f8e08f60e19b179299e850..851a014c6c04400c1029a0aa247c7ae0d6b8c2d2 100644 (file)
--- a/tests/data/localhost4
+++ b/tests/data/localhost4
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name localhost
 ip 127.0.0.1 any any 0 0 0 0
+secure
 

diff --git a/tests/data/localhost4-http b/tests/data/localhost4-http
index 9f49a6b1fca267a21b59e727d3d583d7e742c34a..8f2f7db717cf15931636404414def7d35a62c132 100644 (file)
--- a/tests/data/localhost4-http
+++ b/tests/data/localhost4-http
@@ -2,4 +2,5 @@ response netresolve 0.0.1
 name localhost
 ip 127.0.0.1 stream tcp 80 0 0 0
 ip 127.0.0.1 dgram udp 80 0 0 0
+secure
 

diff --git a/tests/data/localhost6 b/tests/data/localhost6
index 76214837af1405da39ae76684490db9dab049ea4..12118500d625345355dc2f4b1c88b8ae42db7c06 100644 (file)
--- a/tests/data/localhost6
+++ b/tests/data/localhost6
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name localhost
 ip ::1 any any 0 0 0 0
+secure
 

diff --git a/tests/data/localhost6-http b/tests/data/localhost6-http
index 4eead793a19c9d8a9fe39e21528085014fabcbeb..9a700975c6dcff221a162a9b39cbde102e751bfc 100644 (file)
--- a/tests/data/localhost6-http
+++ b/tests/data/localhost6-http
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 ip ::1 stream tcp 80 0 0 0
 ip ::1 dgram udp 80 0 0 0
+secure
 

diff --git a/tests/data/numeric4 b/tests/data/numeric4
index 53bf903c20de7cf8cef37c535dddeb3970bd5163..e3162e50b079e933c493b8138fea349ff39c06b7 100644 (file)
--- a/tests/data/numeric4
+++ b/tests/data/numeric4
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name 1.2.3.4
 ip 1.2.3.4 any any 0 0 0 0
+secure
 

diff --git a/tests/data/numeric4failed b/tests/data/numeric4failed
deleted file mode 100644 (file)
index d4d6896..0000000
--- a/tests/data/numeric4failed
+++ /dev/null
@@ -1,3 +0,0 @@
-response netresolve 0.0.1
-name 1.2.3.4%999999x
-

diff --git a/tests/data/numeric4lo b/tests/data/numeric4lo
index 888f1e5355f684aa741a067fbe3db8536769c485..eabe2e91f5751e03e3be5dd34576cd4adc01d321 100644 (file)
--- a/tests/data/numeric4lo
+++ b/tests/data/numeric4lo
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name 1.2.3.4%lo
 ip 1.2.3.4%lo any any 0 0 0 0
+secure
 

diff --git a/tests/data/numeric4nines b/tests/data/numeric4nines
index 4850d8278317dd6aa10f80432594b5e1cb1f94ed..feb67041b0cc526b3e92972a13fbadcccca24777 100644 (file)
--- a/tests/data/numeric4nines
+++ b/tests/data/numeric4nines
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name 1.2.3.4%999999
 ip 1.2.3.4%999999 any any 0 0 0 0
+secure
 

diff --git a/tests/data/numeric6 b/tests/data/numeric6
index 816f055d27f9aba41dce44b3745e1718b7b87cbf..29a1ea61ba086122af7f691287732ec7fc8a3219 100644 (file)
--- a/tests/data/numeric6
+++ b/tests/data/numeric6
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name 1:2:3:4:5:6:7:8
 ip 1:2:3:4:5:6:7:8 any any 0 0 0 0
+secure
 

diff --git a/tests/data/numeric6failed b/tests/data/numeric6failed
deleted file mode 100644 (file)
index ca2fea2..0000000
--- a/tests/data/numeric6failed
+++ /dev/null
@@ -1,3 +0,0 @@
-response netresolve 0.0.1
-name 1:2:3:4:5:6:7:8%999999x
-

diff --git a/tests/data/numeric6ifindex b/tests/data/numeric6ifindex
index 0ecae3c2436cb855ea502a2f710af25e15bd4818..4c981ece5d584f2cec2b9311a567021e5afc16b8 100644 (file)
--- a/tests/data/numeric6ifindex
+++ b/tests/data/numeric6ifindex
@@ -1,3 +1,4 @@
 response netresolve 0.0.1
 ip 1:2:3:4:5:6:7:8%lo any any 0 0 0 0
+secure
 

diff --git a/tests/data/numeric6lo b/tests/data/numeric6lo
index 421ef93bfb9259d2623b1ae89f352991a52c2e26..184e0bd17440cadabc4595d5c18e3693553fc404 100644 (file)
--- a/tests/data/numeric6lo
+++ b/tests/data/numeric6lo
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name 1:2:3:4:5:6:7:8%lo
 ip 1:2:3:4:5:6:7:8%lo any any 0 0 0 0
+secure
 

diff --git a/tests/data/numeric6nines b/tests/data/numeric6nines
index caf6b2fd61621edef1deef1badd184d79748cab6..e50ceb512dbb89ec5fbc8e896997a1ede33eaef7 100644 (file)
--- a/tests/data/numeric6nines
+++ b/tests/data/numeric6nines
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name 1:2:3:4:5:6:7:8%999999
 ip 1:2:3:4:5:6:7:8%999999 any any 0 0 0 0
+secure
 

diff --git a/tests/data/services b/tests/data/services
index 8365ffede746230cd6dd3b9ec3265ffeed9521b2..2e45fdea709b40c29a81f69ea664ab525f61c8f6 100644 (file)
--- a/tests/data/services
+++ b/tests/data/services
@@ -4,4 +4,5 @@ ip :: stream tcp 80 0 0 0
 ip :: dgram udp 80 0 0 0
 ip 0.0.0.0 stream tcp 80 0 0 0
 ip 0.0.0.0 dgram udp 80 0 0 0
+secure
 

diff --git a/tests/data/unix b/tests/data/unix
index 855a45b7b04a4bed8a1029a5b1f8d8aa12563c61..40f9d2ecbb6eb032191e74f0b85aac61a5bebca8 100644 (file)
--- a/tests/data/unix
+++ b/tests/data/unix
@@ -2,4 +2,5 @@ response netresolve 0.0.1
 name /path/to/socket
 unix /path/to/socket stream
 unix /path/to/socket dgram
+secure
 

diff --git a/tests/data/unix-dgram b/tests/data/unix-dgram
index 0c2ff30c1e4acb97d5d3b6f4b00fb1dc234fd08c..0aaa134e9a560c472a9dc0f70190b42923df05fd 100644 (file)
--- a/tests/data/unix-dgram
+++ b/tests/data/unix-dgram
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name /path/to/socket
 unix /path/to/socket dgram
+secure
 

diff --git a/tests/data/unix-stream b/tests/data/unix-stream
index 57d2f39188ee17a28b4484822b5eeb254928760c..970859acf263b445057d2fe1368db729fe59f1c3 100644 (file)
--- a/tests/data/unix-stream
+++ b/tests/data/unix-stream
@@ -1,4 +1,5 @@
 response netresolve 0.0.1
 name /path/to/socket
 unix /path/to/socket stream
+secure
 

diff --git a/tests/test-netresolve.sh b/tests/test-netresolve.sh
index ee16fa84341323737e1d358df5553da7b8b4857a..f735f1aa8a7b57a8d85bda2e9507669b8c4abbb9 100755 (executable)
--- a/tests/test-netresolve.sh
+++ b/tests/test-netresolve.sh
@@ -15,8 +15,8 @@ $DIFF <($NR --backends aresdns) $DATA/failed
 $DIFF <($NR --backends getaddrinfo) $DATA/failed
 $DIFF <($NR --backends nss:files) $DATA/failed
 $DIFF <($NR --backends nss:bogusbogus) $DATA/failed
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so) $DATA/any
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:getaddrinfo) $DATA/any
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so) <(grep -v '^secure$' $DATA/any)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:getaddrinfo) <(grep -v '^secure$' $DATA/any)
 $DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname4) $DATA/failed
 $DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname3) $DATA/failed
 $DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname2) $DATA/failed
@@ -27,57 +27,57 @@ $DIFF <(NETRESOLVE_FLAG_DEFAULT_LOOPBACK=yes $NR) $DATA/localhost
 
 # empty/http
 $DIFF <($NR --service http) $DATA/services
-$DIFF <($NR --backend getaddrinfo --service http) $DATA/services
+$DIFF <($NR --backend getaddrinfo --service http) <(grep -v '^secure$' $DATA/services)
 
 # numeric
 $DIFF <($NR --node 1.2.3.4) $DATA/numeric4
 $DIFF <($NR --node 1.2.3.4%lo) $DATA/numeric4lo
 $DIFF <($NR --node 1.2.3.4%999999) $DATA/numeric4nines
-$DIFF <($NR --node 1.2.3.4%999999x) $DATA/numeric4failed
+$DIFF <($NR --node 1.2.3.4%999999x) $DATA/failed
 $DIFF <($NR --node 1:2:3:4:5:6:7:8) $DATA/numeric6
 $DIFF <($NR --node 1:2:3:4:5:6:7:8%lo) $DATA/numeric6lo
 $DIFF <($NR --node 1:2:3:4:5:6:7:8%999999) $DATA/numeric6nines
-$DIFF <($NR --node 1:2:3:4:5:6:7:8%999999x) $DATA/numeric6failed
+$DIFF <($NR --node 1:2:3:4:5:6:7:8%999999x) $DATA/failed
 
 # localhost
 $DIFF <($NR --node localhost) $DATA/localhost
 $DIFF <($NR --backends hosts --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:files --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:files:gethostbyname4 --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:files:gethostbyname --node localhost) $DATA/localhost4
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:getaddrinfo --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname4 --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname3 --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname2 --node localhost) $DATA/localhost
-$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname --node localhost) $DATA/localhost4
+$DIFF <($NR --backends nss:files --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:files:gethostbyname4 --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:files:gethostbyname --node localhost) <(grep -v '^secure$' $DATA/localhost4)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:getaddrinfo --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname4 --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname3 --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname2 --node localhost) <(grep -v '^secure$' $DATA/localhost)
+$DIFF <($NR --backends nss:./.libs/libnss_netresolve.so:gethostbyname --node localhost) <(grep -v '^secure$' $DATA/localhost4)
 
 # localhost/http
 $DIFF <($NR --node localhost) $DATA/localhost
-$DIFF <($NR --backends getaddrinfo --node localhost --service http) $DATA/localhost-http
-$DIFF <($NR --backends nss:files --node localhost --service http) $DATA/localhost-http
-$DIFF <($NR --backends nss:files:gethostbyname4 --node localhost --service http) $DATA/localhost-http
-$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost --service http) $DATA/localhost-http
-$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost --service http) $DATA/localhost-http
-$DIFF <($NR --backends nss:files:gethostbyname --node localhost --service http) $DATA/localhost4-http
+$DIFF <($NR --backends getaddrinfo --node localhost --service http) <(grep -v '^secure$' $DATA/localhost-http)
+$DIFF <($NR --backends nss:files --node localhost --service http) <(grep -v '^secure$' $DATA/localhost-http)
+$DIFF <($NR --backends nss:files:gethostbyname4 --node localhost --service http) <(grep -v '^secure$' $DATA/localhost-http)
+$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost --service http) <(grep -v '^secure$' $DATA/localhost-http)
+$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost --service http) <(grep -v '^secure$' $DATA/localhost-http)
+$DIFF <($NR --backends nss:files:gethostbyname --node localhost --service http) <(grep -v '^secure$' $DATA/localhost4-http)
 
 # localhost (ip4)
 $DIFF <($NR --node localhost --family ip4) $DATA/localhost4
-$DIFF <($NR --backends nss:files --node localhost --family ip4) $DATA/localhost4
+$DIFF <($NR --backends nss:files --node localhost --family ip4) <(grep -v '^secure$' $DATA/localhost4)
 $DIFF <($NR --backends nss:files:gethostbyname4 --node localhost --family ip4) $DATA/failed
-$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost --family ip4) $DATA/localhost4
-$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost --family ip4) $DATA/localhost4
-$DIFF <($NR --backends nss:files:gethostbyname --node localhost --family ip4) $DATA/localhost4
+$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost --family ip4) <(grep -v '^secure$' $DATA/localhost4)
+$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost --family ip4) <(grep -v '^secure$' $DATA/localhost4)
+$DIFF <($NR --backends nss:files:gethostbyname --node localhost --family ip4) <(grep -v '^secure$' $DATA/localhost4)
 
 # localhost (ip6)
 $DIFF <($NR --node localhost --family ip6) $DATA/localhost6
-$DIFF <($NR --backends nss:files --node localhost --family ip6) $DATA/localhost6
-$DIFF <($NR --backends nss:files:gethostbyname4 --node localhost --family ip6) $DATA/failed
-$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost --family ip6) $DATA/localhost6
-$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost --family ip6) $DATA/localhost6
-$DIFF <($NR --backends nss:files:gethostbyname --node localhost --family ip6) $DATA/empty
+$DIFF <($NR --backends nss:files --node localhost --family ip6) <(grep -v '^secure$' $DATA/localhost6)
+$DIFF <($NR --backends nss:files:gethostbyname4 --node localhost --family ip6) <(grep -v '^secure$' $DATA/failed)
+$DIFF <($NR --backends nss:files:gethostbyname3 --node localhost --family ip6) <(grep -v '^secure$' $DATA/localhost6)
+$DIFF <($NR --backends nss:files:gethostbyname2 --node localhost --family ip6) <(grep -v '^secure$' $DATA/localhost6)
+$DIFF <($NR --backends nss:files:gethostbyname --node localhost --family ip6) <(grep -v '^secure$' $DATA/empty)
 
 # localhost4
 $DIFF <($NR --node localhost4) $DATA/localhost4