tests/bind
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Workarounds to DNSSEC failing infrastructure

Browse source 
Be it systemd-resolved activation or some servers not providing working
dnssec, it needs workarounds to resolv.conf.
This commit is contained in:
Petr Menšík 2023-08-25 16:11:06 +02:00
commit 2ddad6ff92
1 changed files with 38 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

46
Sanity/delv-smoke-test/runtest.sh
View file

@ -29,18 +29,42 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
: ${PACKAGE:="bind"}
BACKUP_RESOLV=""
SOURCE_RESOLV="/etc/resolv.conf"
rlJournalStart
rlPhaseStartSetup
rlAssertRpm $PACKAGE-utils
rlRun "cat /etc/resolv.conf"
if dig +dnssec dnskey | grep RRSIG; then
rlLog "Infrastructure supports DNSSEC"
DNSSEC=yes
rlRun "REAL_RESOLV=$(realpath /etc/resolv.conf)"
rlRun "BACKUP_RESOLV=$(mktemp /etc/resolv-XXXXXX.conf)"
rlRun "rm -f $BACKUP_RESOLV"
if [ "$REAL_RESOLV" = /run/systemd/resolve/stub-resolv.conf ]; then
rlWarning "systemd-resolved stub detected, temporary switching..."
rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
SOURCE_RESOLV="/run/systemd/resolve/resolv.conf"
else
DNSSEC=no
rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
SOURCE_RESOLV="$BACKUP_RESOLV"
fi
rlRun "" 0 "Check infrastructure supports DNSSEC records"
rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
rlRun -l "cat /etc/resolv.conf"
DNSSEC=""
for NS in $(awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf)
do
if dig +dnssec @$NS | grep -q RRSIG; then
rlLog "nameserver $NS supports DNSSEC"
DNSSEC=yes
else
rlLogWarning "nameserver $NS does not support DNSSEC!"
rlRun "sed -e '/$NS/ d' -i /etc/resolv.conf"
fi
done
if [ -z "$DNSSEC" ]; then
DNSSEC=no
rlLogWarning "Infrastructure does not support DNSSEC at all!"
rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
fi
rlRun -l "cat /etc/resolv.conf" 0 "after modifications"
rlPhaseEnd
rlPhaseStartTest
@ -50,6 +74,7 @@ rlJournalStart
rlAssertGrep 'serial' $rlRun_LOG
rlRun -s "delv +multi +vtrace"
LINES=$(wc -l $rlRun_LOG)
rlRun -l "cat $rlRun_LOG"
rlAssertGreater "delv +vtrace should show few lines" "$LINES" "10"
rlRun "delv +vtrace | grep 'fully validated'"
if [ "$DNSSEC" = yes ]; then
@ -62,7 +87,14 @@ rlJournalStart
rlAssertGrep 'marking as secure' $rlRun_LOG
fi
cat /etc/resolv.conf
rlPhaseEnd
rlPhaseStartCleanup
rlRun "rm -f $rlRun_LOG"
if [ -n "$BACKUP_RESOLV" ]; then
rlRun "rm -f /etc/resolv.conf"
rlRun "mv $BACKUP_RESOLV /etc/resolv.conf"
fi
rlPhaseEnd
rlJournalPrintText