From 2ddad6ff9283126d743fcf8b1da2c09f46fb10ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 25 Aug 2023 16:11:06 +0200
Subject: [PATCH] Workarounds to DNSSEC failing infrastructure

Be it systemd-resolved activation or some servers not providing working
dnssec, it needs workarounds to resolv.conf.
---
 Sanity/delv-smoke-test/runtest.sh | 46 ++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/Sanity/delv-smoke-test/runtest.sh b/Sanity/delv-smoke-test/runtest.sh
index 556e60a..0a3c0be 100755
--- a/Sanity/delv-smoke-test/runtest.sh
+++ b/Sanity/delv-smoke-test/runtest.sh
@@ -29,18 +29,42 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 : ${PACKAGE:="bind"}
+BACKUP_RESOLV=""
+SOURCE_RESOLV="/etc/resolv.conf"
 
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm $PACKAGE-utils
-	rlRun "cat /etc/resolv.conf"
-	if dig +dnssec  dnskey | grep RRSIG; then
-		rlLog "Infrastructure supports DNSSEC"
-		DNSSEC=yes
+	rlRun "REAL_RESOLV=$(realpath /etc/resolv.conf)"
+	rlRun "BACKUP_RESOLV=$(mktemp /etc/resolv-XXXXXX.conf)"
+	rlRun "rm -f $BACKUP_RESOLV"
+	if [ "$REAL_RESOLV" = /run/systemd/resolve/stub-resolv.conf ]; then
+		rlWarning "systemd-resolved stub detected, temporary switching..."
+		rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
+		SOURCE_RESOLV="/run/systemd/resolve/resolv.conf"
 	else
-		DNSSEC=no
+		rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
+		SOURCE_RESOLV="$BACKUP_RESOLV"
 	fi
-	rlRun "" 0 "Check infrastructure supports DNSSEC records"
+	rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
+	rlRun -l "cat /etc/resolv.conf"
+	DNSSEC=""
+	for NS in $(awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf)
+	do
+		if dig +dnssec @$NS | grep -q RRSIG; then
+			rlLog "nameserver $NS supports DNSSEC"
+			DNSSEC=yes
+		else
+			rlLogWarning "nameserver $NS does not support DNSSEC!"
+			rlRun "sed -e '/$NS/ d' -i /etc/resolv.conf"
+		fi
+	done
+	if [ -z "$DNSSEC" ]; then
+		DNSSEC=no
+		rlLogWarning "Infrastructure does not support DNSSEC at all!"
+		rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
+	fi
+	rlRun -l "cat /etc/resolv.conf" 0 "after modifications"
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -50,6 +74,7 @@ rlJournalStart
 	rlAssertGrep 'serial' $rlRun_LOG
 	rlRun -s "delv +multi +vtrace"
 	LINES=$(wc -l $rlRun_LOG)
+	rlRun -l "cat $rlRun_LOG"
 	rlAssertGreater "delv +vtrace should show few lines" "$LINES" "10"
 	rlRun "delv +vtrace | grep 'fully validated'"
 	if [ "$DNSSEC" = yes ]; then
@@ -62,7 +87,14 @@ rlJournalStart
 		rlAssertGrep 'marking as secure' $rlRun_LOG
 
 	fi
-	cat /etc/resolv.conf
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+	rlRun "rm -f $rlRun_LOG"
+	if [ -n "$BACKUP_RESOLV" ]; then
+		rlRun "rm -f /etc/resolv.conf"
+		rlRun "mv $BACKUP_RESOLV /etc/resolv.conf"
+	fi
     rlPhaseEnd
 
 rlJournalPrintText