Use next resolv.conf if first is is security-unaware

Check servers in the most preferred resolv.conf file. If it does not
contain security-aware servers, try next file. Only use fallback
addresses if none of detected servers works with DNSSEC.

Sanity/caching-forwarder-dnssec/test.sh

@@ -4,7 +4,7 @@
 
 : ${CLEAN_ANCHORS:=y}
 
-bu_FALLBACK_SERVERS="8.8.8.8 8.8.4.4"
+bu_FALLBACK_SERVERS="8.8.8.8 8.8.4.4 9.9.9.9"
 bu_DELV=$(type -p delv 2>/dev/null)
 bu_DIG=$(type -p dig 2>/dev/null)
 # Servers which failed DNSSEC-awareness check
@@ -15,29 +15,42 @@ buGetServersConf() {
 	awk '$1 == "nameserver" { printf "%s%s", DL, $2; DL=" " }' "$RESOLV_CONF"
 }
 
-buGetNameservers() {
-	# avoids systemd-resolved breaking dnssec, prefer communication with remote servers directly
+# Get list of resolv-conf (like) files, which might contain useful DNS servers
+# Ordered in preference, tries to avoid DNSSEC-unaware servers
+buGetCandidateResolvConf() {
 	local -a CONF_FILES=()
 	systemctl is-active --quiet NetworkManager && CONF_FILES+=("/run/NetworkManager/no-stub-resolv.conf")
 	systemctl is-active --quiet systemd-resolved && CONF_FILES+=("/run/systemd/resolve/resolv.conf")
-	CONF_FILES+=(/etc/resolv.conf)
-	for CONF in "${CONF_FILES[@]}"
+	CONF_FILES+=("/etc/resolv.conf")
+	echo "${CONF_FILES[@]}"
+}
+
+# Print list of nameservers addresses, space separated.
+# No check on them is done.
+buGetNameservers() {
+	# avoids systemd-resolved breaking dnssec, prefer communication with remote servers directly
+	for CONF in $(buGetCandidateResolvConf)
 	do
+		local SERVERS
 		# intentionally do not prefer local resolv.conf, because systemd-resolved is breaking it often
-		if [ -r "$CONF" ]; then
-			local SERVERS=$(buGetServersConf "$CONF")
-			if [ -n "$SERVERS" ]; then
-				echo "$SERVERS"
-				break
-			fi
+		if [ -r "$CONF" ] && SERVERS=$(buGetServersConf "$CONF") && [ -n "$SERVERS" ]; then
+			echo "$SERVERS"
+			break
 		fi
 	done
 }
 
+# Test server IP addresses give as parameters to find those, who
+# are security-aware.
+# Param1: space separated IP addresses of DNS servers
 buCheckSecureNameservers() {
 	local SERVERS="$1"
 	bu_SECURE_SERVERS=""
 
+	if [ -z "$bu_DELV" ] && [ -z "$bu_DIG" ]; then
+		rlFail "Both delv and dig from bind-utils are missing!"
+		return 1
+	fi
 	for NS in ${SERVERS}; do
 		if [ -n "$bu_DELV" ]; then
 			
@@ -55,22 +68,37 @@ buCheckSecureNameservers() {
 			fi
 		fi
 	done
+	[ -n "$bu_SECURE_SERVERS" ]
 }
 
 # Try to find DNSSEC capable network provided forwarders.
 # If that fails try to verify $bu_FALLBACK_SERVERS works and use them.
 # If no working server is found, call rlDie to stop the test.
+# Outputs found servers into bu_SECURE_SERVERS and bu_FAILED_SERVERS
+# variables
 buGetSecureNameservers() {
-	local SERVERS="$(buGetNameservers)"
-	if [ -z "$SERVERS" ]; then
-		rlDie "No nameservers obtained!"
+	bu_FAILED_SERVERS=""
+	local SERVERS=""
+
+	# avoids systemd-resolved breaking dnssec, prefer communication with remote servers directly
+	for CONF in $(buGetCandidateResolvConf)
+	do
+		# intentionally do not prefer local resolv.conf, because systemd-resolved is breaking it often
+		if [ -r "$CONF" ] && SERVERS=$(buGetServersConf "$CONF") && [ -n "$SERVERS" ]; then
+			rlLogDebug "Checking servers from $CONF..."
+			buCheckSecureNameservers "$SERVERS" && break
+		fi
+	done
+	if [ -z "${bu_SECURE_SERVERS}${bu_FAILED_SERVERS}" ]; then
+		rlDie "No nameservers obtained, tried files: $(buGetCandidateResolvConf)"
 		return 1
 	fi
-	bu_FAILED_SERVERS=""
-	local SECURE_SERVERS=""
-
-	buCheckSecureNameservers "$SERVERS"
 	if [ -z "$bu_SECURE_SERVERS" ]; then
+		rlLog "Found resolv files..."
+		for CONF in $(buGetCandidateResolvConf)
+		do
+			rlRun -l "cat $CONF"
+		done
 		rlLog "Versions of network provided nameservers..."
 		for NS in ${SERVERS}
 		do
@@ -79,8 +107,8 @@ buGetSecureNameservers() {
 		if [ -n "$bu_FALLBACK_SERVERS" ]; then
 			# If we have access to public DNS servers, use them instead. They are known to support DNSSEC.
 			buCheckSecureNameservers "$bu_FALLBACK_SERVERS"
-			SERVERS+=" $bu_FALLBACK_SERVERS"
 			rlLogWarning "No network provided servers (${SERVERS}) support DNSSEC! Fix the infrastructure!"
+			SERVERS+=" $bu_FALLBACK_SERVERS"
 		fi
 	fi
 	if [ -z "$bu_SECURE_SERVERS" ]; then
@@ -91,7 +119,7 @@ buGetSecureNameservers() {
 	if [ -n "$bu_FAILED_SERVERS" ]; then
 		rlLogWarning "Servers not supporting DNSSEC: ${bu_FAILED_SERVERS}"
 	fi
-	rlLogInfo "Found secure servers: $bu_SECURE_SERVERS"
+	rlLogInfo "Found security-aware servers: $bu_SECURE_SERVERS"
 }
 
 # Create bind forwarder configuration from servers entered as parameters