From 426b3debbb654011097ec7bc3769b8ce7eee6d2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 6 Jun 2022 13:49:25 +0200 Subject: [PATCH] Workaround resolved breaking the resolution systemd-resolved does not provide DNSSEC entries in default configuration. Workaround that by using servers used by it, but not the resolved itself. --- .../runtest.sh | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/Sanity/Unbound-fails-resolution-of-any-SHA-1-signed-domain/runtest.sh b/Sanity/Unbound-fails-resolution-of-any-SHA-1-signed-domain/runtest.sh index ef0d3e3..990a2e2 100755 --- a/Sanity/Unbound-fails-resolution-of-any-SHA-1-signed-domain/runtest.sh +++ b/Sanity/Unbound-fails-resolution-of-any-SHA-1-signed-domain/runtest.sh @@ -38,14 +38,22 @@ rlJournalStart rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" + rlRun "RESOLV_CONF=$(realpath /etc/resolv.conf)" + if [ "$RESOLV_CONF" = "/run/systemd/resolve/stub-resolv.conf" ]; then + rlLog "systemd-resolved is known to break dnssec. Switching to remote resolvers." + rlRun "rm -f /etc/resolv.conf" + RESOLV_CONF_ORIG="$RESOLV_CONF" + RESOLV_CONF=/run/systemd/resolve/resolv.conf + rlRun "ln -s $RESOLV_CONF /etc/resolv.conf" 0 "Link to non-stub resolv.conf" + fi rlPhaseEnd rlPhaseStartTest rm -rf log for i in $ListSha1Signed;do rlLog "trying $i" - if unbound-host ietf.org;then - rlRun "unbound-host -rD $i &> log" + if unbound-host -vr ietf.org;then + rlRun "unbound-host -rvD $i &> log" rlRun "grep 'failure' log" 1-255 rlRun "grep 'has address' log" cat log @@ -57,6 +65,10 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup + if [ -n "$RESOLV_CONF_ORIG" ]; then + rlRun "rm -f /etc/resolv.conf" + rlRun "ln -s $RESOLV_CONF_ORIG /etc/resolv.conf" 0 "Link to non-stub resolv.conf" + fi rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" rlPhaseEnd