From e66e17769681610b11d37597f444ccff01603757 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Wed, 10 Mar 2021 12:13:24 +0100
Subject: [PATCH 1/2] ipatests: re-add test_dnssec.py::TestInstallDNSSECFirst
 in gating

The test was temporarily removed because of a known issue
but the issue is now fixed.

Related: https://pagure.io/freeipa/issue/8496
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Sergey Orlov <sorlov@redhat.com>
---
 .../azure/azure_definitions/gating-fedora.yml | 11 +++++-----
 ipatests/prci_definitions/gating.yaml         | 22 +++++++++----------
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/ipatests/azure/azure_definitions/gating-fedora.yml b/ipatests/azure/azure_definitions/gating-fedora.yml
index db85d6557bf..62ded1885a6 100644
--- a/ipatests/azure/azure_definitions/gating-fedora.yml
+++ b/ipatests/azure/azure_definitions/gating-fedora.yml
@@ -26,12 +26,11 @@ vms:
     - test_integration/test_membermanager.py
 
 - vm_jobs:
-  # Temporarily disabled because of https://pagure.io/freeipa/issue/8496
-  # - container_job: InstallDNSSECFirst
-  #     containers:
-  #       replicas: 1
-  #     tests:
-  #     - test_integration/test_dnssec.py::TestInstallDNSSECFirst
+  - container_job: InstallDNSSECFirst
+    containers:
+      replicas: 1
+    tests:
+    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
 
   - container_job: simple_replication
     containers:
diff --git a/ipatests/prci_definitions/gating.yaml b/ipatests/prci_definitions/gating.yaml
index 465d9da45a4..38417db2d7b 100644
--- a/ipatests/prci_definitions/gating.yaml
+++ b/ipatests/prci_definitions/gating.yaml
@@ -239,17 +239,17 @@ jobs:
         timeout: 3600
         topology: *master_1repl
 
-#  fedora-latest-ipa-4-9/test_dnssec_TestInstallDNSSECFirst:
-#    requires: [fedora-latest-ipa-4-9/build]
-#    priority: 100
-#    job:
-#      class: RunPytest
-#      args:
-#        build_url: '{fedora-latest-ipa-4-9/build_url}'
-#        test_suite: test_integration/test_dnssec.py::TestInstallDNSSECFirst
-#        template: *ci-ipa-4-9-latest
-#        timeout: 3600
-#        topology: *master_1repl
+  fedora-latest-ipa-4-9/test_dnssec_TestInstallDNSSECFirst:
+    requires: [fedora-latest-ipa-4-9/build]
+    priority: 100
+    job:
+      class: RunPytest
+      args:
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
+        test_suite: test_integration/test_dnssec.py::TestInstallDNSSECFirst
+        template: *ci-ipa-4-9-latest
+        timeout: 3600
+        topology: *master_1repl
 
   fedora-latest-ipa-4-9/test_membermanager:
     requires: [fedora-latest-ipa-4-9/build]

From 0cf3a44b4dde1ee9187060839ff10cf462f4dd7c Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Thu, 11 Mar 2021 14:10:56 +0100
Subject: [PATCH 2/2] ipatests: fix TestInstalDNSSECFirst::test_resolvconf
 logic

The test test_dnssec.py::TestInstallDNSSECFirst::test_resolvconf
checks that /etc/resolv.conf points to the localhost and
fails on fedora33 because systemd-resolved is in place
(and /etc/resolv.conf contains 127.0.0.53).
The test logic needs to be adapted. When systemd-resolved is
used, the test can check the output of "resolvectl dns".

Fixes: https://pagure.io/freeipa/issue/8695
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Sergey Orlov <sorlov@redhat.com>
---
 ipatests/pytest_ipa/integration/resolver.py | 22 +++++++++++++++++++++
 ipatests/test_integration/test_dnssec.py    |  7 +++----
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/ipatests/pytest_ipa/integration/resolver.py b/ipatests/pytest_ipa/integration/resolver.py
index 43b2e2b4818..5bfbbf4fe4b 100644
--- a/ipatests/pytest_ipa/integration/resolver.py
+++ b/ipatests/pytest_ipa/integration/resolver.py
@@ -1,6 +1,7 @@
 import os
 import abc
 import logging
+import re
 import textwrap
 import time
 
@@ -131,6 +132,16 @@ def _apply_state(self, state):
         :param state: internal state object  specific to subclass implementaion
         """
 
+    def uses_localhost_as_dns(self):
+        """Return true if the localhost is set as DNS server.
+
+        Default implementation checks the content of /etc/resolv.conf
+        """
+        resolvconf = self.host.get_file_contents(paths.RESOLV_CONF, 'utf-8')
+        patterns = [r"^\s*nameserver\s+127\.0\.0\.1\s*$",
+                    r"^\s*nameserver\s+::1\s*$"]
+        return any(re.search(p, resolvconf, re.MULTILINE) for p in patterns)
+
 
 class ResolvedResolver(Resolver):
     RESOLVED_RESOLV_CONF = {
@@ -192,6 +203,17 @@ def _apply_state(self, state):
                 self.RESOLVED_CONF_FILE, state['resolved_config'])
         self._restart_resolved()
 
+    def uses_localhost_as_dns(self):
+        """Return true if the localhost is set as DNS server.
+
+        When systemd-resolved is in use, the DNS can be found using
+        the command resolvectldns.
+        """
+        dnsconf = self.host.run_command(['resolvectl', 'dns']).stdout_text
+        patterns = [r"^Global:.*\s+127.0.0.1\s+.*$",
+                    r"^Global:.*\s+::1\s+.*$"]
+        return any(re.search(p, dnsconf, re.MULTILINE) for p in patterns)
+
 
 class PlainFileResolver(Resolver):
     IPATESTS_RESOLVER_COMMENT = '# created by ipatests'
diff --git a/ipatests/test_integration/test_dnssec.py b/ipatests/test_integration/test_dnssec.py
index d80a77a811c..bae16120a7a 100644
--- a/ipatests/test_integration/test_dnssec.py
+++ b/ipatests/test_integration/test_dnssec.py
@@ -462,11 +462,10 @@ def test_chain_of_trust(self):
         self.master.run_command(args)
         self.replicas[0].run_command(args)
 
-    def test_resolvconf(self):
-        # check that resolv.conf contains IP address for localhost
+    def test_servers_use_localhost_as_dns(self):
+        # check that localhost is set as DNS server
         for host in [self.master, self.replicas[0]]:
-            resolvconf = host.get_file_contents(paths.RESOLV_CONF, 'utf-8')
-            assert any(ip in resolvconf for ip in ('127.0.0.1', '::1'))
+            assert host.resolver.uses_localhost_as_dns()
 
 
 class TestMigrateDNSSECMaster(IntegrationTest):
