Since a recent upgrade of dnssec-trigger the "search" option to set
custom search domains is ignored. Looking at the dnssec-trigger-script
which writes resolv.conf it does not even look at this option.

While this does not make the package unusable I consider it quite
important to be able to set custom search domains. If possible it would
be nice this could be fixed for stretch.

Gaudenz

This seems to be caused by a new option, set_search_domains, in
/etc/dnssec.conf. It defaults to 'no', but if you set it to 'yes',
search domains are properly added to /etc/resolv.conf, again.

(Note: Make sure to look at /etc/dnssec.conf, not
/etc/dnssec-trigger/dnssec.conf, which may be present as a stale config
file, due to Bug#850001)

Jan

Unfortunately it seems that setting set_search_domains=yes in
dnssec.conf is not enough.

The code in dnssec-trigger-script does not look at the contents of
"search:" in /etc/dnssec-trigger/dnssec-trigger.conf even with that set.
Instead, it seems to query NetworkManager for search domains but even
that fails on current Debian releases, since the configured search
domains there do not even show up in the debug log:

Sep 15 14:47:19 believe dnssec-triggerd[29297]: Search domains:

The reason for that is that the script looks at networkmanagers
connection calls:

self.zones += connection.get_ip4_config().get_domains()

But instead, or additionally, it should call get_searches(); as far as I
understand it, zones is what is passed through in a DHCP request as the
local domain for a DHCP client but additional DNS search domains
configured for a NM connection only show up in get_searches().

So this is broken in multiple ways, and I imagine it's not just on Debian.

Hello.

In the past, when Pavel Simerda (he no longer works for Red Hat) reworked the way dnssec-trigger sets up /etc/resolv.conf (by calling the dnssec-trigger-script script from the daemon), he unintentionally broke this functionality. It has been broken since then in upstream.

We track the issue in Fedora bug: https://bugzilla.redhat.com/show_bug.cgi?id=1287607

In the long run, we would like to get rid of the python script and consolidate the logic only into the daemon. Part of that would be also to fix this one bug. However everyone in my team has been busy with other thing, so this is still on our TODO with no ETA.

Some work in progress is on GitHub (https://github.com/InfrastructureServices/dnssec-trigger/commits/master-fedora), but it still needs to be polished and sent to the upstream.

Regards,
Tomas