BRO_DNS_FAKE was historically for controlling how/if DNS constantns in
scripts get resolved (i.e., set[add] = { www.google.com }). The
lookup_* functions came later and might fail to take that into
account.
Also, I'm wondering if our test suite should set BRO_DNS_FAKE
generally. It's not great because it changes quite a bit what's
happening; on the other hand doing all the lookups every time the
suite runs isn't ideal either.
I have a slightly different angle on that. I think it's reasonable to set BRO_DNS_FAKE (assuming it works more completely than it currently does) for the tests because eventually I don't think that the scripts in policy will be part of the base Bro distribution forever and I think it's reasonable to have them tested separately and with all the caveats that accompany testing those scripts.
For the moment though, I still think it's reasonable though since our test suite shouldn't be relying on external DNS servers returning the same information forever. Perhaps we should come up with more general tests for testing that stuff to make sure that external services are still working and working like we expect them to. For example, if Team Cymru changed the output of their MHR service it would be nice to have a test that catches that so we can update appropriately but is not normally run for the performance testing.
.Seth