From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail2.tohojo.dk (mail2.tohojo.dk [IPv6:2a01:4f8:200:3141::101]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by huchra.bufferbloat.net (Postfix) with ESMTPS id C710321F100 for ; Sun, 30 Mar 2014 06:21:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at example.com Received: by alrua-x1.borgediget.toke.dk (Postfix, from userid 1000) id DE2F21CA2E; Sun, 30 Mar 2014 15:21:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toke.dk; s=201310; t=1396185681; bh=EyaX8qmv1WOvKlzZFVXaKdS11mlQJggOj3RtI+AohMY=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=pWZDuNMjRtB968Uot+8euKOaEfpDua1q/Oj0XAsh6TzSRXriQX2TdSGJFtzBu576t 5pHBdFdBGLWMGWXGwFTeEDBrhI1vZmx7SHTHSKOmUfywnfxoyP0qOINU1tx//oQsGN AAj9mi5a+PuryNuVTnPwgDMgcsI0q1qUYOdiUidk= From: =?utf-8?Q?Toke_H=C3=B8iland-J=C3=B8rgensen?= To: Dave Taht References: <532DD9DD.8040301@thekelleys.org.uk> <871txut453.fsf@alrua-x1.karlstad.toke.dk> <532DE7A8.3010504@thekelleys.org.uk> <87ppleroks.fsf@alrua-x1.karlstad.toke.dk> <53348C32.4040907@thekelleys.org.uk> <87ha6idabz.fsf@alrua-x1.karlstad.toke.dk> <53353C07.9030000@thekelleys.org.uk> <87eh1madfy.fsf@toke.dk> <533551F6.9010402@thekelleys.org.uk> <87lhvu8uqi.fsf@toke.dk> <5335E1BD.7010304@thekelleys.org.uk> <87k3bdbbt6.fsf@alrua-x1.karlstad.toke.dk> <87bnwpb7f7.fsf_-_@alrua-x1.karlstad.toke.dk> <421.1396128076@sandelman.ca> Date: Sun, 30 Mar 2014 15:21:15 +0200 In-Reply-To: (Dave Taht's message of "Sat, 29 Mar 2014 14:30:13 -0700") Message-ID: <877g7bbz5g.fsf@alrua-x1.karlstad.toke.dk> Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Cc: "cerowrt-devel@lists.bufferbloat.net" Subject: Re: [Cerowrt-devel] DNSSEC & NTP Bootstrapping -- prototype! X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Mar 2014 13:21:32 -0000 --=-=-= Content-Type: text/plain Dave Taht writes: > Well I strongly favor less interdependency between ntp, a monitoring > script, and dnsmasq. Well, the reverse dependency (i.e. the modification of the ntpd startup script) is not strictly needed, so the dependency could be made to be one-way (it kinda is already). Also, in case ntpd is missing it's quite easy to just bail out and start dnsmasq in full validation mode. The nice thing about this switch to dnsmasq is that it does validation of the chain, just ignoring validity times; which presumably would make it harder to exploit as you'd need an actual valid key, rather than just be able to spoof the packets reply of the non-validated query... > I'd kind of like some sort of check on validating the dns roots, if it > fails due to the time being wrong, disable dnssec and wait for clock > slew. Well conceivably you could be in a situation where the roots validate, but validation fails further down the chain, making that scheme fail in weird and unpredictable ways? > Another other alternative is a ntp that does a query with the > authenticate bit off, all the time. This would involve teaching the uclibc resolver about the CD bit and expose it in the resolver API I think. Can look into how difficult this actually is to do; with the caveat that I'm not exactly an expert on such code :P Also, see above re: validation modes. > On Sat, Mar 29, 2014 at 2:21 PM, Michael Richardson wrote: >> >> This process needs to be written up as an IETF BCP. I'll be happy to write something up once we actually settle on something :) -Toke --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBCAAGBQJTOBpLAAoJEENeEGz1+utP4SIIAKkZ1OnkV3z9GD952tepMldu wt9G1lkrHgQE0ctzslLKkPRIPK7hAoK3BJkugzYHdfmRsTIMl7kme8oFV9HxpHYF dr7TtQly31L+x2Sak5tQ2J0jAcAUL7iLk24G/TdSF610iNBffKKqIjaykMvmsKTT Fm67R5kefxw3ghRLH9i0QF3cLekeKILaWUVcwlRyKG68dW5X3slG6BfbIZcBf2Kz VZ+36EUkkgOthvthHvvQwP02J8FZRSJOFhOMFghSoGHWm79nT0Zxr9RIi9es2pn8 3+LSe0eV0rlYxkFzg9rxcvNLW6Ri/lyYUFFtuaCYUo9o54D7hThHzlG90F2KQyE= =HLCI -----END PGP SIGNATURE----- --=-=-=--