<div dir="ltr"><div><div><div>Phil,<br><br></div>With the exception of the extra dependencies (dig and python), I like this. I would suggest that if DNSSEC will be enabled, that nslookup (I think that's the only command line resolver included by CeroWRT/OpenWRT base installs) be extended to have a similar option as dig, to resolve without DNSSEC.<br>
<br></div>The only other issue I see is if the router is brought online before internet access is available. If I read your code correctly, it will try 4 times per defined server (with and without DNSSEC for IPv4 and IPv6), then exit. It either needs to keep trying until it succeeds, or be called every time a connection comes up (shutting down NTPd prior and restarting after).<br>
<br></div>Thanks.<br><div><div><div><div><div><div class="gmail_extra"><br clear="all"><div>-- <br>David P.</div>
<br><br><br><div class="gmail_quote">On Mon, Mar 24, 2014 at 3:12 PM, Phil Pennock <span dir="ltr"><<a href="mailto:cerowrt-devel+phil@spodhuis.org" target="_blank">cerowrt-devel+phil@spodhuis.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 2014-03-21 at 23:33 -0400, Joseph Swick wrote:<br>
> I've been lurking for several months now on the list and I remember some<br>
> discussion about trying to find acceptable methods for bootstrapping the<br>
> local system time so that DNSSEC would work.<br>
<br>
</div>I raised this on the ntp-pool mailing-lists last year, looking for a<br>
solution because of the chicken/egg bootstrap, with suggested approaches<br>
and some trial scripts. Eg:<br>
<br>
<a href="http://lists.ntp.org/pipermail/pool/2013-July/006569.html" target="_blank">http://lists.ntp.org/pipermail/pool/2013-July/006569.html</a><br>
<br>
For context, I'm currently running OpenWRT; attached is the<br>
/etc/init.d/ntpdate which I'm using. It relies upon having Python and<br>
dig installed, as I haven't gotten around to building a small C utility<br>
to do just this task, but perhaps the approach is useful enough that<br>
someone else might do so?<br>
<br>
In summary: if the current time is less than the timestamp on the<br>
unbound-maintained copy of the root zone trust anchors, then bump the<br>
time up at least that far, because we must be at >= that timestamp, and<br>
this increases the odds that DNSSEC will validate if we haven't been<br>
off-line for too long.<br>
<br>
Then, for each hostname in the $STEP_SERVERS list (which could be<br>
taken from ntp.conf or uci config or whatever, but here is just<br>
hardcoded), I try to resolve IPv4 then IPv6, first with DNSSEC left<br>
enabled, and then with DNSSEC disabled via `dig +cd`. The first dig<br>
command to return results is the one which is used.<br>
<br>
The idea is to minimize the potential vulnerability of syncing to a bad<br>
timesource, by using DNSSEC if it's available and works, after making<br>
sure it has a reasonable chance of working if we've just rebooted, and<br>
only if we've been off-line for some time do we fall back to insecure<br>
DNS.<br>
<br>
Make sure that the START value is appropriate for your systems; I've<br>
found the OpenWRT defaults to be sufficiently broken that I stomp on<br>
them on reinstall. I run ntpdate once the network and firewall are up,<br>
but just before ntpd and both of those well before other network<br>
services which might depend upon time.<br>
<br>
Regards,<br>
-Phil<br>
<br>#!/bin/sh /etc/rc.common<br>
# Copyright (C) 2006-2008 OpenWrt.org<br>
# Copyright (C) 2013 Phil Pennock<br>
<br>
START=60<br>
<br>
STEP_SERVERS="<a href="http://0.openwrt.pool.ntp.org" target="_blank">0.openwrt.pool.ntp.org</a> <a href="http://1.openwrt.pool.ntp.org" target="_blank">1.openwrt.pool.ntp.org</a> <a href="http://2.openwrt.pool.ntp.org" target="_blank">2.openwrt.pool.ntp.org</a>"<br>
TIMEOUT="2" # in seconds<br>
PRESEED_TIMESTAMP_FN="/etc/unbound/runtime/root.autokey"<br>
<br>
# The core problem is that with DNSSEC, an invalid time prevents resolution<br>
# of DNS, but we need DNS to be able to find time-servers to get a good time<br>
# to be able to resolve DNS.<br>
#<br>
# We break out of this "Catch 22" situation by _trying_ normal DNS resolution,<br>
# IPv4 and then IPv6, and only if those fail do we forcibly disable DNSSEC<br>
# by using dig(1)'s +cd flag ("checking disabled"); trying normally first<br>
# protects us against malicious DNS trying to point us to bad time-servers,<br>
# if we've enough state that we _should_ already be protected.<br>
#<br>
# The "insecure" approach we regress to, as a last resort, is the same way<br>
# the Internet functioned for decades. There is a DoS+hijack attack path<br>
# here, but if we don't have a good battery-backed clock to protect us, we<br>
# don't have a better solution.<br>
<br>
# Also, per a suggestion from Doug Calvert, we can use the timestamp of<br>
# modification of the unbound root.key file itself as an approximate time.<br>
# Unbound updates the file on every refresh, so it's not too far off.<br>
<br>
preseed_approximate_time() {<br>
# Unfortunately, date(1) on OpenWRT can't parse the timestamp<br>
# output from ls.<br>
python -c '<br>
import os, time, sys<br>
fn=sys.argv[1]<br>
min_time=os.stat(fn).st_ctime<br>
if time.time() < min_time:<br>
want=time.strftime("%Y%m%d%H%M.%S", time.gmtime(min_time))<br>
os.system("date -u -s %s" % want)' "$PRESEED_TIMESTAMP_FN" > /dev/null<br>
}<br>
<br>
resolve_hostname_v4() {<br>
# we use the grep both to filter out cname referrals and to detect empty<br>
# results<br>
local hn="$1"<br>
shift<br>
dig +nodnssec +short "$@" -t a "$hn" | grep '^[0-9][0-9.]*$'<br>
}<br>
<br>
resolve_hostname_v6() {<br>
local hn="$1"<br>
shift<br>
dig +nodnssec +short "$@" -t aaaa "$hn" | grep -i '^[0-9a-f][0-9a-f.:]*$'<br>
}<br>
<br>
resolve_one_server() {<br>
local hn="$1"<br>
resolve_hostname_v4 $hn && return<br>
resolve_hostname_v6 $hn && return<br>
resolve_hostname_v4 $hn +cd && return<br>
resolve_hostname_v6 $hn +cd && return<br>
}<br>
<br>
resolve_step_servers() {<br>
local server ips<br>
for server in $STEP_SERVERS ; do<br>
resolve_one_server $server<br>
done<br>
}<br>
<br>
start() {<br>
preseed_approximate_time<br>
for s in $(resolve_step_servers) ; do<br>
/usr/sbin/ntpdate -s -b -u -t "$TIMEOUT" "$s" && break<br>
done<br>
}<br>
<br>_______________________________________________<br>
Cerowrt-devel mailing list<br>
<a href="mailto:Cerowrt-devel@lists.bufferbloat.net">Cerowrt-devel@lists.bufferbloat.net</a><br>
<a href="https://lists.bufferbloat.net/listinfo/cerowrt-devel" target="_blank">https://lists.bufferbloat.net/listinfo/cerowrt-devel</a><br>
<br></blockquote></div><br></div></div></div></div></div></div></div>