<div dir="ltr"><div># ll $(which nslookup)<br>lrwxrwxrwx 1 root root 17 Mar 21 13:16 /usr/bin/nslookup -> ../../bin/busybox<br><br></div>I'm not sure it's the old nslookup that we're thinking of...<br>
<div><div class="gmail_extra"><br clear="all"><div>-- <br>David P.</div>
<br><br><br><div class="gmail_quote">On Mon, Mar 24, 2014 at 5:58 PM, Dave Taht <span dir="ltr"><<a href="mailto:dave.taht@gmail.com" target="_blank">dave.taht@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I ship dig as an optional package for cerowrt.<br>
<br>
I think it's in bind-tools or bind-utils. It is terribly big, but most<br>
people hae enough spare flash to have it.<br>
<br>
An<br>
<br>
opkg update<br>
opkg list | less<br>
<br>
will show you what is available.<br>
<br>
I will argue that nobody wants to add functionality to the primitive<br>
nsupdate....<br>
<div class="HOEnZb"><div class="h5"><br>
On Mon, Mar 24, 2014 at 1:27 PM, David Personette <<a href="mailto:dperson@gmail.com">dperson@gmail.com</a>> wrote:<br>
> Phil,<br>
><br>
> With the exception of the extra dependencies (dig and python), I like this.<br>
> I would suggest that if DNSSEC will be enabled, that nslookup (I think<br>
> that's the only command line resolver included by CeroWRT/OpenWRT base<br>
> installs) be extended to have a similar option as dig, to resolve without<br>
> DNSSEC.<br>
><br>
> The only other issue I see is if the router is brought online before<br>
> internet access is available. If I read your code correctly, it will try 4<br>
> times per defined server (with and without DNSSEC for IPv4 and IPv6), then<br>
> exit. It either needs to keep trying until it succeeds, or be called every<br>
> time a connection comes up (shutting down NTPd prior and restarting after).<br>
><br>
> Thanks.<br>
><br>
> --<br>
> David P.<br>
><br>
><br>
><br>
> On Mon, Mar 24, 2014 at 3:12 PM, Phil Pennock<br>
> <<a href="mailto:cerowrt-devel%2Bphil@spodhuis.org">cerowrt-devel+phil@spodhuis.org</a>> wrote:<br>
>><br>
>> On 2014-03-21 at 23:33 -0400, Joseph Swick wrote:<br>
>> > I've been lurking for several months now on the list and I remember some<br>
>> > discussion about trying to find acceptable methods for bootstrapping the<br>
>> > local system time so that DNSSEC would work.<br>
>><br>
>> I raised this on the ntp-pool mailing-lists last year, looking for a<br>
>> solution because of the chicken/egg bootstrap, with suggested approaches<br>
>> and some trial scripts. Eg:<br>
>><br>
>> <a href="http://lists.ntp.org/pipermail/pool/2013-July/006569.html" target="_blank">http://lists.ntp.org/pipermail/pool/2013-July/006569.html</a><br>
>><br>
>> For context, I'm currently running OpenWRT; attached is the<br>
>> /etc/init.d/ntpdate which I'm using. It relies upon having Python and<br>
>> dig installed, as I haven't gotten around to building a small C utility<br>
>> to do just this task, but perhaps the approach is useful enough that<br>
>> someone else might do so?<br>
>><br>
>> In summary: if the current time is less than the timestamp on the<br>
>> unbound-maintained copy of the root zone trust anchors, then bump the<br>
>> time up at least that far, because we must be at >= that timestamp, and<br>
>> this increases the odds that DNSSEC will validate if we haven't been<br>
>> off-line for too long.<br>
>><br>
>> Then, for each hostname in the $STEP_SERVERS list (which could be<br>
>> taken from ntp.conf or uci config or whatever, but here is just<br>
>> hardcoded), I try to resolve IPv4 then IPv6, first with DNSSEC left<br>
>> enabled, and then with DNSSEC disabled via `dig +cd`. The first dig<br>
>> command to return results is the one which is used.<br>
>><br>
>> The idea is to minimize the potential vulnerability of syncing to a bad<br>
>> timesource, by using DNSSEC if it's available and works, after making<br>
>> sure it has a reasonable chance of working if we've just rebooted, and<br>
>> only if we've been off-line for some time do we fall back to insecure<br>
>> DNS.<br>
>><br>
>> Make sure that the START value is appropriate for your systems; I've<br>
>> found the OpenWRT defaults to be sufficiently broken that I stomp on<br>
>> them on reinstall. I run ntpdate once the network and firewall are up,<br>
>> but just before ntpd and both of those well before other network<br>
>> services which might depend upon time.<br>
>><br>
>> Regards,<br>
>> -Phil<br>
>><br>
>> #!/bin/sh /etc/rc.common<br>
>> # Copyright (C) 2006-2008 OpenWrt.org<br>
>> # Copyright (C) 2013 Phil Pennock<br>
>><br>
>> START=60<br>
>><br>
>> STEP_SERVERS="<a href="http://0.openwrt.pool.ntp.org" target="_blank">0.openwrt.pool.ntp.org</a> <a href="http://1.openwrt.pool.ntp.org" target="_blank">1.openwrt.pool.ntp.org</a><br>
>> <a href="http://2.openwrt.pool.ntp.org" target="_blank">2.openwrt.pool.ntp.org</a>"<br>
>> TIMEOUT="2" # in seconds<br>
>> PRESEED_TIMESTAMP_FN="/etc/unbound/runtime/root.autokey"<br>
>><br>
>> # The core problem is that with DNSSEC, an invalid time prevents<br>
>> resolution<br>
>> # of DNS, but we need DNS to be able to find time-servers to get a good<br>
>> time<br>
>> # to be able to resolve DNS.<br>
>> #<br>
>> # We break out of this "Catch 22" situation by _trying_ normal DNS<br>
>> resolution,<br>
>> # IPv4 and then IPv6, and only if those fail do we forcibly disable DNSSEC<br>
>> # by using dig(1)'s +cd flag ("checking disabled"); trying normally first<br>
>> # protects us against malicious DNS trying to point us to bad<br>
>> time-servers,<br>
>> # if we've enough state that we _should_ already be protected.<br>
>> #<br>
>> # The "insecure" approach we regress to, as a last resort, is the same way<br>
>> # the Internet functioned for decades. There is a DoS+hijack attack path<br>
>> # here, but if we don't have a good battery-backed clock to protect us, we<br>
>> # don't have a better solution.<br>
>><br>
>> # Also, per a suggestion from Doug Calvert, we can use the timestamp of<br>
>> # modification of the unbound root.key file itself as an approximate time.<br>
>> # Unbound updates the file on every refresh, so it's not too far off.<br>
>><br>
>> preseed_approximate_time() {<br>
>> # Unfortunately, date(1) on OpenWRT can't parse the timestamp<br>
>> # output from ls.<br>
>> python -c '<br>
>> import os, time, sys<br>
>> fn=sys.argv[1]<br>
>> min_time=os.stat(fn).st_ctime<br>
>> if time.time() < min_time:<br>
>> want=time.strftime("%Y%m%d%H%M.%S", time.gmtime(min_time))<br>
>> os.system("date -u -s %s" % want)' "$PRESEED_TIMESTAMP_FN" > /dev/null<br>
>> }<br>
>><br>
>> resolve_hostname_v4() {<br>
>> # we use the grep both to filter out cname referrals and to detect empty<br>
>> # results<br>
>> local hn="$1"<br>
>> shift<br>
>> dig +nodnssec +short "$@" -t a "$hn" | grep '^[0-9][0-9.]*$'<br>
>> }<br>
>><br>
>> resolve_hostname_v6() {<br>
>> local hn="$1"<br>
>> shift<br>
>> dig +nodnssec +short "$@" -t aaaa "$hn" | grep -i<br>
>> '^[0-9a-f][0-9a-f.:]*$'<br>
>> }<br>
>><br>
>> resolve_one_server() {<br>
>> local hn="$1"<br>
>> resolve_hostname_v4 $hn && return<br>
>> resolve_hostname_v6 $hn && return<br>
>> resolve_hostname_v4 $hn +cd && return<br>
>> resolve_hostname_v6 $hn +cd && return<br>
>> }<br>
>><br>
>> resolve_step_servers() {<br>
>> local server ips<br>
>> for server in $STEP_SERVERS ; do<br>
>> resolve_one_server $server<br>
>> done<br>
>> }<br>
>><br>
>> start() {<br>
>> preseed_approximate_time<br>
>> for s in $(resolve_step_servers) ; do<br>
>> /usr/sbin/ntpdate -s -b -u -t "$TIMEOUT" "$s" && break<br>
>> done<br>
>><br>
>> }<br>
>><br>
>> _______________________________________________<br>
>> Cerowrt-devel mailing list<br>
>> <a href="mailto:Cerowrt-devel@lists.bufferbloat.net">Cerowrt-devel@lists.bufferbloat.net</a><br>
>> <a href="https://lists.bufferbloat.net/listinfo/cerowrt-devel" target="_blank">https://lists.bufferbloat.net/listinfo/cerowrt-devel</a><br>
>><br>
><br>
><br>
> _______________________________________________<br>
> Cerowrt-devel mailing list<br>
> <a href="mailto:Cerowrt-devel@lists.bufferbloat.net">Cerowrt-devel@lists.bufferbloat.net</a><br>
> <a href="https://lists.bufferbloat.net/listinfo/cerowrt-devel" target="_blank">https://lists.bufferbloat.net/listinfo/cerowrt-devel</a><br>
><br>
<br>
<br>
<br>
</div></div><div class="HOEnZb"><div class="h5">--<br>
Dave Täht<br>
<br>
Fixing bufferbloat with cerowrt: <a href="http://www.teklibre.com/cerowrt/subscribe.html" target="_blank">http://www.teklibre.com/cerowrt/subscribe.html</a><br>
</div></div></blockquote></div><br></div></div></div>