Skip to content
Snippets Groups Projects
  • Kevin Darbyshire-Bryant's avatar
    5acfe55d
    dnsmasq: dnssec time handling uses ntpd hotplug · 5acfe55d
    Kevin Darbyshire-Bryant authored
    
    Change dnsmasq's dnssec time check handling to use time validity
    indicated by ntpd rather than maintaining a cross boot/upgrade
    /etc/dnsmasq.time timestamp file.  This saves flash device wear.
    
    If ntpd client is configured in uci and you're using dnssec, then
    dnsmasq will not check dnssec timestamp validity until ntpd hotplug
    indicates sync via a stratum change. The ntpd hotplug leaves a status
    flag file to indicate to dnsmasq.init that time is valid and that it
    should now start in 'check dnssec timestamp valid' mode.
    
    If ntpd client is not configured and you're using dnssec, then it is
    presumed you're using an alternate time sync mechanism and that time is
    correct, thus dnsmasq checks dnssec timestamps are valid from 1st start.
    
    Signed-off-by: default avatarKevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
    
    V2 - stratum & step ntp changes indicate time is valid
    V3 - on initial flag file step signal dnsmasq with SIGHUP if running
    V4 - only accept step ntp changes. Accepting both stratum & step could
    result in unpleasant script race conditions
    V5 - Actually only accepting stratum is the correct thing to do after
    further testing
    V6 - improve handling of non busybox ntpd
    if sysntpd not executable
      dnsmasq checks dnssec timestamps
    else
      sysntp script disabled - look for timestamp file - allows external mechanism to use hotplug flag file
      sysntp script enabled & uci ntp enabled  - look for timestamp file
      sysntp script enabled & uci ntp disabled - dnsmasq checks dnssec
    timestamps
    fi
    5acfe55d
    History
    dnsmasq: dnssec time handling uses ntpd hotplug
    Kevin Darbyshire-Bryant authored
    
    Change dnsmasq's dnssec time check handling to use time validity
    indicated by ntpd rather than maintaining a cross boot/upgrade
    /etc/dnsmasq.time timestamp file.  This saves flash device wear.
    
    If ntpd client is configured in uci and you're using dnssec, then
    dnsmasq will not check dnssec timestamp validity until ntpd hotplug
    indicates sync via a stratum change. The ntpd hotplug leaves a status
    flag file to indicate to dnsmasq.init that time is valid and that it
    should now start in 'check dnssec timestamp valid' mode.
    
    If ntpd client is not configured and you're using dnssec, then it is
    presumed you're using an alternate time sync mechanism and that time is
    correct, thus dnsmasq checks dnssec timestamps are valid from 1st start.
    
    Signed-off-by: default avatarKevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
    
    V2 - stratum & step ntp changes indicate time is valid
    V3 - on initial flag file step signal dnsmasq with SIGHUP if running
    V4 - only accept step ntp changes. Accepting both stratum & step could
    result in unpleasant script race conditions
    V5 - Actually only accepting stratum is the correct thing to do after
    further testing
    V6 - improve handling of non busybox ntpd
    if sysntpd not executable
      dnsmasq checks dnssec timestamps
    else
      sysntp script disabled - look for timestamp file - allows external mechanism to use hotplug flag file
      sysntp script enabled & uci ntp enabled  - look for timestamp file
      sysntp script enabled & uci ntp disabled - dnsmasq checks dnssec
    timestamps
    fi