Move 'check dnssec timestamp enable' from SIGHUP handler to SIGUSR2. Dnsmasq uses SIGHUP to do too many things: 1) set dnssec time validation enabled, 2) bump SOA zone serial, 3) clear dns cache, 4) reload hosts files, 5) reload resolvers/servers files. SIGUSR2 is used to re-open/re-start the logfile. Default LEDE does not use logfile functionality.
Many subsystems within LEDE can send SIGHUP to dnsmasq: 1) ntpd hotplug (to indicate time is valid for dnssec) 2) odhcpd (to indicate a new/removed host - typically DHCPv6 leases) 3) procd on interface state changes 4) procd on system config state changes, 5) service reload. If dnssec time validation is enabled before the system clock has been set to a sensible time, name resolution will fail. Because name resolution fails, ntpd is unable to resolve time server names to addresses, so is unable to set time. Classic chicken/egg. Since commits 23bba9cb330cd298739a16e350b0029ed9429eef (service reload) & 4f02285d8b4a66359a8fa46f22a3efde391b5419 (system config) make it more likely a SIGHUP will be sent for events other than 'ntpd has set time' it is more likely that an errant 'name resolution is failing for everything' situation will be encountered. Ideally dnsmasq would have some other IPC mechanism for indicating 'time is valid, go check dnssec timestamps', but until that time (implementation is left as an exercise for the interested/competent reader/bikeshedder) the next best thing is to move functionality from the overloaded SIGHUP signal to the under-utilised SIGUSR2. ntpd hotplug script updated to use SIGUSR2. Signed-off-by: Kevin Darbyshire-Bryant <l...@darbyshire-bryant.me.uk> --- package/network/services/dnsmasq/Makefile | 2 +- .../services/dnsmasq/files/dnsmasqsec.hotplug | 2 +- .../dnsmasq/patches/250-dnssec-SIGUSR2.patch | 32 ++++++++++++++++++++++ 3 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 package/network/services/dnsmasq/patches/250-dnssec-SIGUSR2.patch diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index c6d2739f03..1224ad86f8 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dnsmasq PKG_VERSION:=2.78 -PKG_RELEASE:=7 +PKG_RELEASE:=8 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/ diff --git a/package/network/services/dnsmasq/files/dnsmasqsec.hotplug b/package/network/services/dnsmasq/files/dnsmasqsec.hotplug index a155eb0f6e..f9fb4b533d 100644 --- a/package/network/services/dnsmasq/files/dnsmasqsec.hotplug +++ b/package/network/services/dnsmasq/files/dnsmasqsec.hotplug @@ -9,6 +9,6 @@ TIMEVALIDFILE="/var/state/dnsmasqsec" [ -f "$TIMEVALIDFILE" ] || { echo "ntpd says time is valid" >$TIMEVALIDFILE /etc/init.d/dnsmasq enabled && { - procd_send_signal dnsmasq + procd_send_signal dnsmasq '*' USR2 } } diff --git a/package/network/services/dnsmasq/patches/250-dnssec-SIGUSR2.patch b/package/network/services/dnsmasq/patches/250-dnssec-SIGUSR2.patch new file mode 100644 index 0000000000..1c7ffa5123 --- /dev/null +++ b/package/network/services/dnsmasq/patches/250-dnssec-SIGUSR2.patch @@ -0,0 +1,32 @@ +--- a/src/dnsmasq.c ++++ b/src/dnsmasq.c +@@ -1296,13 +1296,6 @@ static void async_event(int pipe, time_t + case EVENT_RELOAD: + daemon->soa_sn++; /* Bump zone serial, as it may have changed. */ + +-#ifdef HAVE_DNSSEC +- if (daemon->dnssec_no_time_check && option_bool(OPT_DNSSEC_VALID) && option_bool(OPT_DNSSEC_TIME)) +- { +- my_syslog(LOG_INFO, _("now checking DNSSEC signature timestamps")); +- daemon->dnssec_no_time_check = 0; +- } +-#endif + /* fall through */ + + case EVENT_INIT: +@@ -1399,6 +1392,15 @@ static void async_event(int pipe, time_t + we leave them logging to the old file. */ + if (daemon->log_file != NULL) + log_reopen(daemon->log_file); ++ ++#ifdef HAVE_DNSSEC ++ if (daemon->dnssec_no_time_check && option_bool(OPT_DNSSEC_VALID) && option_bool(OPT_DNSSEC_TIME)) ++ { ++ my_syslog(LOG_INFO, _("now checking DNSSEC signature timestamps")); ++ daemon->dnssec_no_time_check = 0; ++ clear_cache_and_reload(now); ++ } ++#endif + break; + + case EVENT_NEWADDR: -- 2.14.3 (Apple Git-98) _______________________________________________ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
