Codestin Search App

ldir-EDB0 · 2016-05-12T12:08:03Z

dnsmasq uses dnsmasq.time to validate if the system clock is current or not. This process is particularly important when dnsmasq's 'dnssec-check-unsigned' option is enabled.

ConorOG · 2016-05-12T13:10:08Z

Why should fixsystime exclude any file? Can a file be too new?

ldir-EDB0 · 2016-05-13T08:35:21Z

dnsmasq uses the timestamp on dnsmasq.time as a decider on whether to valid dnssec time based signatures. Once system time has gone beyond dnsmasq.time, dnsmasq considers system time valid and starts validating dnssec timestamps. If system time is wrong and you validate timestamps, name resolution in essence stops. This may not be so help if it is ntpd trying to do the lookup :-) The file based solution adopted by dnsmasq used the assumption that systime would be in the 1970s on boot to then be corrected to present by ntpd.

So, if sysfixtime sets the time to newer than dnsmasq.time, time would be considered valid which may have unfortunate consequences.

A different solution would be to have ntpd signal dnsmasq when it has set time for real. That's not the solution I coded for :-)

jow- · 2016-05-13T11:09:50Z

@kdarbyshirebryant - the dnsmasq specific file handling should not be added as exception to sysupgrade, you should handle it like that:

Move the service restart and dnsmasq.time handling into an external shell script registering a conffiles hook, see https://github.com/openwrt/luci/blob/master/libs/luci-lib-nixio/root/lib/upgrade/luci-add-conffiles.sh for an example
Bundle that conffiles hook script with the dnsmasq-dnssec build variant instead

The dnsmasq.time exclusion in sysfixtime can stay but we can optimize the find command instead of using a slow shell parsing loop.

I think the following should work: find /etc -type f '!' -path /etc/dnsmasq.time -exec date -r {} +%s \; | sort -nr | head -n1

ldir-EDB0 · 2016-05-13T11:15:29Z

Thank you Jow - I shall take your advice and work on a better version - I'll be back, though it might take a while :-)

ldir-EDB0 · 2016-05-18T14:48:26Z

@jow May I bring your attention to https://patchwork.ozlabs.org/patch/521344/ which discussed (at great length!) a variety to methods for finding the latest file (excluding dnsmasq.time) I'm reminded that the original reason for changing from the original 'find/exec' combination (indeed my original patch used a '!' -path /etc/dnsmasq.time as per your suggestion above) was to reduce CPU usage. Justin explores this a little more in his post in the above mentioned thread.

I'm inclined to use his improved option:
time sh -c 'local file newest; for file in $(find /etc -type f ! -path /etc/dnsmasq.time) ; do [ -z "$newest" -o "$newest" -ot "$file" ] && newest=$file ; done ; [ "$newest" ] && date -r "$newest" +%s'
1463567373
real 0m 0.09s
user 0m 0.09s
sys 0m 0.00s

time find /etc -type f '!' -path /etc/dnsmasq.time -exec date -r {} +%s ; | sort -nr | head -n1
real 0m 1.57s
user 0m 0.06s
sys 0m 0.13s

What do you think?

jow- · 2016-05-18T17:39:17Z

I'd say take the faster find command then.

ldir-EDB0 · 2016-05-18T18:13:46Z

Hopefully the latest commits are more what you're looking for :-)

dnsmasq maintains dnsmasq.time across reboots and uses it as a means of determining if current time is good enough to validate dnssec time stamps. By including /etc/dnsmasq.time as a time source for sysfixtime, the mechanism was effectively defeated because time was set to the last time that dnsmasq considered current even though that time is in the past. Since that time is out of date, dns(sec) resolution would fail thus defeating any ntp based mechanisms for setting the clock correctly. In theory the process is defeated by any files in /etc that are newer than /etc/dnsmasq.time however dnsmasq now updates the file's timestamp on process TERM so hopefully /etc/dnsmasq.time is the latest file timestamp in /etc as part of LEDE shutdown/reboot. Either way, including /etc/dnsmasq.time as a time source for sysfixtime is not helpful.

conditionally save dnsmasq.time across sysupgrade dnsmasq uses /etc/dnsmasq.time as record of the last known good system time to aid its validation of dnssec timestamps. dnsmasq updates the timestamp on process start/stop once it considers the system time as valid. The timestamp file should be preserved across system upgrade but should not be included as part of normal configuration backups to prevent restores corrupting the current timestamp.

jow- · 2016-05-18T20:18:20Z

Pulled into my staging tree: https://git.lede-project.org/?p=lede/jow/staging.git;a=commit;h=382779e009af7c1c688fbd98adf71fb19ce66254

Add register and masks for external port lede-project#2 Add RGMII mode setup for external port lede-project#2 Remove unneeded port enabling for RGMII mode as it was already enabled at switch init. Signed-off-by: Vitaly Chekryzhev <[email protected]>

Add register and masks for external port lede-project#2 Add RGMII mode setup for external port lede-project#2 Remove unneeded part RGMII as part it was already enabled at setup. Signed-off-by: Vitaly Chekryzhev <[email protected]>