mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2024-11-23 21:43:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

package/{chrony, ntp, openntpd}: turn off DNSSEC validation

Browse Source 
We have a chicken and egg problem: validation of DNSSEC signatures
doesn't work without a correct clock, but to set the correct clock we
need to contact NTP servers which requires resolving a hostname, which
would normally require DNSSEC validation.

Let's break the cycle by excluding NTP hostname resolution from
validation for now.

Details:
abf4e5c1d3

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c2db53caca)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
James Hilliard 2021-07-08 05:16:27 -06:00 committed by Peter Korsgaard
parent 60f7f0fc62
commit 2b82d31c27
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/chrony/chrony.service
View File

@ -4,6 +4,10 @@ After=syslog.target network.target
Conflicts=systemd-timesyncd.service
[Service]
# Turn off DNSSEC validation for hostname look-ups, since those need the
# correct time to work, but we likely won't acquire that without NTP. Let's
# break this chicken-and-egg cycle here.
Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0
ExecStart=/usr/sbin/chronyd -n
Restart=always

4
package/ntp/ntpd.service
View File

@ -5,6 +5,10 @@ After=network.target
[Service]
Type=forking
PIDFile=/run/ntpd.pid
# Turn off DNSSEC validation for hostname look-ups, since those need the
# correct time to work, but we likely won't acquire that without NTP. Let's
# break this chicken-and-egg cycle here.
Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0
ExecStart=/usr/sbin/ntpd -g -p /run/ntpd.pid
[Install]

4
package/openntpd/ntpd.service
View File

@ -5,6 +5,10 @@ Conflicts=systemd-timesyncd.service
[Service]
Type=simple
# Turn off DNSSEC validation for hostname look-ups, since those need the
# correct time to work, but we likely won't acquire that without NTP. Let's
# break this chicken-and-egg cycle here.
Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0
ExecStart=/usr/sbin/ntpd -s -d
[Install]