[LEDE-DEV] [PATCH v1] dnsmasq: use SIGINT for dnssec time valid

Hans Dedecker dedeckeh at gmail.com
Mon Jan 15 13:50:42 PST 2018


On Mon, Jan 15, 2018 at 1:45 PM, Kevin Darbyshire-Bryant
<ldir at darbyshire-bryant.me.uk> wrote:
> Dnsmasq used SIGHUP to do too many things: 1) set dnssec time validation
> enabled, 2) bump SOA zone serial, 3) clear dns cache, 4) reload hosts
> files, 5) reload resolvers/servers files.
>
> Many subsystems within LEDE can send SIGHUP to dnsmasq: 1) ntpd hotplug
> (to indicate time is valid for dnssec) 2) odhcpd (to indicate a
> new/removed host - typically DHCPv6 leases) 3) procd on interface state
> changes 4) procd on system config state changes, 5) service reload.
>
> If dnssec time validation is enabled before the system clock has been
> set to a sensible time, name resolution will fail.  Because name
> resolution fails, ntpd is unable to resolve time server names to
> addresses, so is unable to set time.  Classic chicken/egg.
>
> Since commits 23bba9cb330cd298739a16e350b0029ed9429eef (service reload) &
> 4f02285d8b4a66359a8fa46f22a3efde391b5419 (system config)  make it more
> likely a SIGHUP will be sent for events other than 'ntpd has set time'
> it is more likely that an errant 'name resolution is failing for
> everything' situation will be encountered.
>
> Fortunately the upstream dnsmasq people agree and have moved 'check
> dnssec timestamp enable' from SIGHUP handler to SIGINT.
>
> Backport the upstream patch to use SIGINT.
> ntpd hotplug script updated to use SIGINT.
>
> Signed-off-by: Kevin Darbyshire-Bryant <ldir at darbyshire-bryant.me.uk>
> ---
>  package/network/services/dnsmasq/Makefile          |   2 +-
>  .../services/dnsmasq/files/dnsmasqsec.hotplug      |   2 +-
>  .../dnsmasq/patches/260-dnssec-SIGINT.patch        | 120 +++++++++++++++++++++
>  3 files changed, 122 insertions(+), 2 deletions(-)
>  create mode 100644 package/network/services/dnsmasq/patches/260-dnssec-SIGINT.patch
>
> diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
> index c6d2739f03..1224ad86f8 100644
> --- a/package/network/services/dnsmasq/Makefile
> +++ b/package/network/services/dnsmasq/Makefile
> @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
>
>  PKG_NAME:=dnsmasq
>  PKG_VERSION:=2.78
> -PKG_RELEASE:=7
> +PKG_RELEASE:=8
>
>  PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
>  PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/
> diff --git a/package/network/services/dnsmasq/files/dnsmasqsec.hotplug b/package/network/services/dnsmasq/files/dnsmasqsec.hotplug
> index a155eb0f6e..781d533734 100644
> --- a/package/network/services/dnsmasq/files/dnsmasqsec.hotplug
> +++ b/package/network/services/dnsmasq/files/dnsmasqsec.hotplug
> @@ -9,6 +9,6 @@ TIMEVALIDFILE="/var/state/dnsmasqsec"
>  [ -f "$TIMEVALIDFILE" ] || {
>         echo "ntpd says time is valid" >$TIMEVALIDFILE
>         /etc/init.d/dnsmasq enabled && {
> -               procd_send_signal dnsmasq
> +               procd_send_signal dnsmasq '*' INT
>         }
>  }
> diff --git a/package/network/services/dnsmasq/patches/260-dnssec-SIGINT.patch b/package/network/services/dnsmasq/patches/260-dnssec-SIGINT.patch
> new file mode 100644
> index 0000000000..e280142f75
> --- /dev/null
> +++ b/package/network/services/dnsmasq/patches/260-dnssec-SIGINT.patch
> @@ -0,0 +1,120 @@
> +From 3c973ad92d317df736d5a8fde67baba6b102d91e Mon Sep 17 00:00:00 2001
> +From: Simon Kelley <simon at thekelleys.org.uk>
> +Date: Sun, 14 Jan 2018 21:05:37 +0000
> +Subject: [PATCH] Use SIGINT (instead of overloading SIGHUP) to turn on DNSSEC
> + time validation.
> +
> +---
> + src/dnsmasq.c |   36 +++++++++++++++++++++++++-----------
> + src/dnsmasq.h |    1 +
> + src/helper.c  |    3 ++-
> + 5 files changed, 38 insertions(+), 14 deletions(-)
> +
> +--- a/src/dnsmasq.c
> ++++ b/src/dnsmasq.c
> +@@ -137,7 +137,8 @@ int main (int argc, char **argv)
> +   sigaction(SIGTERM, &sigact, NULL);
> +   sigaction(SIGALRM, &sigact, NULL);
> +   sigaction(SIGCHLD, &sigact, NULL);
> +-
> ++  sigaction(SIGINT, &sigact, NULL);
> ++
> +   /* ignore SIGPIPE */
> +   sigact.sa_handler = SIG_IGN;
> +   sigaction(SIGPIPE, &sigact, NULL);
> +@@ -815,7 +816,7 @@ int main (int argc, char **argv)
> +
> +       daemon->dnssec_no_time_check = option_bool(OPT_DNSSEC_TIME);
> +       if (option_bool(OPT_DNSSEC_TIME) && !daemon->back_to_the_future)
> +-      my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until first cache reload"));
> ++      my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until receipt of SIGINT"));
> +
> +       if (rc == 1)
> +       my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until system time valid"));
> +@@ -1142,7 +1143,7 @@ static void sig_handler(int sig)
> +     {
> +       /* ignore anything other than TERM during startup
> +        and in helper proc. (helper ignore TERM too) */
> +-      if (sig == SIGTERM)
> ++      if (sig == SIGTERM || sig == SIGINT)
> +       exit(EC_MISC);
> +     }
> +   else if (pid != getpid())
> +@@ -1168,6 +1169,15 @@ static void sig_handler(int sig)
> +       event = EVENT_DUMP;
> +       else if (sig == SIGUSR2)
> +       event = EVENT_REOPEN;
> ++      else if (sig == SIGINT)
> ++      {
> ++        /* Handle SIGINT normally in debug mode, so
> ++           ctrl-c continues to operate. */
> ++        if (option_bool(OPT_DEBUG))
> ++          exit(EC_MISC);
> ++        else
> ++          event = EVENT_TIME;
> ++      }
> +       else
> +       return;
> +
> +@@ -1295,14 +1305,7 @@ static void async_event(int pipe, time_t
> +       {
> +       case EVENT_RELOAD:
> +       daemon->soa_sn++; /* Bump zone serial, as it may have changed. */
> +-
> +-#ifdef HAVE_DNSSEC
> +-      if (daemon->dnssec_no_time_check && option_bool(OPT_DNSSEC_VALID) && option_bool(OPT_DNSSEC_TIME))
> +-        {
> +-          my_syslog(LOG_INFO, _("now checking DNSSEC signature timestamps"));
> +-          daemon->dnssec_no_time_check = 0;
> +-        }
> +-#endif
> ++
> +       /* fall through */
> +
> +       case EVENT_INIT:
> +@@ -1411,6 +1414,17 @@ static void async_event(int pipe, time_t
> +       poll_resolv(0, 1, now);
> +       break;
> +
> ++      case EVENT_TIME:
> ++#ifdef HAVE_DNSSEC
> ++      if (daemon->dnssec_no_time_check && option_bool(OPT_DNSSEC_VALID) && option_bool(OPT_DNSSEC_TIME))
> ++        {
> ++          my_syslog(LOG_INFO, _("now checking DNSSEC signature timestamps"));
> ++          daemon->dnssec_no_time_check = 0;
> ++          clear_cache_and_reload(now);
> ++        }
> ++#endif
> ++      break;
> ++
> +       case EVENT_TERM:
> +       /* Knock all our children on the head. */
> +       for (i = 0; i < MAX_PROCS; i++)
> +--- a/src/dnsmasq.h
> ++++ b/src/dnsmasq.h
> +@@ -175,6 +175,7 @@ struct event_desc {
> + #define EVENT_NEWROUTE   23
> + #define EVENT_TIME_ERR   24
> + #define EVENT_SCRIPT_LOG 25
> ++#define EVENT_TIME       26
> +
> + /* Exit codes. */
> + #define EC_GOOD        0
> +--- a/src/helper.c
> ++++ b/src/helper.c
> +@@ -97,13 +97,14 @@ int create_helper(int event_fd, int err_
> +       return pipefd[1];
> +     }
> +
> +-  /* ignore SIGTERM, so that we can clean up when the main process gets hit
> ++  /* ignore SIGTERM and SIGINT, so that we can clean up when the main process gets hit
> +      and SIGALRM so that we can use sleep() */
> +   sigact.sa_handler = SIG_IGN;
> +   sigact.sa_flags = 0;
> +   sigemptyset(&sigact.sa_mask);
> +   sigaction(SIGTERM, &sigact, NULL);
> +   sigaction(SIGALRM, &sigact, NULL);
> ++  sigaction(SIGINT, &sigact, NULL);
> +
> +   if (!option_bool(OPT_DEBUG) && uid != 0)
> +     {
> --
> 2.14.3 (Apple Git-98)
>
>
> _______________________________________________
> Lede-dev mailing list
> Lede-dev at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/lede-dev

Thanks; patch applied in commit
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=aba3b1c6a3639bf821d2cf305de22ec276fbff33

Hans



More information about the Lede-dev mailing list