Subject: [homenet] time service and DNSSEC (code)

From: David Täht <[email-masked]>
Date: Sun, 16 Oct 2011 13:34:23 +0200

In message <17165.1318514742 at marajade.sandelman.ca>
Michael Richardson writes:
 
> >>>>> "Curtis" == Curtis Villamizar <curtis at occnc.com> writes:
>     >> While talking about hardware.  These these devices all need a
>     >> battery backed clock or all the crypto will be broken.
>  
>  
>     Curtis> Having a clock is not hard but I don't think your statement
>     Curtis> is true.
>  
>     Curtis> Some crypto does not require time, but rather just entropy
>     Curtis> (a nonce or challenge).  For crypto that does require time
>     Curtis> the former can be a bootstrap of sorts, possibly to get ntp
>     Curtis> going if very accurate time is needed (for some reason).
>  
> Curtis, Mark, as a DNSSEC implementer knows of what he speaks.  DNSSEC
> requires time.  Not to the second or even minute, but at least hour.
>  
> DNSSEC is a core protocol at this point, and we need to be aware of
> it.  It doesn't matter today, because we have a broken home DNS
> system, but that's within homenet to fix.
>  
> Bootstrapping time enough to get DNSSEC to work is important.

A version of the scripts evan created to generate valid DNS entries for IPv6
views is in the dhcp-next package in the ceropackages repository

https://github.com/dtaht/ceropackages

which leverages isc-dhcp's scripting abilities:

https://github.com/dtaht/ceropackages/blob/master/net/bind-dhcp-hooks/files/etc/ddns6.sh

I note that we did do another innovative thing here. By using a DHCPv4
server and constructing a working EUI-64 from the known prefix and mac address
we were able to insert valid ipv6 entries into the DNS that matched the naming
scheme of the ipv4 client.

more work is required to generalize this solution, as evan's setup did not 
use subdomains for the dns views, nor have I got around to making a script like
this work well for a dnsmasq hook, rather than isc-dhcp hook. (isc-dhcp is
presently rather too large for a home router, so we use dnsmasq in cerowrt)

I note: we did this hack over a weekend.

as for bootstrapping DNSSEC with invalid time...

bufferbloat.net and the main router for the lab (jupiter.lab.bufferbloat.net)
are also generating DNSSEC signed DNS.Yes, it's a home router, and I do find
it comforting to see DNSSEC working in various places with tools in my browser
such as the firefox dnssec plugin.

Cerowrt is currently shipping with DNSSEC enabled, and the 
'get time to within an hour problem' is currently
handled with a very hacky script that disables DNSSEC until
valid time is acquired.

More elegant solutions are outlined on:

http://www.bufferbloat.net/issues/113
http://www.bufferbloat.net/issues/205

and also discussed on the bloat list:

https://lists.bufferbloat.net/pipermail/bloat-devel/2011-July/000206.html

I think the consensus there for DNSSEC is the 'right thing to do' 

- for all devices, not just home gateways - 

is to add a flag to c libraries to getaddrinfo and friends to ask it to 
not validate the results, and have ntp (and related tools such as rdate) - try
this when first attempting to slew the time.

It's an awful large amount of work to get this single bit used correctly
throughout the c stack, but it seems like the right thing.

it is mildly easier to link the dnsval library for apps that need to be slightly 
more dnssec aware - but...

I've been too absorbed by beating bufferbloat to tackle this one too, but no 
matter the approach, having dnssec work mo better everywhere looks quite feasible,
and would benefit from someone actually attempting the work.

-- 
Dave Täht