From aee9d18c8d909eb7aca2838e4bce5da018b6a112 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 5 Nov 2020 11:18:20 +0100 Subject: [PATCH 1/2] nss-resolve: allow turning off validation via env var --- src/nss-resolve/nss-resolve.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/src/nss-resolve/nss-resolve.c b/src/nss-resolve/nss-resolve.c index fb1d61fea9..5fcd39ee0a 100644 --- a/src/nss-resolve/nss-resolve.c +++ b/src/nss-resolve/nss-resolve.c @@ -8,6 +8,7 @@ #include #include +#include "env-util.h" #include "errno-util.h" #include "in-addr-util.h" #include "macro.h" @@ -184,6 +185,21 @@ static const JsonDispatch address_parameters_dispatch_table[] = { {} }; +static uint64_t query_flags(void) { + uint64_t f = 0; + int r; + + /* Allow callers to turn off validation, when we resolve via nss-resolve */ + + r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE"); + if (r < 0 && r != -ENXIO) + log_debug_errno(r, "Failed to parse $SYSTEMD_NSS_RESOLVE_VALIDATE value, ignoring."); + else if (r == 0) + f |= SD_RESOLVED_NO_VALIDATE; + + return f; +} + enum nss_status _nss_resolve_gethostbyname4_r( const char *name, struct gaih_addrtuple **pat, @@ -215,7 +231,8 @@ enum nss_status _nss_resolve_gethostbyname4_r( goto fail; r = json_build(&cparams, JSON_BUILD_OBJECT( - JSON_BUILD_PAIR("name", JSON_BUILD_STRING(name)))); + JSON_BUILD_PAIR("name", JSON_BUILD_STRING(name)), + JSON_BUILD_PAIR("flags", JSON_BUILD_UNSIGNED(query_flags())))); if (r < 0) goto fail; @@ -367,7 +384,8 @@ enum nss_status _nss_resolve_gethostbyname3_r( goto fail; r = json_build(&cparams, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("name", JSON_BUILD_STRING(name)), - JSON_BUILD_PAIR("family", JSON_BUILD_INTEGER(af)))); + JSON_BUILD_PAIR("family", JSON_BUILD_INTEGER(af)), + JSON_BUILD_PAIR("flags", JSON_BUILD_UNSIGNED(query_flags())))); if (r < 0) goto fail; @@ -571,7 +589,8 @@ enum nss_status _nss_resolve_gethostbyaddr2_r( goto fail; r = json_build(&cparams, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("address", JSON_BUILD_BYTE_ARRAY(addr, len)), - JSON_BUILD_PAIR("family", JSON_BUILD_INTEGER(af)))); + JSON_BUILD_PAIR("family", JSON_BUILD_INTEGER(af)), + JSON_BUILD_PAIR("flags", JSON_BUILD_UNSIGNED(query_flags())))); if (r < 0) goto fail; From abf4e5c1d3ad767bc0ed67883e8e4d916af095ec Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 5 Nov 2020 11:20:32 +0100 Subject: [PATCH 2/2] units: turn off DNSSEC validation when timesyncd resolves hostnames We have a chicken and egg problem: validation of DNSSEC signatures doesn't work without a correct clock, but to set the correct clock we need to contact NTP servers which requires resolving a hostname, which would normally require DNSSEC validation. Let's break the cycle by excluding NTP hostname resolution from validation for now. Of course, this leaves NTP traffic unprotected. To cover that we need NTPSEC support, which we can add later. Fixes: #5873 #15607 --- units/systemd-timesyncd.service.in | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index c0d63f5c70..6226ab7a40 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -22,6 +22,10 @@ Wants=time-set.target AmbientCapabilities=CAP_SYS_TIME BusName=org.freedesktop.timesync1 CapabilityBoundingSet=CAP_SYS_TIME +# Turn off DNSSEC validation for hostname look-ups, since those need the +# correct time to work, but we likely won't acquire that without NTP. Let's +# break this chicken-and-egg cycle here. +Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0 ExecStart=!!@rootlibexecdir@/systemd-timesyncd LockPersonality=yes MemoryDenyWriteExecute=yes