1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-14 19:24:13 +03:00
Lennart Poettering abf4e5c1d3 units: turn off DNSSEC validation when timesyncd resolves hostnames
We have a chicken and egg problem: validation of DNSSEC signatures
doesn't work without a correct clock, but to set the correct clock we
need to contact NTP servers which requires resolving a hostname, which
would normally require DNSSEC validation.

Let's break the cycle by excluding NTP hostname resolution from
validation for now.

Of course, this leaves NTP traffic unprotected. To cover that we need
NTPSEC support, which we can add later.

Fixes: #5873 #15607
2021-02-14 22:05:18 +01:00
..