dnsmasq: Enable DNSSEC timestamp feature

This disables DNSSEC until the system clock has been set correctly.
There is a circular dependency on working DNS and being able to
resolve DNS records in order to reach a time server. Systems without
a RTC or empty RTC battery will start up with time way in the past
in which all DNSSEC signatures are invalid.

diff --git a/src/initscripts/init.d/dnsmasq b/src/initscripts/init.d/dnsmasq
index 48b9d19d02627f9d8c829f958a5febfc5ebe5c28..4e37925171a4687d056f4f93ef3ec7b317ed8e3d 100644 (file)
--- a/src/initscripts/init.d/dnsmasq
+++ b/src/initscripts/init.d/dnsmasq
@@ -26,7 +26,7 @@ SHOW_SRV=1
 TRUST_ANCHOR=".,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
 
 function dnssec_args() {
 TRUST_ANCHOR=".,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
 
 function dnssec_args() {

-       local cmdline="--dnssec"
+       local cmdline="--dnssec --dnssec-timestamp"

 
        if [ -n "${TRUST_ANCHOR}" ]; then
                cmdline="${cmdline} --trust-anchor=${TRUST_ANCHOR}"
 
        if [ -n "${TRUST_ANCHOR}" ]; then
                cmdline="${cmdline} --trust-anchor=${TRUST_ANCHOR}"