summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* man: netdev: use <varname> tagYu Watanabe2021-12-061-5/+5
|
* meson: remove openssl dependency from repartLuca Boccassi2021-12-061-4/+2
| | | | No longer needed since ade99252e2cdd9eeff78566789008996d27e4dc0
* tree-wide: check for NULLs in more placesFrantisek Sumsal2021-12-067-0/+22
| | | | | Fixes issues pointed out by the `cpp/inconsistent-null-check` LGTM query.
* NEWS: add more entries for v250Luca Boccassi2021-12-051-5/+61
|
* Merge pull request #21563 from yuwata/network-IPoIB-supportYu Watanabe2021-12-0419-39/+398
|\ | | | | network: IPoIB support
| * sd-netlink: fix implicit cast to booleanYu Watanabe2021-12-041-2/+2
| |
| * network: set MTU after IPoIB configs are appliedYu Watanabe2021-12-041-2/+12
| | | | | | | | MTU is updated when IB mode is changed.
| * network: add support to configure IPoIB interfacesYu Watanabe2021-12-0410-1/+98
| |
| * network/netdev: add support to create IPoIB subinterfaceYu Watanabe2021-12-0413-14/+248
| |
| * sd-netlink: add support for IPoIBYu Watanabe2021-12-041-3/+7
| |
| * network/netdev: generate persistent MAC address when creating netdev interfaceYu Watanabe2021-12-043-22/+36
|/ | | | Preparation for later commits.
* ci: consider `cryptolib` in the group identifierFrantisek Sumsal2021-12-031-1/+1
| | | | | | | otherwise we end up with more than one job with the same identifier in one run, causing some of them to get cancelled unexpectedly. A quick follow-up to 85bd394df57fe45c2873605e2c1d1d79e83e853d.
* Merge pull request #21607 from mrc0mmand/ci-install-libbpfLuca Boccassi2021-12-033-4/+14
|\ | | | | ci: run build test with BPF-related stuff as well
| * ci: install libbpfFrantisek Sumsal2021-12-031-1/+2
| |
| * analyze: fix build with -Db_ndebug=trueFrantisek Sumsal2021-12-031-1/+1
| |
| * meson: support versioned llvm binaries in BPF detectionFrantisek Sumsal2021-12-031-2/+11
| |
* | Merge pull request #21582 from mrc0mmand/lgtm-uninitializedLuca Boccassi2021-12-033-4/+126
|\ \ | |/ |/| lgtm: enable more queries
| * lgtm: enable more (and potentially useful) queriesFrantisek Sumsal2021-12-021-0/+21
| | | | | | | | | | | | Not all available queries on LGTM are enabled by default, but some of the excluded ones might come in handy, hence let's enable them explicitly.
| * lgtm: don't treat the custom note as a list of tagsFrantisek Sumsal2021-12-021-4/+6
| | | | | | | | Just a cosmetic change.
| * lgtm: detect uninitialized variables using the __cleanup__ attributeFrantisek Sumsal2021-12-021-0/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a slightly modified version of the original `cpp/uninitialized-local` CodeQL query which focuses only on variables using the cleanup macros. Since this has proven to cause issues in the past, let's panic on every uninitialized variable using any of the cleanup macros (as long as they're written using the __cleanup__ attribute). Some test results from a test I used when writing the query: ``` #define _cleanup_foo_ __attribute__((__cleanup__(foo))) #define _cleanup_(x) __attribute__((__cleanup__(x))) static inline void freep(void *p) { *(void**)p = mfree(*(void**) p); } #define _cleanup_free_ _cleanup_(freep) static inline void foo(char **p) { if (*p) *p = free(*p); } int main(void) { __attribute__((__cleanup__(foo))) char *a; char *b; _cleanup_foo_ char *c; char **d; _cleanup_free_ char *e; int r; r = fun(&e); if (r < 0) return 1; puts(a); puts(b); puts(c); puts(*d); puts(e); return 0; } ``` ``` +| test.c:23:14:23:14 | e | The variable $@ may not be initialized here, but has a cleanup handler. | test.c:20:26:20:26 | e | e | +| test.c:27:10:27:10 | a | The variable $@ may not be initialized here, but has a cleanup handler. | test.c:16:45:16:45 | a | a | +| test.c:29:10:29:10 | c | The variable $@ may not be initialized here, but has a cleanup handler. | test.c:18:25:18:25 | c | c | ```
* | Bump the max number of inodes for /dev to 128kFranck Bui2021-12-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Follow-up for 7d85383edbab73274dc81cc888d884bb01070bc2. Apparently the previous limit set on the max number of inodes for /dev was too small as a system with 4096 LUNs attached can consume up to 95k inodes for symlinks: # /bin/df -i Filesystem Inodes IUsed IFree IUse% Mounted on devtmpfs 49274377 95075 49179302 1% /dev Hence this patch bumps the limit from 64k to 128k although the new limit is still pretty arbitrary (that said, not sure if it really makes sense to put such absolute limit number).
* | Merge pull request #21170 from keszybz/delibgcryptifyZbigniew Jędrzejewski-Szmek2021-12-0323-298/+1003
|\ \ | | | | | | Allow systemd-resolved and systemd-importd to use libgcrypt or libopenssl
| * | meson: disallow the combination of cryptolib=openssl and dns-over-tls=gnutlsZbigniew Jędrzejewski-Szmek2021-12-021-13/+17
| | | | | | | | | | | | | | | | | | It could work, but it doesn't make much sense. If we already have openssl as the cryptolib that provides the necessary support, let's not bring in another library. Disallowing this simplifies things and reduces our support matrix.
| * | ci: expand the test framework to cover opensslZbigniew Jędrzejewski-Szmek2021-12-022-1/+11
| | |
| * | ci: temporarily set -Wno-deprecated-declarations in PackitZbigniew Jędrzejewski-Szmek2021-12-011-0/+3
| | | | | | | | | | | | | | | | | | to suppress OpenSSL 3.0 deprecation warnings (until a proper solution is deployed): RSA_free, EC_KEY_free, RSA_set0_key, RSA_size, EVP_PKEY_assign, EC_KEY_set_group, and others are deprecated.
| * | resolved: do not use BN_dup() unnecessarillyZbigniew Jędrzejewski-Szmek2021-12-011-2/+4
| | | | | | | | | | | | Suggested in https://github.com/systemd/systemd/pull/21170#discussion_r738696794
| * | port string_hashsum from libgcrypt to openssl^gcryptZbigniew Jędrzejewski-Szmek2021-12-0113-37/+96
| | | | | | | | | | | | | | | | | | | | | | | | This allows resolved and importd to be built without libgcrypt. Note that we now say either 'cryptographic library' or 'cryptolib'. Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
| * | basic/openssl-util: Add sha256 hash wrapperKevin Kuehler2021-12-012-0/+39
| | |
| * | resolve: Port nsec3 code to openssl^gcryptKevin Kuehler2021-12-011-14/+59
| | | | | | | | | | | | Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
| * | resolve: Port dnskey verification by ds to openssl^gcryptKevin Kuehler2021-11-301-24/+73
| | | | | | | | | | | | Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
| * | resolve: Port dnssec verify from gcrypt to openssl^gcryptKevin Kuehler2021-11-304-71/+260
| | | | | | | | | | | | Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
| * | resolved: split out function to hash signatureZbigniew Jędrzejewski-Szmek2021-11-301-74/+79
| | | | | | | | | | | | dnssec_verify_rrset() is just too long.
| * | resolved: split out function to generate signatureZbigniew Jędrzejewski-Szmek2021-11-301-47/+78
| | | | | | | | | | | | dnssec_verify_rrset() is just too long.
| * | resolve: Add coverage for dnssec ecdsa (rfc6605)Kevin Kuehler2021-11-301-2/+187
| | |
| * | import: port importd from libgcrypt to openssl^gcryptZbigniew Jędrzejewski-Szmek2021-11-304-19/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is heavily based on Kevin Kuehler's work, but the logic is also significantly changed: instead of a straighforward port to openssl, both versions of the code are kept, and at compile time we pick one or the other. The code is purposefully kept "dumb" — the idea is that the libgcrypt codepaths are only temporary and will be removed after everybody upgrades to openssl 3. Thus, a separate abstraction layer is not introduced. Instead, very simple ifdefs are used to select one or the other. If we added an abstraction layer, we'd have to remove it again afterwards, and it don't think it makes sense to do that for a temporary solution. Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> # Conflicts: # meson.build
| * | meson: add config setting to select between openssl and gcryptZbigniew Jędrzejewski-Szmek2021-11-303-0/+51
| | | | | | | | | | | | This is not pretty, but it is supposed to be only a temporary measure.
| * | repart: port to our home-grown hmac_sha256Kevin Kuehler2021-11-301-15/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces dependencies. The speed of the code here is uimportant, because we hash only a tiny amount of input data. Debian and Ubuntu currently build without repart, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976959 > repart requires openssl and so far I tried to avoid linking against > both gnutls and openssl. Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
* | | cryptenroll: fix wrong error messagesGibeom Gwon2021-12-031-2/+2
| | | | | | | | | | | | PKCS#11 -> FIDO2 in cryptenroll-fido2.c
* | | Merge pull request #21599 from loongarch64/dev-syscallsZbigniew Jędrzejewski-Szmek2021-12-0323-39/+712
|\ \ \ | | | | | | | | Add LoongArch 64bit syscalls
| * | | syscalls: run ninja update-syscall-tablesXiaotian Wu2021-12-0120-40/+79
| | | |
| * | | syscalls: add LoongArch 64bit syscallsXiaotian Wu2021-12-014-0/+634
| | | |
* | | | meson: correctly display enabled featuresFrantisek Sumsal2021-12-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In 9cf75222f20 the conf.get() statements for `bpf-framework` and `valgrind` were dropped, which causes the respective features to always show as disabled (since they don't follow the "standard" naming scheme with HAVE_/ENABLE_ prefixes).
* | | | core: support user manager with Condition[Memory/CPU/IO]PressureLuca Boccassi2021-12-021-3/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Get the cgroup root path from the current PID, so that when ran by the user manager we can get to the right path. Eg: foo.slice:10% will check under: /sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/foo.slice/cpu.pressure Follow-up for 81513b382b24a7f3602987f71042d075ca27d1a5
* | | | Merge pull request #21584 from yuwata/network-wireguard-cleanupsYu Watanabe2021-12-023-144/+173
|\ \ \ \ | | | | | | | | | | network: cleanups for wireguard
| * | | | network/wireguard: search valid address of the endpoint from all struct ↵Yu Watanabe2021-12-021-10/+20
| | | | | | | | | | | | | | | | | | | | addrinfo entries
| * | | | network/wireguard: cleanups for resolving endpointsYu Watanabe2021-12-022-104/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes - drop peers_with_unresolved_endpoint and peers_with_failed_endpoint, - drop destroy handler for sd_resolve_query, and manage each query by peer, - add random fluctuation to the timeout for retry handler, - retry timer event source is now managed by peer, - use sd_event_source_disable_unref().
| * | | | network/wireguard: do not resolve Endpoint= if an IP address is specifiedYu Watanabe2021-12-021-40/+66
| | | | | | | | | | | | | | | | | | | | Also verify the domain name and port.
| * | | | parse-util: refuse leading white space in port numberYu Watanabe2021-12-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When parse_ip_port() is directly used in a conf parser, then that's fine, as the rvalue is already truncated. When parse_ip_port() is used when e.g. parsing IP address with port, then we should really refuse white space after colon.
* | | | | Revert "network: address: drop deprecated temporary address"Yu Watanabe2021-12-021-14/+0
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 528da64a0c734bd45e953b5c57d82e2a727435ef. The commit is a bad way to fix #19838, and introduces #21593. Fixes #21593.
* | | | Merge pull request #21585 from ↵Yu Watanabe2021-12-0216-86/+220
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | yuwata/network-radv-uplink-interface-auto-with-dhcp6-pd network: cleanups for uplink interface handling for RADV and DHCP6-PD
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 00:13:00 +0100