summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* test/fuzz: add dnr packetsRonan Pigott2024-10-213-0/+0
| | | | | | | | | | | | | | The structure of DNR options is considerably more complicated than most DHCP options, and as a result the fuzzer has poor coverage of these code paths. This adds some DNR packets to the fuzzing corpus, not with the intent of capturing some specific edge case, but with the intent to rapidly improve the fuzzers' coverage of these codepaths by giving it a valid example to begin with. Also include an ndisc router advert with a few Encrypted DNS options, for the same purpose.
* network: Serialize ipv6ra DNRRonan Pigott2024-10-211-0/+24
| | | | | Serialize DNR servers acquired by ipv6ra option, same as the V4/V6 DNR DHCP options.
* network: Introduce IPv6RA UseDNR= optionRonan Pigott2024-10-216-0/+19
| | | | | Same as the DHCP v4/v6 options, this controls the use of DNR received from ipv6ra.
* ndisc: Parse RFC9463 encrypted DNS (DNR) optionRonan Pigott2024-10-217-1/+373
| | | | This option is equivalent to the V4/V6 DNR options for DHCP.
* test-network: add DHCPv6 DNR testRonan Pigott2024-10-211-1/+33
| | | | Same as the DHCPv4 test.
* network: Serialize DHCPv6 DNR serversRonan Pigott2024-10-211-2/+41
| | | | | This serializes DNR servers acquired by V6_DNR option, equivalent to the V4_DNR option.
* network: Introduce UseDNR DHCPv6 optionRonan Pigott2024-10-217-0/+14
| | | | This is equivalent to the DHCPv4 option introduced earlier.
* network: Parse RFC9463 DHCPv6 DNR optionRonan Pigott2024-10-214-2/+111
| | | | | Implement the parsing for V6_DNR DHCPv6 option. This does the same as the DHCP V4_DNR option.
* dhcp6: use dns_name_from_wire_formatRonan Pigott2024-10-212-76/+5
| | | | | Convert some of the option parsing to use dns_name_from_wire_format, introduced earlier. No change in behavior intended.
* test-dhcp6: terminate fqdn optionRonan Pigott2024-10-211-4/+4
| | | | | | The encoded fqdn in this option must be properly terminated. We will soon validate that this field is correctly encoded, so correct it in the test.
* test-network: add test for DHCPv4 DNRRonan Pigott2024-10-211-0/+69
| | | | | This will test that networkd/resolved can understand the V4_DNR DHCP option.
* network: Serialize DNR serversRonan Pigott2024-10-216-5/+105
| | | | | | | | | | Implement serialization/deserialization for DNR servers. This re-uses the string format in place for user configuration of DoT servers, and as a consequence non-DoT servers are discarded when recording the link configuration, for correctness. This also enables sd-resolved to use these servers as it would other DNS servers.
* network: Add serialization for DoT resolversRonan Pigott2024-10-213-0/+98
| | | | | For now only DoT is supported, so DoT resolvers are represented using the existing configuration format.
* network: Introduce UseDNR DHCPv4 optionRonan Pigott2024-10-215-0/+27
| | | | | | This option will control the use of DNR for choosing DNS servers on the link. Defaults to the value of UseDNS so that in most cases they will be toggled together.
* network: parse RFC9463 DHCPv4 DNR optionRonan Pigott2024-09-145-1/+158
| | | | | | | | This option is another way for DHCP servers to indicate preferred DNS servers for the network, but includes more detailed info like the server name, transport (DoT/DoH/DoQ etc.), and port. Allow our DHCPv4 client to parse this option.
* network: Introduce sd_dns_resolverRonan Pigott2024-09-1410-40/+479
| | | | | | | This type will be used to represent a "designated resolver", and the necessary info for communicating with it. Beyond and address endpoint, we may need to know the dns transport, authenticated domain name, DoH path, etc.
* dns: introduce dns_name_from_wire_formatRonan Pigott2024-09-143-0/+159
| | | | | This is implemented in various places, but it is better to share this code.
* core: do not fail if ignorable img.v/ vpick dir is emptyLuca Boccassi2024-09-132-12/+22
| | | | | | | | If the vpick directory is configured to be ignored if missing, do not fail and just skip ahead. Follow-up for 5e79dd96a88 Follow-up for 622efc544dc
* Merge pull request #34402 from keszybz/notes-readmeLuca Boccassi2024-09-133-0/+183
|\ | | | | Add examples not package/dlopen notes
| * docs/ELF_DLOPEN_METADATA: add detailed exampleZbigniew Jędrzejewski-Szmek2024-09-131-0/+87
| |
| * docs/ELF_PACKAGE_METADATA: add detailed exampleZbigniew Jędrzejewski-Szmek2024-09-132-0/+96
| | | | | | | | | | | | | | | | When the spec was initially written, we didn't add good documentation of how to display the notes, also because there was no good way to display the data except manually extracting the section to a file and running 'jq' on that. But the tools have improved, so let's show the users how easy it is to use this data.
* | mkosi: update debian commit referenceLuca Boccassi2024-09-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 0704bfd93f Use dh-exec for d/systemd-timesyncd.manpages * b668a942e9 Install new sd-stub tmpfiles.d * 57aa6890f3 Install new org.freedesktop.timesync1 manpage * 63e7fb5a48 Install new shell credentials snippets * 3ce727ad45 Update changelog for 256.6-1 release * 65e0731d3a Note systemd-cryptsetup package split in NEWS * 2bd9927f5d Update upstream source from tag 'upstream/256.6' |\ | * 27c691ac24 New upstream version 256.6 * 395974bae4 Re-enable utmp support, tmux's autopkgtests require it * 685e1c84eb initramfs-tools: ensure rules file exists before invoking chzdev * a454822396 Filter out zdev rules in the initramfs hook (LP: #2044104) * cd0179221d salsa-ci: test the stage1 build profile * 55917feab0 Update changelog for 256.5-2 release * f280a3cbf5 Disable utmp support, replaced by wtmpdb * 635c5f48dc d/t/upstream: do not pass /var/cache/apt/archives to PackageDirectories
* | po: Translated using Weblate (Finnish)Ricky Tigg2024-09-131-66/+43
| | | | | | | | | | | | | | | | Currently translated at 100.0% (253 of 253 strings) Co-authored-by: Ricky Tigg <ricky.tigg@gmail.com> Translate-URL: https://translate.fedoraproject.org/projects/systemd/main/fi/ Translation: systemd/main
* | Merge pull request #34392 from poettering/format-util-splitDaan De Meyer2024-09-1319-78/+95
|\ \ | | | | | | tweaks to networkd sysctl logging
| * | catalog: beef up new sysctl messageLennart Poettering2024-09-131-4/+7
| | | | | | | | | | | | Let's make use of the templating logic, to make the entry more useful.
| * | catalog: rebreak catalog entryLennart Poettering2024-09-131-5/+6
| | |
| * | networkd: move sysctl code to use PID_FMTLennart Poettering2024-09-131-4/+5
| | | | | | | | | | | | | | | Now that format-util.h doesn't pull in net/if.h anymore, we can use it to format PIDs in the networkd-sysctl.c code.
| * | basic: split ifname related calls from format-util.h into format-ifname.hLennart Poettering2024-09-1317-65/+77
|/ / | | | | | | | | | | | | | | This way we don't have to pull in net/if.h into format-util.h. This is supposed to address https://github.com/systemd/systemd/pull/32212#discussion_r1755639881 No actual code changes, just a .c/.h file split-up.
* | minor fixups for #32212Matteo Croce2024-09-133-5/+8
| | | | | | | | Fix minor post merge comments
* | mkosi: Stop applying device groups patch on ArchDaan De Meyer2024-09-121-4/+0
| | | | | | | | It stopped applying so let's stop applying it to make CI green again.
* | analyze: add test for verify exit status with warningsRyan Wilson2024-09-121-0/+23
| |
* | units: Order ldconfig.service after systemd-confext.serviceDaan De Meyer2024-09-121-1/+2
| | | | | | | | | | | | | | The configuration files required by ldconfig could be put into place by systemd-confext.service (ldconfig only looks in /etc) so let's order the service after systemd-confext.service to make sure any config files are in place before the service runs.
* | Merge pull request #34390 from poettering/bus-process-man-tweakLuca Boccassi2024-09-122-9/+18
|\ \ | | | | | | man: document that sd_bus_process() only returns otherwise unhandled …
| * | update TODOLennart Poettering2024-09-121-3/+0
| | |
| * | man: document that sd_bus_process() only returns otherwise unhandled ↵Lennart Poettering2024-09-121-6/+18
| | | | | | | | | | | | messages in *ret_message
* | | Merge pull request #32212 from teknoraver/networkd-sysctlLennart Poettering2024-09-1220-42/+600
|\ \ \ | |/ / |/| | More visibility into systemd-networkd sysctls
| * | test-network: add test for sysctl watchMatteo Croce2024-09-111-0/+32
| | | | | | | | | | | | | | | Add a NetworkdSysctlTest class which ensures that networkd correctly complains when a sysctl file it's handling has been changed externally.
| * | emit a warning in networkd if managed sysctls are changedMatteo Croce2024-09-1114-4/+469
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Monitor the sysctl set by networkd for writes, if a sysctl is overwritten with a different value than the one we set, emit a warning. Writes are detected with an eBPF program attached as BPF_CGROUP_SYSCTL which reports the sysctl writes only in net/. The eBPF program only reports sysctl writes from a different cgroup than networkd. To do this, it uses the `bpf_current_task_under_cgroup_proto()` helper, which will be available allowed in BPF_CGROUP_SYSCTL from kernel 6.12[1]. Loading a BPF_CGROUP_SYSCTL program requires the CAP_SYS_ADMIN capability, so drop it just after the program load, whether it loads successfully or not. Writes are logged but permitted, in future the functionality can be extended to also deny writes to managed sysctls. [1] https://lore.kernel.org/bpf/20240819162805.78235-3-technoboy85@gmail.com/
| * | store the sysctls set by networkdMatteo Croce2024-09-115-22/+45
| | | | | | | | | | | | | | | networkd set several sysctl to set the network configuration. Save their value so we can check is other processes change them.
| * | extend sysctl functions to shadow valuesMatteo Croce2024-09-116-38/+76
| | | | | | | | | | | | | | | Pass to all the sysctl_* functions a hashmap which can be used to optionally save the value written in the sysctl.
* | | update TODOLennart Poettering2024-09-121-29/+4
| | |
* | | Merge pull request #34388 from poettering/syscall-updateLennart Poettering2024-09-1221-43/+6
|\ \ \ | | | | | | | | seccomp: update syscall list and categorize new additions a bit
| * | | seccomp-util: add recently added new syscalls to various seccomp groups, as ↵Lennart Poettering2024-09-121-0/+3
| | | | | | | | | | | | | | | | appropriate
| * | | syscalls: run "ninja update-syscalls-*"Lennart Poettering2024-09-1220-43/+3
| | |/ | |/|
* | | Merge pull request #34385 from poettering/man-unify-pcr-key-nameLennart Poettering2024-09-122-22/+22
|\ \ \ | | | | | | | | man: clean up PCR public key filenames in systemd-stub and systemd-measure man pages
| * | | man: fix advertised filename of the PCR public keyLennart Poettering2024-09-121-1/+1
| | | |
| * | | man: systemd-stub places PCR public key in file 'tpm2-pcr-public-key.pem', ↵Lennart Poettering2024-09-121-21/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | stick to that name across the board systemd-stub provides the signing key for TPM2 signed PCR policies in a file tpm2-pcr-public-key.pem to userspace. Hence, to clarify that this is the same key as used when signing via "systemd-measure", let's rename it in the docs like that. Also rename the private key to tpm2-pcr-private-key.pem, to keep the symmetry. With this we should universally stick to this nomenclature: 1. tpm2-pcr-public-key.pem ← public part of signing key 2. tpm2-pcr-private-key.pem ← private part of signing key 3. tpm2-pcr-signature.json ← signature file made with key pair Inspired by: #34069
* | | | NEWS: correct/complete some entriesMike Yuan2024-09-121-5/+9
| | | |
* | | | Merge pull request #34386 from keszybz/mkosi-update-helperDaan De Meyer2024-09-122-1/+104
|\ \ \ \ | |_|/ / |/| | | Mkosi update helper
| * | | mkosi: update mkosi commit reference to v24.3-158-g2c9954fa51Zbigniew Jędrzejewski-Szmek2024-09-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2c9954fa51 mkosi-initrd: correct `--debug-shell` help output * 671708a10b Merge pull request #2990 from behrmann/allthemanuals |\ | * 2671849125 initrd: add --show-documentation option | * e2238f5dc7 Move show_docs to its own module | * e366093b1c doc: make documentation command take an argument * | 9fcff08b34 Update documentation links * | 113f7f67dd Only write to /etc/machine-id if /etc exists |/ * 62a610c0e5 Merge pull request #3005 from DaanDeMeyer/mypy |\ | * 9b569c93bb Don't delete reader in _tempfile() backport | * 16f4c94930 Mark all class variables as Final | * ca7021e9a7 Annotate two more variables that need it | * fec368dd4d Move KeySource.Type out of KeySource | * ff5f7b06b8 user: Drop lru_cache() for home() and name() | * 8f7c7b366f Move code backported from cpython upstream to backport.py | * f66212e9c2 Drop listify() | * 4293866df2 mypy: Disable allow_redefinition | * 2700337f11 Fix mypyc warnings in sandbox.py |/ * 025483af04 sandbox: Use separate variable name when we change types * b04800cd30 Merge pull request #3003 from DaanDeMeyer/initrd |\ | * fd64be9b60 mkosi-initrd: Ignore gnupg subdirectory | * 7a8a21f8f6 mkosi-initrd: Only set --cacheonly=metadata when running as root | * 156880c398 mkosi-initrd: Add --debug-shell argument |/ * a32c8f393a Merge pull request #3002 from DaanDeMeyer/cherry-pick |\ | * 1d8bfabc97 news: add note to change where the manual pages are | * 8917d65db1 initrd: flatten module into a single file | * 76085b788a sandbox: flatten module into a single file | * 9f48afa4a7 cli: add missing completion stubs to pyproject.toml | * 6e21cceb03 doc: move man pages to resources/man | * 25d1c6b579 cli: use ellipsis ligature instead of writing out ... |/ * 013d9b5595 Move various functions to bootloader.py * 508ad85475 Update NEWS.md * f25b8dee6f Simplify package cache dir mirror key * dce4c8af51 Merge pull request #2998 from DaanDeMeyer/ci |\ | * f4934828f7 tests: Show debug messages on console | * fa3ae22598 ci: Drop machine-id commit timeout drop-in * dba01269de base64 encode mirror if we put it in package cache dir key * 364b65f7bb Add 'login' to Debian/Ubuntu/Kali package list * ee07b5b6d2 Bump github/codeql-action from 3.25.15 to 3.26.6
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 12:56:16 +0100