summaryrefslogtreecommitdiffstats
path: root/src/core/ip-address-access.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* bpf-firewall: optimization for IPAddressXYZ="any" (and unprivileged users)Anita Zhang2019-06-221-0/+18
| | | | | | | | | | | | This is a workaround to make IPAddressDeny=any/IPAddressAllow=any work for non-root users that have CAP_NET_ADMIN. "any" was chosen since all or nothing network access is one of the most common use cases for isolation. Allocating BPF LPM TRIE maps require CAP_SYS_ADMIN while BPF_PROG_TYPE_CGROUP_SKB only needs CAP_NET_ADMIN. In the case of IPAddressXYZ="any" we can just consistently return false/true to avoid allocating the map and limit the user to having CAP_NET_ADMIN.
* Move warning about unsupported BPF firewall right before the firewall would ↵Zbigniew Jędrzejewski-Szmek2019-06-041-15/+0
| | | | | | | | | | | | | | | | | | | be created There's no need to warn about the firewall when parsing, because the unit might not be started at all. Let's warn only when we're actually preparing to start the firewall. This changes behaviour: - the warning is printed just once for all unit types, and not once for normal units and once for transient units. - on repeat warnings, the message is not printed at all. There's already detailed debug info from bpf_firewall_compile(), so we don't need to repeat ourselves. - when we are not root, let's say precisely that, not "lack of necessary privileges" and "the local system does not support BPF/cgroup firewalling". Fixes #12673.
* tree-wide: drop copyright headers from frequent contributorsZbigniew Jędrzejewski-Szmek2018-06-201-3/+0
| | | | | | | | Fixes #9320. for p in Shapovalov Chevalier Rozhkov Sievers Mack Herrmann Schmidt Rudenberg Sahani Landden Andersen Watanabe; do git grep -e 'Copyright.*'$p -l|xargs perl -i -0pe 's|/([*][*])?[*]\s+([*#]\s+)?Copyright[^\n]*'$p'[^\n]*\s*[*]([*][*])?/\n*|\n|gms; s|\s+([*#]\s+)?Copyright[^\n]*'$p'[^\n]*\n*|\n|gms' done
* tree-wide: beautify remaining copyright statementsLennart Poettering2018-06-141-1/+1
| | | | | | Let's unify an beautify our remaining copyright statements, with a unicode ©. This means our copyright statements are now always formatted the same way. Yay.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* bpf: beef up bpf detection, check if BPF_F_ALLOW_MULTI is supportedLennart Poettering2018-02-211-1/+1
| | | | | | | | | This improves the BPF/cgroup detection logic, and looks whether BPF_ALLOW_MULTI is supported. This flag allows execution of multiple BPF filters in a recursive fashion for a whole cgroup tree. It enables us to properly report IP accounting for slice units, as well as delegation of BPF support to units without breaking our own IP accounting.
* ip-address-access: let's exit the loop after invalidating our entry a (#7803)Lennart Poettering2018-01-041-7/+6
| | | CID#1382967
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* core: only warn about BPF/cgroup missing once per runtime (#7319)Lennart Poettering2017-11-131-3/+9
| | | | | | | | Let's reduce the amount of noise a bit, there's little point in complaining loudly about every single unit like this, let's complain only about the first one, and then downgrade the log level to LOG_DEBUG for the other cases. Fixes: #7188
* fix compile error on muslMatija Skala2017-10-301-2/+2
| | | | | | name '__in6_u.__u6_addr32' is specific to glibc use 's6_addr32' macro instead
* core: warn loudly if IP firewalling is configured but not in effectLennart Poettering2017-09-221-0/+10
|
* ip-address-access: minimize IP address listsLennart Poettering2017-09-221-0/+42
| | | | | Let's drop redundant items from the IP address list after parsing. Let's also mask out redundant bits hidden by the prefixlength.
* Add IP address address ACL representation and parserDaniel Mack2017-09-221-0/+165
Add a config directive parser that takes multiple space separated IPv4 or IPv6 addresses with optional netmasks in CIDR notation rvalue and puts a parsed version of it to linked list of IPAddressAccessItem objects. The code actually using this will be added later.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 11:43:29 +0100