summaryrefslogtreecommitdiffstats
path: root/src/core/socket.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* core/socket: support "systemctl clean" for socket unitsYu Watanabe2019-08-281-0/+1
|
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-4/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* Add counter for socket unit refuse events (#9217)xginn82018-06-111-0/+1
| | | core: add counter for socket unit rejection events
* core: undo the dependency inversion between unit.h and all unit typesFelipe Sateler2018-05-151-0/+3
|
* tree-wide: be more careful with the type of array sizesLennart Poettering2018-04-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously we were a bit sloppy with the index and size types of arrays, we'd regularly use unsigned. While I don't think this ever resulted in real issues I think we should be more careful there and follow a stricter regime: unless there's a strong reason not to use size_t for array sizes and indexes, size_t it should be. Any allocations we do ultimately will use size_t anyway, and converting forth and back between unsigned and size_t will always be a source of problems. Note that on 32bit machines "unsigned" and "size_t" are equivalent, and on 64bit machines our arrays shouldn't grow that large anyway, and if they do we have a problem, however that kind of overly large allocation we have protections for usually, but for overflows we do not have that so much, hence let's add it. So yeah, it's a story of the current code being already "good enough", but I think some extra type hygiene is better. This patch tries to be comprehensive, but it probably isn't and I missed a few cases. But I guess we can cover that later as we notice it. Among smaller fixes, this changes: 1. strv_length()' return type becomes size_t 2. the unit file changes array size becomes size_t 3. DNS answer and query array sizes become size_t Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=76745
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* pid1: rename unit_check_gc to unit_may_gcZbigniew Jędrzejewski-Szmek2018-02-151-2/+2
| | | | | | | | "check" is unclear: what is true, what is false? Let's rename to "can_gc" and revert the return value ("positive" values are easier to grok). v2: - rename from unit_can_gc to unit_may_gc
* core/socket: add socket_port_type_from_string()Yu Watanabe2017-12-231-2/+3
|
* core: unify common code for preparing for forking off unit processesLennart Poettering2017-11-211-2/+0
| | | | | | | | | This introduces a new function unit_prepare_exec() that encapsulates a number of calls we do in preparation for spawning off some processes in all our unit types that do so. This allows us to neatly unify a bit of code between unit types and shorten our code.
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* cgroup, unit, fragment parser: make use of new firewall functionsDaniel Mack2017-09-221-1/+1
|
* systemd: do not serialize peer, bump count when deserializing socket insteadZbigniew Jędrzejewski-Szmek2016-08-051-0/+1
|
* core/socket: rework SocketPeer refcountingZbigniew Jędrzejewski-Szmek2016-08-051-7/+0
| | | | | Make functions and definitions that don't need to be shared local to socket.c.
* systemd: convert peers_by_address to a setZbigniew Jędrzejewski-Szmek2016-08-051-1/+1
|
* socket: add support to control no. of connections from one source (#3607)Susant Sahani2016-08-021-0/+16
| | | | | | Introduce MaxConnectionsPerSource= that is number of concurrent connections allowed per IP. RFE: 1939
* core: add a concept of "dynamic" user ids, that are allocated as long as a ↵Lennart Poettering2016-07-221-0/+2
| | | | | | | | | | | | | | | | | | | service is running This adds a new boolean setting DynamicUser= to service files. If set, a new user will be allocated dynamically when the unit is started, and released when it is stopped. The user ID is allocated from the range 61184..65519. The user will not be added to /etc/passwd (but an NSS module to be added later should make it show up in getent passwd). For now, care should be taken that the service writes no files to disk, since this might result in files owned by UIDs that might get assigned dynamically to a different service later on. Later patches will tighten sandboxing in order to ensure that this cannot happen, except for a few selected directories. A simple way to test this is: systemd-run -p DynamicUser=1 /bin/sleep 99999
* core: move enforcement of the start limit into per-unit-type code againLennart Poettering2016-05-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Let's move the enforcement of the per-unit start limit from unit.c into the type-specific files again. For unit types that know a concept of "result" codes this allows us to hook up the start limit condition to it with an explicit result code. Also, this makes sure that the state checks in clal like service_start() may be done before the start limit is checked, as the start limit really should be checked last, right before everything has been verified to be in order. The generic start limit logic is left in unit.c, but the invocation of it is moved into the per-type files, in the various xyz_start() functions, so that they may place the check at the right location. Note that this change drops the enforcement entirely from device, slice, target and scope units, since these unit types generally may not fail activation, or may only be activated a single time. This is also documented now. Note that restores the "start-limit-hit" result code that existed before 6bf0f408e4833152197fb38fb10a9989c89f3a59 already in the service code. However, it's not introduced for all units that have a result code concept. Fixes #3166.
* core: introduce activation rate limiting for socket unitsLennart Poettering2016-04-291-0/+3
| | | | | | | | | | | | | | This adds two new settings TriggerLimitIntervalSec= and TriggerLimitBurst= that define a rate limit for activation of socket units. When the limit is hit, the socket is is put into a failure mode. This is an alternative fix for #2467, since the original fix resulted in issue #2684. In a later commit the StartLimitInterval=/StartLimitBurst= rate limiter will be changed to be applied after any start conditions checks are made. This way, there are two separate rate limiters enforced: one at triggering time, before any jobs are queued with this patch, as well as the start limit that is moved again to be run immediately before the unit is activated. Condition checks are done in between the two, and thus no longer affect the start limit.
* Merge pull request #2569 from zonque/removalsMartin Pitt2016-02-101-2/+0
|\ | | | | Remove some old cruft
| * tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | | | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* | core: make the StartLimitXYZ= settings generic and apply to any kind of ↵Lennart Poettering2016-02-101-1/+1
|/ | | | | | | | | | | | | | | | | | | | unit, not just services This moves the StartLimitBurst=, StartLimitInterval=, StartLimitAction=, RebootArgument= from the [Service] section into the [Unit] section of unit files, and thus support it in all unit types, not just in services. This way we can enforce the start limit much earlier, in particular before testing the unit conditions, so that repeated start-up failure due to failed conditions is also considered for the start limit logic. For compatibility the four options may also be configured in the [Service] section still, but we only document them in their new section [Unit]. This also renamed the socket unit failure code "service-failed-permanent" into "service-start-limit-hit" to express more clearly what it is about, after all it's only triggered through the start limit being hit. Finally, the code in busname_trigger_notify() and socket_trigger_notify() is altered to become more alike. Fixes: #2467
* tree-wide: sort includes in *.hThomas Hindoe Paaboel Andersen2015-11-181-1/+1
| | | | | This is a continuation of the previous include sort patch, which only sorted for .c files.
* socket: Add support for socket protcolSusant Sahani2015-11-181-0/+2
| | | | | | | | | | | | | | | Now we don't support the socket protocol like sctp and udplite . This patch add a new config param SocketProtocol: udplite/sctp With this now we can configure the protocol as udplite = IPPROTO_UDPLITE sctp = IPPROTO_SCTP Tested with nspawn:
* core: add support for naming file descriptors passed using socket activationLennart Poettering2015-10-061-2/+6
| | | | | | | | | | | | | | | | | | | | | | | This adds support for naming file descriptors passed using socket activation. The names are passed in a new $LISTEN_FDNAMES= environment variable, that matches the existign $LISTEN_FDS= one and contains a colon-separated list of names. This also adds support for naming fds submitted to the per-service fd store using FDNAME= in the sd_notify() message. This also adds a new FileDescriptorName= setting for socket unit files to set the name for fds created by socket units. This also adds a new call sd_listen_fds_with_names(), that is similar to sd_listen_fds(), but also returns the names of the fds. systemd-activate gained the new --fdname= switch to specify a name for testing socket activation. This is based on #1247 by Maciej Wereski. Fixes #1247.
* core: simplify fd collection code, return number of fds as return valueLennart Poettering2015-10-061-1/+1
| | | | | | Let's simplify the fd collection code a bit, and return the number of collected fds as positive integer, the way it's customary in our usual code.
* core: add new setting Writable= to ListenSpecial= socket unitsLennart Poettering2015-10-011-0/+1
| | | | | | | | | Writable= is a new boolean setting. If ture, then ListenSpecial= will open the specified path in O_RDWR mode, rather than just O_RDONLY. This is useful for implementing services like rfkill, where /dev/rfkill is more useful when opened in write mode, if we want to not only save but also restore its state.
* Move all unit states to basic/ and extend systemctl --state=helpZbigniew Jędrzejewski-Szmek2015-09-281-21/+0
|
* core: Add socket type for usb functionfs endpointsPawel Szewczyk2015-09-221-0/+1
| | | | For handling functionfs endpoints additional socket type is added.
* core: Add list of additional file descriptors to socket portPawel Szewczyk2015-09-221-0/+2
| | | | | | | | Some additional files related to single socket may appear in the filesystem and they should be opened and passed to related service. This commit adds optional list of file descriptors, which are dynamically discovered and opened.
* core: expose consumed CPU time per unitLennart Poettering2015-03-021-0/+2
| | | | | | This adds support for showing the accumulated consumed CPU time per-unit in the "systemctl status" output. The property is also readable via the bus.
* remove unused includesThomas Hindoe Paaboel Andersen2015-02-231-2/+0
| | | | | | This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.
* socket: introduce SELinuxContextFromNet optionMichal Sekletar2014-09-191-0/+2
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_mls_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* Revert "socket: introduce SELinuxLabelViaNet option"Lennart Poettering2014-08-191-2/+0
| | | | | | This reverts commit cf8bd44339b00330fdbc91041d6731ba8aba9fec. Needs more discussion on the mailing list.
* socket: introduce SELinuxLabelViaNet optionMichal Sekletar2014-08-191-0/+2
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* socket: Add support for TCP defer acceptSusant Sahani2014-08-151-0/+1
| | | | | | | | | | | TCP_DEFER_ACCEPT Allow a listener to be awakened only when data arrives on the socket. If TCP_DEFER_ACCEPT set on a server-side listening socket, the TCP/IP stack will not to wait for the final ACK packet and not to initiate the process until the first packet of real data has arrived. After sending the SYN/ACK, the server will then wait for a data packet from a client. Now, only three packets will be sent over the network, and the connection establishment delay will be significantly reduced.
* socket: Add Support for TCP keep alive variablesSusant Sahani2014-08-151-0/+3
| | | | | | | | | | | | | | The tcp keep alive variables now can be configured via conf parameter. Follwing variables are now supported by this patch. tcp_keepalive_intvl: The number of seconds between TCP keep-alive probes tcp_keepalive_probes: The maximum number of TCP keep-alive probes to send before giving up and killing the connection if no response is obtained from the other end. tcp_keepalive_time: The number of seconds a connection needs to be idle before TCP begins sending out keep-alive probes.
* Revert "socket: add support for TCP fast Open"Lennart Poettering2014-08-141-1/+0
| | | | | | | | This reverts commit 9528592ff8d7ff361da430285deba8196e8984d5. Apparently TFO is actually the default at least for the server side now. Also the setsockopt doesn't actually take a bool, but a qlen integer.
* socket: add support for TCP fast OpenSusant Sahani2014-08-141-0/+1
| | | | | | | | | | TCP Fast Open (TFO) speeds up the opening of successiveTCP) connections between two endpoints.It works by using a TFO cookie in the initial SYN packet to authenticate a previously connected client. It starts sending data to the client before the receipt of the final ACK packet of the three way handshake is received, skipping a round trip and lowering the latency in the start of transmission of data.
* socket: add support for tcp nagleSusant Sahani2014-08-141-0/+1
| | | | | | | This patch adds support for TCP TCP_NODELAY socket option. This can be configured via NoDelay conf parameter. TCP Nagle's algorithm works by combining a number of small outgoing messages, and sending them all at once. This controls the TCP_NODELAY socket option.
* systemd-verify: a simple tool for offline unit verificationZbigniew Jędrzejewski-Szmek2014-07-211-0/+2
| | | | | | | | This tool will warn about misspelt directives, unknown sections, and non-executable commands. It will also catch the common mistake of using Accept=yes with a non-template unit and vice versa. https://bugs.freedesktop.org/show_bug.cgi?id=56607
* socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file ↵Lennart Poettering2014-06-051-0/+4
| | | | | | | system This is relatively complex, as we cannot invoke NSS from PID 1, and thus need to fork a helper process temporarily.
* socket: add new Symlinks= option for socket unitsLennart Poettering2014-06-041-0/+2
| | | | | | | | | | | With Symlinks= we can manage one or more symlinks to AF_UNIX or FIFO nodes in the file system, with the same lifecycle as the socket itself. This has two benefits: first, this allows us to remove /dev/log and /dev/initctl from /dev, thus leaving only symlinks, device nodes and directories in the /dev tree. More importantly however, this allows us to move /dev/log out of /dev, while still making it accessible there, so that PrivateDevices= can provide /dev/log too.
* socket: optionally remove sockets/FIFOs in the file system after useLennart Poettering2014-06-041-0/+1
|
* service: add the ability for units to join other unit's PrivateNetwork= and ↵Lennart Poettering2013-11-271-0/+1
| | | | PrivateTmp= namespaces
* core: convert PID 1 to libsystemd-busLennart Poettering2013-11-201-3/+5
| | | | | | | | | | | | | | | | | | | | | | This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.
* core: rework how we match mount units against each otherLennart Poettering2013-09-261-4/+0
| | | | | | | | | | | | | | | | | | | | | | | Previously to automatically create dependencies between mount units we matched every mount unit agains all others resulting in O(n^2) complexity. On setups with large amounts of mount units this might make things slow. This change replaces the matching code to use a hashtable that is keyed by a path prefix, and points to a set of units that require that path to be around. When a new mount unit is installed it is hence sufficient to simply look up this set of units via its own file system paths to know which units to order after itself. This patch also changes all unit types to only create automatic mount dependencies via the RequiresMountsFor= logic, and this is exposed to the outside to make things more transparent. With this change we still have some O(n) complexities in place when handling mounts, but that's currently unavoidable due to kernel APIs, and still substantially better than O(n^2) as before. https://bugs.freedesktop.org/show_bug.cgi?id=69740
* core: notify triggered by socket of a serviceUmut Tezduyar2013-09-121-3/+0
|
* basic SO_REUSEPORT supportShawn Landden2013-07-111-0/+1
|
* core: general cgroup reworkLennart Poettering2013-06-271-0/+1
| | | | | | | | | | | | | | | | Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 11:25:29 +0100