summaryrefslogtreecommitdiffstats
path: root/src/nss-resolve (follow)
Commit message (Collapse)AuthorAgeFilesLines
* sd-varlink: make our internal Varlink API public as sd-varlink.[ch]Lennart Poettering2024-07-161-17/+18
| | | | | | | | | | It's time. sd-json was already done earlier in this cycle, let's now make sd-varlink public too. This is mostly just a search/replace job of epical proportions. I left some functions internal (mostly IDL handling), and I turned some static inline calls into regular calls.
* tree-wide: port over to new builder apisLennart Poettering2024-06-191-9/+14
|
* libsystemd: turn json.[ch] into a public APILennart Poettering2024-06-121-60/+61
| | | | | | | | | | | | | | | This is preparation for making our Varlink API a public API. Since our Varlink API is built on top of our JSON API we need to make that public first (it's a nice API, but JSON APIs there are already enough, this is purely about the Varlink angle). I made most of the json.h APIs public, and just placed them in sd-json.h. Sometimes I wasn't so sure however, since the underlying data structures would have to be made public too. If in doubt I didn#t risk it, and moved the relevant API to src/libsystemd/sd-json/json-util.h instead (without any sd_* symbol prefixes). This is mostly a giant search/replace patch.
* env-util: rename getenv_bool_secure() → secure_getenv_bool()Lennart Poettering2024-02-281-1/+2
| | | | | | The glibc API is behind the wrapper is called "secure_getenv()", hence our wrapper really should keep the order too, otherwise things are just too confusing.
* varlink: drop "ret_flags" parameter from varlink_call()Lennart Poettering2024-01-171-3/+3
| | | | | | | | The parameter returns the flags field of the reply message. This is only relevant in very few cases, hence drop it from the call, but keep it in a more generic varlink_call_full() call for those who need it. Do something similar for varlink_callb().
* tree-wide: use JSON_ALLOW_EXTENSIONS when disptching at various placesLennart Poettering2024-01-051-1/+1
| | | | | | | | | If we want to allow method replies to be extended without this breaking compat, then we should set this flag. Do so at various method call replies hence. Also do it when parsing user/group records, which are expressly documented to be extensible, as well as the hibernate JSON record.
* tree-wide: take in all *our* JSON structures also decimal stringsLennart Poettering2023-11-071-5/+5
| | | | | | | | | | | | Let's be friendly in what we accept: whenever we define a JSON structure, let's also allow decimal strings where we want an integer. This patch purely replaces JSON_VARIANT_UNSIGNED by _JSON_VARIANT_TYPE_INVALID in the various JsonDispatch[] tables, so that we'll happily accept any type in json_dispatch(), so that json_dispatch_uint64() and related tools can do their thing. This does not switch over OCI (as a JSON structure not defined by us).
* varlink,json: introduce new varlink_dispatch() helperLennart Poettering2023-11-021-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | varlink_dispatch() is a simple wrapper around json_dispatch() that returns clean, standards-compliant InvalidParameter error back to clients, if the specified JSON cannot be parsed properly. For this json_dispatch() is extended to return the offending field's name. Because it already has quite a few parameters, I then renamed json_dispatch() to json_dispatch_full() and made json_dispatch() a wrapper around it that passes the new argument as NULL. While doing so I figured we should also get rid of the bad= argument in the short wrapper, since it's only used in the OCI code. To simplify the OCI code this adds a second wrapper oci_dispatch() around json_dispatch_full(), that fills in bad= the way we want. Net result: instead of one json_dispatch() call there are now: 1. json_dispatch_full() for the fully feature mother of all dispathers. 2. json_dispatch() for the simpler version that you want to use most of the time. 3. varlink_dispatch() that generates nice Varlink errors 4. oci_dispatch() that does the OCI specific error handling And that's all there is.
* meson: Fix version script handlingJan Janssen2023-09-261-1/+1
| | | | | | Build targets should have a link dependency on the version scripts they use. This also uses absolute paths in anticipation for meson 1.3 needlessly deprecating file to string conversions.
* meson: move declarations of nss modulesYu Watanabe2023-07-311-0/+12
|
* nss-resolve: report EAI_NODATAMateusz Poliwczak2023-05-181-0/+12
|
* tree-wide: use ASSERT_PTR moreDavid Tardon2022-09-131-6/+3
|
* tree-wide: allow ASCII fallback for … in logsDavid Tardon2022-06-281-1/+4
|
* nss: only read logging config from environment variablesZbigniew Jędrzejewski-Szmek2022-01-111-1/+1
| | | | | | | | | | | | | log_parse_environment() uses should_parse_proc_cmdline() to determine whether it should parse settings from the kernel command line. But the checks that should_parse_proc_cmdline() apply to the whole process, and we could get a positive answer also when log_parse_environment() was called from one of the nss modules. In case of nss-modules, we don't want to look at the kernel command line. log_parse_environment_variables() that only looks at the environment variables is split out and used in the nss modules. Fixes #22020.
* nss-resolve: expose various source-disablement settings as variablesZbigniew Jędrzejewski-Szmek2021-12-201-10/+20
| | | | | | | | | | | | | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2006761: > systemd-resolved always (reverse)-resolves the host's IP addresses and FQDN. > This can be harmful when an application (for instance, a DNS zone manager) is > installed on the same server instance. That application would expect > NXDOMAIN to be returned if the current server's IP does not belong in an > already managed reverse zone. This allows clients of nss-resolve to use the same config options that are available through the dbus api and as command-line options to resolvectl. The man page text is is mostly copied directly from c6f20515ab600098b5c2871bae2e9ecab3b41555.
* resolved: properly signal transient errors back to NSS stackLennart Poettering2021-11-221-9/+46
| | | | | | | | | | | | NSS mostly knows four error cases: SUCCESS, NOTFOUND, UNAVAIL, TRYAGAIN, and they can all be used in nsswitch.conf to route requests. So far nss-resolve would return SUCCESS + NOTFOUND + UNAVAIL. Let's also return TRYAGAIN in some cases, specifically the ones where we are currntly unable to resolve a request but likely could later. i.e. errors caused by networking issues or such. Fixes: #20786
* shared/json: use int64_t instead of intmax_tZbigniew Jędrzejewski-Szmek2021-11-181-3/+3
| | | | | | | | | | | We were already asserting that the intmax_t and uintmax_t types are the same as int64_t and uint64_t. Pretty much everywhere in the code base we use the latter types. In principle intmax_t could be something different on some new architecture, and then the code would fail to compile or behave differently. We actually do not want the code to behave differently on those architectures, because that'd break interoperability. So let's just use int64_t/uint64_t since that's what we indend to use.
* nss-resolve: define variables in the bodyZbigniew Jędrzejewski-Szmek2021-03-311-37/+36
| | | | | | | | | | | Same motivation as in the parent commit: let's define variables later, ideally right when they are first initialized, so it's easier to figure out that they are properly initialized. error_id and r_tuple* were previously initialized, but I don't see why they would need to be. No functional change intended.
* nss-resolve: fix parsing of io.systemd.Resolve.ResolveAddress replyZbigniew Jędrzejewski-Szmek2021-03-311-25/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the switch to varlink in 0c73f4f075a2d23f7cabe708b589f19f4bbbec37, the code wasn't functional. The JSON_VARIANT_UNSIGNED/JSON_VARIANT_STRING mismatch meant that we'd reject any reply. Once past that, the code would use unitialized 'c' and 'n' variables, so it's lucky we never got that far ;) With -Wmaybe-unitialized, gcc would warn. I think that declaring the huge list of local variables with very short names at the top of the function was making it harder to understand what is going on in the function. So let's rename the variables a bit, and initialize them upon declaration if possible. $ build/test-nss-hosts resolve 1.1.1.1 1.0.0.1 10.38.5.41 ======== resolve ======== _nss_resolve_gethostbyaddr2_r("1.1.1.1") → status=NSS_STATUS_SUCCESS errno=999/--- h_errno=0/Resolver Error 0 (no error) ttl=0 "one.one.one.one" AF_INET 1.1.1.1 _nss_resolve_gethostbyaddr_r("1.1.1.1") → status=NSS_STATUS_SUCCESS errno=999/--- h_errno=0/Resolver Error 0 (no error) "one.one.one.one" AF_INET 1.1.1.1 _nss_resolve_gethostbyaddr2_r("1.0.0.1") → status=NSS_STATUS_SUCCESS errno=999/--- h_errno=0/Resolver Error 0 (no error) ttl=0 "one.one.one.one" AF_INET 1.0.0.1 _nss_resolve_gethostbyaddr_r("1.0.0.1") → status=NSS_STATUS_SUCCESS errno=999/--- h_errno=0/Resolver Error 0 (no error) "one.one.one.one" AF_INET 1.0.0.1 _nss_resolve_gethostbyaddr2_r("10.38.5.41") → status=NSS_STATUS_SUCCESS errno=999/--- h_errno=0/Resolver Error 0 (no error) ttl=0 "squid.redhat.com" alias "squid.corp.redhat.com" alias "squid2.corp.redhat.com" alias "squid3.corp.redhat.com" alias "squid4.corp.redhat.com" alias "squid5.corp.redhat.com" AF_INET 10.38.5.41 _nss_resolve_gethostbyaddr_r("10.38.5.41") → status=NSS_STATUS_SUCCESS errno=999/--- h_errno=0/Resolver Error 0 (no error) "squid.redhat.com" alias "squid.corp.redhat.com" alias "squid2.corp.redhat.com" alias "squid3.corp.redhat.com" alias "squid4.corp.redhat.com" alias "squid5.corp.redhat.com" AF_INET 10.38.5.41 (I have 10.38.5.41 squid.redhat.com squid.corp.redhat.com squid2.corp.redhat.com squid3.corp.redhat.com squid4.corp.redhat.com squid5.corp.redhat.com in /etc/hosts for testing.)
* tree-wide: use in_addr_is_set() or friendsYu Watanabe2021-02-171-1/+1
|
* nss-resolve: allow turning off validation via env varLennart Poettering2021-02-141-3/+22
|
* nss-resolve: shortcut fixing of ifindex if it's zero anywayLennart Poettering2021-02-051-1/+1
|
* nss-resolve: accept zero ifindex when parsing resolved replyLennart Poettering2021-02-051-1/+1
| | | | | | | | Sometimes a reply isn't associated to any specific interface, it might be a general truth (for example served from /etc/hosts or so). In this case the server might pass ifindex == 0. Accept that. https://github.com/systemd/systemd/pull/17823#issuecomment-742439422
* nss-resolve: initialize logging, log json errorsZbigniew Jędrzejewski-Szmek2020-12-101-12/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the .so module is loaded, it gets a separate copy of stuff in src/basic, including the log level variables. So any logging settings are unaffected by the loading program calling log_parse_environment() or such. Let's also parse the environment here so that we can have nice logging. Initialization is done from each exported function, and pthread_once_t is used to avoid duplicate initialization. I didn't merge PROTECT_ERRNO into NSS_ENTRYPOINT_BEGIN because UNPROTECT_ERRNO is called in a bunch of places and it would feel strange to have PROTECT_ERRNO hidden, but not UNPROTECT_ERRNO. The most interesting stuff in this module is the varlink messages, and any potential errors in json. So let's enable json logging when debug messages are enabled. With those changes, figuring out the issue in https://github.com/systemd/systemd/pull/17823 is trivial: $ LD_LIBRARY_PATH=build/ SYSTEMD_LOG_COLOR=1 SYSTEMD_LOG_LOCATION=1 SYSTEMD_LOG_LEVEL=debug getent hosts mirrors.fedoraproject.org src/shared/varlink.c:237: n/a: varlink: setting state idle-client src/shared/varlink.c:1240: n/a: Sending message: {"method":"io.systemd.Resolve.ResolveHostname","parameters":{"name":"mirrors.fedoraproject.org","family":10}} src/shared/varlink.c:240: n/a: varlink: changing state idle-client → calling src/shared/varlink.c:588: n/a: New incoming message: {"parameters":{"addresses":[{"ifindex":0,"family":10,"address":[42,5,208,20,0,16,120,3,247,116,77,124,226,119,164,87]},{"ifindex":0,"family":10,"address":[42,5,208,28,12,106,204,3,38,58,132,9,185,97,126,2]},{"ifindex":0,"family":10,"address":[38,32,0,82,0,3,0,1,222,173,190,239,202,254,254,215]},{"ifindex":0,"family":10,"address":[38,5,188,128,48,16,6,0,222,173,190,239,202,254,254,217]},{"ifindex":0,"family":10,"address":[38,4,21,128,254,0,0,0,222,173,190,239,202,254,254,209]},{"ifindex":0,"family":10,"address":[38,32,0,82,0,3,0,1,222,173,190,239,202,254,254,214]},{"ifindex":0,"family":10,"address":[38,16,0,40,48,144,48,1,222,173,190,239,202,254,254,211]},{"ifindex":0,"family":10,"address":[32,1,65,120,0,2,18,105,0,0,0,0,0,0,254,210]}],"name":"wildcard.fedoraproject.org","flags":1}} src/shared/varlink.c:240: n/a: varlink: changing state calling → called src/shared/varlink.c:240: n/a: varlink: changing state called → idle-client src/nss-resolve/nss-resolve.c:84: (string):1:40: JSON field 'ifindex' is out of bounds for an interface index.
* nss-resolve: varlink_call() set error_id only when r >= 0Yu Watanabe2020-12-071-11/+14
| | | | Fixes #17870.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-092-2/+2
|
* nss-resolve: port over to new varlink interfaceLennart Poettering2020-08-261-252/+276
|
* nss-resolve: treat BUS_ERROR_NO_SUCH_UNIT the same as ↵Zbigniew Jędrzejewski-Szmek2020-08-241-6/+8
| | | | | | SD_BUS_ERROR_SERVICE_UNKNOWN too Seems safer to do so.
* shared: actually move all BusLocator related calls to bus-locator.cLennart Poettering2020-06-301-1/+1
|
* nss-resolve: switch to BusLocator-oriented helpersVito Caputo2020-05-071-21/+4
| | | | Mechanical substitution reducing some verbosity
* tree-wide: drop string.h when string-util.h or friends are includedYu Watanabe2019-11-031-1/+0
|
* codespell: fix spelling errorsBen Boeckel2019-04-291-1/+1
|
* nss-resolve: list more errors as cause for fallbackLennart Poettering2019-04-111-1/+3
| | | | | | If dbus-daemon kicks us from the bus or hangs, we should fallback too. Fixes: #12203
* nss-resolve: simplify conditionLennart Poettering2019-04-111-6/+3
| | | | | Of course, if the error is NXDOMAIN then it's not one of the errors listed for fallback, hence don't bother...
* nss-resolve: resue a jump targetLennart Poettering2019-04-111-4/+2
| | | | We can reuse "fail" here, since it does the same thing.
* nss-resolve: return error properlyLennart Poettering2019-04-111-1/+1
|
* nss-resolve: drop unnecessary variableLennart Poettering2019-04-111-6/+3
| | | | | We assign the same value to "ret" always, let's just return the value literally.
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+2
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* util: split out errno related stuffLennart Poettering2019-03-141-2/+2
|
* nss: unportect errno before writing to NSS' *errnopLennart Poettering2019-02-081-0/+8
| | | | Fixes: #11321
* Revert "nss: prevent PROTECT_ERRNO from squashing changes to *errnop"Zbigniew Jędrzejewski-Szmek2019-01-101-8/+8
| | | | | | | This reverts commit b26c90411343d74b15deb24bd87077848e316dab. I don't see anythign wrong, but Ubuntu autopkgtest CI started failing fairly consistently since this was merged. Let's see if reverting fixes things.
* nss: prevent PROTECT_ERRNO from squashing changes to *errnopSam Morris2019-01-101-8/+8
| | | | | | | glibc passes in &errno for errnop, which means PROTECT_ERRNO ends up squashing our intentional changes to *errnop. Fixes #11321.
* Merge pull request #9504 from poettering/nss-deadlockZbigniew Jędrzejewski-Szmek2018-07-261-0/+29
|\ | | | | some nss deadlock love
| * nss: never become IPC clients for services that are about to be startedLennart Poettering2018-07-201-0/+29
| | | | | | | | | | | | | | This is an attempt to automatically detect and avoid certain kinds of NSS deadlocks as discussed in this thread: https://lists.freedesktop.org/archives/systemd-devel/2018-July/040975.html
* | nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESSYu Watanabe2018-07-251-48/+39
|/ | | | | | | | | This also adds PROTECT_ERRNO for all nss module functions. C.f. glibc NSS documents https://www.gnu.org/software/libc/manual/html_node/NSS-Modules-Interface.html and discussion in https://sourceware.org/bugzilla/show_bug.cgi?id=23410. Fixes #9585.
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-3/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-142-4/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* resolve: Adjust and unify D-Bus call timeout (#7847)ott2018-01-231-5/+4
| | | | | | | | | | | | | | DNS queries have a timeout of DNS_TRANSACTION_ATTEMPTS_MAX * DNS_TIMEOUT_MAX_USEC = 120 s. Calls to the ResolveHostname method of the org.freedesktop.resolve1.Manager interface have various call timeouts that are smaller than 120 s. So it seems correct to adjust the call timeout to the maximum query timeout and to unify the call timeout among all callers. A timeout of 120 s might seem large, in particular since BIND does seem to have a query timeout of 10 s. However, it seems match the timeout value of 120 s of Unbound. Moreover, the query and timeout handling of resolve have problems and might be improved in the future, so this change is at best an interim solution.
* Add SPDX license headers to various assorted filesZbigniew Jędrzejewski-Szmek2017-11-191-0/+2
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 07:45:30 +0100