summaryrefslogtreecommitdiffstats
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* cgroup: Simplify cg_get_path_and_checkMichal Koutný2021-02-111-34/+22
| | | | | | The function controller_is_accessible() doesn't do really much in case of the unified hierarchy. Move common parts into cg_get_path_and_check and make controller check v1 specific. This is refactoring only.
* Merge pull request #18545 from poettering/netlink-seqno-fixZbigniew Jędrzejewski-Szmek2021-02-112-38/+62
|\ | | | | sd-netlink seqnum fixes
| * sd-netlink: spread out sequence numbers a bitLennart Poettering2021-02-101-5/+23
| | | | | | | | | | | | | | | | An (imperfect) fix for #14760. This makes collisions unlikely, but still theoretically possible. Fixes: #14760
| * sd-netlink: reduce indentation levels a bitLennart Poettering2021-02-101-12/+11
| |
| * sd-netlink: use getsockopt_int() where appropriateLennart Poettering2021-02-101-5/+2
| |
| * sd-netlink: revamp message serial handlingLennart Poettering2021-02-102-16/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's use uint32_t everywhere to maintain the seqno, since that's what the kernel does. Prviously in the reply_callback logic we used 64bit, for no apparent reason. Using 32bit also provides us with the benefit that we can avoid using uint64_hash_ops, and can use trivial_hash_ops instead for the reply hashmap, so that we can store the seqno in the key pointer directly. While we are at it, let's make sure we never run into serial collisions internally (32bit is a lot, but not that much), and let's put a limit on outstanding serials, to catch programming errors.
* | networkd: add UseFQDN option for DHCPv6Vinnie Magro2021-02-114-0/+23
| | | | | | | | | | | | Similar to DHCPv4's UseHostname option, add a UseFQDN config option in [DHCPv6] to set the system's transient hostname if the FQDN option is set in the DHCPv6 response from the server.
* | Merge pull request #17823 from poettering/resolved-just-bypassZbigniew Jędrzejewski-Szmek2021-02-1124-632/+1681
|\ \ | |/ |/| resolved: just the dnssec bypass logic
| * resolved: drop timestamp parameter to dns_cache_put() we don't ever passLennart Poettering2021-02-094-6/+3
| |
| * resolved: avoid NOTIMP error when looking up not supported requestsLennart Poettering2021-02-091-2/+2
| | | | | | | | | | | | | | | | | | Some folks argue that NOTIMP should only be returned if a specific QTYPE is not supported. While I don#t think the RFCs are too clear about that, let's use REFUSED instead, which appears to be a less controversial choice of error code. Prompted-by: #17218
| * resolved: add support for answering DNSSEC questions on the stubLennart Poettering2021-02-0916-363/+1151
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This substantially beefs up the local DNS stub feature set in order to allow local clients to do DNSSEC validation through the stub. Previously we'd return NOTIMP if we'd get a DO or DO+CD lookup. With this change we'll instead: 1. If we get DO+CD requests (i.e. DNSSEC with no local checking) we'll proxy DNS queries and response mostly unmodified to/from upstream DNS servers if possible (this is called "bypass" mode). We will patch in new request IDs, (and patch them back out on reply), so that we can sanely keep track of things. We'll also maintain a minimal local cache for such lookups, always keeping the whole DNS packets in it (if we reply from cache we'll patch the TTLs of all included RRs). 2. If we get DO requests without CD (i.e. DNSSEC with local checking) we'll resolve and validate locally. In this mode we will not proxy packets, but generate our own. We will however cache the combination of answer RRs (along with their packet section assignments) we got back in the cache, and use this information to generate reply packets from the DNS stub. In both cases: if we determine a lookup is to be answered from LLMNR or mDNS we'll always revert to non-DNSSEC, non-proxy operation as before. Answers will lack the DO bit then, since the data cannot be validated via DNSSEC by the clients. To make this logic more debuggable, this also adds query flags for turning off RR sources. i.e. cache/network/zone/trust anchor/local synthesis may now be disabled individually for each lookup. The cache is substantially updated to make all this work: in addition to caching simple RRs for lookup RR keys, we'll now cache the whole packets and the whole combination of RRs, so that we can answer DO and DO+CD replies sensibly according to the rules described above. This sounds wasteful, but given that the DnsResourceRecord/DnsResourceKey/DnsAnswer/DnsPacket objects are all ref-counted and we try to merge references the actual additional memory used should be limited (but this might be something to optimize further later on). To implement classic RR key lookups and new-style packet proxy lookups (i.e. the ones necessary for DO+CD packet proxying, as described above) DnsTransaction and DnsQuery objects now always maintain either a DnsResourceKey/DnsQuestion as lookup key or a DnsPacket for "bypass" mode. Fixes: #4621 #17218
| * resolved: DNS_CLASS_ANY lookups are OK tooLennart Poettering2021-02-091-6/+4
| |
| * resolved: if dns_packet_append_answer() fails count how many RRs were ↵Lennart Poettering2021-02-094-9/+11
| | | | | | | | | | | | | | | | | | successfully added This is useful later when handling the truncation case: if we can't add all RRs we'd like to add we need to set the TC bit, but still report the number of RRs we added (and not the number of RRs we would have liked to add) to the packet.
| * resolved: add RRSIG field to DnsAnswerItemLennart Poettering2021-02-0911-59/+122
| |
| * resolved: add new DnsAnswerFlags indicating originating section when parsingLennart Poettering2021-02-093-15/+30
| | | | | | | | | | | | | | | | | | | | Let's beef up our parser a bit: let's store in the DnsAnswerFlags field (that is stored as part of DnsAnswerItem) which DNS packet section (i.e. answer, authoritative, additional) an RR originates from. This is useful when propagating answers from an upstream DNS server eventually, as we can place the data in the right sections downstream too.
| * resolved: replace DNS_ANSWER_FOREACH_FULL() iterator macro with ↵Lennart Poettering2021-02-093-64/+57
| | | | | | | | | | | | | | | | | | | | DNS_ANSWER_FOREACH_ITEM() The more fields DnsAnswerItem gains the less sense it makes to pass every field of it as separate parameter to an iterator macro. Let's simplify things here, in preparation of adding more fields to the structure later on: let's just return the structure itself in the loop, rather than the individual fields.
| * resolved: slight modernizations of resolved-dns-answer.c functionsLennart Poettering2021-02-092-12/+34
| | | | | | | | | | Let's follow our own coding style an initialized return values on all cases of "success".
| * resolved: add dns_answer_contains() helperLennart Poettering2021-02-092-0/+11
| |
| * resolved: add logic for patching TTLs of full packetsLennart Poettering2021-02-092-31/+131
| |
| * resolved: add logic for patching OPT max udp size of existing packetLennart Poettering2021-02-092-1/+21
| |
| * resolved: introduce dns_transaction_key() helper for getting RR key for ↵Lennart Poettering2021-02-092-79/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | transaction This is a simple search&replace excercise: instead of accessing the "key" field of the transaction directly, let's use a small inline helper that does this for us. This appears pointless for now, but this will become useful later when we introduce "bypass" transactions, that reuse the original client DNS packet for queries instead of synthesizing a packet of our own. In that case transactions either have regular "key" field initialized as before, or the "bypass" packet field instead. The new dns_transaction_key() helper allows us to hide the differences for most cases as we can later teach it to access the "bypass" packet's question key transparently. No change in behaviour.
| * resolved: add helper dns_packet_dup() for duplicating packetsLennart Poettering2021-02-092-0/+34
| |
* | tmpfiles: explicitly say we need /proc/ to runLennart Poettering2021-02-101-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I don't think it's realistic to operate without /proc/. Hence, let's make this explicit. If one day someone finds a way to do what we need without /proc/ we can certainly drop this check again, but for now I think it's a lot friendlier to users to make this explicitly early on instead continuing to run and then not do what we need to do, oftentimes failing in cryptic ways. After all, invoking the tool without /proc/ is not an error that was specific to some of the lines we process, but it's systematic error that will show its ugly face in many codepaths down the line. Fixes: #14745
* | network: use SD_BUS_METHOD_WITH_ARGS() macroYu Watanabe2021-02-102-34/+170
| |
* | core: improve log message when unit deactivates cleanlyLennart Poettering2021-02-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever a unit deactivates sucessfully we so far generated a message "unit xyz: succeeded". This is a bit confusing, since various unit types cannot really "succeed", e.g. a device unit can't really "suceed", not can a swap unit. In particular in the latter case people would probably assume that a swap unit that "suceeded" would actually mean a swap was active now, but the opposite is actually true. Let's improve this by saying "Deactivated successfully", which hopefully clears this up. (I thought about saying "terminated" or "completed" or "finished" or so instead, but that too doesn#t make sense if you think about unit types like swaps or devices.)
* | Merge pull request #18440 from bluca/portable_upgradeLennart Poettering2021-02-108-28/+372
|\ \ | | | | | | portable: add 'reattach' verb and DBUS interface
| * | portable: add 'reattach' verb and DBUS interfaceLuca Boccassi2021-02-108-24/+360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add 'reattach' verb to portablectl, and corresponding DBUS interface to systemd-portabled. Takes the same parameters as 'attach', but it will do a 'detach' (and it will refuse to proceed if it cannot be done) first, matching on the unversioned prefix of the new image. Eg: portablectl reattach /tmp/foo_2.raw will cause foo_1.raw to be detached, and foo_2.raw to be attached. The key difference with a manual 'detach old' plus 'attach new' is that the running units are not disturbed until after the attach completed, and if --now is passed they are then restarted. A 'detach' is not allowed normally if the units are running. By using a restart-after-deploy method, 'reattach' allows for minimal interruption of service and also for features that only work on restart (eg: file descriptor store) to work as intended. The DBUS interface returns two lists: first the removals from the detach that were not immediately re-added in the attach, so that the caller can stop the relevant units, and then the list of additions that are either new or updates, so that the caller can restart/enable the relevant units. portablectl already implements this with the existing --now/--enable switches.
| * | portable: allow Detach to match images with different version suffixesLuca Boccassi2021-02-101-4/+12
| | |
* | | tmpfiles: v/q/Q: Add env var to skip check for rootfs in subvolumeAdrian Vovk2021-02-101-2/+8
|/ /
* | Merge pull request #18536 from poettering/uid-refs-simplifyYu Watanabe2021-02-102-37/+23
|\ \ | | | | | | dynamic uid/gid reference handling simplifications
| * | core: fix manager_ref_gid() parameter name in headerLennart Poettering2021-02-101-1/+1
| | | | | | | | | | | | It should match what we do for manager_ref_uid() and in the .c file.
| * | manager: simplify uid-ref/gid-ref a code a bitLennart Poettering2021-02-101-36/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | Let's drop unused function arguments, and needless double pointers where we can. no actual change in behaviour, just simplifications (I tried to track down #14026 without success, and this came out of it)
* | | Merge pull request #11484 from keszybz/udevadm-error-logsYu Watanabe2021-02-10179-460/+471
|\ \ \ | | | | | | | | Use real return codes in _from_string() functions
| * | | test-string-util: add missing commaZbigniew Jędrzejewski-Szmek2021-02-101-1/+1
| | | | | | | | | | | | | | | | Coverity CID#1446368.
| * | | resolved: rework a few functions to return early on errorZbigniew Jędrzejewski-Szmek2021-02-101-67/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The implementation is a bit ugly because we set the output variable twice. But we were already doing this on error, so this is not significantly worse. Doing this allows us to avoid goto's, and the compiler should be able to figure this out and only set once.
| * | | machinectl: write arg_* only after verifying the valueZbigniew Jędrzejewski-Szmek2021-02-101-12/+12
| | | |
| * | | tree-wide: propagate error code from _from_string() functionsZbigniew Jędrzejewski-Szmek2021-02-1027-81/+62
| | | | | | | | | | | | | | | | Now that we know we have something useful, no need to make an answer up.
| * | | Return -EINVAL from _from_string() functionsZbigniew Jędrzejewski-Szmek2021-02-105-18/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We'd return -1 (-EPERM), even though we have a general rule to use real errno values. The particular case that caught my attention was: $ sudo udevadm control -l asdf Failed to parse log priority 'asdf': Operation not permitted ... but "git grep 'r =.*_from_string' src/" return 110 hits. Confusingly, some of the _from_string functions already return a proper errno value, so not all of those are broken, but probably quite a few.
| * | | tree-wide: use -EINVAL for enum invalid valuesZbigniew Jędrzejewski-Szmek2021-02-10139-245/+255
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As suggested in https://github.com/systemd/systemd/pull/11484#issuecomment-775288617. This does not touch anything exposed in src/systemd. Changing the defines there would be a compatibility break. Note that tests are broken after this commit. They will be fixed in the next one.
| * | | udev: make sure UdevBuiltinCommand is properly convertedZbigniew Jędrzejewski-Szmek2021-02-103-2/+44
| | | |
| * | | sd-bus: drop some bitfields in sd_bus_slotZbigniew Jędrzejewski-Szmek2021-02-101-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A hole was/is present after the booleans, so changing them to be one byte each doesn't change the structure size (122 bits on amd64). If we add more stuff later, it might make sense to turn some of those into bitfields again. For now, let's take the easy route. EINVAL fits into type now. Code size it minimally reduced: -rwxrwxr-x 1 zbyszek zbyszek 4109792 Feb 10 14:00 build/libsystemd.so.0.30.0 -rwxrwxr-x 1 zbyszek zbyszek 4109712 Feb 10 14:01 build/libsystemd.so.0.30.0
| * | | sd-netlink: pahole optimization of sd_netlink_slotZbigniew Jędrzejewski-Szmek2021-02-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By rearranging the fields, we can avoid one of the holes (on amd64). By adding more space for .type, -EINVAL can be used as a value later on. The structure is reduced from 96 to 88 bytes (on amd64). Text size is also smaller: -rwxrwxr-x 1 zbyszek zbyszek 4109832 Feb 9 19:50 build/libsystemd.so.0.30.0 -rwxrwxr-x 1 zbyszek zbyszek 4109792 Feb 9 19:51 build/libsystemd.so.0.30.0
| * | | shared/json: make JsonVariant.type field widerZbigniew Jędrzejewski-Szmek2021-02-101-4/+4
| | | | | | | | | | | | | | | | | | | | pahole shows that this doesn't make a difference, but we can fit -EINVAL into .type without warnings.
| * | | sd-event: drop one bitfield from sd_event_sourceZbigniew Jędrzejewski-Szmek2021-02-101-1/+1
| | | | | | | | | | | | | | | | | | | | pahole analysis confirms that the structure size does not change (there was/is a hole after the sequence of bitfields anyway).
| * | | core: drop bitfields in Manager objectZbigniew Jędrzejewski-Szmek2021-02-101-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Every bitfield may make the object a little smaller, but requires additional code when accessing the field. So it only makes sense in objects that are created in many many copies. The Manager is pretty much a singleton. -rwxrwxr-x 1 zbyszek zbyszek 4443840 Feb 9 16:14 build/systemd -rwxrwxr-x 1 zbyszek zbyszek 4442552 Feb 9 16:42 build/systemd We save 1288 bytes of code by "wasting" a few bytes on storage. (The speed advantages are probably more important, but harder to measure…)
| * | | Add comma in structured initialization in a few placesZbigniew Jędrzejewski-Szmek2021-02-103-3/+3
| | | | | | | | | | | | | | | | It just looks nicer…
| * | | core: do not initialize variable which is unconditionally set belowZbigniew Jędrzejewski-Szmek2021-02-102-2/+2
| | | |
| * | | test-tables: make the assert more readableZbigniew Jędrzejewski-Szmek2021-02-101-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | Doing it all in one line and with negation in front seemed like a good idea at some point, but I think it is vastly easier to understand when it is split out a bit.
| * | | test-tables: fix warning about NULL used in printfZbigniew Jędrzejewski-Szmek2021-02-101-1/+1
| | | | | | | | | | | | | | | | | | | | With the simplified asserts, newer gcc is able to (correctly) figure out that NULL was being passed.
* | | | Merge pull request #18506 from keszybz/fuzz-systemctl-parse-argvYu Watanabe2021-02-109-23/+96
|\ \ \ \ | | | | | | | | | | Fuzzer for systemctl argline parsing
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 12:20:25 +0100