Lennart Poettering [Fri, 8 Jan 2016 17:50:41 +0000 (18:50 +0100)]
resolved: rework server feature level logic
This changes the DnsServer logic to count failed UDP and TCP failures separately. This is useful so that we don't end
up downgrading the feature level from one UDP level to a lower UDP level just because a TCP connection we did because
of a TC response failed.
This also adds accounting of truncated packets. If we detect incoming truncated packets, and count too many failed TCP
connections (which is the normal fall back if we get a trucnated UDP packet) we downgrade the feature level, given that
the responses at the current levels don't get through, and we somehow need to make sure they become smaller, which they
will do if we don't request DNSSEC or EDNS support.
This makes resolved work much better with crappy DNS servers that do not implement TCP and only limited UDP packet
sizes, but otherwise support DNSSEC RRs. They end up choking on the generally larger DNSSEC RRs and there's no way to
retrieve the full data.
Lennart Poettering [Fri, 8 Jan 2016 17:50:15 +0000 (18:50 +0100)]
resolved: add missing case to switch statement
Lennart Poettering [Fri, 8 Jan 2016 16:18:54 +0000 (17:18 +0100)]
resolved: log why we use TCP when UDP isn't supported by a server
Lennart Poettering [Fri, 8 Jan 2016 16:16:32 +0000 (17:16 +0100)]
resolved: log about truncated replies before trying again, not after
Lennart Poettering [Fri, 8 Jan 2016 16:10:49 +0000 (17:10 +0100)]
resolved: don't attempt to send queries for DNSSEC RR types to servers not supporting them
If we already degraded the feature level below DO don't bother with sending requests for DS, DNSKEY, RRSIG, NSEC, NSEC3
or NSEC3PARAM RRs. After all, we cannot do DNSSEC validation then anyway, and we better not press a legacy server like
this with such modern concepts.
This also has the benefit that when we try to validate a response we received using DNSSEC, and we detect a limited
server support level while doing so, all further auxiliary DNSSEC queries will fail right-away.
Lennart Poettering [Fri, 8 Jan 2016 15:17:43 +0000 (16:17 +0100)]
resolved: log about reasons for switching to TCP
Lennart Poettering [Fri, 8 Jan 2016 01:46:59 +0000 (02:46 +0100)]
resolved: when we get a packet failure from a server, don't downgrade UDP to TCP or vice versa
Under the assumption that packet failures (i.e. FORMERR, SERVFAIL, NOTIMP) are caused by packet contents, not used
transport, we shouldn't switch between UDP and TCP when we get them, but only downgrade the higher levels down to UDP.
Lennart Poettering [Fri, 8 Jan 2016 01:38:00 +0000 (02:38 +0100)]
resolved: properly handle UDP ICMP errors as lost packets
UDP ICMP errors are reported to us via recvmsg() when we read a reply. Handle this properly, and consider this a lost
packet, and retry the connection.
This also adds some additional logging for invalid incoming packets.
Lennart Poettering [Fri, 8 Jan 2016 01:33:54 +0000 (02:33 +0100)]
resolved: when we get a TCP connection failure, try again
Previously, when we couldn't connect to a DNS server via TCP we'd abort the whole transaction using a
"connection-failure" state. This change removes that, and counts failed connections as "lost packet" events, so that
we switch back to the UDP protocol again.
Lennart Poettering [Fri, 8 Jan 2016 01:29:02 +0000 (02:29 +0100)]
resolved: when DNS/TCP doesn't work, try DNS/UDP again
If we failed to contact a DNS server via TCP, bump of the feature level to UDP again. This way we'll switch back
between UDP and TCP if we fail to contact a host.
Generally, we prefer UDP over TCP, which is why UDP is a higher feature level. But some servers only support UDP but
not TCP hence when reaching the lowest feature level of TCP and want to downgrade from there, pick UDP again. We this
keep downgrading until we reach TCP and then we cycle through UDP and TCP.
Lennart Poettering [Fri, 8 Jan 2016 01:26:53 +0000 (02:26 +0100)]
resolved: introduce dns_transaction_retry() and use it everywhere
The code to retry transactions has been used over and over again, simplify it by replacing it by a new function.
Lennart Poettering [Fri, 8 Jan 2016 01:20:39 +0000 (02:20 +0100)]
resolved: set a description on all our event sources
Lennart Poettering [Fri, 8 Jan 2016 01:19:43 +0000 (02:19 +0100)]
resolved: fix error propagation
Lennart Poettering [Fri, 8 Jan 2016 00:11:55 +0000 (01:11 +0100)]
shared: make sure foo.bar and foobar result in different domain name hashes
This also introduces a new macro siphash24_compress_byte() which is useful to add a single byte into the hash stream,
and ports one user over to it.
Lennart Poettering [Fri, 8 Jan 2016 00:10:45 +0000 (01:10 +0100)]
basic: split hash functions into their own header files
The hash operations are not really that specific to hashmaps, hence split them into a .c module of their own.
Lennart Poettering [Thu, 7 Jan 2016 23:24:06 +0000 (00:24 +0100)]
editors: specify fill column
Let's be a bit more precise with the editor configuration and specify a higher fill column of 119. This isn't as emacs'
default of 70, but also not particularly high on today's screens.
While we are at it, also set a couple of other emacs C coding style variables.
Lennart Poettering [Thu, 7 Jan 2016 21:27:33 +0000 (22:27 +0100)]
resolved: properly look for NSEC/NSEC3 RRs when getting a positive wildcard response
This implements RFC 5155, Section 8.8 and RFC 4035, Section 5.3.4:
When we receive a response with an RRset generated from a wildcard we
need to look for one NSEC/NSEC3 RR that proves that there's no explicit RR
around before we accept the wildcard RRset as response.
This patch does a couple of things: the validation calls will now
identify wildcard signatures for us, and let us know the RRSIG used (so
that the RRSIG's signer field let's us know what the wildcard was that
generate the entry). Moreover, when iterating trough the RRsets of a
response we now employ three phases instead of just two.
a) in the first phase we only look for DNSKEYs RRs
b) in the second phase we only look for NSEC RRs
c) in the third phase we look for all kinds of RRs
Phase a) is necessary, since DNSKEYs "unlock" more signatures for us,
hence we shouldn't assume a key is missing until all DNSKEY RRs have
been processed.
Phase b) is necessary since NSECs need to be validated before we can
validate wildcard RRs due to the logic explained above.
Phase c) validates everything else. This phase also handles RRsets that
cannot be fully validated and removes them or lets the transaction fail.
Lennart Poettering [Thu, 7 Jan 2016 21:22:41 +0000 (22:22 +0100)]
resolved: split up nsec3_hashed_domain() into two calls
There's now nsec3_hashed_domain_format() and nsec3_hashed_domain_make().
The former takes a hash value and formats it as domain, the latter takes
a domain name, hashes it and then invokes nsec3_hashed_domain_format().
This way we can reuse more code, as the formatting logic can be unified
between this call and another place.
Lennart Poettering [Thu, 7 Jan 2016 21:19:12 +0000 (22:19 +0100)]
resolved: drop flags unused parameter from nsec3_is_good
Lennart Poettering [Thu, 7 Jan 2016 19:33:31 +0000 (20:33 +0100)]
resolved: when validating, first strip revoked trust anchor keys from validated keys list
When validating a transaction we initially collect DNSKEY, DS, SOA RRs
in the "validated_keys" list, that we need for the proofs. This includes
DNSKEY and DS data from our trust anchor database. Quite possibly we
learn that some of these DNSKEY/DS RRs have been revoked between the
time we request and collect those additional RRs and we begin the
validation step. In this case we need to make sure that the respective
DS/DNSKEY RRs are removed again from our list. This patch adds that, and
strips known revoked trust anchor RRs from the validated list before we
begin the actual validation proof, and each time we add more DNSKEY
material to it while we are doing the proof.
Lennart Poettering [Thu, 7 Jan 2016 19:07:44 +0000 (20:07 +0100)]
shared: simplify dns_name_hash_func() end of name detection
Lennart Poettering [Thu, 7 Jan 2016 18:43:56 +0000 (19:43 +0100)]
resolved: make sure domain name hash function deals nicely with NUL embedded in labels
Lennart Poettering [Thu, 7 Jan 2016 18:43:26 +0000 (19:43 +0100)]
basic: introduce generic ascii_strlower_n() call and make use of it everywhere
Lennart Poettering [Thu, 7 Jan 2016 16:03:31 +0000 (17:03 +0100)]
resolved: rework trust anchor revoke checking
Instead of first iterating through all DNSKEYs in the DnsAnswer in
dns_transaction_check_revoked_trust_anchors(), and
then doing that a second time in dns_trust_anchor_check_revoked(), do so
only once in the former, and pass the dnskey we found directly to the
latter.
Lennart Poettering [Thu, 7 Jan 2016 11:56:38 +0000 (12:56 +0100)]
resolved: look for revoked trust anchors before validating a message
There's not reason to wait for checking for revoked trust anchors until
after validation, after all revoked DNSKEYs only need to be self-signed,
but not have a full trust chain.
This way, we can be sure that all trust anchor lookups we do during
validation already honour that some keys might have been revoked.
Lennart Poettering [Thu, 7 Jan 2016 11:47:07 +0000 (12:47 +0100)]
resolved: use dns_answer_size() where appropriate to handle NULL DnsAnswer
Lennart Poettering [Thu, 7 Jan 2016 11:45:38 +0000 (12:45 +0100)]
resolved: remove one level of indentation in dns_transaction_validate_dnssec()
Invert an "if" check, so that we can use "continue" rather than another
code block indentation.
Lennart Poettering [Thu, 7 Jan 2016 11:42:48 +0000 (12:42 +0100)]
resolved: be less strict where the OPT pseudo-RR is placed
This increases compatibility with crappy Belkin routers.
Lennart Poettering [Thu, 7 Jan 2016 11:40:59 +0000 (12:40 +0100)]
resolved: rename suffix_rr → zone_rr
The domain name for this NSEC3 RR was originally stored in a variable
called "suffix", which was then renamed to "zone" in
d1511b3338f431de3c95a50a9c1aca297e0c0734. Hence also rename the
RR variable accordingly.
Lennart Poettering [Thu, 7 Jan 2016 00:21:00 +0000 (01:21 +0100)]
resolved: fix NSEC3 iterations limit to what RFC5155 suggests
Lennart Poettering [Mon, 11 Jan 2016 16:30:15 +0000 (17:30 +0100)]
Merge pull request #2262 from pohly/smack-network
smack: Handling network
Lennart Poettering [Mon, 11 Jan 2016 16:26:30 +0000 (17:26 +0100)]
Merge pull request #2301 from martinpitt/kmod-static-condition
kmod-static-nodes: don't run if module list is empty
Daniel Mack [Mon, 11 Jan 2016 15:56:22 +0000 (16:56 +0100)]
Merge pull request #2302 from arthur-c/master
doc typo, src: systemd/src/journal-remote/journal-gatewayd.c
Lennart Poettering [Mon, 11 Jan 2016 15:45:26 +0000 (16:45 +0100)]
Merge pull request #2294 from zonque/in_set
macro.h: improve IN_SET helper macro
Arthur Clement [Mon, 11 Jan 2016 15:38:35 +0000 (16:38 +0100)]
doc typo, src: systemd/src/journal-remote/journal-gatewayd.c
Martin Pitt [Mon, 11 Jan 2016 15:26:17 +0000 (16:26 +0100)]
kmod-static-nodes: don't run if module list is empty
With this kmod commit, modules.devname will be empty by default instead of
containing just a comment:
https://git.kernel.org/cgit/utils/kernel/kmod/kmod.git/commit/?id=
4c30a11d5f
Refine the startup condition of kmod-static-nodes.service to not run needlessly
if the list is empty.
Tom Gundersen [Mon, 11 Jan 2016 12:17:15 +0000 (13:17 +0100)]
Merge pull request #2293 from zonque/issue-2292
sd-netlink: fix assert
Daniel Mack [Mon, 11 Jan 2016 12:13:25 +0000 (13:13 +0100)]
Merge pull request #2296 from dankor/master
Updated Ukrainian translation
Daniel Korostil [Mon, 11 Jan 2016 11:55:48 +0000 (13:55 +0200)]
Updated Ukrainian translation
Daniel Mack [Sun, 10 Jan 2016 17:11:22 +0000 (18:11 +0100)]
macro.h: provide a switch-case statement generator for IN_SET
Rather than walking a list of valid values one-by-one, generate a
switch-case statement for the IN_SET() macro. This allows the compiler to
further optimize its code output, possibly by generating jump tables.
This effectively decreases the binary size slightly.
The implementation is based on macro overloading depending on the number of
arguments. h/t to the following post:
https://stackoverflow.com/questions/
11761703/overloading-macro-on-number-of-arguments
Casey Schaufler [Fri, 8 Nov 2013 17:42:26 +0000 (09:42 -0800)]
smack: Handling network
- Set Smack ambient to match run label
- Set Smack netlabel host rules
Set Smack ambient to match run label
------------------------------------
Set the Smack networking ambient label to match the
run label of systemd. System services may expect to
communicate with external services over IP. Setting
the ambient label assigns that label to IP packets
that do not include CIPSO headers. This allows systemd
and the services it spawns access to unlabeled IP
packets, and hence external services.
A system may choose to restrict network access to
particular services later in the startup process.
This is easily done by resetting the ambient label
elsewhere.
Set Smack netlabel host rules
-----------------------------
If SMACK_RUN_LABEL is defined set all other hosts to be
single label hosts at the specified label. Set the loopback
address to be a CIPSO host.
If any netlabel host rules are defined in /etc/smack/netlabel.d
install them into the smackfs netlabel interface.
[Patrick Ohly: copied from https://review.tizen.org/git/?p=platform/upstream/systemd.git;a=commit;h=
db4f6c9a074644aa2bf]
[Patrick Ohly: adapt to write_string_file() change in "fileio: consolidate write_string_file*()"]
[Patrick Ohly: create write_netlabel_rules() based on the original write_rules() that was removed in "smack: support smack access change-rule"]
[Patrick Ohly: adapted to upstream code review feedback: error logging, string constants]
Daniel Mack [Sun, 10 Jan 2016 17:10:08 +0000 (18:10 +0100)]
tree-wide: unify argument lists of IN_SET()
The new implementation will not allow passing the same values more than
once, so clean up first.
Daniel Mack [Sun, 10 Jan 2016 14:36:03 +0000 (15:36 +0100)]
sd-netlink: fix assert
nl->fd can be 0.
Daniel Mack [Fri, 8 Jan 2016 08:25:21 +0000 (09:25 +0100)]
Merge pull request #2287 from dandedrick/journal-gatewayd-timeout-fix
journal-gatewayd: timeout journal wait to allow thread cleanup
Daniel Mack [Thu, 7 Jan 2016 16:40:42 +0000 (17:40 +0100)]
Merge pull request #2285 from evverx/fix-test-resolve
tests: test-resolve: wait until all queries are completed
Lennart Poettering [Thu, 7 Jan 2016 15:13:14 +0000 (16:13 +0100)]
Merge pull request #2284 from teg/resolved-cname-2
resolved: query_process_cname - make fully recursive
Evgeny Vereshchagin [Thu, 7 Jan 2016 14:03:05 +0000 (14:03 +0000)]
tests: test-resolve: wait until all queries are completed
This is a follow-up for
4a134c4903dbf6ef6c6a
Fixes:
$ ./test-resolve
209.132.183.105:80
209.132.183.105:80
canonical name: n/a
193.99.144.85:0
[2a02:2e0:3fe:1001:7777:772e:2:85]:0
canonical name: www.heise.de
Host: web.heise.de -- Serv: http
$ ./test-resolve
193.99.144.85:0
[2a02:2e0:3fe:1001:7777:772e:2:85]:0
canonical name: www.heise.de
Host: web.heise.de -- Serv: http
$ ./test-resolve
...
Tom Gundersen [Thu, 7 Jan 2016 14:05:58 +0000 (15:05 +0100)]
Merge pull request #2276 from poettering/dnssec12
Twelfth DNSSEC PR
Tom Gundersen [Tue, 5 Jan 2016 16:56:45 +0000 (17:56 +0100)]
resolved: query_process_cname - make fully recursive
This ensures we properly resolve the CNAME chain as far as we can, rather
than only CNAME chains of length one.
Daniel Mack [Thu, 7 Jan 2016 11:02:38 +0000 (12:02 +0100)]
Merge pull request #2283 from evverx/update-valgrind-tests
build-sys: valgrind-tests: exclude python scripts too
Evgeny Vereshchagin [Thu, 7 Jan 2016 10:01:45 +0000 (10:01 +0000)]
build-sys: valgrind-tests: exclude python scripts too
Lennart Poettering [Wed, 6 Jan 2016 17:39:08 +0000 (18:39 +0100)]
update DNSSEC TODO
Lennart Poettering [Wed, 6 Jan 2016 17:36:32 +0000 (18:36 +0100)]
resolved: introduce support for per-interface negative trust anchors
Daniel Mack [Wed, 6 Jan 2016 13:56:14 +0000 (14:56 +0100)]
nspawn: fix two typos in error messages
On errors, mention the functions that really failed.
Daniel Mack [Wed, 6 Jan 2016 12:53:29 +0000 (13:53 +0100)]
Merge pull request #2137 from fbuihuu/fstab-gen-fix-device-timeout
Fstab gen fix device timeout
Daniel Mack [Wed, 6 Jan 2016 12:36:15 +0000 (13:36 +0100)]
Merge pull request #2261 from evverx/fix-test-rlimit-util
tests: don't change hard limit in test-rlimit-util
Daniel Mack [Wed, 6 Jan 2016 11:56:56 +0000 (12:56 +0100)]
Merge pull request #2243 from evverx/add-regression-test-for-journald-restart
tests: add regression test for `systemctl restart systemd-journald`
Daniel Mack [Wed, 6 Jan 2016 11:10:22 +0000 (12:10 +0100)]
Merge pull request #2273 from evverx/fix-possible-lost-in-test-bus-cleanup
tests: use sd_bus_flush_close_unref instead of sd_bus_unref in test-bus-cleanup
Daniel Mack [Wed, 6 Jan 2016 11:09:43 +0000 (12:09 +0100)]
Merge pull request #2278 from systemd-mailing-devs/
1452047873-6043-1-git-send-email-hui.wang@canonical.com
keymap: remap microphone mute keycode for Lenovo Thinkcentre M800z
Hui Wang [Wed, 6 Jan 2016 02:37:53 +0000 (10:37 +0800)]
keymap: remap microphone mute keycode for Lenovo Thinkcentre M800z
This Lenovo machine use codec Line2 to implement a microphone mute
button, it depends on the unsolicited interrupt to generate key event,
the scan code for this button is assigned to 0x00 in the linux kernel
driver, and the keycode is KEY_MICMUTE(248), we need to remap this
keycode to KEY_F20 to make this hotkey work in X11.
BugLink: https://bugs.launchpad.net/bugs/1531362
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Lennart Poettering [Wed, 6 Jan 2016 00:01:00 +0000 (01:01 +0100)]
resolved: when dumping the NTA database, sort output
Now that we populate the trust database by default with a larger number
of entires, we better make sure to output a more readable version.
Lennart Poettering [Tue, 5 Jan 2016 23:59:51 +0000 (00:59 +0100)]
resolved: populate negative trust anchor by default
Let's increase compatibility with many private domains by default, and
ship a default NTA list of wel-known private domains, where it is
unlikely they will be deployed as official TLD anytime soon.
Lennart Poettering [Tue, 5 Jan 2016 23:59:32 +0000 (00:59 +0100)]
resolved: log all OOM errors
Lennart Poettering [Tue, 5 Jan 2016 23:58:26 +0000 (00:58 +0100)]
resolved: reuse dns_trust_anchor_knows_domain() at another location
Lennart Poettering [Tue, 5 Jan 2016 23:57:21 +0000 (00:57 +0100)]
resolved: count unsupported dnssec algorithm as indeterminate RRset
After all, when we don't support the algorithm we cannot determine
validity.
Lennart Poettering [Tue, 5 Jan 2016 21:13:56 +0000 (22:13 +0100)]
resolved: try to detect fritz.box-style private DNS zones, and downgrade to non-DNSSEC mode for them
This adds logic to detect cases like the Fritz!Box routers which serve
a private DNS domain "fritz.box" under the TLD "box" that does not
exist in the root servers. If this is detected DNSSEC validation is
turned off for this private domain, thus improving compatibility with
such private DNS zones.
This should be fairly secure as we first rely on the proof that .box
does not exist before this logic is applied. Nevertheless the logic is
only enabled for DNSSEC=allow-downgrade mode.
This logic does not work for routers that set up a full DNS zone directly
under a non-existing TLD, as in that case we cannot prove
that the domain is truly non-existing according to the root servers.
Lennart Poettering [Tue, 5 Jan 2016 19:27:29 +0000 (20:27 +0100)]
resolved: when dumping trust anchor contents, clarify when it is empty
Lennart Poettering [Tue, 5 Jan 2016 19:26:35 +0000 (20:26 +0100)]
resolved: fix DNSSEC transaction dependency recursion check
We followed the wrong connection. This only worked sometimes at all, because we
also return the wrong error code.
Lennart Poettering [Tue, 5 Jan 2016 18:59:19 +0000 (19:59 +0100)]
update DNSSEC TODO
Lennart Poettering [Tue, 5 Jan 2016 18:57:33 +0000 (19:57 +0100)]
resolved,networkd: add a per-interface DNSSEC setting
This adds a DNSSEC= setting to .network files, and makes resolved honour
them.
Lennart Poettering [Tue, 5 Jan 2016 18:43:51 +0000 (19:43 +0100)]
resolved: log about per-interface setting parse errors
Lennart Poettering [Tue, 5 Jan 2016 18:42:34 +0000 (19:42 +0100)]
resolved: properly release all DnsServers that belong to a link
Lennart Poettering [Tue, 5 Jan 2016 16:44:16 +0000 (17:44 +0100)]
resolved: rename "downgrade-ok" mode to "allow-downgrade"
After discussing this with Tom, we figured out "allow-downgrade" sounds
nicer.
Lennart Poettering [Tue, 5 Jan 2016 16:40:51 +0000 (17:40 +0100)]
man: document that DNS= and Domains= is implemented by resolved
Lennart Poettering [Tue, 5 Jan 2016 16:37:09 +0000 (17:37 +0100)]
resolved: make MulticastDNS support configurable in resolved.conf
The option is already there, but wasn't exported in the configuration
file so far. Fix that.
Lennart Poettering [Tue, 5 Jan 2016 16:32:25 +0000 (17:32 +0100)]
networkd,resolved: add a per-interface mdns configuration option
Lennart Poettering [Tue, 5 Jan 2016 16:25:10 +0000 (17:25 +0100)]
resolved,networkd: unify ResolveSupport enum
networkd previously knew an enum "ResolveSupport" for configuring
per-interface LLMNR support, resolved had a similar enum just called
"Support", with the same value and similar pasers.
Unify this, call the enum ResolveSupport, and port both daemons to it.
Lennart Poettering [Tue, 5 Jan 2016 16:10:17 +0000 (17:10 +0100)]
basic: add string table macros for "extended boolean" enums
In a couple of cases we maintain configuration settings that know an on
and off state, like a boolean, plus some additional states. We generally
parse them as booleans first, and if that fails check for specific
additional values.
This adds a generalized set of macros for parsing such settings, and
ports one use in resolved and another in networkd over to it.
Lennart Poettering [Tue, 5 Jan 2016 15:43:07 +0000 (16:43 +0100)]
sd-network: unify parsing of /run/systemd/netif/links/* string fields
Lennart Poettering [Tue, 5 Jan 2016 15:42:40 +0000 (16:42 +0100)]
man: fix a few typos
Lennart Poettering [Tue, 5 Jan 2016 15:40:29 +0000 (16:40 +0100)]
Merge pull request #2272 from kinvolk/alban/typos
machine: fix typo: MS_MOUNT does not exist
Evgeny Vereshchagin [Tue, 5 Jan 2016 15:35:23 +0000 (15:35 +0000)]
tests: use sd_bus_flush_close_unref instead of sd_bus_unref in test-bus-cleanup
Fixes:
$ make valgrind-tests TESTS=test-bus-cleanup
==6363== 9 bytes in 1 blocks are possibly lost in loss record 1 of 28
==6363== at 0x4C2BBCF: malloc (vg_replace_malloc.c:299)
==6363== by 0x197D12: hexmem (hexdecoct.c:79)
==6363== by 0x183083: bus_socket_start_auth_client (bus-socket.c:639)
==6363== by 0x1832A0: bus_socket_start_auth (bus-socket.c:678)
==6363== by 0x183438: bus_socket_connect (bus-socket.c:705)
==6363== by 0x14B0F2: bus_start_address (sd-bus.c:1053)
==6363== by 0x14B592: sd_bus_start (sd-bus.c:1134)
==6363== by 0x14B95E: sd_bus_open_system (sd-bus.c:1235)
==6363== by 0x1127E2: test_bus_open (test-bus-cleanup.c:42)
==6363== by 0x112AAE: main (test-bus-cleanup.c:87)
==6363==
...
$ ./libtool --mode=execute valgrind ./test-bus-cleanup
==6584== LEAK SUMMARY:
...
==6584== possibly lost: 10,566 bytes in 27 blocks
Alban Crequy [Tue, 5 Jan 2016 15:07:33 +0000 (16:07 +0100)]
machine: fix typo: MS_MOUNT does not exist
Tom Gundersen [Tue, 5 Jan 2016 14:47:15 +0000 (15:47 +0100)]
Merge pull request #2269 from poettering/dnssec11
Eleventh DNSSEC patch set
Lennart Poettering [Tue, 5 Jan 2016 13:20:27 +0000 (14:20 +0100)]
man: add documentation for dnssec-trust-anchors.d(5)
Lennart Poettering [Tue, 5 Jan 2016 13:19:05 +0000 (14:19 +0100)]
resolved: also skip built-in trust anchor addition of there's a DNSKEY RR for the root domain defined
We already skip this when the trust anchor files define a DS RR for the
root domain, now also skip it if there's a DNSKEY RR.
Lennart Poettering [Tue, 5 Jan 2016 13:18:18 +0000 (14:18 +0100)]
resolved: move trust anchor files to /etc/dnssec-trust-anchors.d/
These files are not specific to resolved really, and this is then more
in-line with how /etc/sysctl.d and suchlike is handled.
Lennart Poettering [Tue, 5 Jan 2016 11:51:14 +0000 (12:51 +0100)]
Merge pull request #2205 from pohly/cgroup-smack-run-label
mount-setup.c: fix handling of symlink Smack labelling in cgroup setup
Patrick Ohly [Mon, 21 Dec 2015 13:56:00 +0000 (14:56 +0100)]
mount-setup.c: fix handling of symlink Smack labelling in cgroup setup
The code introduced in
f8c1a81c51 (= systemd 227) failed for me with:
Failed to copy smack label from net_cls to /sys/fs/cgroup/net_cls: No such file or directory
There is no need for a symlink in this case because source and target
are identical. The symlink() call is allowed to fail when the target
already exists. When that happens, copying the Smack label must be
skipped.
But the code also failed when there is a symlink, like "cpu ->
cpu,cpuacct", because mac_smack_copy() got called with
src="cpu,cpuacct" which fails to find the entry because the current
directory is not inside /sys/fs/cgroup. The absolute path to the existing
entry must be used instead.
Lennart Poettering [Tue, 5 Jan 2016 00:42:04 +0000 (01:42 +0100)]
Merge pull request #2268 from whot/hwdb-updates
hwdb: add axis ranges and resolution for Dell Lattitude E6220
Lennart Poettering [Tue, 5 Jan 2016 00:35:28 +0000 (01:35 +0100)]
resolved: when caching negative responses, honour NSEC/NSEC3 TTLs
When storing negative responses, clamp the SOA minimum TTL (as suggested
by RFC2308) to the TTL of the NSEC/NSEC3 RRs we used to prove
non-existance, if it there is any.
This is necessary since otherwise an attacker might put together a faked
negative response for one of our question including a high-ttl SOA RR
for any parent zone, and we'd use trust the TTL.
Lennart Poettering [Mon, 4 Jan 2016 23:31:32 +0000 (00:31 +0100)]
man: add basic documentation for resolved.conf's DNSSEC= switch
Peter Hutterer [Mon, 4 Jan 2016 03:54:11 +0000 (13:54 +1000)]
hwdb: add axis ranges and resolution for Dell Lattitude E6220
https://bugzilla.redhat.com/show_bug.cgi?id=1293576
Lennart Poettering [Mon, 4 Jan 2016 21:43:25 +0000 (22:43 +0100)]
update DNSSEC TODO
Lennart Poettering [Mon, 4 Jan 2016 21:35:54 +0000 (22:35 +0100)]
resolved: explicitly handle case when the trust anchor is empty
Since we honour RFC5011 revoked keys it might happen we end up with an
empty trust anchor, or one where there's no entry for the root left.
With this patch the logic is changed what to do in this case.
Before this patch we'd end up requesting the root DS, which returns with
NODATA but a signed NSEC we cannot verify, since the trust anchor is
empty after all. Thus we'd return a DNSSEC result of "missing-key", as
we lack a verified version of the key.
With this patch in place, look-ups for the root DS are explicitly
recognized, and not passed on to the DNS servers. Instead, if
downgrade-ok mode is on an unsigned NODATA response is synthesized, so
that the validator code continues under the assumption the root zone was
unsigned. If downgrade-ok mode is off a new transaction failure is
generated, that makes this case recognizable.
Lennart Poettering [Mon, 4 Jan 2016 21:35:17 +0000 (22:35 +0100)]
resolved: introduce a proper bus error for DNSSEC validation errors
Lennart Poettering [Mon, 4 Jan 2016 21:25:38 +0000 (22:25 +0100)]
resolved: explicitly avoid cyclic transaction dependencies
We already try hard not to create cyclic transaction dependencies, where
a transaction requires another one for DNSSEC validation purposes, which
in turn (possibly indirectly) pulls in the original transaction again,
thus resulting in a cyclic dependency and ultimately a deadlock since
each transaction waits for another one forever.
So far we wanted to avoid such cyclic dependencies by only going "up the
tree" when requesting auxiliary RRs and only going from one RR type to
another, but never back. However this turned out to be insufficient.
Consider a domain that publishes one or more DNSKEY but which has no DS
for it. A request for the domain's DNSKEY triggers a request for the
domain's DS, which will then fail, but return an NSEC, signed by the
DNSKEY. To validate that we'd request the DNSKEY again. Thus a DNSKEY
request results in a DS request which results in the original DNSKEY
request again. If the original lookup had been a DS lookup we'd end up
in the same cyclic dependency, hence we cannot statically break one of
them, since both requests are of course fully valid. Hence, do full
cyclic dependency checking: each time we are about to add a dependency
to a transaction, check if the transaction is already a dependency of
the dependency (recursively down the tree).
Lennart Poettering [Mon, 4 Jan 2016 21:22:47 +0000 (22:22 +0100)]
resolved: block transaction GC'ing while dns_transaction_request_dnssec_keys() is running
If any of the transactions started by
dns_transaction_request_dnssec_keys() finishes promptly without
requiring asynchronous operation this is reported back to the issuing
transaction from the same stackframe. This might ultimately result in
this transaction to be freed while we are still in its
_request_dnssec_keys() stack frame. To avoid memory corruption block the
transaction GC while in the call, and manually issue a GC after it
returned.
Lennart Poettering [Mon, 4 Jan 2016 19:50:07 +0000 (20:50 +0100)]
update RFCs
Lennart Poettering [Mon, 4 Jan 2016 19:38:21 +0000 (20:38 +0100)]
resolved: partially implement RFC5011 Trust Anchor support
With this patch resolved will properly handle revoked keys, but not
augment the locally configured trust anchor database with newly learned
keys.
Specifically, resolved now refuses validating RRsets with
revoked keys, and it will remove revoked keys from the configured trust
anchors (only until reboot).
This patch does not add logic for adding new keys to the set of trust
anchors. This is a deliberate decision as this only can work with
persistent disk storage, and would result in a different update logic
for stateful and stateless systems. Since we have to support stateless
systems anyway, and don't want to encourage two independent upgrade
paths we focus on upgrading the trust anchor database via the usual OS
upgrade logic.
Whenever a trust anchor entry is found revoked and removed from the
trust anchor a recognizable log message is written, encouraging the user
to update the trust anchor or update his operating system.