Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 22:26:57 +0000 (17:26 -0500)]
sd-ndisc: simplify ndisc_prefix_new
If the initial allocation succeeded, there is no way to
fail, so cleanup function is not necessary.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Jan 2016 22:42:06 +0000 (17:42 -0500)]
sd-device: initialize variables to avoid warning
The code is correct, assuming that the kernel does not feed
us garbled data. Let's initialize those variables to avoid the
warning anyway.
Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 17:42:42 +0000 (12:42 -0500)]
bus-kernel: reword assignment of dst_id in bus_message_setup_kmsg
Setting of dst_id was based on interplay of two booleans,
making the logic hard to follow (for humans and compilers alike).
gcc was confused and emmitted a warning about an uninitialized
variable. Rework the code to make it obvious that dst_id is
set properly.
Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 17:16:02 +0000 (12:16 -0500)]
sd-netlink: remove unused table
Zbigniew Jędrzejewski-Szmek [Fri, 25 Dec 2015 21:29:09 +0000 (16:29 -0500)]
basic: add missing word in comment
Zbigniew Jędrzejewski-Szmek [Tue, 12 Jan 2016 20:36:57 +0000 (15:36 -0500)]
basic/escape: merge utf8 and non-utf8 paths in cunescape_one
Not every byte sequence is valid utf8. We allow escaping of non-utf8
sequences in strings by using octal and hexadecimal escape sequences
(\123 and \0xAB) for bytes at or above 128. Users of cunescape_one
could infer whether such use occured when they received an answer
between 128 and 256 in *ret (a non-ascii one byte character). But this
is subtle and misleading: the comments were wrong, because ascii is a
subset of unicode, so c != 0 did not mean non-unicode, but rather
ascii-subset-of-unicode-or-raw-byte. This was all rather confusing, so
make the "single byte" condition explicit.
I'm not convinced that allowing non-utf8 sequences to be produced is
useful in all cases where we allow it (e.g. in config files), but that
behaviour is unchanged, just made more explicit.
This also fixes an (invalid) gcc warning about unitialized variable
(*ret_unicode) in callers of cunescape_one.
Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 19:37:30 +0000 (14:37 -0500)]
core/dbus-execute: do not needlessly compare strings again
gcc complains that dirs might be unitialized. It cannot, but
we just checked that name has one of three values above, so
no need to check again.
Zbigniew Jędrzejewski-Szmek [Wed, 13 Jan 2016 03:44:44 +0000 (22:44 -0500)]
test-bus-error: add tests for setting error == 0
Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 22:19:25 +0000 (17:19 -0500)]
sd-event: check clock argument to sd_event_now()
sd_event_now() is a public function, so we must check all
arguments for validity. Update man page and add tests.
Sample debug message:
Assertion 'IN_SET(clock, CLOCK_REALTIME, CLOCK_REALTIME_ALARM, CLOCK_MONOTONIC, CLOCK_BOOTTIME, CLOCK_BOOTTIME_ALARM)' failed at src/libsystemd/sd-event/sd-event.c:2719, function sd_event_now(). Ignoring.
Zbigniew Jędrzejewski-Szmek [Wed, 13 Jan 2016 19:23:54 +0000 (14:23 -0500)]
bus-error: verify additional error maps during installation
Go over the entries in the map and check that they make sense.
Tests are added. In the future we might want to do additional
checks, e.g. verifying that the error names are in the expected
format.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Jan 2016 22:19:51 +0000 (17:19 -0500)]
basic,bus-error: return negative error from errno_from_name
errno_from_name used an unusual return convention where 0 meant
"not found". This tripped up config_parse_syscall_errno(),
which would treat that as success. Return -EINVAL instead,
and adjust bus_error_name_to_errno() for the new convention.
Also remove a goto which was used as a simple if and clean
up surroudning code a bit.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Jan 2016 22:25:23 +0000 (17:25 -0500)]
Use negative_errno() to assert errno is positive after a few system calls
This is not particularly intrusive because it happens in simple
utility functions. It helps gcc understand that error codes
are negative.
This gets a rid of most of the remaining warnings.
Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 19:31:14 +0000 (14:31 -0500)]
tree-wide: check if errno is greater than zero (2)
Compare errno with zero in a way that tells gcc that
(if the condition is true) errno is positive.
Zbigniew Jędrzejewski-Szmek [Mon, 11 Jan 2016 17:47:14 +0000 (12:47 -0500)]
tree-wide: check if errno is greater then zero
gcc is confused by the common idiom of
return errno ? -errno : -ESOMETHING
and thinks a positive value may be returned. Replace this condition
with errno > 0 to help gcc and avoid many spurious warnings. I filed
a gcc rfe a long time ago, but it hard to say if it will ever be
implemented [1].
Both conventions were used in the codebase, this change makes things
more consistent. This is a follow up to
bcb161b0230f.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61846
Lennart Poettering [Tue, 12 Jan 2016 22:30:20 +0000 (23:30 +0100)]
Merge pull request #490 from pyssling/master
Add machine-id setting
Nils Carlson [Sun, 5 Jul 2015 22:00:59 +0000 (00:00 +0200)]
core: Add machine-id setting
Allow for overriding all other machine-ids which may be present on
the system using a kernel command line systemd.machine_id or
--machine-id= option.
This is especially useful for network booted systems where the
machine-id needs to be static, or for containers where a specific
machine-id is wanted.
Lennart Poettering [Tue, 12 Jan 2016 19:35:55 +0000 (20:35 +0100)]
Merge pull request #2131 from evverx/regenerate-m4-on-reconfigure
build-sys: regenerate %.m4 -> % on reconfigure
Lennart Poettering [Tue, 12 Jan 2016 18:45:01 +0000 (19:45 +0100)]
Merge pull request #2310 from vcaputo/sd-event-profiling-fixups
sd-event: minor fixups to delays profiling changes
Vito Caputo [Tue, 12 Jan 2016 18:14:33 +0000 (10:14 -0800)]
sd-event: minor fixups to delays profiling changes
Lennart Poettering [Tue, 12 Jan 2016 17:52:30 +0000 (18:52 +0100)]
Merge pull request #2147 from vcaputo/sd-event-measure-latencies
sd-event: instrument sd_event_run() for profiling delays
Vito Caputo [Mon, 7 Dec 2015 19:28:18 +0000 (11:28 -0800)]
sd-event: instrument sd_event_run() for profiling delays
Set SD_EVENT_PROFILE_DELAYS to activate accounting and periodic logging
of the distribution of delays between sd_event_run() calls.
Time spent in dispatching as well as time spent outside of
sd_event_run() is measured and accounted for. Every 5 seconds a
logarithmic histogram loop iteration delays since 5 seconds previous is
logged.
This is useful in identifying the frequency and magnitude of latencies
affecting the event loop, which should be kept to a minimum.
Lennart Poettering [Tue, 12 Jan 2016 15:03:48 +0000 (16:03 +0100)]
Merge pull request #2308 from zonque/xsprintf
tree-wide: use xsprintf() where applicable
Daniel Mack [Tue, 12 Jan 2016 14:34:20 +0000 (15:34 +0100)]
tree-wide: use xsprintf() where applicable
Also add a coccinelle receipt to help with such transitions.
Lennart Poettering [Tue, 12 Jan 2016 14:16:24 +0000 (15:16 +0100)]
Merge pull request #2265 from ipuustin/ambient
capabilities: added support for ambient capabilities.
Daniel Mack [Tue, 12 Jan 2016 14:06:41 +0000 (15:06 +0100)]
Merge pull request #2303 from aadamowski/fix-miscalculated-buffer
Fix miscalculated buffer size and uses of size-unlimited sprintf()
Ismo Puustinen [Mon, 11 Jan 2016 07:36:14 +0000 (09:36 +0200)]
man: add AmbientCapabilities entry.
Ismo Puustinen [Tue, 5 Jan 2016 11:34:41 +0000 (13:34 +0200)]
tests: test ambient capabilities.
The ambient capability tests are only run if the kernel has support for
ambient capabilities.
Ismo Puustinen [Thu, 31 Dec 2015 12:54:44 +0000 (14:54 +0200)]
capabilities: added support for ambient capabilities.
This patch adds support for ambient capabilities in service files. The
idea with ambient capabilities is that the execed processes can run with
non-root user and get some inherited capabilities, without having any
need to add the capabilities to the executable file.
You need at least Linux 4.3 to use ambient capabilities. SecureBit
keep-caps is automatically added when you use ambient capabilities and
wish to change the user.
An example system service file might look like this:
[Unit]
Description=Service for testing caps
[Service]
ExecStart=/usr/bin/sleep 10000
User=nobody
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
After starting the service it has these capabilities:
CapInh:
0000000000003000
CapPrm:
0000000000003000
CapEff:
0000000000003000
CapBnd:
0000003fffffffff
CapAmb:
0000000000003000
Ismo Puustinen [Thu, 7 Jan 2016 22:00:04 +0000 (00:00 +0200)]
capabilities: keep bounding set in non-inverted format.
Change the capability bounding set parser and logic so that the bounding
set is kept as a positive set internally. This means that the set
reflects those capabilities that we want to keep instead of drop.
Lennart Poettering [Tue, 12 Jan 2016 01:03:23 +0000 (02:03 +0100)]
Merge pull request #2290 from vcaputo/normalize-log-source-priorities
journal: normalize priority of logging sources
Aleksander Adamowski [Mon, 11 Jan 2016 23:26:41 +0000 (15:26 -0800)]
Fix miscalculated buffer size and uses of size-unlimited sprintf()
function.
Not sure if this results in an exploitable buffer overflow, probably not
since the the int value is likely sanitized somewhere earlier and it's
being put through a bit mask shortly before being used.
Tom Gundersen [Mon, 11 Jan 2016 20:31:53 +0000 (21:31 +0100)]
Merge pull request #2289 from poettering/dnssec13
Thirteenth DNSSEC patch set
Lennart Poettering [Mon, 11 Jan 2016 19:19:10 +0000 (20:19 +0100)]
resolved: improve query RR type error wording a bit
Lennart Poettering [Mon, 11 Jan 2016 19:15:28 +0000 (20:15 +0100)]
resolved: don#t allow explicit queries for RRSIG RRs
We wouldn't know how to validate them, since they are the signatures, and hence have no signatures.
Lennart Poettering [Mon, 11 Jan 2016 19:05:29 +0000 (20:05 +0100)]
resolved: refuse doing queries for known-obsolete RR types
Given how fragile DNS servers are with some DNS types, and given that we really should avoid confusing them with
known-weird lookups, refuse doing lookups for known-obsolete RR types.
Lennart Poettering [Mon, 11 Jan 2016 18:38:25 +0000 (19:38 +0100)]
resolved: rename DnsTransaction's current_features field to current_feature_level
This is a follow-up for
f4461e5641d53f27d6e76e0607bdaa9c0c58c1f6.
Lennart Poettering [Mon, 11 Jan 2016 17:57:59 +0000 (18:57 +0100)]
resolved: split out resetting of DNS server counters into a function call of its own
A suggested by Vito Caputo:
https://github.com/systemd/systemd/pull/2289#discussion-diff-
49276220
Lennart Poettering [Sun, 10 Jan 2016 22:02:52 +0000 (23:02 +0100)]
resolved: accept rightfully unsigned NSEC responses
Lennart Poettering [Sun, 10 Jan 2016 21:58:58 +0000 (22:58 +0100)]
resolved: rework how and when we detect whether our chosen DNS server knows DNSSEC
Move detection into a set of new functions, that check whether one specific server can do DNSSEC, whether a server and
a specific transaction can do DNSSEC, or whether a transaction and all its auxiliary transactions could do so.
Also, do these checks both before we acquire additional RRs for the validation (so that we can skip them if the server
doesn't do DNSSEC anyway), and after we acquired them all (to see if any of the lookups changed our opinion about the
servers).
THis also tightens the checks a bit: a server that lacks TCP support is considered incompatible with DNSSEC too.
Lennart Poettering [Fri, 8 Jan 2016 19:59:03 +0000 (20:59 +0100)]
resolved: cache formatted server string in DnsServer structure
This makes it easier to log information about a specific DnsServer object.
Lennart Poettering [Fri, 8 Jan 2016 17:50:41 +0000 (18:50 +0100)]
resolved: rework server feature level logic
This changes the DnsServer logic to count failed UDP and TCP failures separately. This is useful so that we don't end
up downgrading the feature level from one UDP level to a lower UDP level just because a TCP connection we did because
of a TC response failed.
This also adds accounting of truncated packets. If we detect incoming truncated packets, and count too many failed TCP
connections (which is the normal fall back if we get a trucnated UDP packet) we downgrade the feature level, given that
the responses at the current levels don't get through, and we somehow need to make sure they become smaller, which they
will do if we don't request DNSSEC or EDNS support.
This makes resolved work much better with crappy DNS servers that do not implement TCP and only limited UDP packet
sizes, but otherwise support DNSSEC RRs. They end up choking on the generally larger DNSSEC RRs and there's no way to
retrieve the full data.
Lennart Poettering [Fri, 8 Jan 2016 17:50:15 +0000 (18:50 +0100)]
resolved: add missing case to switch statement
Lennart Poettering [Fri, 8 Jan 2016 16:18:54 +0000 (17:18 +0100)]
resolved: log why we use TCP when UDP isn't supported by a server
Lennart Poettering [Fri, 8 Jan 2016 16:16:32 +0000 (17:16 +0100)]
resolved: log about truncated replies before trying again, not after
Lennart Poettering [Fri, 8 Jan 2016 16:10:49 +0000 (17:10 +0100)]
resolved: don't attempt to send queries for DNSSEC RR types to servers not supporting them
If we already degraded the feature level below DO don't bother with sending requests for DS, DNSKEY, RRSIG, NSEC, NSEC3
or NSEC3PARAM RRs. After all, we cannot do DNSSEC validation then anyway, and we better not press a legacy server like
this with such modern concepts.
This also has the benefit that when we try to validate a response we received using DNSSEC, and we detect a limited
server support level while doing so, all further auxiliary DNSSEC queries will fail right-away.
Lennart Poettering [Fri, 8 Jan 2016 15:17:43 +0000 (16:17 +0100)]
resolved: log about reasons for switching to TCP
Lennart Poettering [Fri, 8 Jan 2016 01:46:59 +0000 (02:46 +0100)]
resolved: when we get a packet failure from a server, don't downgrade UDP to TCP or vice versa
Under the assumption that packet failures (i.e. FORMERR, SERVFAIL, NOTIMP) are caused by packet contents, not used
transport, we shouldn't switch between UDP and TCP when we get them, but only downgrade the higher levels down to UDP.
Lennart Poettering [Fri, 8 Jan 2016 01:38:00 +0000 (02:38 +0100)]
resolved: properly handle UDP ICMP errors as lost packets
UDP ICMP errors are reported to us via recvmsg() when we read a reply. Handle this properly, and consider this a lost
packet, and retry the connection.
This also adds some additional logging for invalid incoming packets.
Lennart Poettering [Fri, 8 Jan 2016 01:33:54 +0000 (02:33 +0100)]
resolved: when we get a TCP connection failure, try again
Previously, when we couldn't connect to a DNS server via TCP we'd abort the whole transaction using a
"connection-failure" state. This change removes that, and counts failed connections as "lost packet" events, so that
we switch back to the UDP protocol again.
Lennart Poettering [Fri, 8 Jan 2016 01:29:02 +0000 (02:29 +0100)]
resolved: when DNS/TCP doesn't work, try DNS/UDP again
If we failed to contact a DNS server via TCP, bump of the feature level to UDP again. This way we'll switch back
between UDP and TCP if we fail to contact a host.
Generally, we prefer UDP over TCP, which is why UDP is a higher feature level. But some servers only support UDP but
not TCP hence when reaching the lowest feature level of TCP and want to downgrade from there, pick UDP again. We this
keep downgrading until we reach TCP and then we cycle through UDP and TCP.
Lennart Poettering [Fri, 8 Jan 2016 01:26:53 +0000 (02:26 +0100)]
resolved: introduce dns_transaction_retry() and use it everywhere
The code to retry transactions has been used over and over again, simplify it by replacing it by a new function.
Lennart Poettering [Fri, 8 Jan 2016 01:20:39 +0000 (02:20 +0100)]
resolved: set a description on all our event sources
Lennart Poettering [Fri, 8 Jan 2016 01:19:43 +0000 (02:19 +0100)]
resolved: fix error propagation
Lennart Poettering [Fri, 8 Jan 2016 00:11:55 +0000 (01:11 +0100)]
shared: make sure foo.bar and foobar result in different domain name hashes
This also introduces a new macro siphash24_compress_byte() which is useful to add a single byte into the hash stream,
and ports one user over to it.
Lennart Poettering [Fri, 8 Jan 2016 00:10:45 +0000 (01:10 +0100)]
basic: split hash functions into their own header files
The hash operations are not really that specific to hashmaps, hence split them into a .c module of their own.
Lennart Poettering [Thu, 7 Jan 2016 23:24:06 +0000 (00:24 +0100)]
editors: specify fill column
Let's be a bit more precise with the editor configuration and specify a higher fill column of 119. This isn't as emacs'
default of 70, but also not particularly high on today's screens.
While we are at it, also set a couple of other emacs C coding style variables.
Lennart Poettering [Thu, 7 Jan 2016 21:27:33 +0000 (22:27 +0100)]
resolved: properly look for NSEC/NSEC3 RRs when getting a positive wildcard response
This implements RFC 5155, Section 8.8 and RFC 4035, Section 5.3.4:
When we receive a response with an RRset generated from a wildcard we
need to look for one NSEC/NSEC3 RR that proves that there's no explicit RR
around before we accept the wildcard RRset as response.
This patch does a couple of things: the validation calls will now
identify wildcard signatures for us, and let us know the RRSIG used (so
that the RRSIG's signer field let's us know what the wildcard was that
generate the entry). Moreover, when iterating trough the RRsets of a
response we now employ three phases instead of just two.
a) in the first phase we only look for DNSKEYs RRs
b) in the second phase we only look for NSEC RRs
c) in the third phase we look for all kinds of RRs
Phase a) is necessary, since DNSKEYs "unlock" more signatures for us,
hence we shouldn't assume a key is missing until all DNSKEY RRs have
been processed.
Phase b) is necessary since NSECs need to be validated before we can
validate wildcard RRs due to the logic explained above.
Phase c) validates everything else. This phase also handles RRsets that
cannot be fully validated and removes them or lets the transaction fail.
Lennart Poettering [Thu, 7 Jan 2016 21:22:41 +0000 (22:22 +0100)]
resolved: split up nsec3_hashed_domain() into two calls
There's now nsec3_hashed_domain_format() and nsec3_hashed_domain_make().
The former takes a hash value and formats it as domain, the latter takes
a domain name, hashes it and then invokes nsec3_hashed_domain_format().
This way we can reuse more code, as the formatting logic can be unified
between this call and another place.
Lennart Poettering [Thu, 7 Jan 2016 21:19:12 +0000 (22:19 +0100)]
resolved: drop flags unused parameter from nsec3_is_good
Lennart Poettering [Thu, 7 Jan 2016 19:33:31 +0000 (20:33 +0100)]
resolved: when validating, first strip revoked trust anchor keys from validated keys list
When validating a transaction we initially collect DNSKEY, DS, SOA RRs
in the "validated_keys" list, that we need for the proofs. This includes
DNSKEY and DS data from our trust anchor database. Quite possibly we
learn that some of these DNSKEY/DS RRs have been revoked between the
time we request and collect those additional RRs and we begin the
validation step. In this case we need to make sure that the respective
DS/DNSKEY RRs are removed again from our list. This patch adds that, and
strips known revoked trust anchor RRs from the validated list before we
begin the actual validation proof, and each time we add more DNSKEY
material to it while we are doing the proof.
Lennart Poettering [Thu, 7 Jan 2016 19:07:44 +0000 (20:07 +0100)]
shared: simplify dns_name_hash_func() end of name detection
Lennart Poettering [Thu, 7 Jan 2016 18:43:56 +0000 (19:43 +0100)]
resolved: make sure domain name hash function deals nicely with NUL embedded in labels
Lennart Poettering [Thu, 7 Jan 2016 18:43:26 +0000 (19:43 +0100)]
basic: introduce generic ascii_strlower_n() call and make use of it everywhere
Lennart Poettering [Thu, 7 Jan 2016 16:03:31 +0000 (17:03 +0100)]
resolved: rework trust anchor revoke checking
Instead of first iterating through all DNSKEYs in the DnsAnswer in
dns_transaction_check_revoked_trust_anchors(), and
then doing that a second time in dns_trust_anchor_check_revoked(), do so
only once in the former, and pass the dnskey we found directly to the
latter.
Lennart Poettering [Thu, 7 Jan 2016 11:56:38 +0000 (12:56 +0100)]
resolved: look for revoked trust anchors before validating a message
There's not reason to wait for checking for revoked trust anchors until
after validation, after all revoked DNSKEYs only need to be self-signed,
but not have a full trust chain.
This way, we can be sure that all trust anchor lookups we do during
validation already honour that some keys might have been revoked.
Lennart Poettering [Thu, 7 Jan 2016 11:47:07 +0000 (12:47 +0100)]
resolved: use dns_answer_size() where appropriate to handle NULL DnsAnswer
Lennart Poettering [Thu, 7 Jan 2016 11:45:38 +0000 (12:45 +0100)]
resolved: remove one level of indentation in dns_transaction_validate_dnssec()
Invert an "if" check, so that we can use "continue" rather than another
code block indentation.
Lennart Poettering [Thu, 7 Jan 2016 11:42:48 +0000 (12:42 +0100)]
resolved: be less strict where the OPT pseudo-RR is placed
This increases compatibility with crappy Belkin routers.
Lennart Poettering [Thu, 7 Jan 2016 11:40:59 +0000 (12:40 +0100)]
resolved: rename suffix_rr → zone_rr
The domain name for this NSEC3 RR was originally stored in a variable
called "suffix", which was then renamed to "zone" in
d1511b3338f431de3c95a50a9c1aca297e0c0734. Hence also rename the
RR variable accordingly.
Lennart Poettering [Thu, 7 Jan 2016 00:21:00 +0000 (01:21 +0100)]
resolved: fix NSEC3 iterations limit to what RFC5155 suggests
Lennart Poettering [Mon, 11 Jan 2016 16:30:15 +0000 (17:30 +0100)]
Merge pull request #2262 from pohly/smack-network
smack: Handling network
Lennart Poettering [Mon, 11 Jan 2016 16:26:30 +0000 (17:26 +0100)]
Merge pull request #2301 from martinpitt/kmod-static-condition
kmod-static-nodes: don't run if module list is empty
Daniel Mack [Mon, 11 Jan 2016 15:56:22 +0000 (16:56 +0100)]
Merge pull request #2302 from arthur-c/master
doc typo, src: systemd/src/journal-remote/journal-gatewayd.c
Lennart Poettering [Mon, 11 Jan 2016 15:45:26 +0000 (16:45 +0100)]
Merge pull request #2294 from zonque/in_set
macro.h: improve IN_SET helper macro
Arthur Clement [Mon, 11 Jan 2016 15:38:35 +0000 (16:38 +0100)]
doc typo, src: systemd/src/journal-remote/journal-gatewayd.c
Martin Pitt [Mon, 11 Jan 2016 15:26:17 +0000 (16:26 +0100)]
kmod-static-nodes: don't run if module list is empty
With this kmod commit, modules.devname will be empty by default instead of
containing just a comment:
https://git.kernel.org/cgit/utils/kernel/kmod/kmod.git/commit/?id=
4c30a11d5f
Refine the startup condition of kmod-static-nodes.service to not run needlessly
if the list is empty.
Tom Gundersen [Mon, 11 Jan 2016 12:17:15 +0000 (13:17 +0100)]
Merge pull request #2293 from zonque/issue-2292
sd-netlink: fix assert
Daniel Mack [Mon, 11 Jan 2016 12:13:25 +0000 (13:13 +0100)]
Merge pull request #2296 from dankor/master
Updated Ukrainian translation
Daniel Korostil [Mon, 11 Jan 2016 11:55:48 +0000 (13:55 +0200)]
Updated Ukrainian translation
Daniel Mack [Sun, 10 Jan 2016 17:11:22 +0000 (18:11 +0100)]
macro.h: provide a switch-case statement generator for IN_SET
Rather than walking a list of valid values one-by-one, generate a
switch-case statement for the IN_SET() macro. This allows the compiler to
further optimize its code output, possibly by generating jump tables.
This effectively decreases the binary size slightly.
The implementation is based on macro overloading depending on the number of
arguments. h/t to the following post:
https://stackoverflow.com/questions/
11761703/overloading-macro-on-number-of-arguments
Casey Schaufler [Fri, 8 Nov 2013 17:42:26 +0000 (09:42 -0800)]
smack: Handling network
- Set Smack ambient to match run label
- Set Smack netlabel host rules
Set Smack ambient to match run label
------------------------------------
Set the Smack networking ambient label to match the
run label of systemd. System services may expect to
communicate with external services over IP. Setting
the ambient label assigns that label to IP packets
that do not include CIPSO headers. This allows systemd
and the services it spawns access to unlabeled IP
packets, and hence external services.
A system may choose to restrict network access to
particular services later in the startup process.
This is easily done by resetting the ambient label
elsewhere.
Set Smack netlabel host rules
-----------------------------
If SMACK_RUN_LABEL is defined set all other hosts to be
single label hosts at the specified label. Set the loopback
address to be a CIPSO host.
If any netlabel host rules are defined in /etc/smack/netlabel.d
install them into the smackfs netlabel interface.
[Patrick Ohly: copied from https://review.tizen.org/git/?p=platform/upstream/systemd.git;a=commit;h=
db4f6c9a074644aa2bf]
[Patrick Ohly: adapt to write_string_file() change in "fileio: consolidate write_string_file*()"]
[Patrick Ohly: create write_netlabel_rules() based on the original write_rules() that was removed in "smack: support smack access change-rule"]
[Patrick Ohly: adapted to upstream code review feedback: error logging, string constants]
Daniel Mack [Sun, 10 Jan 2016 17:10:08 +0000 (18:10 +0100)]
tree-wide: unify argument lists of IN_SET()
The new implementation will not allow passing the same values more than
once, so clean up first.
Daniel Mack [Sun, 10 Jan 2016 14:36:03 +0000 (15:36 +0100)]
sd-netlink: fix assert
nl->fd can be 0.
Vito Caputo [Fri, 8 Jan 2016 20:11:44 +0000 (12:11 -0800)]
journal: normalize priority of logging sources
The stream event source has a priority of SD_EVENT_PRIORITY_NORMAL+5,
and stdout source +10, but the native and syslog event sources are left
at the default of 0.
As a result, any heavy native or syslog logger can cause starvation of
the other loggers. This is trivially demonstrated by running:
dd if=/dev/urandom bs=8k | od | systemd-cat & # native spammer
systemd-run echo hello & # stream logger
journalctl --follow --output=verbose --no-pager --identifier=echo &
... and wait, and wait, the "hello" never comes.
Now kill %1, "hello" arrives finally.
Daniel Mack [Fri, 8 Jan 2016 08:25:21 +0000 (09:25 +0100)]
Merge pull request #2287 from dandedrick/journal-gatewayd-timeout-fix
journal-gatewayd: timeout journal wait to allow thread cleanup
Daniel Mack [Thu, 7 Jan 2016 16:40:42 +0000 (17:40 +0100)]
Merge pull request #2285 from evverx/fix-test-resolve
tests: test-resolve: wait until all queries are completed
Lennart Poettering [Thu, 7 Jan 2016 15:13:14 +0000 (16:13 +0100)]
Merge pull request #2284 from teg/resolved-cname-2
resolved: query_process_cname - make fully recursive
Evgeny Vereshchagin [Thu, 7 Jan 2016 14:03:05 +0000 (14:03 +0000)]
tests: test-resolve: wait until all queries are completed
This is a follow-up for
4a134c4903dbf6ef6c6a
Fixes:
$ ./test-resolve
209.132.183.105:80
209.132.183.105:80
canonical name: n/a
193.99.144.85:0
[2a02:2e0:3fe:1001:7777:772e:2:85]:0
canonical name: www.heise.de
Host: web.heise.de -- Serv: http
$ ./test-resolve
193.99.144.85:0
[2a02:2e0:3fe:1001:7777:772e:2:85]:0
canonical name: www.heise.de
Host: web.heise.de -- Serv: http
$ ./test-resolve
...
Tom Gundersen [Thu, 7 Jan 2016 14:05:58 +0000 (15:05 +0100)]
Merge pull request #2276 from poettering/dnssec12
Twelfth DNSSEC PR
Tom Gundersen [Tue, 5 Jan 2016 16:56:45 +0000 (17:56 +0100)]
resolved: query_process_cname - make fully recursive
This ensures we properly resolve the CNAME chain as far as we can, rather
than only CNAME chains of length one.
Daniel Mack [Thu, 7 Jan 2016 11:02:38 +0000 (12:02 +0100)]
Merge pull request #2283 from evverx/update-valgrind-tests
build-sys: valgrind-tests: exclude python scripts too
Evgeny Vereshchagin [Thu, 7 Jan 2016 10:01:45 +0000 (10:01 +0000)]
build-sys: valgrind-tests: exclude python scripts too
Lennart Poettering [Wed, 6 Jan 2016 17:39:08 +0000 (18:39 +0100)]
update DNSSEC TODO
Lennart Poettering [Wed, 6 Jan 2016 17:36:32 +0000 (18:36 +0100)]
resolved: introduce support for per-interface negative trust anchors
Daniel Mack [Wed, 6 Jan 2016 13:56:14 +0000 (14:56 +0100)]
nspawn: fix two typos in error messages
On errors, mention the functions that really failed.
Daniel Mack [Wed, 6 Jan 2016 12:53:29 +0000 (13:53 +0100)]
Merge pull request #2137 from fbuihuu/fstab-gen-fix-device-timeout
Fstab gen fix device timeout
Daniel Mack [Wed, 6 Jan 2016 12:36:15 +0000 (13:36 +0100)]
Merge pull request #2261 from evverx/fix-test-rlimit-util
tests: don't change hard limit in test-rlimit-util
Daniel Mack [Wed, 6 Jan 2016 11:56:56 +0000 (12:56 +0100)]
Merge pull request #2243 from evverx/add-regression-test-for-journald-restart
tests: add regression test for `systemctl restart systemd-journald`
Daniel Mack [Wed, 6 Jan 2016 11:10:22 +0000 (12:10 +0100)]
Merge pull request #2273 from evverx/fix-possible-lost-in-test-bus-cleanup
tests: use sd_bus_flush_close_unref instead of sd_bus_unref in test-bus-cleanup
Daniel Mack [Wed, 6 Jan 2016 11:09:43 +0000 (12:09 +0100)]
Merge pull request #2278 from systemd-mailing-devs/
1452047873-6043-1-git-send-email-hui.wang@canonical.com
keymap: remap microphone mute keycode for Lenovo Thinkcentre M800z